TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsWhen sovereignty turns into a service
How much control can a state truly exercise over its digital space when the core architecture of the internet is owned and operated by foreign private corporations?
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
Illustration of digital security (Shutterstock/File)
I
ndonesia’s dispute with online services provider Cloudflare, triggered by its delay in registering as an Electronic System Operator (PSE) and its links to illegal online gambling sites shielded behind its protective infrastructure is more than a regulatory confrontation. It exposes a fundamental question: how much control can a state truly exercise over its digital space when the core architecture of the internet is owned and operated by foreign private corporations?
Cloudflare’s technology is not inherently political. As a Content Delivery Network (CDN) and reverse proxy, it accelerates websites, protects servers from Distributed Denial of Service (DDoS) attacks and masks origin locations. These features make it indispensable to Indonesian business, hospitals, universities and public agencies. Yet the same protective shields also allow illegal networks to hide in plain sight. When gambling operators route their operation through Cloudflare, regulators struggle to identify servers they are expected to shut down. The state’s authority hits a technical limit.
The government’s demand that global platforms comply with domestic rules is justified. No sovereign state can govern effectively without the ability to enforce its own laws. But the Cloudflare episode shows that in the digital age, legal authority alone is insufficient. Enforcement now depends on cooperation from private corporations headquartered abroad. A state may assert sovereignty on paper, but its practical sovereignty hinges on access to, and influence over digital infrastructure it does not control.
This dilemma is not uniquely Indonesian. Governments worldwide are confronting the immense leverage of private digital infrastructure. One of the sharpest explanations comes from scholars Rafael Grohmann and Alexandre Barbosa, who argue that Big Tech increasingly positions itself as a provider of quasi-sovereign functions, packaging cloud services, data infrastructure and cybersecurity as “sovereignty solutions”, implying that political control can be purchased as services. Their critique is clear: states are shifting from exercising sovereign functions to outsourcing them.
For Grohmann and Barbosa, “sovereignty-as-a-service” is not a technical evolution but a political warning. Cloudflare, AWS, Google, Meta and Akamai now provide services that resemble core state roles, from identity verification and content moderation, to routing control and data protection. These companies, they argue, “govern without being governments”. The danger is especially acute in the Global South, where digital autonomy is proclaimed but executed through foreign-owned infrastructures.
Brazil illustrates this contradiction. Despite its rhetoric of digital sovereignty, Brasilia relies heavily on AWS to operate tax systems, welfare distributions and part of its election infrastructure. Scholars describe this as “sovereignty in speech, dependency in infrastructures”, a pattern that resonates strongly with Indonesia’s situation. Like Brazil, Indonesia promotes digital independence yet relies on global platforms whose systems lie outside its jurisdiction and technical reach.
In this environment, sovereignty is no longer a fixed attribute of the state, but a practice shaped by interoperability with private systems. A government may have the legal authority to block harmful sites, but when those sites are protected by a global CDN with no local presence, enforcement requires negotiation. Sovereignty becomes contingent on the willingness and incentives of private companies that do not always align with national priorities.
