Digital Sovereignty Without Owning the Digital Stack
In the twentieth century, weaker states worried about who controlled their sea lanes, pipelines and skies. In the twenty first, the more consequential question may be who controls their chips, clouds, cables, payment rails and satellite links. Pakistan and Iran sit on opposite sides of several strategic divides. One is under sanctions and has built an increasingly securitised digital order to survive them. The other remains formally integrated with Western finance, dependent on Gulf support and multilateral lenders, and still talks more comfortably about digital transformation than digital coercion. Yet the gap between them can obscure a more uncomfortable convergence. Both are trying to defend sovereignty through technological systems they do not control.
That is the core strategic exposure now facing medium capacity states in a harsher technological order. The old vocabulary of development policy, innovation ecosystems, startup culture and public sector digitisation is no longer enough. The decisive issue is not whether Pakistan and Iran can digitise. It is whether they can remain governable when the underlying digital substrate is owned, supplied, financed, patched, updated, restricted and, in extremis, switched off by others. In an era shaped by U.S. export controls, Chinese state backed tech ecosystems, cloud concentration in a handful of American hyperscalers, AI compute asymmetries, surveillance technology markets and sanctions driven payment fragmentation, sovereignty increasingly depends on assets that neither Islamabad nor Tehran fully possesses.
Iran has been forced to confront this reality earlier and more brutally than Pakistan. Years of sanctions, banking exclusion and strategic isolation have pushed Tehran toward a model of digital resilience built on control, substitution and selective foreign dependence. The National Information Network was never merely a censorship project. It was also a sovereignty project of a distinctly illiberal kind: an effort to create a domestic communications layer that could keep parts of the economy and state functioning even if the global internet became politically or militarily inaccessible. The problem is that autarky in digital systems is mostly a fantasy, especially for a sanctions hit middle power without frontier semiconductor capability, advanced fabrication, global cloud scale or trusted access to leading software ecosystems.
That contradiction has become sharper, not weaker, in the latest cycle of regional conflict and technological competition. Research on Iran’s 2026 shutdowns suggests the state has refined a model of centralised internet control that can preserve domestic routing while null routing access to the wider web at scale. In parallel, reporting and rights group documentation indicate that Chinese hardware and governance models have become increasingly relevant to Tehran’s censorship and surveillance capacity. Iran’s rulers can thus claim a form of sovereign control over connectivity, but only by importing parts of the architecture through which that control is exercised. This is sovereignty through dependency, not sovereignty beyond it. Tehran may own the decision to close the gate, but it does not own much of the machinery that makes the gate function.
Pakistan’s predicament is less dramatic but not necessarily less consequential. It is not trying to build a sealed national intranet. It is trying to digitise a fragile state, expand payments, localise sensitive data, modernise cloud procurement, harden telecom infrastructure and insert itself into the AI economy without the capital base, manufacturing depth or policy coherence to do so on sovereign terms. Its dependence is therefore less visible than Iran’s, because it is embedded in ordinary procurement decisions rather than wartime shutdowns. But the dependence is real. Pakistan imports most of the hardware that underpins its telecoms and digital services. It lacks meaningful domestic semiconductor capability. Its cloud ambitions remain constrained by foreign infrastructure, foreign software stacks and foreign capital. Even its emerging language of sovereign cloud has so far been expressed through partnerships rather than through indigenous control. Pakistan’s Cloud First push, new accreditation regime and rhetoric around local hosting reflect an awareness of this exposure. Yet they also underline the scale of the gap between aspiration and capability. A country does not announce sovereign cloud as a strategic priority unless it knows it has spent too long living inside other people’s clouds.
The danger is to misread this as a narrow infrastructure story. It is not. Technology competition between major powers is changing the operating environment for states like Pakistan and Iran in at least five interlocking ways.
First, semiconductors are no longer just industrial inputs. They are geopolitical ration cards. The United States has moved steadily from export controls aimed at China toward a broader conception of compute governance, one in which access to advanced chips and large scale AI infrastructure can be conditioned by security alignment, investment commitments and monitoring requirements. Reuters has reported that Washington has considered rules that would require foreign governments or firms to make investments in U.S. AI infrastructure or provide security assurances as a condition for access to advanced chips at scale. That matters even for countries not at the centre of the U.S. China contest. It signals that compute is becoming a managed strategic resource, not a neutral commodity. In practice, medium powers may find that their AI ambitions are constrained not simply by cost, but by the diplomatic and compliance terms under which access is granted.
Second, China’s response to U.S. controls has not produced a more open technological world. It has produced a more segmented one. Beijing is building self reliance where it can, tightening export checks on critical materials and pushing state funded data centres toward domestic chips. The result is not a commons of alternative technology for the Global South. It is a parallel ecosystem with its own political and security implications. China’s tightening scrutiny over indium exports and its efforts to purge foreign AI chips from state backed data centres show that it, too, increasingly treats digital infrastructure as a strategic instrument rather than a market good. For Pakistan and Iran, this means that hedging between Washington and Beijing does not produce technological freedom. It merely relocates dependence from one strategic stack to another.
