“Last month’s AWS outage did more than interrupt chats and scramble payment systems. It reignited a political argument that has been simmering for years: whether cloud platforms have become too essential to be left in private hands.”
In the U.K., calls for digital sovereignty resurfaced almost immediately. Across Europe, people again questioned their dependence on U.S. providers. Even for companies that weren’t directly affected, the incident felt uncomfortably close.
In The Infrastructure We Forgot We Built, I pointed out that private infrastructure now performs public functions. The question isn’t whether these systems are critical—demonstrably, they are—it’s what happens when everything is critical. Governments continue to expand their definitions of “critical infrastructure,” extending the term to encompass finance, cloud, data, and communications. Each new addition feels justified, but the result is an ever-growing list that no one can fully protect.
Declaring something “critical” once meant ensuring its safety. Now it often means claiming jurisdiction. It creates an uncomfortable paradox: the more we classify, the more we appear to protect, and the less effective we become at coordinating a response when the next outage arrives.
Let’s poke at some interesting ramifications of classifying a service as critical.
You can Subscribe and Listen to the Podcast on Apple Podcasts, or wherever you listen to Podcasts.
And be sure to leave me a Rating and Review!
The American model: expanding scope, dispersing responsibility
Nowhere is this inflation more visible than in the United States, where “critical infrastructure” has evolved from a short list of sixteen sectors, including energy, water, transportation, and communications, to a sprawling catalog of national functions. The Cybersecurity and Infrastructure Security Agency (CISA) calls them National Critical Functions: over fifty interconnected capabilities that “enable the nation to function.” It’s an attempt to capture the web of dependencies that tie one system to another, but the list is so long that prioritization becomes impossible.
At the same time, National Security Memorandum 22 (NSM-22) shifted much of the responsibility for protecting those functions away from federal oversight. Under NSM-22, agencies and private operators were expected to manage their own resilience planning. In theory, decentralization builds flexibility; in practice, it creates a policy map with thousands of overlapping boundaries. The government defines criticality broadly, but control over what that means in practice is increasingly diffuse.
As of 2025, the current U.S. administration is reviewing NSM-22 and several other cybersecurity and infrastructure policies in an effort to clarify lines of responsibility and modernize federal strategy. According to Inside Government Contracts, this review could lead to significant revisions in how critical infrastructure is defined and governed, though the direction remains uncertain.
What’s unlikely to change is the underlying trend: expansion without coordination. The more functions labeled critical, the thinner the resources spread to defend them. If everyone is responsible, no one really is.
The European model: bureaucracy as resilience
Europe has taken almost the opposite approach. Where the U.S. delegates, the European Union codifies. The NIS2 Directive and the Critical Entities Resilience (CER) Directive bring a remarkable range of organizations, such as cloud providers, postal services, and wastewater plants, under the umbrella of “essential” or “important” entities. Each must demonstrate compliance with a thick stack of risk-management, incident-reporting, and supply-chain-security obligations.
It’s tempting to see this as overreach, but there’s a strange effectiveness to it. A friend recently observed that bureaucracy can be a form of resilience: it forces repeatable, auditable behavior, even when it slows everything down. Under NIS2, an outage may still occur, but the process for recovery is at least predictable. Europe’s system may be cumbersome, but it institutionalizes the habit of preparedness.
If the U.S. model risks diffusion, the European one risks inertia. Both confuse activity with assurance. To put it another way, expanding oversight doesn’t guarantee protection; it guarantees paperwork. Protection might just be a happy accident.
Interdependence cuts both ways
Underlying both approaches is the same dilemma: interdependence magnifies both stability and fragility. The OECD warns about “systemic risk” in its 2025 Governments at a Glance report. Similarly, the WEF describes this characteristic as “interconnected risk” in their Global Risks Report 2024. In both cases, they are talking about how a disturbance in one sector can ripple instantly into others, turning what should be a local failure into a global one.
