The new geopolitics of EU cybersecurity: security, economy and sovereignty

Abstract The European Union (EU) is currently experiencing significant geopolitical shifts and is concerned that its dependence on externally produced or foreign-owned technologies risks its strategic autonomy, with implications for its security and economy. In response, it has placed sovereignty at the forefront of its agenda and at the centre of its relations with the world. Academic literature has so far paid limited attention to understanding the interactions between geopolitics, perceptions of technological dependence, and the impact on policy governance in cybersecurity. Bearing this gap in mind, the article asks how the EU's discourse of sovereignty and reducing external dependencies is shaping its approach to cybersecurity. Applying regulatory mercantilism and policy analysis to three case-studies—focusing on control of semiconductors, data server location, and cybersecurity certification— the article finds that the EU's depiction of its cybersecurity as impacted by dependence on externally manufactured products resulted in the merging of security and economic rationales. This has translated into efforts for greater control, either through promoting production within the European physical space through security-influenced industrial policies or—when this is not possible—by exerting regulatory influence beyond Europe's borders. Where globalization is believed to have failed, regulatory mercantilism becomes more likely as a policy approach.