Microsoft’s Lisa Monaco: What Leaders Need to Know About Digital Sovereignty

Linda Lacina, Meet the Leader: Welcome to Meet the Leader, the podcast where top leaders share how they're tackling the world's toughest challenges. In today's episode, we talk about a complex issue: AI sovereignty. Why leaders need to understand it, and how the right approach can protect business, growth and innovation.

Subscribe to Meet the Leader on Apple, Spotify and wherever you get your favourite podcasts. And don't forget, rate and review us. I'm Linda Lacina from the World Economic Forum and this is Meet the Leader.

Lisa Monaco, Microsoft: People are concerned, rightly, about how they control their digital destiny, how they control the security of their data, how they ensure the continuity of services for their enterprises.

Linda Lacina, Meet the Leader: Technology is changing fast. And as we've seen with AI, more and more of the infrastructure, from chips and data centres to cloud services and AI models, are controlled by just a small number of countries and organizations.

Of course, in a hyper-connected world, there's no such thing as true autonomy. No company or organization can truly be an island but there are big risks to manage, countries and businesses can lose access to critical technology.

Geopolitical conflict can put sensitive data in the wrong hands and too many could miss out on the big benefits that AI is poised to bring. Leaders need to think strategically about this complex issue. Lisa Monaco can help.

She has spent 25 years working in government and national security and she's currently Microsoft's president of global affairs. In this role, she drives responsible leadership on technology policy and what that means for complex issues like cybersecurity, digital sovereignty and AI governance.

She'll talk to us about what digital sovereignty means and what leaders should be thinking about to ensure that sovereignty can help support growth and innovation and not just hold it back. She'll talk to us about all of that but first she'll define digital sovereignty.

What Is Digital Sovereignty and Why Does It Matter?

Lisa Monaco, Microsoft: So, digital sovereignty actually means a lot of different things to a lot of different people but fundamentally, what I'm finding in my conversations with leaders around the world and my role as president of global affairs at Microsoft, it really comes down to a number of different things.

First, it means control – control over data, over resiliency of services, continuity of services. It means choice. It means countries and governments and companies and enterprises wanting to have a choice of how they handle and ensure that their data is handled in a safe, secure manner. So it means a lot of different things. It also, for Microsoft, means security.

We really think digital sovereignty is really interspersed and inextricably intertwined with security of that data and it's the kind of thing that we are very, very focused on as we provide services to governments, customers, enterprises, universities – you name it – all around the world.

Linda Lacina, Meet the Leader: And there's been an uptick in organizations that are pursuing sovereign solutions and digital sovereignty has certainly been a big topic of conversation. Why is this?

Why Digital Sovereignty Matters for Organizations

Lisa Monaco, Microsoft: We are in a time of real volatility geopolitically with regard to trade relations. We are in a volatile time. We're in a time when, frankly, the cybersecurity landscape is expanding and is unpredictable.

So people are concerned, rightly, about how they control their digital destiny, how they control the security of their data that ensures the continuity of services for their enterprises, and they, rightly, want to make sure that they can control that destiny. And that's something Microsoft is working with governments and companies around the world to ensure that they can do.

I mean, we think of sovereignty and digital sovereignty across a number of different dimensions. For instance, cybersecurity, as I mentioned, digital sovereignty and sovereignty itself. You often think about sovereignty as synonymous with erecting walls and borders but we also think about it as helping institutions and organizations of all types be empowered to use their data, to use their intellectual property to the fullest extent possible.

But you can't actually protect your digital sovereignty if you can't protect your digital borders. And when it comes to cybersecurity, we at Microsoft are seeing trillions of security signals every single day and we are using that information to help protect customers and governments that we work with at the speed of cyber to protect their data to protect themselves.

So we think about sovereignty as related to cybersecurity. We think about it as protecting data, where our ethos is your data, your control. We think about it in terms of privacy. We've long been committed to customer privacy and protecting customer privacy.

We think about it in terms of ensuring that we're contributing to a digital ecosystem that's lifting up developers and entrepreneurs and businesses and ensuring competition and finally, we think about it in terms of resilience, continuity in a really volatile world. We want to make sure that we are a source of stability, including digital stability in that very volatile world.

How to Protect Company Data Without Isolating Your Organization

Linda Lacina, Meet the Leader: What do people sort of misunderstand about digital sovereignty?