But interdependence also enables the efficiencies that modern economies depend on. The same cloud architectures that expose organizations to shared risk also deliver shared recovery. If an AWS region goes down, another can often pick up the load within minutes. That doesn’t make the system invulnerable; it makes it tightly coupled, which is both a feature and a flaw.
That is the paradox of microservice design: locally resilient, globally fragile. The further we distribute responsibility, the more brittle the whole becomes. Managing that trade-off is less about eliminating interdependence than about deciding which dependencies are worth keeping.
Coordination in a fragmented world
The Carnegie Endowment’s recent report on global cybersecurity clearly frames the problem: the challenge is no longer whether to protect critical systems, but how to coordinate that protection across borders. The Internet made infrastructure transnational; regulation still stops at the border.
That tension was at the center of my earlier series, The End of the Global Internet. Fragmentation, through data-localization mandates, competing technical standards, and geopolitical distrust, is shrinking the space for cooperation. The systems that most need collective protection are emerging at the moment when collective action is least feasible.
That was made more than clear during the October 2025 AWS outage.
- In the U.K., it reignited arguments about tech sovereignty, with commentators and MPs warning that reliance on U.S. providers left the country strategically exposed.
- In Brussels, the outage reinforced calls to accelerate the European Cloud Federation and “limit reliance on American hyperscalers.”
Tech.eu put it bluntly: “A global AWS outage exposes fragile digital foundations.” They are not wrong.
A technical event at this scale offers impressive political ammunition. The debate becomes about more than just uptime. It’s also about who controls the tools a society can’t seem to function without.
Labeling platforms as critical infrastructure amplifies that instinct. Once something is “critical,” every government wants jurisdiction. Every region seeks its own version. The intent is to strengthen sovereignty, but the result is a more fragmented Internet. Protection turns into partition.
Openness vs. control: lessons from digital public infrastructure
This tension between openness and control shows up again in global discussions around Digital Public Infrastructure (DPI). A recent G20 policy brief argues that while DPI and Critical Information Infrastructure (CII) both serve public purposes, they arise from opposite design instincts. DPI emphasizes inclusion, interoperability, and openness; CII emphasizes security, restriction, and control.
Some systems are designated critical only after they become indispensable. India’s Aadhaar identity platform is a great example. The Central Identities Data Repository (CIDR) was declared a Protected System under the country’s CII rules in 2015—five years after Aadhaar’s rollout—adding compliance obligations to what began as open, widely used public infrastructure. Those regulations were and are necessary, but it’s reasonable to ask whether a system managing such sensitive data should ever have operated without that protection in the first place.
The challenge isn’t simply timing. Too early can stifle innovation; too late can amplify harm. The real question is how societies decide when openness must yield to oversight, and whether that transition preserves the trust that made the system valuable in the first place.
The politics of protection
Critical infrastructure has always been political. As the Brookings Institution observed more than a decade ago, infrastructure investment—and, by extension, classification—has always reflected political will as much as technical necessity. The same logic applies online. Designating something “critical” can attract funding, exemptions, or strategic leverage. In a digital economy where perception drives policy, criticality itself becomes a form of currency.
The temptation to leverage the classification of “critical” is understandable: declaring something critical signals seriousness. But it also invites lobbying, nationalization, and regulatory capture. In the analog era, the line between public good and private gain was already blurry; the digital era simply made it blur faster and more broadly.
Criticality has become a negotiation, and as with all negotiations, outcomes depend less on evidence than on who has the microphone.
The discipline of selective resilience
If the first post in this series leaned toward recognizing new kinds of critical infrastructure, this one argues for restraint in doing so. Declaring everything critical doesn’t make societies safer; it makes prioritization impossible. Resilience requires hierarchy, specifically knowing what must endure, what can fail safely, and how systems recover in between.
That’s an uncomfortable truth for both policymakers and providers. (I would say I’m glad I don’t have that job, but I kind of do as a voting member of society) Safety sounds equitable; prioritization sounds elitist. But in practice, resilience demands choice. It asks us to acknowledge that some dependencies matter more than others, and to build systems that tolerate loss rather than pretending loss is preventable.
