Border security and the digitalisation of sovereignty: insights from EU borderwork

ABSTRACT

The European Union’s effort at controlling its external borders is an endeavour that increasingly relies on digital systems: from tools for information gathering and surveillance to systems for communicating between different agencies and across member states. This makes EU borders a key site for the politics of “digital sovereignty” – of controlling digital data, software and infrastructures. In this article, we propose a new understanding of how the concepts of digital and sovereignty interplay: sovereignty by digital means, sovereignty of the digital, and sovereignty over the digital. We do it by analysing three key manifestations within the EU’s borderwork: firstly, the expansion of EURODAC to include facial biometric data; secondly, the creation of the (future) shared Biometric Matching System (sBMS); and thirdly, the EU-funded West Africa Police Information System (WAPIS). These databases and systems exemplify three transformations of EU borderwork that invoke different dimensions of digital sovereignty: expansion of techniques for governing migration; interoperability of EU databases facilitating the internalisation of borders through domestic policing; and extra-territorialization of borderwork beyond the geographic limits of the EU.

KEYWORDS:

• European Union
• borderwork
• digital sovereignty
• security
• interoperability
• extraterritorialization

1. Introduction

In the summer of 2021, a number of seemingly unrelated political developments were taking place in Brussels and beyond involving different actors and EU institutions. Firstly, thirty civil society organisations and NGOs wrote a letter to Member of the European Parliament (MEP) Jorge Buxadé regarding the intention of using facial recognition for biometric identification included in a proposal to reform the EURODAC Regulation. They expressed their “concerns”, calling it a matter of “a highly political and strategic nature” that “may undermine the EU’s duty to respect international asylum and migration law and standards” (Access Now 2021). Buxadé is the lead MEP with the task of reforming EURODAC – the EU fingerprint database for asylum seekers – a reform that NGOs believe should be paused due to fundamental rights issues.

Secondly, around the same time, concerns were raised regarding the development of the new EU shared Biometric Matching System (sBMS), when MEP Patrick Breyer posed written questions to Krum Garkov, the Executive Director of eu-LISA, the EU’s Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (AFSJ) (Garkov 2021). The questions were related to contracts for information systems concluded by eu-LISA (and Frontex), particularly the ones signed between the agency, on the one hand, and French companies IDEMIA and Sopra Steria, on the other, to deliver the new sBMS, which, when in force, will be one of the largest biometric systems in the world, integrating a database of over 400 million third-country nationals with their fingerprints and facial images.

Finally, European news agencies reported how biometric-based security control programmes were mushrooming in Northern Africa, many of which funded directly by the EU (Creta 2021). Several of these biometric databases were either established by EU funding, such as the West African Police Information System (WAPIS), or share their data with Frontex and other international agencies. These databases are also implemented in cooperation with other projects, such as the Free Movement of Persons and Migration in West Africa (FMM West Africa), a project funded by the EU and run by the International Organisation for Migration in all 15-ECOWAS countries. One of the aims of the scheme is to introduce biometric identity cards for West African citizens (Zandonini 2019) so that people’s movement (mostly towards the EU) can be more easily controlled.

In this article, we propose to study these developments from the perspective of digital sovereignty. Emerging debates around digital sovereignty in the EU context have put emphasis on how this concept relates to the notion of strategic autonomy and independence of digital information and infrastructures. This is key when EU border management is digitalised through the above-listed dynamics. Digital sovereignty can be defined with Luciano Floridi (2020, pp. 370–371) as a

fight for (…) the control of data, software (e.g. AI), standards and protocols (e.g. 5G, domain names), processes (e.g. cloud computing), hardware (e.g. mobile phones), services (e.g. social media, e-commerce), and infrastructures (e.g. cables, satellites, smart cities), in short, for the control of the digital.

While covering the fight for “sovereignty over the digital”, we nonetheless also see a need for opening this concept to two other dimensions of the dyad digital/sovereignty: sovereignty by digital means and sovereignty of the digital. The growing digitalisation of the EU’s borderwork offers possibilities for rethinking the way these three dimensions interact and mutually influence each other. On the one hand, the above-mentioned databases demonstrate the capacity and will of the EU to prescribe and regulate digital technologies in the fields of its operations. On the other hand, they exemplify how these operations rely on controversial technological, security-political and commercial rationales that are not necessarily compatible with the fight for digital sovereignty.

Indeed, common to the above-mentioned developments are three key dynamics that invoke the different constellations of digital/sovereignty. The first one deals with how the access of non-EU citizens to the union territory is increasingly mediated by databases with expanding biometric outreach. In the name of security, these databases are combined with automated risk profiling of travellers for the effective exclusion of unwanted migrants as well as potential criminals or terrorists. The second dynamic refers to the push towards the interoperability of EU databases, i.e. the effort to make different systems communicate through the sharing of searchable data, in a process that enmeshes traveller information with police databases that aim at identifying criminal suspects and enforcing migration policies. The third dynamic relates to how these efforts are increasingly taking place beyond the geographic limit of the EU. In other words, the boundaries of EU sovereignty are not only increasingly digital but also extra-territorialized, in a process facilitated by the turn towards data-based population movement control.

