Lorenzo Maria Pacini
Data sovereignty is the new oil - but West Asia is pumping raw material while foreign tech giants refine it.
The map hidden by servers and the illusion of digital borders
On June 10, 2025, two executives from Microsoft France appeared before a French Senate investigative committee tasked with examining public procurement and digital sovereignty. The hearing proceeded in the usual reassuring tone until a question that completely shifted the mood: Could the company guarantee that the data of French citizens - even if hosted on servers located in France - would never be transferred to a foreign authority without the consent of the French government ? Anton Carniaux, the subsidiary's director of public and legal affairs, responded under oath with six words: "No, I cannot guarantee that."
That statement cut through years of corporate rhetoric built around phrases such as "local cloud regions", "reliable infrastructure", and "data residency". France could host the servers, French citizens could generate the data, and French institutions could pay for the service - yet ultimate authority could still reside elsewhere. The commission drew a clear conclusion. Microsoft was unable to guarantee sovereignty over the data it hosted. That exchange reveals a reality with specific consequences, including - and perhaps above all - for West Asia: the physical location of data no longer coincides with its political location.
Classical power geography teaches that sovereignty occupies territory. Oil belongs to the state beneath whose soil it lies; ports fall under the authority of the country on whose shores they stand; oil pipelines follow the borders they cross. In this tradition, power is read on the surface of the earth. Data follows a different geography.
A medical record can be created in Riyadh, stored in Bahrain, processed by an algorithm trained in the United States, and managed through a European subsidiary. Which state truly controls it ? The conventional answer attributes the data to the individual, company, or government that generated it. In practice, ownership matters less than control. Real power belongs to whoever is able to access, process, transfer, restrict, or legally compel the disclosure of the information.
This principle is stated unambiguously by the U.S. Department of Justice itself. Under the CLOUD Act, providers subject to U.S. jurisdiction can be compelled to hand over data through valid legal proceedings, "regardless of where the company stores it". Washington presents the law as a legitimate tool for obtaining electronic evidence. On a geopolitical level, it allows U.S. jurisdiction to extend through corporate control, reaching information stored far beyond U.S. territory. The new map of power is drawn not only by borders, cables, and data centers, but by registered offices, encryption keys, legal obligations, system administrators, and the states capable of compelling them to cooperate.
Across Western Asia, governments are investing heavily in cloud computing, artificial intelligence, digital identity, smart cities, and data-driven public services. Saudi Arabia aims to become a leading data economy; the United Arab Emirates, Qatar, Bahrain, Oman, and Turkey are expanding their information management and governance capabilities. Physical capacity is also concentrated in a few regional hubs: a 2025 assessment by the World Bank counted thirty-nine data centers in the UAE and thirty-three in Saudi Arabia - figures lower than the average for high-income countries (eighty-one) but significantly higher than the rest of the region.
The transition is measurable. According to the International Telecommunication Union, in 2024, 70 percent of the population of Arab states used the Internet, compared to 68 percent globally. The regional average, however, masks an 82-percentage-point gap between the least-connected and most-connected economies, while fixed broadband subscriptions remain less than half the global figure. Digital expansion is rapid and, at the same time, deeply unequal.
The provider landscape, on the other hand, is highly concentrated. According to Synergy Research Group, in the third quarter of 2025, Amazon, Microsoft, and Google accounted for 63 percent of global enterprise spending on cloud infrastructure, in a quarterly market that had grown to $107 billion from $68 billion just two years earlier. Countries that are rapidly building their own digital systems are entering a market already structured around dependency. A government may require that citizens' data remain within national borders while simultaneously entrusting a foreign company with managing the platform, updating the software, providing the AI model, or controlling critical layers of the system. This creates the appearance of sovereignty without its substance.
Data localization answers only one question: where is the information stored ? It leaves the crucial questions open. Who controls the encryption keys ? Who updates the software ? Who can suspend the service ? Which country's laws govern the provider ? Who can compel its disclosure, and who possesses the computing power necessary to extract strategic value from it ? Keeping servers within national borders does not place them under national control.
Palestine and data as a weapon
Nowhere are the consequences of this hidden geography more evident than in occupied Palestine. Modern warfare increasingly depends on the collection, cross-referencing, and interpretation of enormous amounts of information. Phone records, biometric identifiers, intercepted communications, location histories, and aerial imagery can be transformed into military intelligence through cloud computing and artificial intelligence.
The combined use of Microsoft and OpenAI products by the Israeli military in March 2024 had reached a level nearly two hundred times higher than that of the week preceding October 7, 2023. The data stored on Microsoft servers had more than doubled, exceeding 13.6 petabytes by July 2024, while server usage grew by nearly two-thirds during the first two months of the war. The Azure platform was reportedly used to compile, transcribe, and translate information obtained through mass surveillance, with some of the intelligence cross-referenced with target-acquisition systems.
