Surveillance programs make the hidden stack visible.
Week 1 • Part III
THE RUPTURE
Snowden revealed that the open internet depended on hidden chokepoints. (2013)
Scroll to Explore
Reading map
The Rupture Chain
Read this module as a causal sequence: the key question is not only what Snowden revealed, but which layers of internet order became governable once hidden surveillance capability was exposed.
Exposure
Hidden capabilities become visible and turn stewardship into a legitimacy question.
Stewardship claims become harder to defend.
Response
States, institutions, and firms react at different layers of the network stack.
Democracies seek legal and infrastructural insulation.
Internet institutions absorb pressure to de-Americanize.
Platforms encrypt, disclose, and litigate.
Reordering
Data governance hardens into jurisdictional infrastructure and leads into the next module.
Surveillance law becomes data-flow governance.
The next module follows sovereignty into the stack.
June 2013:
The Stewardship Claim Breaks
The Snowden disclosures of June 2013 made a hidden dependency visible: an internet described as open, borderless, and commercially driven also depended on infrastructures that could be used for state surveillance.
"The power of new technologies means that there are fewer and fewer technical constraints on what we can do." — President Barack Obama, remarks on signals intelligence, 2014
The shift was conceptual as much as technical: U.S.-anchored "stewardship" now had to be read alongside "asymmetric visibility." The same architecture that enabled global reach also exposed the political concentration underneath it.
Assumption shift
What changed after the disclosures
Pre-2013 assumption
- Open commons
Interconnection was treated as a benign public good.
- Benign stewardship
U.S.-anchored governance looked like practical coordination.
- Commercial platforms
Major firms appeared mainly as services and markets.
- Global routing efficiency
Concentrated routes were understood as speed and scale.
Post-Snowden rupture
- Strategic chokepoints
Infrastructure concentration became a control surface.
- Surveillance hegemony
Stewardship claims were recoded as asymmetric visibility.
- Platform exposure
Private services became routes into state power.
- Jurisdictional routing risk
Where data moved now mattered politically and legally.
Disclosure
What Snowden Revealed
The disclosures made hidden collection programs legible as platform, cable, and search dependencies.
PRISM
Provider-Side Collection
Direct access to servers of major tech companies including Google, Facebook, Apple, Microsoft, and Yahoo. "Collection directly from the servers."
9 Major Providers
UPSTREAM
Network-Side Collection
Wire-speed packet inspection at fiber optic cable landing stations. Copying entire data flows as they traverse the internet backbone.
Wire-Speed Interception
XKEYSCORE
The Search Engine
A system allowing analysts to search virtually all internet activity across emails, online chats, and browsing histories.
Universal Search Capability
Network Chokepoints
Tapping the Fiber Backbone
Upstream showed that surveillance capacity was not only a platform question. It could also sit inside the internet's physical infrastructure, where cable routes and landing stations made bulk collection technically possible.
1
Fiber optic cables tapped at landing stations
2
Data copied at wire speed without provider knowledge
3
Foreign and domestic traffic both captured
Diagram: Fiber optic tapping at cable landing station
Defensive Sovereignty
Democracies Turn Sovereign
Democratic governments treated the disclosures as a sovereignty problem: exposure to foreign surveillance became a reason to revisit infrastructure, law, and diplomatic control.
Diplomatic protest becomes infrastructure strategy
"Brazil will redouble its efforts to adopt legislation, technologies and mechanisms to protect us from the illegal interception of communications and data." — President Dilma Rousseff, UN General Assembly, 2013
- Trigger
- Reports that the NSA intercepted presidential communications and Petrobras-linked traffic.
- Political response
- Rousseff cancelled a U.S. state visit and used the UN General Assembly to reject surveillance as normal statecraft.
- Infrastructure / legal response
- Brazil backed Marco Civil and the EllaLink cable as ways to reduce dependence on North American routes.
