Digital Sovereignty in Times of Crisis: The Impact of Cyberattacks on the Functioning of State Institutions (Comparative Analysis of South Caucasus States)

Abstract

In the era of modern geopolitical crises, the concept of state sovereignty has transcended physical borders and moved into the digital dimension. The South Caucasus, with its ethnopolitical conflicts and strategic location, represents a unique environment for investigating how cyberattacks are used to destabilize state institutions and reorganize the political order. This study focuses on the concept of “digital sovereignty” and analyzes the resilience of state institutions in the region against growing cyber threats. The main objective of this research is to establish the relationship between the intensity of cyberattacks during times of crisis and the quality of functioning of state services. The study addresses three primary questions: How do cyberattacks transform the strategies of state institutions in the South Caucasus? What is the impact of digital infrastructure vulnerabilities on public trust in state institutions? What different models of protecting digital sovereignty exist in Georgia, Armenia, and Azerbaijan? The study is grounded in the theories of neorealism and the "cybersecurity dilemma," viewing digital space as an anarchic environment where states strive for survival and influence. It introduces the cybersecurity dilemma as a phenomenon where a state’s efforts to strengthen its digital defenses are perceived by neighbors as potential threats, leading to regional digital armament. Digital sovereignty is redefined here not merely as data localization, but as a state’s ability to maintain control over critical information flows during a crisis. For small states like those in the Caucasus, digital sovereignty is argued to be a prerequisite for national survival. Methodologically, the study employs a qualitative comparative case study based on the “Most Similar Systems Design” (MSSD) model. While all three countries share a post-Soviet legacy and face active or frozen conflicts, their approaches to digital security differ radically. Data sources include content analysis of national security strategies, event analysis of specific incidents (2008, 2019, 2020), and index comparisons using ITU Global Cybersecurity Index data from 2015–2025. Georgia – Reactive Modernization: As the first country to experience coordinated cyber and physical attacks (2008), Georgia provides a blueprint for institutional transformation. The creation of the Data Exchange Agency (DEA) and the Cybersecurity Bureau highlights a choice of Western integration, where digital sovereignty is linked to NATO and EU standards. Azerbaijan – Centralized Control: During the 2020 Nagorno-Karabakh conflict, Azerbaijan demonstrated a high degree of state control over information flows. The study analyzes how Baku utilized cyber capabilities for both defense and strategic communication, effectively insulating critical infrastructure from external interference. Armenia – Decentralized Resilience: Armenia presents an interesting contrast—possessing a strong private technology sector but vulnerable state institutions. The study examines the paralysis of government websites during the 2020 war and its subsequent impact on wartime decision-making. The paper argues that cyberattacks act as psychological weapons aimed at the “social contract” between the state and its citizens. Digital sovereignty is directly proportional to institutional resilience; if state services are disrupted, the state loses legitimacy. This is examined through: Institutional Functioning: Disruptions to public registries or banking systems cause “bureaucratic shock,” preventing the state from performing its core function: service delivery. The Crisis of Trust: In a region where institutional trust is fragile, successful cyberattacks are perceived as signs of state weakness, leading to political destabilization. Reorganization: Crisis acts as a catalyst; countries experiencing severe attacks are more likely to pursue radical legislative and institutional reforms, as seen in the Georgian case. The concluding section emphasizes that restoring peace and order in the South Caucasus is unthinkable without cyber diplomacy. A "reorganization of order" requires states to recognize digital space as an integral part of sovereignty, necessitating technological as well as military readiness. The research offers a new vision of how small states can maintain political sovereignty in the face of global technological disruption. Ultimately, the region's new security architecture will depend on the extent to which these three countries can establish independent and secure digital ecosystems.