In September 2025, Microsoft deactivated certain cloud and AI services provided to an Israeli military unit after an internal audit confirmed that its products were being used for mass surveillance of Palestinians; the data in question was stored in the company's cloud facilities located in Europe. This chain of events is revealing: information collected in Palestine, processed by an Israeli military unit, hosted in Europe, and ultimately subject to a decision made by a U.S. company. The limitation of this measure is equally telling. As Hossam Nasr, a former Microsoft employee and advocate for the No Azure for Apartheid campaign, noted, the bulk of the contract with the Israeli military apparatus remained intact. Big tech companies now occupy positions once reserved almost exclusively for states: they provide capabilities used in intelligence operations, decide whether a customer retains access, investigate alleged abuse, and impose restrictions across borders.
Israel itself recognizes the strategic importance of control over the cloud. The Nimbus project, awarded to Google and Amazon Web Services, was designed to provide Israeli ministries and related public agencies with a comprehensive cloud infrastructure. The contract, worth $1.2 billion, required local infrastructure and was presented as a means of keeping government information within the country's borders. The main providers, however, remain U.S. companies, embedded in American legal and technological systems.
Nimbus embodies the central paradox of data sovereignty: a government can demand that information remain within its territory while entrusting the storage, computing, and platform management to companies headquartered elsewhere. Israel negotiated hard to reduce this vulnerability. Most countries in West Asia lack Israel's bargaining power, its technological integration with Washington, or its ability to exert pressure on major American corporations. Here, sovereignty is also a function of negotiating power.
The dispute over data is ultimately a struggle over three strategic rights. The first is the right to collect: governments, digital platforms, telecommunications operators, banks, and security services accumulate information on identity, movements, communications, health, consumption, and behavior. The second is the right to process: raw data acquires strategic value only if the actor possesses the chips, algorithms, cloud platforms, and qualified personnel necessary to process it. The third is the right to compel: the authority, claimed by governments and courts, to force providers to disclose, retain, remove, or restrict information.
The economic concentration behind these three rights is intensifying. UNCTAD reports that the five largest digital multinationals have increased their combined share of industry sales from 21 percent in 2017 to 48 percent in 2025, while their share of assets rose from 17 to 35 percent. Control over data and computing is accumulating faster than infrastructure is spreading. A country that controls only the first right is a supplier of digital raw materials; one that controls data collection and computing can become a digital power; an actor capable of exercising all three possesses something close to digital sovereignty.
The economic stakes are rising rapidly. UNCTAD estimates that the global artificial intelligence market will grow from $189 billion in 2023 to $4,800 billion in 2033 - a twenty-five-fold increase over a decade. Regions that supply data but lack the computing infrastructure and intellectual property necessary to process it risk retaining only a minimal portion of that value. In the 20th century, strategic value lay not only in extracting oil, but in refining it, transporting it, pricing it, and financing it. In the 21st century, the same distinction applies to data: West Asia can generate the raw material, but the decisive power lies in the "data refineries" - that is, in the cloud platforms, AI models, and computing systems that convert information into profit, intelligence, and geopolitical leverage.
Beyond digital colonialism
The solution is not technological isolation. No single West Asian state can reproduce every layer of the global technology stack on its own, and replacing dependence on U.S. suppliers with total reliance on Chinese or other platforms would merely shift the external center of gravity. The risk to avoid is that breaking free from oil dependence could turn into digital colonialism: a scenario in which companies in the region generate the data while foreign platforms own the infrastructure, extract its value, and retain control over access. What is needed is distributed technological autonomy.
On this basis, a concrete order of priorities can be established. The procurement of cloud services must be treated as a national security decision, not as routine IT business: contracts must specify who controls the encryption keys, how foreign legal requests will be handled, and whether data and applications can be migrated to another provider. Health, defense, biometric, judicial, and civil registry data require stricter protection than ordinary commercial information. Governments must invest in interoperable regional cloud capabilities, open standards, independent auditing, and the ability to maintain essential services should a foreign provider revoke access. Above all, data sovereignty must extend beyond storage to encompass the entire chain: collection, classification, computation, access, sharing, and deletion.
For over a century, the geopolitical importance of West Asia has been mapped through oil fields, pipelines, ports, straits, and military bases. Those structures remain central, but another strategic network has spread over them - one made up of databases, cloud contracts, legal jurisdictions, identity systems, AI models, and invisible authorizations. Control over data gives states and corporations the power to map societies, interpret their behaviors, anticipate their political and economic shifts, and translate that knowledge into action.
The states of Western Asia are rapidly building the digital infrastructure upon which their economies and public institutions will rest. Much of the authority governing those systems, however, remains outside the region. In the 21st century, control over a territory will increasingly depend on control over the data that reveals its people, institutions, and resources.
The question posed to the French Senate in June 2025 clearly extends far beyond France: those who cannot guarantee where their data will end up do not fully govern their own territory. And with that data, literally anything can be done.