Kurdistan Center
for Democracy in the Middle East
Khoyboun Flag
About us
www.kcdme.com
Digital empires and West Asia’s hidden battle for data sovereignty
West Asia is investing billions in local clouds and AI, but foreign firms still control the platforms and legal frameworks that can turn digital infrastructure into a tool of external influence.
06.08.2026
By Kamran Yeganegi
Source:https://thecradle.co/articles/digital-empires-and-west-asias-hidden-battle-for-data-sovereignty
On 10 June 2025, two senior Microsoft France executives appeared before a French Senate commission investigating public procurement and digital sovereignty.
The hearing appeared routine until the central question was put to Microsoft.
Could it guarantee that French citizens’ data, even when hosted in France, would never be transferred to a foreign authority without the French government’s consent?
Anton Carniaux, Microsoft France’s director of public and legal affairs, gave a six-word answer: “No, I cannot guarantee that.”
The admission cut through years of corporate language about “local cloud regions,” “trusted infrastructure,” and “data residency.” France could host the servers, French citizens could generate the data, and French institutions could pay for the service. Yet ultimate authority might still be exercised elsewhere.
The French Senate concluded that Microsoft could not guarantee sovereignty over the data it hosted. That exchange exposed a global reality with profound consequences for West Asia: the physical location of data is no longer the same as its political location.
The map that servers conceal
Traditional geography teaches that power occupies territory. Oil belongs to the state beneath whose soil it lies. Ports fall under the authority of the country on whose coast they are built. Pipelines are governed by the borders they cross.
Data follows a different geography.
A medical record may be created in Riyadh, stored in Bahrain, processed by an algorithm trained in the US, and administered through a European subsidiary. Which country truly controls it?
The conventional answer is that data belongs to the individual, company, or government that generated it. In practice, ownership matters less than control. Real power lies with those capable of accessing, processing, transferring, restricting, or legally compelling its disclosure.
The US Department of Justice states the principle clearly. Under the CLOUD Act, providers subject to US jurisdiction may be required to disclose data through valid legal process: “Regardless of where the company stores the data.”
Washington presents this as a legitimate means of obtaining electronic evidence. Geopolitically, however, it allows US jurisdiction to travel through corporate control, reaching information held outside US territory. The Justice Department’s explanation confirms that providers may be compelled to produce data under their control wherever it is stored.
The new geography of power is therefore drawn not only by borders, cables, and server farms, but also by corporate headquarters, encryption keys, legal obligations, cloud administrators, and the states capable of compelling their cooperation.
The illusion of digital borders
Across West Asia, governments are investing heavily in cloud computing, artificial intelligence (AI), digital identity, smart cities, and data-driven public services. Saudi Arabia aims to become a leading data economy, while the UAE, Qatar, Bahrain, Oman, and Turkiye are expanding their cloud and data-governance capabilities.
Physical capacity is also concentrating in a few regional hubs. A 2025 World Bank assessment counted 39 data centers in the UAE and 33 in Saudi Arabia. Both totals remained below the high-income-country average of 81, but they were far ahead of much of the surrounding region, positioning the two states as emerging gateways for West Asia’s computing infrastructure.
The scale of this transition is measurable. The International Telecommunication Union reports that 70 percent of people in the Arab states used the internet in 2024, compared with 68 percent globally. Yet the regional average conceals an 82-percentage-point gap between the least and most connected economies, while fixed-broadband subscriptions remain below half the global average. Digital expansion is therefore rapid, but profoundly uneven.
The supplier base is highly concentrated. According to Synergy Research Group, Amazon, Microsoft, and Google captured 63 percent of global enterprise spending on cloud infrastructure in the third quarter of 2025.
The market reached $107 billion that quarter, up from $68 billion just eight quarters earlier. States building digital systems at speed are entering a market already structured around dependence.
A government may require citizens’ data to remain within national borders while relying on a foreign company to operate the platform, maintain its software, supply the AI model, or control critical layers of the system.
This creates the appearance of sovereignty without necessarily delivering its substance.
Data localization answers only one question: Where is the information stored?
It does not answer the more important questions: Who controls the encryption keys? Who updates the software? Who can suspend the service? Which country’s laws govern the provider? Who can compel disclosure? And who possesses the computing power required to extract strategic value?
Keeping servers within national borders does not place them under national control.
Palestine and weaponized data
Nowhere are the consequences of this hidden geography more visible than in occupied Palestine. Modern warfare increasingly depends on gathering, combining, and interpreting vast quantities of information. Phone records, biometric identifiers, intercepted communications, location histories, and aerial images can be transformed into military intelligence through cloud computing and AI.
