Digital strategic depth is the ability of a state to maintain military and economic power by dispersing data and compute across distributed architectures to survive physical or cyber attacks. According to Blake Herzinger, Microsoft’s defense and national security policy lead for Asia, this shift moves the concept of “strategic depth” from geographical distance to the resilience and elasticity of cloud infrastructure.
Why is traditional geographic depth failing?
Historically, nations used vast territories to trade space for time, a strategy exemplified by the Soviet Union during World War II. However, precision-strike weapons and cyber capabilities have compressed the battlefield. According to Herzinger, no command node or data center can now assume sanctuary based on distance alone.
Recent conflicts illustrate this vulnerability. In Ukraine, the reach of long-range strikes and cyber operations has made fixed targets high-risk. Similarly, Iranian strikes on data centers in the Middle East caused service interruptions because redundancy models only accounted for the loss of a single availability zone, rather than regional clusters, according to reports cited by Herzinger.
How does cloud architecture create “digital depth”?
Modern military power relies on massive data processing. The U.S. Air Force previously reported collecting roughly six petabytes of data daily, which Herzinger notes is nearly a century of high-definition video. To manage this, states are moving away from centralized “sovereign” data centers, which act as fixed targets, toward three architectural pillars:
- Dispersion: Distributing data across different geographies and jurisdictions to complicate enemy targeting and reduce latency by moving compute closer to the theater of operations.
- Elasticity: The technical capacity to shift workloads and regenerate compute power across different regions instantly when one area is attacked.
- Optionality: Using multi-cloud designs to avoid vendor lock-in, ensuring a state can pivot between providers if a partner becomes politically or technically unreliable.
Ukraine provides a primary example of this in practice. The Ukrainian government stored critical warfighting applications and data on cloud infrastructure located outside its borders. This move placed operational advantages beyond the kinetic reach of Russian missiles while utilizing private-sector cybersecurity scale.
What is the Joint Warfighting Cloud Capability (JWCC) approach?
The U.S. government is implementing these concepts through the Joint Warfighting Cloud Capability (JWCC) Unified Cloud Marketplace. According to the program’s solicitation documents, the marketplace prioritizes “survivability” and “graceful degradation.”
The JWCC mandates specific physical and technical safeguards to ensure digital depth:
| Requirement | Strategic Objective |
|---|---|
| 400-mile separation between data centers | Prevents a single strike or power grid failure from disabling the network. |
| Global points of presence (all continents except Antarctica) | Ensures international availability and geographic dispersion. |
| Edge capability in denied environments | Allows devices to function “as if connected” even when real-time links are severed. |
| Dynamic data movement | Enables rapid failover to alternative nodes during an attack. |
Does sovereign control conflict with survivability?
Many governments pursue “data localization”—requiring data to be stored on domestic servers—to maintain control. However, Herzinger argues that maximizing localization often decreases survivability by creating “brittle” architectures. A single fixed data center, regardless of its defenses, remains a target with a known address.
The alternative is a “sliding scale” of control. By using cryptographic controls and sovereign access models, states can retain legal and political authority over their data without needing to physically house the servers within their own borders. This separates sovereignty (who controls the data) from localization (where the data sits).
The risk of the “Digital Maginot Line”
Simply migrating old on-premises server models into a cloud environment is insufficient.
True resilience requires “infrastructure-as-code” models. This allows governments to treat workloads as disposable; if a server is compromised or destroyed, the system can “burn down” the affected instance and reconstitute the data rapidly across a different, encrypted, and portable location.