An important part of EU sovereignty, in general, is understood to be related to the management of its borders, in line with the classic literature that associates sovereignty with the territory. In this article, though, we embrace a fluid, post-traditionalist understanding of borders (Bellanova et al. 2022), acknowledging their polysemic nature (Balibar 2002, p. 79), and we interpret border management as an enactment of territorial sovereignty that happens both within and beyond territorial lines. As argued by Foucault (2007 [1978], p. 29), the sovereignty of states relies not only on efforts at controlling the means of violence within a territory, but also at enabling and controlling the circulation of people and goods (see also Vaughan-Williams 2015). Provided this connection between border control and sovereignty, we see the field of digital borderwork as a salient site for the study of digital sovereignty.

We use the word borderwork to capture the activities around “envisioning, constructing, maintaining and erasing borders” (Rumford 2008, p. 2; see also Vaughan-Williams 2008, Frowd 2018). We also understand EU security, and particularly EU security as operationalised at its borders, as a socio-technical assemblage, i.e. “heterogeneous systems composed of elements that are both material and immaterial, both physical and textual” (Bellanova and Duez 2012). In short, the socio-technical assemblage of EU border security is composed of its different systems, digital and material, its technologies, hardware and software, high- and low-tech, various border professionals, and their everyday practices. Our inquiry is organised as a path towards answering one main question: what does the growing digitalisation of EU borderwork tell us about the conditions for digital sovereignty in the field of EU security governance? More concretely, how does the digitalisation of efforts to control the circulation of people across EU borders through shared and interoperable databases affect EU sovereignty (sovereignty by digital means)? Does this reliance on digital databases represent a radical departure from analogue borderwork (sovereignty of the digital)? What does this entail for EU efforts at controlling the databases (sovereignty over the digital)?

In the article we start by showing how the EU’s borderwork is increasingly being digitalised amidst political controversies over digital surveillance and EU migration policy (Section 2). Then we review three key manifestations of this growing digitalisation as illustration (Section 3): firstly, the expansion of EURODAC to include facial biometric data – allowing for the use of automated facial recognition technologies; secondly, the creation of the upcoming sBMS; and thirdly, the EU-funded WAPIS system being implemented in Northern Africa. We then move on to show how this illustrates the three levels of sovereignty by, of and over the digital (Section 4), and discussing how our engagement with the political and social character of digital data-based EU security governance understands this as an area where new actors and new policies are continuously challenging the contours of what European security is, how it is manifested, how it is contested, and what implications it may have on individuals. We conclude with reflections on how both digital-based security governance and the political sociology that surrounds it should be treated as a mainstream approach to study contemporary security phenomena in the EU and beyond.

2. The growing digitalisation of EU borderwork

In recent years, the turn to digital-based forms of governance and administration with the aim of gaining a better oversight, control and efficiency has concerned most, if not all, sectors of society. They do not only promise to deliver faster and more efficient services but also advertise rational and objective systems of governance rather than those based on individual interactions and preferences. This logic has expanded into the governance of security as well – examples include the automated gathering of intelligence data, patterns of life analysis based on that data, as well as predictive policing relying on machine learning techniques (Amoore and Raley 2017, Aradau and Blanke 2018, Kaufmann et al. 2019, Bellanova and de Goede 2022). In the case of the EU, this has been manifested in some of the processes deriving from the logic of smart borders (Jeandesboz 2016, Leese 2016, Bigo 2020). Smart borders are integrated IT systems and infrastructures involving a combination of technologies for border control (e-gates, self-service kiosks, automated security checks, border surveillance and software for pre-registration and risk assessment of travellers) and centralised databases with information on travel permits, travel history, and biometric identifiers, including fingerprints and facial features. They make border crossings faster and smoother for EU citizens and those who have travel permits or passports from countries with pre-existing visa agreements, yet more difficult, if not impossible, for those without permits or the right passport – including notably those seeking asylum, who need to first access the country they want to seek asylum in.

The field of border management and migration control lends itself particularly well to the “problem” that such new digital systems and “solutions” are in search of (Martins and Jumbert 2022, Morozov 2013, Trauttmansdorf and Felt 2021). While border management is a legitimate prerogative of sovereign states, as immigration and border security have become highly politicised areas with few straightforward solutions, they are particularly vulnerable to discourses arguing for the need of efficient but also seemingly “neutral” and “objective”, data-based systems (see Bellanova and Glouftsios 2020 for a critique of this narrative). The increased digitalisation of EU borders has concerned all the dimensions of both external and internal borders of the EU, from its land, air and sea borders, through the overarching concept of smart borders, to the digitalisation of security checks, passport screening and body screening (Jeandesboz 2016, Bigo 2020, Amelung et al. 2021, Dijstelbloem 2021). The idea that smart borders will reduce the weight of human error (or merely, subjectivity) is transcending all of these developments. This idea is materialised in, for example, the search for a perfect situational overview through aerial surveillance, and in the quest for perfect and truthful information about migrants' “real” identity. In the latter case, this logic translates into measures such as the screening of asylum seekers' smart phones and social media to verify the well-foundedness of their claims for protection (Alencar et al. 2018, Jumbert et al. 2018, Bolhuis and van Wijk 2021).