An AP investigation found that the Israeli military’s use of Microsoft and OpenAI rose to nearly 200 times the level recorded in the week before Operation Al-Aqsa Flood on 7 October 2023 by March 2024.
Data stored on Microsoft servers doubled to more than 13.6 petabytes by July 2024, while the military’s use of Microsoft computing servers increased by almost two-thirds during the first two months of the war. Azure was reportedly used to compile, transcribe, and translate information obtained through mass surveillance, with some intelligence cross-checked against targeting systems.
In September 2025, Microsoft disabled certain cloud and AI services provided to an Israeli military unit after a review found that its products had been used for mass surveillance of Palestinians. The relevant data had reportedly been stored in Microsoft cloud facilities in Europe.
The chain is revealing: information gathered in Palestine, processed by an Israeli military unit, hosted in Europe, and ultimately subject to decisions made by a US corporation. AP documented the surveillance system and Microsoft’s subsequent restrictions.
The restriction appeared significant, but its limits were equally instructive. Hossam Nasr, a former Microsoft employee and organizer with No Azure for Apartheid, observed:
“The vast majority of Microsoft’s contract with the Israeli military remains intact.”
The case demonstrated that private technology corporations now occupy positions once associated almost exclusively with states. They provide capabilities used in intelligence operations, determine whether customers retain access, investigate alleged misuse, and impose restrictions across borders.
Nimbus and the sovereignty trap
Israel itself recognizes the strategic importance of cloud control. Project Nimbus, awarded to Google and Amazon Web Services, was designed to provide comprehensive cloud infrastructure to Israeli ministries and associated public bodies.
The $1.2-billion project required local infrastructure and was presented as a means of retaining government information within Israel. Yet its principal providers remain US corporations embedded in US legal and technological systems. The contract’s scale places cloud sovereignty firmly within the realm of strategic infrastructure, with costs measured in billions of dollars.
Nimbus embodies the central paradox of data sovereignty: a government can insist that data remain within its territory while entrusting its storage, computation, and platform management to companies headquartered beyond it.
Israel negotiated aggressively to reduce this vulnerability. Most West Asian states do not possess Israel’s bargaining power, technological integration with Washington, or leverage over major US corporations.
Collect, compute, compel
The battle for data is ultimately a struggle over three strategic rights.
The first is the right to collect. Governments, digital platforms, telecom operators, banks, and security services accumulate information about identity, movement, communication, health, consumption, and behavior.
The second is the right to compute. Raw data acquires strategic value only when an actor possesses the chips, algorithms, cloud platforms, and skilled personnel required to process it.
The third is the right to compel. Governments and courts seek the authority to force providers to disclose, retain, remove, or restrict information.
The economic concentration behind these rights is intensifying. UN Trade and Development (UNCTAD) reports that the five largest digital multinational enterprises increased their combined share of sector-wide sales from 21 percent in 2017 to 48 percent in 2025; their share of total assets rose from 17 to 35 percent. Control over data and computation is therefore accumulating faster than the infrastructure is spreading.
A country controlling only the first right is a supplier of digital raw material. A country controlling collection and computation may become a digital power. An actor capable of exercising all three possesses something closer to digital sovereignty.
Former Research in Motion chairman Jim Balsillie summarized this transformation before the UN: “Wealth and power stem from owning valuable intellectual property and controlling valuable data and AI engines.”
In the 20th century, strategic value did not lie only in extracting oil, but also in refining, transporting, pricing, and financing it. In the 21st century, the same distinction applies to data.
The value at stake is expanding rapidly. UNCTAD projects that the global AI market will grow from $189 billion in 2023 to $4.8 trillion by 2033 – a 25-fold increase. Regions that provide data but lack the computing infrastructure and intellectual property needed to process it risk capturing only a small share of that value.
West Asia may generate the raw material, but decisive power lies in the data refineries: the cloud platforms, AI models, and computing systems that convert information into profit, intelligence, and geopolitical leverage.
Beyond digital colonialism
The solution is not digital isolation. No West Asian state can independently reproduce every layer of the global technology stack. Replacing dependence on US providers with total reliance on Chinese or other foreign platforms would merely shift the external center of gravity.
But the region must ensure that moving beyond oil dependence does not mean moving from classical dependency to digital colonialism – a system in which West Asian societies generate the data while foreign platforms own the infrastructure, extract the value, and retain the power of access. What the region requires is distributed technological autonomy.
Cloud procurement must be treated as a national-security decision, not a routine IT purchase. Contracts should establish who controls encryption keys, how foreign legal demands will be handled, and whether data and applications can be transferred to another provider.
Critical health, defense, biometric, judicial, and population data should receive stronger protection than ordinary commercial information. Governments must also invest in interoperable regional cloud capabilities, open standards, independent auditing, and the capacity to maintain essential services if a foreign provider withdraws access.
