Season One — Rome · Episode 2 of 9. Originally published at richardstpierre.com/mosaic-doctrine/s1e2-data-embassies.
A working table in Rome, in the days around the symposium. Across from me, a European technology investor who runs a fund with several billion euros behind it, and who had just come back from opening a research centre in Beijing.
I have learned not to lead with this idea. It sounds far-fetched the first time, and the people who grasp it immediately usually think I have said something illegal. So I go slowly. The embassy of Canada in Italy — or in any country, for that matter — is inviolable. Italian police cannot walk in. Italian courts cannot reach inside. It sits on Italian soil and Italian law stops at the door. That status is not a metaphor and not a courtesy — it is one of the oldest and most robust legal technologies we have, and it has survived wars.
Now apply it to a building full of servers.
I get four sentences in. He does not need the fifth.
“So you mean a Canadian embassy data centre in China.”
Yes. That is exactly what I mean.
The reason the idea lands hard is that it inverts the question everyone has been asking. For a decade, digital sovereignty has meant keeping our data at home — data residency rules, national clouds, localisation mandates. That framing has one fatal property: it makes sovereignty a function of geography, and geography is the one variable a mid-sized country cannot optimise. You cannot conjure hyperscale capacity inside your borders by legislating that it must be there. You can only make it more expensive not to have it.
The data embassy inverts it. Stop asking how to keep the data at home. Start asking how to keep your law attached to the data wherever it happens to sit.
This is not speculative, which is the part that surprises people. Estonia — a country that has been the subject of a real cyberattack and drew real conclusions from it — has operated a data embassy in Luxembourg since 2017, holding critical state systems under Estonian jurisdiction on Luxembourgish soil. Monaco followed in 2021. The World Economic Forum wrote the definition down this May, in a paper on AI infrastructure and sovereignty: such arrangements “enable the creation of secure digital spaces in a host country where a guest country’s (or organization’s) data, workloads storage and compute remain governed under its own jurisdiction.”
The same paper contains the sentence that, to my mind, ends the whole self-sufficiency debate: “for most economies, self-sufficiency is unrealistic given the scale, complexity and concentration of AI infrastructure required. Therefore, AI sovereignty must be pursued through strategic interdependence.”
Strategic interdependence is not a compromise position. For a country whose geography will never hold hyperscale capacity — most of the Global South, and most small states — it is the only position that survives contact with the physics.
There is also a resilience argument that gets lost because it is boring. The instinct of a government told to build sovereign infrastructure is to build one very good facility — Tier 4, maximum redundancy, ribbon-cutting. A Tier 4 facility costs three to four times a Tier 2. For the same money you can distribute several Tier 2 facilities across several jurisdictions, and the distributed arrangement survives things the single facility does not: a grid failure, a legal change, a sanctions regime, a war. The Holy See is the extreme illustration — more than half its territory sits outside Rome. It has been doing distributed sovereignty since long before there was anything to distribute.
Now the objection, and it is the right one.
This is a legal fiction stapled to somebody else’s cloud. A diplomatic note does not encrypt anything. If the host’s engineers hold the keys, if the network egress is controlled by the host’s carrier, if the operational runbook is written by the vendor, then your “sovereign” facility is a normal facility with a flag on the door — and the flag will not help you on the day it matters.
That objection is correct, and it is the hinge of this entire series. Legal status without technical detachability is theatre. What makes a data embassy real is a set of unglamorous engineering properties: you hold the keys; you control the network path; you can operate it with your own people if you have to; and you can leave — pick up the workload and move it to another jurisdiction without rebuilding it. Detachability is the property. Everything else is packaging.
Which is why this is a two-part act, and most countries will do only the first part. Declaring that data centres may hold sovereign status is a stroke of a pen for a head of government — an afternoon’s work, a good press conference. Building the architecture that makes the declaration enforceable is three years of procurement, key management, network engineering and contract law that nobody will ever write about.
The encyclical is blunt about what is at stake if the second part never happens. Colonialism, it says, “no longer dominates only bodies, but appropriates data… These have become the new ‘rare earths’ of power.”
You can put your flag on a building. The question is whether you can carry it out.
Previously: The Intelligence Delta. Next Tuesday: Beyond the Hegemon.
Tile 2 of 9: Sovereignty travels with the law, not with the geography — but only if the architecture can carry it.
Next Tuesday, 3 November: Episode 3 — Beyond the Hegemon.
All episodes: https://richardstpierre.com/mosaic-doctrine