In recent years, the principle of “interoperability” has driven policy-making in EU border security. Interoperability refers to the idea that the different systems of surveillance and border control should be able to communicate between each other, as seamlessly as possible (Bellanova and Glouftsios 2020; European Commission 2016, 2017, Leese 2020, OJEU 2019). In 2016, the Commission, in its Communication Stronger and Smarter Information Systems for Borders and Security (European Commission 2016), argued for the necessity of improving the EU’s data management architecture, to which it received the support and engagement of the Parliament and the Council. Later in the year, the Commission created a high-level expert group (HLEG) on information systems and interoperability, that made the case for the added-value of interoperability between the customs systems and the existing databases in JHA. In its May 2017 report (DGMHA 2017), the HLEG requested eu-LISA to analyse the technical and operational aspects of the possible implementation of a shared biometric matching service. Eu-LISA then conducted a feasibility study on different possible pathways to operationalise these systems in line with the idea of interoperability (eu-LISA 2018). These and other initiatives laid the foundations for the adoption of the May 2019 Regulation on establishing a framework for interoperability between EU information systems in the field of borders and visa (European Parliament and Council 2019).

Allowing systems to communicate between each other may be crucial to allow them to carry out their basic functions, yet this same interoperability can create architectures that are both mutually vulnerable and where the very combination of data through the interoperability potentially allows for other operations beyond the ones for which each system has been validated individually. As will be demonstrated in the next section, the push for interoperability can be seen as an attempt to furthering EU digital sovereignty, both regarding the sovereignty over the digital (through the reliance on EU-based companies to design and maintain the systems) (see also Barrinha and Christou, 2022, Csernatoni, 2022, Farrand and Carapico, 2022, Calderaro and Blumfelde, 2022) and sovereignty by digital means (through expansion of the interoperability logic into territories beyond the EU).

3. Modes of digital borderwork: three illustrations

How does this growing digitalisation of borderwork take place? In this section, we will illustrate these processes with insights from three different types of systems aimed at screening, identifying and controlling people: the EURODAC, the new (and future) sBMS, and WAPIS. What they all have in common is a move towards collecting increasingly more information about individuals, including biometric information on ever younger persons, in order to more effectively screen migrants on their way to reach Europe, as well as identifying and expelling unwanted migrants within the EU. While these different systems constitute modes of bio-bordering – to borrow the expression of Nina Amelung, Rafaela Granja and Helena Machado (Amelung et al. 2021) – each of them is an illustrative example of at least one of the three dynamics that characterise the digitalisation of borderwork: systems expansion (in the case of EURODAC and WAPIS), interoperability (in the case of the EURODAC, sBMS and WAPIS) and extra-territorialization (in the case of WAPIS).

Additionally, there is an important element at stake that is relevant for the debates on the EU’s digital sovereignty, particularly regarding how this digital sovereignty is pursued. One of the strategies is to have new data-based systems designed and maintained by EU-based companies rather than having them provided by third-country companies. Indeed, in the cases covered in this article, the three systems have either been created or are maintained by European private providers. EURODAC was originally provided by the US-based Cogent Systems, who won a contract to supply the Eurodac Automated Fingerprint Identification System in 2002. This company was recently acquired by the French multinational company Thales, that now provides and maintains EURODAC through Thales Cogent (Thales 2020). As for the creation of the sBMS, the consortium that won the contract in 2020 is led by the French multinational companies IDEMIA and Sopra Steria (IDEMIA 2020). WAPIS was developed by Interpol with the technical support of CIVIPOL (EU Trust Fund for Africa 2019), the French Ministry of the Interior’s public limited company that, as shown by Privacy International, is 40% owned by the French state and is part-owned by large defence companies, including Thales, Airbus DS, and Safran (Privacy International 2020). WAPIS is just one of the several new North-African biometric schemes that are being built with EU resources and where CIVIPOL is deeply involved (Privacy International 2020).

3.1. EURODAC

EURODAC operates as an Automated Fingerprint Identification System (AFIS) and contains the fingerprints of all asylum applicants from each EU member state, and fingerprints from people who were detained during irregular border crossings. The EURODAC is applied within the areas where the Dublin III Regulation is applicable. EURODAC was adopted as a European Council Regulation on 11 December 2000, and it is often emphasised that its primary aim is to deal with the issue of “asylum shopping” – for example, the Thales Group, whose subsidiary companies have been responsible for supplying the AFIS since 2002, refers to EURODAC’s effectiveness in preventing “asylum shopping” (Thales 2020). For every individual registered, EURODAC currently stores a complete set of digitised fingerprints, the state sending the data, the place and date of the application for international protection, the person’s gender, and a reference number.

On 1 June 2013, eu-LISA took over the daily operational management of EURODAC from the Commission. The central server is a fully automated system. In 2015, the new EURODAC Regulation (603/2013) took effect, enabling national police forces and the EUROPOL to access the database for prevention, investigation and detection of criminal activity. On 4 May 2016, the European Commission proposed (2016/0132 COD) to reinforce and expand the EURODAC Regulation, and in 2018, in a provisional agreement, the Parliament and the Council agreed on an expansion of the system. This widening of the stored biometric data is manifested in the storage of facial images and alphanumeric data of asylum seekers and irregular migrants in addition to fingerprints; in lowering the age for obtaining fingerprints and facial images of minors from 14 to 6 years old; in permitting Europol to enquire the database more efficiently; in registering persons falling under the Union or national resettlement schemes; and in giving partial access to the authorities of third countries on certain conditions. As part of the broader migration and asylum pact, the Commission presented an amended proposal on 23 September 2020 (COM(2020) 614). If accepted, the proposal would introduce an obligation to store data on names, nationalities, place and date of birth, and travel document information; for asylum seekers, the obligation is to store the asylum application number and the Member State responsible under the Dublin Regulation.