- Limit
- Routing autonomy did not remove dependence on global platforms, cloud providers, or U.S.-centered technical standards.
Privacy shock becomes regulatory sovereignty
"Spying on friends is not acceptable at all." — Chancellor Angela Merkel, 2013
- Trigger
- The reported monitoring of Merkel's phone turned surveillance into a legitimacy crisis inside a close alliance.
- Political response
- German and EU debate shifted toward strategic autonomy, privacy rights, and distrust of extraterritorial U.S. access.
- Infrastructure / legal response
- Schengen-routing proposals, GDPR enforcement, and Gaia-X expressed the search for European control over data and cloud layers.
- Limit
- European law created leverage, but the region still depended on hyperscale cloud, platform services, and transatlantic data transfers.
Response ladder
2013
Diplomatic shock
Rousseff and Merkel make surveillance a question of sovereignty and alliance legitimacy.
2014
Governance reform pressure
NETmundial channels the shock into demands for a more credible multistakeholder order.
2016
GDPR adopted / IANA transition completed
Legal and institutional responses start changing the terms of data protection and root-zone stewardship.
2018
GDPR enforced
Privacy rights become a regulatory instrument for shaping cross-border digital activity.
2019
Gaia-X launched
European sovereignty moves higher in the stack, toward cloud, data spaces, and industrial coordination.
Governance Rebalancing
NETmundial and the Legitimacy Repair Problem
NETmundial became a visible forum for converting post-Snowden legitimacy pressure into governance reform debate.
Cyber-Realists
US & Allies
- Preserve multistakeholder model
- Maintain ICANN/IANA control
- Resist UN ITU oversight
Sovereignists
Russia, China, Iran
- State-centric internet governance
- UN/ITU institutional control
- National data sovereignty
Non-Aligned
Brazil, India, South Africa
- Reform multistakeholderism
- More inclusive governance
- IANA transition to global community
The IANA Transition (2016)
A Symbolic De-Americanization, Not a Full Exit
In response to global pressure, the U.S. government agreed to transfer control of IANA—the system that manages the internet's root zone—from the Department of Commerce to the global multistakeholder community. The move repaired part of the legitimacy problem, but it did not eliminate U.S. structural advantages in platforms, cloud, standards, or surveillance reach.
October 1, 2016
Completed
Before 2016
NTIA contractual oversight
The U.S. Department of Commerce retained formal stewardship over the IANA functions contract.
ICANN / IANA root functions
Root-zone coordination operated under a structure that still carried visible U.S. supervisory authority.
2016 transition
Legitimacy repair
Global pressure turned symbolic U.S. stewardship into a governance problem that had to be addressed.
After 2016
Empowered community
Multistakeholder accountability mechanisms gained formal weight over the stewardship structure.
ICANN / PTI stewardship
IANA root functions continued without NTIA contractual oversight, but stayed inside the same wider institutional ecosystem.
What did not change
Platforms, cloud scale, standards influence, and surveillance reach remained structurally U.S.-advantaged after the symbolic transfer.
Splinternet Bridge
Routing Geography Becomes Political
The disclosures made a simple point harder to ignore: efficient routes are also jurisdictional routes, and jurisdictional routes can become surveillance chokepoints.
The routing chain
01 / Efficiency route
Traffic follows cheap, fast, existing paths.
Exchange points, undersea cables, cloud regions, and platform concentration make the network efficient by concentrating traffic.
02 / Chokepoint exposure
Concentration creates visibility.
Once data crosses a small number of jurisdictions and facilities, state access can scale beyond targeted interception.
03 / Sovereignty response
States try to reroute, localize, or duplicate.
The response is not only censorship; it is an attempt to redesign dependency, resilience, and governability.
01 Star Routing
Efficient concentration creates a jurisdictional surveillance surface.
02 Mesh Routing
Alternative pathways reduce single-route dependence, but they also fragment the network into planned zones of resilience.