The more we classify, the more we appear to protect, and the less effective we become at coordinating when the next outage arrives. The task ahead isn’t expanding the list. It’s learning to live with a smaller one.
📩 If you’d rather have a notification when a new blog is published rather than hoping to catch the announcement on social media, I have an option for you! Subscribe to get a notification when new blog posts go live. No spam, just announcements of new posts. [Subscribe here]
Transcript
[00:00:30]
Welcome back. Last month’s AWS outage did more than just interrupt chats and scramble payment systems — it ignited a long-simmering argument about whether cloud platforms have become too essential to be left entirely in private hands.
In the UK, calls for digital sovereignty resurfaced almost immediately. Across Europe, governments and enterprises once again questioned their dependence on U.S. providers. And even for organizations that weren’t directly affected, the outage felt uncomfortably close. The internet wobbled — and everybody noticed.
Defining What’s “Critical”
In my post last week, The Infrastructure We Forgot We Built, I argued that private infrastructure now performs public functions.
That’s the heart of the question here — not whether these systems are critical infrastructure (they are), but what happens when everything becomes critical?
When every failure becomes a matter of national concern, the language of protection starts collapsing under its own weight.
So, what do we actually mean when we say critical infrastructure? The phrase sounds straightforward, but it isn’t. Every jurisdiction defines it differently. Broadly speaking, critical infrastructure refers to assets, systems, and services essential for society and the economy — things whose disruption would cause harm to public safety, economic stability, or national security.
That definition works for power grids and water systems, but it gets complicated when we start talking about DNS, payments, or authentication services — the digital glue holding everything together.
Today, critical is no longer just about physical survival. It’s about functional continuity and keeping society running.
When Everything Is Critical, Nothing Is
Each country’s list of what’s critical keeps getting longer — and fuzzier. Declaring something critical once meant ensuring its safety. Now, it feels more like staking a claim to control.
That’s the paradox. The more we classify, the more we appear to protect — but the less effective we become when the next outage hits.
This tension is especially visible in the United States. Critical infrastructure once referred to 16 sectors — energy, water, transportation, communications — things you could point to in the real world.
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recognizes more than 50 “national critical functions.” These include both government and private-sector operations so vital that their disruption could debilitate the nation.
It’s a noble definition — but a recipe for paralysis. Because if everything is critical, then nothing truly is.
Expansion Without Coherence
The National Security Memorandum 22 (NSM 22) was intended to modernize how those functions are managed. In theory, it decentralizes responsibility, allowing agencies and private operators to tailor protections to their own risk environments.
In practice, it’s become a policy map full of overlapping boundaries — blurry accountability, scattered resources, and fragmented oversight.
It’s a patchwork: agencies, regulators, and corporate partners each hold a piece of the responsibility, but no one has the full picture.
While the U.S. administration is reviewing these policies, the underlying trend remains: we keep expanding the definition of “critical” without improving coordination.
The result?
- Expansion without coherence
- Protection without prioritization
- A system too diffused to defend
It’s the digital version of the bystander effect: if everyone is responsible, no one truly is.
Bureaucracy as Resilience
Let’s shift to the European model, which takes almost the opposite approach. Where the U.S. delegates, the EU codifies — through the NIS 2 Directive and the Critical Entities Resilience Directive.
These cover a wide range of organizations — from cloud providers to waste-water plants — all classified as “essential” or “important.” Each must prove compliance with risk management, incident reporting, and supply-chain security requirements.
It’s easy to dismiss that as bureaucratic overreach — and in part, it is.
But it’s also effective in its own way. Bureaucracy, for all its flaws, enforces repeatable, auditable behavior even as it slows things down.
Under NIS 2, an outage may still occur, but the recovery process is predictable. You may not like the paperwork, but you’ll have it — and sometimes, that’s half the battle.
