Digital Supply Chain Dependency and Resilience

While a growing body of literature addresses how states increasingly aim to secure their digital domains and mitigate dependencies, less attention has been paid to how infrastructural and architectural configurations shape their ability to do so. This paper provides a novel approach to studying cyber security and digital dependencies, paying attention to how the everyday business decisions by private companies affect states’ ability to ensure security. Every mobile application relies on a multitude of microservices, many of which are provided by independent vendors and service providers operating through various infrastructural configurations across borders in an a-territorial global network. In this paper, we unpack such digital supply chains to examine the technical cross-border services, infrastructural configurations, and locations of various microservices on which popular mobile applications depend. We argue that these dependencies have differing effects on the resilience of digital technologies at the national level but that addressing these dependencies requires different and sometimes contradictory interventions. To study this phenomenon, we develop a methodology for exploring this phenomenon empirically by tracing and examining the dispersed and frequently implicit dependencies in some of the most widely used mobile applications. To analyse these dependencies, we record raw traffic streams at a point in time seen across various mobile applications. Subsequently locating these microservices geographically and to privately owned networks, our study maps dependencies in the case studies of Oslo, Barcelona, Paris, Zagreb, Mexico City, and Dublin.

1. Introduction

The security of digital networks and technologies is an increasingly important issue for states. Early iterations of national security concerns in Western states primarily understood digital vulnerabilities from the lens of threats to critical infrastructures. In recent years, however, a richer understanding of cyber security has developed ( Dunn Cavelty and Wenger 2020 ), drawing attention to infrastructural configurations ( Musiani et al. 2016 , 268), private interests ( Srivastava 2021 ), and the unequal distribution of digital resources globally ( Kwet 2019 ). Notably, scholars have increasingly started to dissect understandings of power and vulnerability rooted in complex interdependencies to depict how digitalization, geo-economics, and the security concerns of states intersect ( Cartwright 2020 ; Nye 2020 ; Mügge 2023 ).