Digital Sovereignty Turns Inward: Why states that cannot govern the machines end up governing their own people
Digital sovereignty is one phrase hiding two different things. Few who invoke it say which one they mean. The first kind is declared. A state passes a law, forms a committee, issues a directive, and announces that its digital space is “governed.” This kind of sovereignty is available to everyone. Any state can have it.
The second kind is built. It is compute, models, infrastructure, engineers. It is the ability to make the technology, run it, look inside it, and replace it when the relationship with its maker goes “south.” This kind of sovereignty is available to almost no one. China built it over decades, deliberately. America owns it, because most companies are American. Europe is spending billions trying to convert the first kind into the second by funding its own frontier model, in its own languages, on its own infrastructure, because it understood, albeit a bit late, that writing rules for machines you do not own is not the same as owning them. Everyone else declares.
The gap between the two kinds is easy to miss, because most of the time it is invisible to the governed. A state can run for years on declared sovereignty. The laws are passed, the committees meet, the directives circulate, and the digital space appears governed. Nothing actually tests the claim, until something/someone does.
Jordan has been “declaring” digital sovereignty for years. The record is worth reading in sequence.
In 2023, the Kingdom passed a new cybercrimes law. The government said it was answering a real problem: online fraud, extortion, and privacy violations had multiplied several times over in a decade. But the law’s reach went further than fraud. It criminalized vaguely worded offenses like spreading “fake news” and “provoking strife.” It ordered foreign platforms to open offices in Amman and answer to Jordanian courts, with slowed bandwidth as the penalty for refusal. No offices were opened. Enforcement never followed, except inward.
In February of this year, the government formed a national committee to protect children from the risks of social media, tasked with recommending the necessary technical measures. By spring, it was studying a minimum age for social media use. This is the most defensible instrument of the three. It is also the same move Europe made- with one difference that contains the whole story. When Europe restricts children’s access, it does so while fining platforms billions, forcing them to redesign their systems, and building a frontier model of its own. Jordan can only do the first part. Eleven million people is not a market that moves Meta. Even Australia, “rich and Western”, won platform cooperation mainly because the companies feared its example would spread to bigger markets. No one in California fears Jordan’s example. Five months in, the committee has published nothing. A committee that cannot compel the companies it regulates is, whatever its intentions, a message addressed inward: a state telling anxious parents that it is present.
Then came the image. This spring, on the eightieth anniversary of independence, the Kingdom’s embassy in Washington published a celebratory graphic. A flag flying from a rocky summit under a clear sky, the anniversary written above it. The image carried every mark of AI generation; the star had five points. The Constitution specifies seven, down to their size and geometry, carrying the seven verses of the Fatiha and the memory of the Arab Revolt. The machine chose five because that is what a star on a flag usually looks like in the images it learned from. Jordan’s seven points are rare in the world’s pictures, so the machine rounded them to the common one. The Kingdom’s most identity-laden symbol, on its most identity-laden date, averaged into the global norm by its own embassy in DC.
In July, the government issued a circular prohibiting the use of artificial intelligence to create or alter national emblems, flags, and sovereign symbols, and requiring that only approved versions be used. Read alone, the circular looks like caution. Read in sequence, it is something else. This perceived and documented threat to Jordan’s symbols did not come from a citizen misusing a tool. It came from inside the state’s own apparatus, reaching for a machine it does not own and cannot see into. And the state answered with the only instrument it has: a rule that binds Jordanians and cannot bind the machine.
Put the three instruments side by side and a pattern appears. Every one of them governs Jordanians: their speech, their children’s screens, their use of the machines. None of them governs the technology itself. The platforms and the models sit in San Francisco. The rules that actually bind them are written in Washington, Brussels, and Beijing. Jordan’s instruments stop at Jordan’s borders, which is to say, they stop at Jordanians. This is not a Jordanian failing. It is what the second kind of sovereignty predicts for any state without capital and compute. A government that cannot reach the infrastructure will govern what it can reach. And what it can reach is its own population.
The less capacity a state has over digital infrastructure, the more control it tends to exercise over its own people. Sovereignty gets performed inward when it cannot be exercised outward.
That is the quiet inversion at the heart of this piece, and it deserves to be stated plainly. The performance is not cynical, or not only cynical. Each instrument answers a real anxiety. The fraud is real. The harm to children is real. The dissolving of national symbols into machine averages is real. But the instruments share one architecture: they discipline the users of technologies whose makers are untouchable. The law summons the citizen because it cannot summon the platform. The committee reassures the parent because it cannot restrain the algorithm. The circular corrects the Jordanian because it cannot correct the machine.
And the circular shows the limit of even this. The state can punish the citizen who circulates a five-pointed star. It cannot teach the machine to draw seven. So the hypothesis is on the table: the less capacity a state has over digital infrastructure, the more control it exercises over its own population. It is worth asking honestly whether it holds.
In one direction, it holds well. Jordan is a case, but not a lonely one. The past decade has produced a documented surge of cybercrime laws across the developing world, written in the language of fraud and security, used in practice against journalists, bloggers, and critics — in states that could not, in the same decade, build a single piece of the infrastructure those laws claim to govern. What these states share is not geography. It is the gap between what they can declare and what they can build.
In the other direction, it complicates. China has more capacity than anyone, and more internal control than anyone. There, capacity was built in order to control; the two sovereignties reinforce each other rather than substitute. And America, which owns the infrastructure, spent this spring turning its instruments inward too: export directives, blacklists, a demand for what its own officials called “alignment”, not against its citizens, but against its own leading AI company. So the more honest version of the hypothesis is narrower and harder: capacity does not decide whether a state disciplines. It decides what a state is able to discipline. The powerful discipline the companies. The rest discipline their citizens.
Control is a constant. Capacity only decides its target
This is what the collision of the two sovereignties actually looks like. Not a clash of doctrines, but two forces passing through each other in ordinary moments. A machine trained under someone else’s capacity draws a five-pointed star inside Jordan’s symbolic space of trust, identity, and narratives without ever crossing a border. A state armed only with declaration answers with a circular. Each is exercising the only sovereignty it has. One governs probability. The other governs people. And the population stands at the single point where both apply, shaped by models it did not choose, restricted by rules its dependency produced.
If the hypothesis holds, it carries a prediction: every new capability built abroad will produce a new restriction at home. The real measure of a state’s digital weakness will not be found in what it fails to build. It will be found in what it forbids. The question the coming years will answer, in Jordan and across the region, is which is growing faster: the capacity out there, or the control in here, and whether anyone drafting the circulars is keeping count.