This proposed expansion of EURODAC is an important condition enabling the growing digitalisation of EU borderwork, with potential impact on the sovereignty over the digital. This expansion is being promoted by the French company Thales and it is an effort in grounding within Europe the technical and technological infrastructure of a programme central to European border management. EURODAC has received critical views in the specialised literature due to its enmeshment of the migration and crime control logics (Vavuola 2015, Queiroz 2019), and, if implemented, some of the proposed amendments to its regulation would only make these problems grow bigger and more complex. Opening up to automated facial recognition technology would import all the problems regarding biases in facial recognition technology (Benjamin 2019, Birhane 2021) to an already challenging system.

3.2. Shared Biometric Matching System (sBMS)

When operational, the sBMS will be one of the largest biometric systems in the world, integrating a database of over 400 million third-country nationals with their fingerprints and facial images. As of June 2022, the sBMS is not in place and the consortium tasked with “providing it by mid 2022” has faced problems that will lead to significant delays in delivering the system (Statewatch 2021).

The new sBMS will be used for the future Entry-Exit System and by all the systems already in use in the EU: the Schengen Information System (SIS), the Visa Information System (VIS), EURODAC, and the future European Criminal Records Information System –Third Country Nationals (ECRIS-TCN). In practical terms, it will “extract biometric ‘templates’ from different EU databases to simplify the searching and cross-matching of biometric data” such as fingerprints, facial images, etc. (Jones 2019, p. 6) and will integrate a wide complex system of agencies (e.g. Interpol, Europol) and databases (EES, ECRIS-TCN, VIS, EURODAC and ETIAS) that constitute the interoperable infrastructure of EU migration and crime control. Whereas ECRIS focusing on EU citizens has been in place since 2012, eu-LISA is now tasked with expanding this system to also include information about third-country individuals with criminal record in an EU member state. The idea with the sBMS is that authorities will be able to check whether third-country nationals are the person they claim to be through biometric verification and then ensure they do not overstay. A set of alphanumeric data, as well as biometric data, will be collected, checked and stored for three years. The biometric data remains in Europe.

As mentioned by Mathias Leese:

the new interoperability architecture for the Schengen area bears witness of a shift towards identity management that aspires to simultaneously verify and cross-validate identity records across multiple domains. The results from such verification and cross-validation processes then form a new, allegedly truthful basis for knowledge production and government. (Leese 2020, p. 16)

Yet early on, observers have pointed out that interoperability creates problematic enmeshments of databases created for very different purposes (Bunyan 2018) – for example, travel, border crossings, criminal record archiving for judicial cooperation, criminal suspect listing for police investigations, etc. These correspond to different EU policy and law objectives and functions. The EU Data Protection Supervisor highlighted that interoperability “is not only or primarily a technical choice but rather a political choice liable to have profound legal and societal consequences that cannot be hidden behind allegedly technical changes” (European Data Protection Supervisor 2018, p. 30, point 143). In concrete, the Supervisor underlined that:

facilitating the access by law enforcement authorities to non-law enforcement systems (i.e. to information obtained by authorities for purposes other than law enforcement), even to a limited extent, is far from insignificant from a fundamental rights perspective. Routine access would indeed represent a serious violation of the principle of purpose limitation. (European Data Protection Supervisor 2018, p. 3)

3.3. Beyond the EU: funding the datafication of African borders

In previous sections of the article, we argued that digital technologies have been put at the service of an enactment of EU borders, as they are portrayed as serving a vital security function through the control of mobility. Above, we showed how two EU programmes perform this logic: EURODAC, erecting the EU border against asylum seekers; and sBMS, offering security integration through interoperability of systems. Both cases relate to programmes and agencies that operate within the EU.

If we understand borders and territory as enactable (i.e. capable of being enacted), then, in line with this critical understanding of the border, we can claim that the EU’s border is increasingly also enacted beyond the geographical borders of the EU, and well into third countries. As argued by Frowd, the “literature in political geography has emphasised shifts in territoriality and authority whether it is through the adoption of new technologies (e.g. Amoore 2006) but also broader questions of spatiality and territoriality” (2021, p. 3). While for many years the externalisation of EU borders has been extensively documented and analysed (Lavenex 2006, Bialasiewicz 2012, Carrera et al. 2018, Martins and Strange 2019) the contemporary trend towards growing digitalisation brings new shades to this deterritorialization. In Northern Africa, an assemblage of actors, systems and practices has promoted increasing digitalisation, biometric registration, and interoperability of African databases in order to better control the movements of populations. The turn to this biometric digitalisation is often promoted and funded by the EU, and it is implemented through technological solutions created, maintained, and made available by European companies such as Gemalto (FR/NL), Veridos (DE), Mühlbauer (DE), Idemia (FR) and Civipol (FR), among others.

