Learn how the Global CBPR Forum advances data protection and cross-border privacy through global cooperation and frameworks.

An ISOC LIVE Summary

  Russian daily communication has been disrupted in recent weeks, as familiar digital channels are experiencing problems under mounting regulatory pressure, disrupting the rhythms of everyday communication.  What appears at first glance to be a technical inconvenience is in fact a deliberate realignment of the country's information ecosystem that has been going on for several years. A domestically developed alternative known as Max has been elevated by authorities in parallel to globally embedded messaging platforms such as WhatsApp and Telegram, while authorities restrict access to these platforms.  There is no subtlety or incident in the shift. It is an assertive attempt to redefine the boundaries of digital interaction within the state's sphere of influence. Millions of users are directed towards a platform that remains closely aligned with Kremlin interests in terms of architecture and governance. With Max, introduced in 2025 by VK, the platform becomes much more than just a conventional messaging platform, marking a significant escalation in this strategy. By consolidating communication tools with state-linked utilities, such as access to government services, financial transactions, and the development of a digital identity framework, it provides the functionality of an integrated digital ecosystem. Despite bearing structural similarities to WeChat, the implementation is in line with Moscow's long-standing pursuit of technological autonomy. Although adoption is a voluntary process, infrastructure incentives and regulatory constraints have combined to create conditions in which disengagement has become increasingly difficult. A secure and sovereign alternative has been framed by endorsements from Vladimir Putin, reinforcing the policy direction, as noted by internet governance scholar Marielle Wijermars, that has culminated efforts to reconfigure the nation's internet architecture toward tighter state oversight.  As part of the transition, technical integration and controlled accessibility are being implemented. Max has been pre-installed on numerous domestically sold consumer devices since September, reducing entry barriers while subtly standardizing its presence.  A number of features are included in the interface, including private messaging, broadcast channels, and user engagement, which minimize friction for new users as it mimics established platforms. However, its differentiation lies in its privileged network status: by being included on Russia's approved "white list," the company ensures uninterrupted connectivity during periodic connectivity restrictions, which authorities attribute to defensive measures against external threats.  Furthermore, geopolitical considerations also play a role, as initial restrictions on Russian and Belarusian SIM cards have been expanded selectively to a limited group of countries who are considered politically aligned.  Although the platform has been widely distributed in countries such as the European Union and Ukraine, these markets are notably absent, even as the platform becomes enmeshed in larger information dynamics, including its perceived role as a means of countering rival cross-border coordination applications such as Telegram and WhatsApp.  Russia itself continues to receive uneven receptions, suggesting an increasing divide between state-driven digital consolidation and a population long accustomed to more open communication systems. As a result of this transition, established communication patterns are disrupted, which has already begun to affect professionals who rely on continuity and reliability as part of their workflows.  Before routine connectivity began to fail without warning, Marina, a freelance copywriter based in Tula, had been relying on WhatsApp for both client interactions and personal exchanges. There has also been little success in shifting conversations to Telegram, reflecting a broader trend experienced by millions as Roskomnadzor imposed restrictions on voice and messaging functions across the country's most widely used platforms in mid-August.  There have been concerns about the timing of these limitations, which coincide with the rapid deployment of the state-backed Max ecosystem. With WhatsApp's user base estimated at approximately 97 million, and Telegram's user base estimated at 90 million, this disruption goes far beyond inconvenience, reaching into the foundations of social and economic interaction on a daily basis.  These platforms have been providing informal digital backbones for many years, facilitating everything from family coordination and residential management groups to hyperlocal commerce in areas lacking conventional internet access. For example, message applications often serve as a substitute for broader digital infrastructure in remote parts of the Russian Far East, enabling services such as ride coordination and small-scale transactions as well as information sharing within the community.  In addition to implementing end-to-end encryption, both platforms have also implemented security architectures that prevent intermediaries, including service providers, from gaining access to communications' contents.  Russian authorities assert that the restrictions are justified by compliance failures, particularly the refusal to localize user data within national borders, along with concerns over fraud. Based on available financial sector data, however, most scams remain perpetrated through traditional mobile networks rather than encrypted applications, according to data available to the financial sector.  Analysts and segments of the public view these measures as part of a broader effort to improve visibility into interpersonal networks and information flows, with a less technical but more strategic interpretation. According to Marina, who requested anonymity due to concerns about possible consequences, the shift is not simply one of technology, but one of social space narrowing, with the ability to maintain connections outside of state-mediated channels gradually becoming increasingly restricted.  Through regulatory pressure as well as institutional dependency, Max is being reinforced within everyday workflows.  To maintain access to essential services, individuals across sectors report a growing requirement for the platform. In her experience, Irina describes being forced to utilize Max to communicate with her children's school communications and navigate the Gosuslugi, where patient appointments are increasingly coordinated.  Across corporate and educational environments, similar patterns are emerging as employers and schools standardize their internal communication platforms. The public visibility of Max is also increasing as celebrities and digital influencers migrate their content ecosystems to Max, enhancing its normalization, parallel to this structural push.  According to analysts such as Dmitry Zakharchenko, the campaign has been unusually strong, comparing it to the centrally orchestrated messaging efforts of earlier eras, which has nonetheless been able to accelerate adoption to approximately 100 million users within a short period of time.  In terms of technical characteristics, the platform represents a broader trajectory of Russia's "sovereign internet" initiative, which prioritizes control over data flows and infrastructure over international interoperability. As opposed to Telegram and WhatsApp, Max does not utilize end-to-end encryption technology, and its data governance framework requires that all user information be stored on domestic servers, thereby making it subject to the jurisdiction of government regulators and security agencies.  Many users express only a limited level of concern, regarding compliance as inconsequential when there is no perceived risk. However, others have sought alternatives, including IMO, or have refused to adopt Max altogether. However, this resistance appears to be increasingly constrained as Max's structural integration into critical services increases. Even among skeptics, prevailing sentiment indicates that participation may soon become unavoidable as the country's digital environment narrows toward a state-defined center of gravity. For policymakers, technologists, and civil society observers, Max's trajectory provides a valuable example of how digital sovereignty and user autonomy are evolving in an increasingly dynamic environment.  By rapidly integrating the platform into essential services, people can see how infrastructure can be a subtly effective tool for shaping behavioral compliance, particularly when alternatives are systematically restricted. As a result, centralized control over communication ecosystems raises further concerns regarding transparency, data governance, and long-term consequences.  Russia is likely to continue to grapple with a defining tension as they advance this model in order to balance national security objectives with individual privacy rights. This type of system will ultimately be determined by the level of state enforcement as well as the level of trust among users, the resilience of alternative networks, and the worldwide response to fragmented digital environments.