Above all, data sovereignty must extend beyond storage to encompass the entire chain: collection, classification, computation, access, sharing, and deletion.
The territory states cannot see
For more than a century, West Asia’s geopolitical importance was mapped through oilfields, pipelines, ports, straits, and military bases. Those structures remain central, but another strategic map now lies above them.
It consists of databases, cloud contracts, legal jurisdictions, identity systems, AI models, and invisible permissions.
Control over data gives states and corporations the power to map societies, interpret behavior, anticipate political and economic shifts, and turn that knowledge into action.
West Asian states are rapidly building the digital infrastructure on which their economies and public institutions will depend. Yet much of the authority governing these systems remains beyond the region.
In the 21st century, control of territory will increasingly depend on control of the data that makes its people, institutions, and resources visible.
West Asia is investing billions in local clouds and AI, but foreign firms still control the platforms and legal frameworks that can turn digital infrastructure into a tool of external influence.
06.08.2026
By Kamran Yeganegi
Source:https://thecradle.co/articles/digital-
On 10 June 2025, two senior Microsoft France executives appeared before a French Senate commission investigating public procurement and digital sovereignty.
The hearing appeared routine until the central question was put to Microsoft.
Could it guarantee that French citizens’ data, even when hosted in France, would never be transferred to a foreign authority without the French government’s consent?
Anton Carniaux, Microsoft France’s director of public and legal affairs, gave a six-
The admission cut through years of corporate language about “local cloud regions,” “trusted infrastructure,” and “data residency.” France could host the servers, French citizens could generate the data, and French institutions could pay for the service. Yet ultimate authority might still be exercised elsewhere.
The French Senate concluded that Microsoft could not guarantee sovereignty over the data it hosted. That exchange exposed a global reality with profound consequences for West Asia: the physical location of data is no longer the same as its political location.
The map that servers conceal
Traditional geography teaches that power occupies territory. Oil belongs to the state beneath whose soil it lies. Ports fall under the authority of the country on whose coast they are built. Pipelines are governed by the borders they cross.
Data follows a different geography.
A medical record may be created in Riyadh, stored in Bahrain, processed by an algorithm trained in the US, and administered through a European subsidiary. Which country truly controls it?
The conventional answer is that data belongs to the individual, company, or government that generated it. In practice, ownership matters less than control. Real power lies with those capable of accessing, processing, transferring, restricting, or legally compelling its disclosure.
The US Department of Justice states the principle clearly. Under the CLOUD Act, providers subject to US jurisdiction may be required to disclose data through valid legal process: “Regardless of where the company stores the data.”
Washington presents this as a legitimate means of obtaining electronic evidence. Geopolitically, however, it allows US jurisdiction to travel through corporate control, reaching information held outside US territory. The Justice Department’s explanation confirms that providers may be compelled to produce data under their control wherever it is stored.
The new geography of power is therefore drawn not only by borders, cables, and server farms, but also by corporate headquarters, encryption keys, legal obligations, cloud administrators, and the states capable of compelling their cooperation.
The illusion of digital borders
Across West Asia, governments are investing heavily in cloud computing, artificial intelligence (AI), digital identity, smart cities, and data-
Physical capacity is also concentrating in a few regional hubs. A 2025 World Bank assessment counted 39 data centers in the UAE and 33 in Saudi Arabia. Both totals remained below the high-
The scale of this transition is measurable. The International Telecommunication Union reports that 70 percent of people in the Arab states used the internet in 2024, compared with 68 percent globally. Yet the regional average conceals an 82-
The supplier base is highly concentrated. According to Synergy Research Group, Amazon, Microsoft, and Google captured 63 percent of global enterprise spending on cloud infrastructure in the third quarter of 2025.
The market reached $107 billion that quarter, up from $68 billion just eight quarters earlier. States building digital systems at speed are entering a market already structured around dependence.
A government may require citizens’ data to remain within national borders while relying on a foreign company to operate the platform, maintain its software, supply the AI model, or control critical layers of the system.
This creates the appearance of sovereignty without necessarily delivering its substance.
Data localization answers only one question: Where is the information stored?
It does not answer the more important questions: Who controls the encryption keys? Who updates the software? Who can suspend the service? Which country’s laws govern the provider? Who can compel disclosure? And who possesses the computing power required to extract strategic value?
Keeping servers within national borders does not place them under national control.
Palestine and weaponized data
Nowhere are the consequences of this hidden geography more visible than in occupied Palestine. Modern warfare increasingly depends on gathering, combining, and interpreting vast quantities of information. Phone records, biometric identifiers, intercepted communications, location histories, and aerial images can be transformed into military intelligence through cloud computing and AI.
