The drone attack on Amazon Web Services infrastructure in March 2026 may ultimately be remembered as far more than a cyber-security incident.

It exposed a reality that governments, militaries, and corporations have long preferred not to discuss openly:

The cloud has become critical infrastructure.

And critical infrastructure has become a target.

For years, Europe's debate about digital sovereignty revolved around familiar questions. Should government data be stored in Europe? Should sensitive workloads run on domestic infrastructure? How much dependence on American technology is acceptable?

The AWS attack shifted the conversation.

Suddenly, the vulnerability of hyperscalers was no longer theoretical. The world's largest cloud providers were no longer viewed simply as technology companies. They had become strategic assets embedded within national security ecosystems.

Yet physical vulnerability may not be the most dangerous aspect of the problem.

The deeper challenge is legal.

And no one has solved it.

The Sovereignty Illusion

European governments often treat digital sovereignty as a question of geography.

Build a data center in Europe.

Store data within European borders.

Apply European regulations.

Problem solved.

Except it isn't.

Because sovereignty is not ultimately determined by where data resides.

It is determined by who controls access to it.

A server farm in Frankfurt may be physically located inside Germany, powered by German electricity, protected by German police, and subject to European privacy regulations.

Yet if the platform itself remains legally tied to a foreign jurisdiction, a strategic dilemma remains.

In normal times, this may appear manageable.

In a geopolitical crisis, it becomes existential.

The uncomfortable reality is that digital infrastructure now occupies the same strategic category that energy pipelines, submarine cables, ports, and telecommunications networks occupied in earlier eras.

Governments depend on it.

Militaries depend on it.

Economies depend on it.

And therefore geopolitical power depends on it.

The Digital Version of "Dead Hand"

During the Cold War, the Soviet Union reportedly developed the Perimeter system, known in the West as the "Dead Hand."

Its logic was simple and terrifying.

If national leadership disappeared and no cancellation signal arrived, the absence of communication itself became the trigger for action.

The system transformed silence into a command.

While today's cloud ecosystem has nothing to do with nuclear deterrence, the analogy is increasingly relevant.

Modern societies operate through digital command chains.

Government databases.

Financial transactions.

Military logistics.

Health records.

Industrial control systems.

Cloud-native applications.

The question is no longer whether these systems are connected.

The question is what happens when control over that connectivity becomes uncertain.

Every nation effectively possesses a digital dead-man switch.

Few have identified where it is.

The Problem Europe Is Only Beginning to See

The AWS incident highlighted physical risk.

A data center can be attacked.

A communications hub can be disrupted.

Power can be interrupted.

Networks can be degraded.

But legal vulnerability is often much harder to detect.

Physical attacks are visible.

Jurisdictional dependencies are invisible until they matter.

That distinction is critical.

A nation can spend billions protecting infrastructure from missiles, drones, sabotage, and cyberattacks.

Yet if strategic decision-making around access, governance, or operational control remains externally dependent, sovereignty remains incomplete.

In other words, resilience is not just an engineering problem.

It is a governance problem.

The New Security Frontier

Europe's security debate has traditionally focused on tanks, aircraft, missiles, and industrial production.

Those issues remain important.

But a new strategic layer has emerged beneath them.

Data infrastructure.

Cloud architectures.

AI environments.

Digital operating systems.

Information flows.

The battlefield of the future will not exist separately from these systems.

It will depend on them.

Military headquarters increasingly operate through digital ecosystems.

Governments manage crises through cloud-connected platforms.

Critical infrastructure relies on distributed networks and automated decision-making.

The distinction between national security and digital infrastructure is disappearing.

That changes everything.

The Strategic Question Nobody Wants to Answer

The most important question is not whether hyperscalers are secure.

They are among the most secure technology environments ever created.

The question is different.

Who ultimately remains in control during a geopolitical crisis?

Because sovereignty is tested not during normal operations.

It is tested during emergencies.

A nation does not discover the strength of its energy security when gas is flowing.

It discovers it during shortages.

Likewise, digital sovereignty is not measured on ordinary days.

It is measured when governments can no longer assume that political, legal, and technological interests remain aligned.

That is the lesson hidden beneath the AWS debate.

Beyond Data Residency

The next phase of digital sovereignty cannot focus exclusively on data location.

It must focus on continuity of control.

Who owns the infrastructure?

Who governs the platform?

Who controls access?

Who can make decisions in a crisis?

Who can prevent those decisions?

Those questions are no longer academic.

They are strategic.

The drone attack on AWS may have revealed the physical vulnerability of the cloud.

But the larger issue lies elsewhere.

The real sovereignty challenge begins when the servers keep running, the networks remain connected, and a country suddenly discovers it does not fully control the systems on which its state, economy, and security depend.

That is Europe's digital dead-hand problem.

And unlike the Cold War version, there is no established doctrine for dealing with it.

‍