Digital sovereignty foretold

The current nexus of technology and politics in the United States has produced multiple ripple effects.  The rapid growth of resource-hungry AI infrastructure across the US has provoked a broad and popular anti-datacentre movement, for instance.  Another defining feature of Trump’s second presidency has been its zero-sum foreign policy, which has often included a digital dimension: from pressuring allies to dump regulations that irk the US tech sector; restrictions on digital hardware designed to stifle China’s national ambitions; or leveraging access to foundational US tech services (for example, Microsoft in the case of the ICC).  The ripple effect emanating from these developments has been a renewed push for forms of digital sovereignty by assailed governments across the world.

Digital sovereignty most often refers to reasserting the primacy of the state in matters of internet governance, as well as prioritising national autonomy and independence in infrastructural projects.  Digital sovereignty is no monolith, however, and takes on diverse ideological hues and material dimensions depending on whether it is being asserted by an authoritarian state, a post-colonial society or a pan-continental organisation such as the European Union.  Concrete examples of policy initiatives launched under the banner of digital sovereignty include Senegal’s 2021 data localisation laws, the EU’s ongoing investments in frontier technologies and Canada’s 2025 launch of a ‘sovereign cloud’.

However, responsibility for these initiatives cannot be laid entirely at the door of the Trump administration.  China’s efforts at legislating national network security date back to the 1990s, after all.¹ Meanwhile, across the democratic world, the impetus for digital sovereignty stems from longer-standing concerns about the invasive data collection practices of US platform companies,² as well as startling levels of market concentration in search, social media, app stores and operating systems.³ Casting our gaze back a little further though, we can observe that a singular event in 2013 elevated digital sovereignty from obscurity to the top of the policy agenda for many countries across the world. 

A moment of reckoning

The Edward Snowden revelations of dragnet digital surveillance by the United States’ National Security Agency (NSA) in 2013 have been widely recognised as a moment of rupture, a turning point at which a shared common sense of a borderless internet and deregulated cyberspace was no longer taken for granted. This was a moment of reckoning for many countries in their regulation of the internet and their considerations of national sovereignty.  This was particularly the case for the European Union, especially Germany, as well as India and the creation of its Digital India programme in 2015.⁴

What may not be as well known is how we can trace this pivotal moment back to an instance of internet policymaking that was heralded at the time, but now largely forgotten, and what it foretold about our present moment.  Brazil’s Marco Civil da Internet (Civil Framework for the Internet) was a pioneering bill of digital rights, one of the world’s first efforts at creating a comprehensive and civically oriented piece of internet regulation. It too owed a foundational debt to the seismic fallout from the Snowden revelations.

Wounded sovereignty, data localisation and Edward Snowden

The Marco Civil was passed into law in Brazil in 2014, under the government of Dilma Rousseff, and was regulated ten years ago in 2016, in what proved to be one of Rousseff’s last acts before Lula da Silva’s ill-fated successor was toppled in a legislative coup-d’état.  Upon congressional approval in April 2014, the Marco Civil was feted internationally as ‘the best possible birthday present for Brazilian and global web users’⁵ and a ‘Magna Carta for the Web’.⁶ The framework was built on a four-part structure of network neutrality, limited liability for web platforms (as a proxy for user freedom of expression), data protections and access provisions.  Before its eventual passage into law, the Marco Civil had undergone a torturous six-year journey through two rounds of public consultation, multi-stakeholder input from corporations, civil society and governmental organisations, and dozens of debates and votes in the Brazilian Congress. 

In its early incarnations, the bill had proved to be highly contentious, as it was considered threatening to the business interests of powerful economic groups in Brazil but was also tightly embraced by civil society organisations in the country.  The telecommunications sector in Brazil, for instance, staunchly opposed network neutrality as they argued it would limit their capacity to develop new business models, while traditional media, such as the Globo Group, lobbied hard to ensure that freedom of expression for Brazilian citizens would not preclude the removal of online content that violated copyright.

Meanwhile, for communication rights organisations, the Marco Civil was an opportunity not only to ensure that the internet would avoid the fate of government repression that befell earlier media systems under the military dictatorship, but also to try and evade the suffocating market concentration and control that characterised Brazil’s traditional media sector.