Vietnam has officially stepped into the global vanguard of digital governance. On March 1, the country’s landmark Law on Artificial Intelligence took effect, establishing one of Southeast Asia's…

Sanjay K Mohindroo

USTR flags Indias UPI rules, data localization and internet shutdowns as digital trade barriers, also criticizes high farm tariffs and other non tariff hurdles for US firms

  From the ongoing war in Ukraine, to instability in the Middle East, and rising tensions in the South China Sea, global conflicts are proving that digital systems are deeply exposed to geopolitical risks. Speaking at London Tech Week, UK Prime Minister Keir Starmer highlighted how warfare has evolved, noting that it “has changed profoundly,” and emphasizing that technology and AI are now “hard wired” into national defense. His remarks underscored a critical point—IT infrastructure and data management must be approached with security at the forefront. But achieving this is no easy task. New research from Civo reveals that 83% of UK IT leaders believe geopolitical pressures threaten their ability to control data, while 61% identify sovereignty as a strategic priority. Yet, only 35% know exactly where their data is located. This isn’t just a compliance concern—it signals a disconnect between infrastructure, policy, and long-term strategy. Once seen as a policy or legal issue, data sovereignty is now a live operational necessity. With regulatory fragmentation, mounting cyber threats, and increasingly complex data ecosystems, organizations must actively manage sovereignty. Whether it’s controlling access to AI training data or meeting residency rules in healthcare, sovereignty dictates what businesses can and cannot do. Legislative frameworks such as the EU Data Act, the UK’s evolving stance post-Brexit, and stricter critical infrastructure policies are shaping enterprise resilience. As Lord Ricketts stated in the House of Lords, “the safe and effective exchange of data underpins our trade and economic links with the EU and co-operation between our law-enforcement bodies.” Building trust now depends on robust and enforceable data governance. Public cloud adoption has given many businesses the illusion of flexibility, but moving quickly isn’t the same as moving securely. Data localization, jurisdictional controls, and aligned security policies must be central to enterprise strategy. This demands a shift: design IT systems for agility with control, or risk disruption when regulations inevitably change. Sovereignty-aware infrastructure is not about isolation, but about visibility, governance, and adaptability. Organizations must know where data is stored, who can access it, how it travels, and which policies apply at each stage. A hybrid multicloud approach offers the flexibility to scale, while keeping sovereignty and governance intact. For instance, financial firms may need to keep sensitive transaction data within the UK but still run analytics in the cloud—an architecture that enables agility without sacrificing compliance. Generative AI further complicates sovereignty. Training models with private datasets, deploying inference at the edge, or simply exchanging prompts across jurisdictions introduces new risks. Many businesses have embraced AI without aligning deployments with residency or compliance requirements. Sovereignty now extends beyond storage—it covers compute, access patterns, and third-party model interactions. Building sovereignty into design requires collaboration between IT, legal, and compliance teams, as well as infrastructure that supports location-aware policies from day one. Research from Nutanix shows the urgency: 94% of public sector bodies are using generative AI tools, yet 92% admit their security isn’t sufficient, and 81% say their infrastructure falls short of sovereignty needs. Customers and partners are increasingly demanding transparency—knowing where data resides, how it is used, and whether governance is enforced. Regulators are also raising expectations beyond “checkbox compliance.” In sectors like healthcare, education, finance, and government, sovereignty is now synonymous with trust and continuity. The path forward starts with clarity. Organizations must know where their data lives, what laws apply, and whether their infrastructure can support hybrid deployment, location controls, and detailed audits. They must also plan for generative AI workloads with sovereignty in mind, ensuring scale does not come at the expense of compliance. Ultimately, sovereignty should be treated not as a restriction, but as a design principle. Businesses that do this will not only remain compliant but will also build resilience, transparency, and long-term trust. In an environment where data moves faster than regulation, maintaining control is no longer optional—it is fundamental to good governance and sound business strategy.

India must move beyond data sovereignty to build and own LLMs as critical infrastructure, ensuring true AI autonomy and cultural integrity.

Context: On April 6th 2018, the Reserve Bank of India issued a circular, which mandates all payment ecosystem players operating in India to…

Sanjay K Mohindroo

Country is one of only a handful – alongside China and North Korea – where service fails to function as it should

Discover why Data Sovereignty is critical for Indian enterprises. Learn laws, risks, and how ESDS Sovereign Cloud ensures compliance and security.