Still, the EU’s model has limits. If the U.S. risks diffusion, the EU risks inertia. Both can be mistaken for resilience, but neither guarantees protection. What bureaucracy guarantees is documentation, not defense.
Interdependence and Fragility
Both systems face the same dilemma: interdependence.
It magnifies both stability and fragility. A local failure can ripple across sectors and become a global event — yet shared infrastructure also provides recovery pathways.
When an AWS region fails, another often takes over. That’s designed resilience, but it isn’t limitless. As we’ve seen, microservice architecture provides local stability but global fragility. The more distributed a system becomes, the harder it is to understand its failure points.
When everything depends on everything else, “critical infrastructure” starts to lose meaning.
The goal isn’t to eliminate dependencies — that’s impossible — but to decide which ones we can live with.
The Coordination Gap
Coordination, or the lack of it, is the real challenge.
A recent Carnegie Endowment report put it plainly: the issue isn’t whether to protect critical systems, but how to coordinate that protection across borders.
The internet made infrastructure transnational.
Regulation, however, still stops at the border. The wider that gap grows, the more fragile the entire system becomes.
We’re trying to protect a global network at a time when global cooperation is at a low point.
During the October AWS outage, responses were swift — and revealing:
- In the UK, debates about tech sovereignty resurfaced.
- In Brussels, attention turned to reducing dependence on U.S. hyperscalers.
- Across tech journalism, the consensus was clear: a global AWS outage exposes fragile digital foundations.
And they’re right. But this technical failure has become political ammunition. The debate has shifted from uptime to control — who controls the tools we can’t function without?
From Protection to Fragmentation
Once something is labeled critical, every government wants jurisdiction.
Every region wants its own version. The intent is protection; the result is fragmentation.
This same tension shows up in debates about Digital Public Infrastructure (DPI) versus Critical Information Infrastructure (CII).
- DPI emphasizes inclusion, interoperability, and openness.
- CII emphasizes security, restriction, and control.
Both serve public goals — they just stem from different design instincts.
For example, India’s Aadhaar identity system began as an open platform for inclusion. Five years later, it was reclassified as protected critical infrastructure. That shift was probably necessary, but it raises an uncomfortable question:
Should systems managing that level of personal data ever have operated without such protections?
Move too early, and you stifle innovation.
Move too late, and you amplify harm.
Timing, Trust, and Trade-Offs
The challenge is timing — and trust.
How do we decide when openness must yield to oversight, and how do we maintain public confidence when that shift happens?
Declaring something critical is never neutral. It’s a political act.
In the digital economy, criticality itself becomes a kind of currency — attracting investment, lobbying, and influence.
If a nation declares a platform critical, is it for resilience or for leverage?
Realistically, it’s both.
Selective Resilience
If The Infrastructure We Forgot We Built was about recognizing new kinds of critical systems, this reflection argues for restraint.
Declaring everything critical doesn’t make us safer — it makes prioritization impossible.
Resilience requires hierarchy: knowing what must endure, what can fail safely, and how recovery happens in between.
That’s uncomfortable for policymakers. Safety sounds equitable; prioritization sounds elitist.
But resilience demands choice. It asks us to build systems that tolerate failure rather than pretending it won’t happen.
The more we classify, the more we appear to protect — and the less control we have when it matters most.
Maybe the real task isn’t expanding the list of critical infrastructure, but learning to live with a smaller one.
Because protection is ultimately about trade-offs:
- Between autonomy and interdependence
- Between openness and control
- Between trust and necessity
The harder we try to protect everything, the more fragile we make the whole.
[00:13:33]
That’s it for this week’s episode of The Digital Identity Digest.
[00:13:38]
If this helped make things clearer — or at least more interesting — share it with a friend or colleague.
Connect with me on LinkedIn @hlflanagan, and if you enjoyed the show, please subscribe and leave a rating on your favorite podcast platform.
You can also read the full post at sphericalcowconsulting.com.
Stay curious, stay engaged, and let’s keep these conversations going.