In this context, the above-mentioned WAPIS system is of particular relevance. WAPIS is a multiannual Programme (2012–2022) funded by the EU which aims at “improving the capacity of West African law enforcement agencies to combat transnational organised crime and terrorism by facilitating the sharing of information” (EUTF Africa 2019). As a cross-national system, it is managed by INTERPOL and, since 2017, it also collaborates with ECOWAS. According to Interpol’s webpage on WAPIS, the system:

• Enables police officers in West African countries to access critical police information from their national criminal databases and from databases of countries across the region, thus improving the identification of criminals and supporting ongoing investigations.

• Improves analysis of the problems of transnational organised crime and terrorism facing the region and allow a better understanding of crime originating in, coming from and transiting through West Africa.

• Allows greater police and judicial cooperation in criminal matters within the region, the European Union and the rest of the world. (Interpol 2021)

The first phase of the WAPIS Programme was launched in September 2012, and in September 2013, it started with four pilot countries (Benin, Ghana, Niger, Mali) under the EU Emergency Trust Fund for Africa. These countries are crucial parts of the Western African routes of migration to Europe. In 2016, the WAPIS began to be implemented also in Burkina Faso, Chad, Côte d’Ivoire and Mauritania, again as part of the EU Emergency Trust Programme for Africa. And since November 2017, there has been a full application in all ECOWAS member states and Mauritania (Interpol and ECOWAS 2020). Although the narrative is that the necessity of such a system was first detected by African police authorities and requested by them to the EU, it has been argued in the literature on EU externalisation policies that, despite claims of partnership, the EU and African countries are unequal partners in the field of migration management, both parties entering partnership agreements from very different positions of power (El Qadim 2014, Pradella and Taghdisi Rad 2017, De Guerry and Stocchiero 2018, Lemberg-Pedersen 2019, Strange and Martins 2019). In other words, irrespective of which party took the initiative in creating this setup, the WAPIS system fundamentally meets the needs and wishes of the EU for furthering population control in Africa, to the extent that it decided to fund it from its funding schemes.

WAPIS represents an effort to digitalise and make readable the biometric data of African citizens, and while having a decisive EU impetus through finance and political agenda-setting, it involves a large number of state-level and international actors. The data generated by WAPIS is then shared with larger international databases and organisations, including Frontex. The readability of data across different systems is a requirement of interoperability. In other words, data needs to be formatted in a way to be rendered readable by different systems that indeed share similar configurations. That the WAPIS was funded by the EU indicates that the EU’s turn to interoperability stretches beyond the EU territory and that interoperability of databases has become an important dimension of the externalisation of EU migration management policies. As argued by Eva Stambøl when scrutinising land border security-building by international actors in West Africa, borders can be understood “as ‘penal transplants’ embodying specific (western) visions of state, political power, social control/order and territoriality” (Stambøl 2021a, p. 474); in this case the push to interoperability of African security and criminal databases with EU ones, made possible through a EU-funded and European-provided data infrastructure, illustrates this transplantation of EU borderwork through data to Africa and how security, migration, and crime control objectives are fundamentally interconnected.

4. Interpreting EU digital borderwork: sovereignty as hegemony and algocracy

From these three cases, we see how the sovereignty of the EU that is to be maintained through EU digital sovereignty is not only aimed at maintaining the security, rights and interests of EU citizens: it is it is also about controlling the circulation of non-EU citizens inside, outside and at the EU external borders. On the one hand, this happens through the enactment of sovereignty by digital technology, including the above-mentioned databases. On the other, it happens through the very sovereignty of the digital tools – that is, through the autonomy and automation of computation.

4.1. Sovereignty by digital means: the expansion, interoperability and deterritorialization of EU borders

As noted in the introduction, data-based digital tools for this borderwork are not a mere extension of analogue practices but involve a threefold transformation: an expansion of the work – as exemplified by the expansion of the biometric techniques to be included in EURODAC; an interoperability of borderwork by enhancing the policing of non-EU citizens within the EU – as exemplified by the sBMS; and an extra-territorialization of borderwork by reaching into the borderwork of foreign countries – as with the WAPIS.

A requirement of interoperability is that not only data is shared, but that different data is presented and formatted in a way that can rend it readable, also across platforms. Interoperability requires compatibility of systems, and therefore the data needs to be presented, stored and organised in a compatible way across different systems. This means that WAPIS, for example, is not just about getting access to the biometric data of African citizens; it is also about making sure that the data is collected, stored and programmed in a way that is compatible with EU systems. So, the EU funding, and its design by European companies, ensure that the data will come in the right format to ensure the interoperability with EU systems.

In this context, the notion of EU borderwork might leave the impression of EU agencies operating under EU legislation for the implementation of EU migration policies at the service of EU sovereignty and security. While this is part of the story, the above examples illustrate how it leaves a false impression of the power and autonomy of the EU versus its members states, private corporations, individual EU citizens and foreign countries and corporations. With Bent Flyvbjerg’s (2001) distinction between the “formalpolitik” and “realpolitik” of governance, the formal jurisdictions and procedures of EU borderwork rely on a realpolitik of competing and partly conflicting actors and interests. In the case of EURODAC, for instance, the systems, interests and routines of national agencies do not neatly align with each other or the EU’s policies and legislation (cf. Bigo et al. 2011, Bigo 2020). Moreover, the proposed widening of the system is subject to resistance from parliamentarians and NGOs concerned with data protection, state surveillance and the rights of migrants. Examples regarding sBMS include the repeated failures of actually making security systems interoperable in practice within and across national borders and of making border guards and the police using them according to the intentions (cf. Bigo 2014, 2020). Not to speak of the commercial and national interests involved in providing and maintaining a super-system like the sBMS, with an estimated total value of 302,550,000 EUR for the first contract period (Eu-LISA 2020).

