Private Sovereigns at War: Corporate Control of Communications, Compute, Targeting and the New Economic Arsenal

The State has never possessed every instrument by which war is conducted. Merchants financed fleets, chartered companies governed territories, privateers attacked commerce and manufacturers supplied arms. Public law nevertheless assumed that the decision which exposed a polity to war belonged, in the final account, to public authority. That assumption now fails in a new way. An individual may possess a satellite network, a corporation may control communications or cloud infrastructure upon which military action depends, a private military and security company may combine intelligence and force, and a commercial intrusion company may sell a capability formerly confined to a security service. Their power is neither merely wealth nor merely influence. It is the practical capacity to decide whether another actor may see, communicate, target, move or survive. This paper calls such actors private sovereigns when three conditions coincide: they control strategically indispensable capacity; they exercise material discretion over its wartime or coercive use; and no public authority capable of bearing the external consequence has authorised the particular decision in advance. The term does not grant them sovereignty in law. It identifies a constitutional defect: power with effects equivalent to public decision, exercised by one who neither represents those exposed to retaliation nor submits to the legal machinery by which force is ordinarily authorised and reviewed. Starlink's activation in Ukraine supplies the clearest case. Service was announced on 26 February 2022, before the later public contracts and reimbursement arrangements which regularised part of the relationship. The result assisted a State lawfully defending itself, but beneficence does not answer authority. Purchasers of unrelated products did not consent to foreign belligerent exposure; shareholders did not elect a foreign minister; and an owner's bank account did not supply a sovereign right. The same rule must govern a Chinese, Russian, British or American controller when the political sympathies are reversed. The danger is wider than satellites. State-linked contractor markets, private spyware, PMSCs, platform intervention, corporate denial-of-service capability and autonomous systems permit strategic acts to be commissioned, improvised or withheld beyond the effective reach of inherited mercenary, sanctions, company and cybercrime law. Dark Caracal and Lebanese Cedar are treated as separate technical reports: the former was traced by Lookout and the Electronic Frontier Foundation to a building of the Lebanese General Security Directorate; the latter was reported by ClearSky as a distinct campaign using known server vulnerabilities and linked by its researchers to Hezbollah. Neither report is converted into a judicial finding. The paper rejects the proposition that a private attacker loses human rights or becomes an "object of war" by leaving the social contract. Rights remain. In armed conflict a civilian may lose protection from direct attack only for such time as he directly participates in hostilities, or, on the better organised-group analysis, whilst exercising a continuous combat function; an object must satisfy the definition of a military objective. Outside armed conflict, lethal force is governed by the law-enforcement and human-rights framework save where the independent rules upon self-defence are engaged. Direct measures must nevertheless remain available. When a proved private operation presents an actual or imminent armed attack, or a node makes an effective contribution to military action and its neutralisation offers a definite military advantage, the fact that its owner is poor, deniable or incorporated does not immunise it. The statutory answer is control rather than prohibition: registration of strategic private capacity; public authorisation for intervention in armed conflict; a duty to maintain service and decision manifests; mandatory notification of coercive foreign requests; licensing of high-risk cyber and military services; personal orders against controllers; rapid preservation, freezing and infrastructure restraint; and a response ladder which includes sanctions, criminal process, civil restraint, cyber defence and, where international law independently permits, force. Proportionality should assess actual harm and maximum reasonably credible foreseeable harm, including replication and deterrent consequence. Punishment alone cannot create necessity under article 51, but a legal order which cannot act until cheap private warfare has killed at State scale has mistaken lateness for restraint. Publication edition, revised October 2026; not yet peer reviewed.