An AP investigation found that the Israeli military’s use of Microsoft and OpenAI rose to nearly 200 times the level recorded in the week before Operation Al-
Data stored on Microsoft servers doubled to more than 13.6 petabytes by July 2024, while the military’s use of Microsoft computing servers increased by almost two-
In September 2025, Microsoft disabled certain cloud and AI services provided to an Israeli military unit after a review found that its products had been used for mass surveillance of Palestinians. The relevant data had reportedly been stored in Microsoft cloud facilities in Europe.
The chain is revealing: information gathered in Palestine, processed by an Israeli military unit, hosted in Europe, and ultimately subject to decisions made by a US corporation. AP documented the surveillance system and Microsoft’s subsequent restrictions.
The restriction appeared significant, but its limits were equally instructive. Hossam Nasr, a former Microsoft employee and organizer with No Azure for Apartheid, observed:
“The vast majority of Microsoft’s contract with the Israeli military remains intact.”
The case demonstrated that private technology corporations now occupy positions once associated almost exclusively with states. They provide capabilities used in intelligence operations, determine whether customers retain access, investigate alleged misuse, and impose restrictions across borders.
Nimbus and the sovereignty trap
Israel itself recognizes the strategic importance of cloud control. Project Nimbus, awarded to Google and Amazon Web Services, was designed to provide comprehensive cloud infrastructure to Israeli ministries and associated public bodies.
The $1.2-
Nimbus embodies the central paradox of data sovereignty: a government can insist that data remain within its territory while entrusting its storage, computation, and platform management to companies headquartered beyond it.
Israel negotiated aggressively to reduce this vulnerability. Most West Asian states do not possess Israel’s bargaining power, technological integration with Washington, or leverage over major US corporations.
Collect, compute, compel
The battle for data is ultimately a struggle over three strategic rights.
The first is the right to collect. Governments, digital platforms, telecom operators, banks, and security services accumulate information about identity, movement, communication, health, consumption, and behavior.
The second is the right to compute. Raw data acquires strategic value only when an actor possesses the chips, algorithms, cloud platforms, and skilled personnel required to process it.
The third is the right to compel. Governments and courts seek the authority to force providers to disclose, retain, remove, or restrict information.
The economic concentration behind these rights is intensifying. UN Trade and Development (UNCTAD) reports that the five largest digital multinational enterprises increased their combined share of sector-
A country controlling only the first right is a supplier of digital raw material. A country controlling collection and computation may become a digital power. An actor capable of exercising all three possesses something closer to digital sovereignty.
Former Research in Motion chairman Jim Balsillie summarized this transformation before the UN: “Wealth and power stem from owning valuable intellectual property and controlling valuable data and AI engines.”
In the 20th century, strategic value did not lie only in extracting oil, but also in refining, transporting, pricing, and financing it. In the 21st century, the same distinction applies to data.
The value at stake is expanding rapidly. UNCTAD projects that the global AI market will grow from $189 billion in 2023 to $4.8 trillion by 2033 – a 25-
West Asia may generate the raw material, but decisive power lies in the data refineries: the cloud platforms, AI models, and computing systems that convert information into profit, intelligence, and geopolitical leverage.
Beyond digital colonialism
The solution is not digital isolation. No West Asian state can independently reproduce every layer of the global technology stack. Replacing dependence on US providers with total reliance on Chinese or other foreign platforms would merely shift the external center of gravity.
But the region must ensure that moving beyond oil dependence does not mean moving from classical dependency to digital colonialism – a system in which West Asian societies generate the data while foreign platforms own the infrastructure, extract the value, and retain the power of access. What the region requires is distributed technological autonomy.
Cloud procurement must be treated as a national-
Critical health, defense, biometric, judicial, and population data should receive stronger protection than ordinary commercial information. Governments must also invest in interoperable regional cloud capabilities, open standards, independent auditing, and the capacity to maintain essential services if a foreign provider withdraws access.
Above all, data sovereignty must extend beyond storage to encompass the entire chain: collection, classification, computation, access, sharing, and deletion.
The territory states cannot see
For more than a century, West Asia’s geopolitical importance was mapped through oilfields, pipelines, ports, straits, and military bases. Those structures remain central, but another strategic map now lies above them.
It consists of databases, cloud contracts, legal jurisdictions, identity systems, AI models, and invisible permissions.
Control over data gives states and corporations the power to map societies, interpret behavior, anticipate political and economic shifts, and turn that knowledge into action.
West Asian states are rapidly building the digital infrastructure on which their economies and public institutions will depend. Yet much of the authority governing these systems remains beyond the region.
In the 21st century, control of territory will increasingly depend on control of the data that makes its people, institutions, and resources visible.