Bridge to the splinternet
This is the conceptual handoff to Module 04. Once routing, cloud regions, standards, app stores, and cables are understood as political layers, the splinternet no longer looks like a sudden break from openness. It looks like the institutionalization of the post-Snowden sovereignty response.
Trust Repair
Trust Repair by Platforms
Silicon Valley did not simply "fight back." It repaired trust through encryption defaults, public transparency, and selective legal resistance to state access.
Mechanism 01
Encryption defaults
User connections, data-center links, and backbone traffic moved toward encryption as the new baseline for platform credibility.
Mechanism 02
Transparency and public trust repair
Disclosure reports, public letters, and security commitments became reputational tools after the legitimacy shock.
Mechanism 03
Jurisdictional/legal resistance
Companies challenged backdoors and extraterritorial warrants when state access threatened user trust or foreign-market legitimacy.
Encryption Defaults
After Snowden, major technology companies expanded encryption across user connections, data-center links, and backbone traffic. What had been unevenly deployed became part of the trust baseline.
HTTPS by Default
Google, Facebook, Twitter encrypt all connections
Data Center Encryption
Internal traffic between facilities encrypted
Transparency Reports
Regular disclosure of government data requests
HTTPS Adoption Growth
Source: Google Transparency Report
Jurisdictional and Legal Resistance
2016
Apple vs. FBI
Apple refused to create a backdoor to unlock the San Bernardino shooter's iPhone, citing the dangerous precedent it would set for all users' privacy.
Apple prevailed; case dropped
2016
Microsoft vs. USA
Microsoft challenged a US warrant for emails stored in Ireland, arguing that US law doesn't extend to data stored on foreign servers.
Led to CLOUD Act (2018)
2018
CLOUD Act Passed
Clarified that US law enforcement can compel providers to produce data regardless of where it's stored, while establishing frameworks for international agreements.
Data Borders
Surveillance Law Becomes Data-Transfer Law
European courts turned the Snowden problem into a data-flow problem: if U.S. surveillance law could reach transferred data, transatlantic transfer frameworks had to be legally re-tested.
| Framework | Court event | Surveillance issue | Effect on data flows |
|---|---|---|---|
| Safe Harbor 2000-2015 |
Baseline transfer arrangement for U.S. firms receiving EU personal data. | Assumed U.S. self-certification could coexist with adequate privacy protection. | Enabled routine transatlantic transfers until the Snowden disclosures made U.S. access legally contestable. |
| Schrems I October 6, 2015 |
The CJEU invalidated Safe Harbor after Max Schrems' complaint against Facebook. | U.S. surveillance practices were treated as incompatible with EU fundamental-rights protection. | Companies had to rely on alternative legal mechanisms while regulators reassessed U.S. adequacy. |
| Privacy Shield 2016-2020 |
Replacement framework attempted to add stronger U.S. commitments. | The core problem remained: intelligence authorities still had broad access pathways. | Transfers resumed under a more fragile legal basis. |
| Schrems II July 16, 2020 |
The CJEU struck down Privacy Shield and tightened scrutiny of Standard Contractual Clauses. | FISA 702 and EO 12333 still failed to provide EU-equivalent redress and proportionality protections. | Data transfer became a continuing compliance and sovereignty problem, not a solved trade issue. |
Governance Instruments for Data Borders
Sovereign cloud regions
AWS, Azure, and GCP create local control arrangements for regulated data.
Data localization
States require selected citizen, public-sector, or strategic data to stay in national jurisdiction.
National champions
Governments support domestic providers to reduce dependency in sensitive layers.
Data Borders
Data Becomes Jurisdictional Infrastructure
The Snowden disclosures reframed data from a mobile commercial input into a governable jurisdictional object: where data is stored, processed, and accessed now carries strategic meaning.
From free flow to governed location
Before 2013, data was primarily viewed through an economic lens: something to be mined, monetized, and moved freely. After Snowden, states increasingly treated data location, cloud jurisdiction, and lawful access as parts of national digital infrastructure.