The element of realpolitik in the externalisation of EU borderwork is even more straightforward – including a range of means like security assistance, aid and trade in return for cooperation on migration management (Lemberg-Pedersen 2019, Stambøl 2021b). Formally, these agreements respect the sovereignty of “third countries” like Libya, Mali and Niger. However, in practice, the power asymmetries between the EU and these countries involve a de facto bracketing of their de jure sovereignty for the strengthening of EU sovereignty as well as for the strengthening of their de facto internal sovereignty (Krasner 1999, Strange and Martins 2019).

In other words, and in line with a Bourdieusian reading, digital, data-based borderwork is not just about the technologies and their functionalities and regulation but also about the politics they are embedded in and how the technologies are used in practice. Bigo et al. (2019) argue that data and politics are now inseparable: data is not only shaping our social relations, preferences and life chances, but our very democracies. As we have seen, it also shapes the nature and enactment of sovereignty – including digital sovereignty – and highlights how data brings into being what it represents. Digital borderwork is more than merely counting and overseeing the movement of data subjects, it also reconfigures these subjects by making them governable.

Hence, the enabling and controlling of the circulation of people and goods that Foucault described as an aspect of state sovereignty is not only about governing the citizenry but identifying and excluding unwanted foreigners. In line with Stambøl’s above-mentioned observations, Mark Duffield describes this governance as part of a global “security architecture” that defends “the West’s” way of life:

The internal and external frontiers of this security architecture are radically interconnected through the flows and spaces of global circulation, which itself creates a need to police its dynamics, that is, allowing the “good” circulation on which globalized markets depend – such as investment, commodity flows, information, patent rights, technology, skilled migration and tourism – while preventing the “bad” circulation that poses a risk to national and international stability: non-insured migrants, refugees and asylum seekers, together with the shadow economies, money laundering, drugs, international crime, trafficking and terrorism associated with ineffective states and zones of crisis. (Duffield 2007, p. 187)

In Duffield’s account, the dangers and desolation of unwanted migrants and “failed” states are itself a result of hegemonic policies that reinforce global inequalities of security and welfare. However, independent of what causes these inequalities, the need to police the EU borders in ever more effective ways to avoid uncontrolled immigration is an effect of the superior wealth and security of Western countries. In effect, the EU sovereignty that it maintains is not just about protecting Europe from foreign dangers – it is a hegemonic kind of sovereignty maintaining global inequalities of power and wealth.

4.2. The sovereignty of the digital: algocracy, technocracy and hypocrisy

When shifting our focus from the digitalisation of sovereignty to the sovereignty of the digital, EU digital borderwork also tells a story of what it means to rely on automated forms of digital technology. As we have seen, databases like EURODAC are integral to larger systems of “smart borders” that involve the automated surveillance and processing of digital information on travellers. The notion of “algocracy” presents us with a useful point of departure in this regard. In Danaher’s iteration, this term is defined as “a system in which algorithms are used to collect, collate and organize the data upon which decisions are typically made and to assist in how that data is processed and communicated through the relevant governance system” (Danaher 2016, p. 247). In the original conceptualisation by Aneesh (2006, 2009), algocracy was defined in distinction from a bureaucracy and a market. As Danaher notes, however, the boundaries between these systems are not clear-cut, and “algocratic decision-making systems can be integrated into pre-existing legal-bureaucratic decision-making systems” (Danaher 2016, p. 247). At an aggregate level, one might speculate that this involves a transformation of the sovereignty of states and organisations as well – replacing human-based sovereignty with an autonomous mode of virtual sovereignty.

While highlighting the difference that algorithms can make to systems of governance, reducing practices of governance to “algorithmic governance” in this way is nonetheless unconvincing – at least in the context of EU border management. Instead of defining algocracy as an entirely new mode of governance, we propose to conceive it as a continuation of technocracy, i.e. a “technocracy 3.0”, where the original iteration is the exercise of governance based on scientific expertise, and the second is the emergence of a modern bureaucratic system for collective governance based on a combination of science and surveillance (Hacking 1990). The third iteration – technocracy as algocracy – involves the introduction of advanced computation to this system, based on logics of prediction and prevention beyond the capacity and comprehension of humans (be they in, on or off the loop) (Table 1).

Table 1. Iterations of technocracy in security governance.

