I was at the Nasdaq bell ringing ceremony for a new company on Friday, WiseSat. The company promises secure and sovereign connectivity from orbit. Which begs the question:

What happens to digital sovereignty when data leaves the planet?

Satellites got different really fast. Before 2020, there were a few thousand satellites in orbit, now there are almost 20,000 – an order of magnitude more. They’re no longer niche telecom, scientific, or espionage tools either. Increasingly – as Ukraine learned most famously – they are becoming the primary backbone of global connectivity, bridging digital divides, and powering critical operations (civilian and military) worldwide.

But, yet again as Ukraine learned during the Russian invasion and Elon Musk’s meddling, they can impact national self-determination. Global security is the most new-grabbing case, but as our communication networks move into space, our frameworks for cybersecurity and a lot of other technology governance issues are being tested in unexpected ways.

Digital sovereignty is certainly the topic of the moment, so that’s a good frame for this discussion. While almost no one agrees on what digital sovereignty is, every nation definitely, definitely wants it. For our purposes, we can separate digital sovereignty from its frequent partner data localization (or data sovereignty) – the legal requirement that data generated within a country’s borders must physically reside on servers located within those same geographic boundaries. But data localization is an earthbound, industrial-era concept. It’s digital revolution stuff. We’re on the fourth, or fifth, (or who knows?) maybe the sixth industrial revolution at this point.

Rather, digital sovereignty is about strategic autonomy, operational resilience, and the capacity of states, organizations, and even individuals to maintain control, trust, and agency over their digital destinies. It is a matter of governance, cybersecurity, and rule of law, regardless of where data is processed, transmitted, or stored. When data moves through space, physical borders disappear, but digital sovereignty doesn’t. It becomes more urgent but also more complex.

Based on my research (described in chapter 10 of my book Technology Governance) and the discussions I’ve had lately, there are three useful principles to guide the intersection of satellite technology, cybersecurity, and digital policy as our data leaves its earthly tent.

1. Digital Sovereignty Follows Data.

Despite the globe-spanning nature of the internet, for decades, legal frameworks governing technology relied on geographic indicators. Regulators asked: Where is the server located? Where was the byte written? Whose soil is under the data center? Not “Whose Bed Have Your Boots Been Under?” but close.

This doesn’t make sense for satellites. A single data packet transmitted across a modern non-terrestrial network may be generated on a smartphone in Sub-Saharan Africa, routed through a satellite constellation orbiting hundreds of kilometers above the Earth, bounced across optical inter-satellite links over international waters, and downlinked to a ground station on another continent.

If sovereignty is tied strictly to land, it breaks down faster than oxygen molecules in the stratosphere.

So digital sovereignty must follow the data, not the soil. Sovereignty in the satellite era is orbit-neutral. It demands that nations and enterprises maintain legal clarity, data integrity, and operational control over their information flows throughout the entire lifecycle of a transaction—whether that transaction occurs on terrestrial fiber, undersea cables, or satellite links in low Earth orbit.

If that’s the principle, then achieving ‘orbit-neutral’ sovereignty requires international legal alignment, secure encryption, and clear governance standards that protect data integrity regardless of physical topology. Failure to develop rules and safeguards here (that is, failure to develop adequate technology governance) treats space as a lawless transit zone, subject to ambiguity and conflict.

2. Security Creates Trust (And Agency)

You cannot have digital sovereignty without trust, and you cannot earn trust without cybersecurity.

Space-based connectivity is becoming part of critical infrastructure. Not too far from now, power grids, maritime shipping, financial transactions and (I guess this is already true) defense networks rely on those connections. If that’s true, then it’s also true that satellite constellations will become high-value targets for malicious actors. There’s already work being done to envision this near future of cyber threat: ground station breaches, telemetry and command spoofing, signal jamming, inter-satellite link interception, and supply chain vulnerabilities in satellite hardware and software.

Without rigorous, end-to-end cybersecurity, any promise of “digital sovereignty” is an illusion. A sovereign nation or enterprise that relies on insecure satellite communications has surrendered its autonomy to whoever controls or disrupts those feeds.

And this impacts people too! Cybersecurity is the bedrock of individual agency. If anyone can access your data and your digital life without your permission or consent, you don’t have agency. In an increasingly connected world, individual rights—privacy, freedom of expression, and access to information—depend on secure communications. When space networks prioritize strong cryptographic standards, zero-trust architectures, and resilient hardware, they do more than defend systems; they protect the fundamental rights and agency of the citizens who rely on them.

3. Learning from History: Security by Design in Space

When CERN cooked up the world wide web and commercial Internet bloomed decades ago, speed, openness, and interoperability were prioritized. Security, not so much. It became an afterthought, a secondary layer added later through patches, firewalls, and protocols designed to fix inherent structural vulnerabilities. We have spent the last thirty years paying the price for those architectural choices in the form of ransomware, supply chain breaches, and pervasive cyber espionage.

How can we learn from this mistake?

Coming back to the conversation at Nasdaq, it’s terrific seeing one of the OGs of cyber looking at satellites. Learning from history looks like prioritizing cyber resilience, supply chain transparency, and tamper-proof security that is built directly within satellite hardware and constellation management prior to deployment. 

Learning from history looks like learning how to build systems that are defensible, resilient, and worthy of public trust – before they get launched.