By the middle of 2013 the various forces disputing the Marco Civil had arrived at a deadlock and the bill appeared in danger of never becoming law. (The Marco Civil was subject to 10 aborted congressional votes in 2013 and a further 14 in 2014: a clear metric for the strength of the telecoms and media sectors’ political influence.) This all changed, however, on 1 September 2013, when the newspaper, O Globo, published proof, provided by Edward Snowden via the American journalist, Glenn Greenwald, that the NSA had intercepted the official communications of President Dilma Rousseff.⁷ The scandal escalated further when on 8 September, the same line of communication between Snowden, Greenwald and the Globo media organisation yielded revelations that the Brazilian state oil company, Petrobras, had also been the target of US state surveillance. Documents included in an internal NSA presentation showed how the agency was using new cryptographic techniques provided by Google Brazil to monitor secure corporate networks, including those of Petrobras. This news contradicted earlier statements by the NSA that they did not partake in industrial espionage. 

It took just 24 hours from the first Snowden revelations published by Globo on 7 July for the then Minister of Institutional Relations, Ideli Salvatti, to react.  She stated that ‘it is absolutely clear that the sovereignty of the country and the privacy of the Brazilian citizen is under threat’ and revealed that the government was studying proposals for a policy response to the NSA surveillance to be included in the Marco Civil.  The measures constituted an extraordinary expansion in the scope of the bill: a new clause mandating the storage of Brazilian user data on Brazilian territory by any commercial application provider. This clause included two stipulations: that any communication occurring on these platforms, in which one participant was based in Brazil, would also be stored locally; and that Brazilian legislation would also apply in cases where Brazilian user data was stored outside the country.  These measures became known collectively as ‘data localisation’ and they proved to be one of the most contentious proposals to be added to the Marco Civil. 

What the Justice Minister Cardozo later described as ‘national data sovereignty’ was not only embodied in the data localisation amendment, however.  In September 2013, General Sinclair Mayer, head of the Brazilian Army’s science and technology department, announced to lawmakers that Brazil would establish underwater internet cables linking Brazil to Europe and to Africa in an effort to divert internet traffic passing through the United States.  Existing submarine infrastructure channelled around 90 per cent of all outbound internet traffic from Central and South America through one datacentre in Miami named the Network Access Point of the Americas. Bypassing this surveillance choke point in the United States became an obvious policy target for Rousseff after the Snowden revelations.

Finally, another related policy proposal that emerged in response to the Snowden revelations was a national email program.  Conceived initially as a parallel measure to the Marco Civil rather than as an amendment to it, the service was named ‘Digital Messenger’.  According to the Minister of Communications, Paulo Bernardo, a national email service with local storage and cryptographic standards was essential in the wake of the revelations of NSA surveillance. 

The platforms react

In isolation, the data localisation measures proposed by the Brazilian government would have represented an operational nuisance for the US web platforms that they were designed to target.  However, the fear was that other governments would see the opportunity in the wake of the Snowden revelations to roll out their own data localisation measures and in this case, Brazil would constitute simply the first in a cascade. Google CEO Eric Schmidt articulated this at an event in New York in September 2013 when he declared that: ‘The real danger…is that other countries will begin…to essentially split the internet and that the internet’s going to be much more country specific. That would be a very bad thing, it would really break the way the internet works, and I think that’s what I worry about.’

Accordingly, the web platforms embarked on a campaign of lobbying to try and persuade the Brazilian government to withdraw the data localisation amendment. Representatives of the major US web platforms increased their presence in Brasília, conducting meetings with legislators, presenting at senate and congressional committees and giving interviews to the press.

What was not publicly known was the extent to which the US platforms were willing to go to prevent Brazil from including data localisation measures in the Marco Civil. According to an executive at a US web platform company: ‘Every US company actually gave the order from HQ to all of the policy folks on the ground here…everybody that you can think of, if it comes to that we prefer you to nuke the entire bill, we prefer to lose the safe harbours that we are going to get than have to comply with this craziness of data localisation.’⁸

In spite of the ferocious lobbying campaign, President Rousseff at this time felt acute political pressure to respond to the US violation of Brazil’s digital sovereignty and also to shore up plummeting approval ratings. Accordingly, in late 2013, Rousseff elected to apply ‘constitutional urgency’ to the Marco Civil bill, meaning that no other measure could pass through Congress for a span of 45 days until the Marco Civil was approved.  Meanwhile, in some fortuitous timing, on 24 September Brazil was due to make the inaugural statement at the opening of the 68th session of the UN General Assembly in New York. This would give Rousseff a global stage on which to deliver a fitting riposte to the United States, as well as to propel the Marco Civil to a final resolution.