In this account, algocracy has not replaced modern bureaucracy and the market but interferes and competes with these systems as a kind of mutation. It cannot be understood in isolation but as part of these wider practice-based ecosystems of information and communication. As noted by Bigo, the difference in such data-based governance is not made by the emergence of new digital techniques per se but the ways in which they are put to use:

Firstly, they can be used in support of the more traditional framework of conjectural reasoning in order to provide necessary evidence for the judiciary. Secondly, they can also be used to impose a preventive and predictive reasoning. The logics and mechanisms of reasoning that are specific to each universe and its actors – be it the police, military, or communications – are therefore to be considered more important than the technologies themselves. (Bigo et al. 2019, p. 119)

In “The emergence of iBorder”, Pötzsch outlines the systemic consequences of the interaction between biometrics, dataveillance, predictive analytics, and robotics in border control. In accordance with the above accounts of the preventive and predictive reasoning of algocratic governance, he sums up these as follows:

Juridical and disciplinary aspects produce obedient and docile individuals through such mechanisms as biometric identification, “trusted” traveler programmes, and ubiquitous (self-)surveillance, as well as the constant threat of decelerating searches, detention, and ultimately death. At the same time, a technologically facilitated biopolitical component draws upon algorithm-based predictive analytics and robotics to regulate flows of categories by identifying implied norms against which suspicious deviations can be measured, thus not only predicting and potentially preventing the occurrence of threatening patterns and compensating for their effects, but also framing and predisposing the very performances through which such patterns are brought forth and made relevant in the first place. (Pötzsch 2015, p. 115)

However, as we saw from the “realpolitik” of digital borderwork, isolating these “cultural techniques of bordering in emergent control societies” from the analogue practices in which they are embedded – from the level of policy-making and jurisdiction to their enactment at the borders – creates a false image of an autonomous “border algocracy”. In spite of the expansion, interoperability and extra-territorialization that result from digitalisation, there is more continuity with preceding practices than it seems when we zoom into the algorithmic decision-making of technologies in isolation. Even AI-based decision-making with humans “off-the-loop” involves close interaction with related human practices, and when part of a governance apparatus, they will not be devised without close supervision at a “meta-loop” level. This does not necessarily mean that they are more legitimate, however, but rather that the algocratic dimension of “digitalized sovereignty” must be analysed as part of a wider political sociology of the practices. There is still an element of algocracy involved, but exactly how and to which extent remains an empirical question.

In his study of the digitalisation of EU border regimes, Bigo describes the emergence of a new guild of digital technologies that introduces

de facto new “players” in the (in)security field in Europe who have their own politics, connected with their own visions of the world order, their own interests, and specific habitus or dispositions different from the military, the police or the border guards. (Bigo 2020, p. 75)

Rather than dissolving in the wake of repeated failures of new systems he describes how the guild thrives from such failures due to what may be described as a “hypocritic oath”: that failures of digital systems are to be resolved through further digitalisation. Being similar to the original meaning of algocracy in the work of Aneesh, this oath stems from the prevalence of a digital rationale in which the problems to be addressed are understood as being of a digital nature in the first place – rather than political, juridical or economic. Following the logic of techno-solutionism advanced by Morozov (2013), Trauttmansdorff and Felt call this expansion of digital databases digital solutionism, but also point out that these “processes of rebordering can also be seen as reaction formations to cross-border mobility” (Trauttmansdorf and Felt 2021, p. 2).

In the context of EU borderwork, the digital data, software, and infrastructures that are to be controlled through the fight for “digital sovereignty” are thus just as political as the sovereignty through which they are to be controlled. Drawing on the work of Kitchin, Zarsky, amongst others, Danaher is concerned about the growth in algocratic systems that are based on predictive or descriptive data-mining algorithms – which is a well-described concern in the field of border management (Amoore 2006, Pötzsch 2015). Danaher describes this “threat” as stemming from a combination of the hiddenness and, in particular, the opacity, of algorithmic governance. With Morozov, he describes how algorithms that are introduced in the service of well-established goals like security, health or economy may eventually take control of human agency and autonomy when being intransparent in this manner. Against the backdrop of EU borderwork where multiple databases are to be combined with multiple systems for the automated assessment of the identity, personality and risk level of travellers, we propose to add the excess of digital data to the list of algocratic threats – i.e. when big data is too big, in a way that defeats its purpose and threatens the autonomy of individuals and political institutions.

4.3. Sovereignty over the digital: implications of EU borderwork

From this analysis, we see how an agenda of digital sovereignty in the context of EU borderwork is bound to have political repercussions beyond the mere control of digital technologies. Firstly, it reinforces a sovereignty that is hegemonic and exclusive in expanding, making interoperable, and deterritorializing EU external borders. This may be self-evident – but the notion of “digital sovereignty” tends to be used without questioning which kind of sovereignty is at stake. Secondly, the “digital” is far from neutral in this context; it entails a dimension of algocracy to which no effort at controlling the digital can be neutral. On the one hand, such efforts may bolster the agency, actors and rationales of technocratic algocracy. On the other, they may also constrain such tendencies by insisting on human control and democratic standards.

In effect, we may infer that the enactment of sovereignty (sovereignty by digital means), practices of digitalisation (implying sovereignty of the digital) and the fight for digital sovereignty (sovereignty over the digital) are interconnected in ways that are both complementary and contradictory. The sovereignty of states and organisations is evidently a prerequisite for their pursuit of digital sovereignty. Yet, the political and economic drivers of sovereignty may also undermine digital sovereignty if, for instance, entailing a reliance on foreign digital systems and providers. An example of such reliance is the EU-US Data Protection Shield that presumably enhanced European sovereignty while weakening its digital sovereignty. Moreover, at the EU level, nationalist agendas of digital sovereignty may undermine EU sovereignty – both digital and analogue. And democratic policies of digital sovereignty may counter authoritarian sovereignty of states and organisations.

