Government in the cloud, state on a tether: Ukraine’s data evacuation and the resilience-sovereignty-privacy trilemma

This article examines how wartime relocation of public data and digital workloads beyond Ukraine reshaped digital governance. It asks: How has data evacuation abroad affected Ukraine’s digital governance in terms of resilience, sovereignty, and privacy? Using a qualitative single-case study based on document analysis, it examines laws, parliamentary records, official statements, provider reports, scholarship, and reported incidents from February 2022 through December 2025. It identifies and articulates a resilience-sovereignty-privacy (RSP) trilemma as a defensive counterpart to Maschmeyer’s subversive trilemma. External cloud and backup arrangements improved continuity by reducing exposure to destruction, seizure, power loss, and destructive cyber operations. However, externalization redistributed practical control across Ukrainian law, foreign jurisdiction, contracts, cryptographic-key custody, provider architectures, and networks. Privacy outcomes were conditional: scale and geographic redundancy reduced some technical risks, while cross-border processing, registry integration, emergency exceptions, and limited transparency increased governance risks. The article identifies a connectivity trap in which resilience depends on networks, identity systems, funding, contracts, and provider decisions that can become strategic chokepoints. Ukraine’s later rules on encryption, provider standards, portability, and exit partially mitigate this trap, supporting a portfolio model of wartime digital continuity rather than a binary choice between domestic hosting and foreign cloud dependence.