Brazil as a global champion

At the famous UN lectern, although Rousseff did make mention of adopting ‘technologies and mechanisms’ to prevent the interception of sensitive data, instead of announcing infrastructural and legislative measures to shore up Brazil’s digital sovereignty, it was on the venerable language of human rights – the lingua franca of the United Nations – that Rousseff leaned most heavily. She proposed ‘a civilian multilateral framework for the governance and use of the internet’ that was premised largely on the framework of the Marco Civil and thus positioned Brazil as a global champion of digital rights.

Back in Brazil, by early 2014, amidst mounting pressure from civil society, an uneasy deadlock of corporate interests and the looming deadline of Brazil’s hosting of the NETMundial summit at which the government intended to announce the Marco Civil to the world, the conditions were finally set for the framework to be passed into law.

For digital sovereignty measures to receive public support, the sovereign authority must be accountable to its citizenry

What are the lessons then that we can draw from the Marco Civil da Internet in terms of digital rights and digital sovereignty?

One is that for digital sovereignty measures to receive public support, the sovereign authority must be accountable to its citizenry and the measures must advance the public interest.  As the internet governance scholars, Pohle, Nanni and Santaniello, remind us, digital sovereignty often means ‘creating central control points for digital infrastructures and applications’.⁹In the case of the Marco Civil, a Brazilian population scarred by memories of the country’s recent history of military dictatorship and represented by an assertive civil society, was not willing to trust its government to create ‘central control points’ in the form of data localisation and a national email system. Both were quietly abandoned, with this opposition proving decisive.

Another lesson is that Brazil’s aborted attempt to establish digital sovereignty in favour of promoting digital rights influenced the global policy agenda, with the Marco Civil held up as an inspiration for national legislation, such as in the case of Italy, and for innumerable multi-stakeholder initiatives. Arguably, it required the outrage and upheaval generated by the so-called ‘techlash’ – popular awareness of the destructive impacts of ‘big tech’ platforms – for the paradigm of digital rights premised on the individualised protection of expression, creativity and freedom to be superseded by more systemic, interventionist measures.  These include the EU’s landmark General Data Protection Regulation (GDPR), Germany’s Network Enforcement Act, as well as Neo-Brandeisian (antitrust) proposals in the US under the Biden administration.

Finally, and returning to Pohle, Nanni and Santaniello, efforts at advancing digital sovereignty need to be understood in the context of ‘long term historical processes’ and ‘structural relationships’, not as isolated incidents. Such a perspective focuses our attention on the particularities and intricacies of digital sovereignty in its proper context. Brazil’s long history of global economic marginality, recent history of military repression, sensitivity to American state interference and its highly concentrated and controlled media sector, all shaped its creation of digital rights, as well as its stillborn attempts at digital sovereignty. 

The ‘structural relationships’ also guide our gaze onto the corporate manoeuvres and political economic configurations that were pivotal in giving a final form to Brazil’s digital rights framework. Brazil’s powerful telecommunications sector and Globo media group exerted tremendous influence on the final form of the Marco Civil, while US web platforms were also very active in their lobbying efforts.  Such attempts to block or reshape legislation considered harmful to the interests of US platform companies have become increasingly overt. We have seen the ‘lobbying playbook’¹⁰ manifest in multiple episodes where national legislatures and regulators attempt to put a check on platform power, from Australia’s News Media and Digital Platforms Mandatory Bargaining Code, and back to Brazil and its recent efforts to create an AI Law.¹¹

Given the wrenching changes threatened by artificial intelligence across swathes of the global economy and national societies, we might do well to heed the lessons of the Marco Civil as we attempt to assert fundamental rights and protect national digital sovereignty.

Guy Hoskins was awarded the 2026 CCA Emerging Scholar Book Award for his book, Digital Rights at the Periphery: Making Brazil’s Marco Civil, available from University of Illinois Press.