Finally, the possibilities for democratic supervision and accountability are also (negatively) impacted by the prevalence of data-based governance. As noted by Iliadis and Russo (2016) on their work proposing a critical data studies research agenda, data-based governance has led to the identification of social data problems and there is a need to design critical frameworks for addressing them. The application of social solutions to increase data literacy is also crucially important and includes datactivism and “viewing data as interpretive and rhetorical assemblages in the construction of science, institutions, and citizens” (2016, p. 5). Indeed, as we saw in the opening paragraphs of this article, the civil society has a very important role in the contestation of policy and regulatory developments promoting increased digitalisation, at the borders and beyond. Data politics is technically so complex that it is difficult to expect that contestation of measures can come from the usual institutions that ensure checks and balances (namely, national parliaments and the EU Parliament). The civil society contestation of the expansion of EURODAC, for example, is precisely what should be expected going forward: only a handful of specialised NGOs, researchers and civil society organisations have developed the skills to fully grasp the broad implications of this digitalisation of sovereignty in terms of fundamental rights, privacy and security politics.

5. Conclusion and way forward

In 2008, Adler-Nissen and Gammeltoft-Hansen (2008, p. 2) argued that we were witnessing “an expansion of the playing field relating to sovereignty”. More than a decade later, we can conclude that the digital realm is one of the sharpest manifestations of this expansion. In the article, we have shown how the growing digitalisation of EU borderwork takes place in a socio-technical assemblage made of the different systems, digital and material, its technologies, hardware and software, high- and low-tech, various border professionals, and their everyday practices. We have shown how this growing digitalisation can be characterised by three dynamics: expansion, interoperability, and extra-territorialization.

These processes have different implications in what regards sovereignty over the digital, sovereignty of the digital, and sovereignty by digital means. Digitalisation may evidently enhance digital sovereignty if being within the remit of sovereign control, but it may also undermine it in several ways. Firstly, policies of digitalisation tend to be driven by commercial and political agendas that leave little room for their “sovereignification”. As we showed in the sections above, private actors are key providers of the technological infrastructure; can this reliance on private actors constitute a challenge to actual (public) EU sovereignty? Secondly, digital technologies of governance may undermine human control – hence (analogue) sovereignty over the digital – by relying on hidden, opaque or excessive data and models. As a consequence, the fight for digital sovereignty may constrain digitalisation based on foreign companies as well as the introduction of digital techniques beyond human control.

Does this imply that the EU can achieve digital sovereignty in the realm of border and migration governance if these dynamics are taken into regard? And would it be possible to pursue a less hegemonic or algocratic form of digital sovereignty in the EU? The answer to both questions seems to be “no”. EU politics of sovereignty and digitalisation involve a range of interests and agendas beyond the remit of EU regulations in the digital field. Hence, there is no realistic actor or institution in which a “pure and depoliticized” policy of digital sovereignty could take place. As Floridi maintains, digital sovereignty is not about total control but degrees of influence in “an epochal struggle not only of all against all, but also of anyone allied with anyone” in a setting of “variable alliances changing according to interests and opportunities” (Floridi 2020, pp. 371). The main protagonists in this struggle are not only states but corporations and citizens, and the distribution of power among and between these depend on geopolitical as well as ideological conditions. As we have seen, EU policies for the enhancement of digital sovereignty involve an alliance between EU institutions, its member states and European corporations – not as a source of total control but of reducing the reliance on other states and corporations in the digital realm (see also Farrand and Carrapico 2022). Thus, EU policymakers or legislators cannot simply choose which notions of digital or sovereignty they are to adopt. Digital technologies of governance have inherent algocratic features, and EU sovereignty is inherently hegemonic unless a dramatic shift is made at the centre of European politics.

Indeed, understanding the socio-political dimensions of these digital systems remains central for engaging critically with them. For example, whereas there is wide discussion about correcting biases in algorithms that govern different areas of social life, including migration, we argue that the problem is much more complex than that: there is not a basic EU policy line on how to treat migrants fairly. On paper, EU policies may be rather balanced, but, in practice, it comes down to the policies of the member states and EU efforts in supporting them through EU agencies such as Frontex. EU efforts at a fair distribution of refugees across the Member States are failing – for different reasons pertaining more broadly to the difficulties of cooperating in the area of migration policies, and the fear of each member state of being slightly more accommodating to receiving migrants than their neighbour – and this means that the biases that permeate algorithm-based decision-making do not deviate from an unbiased, fair baseline. There is no fair baseline to return once the digital biases are “corrected”, and therefore a focus on correcting biases in algorithms will always fall short from giving the EU migration management the fair character that it lacks.

Finally, our empirical analysis shows that the digitalisation of EU borderwork is not just a matter of migration but, indeed, a fundamental vector of the EU security architecture. Border management is an area where different agendas overlap and intersect, from security to development, from migration to trade and innovation. As digital-based governance permeates borderwork in increasingly complex ways, our understanding of what European security is, how it impacts people, and how it can be contested needs to further engage with the literature that puts the socio-politics of data at the centre of the analysis.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

This work was supported by H2020 Security [grant number 787123] and Norwegian Research Council [grant number 262565].