A nation on a hard drive: Inside the rise of digital embassies

A nation on a hard drive: Inside the rise of digital embassies

Facing cyberattacks, hybrid warfare and military conflict, governments are storing their data outside their borders.

By ELLEN O’REGAN

Illustration by Natália Delgado/ POLITICO

In the small, sleepy Grand Duchy of Luxembourg, a hidden digital vault holds data on every Estonian citizen.

The vault is what’s known as a “digital embassy,” a sliver of territory under Estonian control where the Baltic country stores critical data some 1,600 kilometers from home. Security databases, population registers and land ownership records are kept safe from cyberattacks, sabotage and even a Russian invasion.

Think of it as a giant USB stick loaded with the blueprint and vital data to rebuild an entire state, stored in another country, out of reach of potential invaders, hackers and natural disasters. The site is treated as inviolable, like a real diplomatic embassy. Even the host country can’t enter without permission.

While Estonia was the first to set up an operational data embassy, the idea rapidly gained ground following Russia’s full-scale invasion of Ukraine in 2022, as countries fret about the rising threat of cyberattacks, disruption of data cables and military conflict.

The Kremlin’s assault “changed the game,” said Allan Allmere, the Estonian government official leading the digital embassy initiative. “Everyone got it, that we must protect our data.” 

Estonia set up its digital embassy in 2019, securing its famously digitized public service information after years of suffering cyberattacks from neighboring Russia.

The idea was inspired by an old-school version of backups that Estonian diplomats had been doing for years. “We put [information] on magnetic tapes, then our staff members put them in suitcases, got in a plane, flew to some Estonian embassy around the world and put it in the safe,” explained Allmere. 

“The Estonian government then thought, okay, why are we doing this work manually?”

Other countries have since followed in Estonia’s footsteps. Monaco formed a digital embassy agreement with Luxembourg in 2021, Singapore is scouting a location in India, and India announced this year that it is working on setting one up in the United Arab Emirates.

Invasion-proof

Estonia’s digital embassy sits in a data center with top-tier security owned by the Luxembourgish government. Encrypted data is sent from Estonia to Luxembourg via private internet links and can only be remotely or physically accessed by authorized Estonian officials.

The first version of the vault included 10 critical datasets, including information on citizens, what land they owned and the country’s laws — everything a government would need to restart after a disaster.

It has expanded since then, said Allmere, and now also hosts some “live services” such as parts of the government cloud.

Luxembourg has become a hub for digital embassies because of its stable political environment, state-owned secure servers and high levels of connectivity. | Alfredo Martinez/Getty Images

The system is built so the data can’t be remotely deleted. “If someone puts a gun to my head and says: ‘Delete all our systems in Luxembourg,’ you can’t do it,” said Allmere. “If someone, our bad neighbor, invades Estonia and they get access to our data rooms … even then they can’t delete what we have in Luxembourg.”

Luxembourg — a tiny country wedged between France, Germany and Belgium — has become a hub for digital embassies because of its stable political environment, state-owned secure servers and high levels of connectivity, said the country’s Deputy Prime Minister Xavier Bettel. Luxembourg, he added, is regarded as a “trusted digital partner.” 

“We don’t do it for money,” he said. “It’s a question of reputation … It’s a part also of attractiveness for companies.” Luxembourg hosts digital embassies for countries other than Estonia and Monaco as well, but those governments prefer to keep the arrangement confidential for “security reasons” or because they are still being finalized, said Bettel.

Ukraine’s data evacuation

Ukraine has been studying the concept of a digital embassy since Russia’s 2022 assault, said Vitaly Balashov, Ukraine’s deputy minister for cloud and cybersecurity at the Ministry of Digital Transformation. He added that Kyiv is discussing the idea with “several countries.” 

“I am absolutely sure that we will have it,” he said. 

In the meantime, the Ukrainian government has changed its laws and revised its data policies to account for the risk of data centers being taken down in the war.

Balashov said that before Russia’s full-scale invasion, Ukrainian law mandated that government data be stored within the country. The invasion showed “our data center is [a] potential target,” he said.  

“We need to hide our facilities. We need to protect it,” noted Balashov. “One of the best and most cheap ways, it’s to move it out from the danger zone.” 

To do so, the government temporarily changed its laws, allowing non-secret government information and systems to be moved out of Ukraine while the war lasts. Balashov said the government is now working to make that rule permanent.  

Certain government data and systems are operated outside the country on cloud and data centers run by Ukrainian companies as well as U.S. hyperscalers like Amazon Web Services, Microsoft and Google, said Balashov. There are also key backups for “disaster recovery” still stored in Ukraine, he added.

Government departments that want to store data outside the country have to meet security requirements, and document how quickly they could restore the system from backups stored in Ukraine if the connection were lost, said the deputy minister.

Sharing the AI load

As Europe wakes up to its dependence on private tech from the U.S. and China, some countries are weighing whether building a digital embassy is better than relying on a private cloud service.

Luxembourg’s Deputy Prime Minister Xavier Bettel, who says the principality has become a trusted digital partner, at a technolgoy summit in Lisbon in November 2024. | Horacio Villalobos/Corbis/Getty Images

“When we speak about digital sovereignty, we don’t need to send them to the States or to Asia, we can do it in Europe,” said Bettel. “It’s not against someone, it’s just in favor of sovereign Europe.”

The idea is also sparking the curiosity of countries that want to supercharge artificial intelligence development and data processing but don’t have the resources to do it in their own country.

Earlier this month, the World Economic Forum launched a global framework for bilateral agreements to establish such digital embassies. The framework touches on things like access rights, data disclosures, jurisdiction, privacy laws, dispute resolution and the interoperability of infrastructure.

As AI becomes increasingly important for economic competitiveness, national security and public services, computing and data storage demands are “accelerating beyond what many economies, particularly the emerging ones, can support domestically due to structural limits in land, energy and capital,” said Cathy Li, head of the WEF’s Centre for AI Excellence.

Bahrain, for example, has developed a specific digital embassy law that allows institutions to store data on servers in Bahrain but keep it subject to the laws of their home countries. Saudi Arabia is also pushing to become a global digital embassy hub for AI.

“We have finite energy on Earth, we have a finite infrastructure, and we believe that without some sort of shared access, the Earth would just not be able to support such large-scale infrastructure build-out,” said Li.