Data localization laws
States require certain citizen or sectoral data to remain inside national jurisdiction.
Sovereign cloud regions
Cloud providers create local control arrangements to satisfy public-sector and regulatory demands.
AI sovereignty precursor
Training data, deployment channels, and model access become easier to politicize once data location is governable.
The jurisdictional shift
PRE-2013
Free-flow assumption
Data as mobile commercial input
POST-2013
Jurisdictional Infrastructure
Localization
Rights
Lawful access
Sovereign cloud
Data governance becomes a question of storage, processing, jurisdiction, and access.
Splinternet Bridge
What the Rupture Changed
The Snowden revelations of June 2013 did not end the internet commons by themselves. They changed how states, firms, courts, and publics interpreted the layers underneath it: trust, routing, governance, platforms, law, and data all became sites of geopolitical control.
| Layer | Pre-2013 assumption | Post-Snowden rupture | Bridge to Module 04 |
|---|---|---|---|
| Trust | The U.S.-anchored internet order could be treated as benign stewardship. | Stewardship became inseparable from asymmetric surveillance capacity. | Trusted and untrusted networks become explicit policy categories. |
| Routing | Traffic concentration was mainly a matter of speed, cost, and reliability. | Efficient routes became jurisdictional exposure and intelligence opportunity. | States start treating cables, gateways, and cloud regions as strategic terrain. |
| Governance | Multistakeholder institutions looked technically practical and politically neutral. | Governance legitimacy required visible de-Americanization and broader participation. | Standards bodies and governance forums become arenas of bloc competition. |
| Platforms | Major firms were primarily commercial services scaling across borders. | Platforms became trust intermediaries, lawful-access targets, and geopolitical actors. | App stores, clouds, and platform access become instruments of exclusion. |
| Law | Transatlantic data transfer could be handled as compliance paperwork. | Surveillance law became a condition for whether data could legally move. | Regulation becomes a sovereignty strategy, not only a privacy policy. |
| Data | Data was mobile, commercial, and naturally global. | Data became tied to jurisdiction, storage, processing, and access rights. | Data localization and sovereign cloud logic anticipate AI sovereignty. |
Fragmentation turns internet governance into internet geopolitics: data flows, routing, standards, and jurisdiction become objects of state power. Module 04 follows that logic as it hardens into the splinternet.
Sources & References
These references follow Part III's sequence: disclosure, defensive sovereignty, governance rebalancing, trust repair, data borders, and the legal rupture over transatlantic data flows.
Part III / 3.1 Disclosure
The Guardian, "The NSA Files"Reporting base for the Snowden disclosures and the surveillance architecture they revealed.
Part III / 3.1 U.S. response
Barack Obama, remarks on the review of signals intelligence (2014)The official U.S. response after the legitimacy shock.
Part III / 3.2 Defensive sovereignty
Dilma Rousseff, UN General Assembly statement (2013)
Brazil's diplomatic response after presidential communications were targeted.
EllaLink project overview
An infrastructure example for bypassing North American hub dependence.
GDPR, Regulation (EU) 2016/679
A legal instrument for Europe's defensive-sovereignty response.
Gaia-X
A cloud and data-space example for sovereignty higher in the stack.
Part III / 3.3 Governance rebalancing
NETmundial Multistakeholder Statement (2014)The primary document for the post-Snowden governance-fracture section.
Part III / 3.5 Trust repair
Apple, "A Message to Our Customers" (2016)
The direct source for the Apple-FBI encryption example.
Apple Transparency Report
A representative primary source for post-rupture transparency reporting.
Part III / 3.6 Data borders and legal rupture
EUR-Lex, CJEU judgment in Schrems I (Case C-362/14)
The ruling that ended Safe Harbor.
EUR-Lex, CJEU judgment in Schrems II (Case C-311/18)
The ruling behind the Privacy Shield collapse and new transfer regime.