Third, cloud concentration has become one of the least discussed and most consequential forms of power asymmetry. A handful of firms, overwhelmingly American, now sit atop the global infrastructure through which governments store data, businesses run operations and AI models are trained and deployed. Even where states insist on local hosting, the underlying software, security layers, orchestration tools, chip supply and service standards often remain foreign. This matters because cloud is no longer simply rented storage. It is the operational backbone of digital government, financial services, health records, enterprise software and increasingly national AI strategy. If a state cannot credibly ensure continuity of access, resilience against external pressure, or independent auditing of what sits inside its critical cloud layers, then its sovereignty is conditional. Pakistan has recognised part of this problem through data localisation and cloud accreditation measures, but localisation alone does not solve strategic dependence if the accredited providers themselves are reliant on external vendors, foreign security updates and imported hardware.
Fourth, payment systems and financial messaging are now part of the same sovereignty problem. Iran has long understood this because sanctions forced it to. Its experiments with non Western financial channels, local currency arrangements and payment integration with Russia are not signs of triumph but of necessity. Tehran’s linkage of Shetab with Russia’s Mir system and associated banking messaging arrangements with Moscow show how a sanctioned state seeks to rebuild transactional capacity outside Western rails. Yet these workarounds are narrow, politically loaded and often economically suboptimal. They may ease tourist payments or bilateral trade settlement at the margins, but they do not replicate the scale, liquidity, trust and interoperability of the dominant system. They are less a substitute for financial normalcy than a survival architecture for partial exclusion.
Pakistan is not in the same position, but it would be unwise to assume that makes it safe. Its own payments modernisation, including the expansion of Raast and efforts to digitise remittance flows, is best understood not only as financial inclusion policy but as a strategic attempt to strengthen domestic payment rails before external shocks test them. The trouble is that Pakistan’s financial sovereignty remains inseparable from external confidence. It still depends on correspondent banking relationships, lender credibility and the avoidance of sanctions contamination. That makes its room for experimentation far narrower than Iran’s. Islamabad can talk about digital payments, local clearing and fintech inclusion. It cannot casually drift into sanctions adjacent payment improvisation without risking reputational damage well beyond the scale of any gains from frontier trade.
Fifth, surveillance technologies and cyber governance norms are becoming export sectors in their own right. Iran’s recent experience is a warning about what happens when digital sovereignty is defined primarily as the state’s ability to watch, filter and close rather than society’s ability to transact, communicate and innovate securely. The attraction of Chinese hardware and censorship models for Tehran lies in their political utility. They help a regime manage dissent and preserve control under pressure. But they also deepen path dependence on external vendors and imported doctrines of control. Pakistan’s challenge is different but not entirely disconnected. It, too, is tightening telecom security rules, data hosting requirements and critical infrastructure controls. Some of that is prudent. A country with weak cyber hygiene, rising attacks and sprawling public sector digitisation should harden its systems. But there is a narrow passage between resilience and securitised overreach. If the state adopts the language of sovereignty merely to justify ad hoc control without building indigenous technical capacity, then it risks importing not only foreign equipment but foreign habits of governance.
This is why the Pakistan Iran comparison matters. The point is not that the two countries are technologically equivalent. They are not. Iran has lived longer with sanctions, built a denser internal control architecture and accepted a much higher degree of digital closure. Pakistan remains more open, more financially exposed to Western institutions and more dependent on external market confidence. But they are converging in a more structural sense. Both are medium capacity states confronting a world in which strategic autonomy depends on control over assets that are expensive to build, difficult to secure and increasingly rationed by great power competition. Neither has the industrial depth to manufacture advanced chips. Neither commands a globally scaled cloud ecosystem. Neither sets the dominant standards for AI compute, submarine cable governance, satellite connectivity or financial messaging. Both are downstream from decisions made elsewhere.
The consequences are not abstract. They affect war risk, economic continuity and state capacity.
Take AI. Much of the current discussion in Pakistan treats artificial intelligence as a workforce, education or service delivery question. That is too narrow. AI has become an infrastructure question because frontier models and advanced deployment increasingly require access to compute, energy, storage and cloud environments controlled by a small number of firms and states. Even China, despite massive state backing, remains constrained by U.S. controls and domestic chip bottlenecks. Reuters has reported both the widening squeeze in memory supply for AI buildout and the strategic struggle over who gets access to advanced processors. If China itself is still wrestling with compute scarcity and software ecosystem constraints, the idea that Pakistan or Iran can simply “adopt AI” as a policy choice borders on fantasy. They can consume AI services, fine tune smaller models, procure surveillance tools, automate parts of government and perhaps host niche inference workloads. But without reliable access to compute and trusted cloud environments, their AI sovereignty will remain shallow.
Take telecom resilience. Pakistan’s dependence on imported network equipment, software patches and cloud linked management systems means that the security of its communications backbone is partly a question of supply chain trust. Iran’s own experience, including claims and fears about foreign hardware vulnerabilities during conflict, illustrates how quickly this can become a strategic paranoia even when evidence is contested. The point is not to validate every allegation. It is to note that in a conflict environment, dependence on black box foreign equipment becomes politically toxic and operationally dangerous. States begin to ask not only whether their networks can be attacked, but whether they are governable by others at the firmware layer.