Lisa Monaco, Microsoft: The way I think about it, in the conversations I'm having with business leaders and government leaders, oftentimes there is a sense that if you isolate – if you put your information and your data behind a wall of sorts, if you isolate from the rest of the world, so to speak – that you are getting more control and having more security. But there is a real trade-off in doing that because you then wall yourself off from the important intelligence that we can provide by having access to that cybersecurity information that helps companies and governments protect themselves.

The Cybersecurity Risks Leaders Are Trying to Avoid

Linda Lacina, Meet the Leader: You know, if we can kind of help kind of drive home to people why people are exploring digital sovereignty solutions, what is the worst case scenario that they're looking to avoid?

Lisa Monaco, Microsoft: Conversations I'm having really do relate to the volatile geopolitical environment that we're in. There is concern on a number of different levels. First, about, you know, what is AI and this transformative technology. What does it mean for people, for families? What are the risks inherent in some of this technology and how should they think about that?

Companies and governments worry about trade volatility and whether one government will be able to throttle access to digital services from another, cut them, cut them off. There's concern about a so-called kill switch and then there's concerns about where is all this going? What is the trajectory of AI?

And so those are the conversations that we are having, that I'm having around the world with leaders and businesses and we're trying to be that source of stability, that source of continuity and that source of security in a very volatile world.

Why AI Adoption Matters More Than AI Invention

Linda Lacina, Meet the Leader: What does it mean for emerging tech things like AI, especially as they're becoming some of the big drivers for economic growth and also competitiveness.

Lisa Monaco, Microsoft: History tells us and this has been true throughout history with all sorts of technologies, from the steam engine to the light bulb and electricity to the internet, that the economies, the countries that grow the most that really reap the benefits of transformative technologies are not necessarily the ones that invent it actually.

History shows us that the economies and countries that reap those benefits, that grow the fastest, are the ones that adopt and, as we call it, diffuse that technology throughout their economies, throughout their society. The ones that use it the fastest and the widest.

What we're seeing is that AI is being adopted and diffused faster than any other technology ever in the history of the world. Faster than the steam engines. Faster than electricity and the internet today, one in six people across the globe have used generative AI technologies. That is a really rapid rise.

But the other thing we're seeing, Linda, is that this diffusion isn't happening evenly. Microsoft released something we called the diffusion report and what we see in that report is that there is a digital divide between the Global North and the Global South and unfortunately, it's a divide that's growing. The Global North is diffusing or adopting AI at twice the rate as the Global South and we see a number of reasons for that disparity.

So, what blocks people and organizations from adopting this technology? It's a few things. It's access to energy and to power. It's connectivity, access to devices that can enable you to use this technology. It's skills. It's access to skills and education about how to use this technology.

So these are the things that Microsoft is investing in to try and remove these blockers, to invest in infrastructure to provide services and to allow everyone to benefit from this technology. We're investing in skilling and providing individuals and organizations and youth across the world really learn and become literate in these skills to help them advance and really reap the benefits of this AI-driven economy.

Why the Global AI Divide Is Growing

Linda Lacina, Meet the Leader: We're talking about this issue. What are the actual solutions? So people can kind of maybe have a picture in their head of what they look like. How do they walk and talk? What are we talking about here?

Lisa Monaco, Microsoft: I have been so excited to see these technologies being put to use. Yes, in organizations and businesses to really help people be more productive to access and use their data and their intellectual property to the fullest extent.

But I've also seen kids in a classroom in India using this technology to help learn. Teachers help them form their lesson plans and develop quizzes to help teach their students. I've seen students in Brazil in the largest technical and vocational university in Brazil, becoming more conversant and more literate and gaining skills in cybersecurity.

Right, so these are the types of really practical skills that we're investing in and partnering with schools, with universities, with nonprofits to help lift up people around the world to develop these skills and reap the benefits of this incredible technology

How Organizations Can Protect Data and Critical Services

Linda Lacina, Meet the Leader: For digital sovereignty in particular. What are people making sure that they have landed?

Lisa Monaco, Microsoft: To give you an example right here in Europe. There's lots of talk about concerns about digital sovereignty. Microsoft turned 50 last year and we've been in Europe more than 40 years. I think the first version of Microsoft Word was released just about 40 years ago here in Europe in multiple languages.

So we've been here a long time and the commitment is clear. But we want to double down on that at a time when there really is concern about volatility in the world, from conflicts, as we've seen in Russia and Ukraine, to trade volatility and as we've seen strains amongst the longstanding alliances.

So the number of things that we're doing really focus on that commitment to data security, data privacy. So, for instance, we have said we will continue to protect customer privacy. We will challenge court orders that conflict with local law. We will challenge requests from the government to cease services to the highest extent possible under the law, our data centres that we invest in across Europe and indeed across the world.

