Cyberspace was conceived as independent, yet it never was. States claimed it first, but now Big Tech is going further, making itself structurally indispensable to how international security is governed, legitimized, and fought.
It started with lobbying, which has grown over 33% in just two years, and is quickly developing to take over the military and legal realm regarding cyberspace as well. The Russia-Ukraine conflict made this shift impossible to ignore, with companies like Starlink, Microsoft, and Palantir Technologies becoming decisive players in war. Recent trends in warfare have only confirmed this further, blurring the line between Silicon Valley and the battlefield.
On a legal level, they are actively shaping regulations, and despite the positive changes they could bring, like Microsoft’s AI for Good Lab aimed at supporting civil society, the other side of the coin is that they are ultimately focused on their own interests. The push by Big Tech for the Digital Omnibus proposals, aimed at scaling back digital protections, is a case in point. Given that states increasingly need to rely on these companies, their temptation to exploit that dependence is real, as the fastest way to shape the rules of a new domain is to write them yourself. This is best exemplified through “tech diplomacy,” with Big Tech becoming a co-maker of norms, eroding the distinction between public and private power.
This ultimately raises questions about how force and legislative power, once the state’s monopoly, are increasingly being distributed. States, for all their failures, at least claim to represent populations, whereas companies represent shareholders, accountable only to profit. And yet they are increasingly co-producing the rules, the wars, and the governance architectures that shape all of our lives. And nobody voted on that.
Despite the digital world being conceived as independent, as per the 1996 Declaration of Independence of Cyberspace, soon enough, states started to establish their dominance, seeking to use the internet to further their national priorities and regulate digital spaces accordingly. With the claims of the state, also came the ones from a further actor: companies. The latter have, notably, always been present alongside the state through lobbying, namely the pressure exercised by interest groups to influence state decisions, primarily to reduce costs and regulations and secure competitive advantages.
However, nowadays, companies and in particular Big Tech, are arguably doing even more than lobbying, but rather actively contributing to warfare. The Russia-Ukraine conflict made this shift clear, with examples including Starlink, Microsoft’s and Palantir Technologies’ deep involvement in Ukraine’s intelligence operations, and Nokia, which is packaging 5G for battlefield use.
States’ reliance on companies has been slowly building since Post-9/11, as the US military recognized the value of digital infrastructures, and Big Tech became increasingly involved in military-related projects. The moment that institutionalized this shift was Project Maven’s launch in 2017, as the Pentagon established its relations with AI-specialized Big Tech. The recent US strikes on Iran have only deepened this, given that AI-supported targeting was once again central, normalizing what was once unthinkable.
Apart from the military context, companies have also been essential in shaping regulations. A striking example was Microsoft’s proposal of a “Digital Geneva Convention” in 2017, aimed at combating cyberattacks. More recently, Big Tech firms have been pushing for the Digital Omnibus proposals, representing a major deregulation of EU digital laws, including the GDPR and the AI Act, which would permit AI models to train on personal data without active consent and make it easier to track customers’ behavior. Interestingly, the digital industry’s annual lobby spending has grown from €113 million in 2023 to €151 million today, representing a 33.6% increase.
States’ involvement with private tech giants has further deepened through the establishment of tech diplomacy, namely diplomats who go directly to company headquarters to negotiate, a term first introduced by Denmark in 2017. As argued by Cotroneo & Csernatoni (2025), this emerging public-private diplomatic practice positions Big Tech as a genuine interlocutor and co-makers of norms and governance architectures, therefore blurring the line between public and private power.
Given all of this, the picture becomes complicated. Firstly, it is understandable that in such a new and ever-changing domain like cyberspace and AI, states might not be prepared to fare on their own, and given tech companies’ better technological capabilities, compounded by the urgency of regulating this space, they would accept outside help. Furthermore, regulating cyberspace is also in companies’ own interest: as targets of cyberattacks, they have every reason to help shape the rules of a domain they operate in.
However, given their profit-driven nature, it would be an overstatement to regard these companies as good Samaritans. War is profitable, and given the growing recognition of AI and tech as central to modern warfare, companies are hardly reluctant to accept military contracts. Beyond classical profit, this is also a way for tech companies to gain public legitimacy and power, normalize their meddling in politics, and claim moral authority, which they could exploit later on. And while states at least claim to represent populations that (usually) hold them accountable, companies represent shareholders, accountable only to profit.
Ultimately, the meddling of companies in politics and norm-building is not necessarily a new phenomenon, but the digital realm is transforming how power is conceptualized even faster and more aggressively than before. State power over force and legality is unlikely to disappear overnight, but it is quietly corroding the monopoly on force and legitimacy that once defined the state. Whether this change is better or worse is too early to say, but it is certainly something to be careful about, especially given the push for deregulation and the increasingly deep penetration of AI in warfare, which risks removing the human component altogether. And nobody voted on that.