Take payments and trade. The next sanctions shock in the region may not begin with a formal embargo. It may begin with compliance aversion. Banks de risk. insurers step back. cloud providers tighten terms. payment intermediaries slow transfers. software vendors reassess exposure. Even where no direct prohibition exists, commercial actors respond to geopolitical risk by withdrawing discretionary tolerance. That is the zone in which Pakistan could find itself squeezed if Iran related trade, frontier finance or digital settlement mechanisms appear too opaque. Iran has learned to operate inside this grey economy of friction. Pakistan has not, and cannot afford to learn casually.
So what should Islamabad do with this diagnosis. Not, certainly, attempt an Iranian style sovereignty through closure. Pakistan’s comparative advantage lies precisely in avoiding the strategic self harm of broad digital isolation. It needs openness, capital, remittances, cross border services and reputational access to the formal financial system. But it also cannot continue with the old assumption that buying foreign infrastructure plus writing a policy paper equals digital sovereignty.
A more serious strategy would begin with a modest premise: Pakistan will remain technologically interdependent, but it can still reduce the most dangerous forms of dependence. That requires ranking vulnerabilities rather than chanting self reliance. Four priorities stand out.
The first is to distinguish between localisation and control. Hosting data in Pakistan is useful, especially for critical public sector systems, but it is not sufficient. The state needs visibility into who owns the infrastructure, where the root administrative privileges sit, how incident response works, what legal jurisdictions can compel disclosure, and whether continuity is possible if a foreign vendor exits. A sovereign cloud strategy worthy of the name must therefore include vendor diversification, escrow and portability requirements for critical public systems, independent code and security audits where feasible, and procurement rules that do not simply replace one opaque dependency with another.
The second is to treat payments infrastructure as strategic national resilience, not just fintech modernisation. Raast’s expansion matters because it strengthens domestic rails. But Pakistan also needs a sanctions aware framework for any licit Iran related trade, one that is transparent, ring fenced and central bank supervised rather than left to frontier improvisation. That does not mean mimicking Iran’s workaround economy. It means ensuring that any permissible trade settlement architecture is auditable enough to protect Pakistan’s broader financial standing.
The third is to build selective domestic capability where the sovereignty dividend is highest. Pakistan will not become a semiconductor power in the foreseeable future. But it can still invest in the less glamorous layers that matter: cybersecurity talent, public sector cloud architecture, secure identity systems, digital forensics, telecom resilience testing, local language AI tooling, and legal capacity to negotiate with large technology vendors. Sovereignty is not only about making chips. It is also about not being strategically illiterate in the contracts and systems that govern them.
The fourth is to pursue carefully bounded external cooperation, including with Iran, without pretending away alignment asymmetries. A Pakistan Iran technology dialogue is not absurd. In fact, on narrow questions such as border digitisation, cyber incident deconfliction, customs data integrity, anti smuggling analytics and perhaps even baseline norms around civilian telecom continuity, it could be useful. Both countries share a difficult frontier. Both have reasons to reduce digital friction in licit trade and border administration. But Islamabad should resist any grander techno strategic romance. Joint work on sanctions resilient payments, surveillance architecture or politically loaded cyber coordination would carry outsized reputational and diplomatic risks for Pakistan. The logic of engagement should therefore be practical, technical and tightly delimited, not ideological.
That, ultimately, is the distinction Pakistan must preserve if it wants more sovereignty rather than less. Iran’s model offers one lesson worth studying and another worth avoiding. The lesson worth studying is that states ignore technological dependency at their peril, because under pressure the question of who owns the digital pipes quickly becomes a question of who governs the state. The lesson worth avoiding is the belief that sovereignty can be secured mainly by tightening control over citizens while remaining dependent on foreign hardware, foreign code and foreign coercive partnerships. That is not strategic autonomy. It is brittle insulation.
Pakistan’s challenge is harder in some ways because it must walk a narrower line. It cannot decouple from Western finance, nor can it wholly entrust its digital future to Chinese systems, Gulf capital or any single external patron. It must modernise without alarming lenders, secure infrastructure without smothering openness, and localise critical systems without pretending that localisation alone equals control. Above all, it must stop talking about technology as a neutral development sector and start treating it as a field of statecraft.
The emerging hierarchy of technological dependency will not be kind to countries that arrive late to that realisation. In the next phase of competition, conventional alliances will still matter, but they will increasingly be mediated through less visible instruments: export licences, cloud contracts, satellite access, payment interoperability, data hosting mandates, software updates and compliance warnings. That is where sovereignty will be tested. Pakistan and Iran are not at the same point on that map. But both are already living inside its logic. The question is no longer whether they can digitise. It is whether they can remain strategically intelligible to themselves once digitisation has placed the foundations of commerce, communication and governance inside systems built elsewhere.
A Public Service Message