Here in Europe, they're governed by boards of directors that are populated by European nationals. So we're also committed to building up an ecosystem, a digital ecosystem, if you will, that is providing a platform.

We can provide the access, open access to models and compute that can really build a growing competitive digital ecosystem and that's why the data centres that we have here in Europe host 1000s of models, many, many, many open models, including from real, you know, national champions companies like Mistral or Hugging Face. So the focus here really is on being that source of openness.

Now, the last thing I'd say on this, Linda, is because there is that concern about geopolitical and trade and other sources of volatility. We want to be that source of stability. We've made a commitment and we've put in our contracts that we will challenge orders to cease and desist services. We are working with companies to ensure continuity of service to really make sure that people know that they can have that source of reliability in the services we provide.

How Leaders Can Build Trust in AI

Linda Lacina, Meet the Leader: How can leaders make sure that they are maintaining trust at a time when scrutiny is increasing? What are these elements that need to be put in place?

Lisa Monaco, Microsoft: Well, I think it comes down to a few different things when it comes to security and this is something again that I think is inextricably linked to issues of sovereignty and control over data and intellectual property. You can't bolt it on later. It has to be embedded from the beginning.

It also means transparency, right, in how we're going about that work. Transparency about the principles that we're applying. I think those are a few of the elements and they're what our leadership is thinking about and I think it's what leaders of organizations of all types should be thinking about.

Digital Sovereignty Is More Than Data Localization

Linda Lacina, Meet the Leader: What does the world look like if we get digital sovereignty right?

Lisa Monaco, Microsoft: I think that empowering individuals and organizations of all kinds to control their destiny. Yes, their digital destiny. You can think about digital sovereignty and you can think about sovereignty as an isolation action – it's kind of closing yourself off – or you can think about it in terms of empowerment.

And part of that is making sure that you're doing your level best to protect yourself and your data, and we are helping to do that with the access, as I said, to trillions of security signals around the world to then help companies protect themselves, to really respond at the speed of cyber, to help them protect themselves, to protect their data.

So rather than thinking of sovereignty as isolation, we're trying to think about it in terms of empowerment and security, and seeing those things as inextricably linked.

How to Choose a Digital Sovereignty Strategy

Linda Lacina, Meet the Leader: What needs to change to make sure that those things are all in place?

Lisa Monaco, Microsoft: Well, I think approaching it in this way, right? Approaching it from the sense that the end of the day, sovereignty and the future of the firm is about security. It's about risk management, really. There are different sovereignty solutions that we're seeing companies and organizations of all sizes and stripes, really employ. You can think about it as a bit of a portfolio approach.

We have our public cloud that we provide to companies and organizations around the world and that may be sufficient and appropriate for certain companies and firms for the data that they have and that they're using. That public cloud has sovereign controls, encryption and key management and security and the like.

We employ here in Europe the EU data boundary, right, giving customers and organizations the choice to process and keep their data within that EU data boundary, organizations with sensitive workloads and data may choose to have a separate system, a private cloud, so to speak or do their processing on their own premises.

So there's a full range of approaches to this but at the end of the day, it ought to be governed by a series of these principles: cybersecurity, control, data residency, commitment to privacy, commitment to continuity of services and resilience of services. Those are the principles we're trying to apply and work with governments and organizations around the world to do exactly that.

Why AI Security and Cybersecurity Must Work Together

Linda Lacina, Meet the Leader: You've led major national security and cyber initiatives both as a US deputy attorney general, but also as a Homeland security advisor. Can you talk a little bit about how those experiences have shaped your view of AI as a strategic asset, and maybe also as a national level security risk?

Lisa Monaco, Microsoft: Well, sure. You know, across my career, I've seen technology have great promise, frankly, and have great peril. And there's a, you have to keep that in mind, and to be able to see that, and to see both sides of particularly transformative technologies like AI. I've seen it both in this role and in previous roles, have the potential to be misused and to be abused.

I think we need to be talking about and approaching AI security and cybersecurity, frankly, as one conversation. Right? You can't think of one isolated from the other and that's how we're approaching it. I think that's how leaders should be thinking about it. That's how I thought about it in my public service career, approaching these issues as risks of very dynamic proportions that really do go together. And you've got to apply a few principles to this, right?

Don't wait for that disaster to happen. Preparedness, information, access to information and information sharing. Preparing your response ahead of time. Those are the types of skills and principles that we use to approach threats of all types, whether it's terrorism threats to cybersecurity and now to disruptive and transformative technologies like AI.

Why Cybersecurity Requires Public-Private Collaboration

Linda Lacina, Meet the Leader: You've worked in intelligence, you've worked in law enforcement, now tech. How do those particular communities, how do they need to maybe evolve or change or grow so that we can sort of better together defend AI infrastructure? But also this safeguarding, this digital sovereignty.

Lisa Monaco, Microsoft: Well, look, you used the key word and that's together. What I have found, both in my public service career and now at Microsoft, is that no one organization can address these issues in isolation. We've got to be working together. We've got to be collaborating.

When it comes to, frankly, cybersecurity, there wasn't a single impactful operation or act to address a threat or a cybersecurity concern that didn't include collaboration between the public sector and the private sector. In my experience, that didn't, frankly, include collaboration across international boundaries. We've got to have that international collaboration and that's what I saw to great effect, both when I was in the public sector and now at Microsoft.

And for instance, we have something called the Digital Crimes Unit that is part of my team at Microsoft and they have been pioneering efforts now for decades to employ civil legal processes to employ technical capabilities, to disrupt cyber criminal actors, including the criminal ecosystems that feed ransomware attacks, that feed fraud scams.

They've undertaken a disruption action, working with Europol, working with German authorities, working with the UK to disrupt and dismantle a cyber criminal ecosystem that was providing the computer infrastructure and stolen software to cybercriminals around the world.

So it's that working together, using the intelligence that we have, the unique insights that Microsoft has access to when it comes to cyber threats, using that, sharing that, working with authorities around the world to take action under the rule of law to disrupt those criminal actors. These are the types of collaborative efforts that we need to be doing more of.

What Are Digital Embassies?

Linda Lacina, Meet the Leader: How do digital embassies fit in? What role might they play?

Lisa Monaco, Microsoft: It's the type of thing that we can be and should be exploring to give countries and companies a potential answer to sovereignty concerns, to think about how they can control their data, have the assurance that it can be treated under their local law, even if it is hosted in a host country.

Linda Lacina, Meet the Leader: For those who aren't familiar, what is a digital embassy?

Lisa Monaco, Microsoft: It's exactly that. You think about an embassy in one country's embassy in another country as being a source of their sovereignty in that country and their kind of representation in that country. And the idea that was explored in a few sessions here this week is doing the equivalent for hosting data of one country in another, governed by the data owners' laws in another country.

Linda Lacina, Meet the Leader: And how could embassies help countries balance both that reliance but also interoperability?

Lisa Monaco, Microsoft: So you know, could conceivably give the country and the entity who is the guest in that country, the assurance of how their data is going to be treated, even though it is hosted in a separate country. So it's this idea of having resilience, having control, having certainty about how you treat what can be your most precious asset, your data.

Why AI Security Is a Board-Level Risk

Linda Lacina, Meet the Leader: Leaders who are looking to sort of secure our AI future, what should they be prioritizing?

Lisa Monaco, Microsoft: Well, they should be treating it not as just a technological problem but a societal problem. They should be treating it as a societal challenge, looking to make those investments in security, asking those questions, treating it at the level of if you're a company or organization or a corporate organization at the board level, really viewing this as an issue of really senior level risk management and attention, and treating it as a security priority.

That's the way that we're approaching it at Microsoft and that's how we think both we will build the trust and confidence in the use and development and deployment of this technology that will ultimately then enhance the use, the adoption, the diffusion of that technology, which is so essential to ensure that everyone can be benefiting from this transformative technology and an AI-driven economy.

Linda Lacina, Meet the Leader: That was Lisa Monaco. Thanks so much to her and thanks so much to you for listening.

If you like this episode, share it with someone looking to better understand how we'll manage this complex world. I bet it's a long list.

The World Economic Forum published a paper you might want to see, this Spring: AI Infrastructure in the Age of Sovereignty. I'll make sure to have a link in the show notes. If you enjoyed this episode, take a listen to our interview with Microsoft's president, Brad Smith. He has a deep interest in how leaders have navigated technological change. He talks a little bit about the blind spots that can come with progress.

Find a transcript of this episode as well as transcripts from my colleague's podcast, Radio Davos, on wef.ch/podcasts.

This episode of Meet the Leader was produced and presented by me with Taz Kelleher as editor, Juan Toran as studio engineer in Davos and Gareth Nolan driving studio production. That's it for now. I'm Linda Lacina from the World Economic Forum. Have a great day.