The Nayara Energy incident laid bare a chilling reality: a sanctions compliance decision by a global cloud vendor can abruptly disrupt operations at a major Indian corporation, cutting off access to critical data and services. That event, now a touchstone in policy circles, underscores why India's national security analysts and researchers are sounding alarms over the country’s deep dependence on US-controlled software, platforms, and cloud infrastructure. A recent brief circulating in Indian media calls for a national push toward digital self-reliance by 2030, arguing that Windows, Android, foreign hyperscalers, and US-headquartered cybersecurity firms have become strategic vulnerabilities that demand urgent action.

The dependence is staggering and spans every layer of the digital stack. On desktops and laptops, Microsoft Windows dominates, with some estimates suggesting over 25 million government and enterprise laptops run the OS—though exact governmentwide inventories remain unpublished. On mobile, Android’s grip is even tighter; StatCounter data places its share in India in the mid‑90% range, meaning hundreds of millions of smartphones rely on Google’s platform, from OS updates to core services. Productivity and collaboration tools are overwhelmingly provided by Microsoft 365 and Google Workspace, with vendor disclosures indicating tens of millions of seats across corporate India. Meanwhile, the cloud market mirrors global trends: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud collectively hold the lion’s share of infrastructure spending, hosting vast swaths of enterprise and government workloads.

Cybersecurity defenses are no less dependent on foreign vendors. The endpoint detection, firewall, and cloud security stacks protecting Indian networks are dominated by firms like Palo Alto Networks, Cisco, CrowdStrike, and Microsoft. In critical infrastructure, industrial control systems (SCADA/PLC) in power grids, water treatment, and manufacturing overwhelmingly run on products from Rockwell Automation, Siemens, and Schneider Electric—proprietary systems with complex supply chains and limited auditability. Even the public square is shaped by US platforms: Google Chrome commands 80–90% of browser usage, while Meta’s Facebook, WhatsApp, Instagram, YouTube, and X remain central to online discourse and are governed by policies set far from Delhi.

This web of dependencies is not merely an economic or convenience issue—it is a multifaceted strategic risk. The threat of extraterritorial law looms large, as the Nayara Energy case demonstrated: a global vendor, fearing secondary sanctions, may unilaterally suspend services even when local laws do not require it. Vendor lock-in compounds the danger; years of custom integrations, multi‑year contracts, and certification cycles make rapid migration from entrenched productivity suites or cloud platforms prohibitively expensive. Supply‑chain risks in industrial control systems and defense platforms—such as the AH-64E Apache helicopters and P-8I maritime patrol aircraft that rely on US‑developed mission software—mean a foreign decision could choke critical capabilities. As the brief warns, these are not hypothetical scenarios; they represent “possible immediate operational consequences for Indian institutions” stemming from non-technical decisions by a foreign company or government.

Achieving genuine digital sovereignty, however, is not a slogan but a complex, multi‑pillar program. It demands auditable operating system alternatives for sensitive government functions, with Linux‑based or domestically developed stacks replacing Windows on classified desktops under a practical migration plan. A sovereign cloud ecosystem must scale beyond the government’s MeghRaj (GI Cloud) initiative, which has grown but still lags hyperscalers in service breadth and AI‑capable infrastructure. Domestic cybersecurity firms need investment and procurement preferences to challenge global incumbents, while open‑source alternatives—pioneered in pockets like Kerala’s FOSS adoption—must be hardened for national‑level services. Legal safeguards, bilateral agreements, and procurement clauses that mandate service continuity and limit arbitrary suspension are equally critical.

India can draw lessons from international experiments. The European Union has pursued sovereignty through regulation—the Digital Services Act and Digital Markets Act reshape platform accountability—and through initiatives like Gaia‑X that foster interoperable, sovereign‑compliant cloud standards. China’s whole‑of‑state push has produced indigenous operating systems like Kylin and HarmonyOS, aggressively deployed through state procurement and industrial policy. Yet the EU model demonstrates that regulation alone cannot quickly build domestic alternatives, while China’s approach—effective but authoritarian—offers no simple template for a pluralistic democracy. Both underscore that transitions take years, even decades; Windows remained widely used in China long after homegrown alternatives emerged.

A pragmatic roadmap for India mapped in the brief unfolds over five phases. The first 12 months should be spent on a central, verifiable inventory of all critical digital assets—operating systems, cloud workloads, SCADA vendors, device fleets—categorized by sensitivity. In the next 12–36 months, the highest‑risk workloads (national security, critical financial infrastructure, essential services) must be ring‑fenced, with pilot migrations to sovereign cloud nodes and auditable OS environments. Scaling MeghRaj and certifying private Indian cloud providers to match hyperscaler service levels is a 12‑to‑60‑month undertaking, demanding heavy public investment. Overlapping with that, 18–60 months will be needed to accelerate domestic cybersecurity R&D, mandate third‑party code audits, and embed “right to audit” clauses in all critical vendor contracts. Underpinning everything is a massive workforce upskilling effort in cloud operations, open‑source development, and secure systems engineering, while maintaining interoperability with global trade.

The push for sovereignty carries genuine strengths: it reduces single points of failure and extraterritorial legal exposure, builds a domestic industrial base, and improves auditability of sensitive systems. Yet roadblocks are formidable. The scale and capability gap between Indian alternatives and globe‑spanning hyperscalers—backed by decades of engineering and billions in capex—cannot be bridged overnight, necessitating hybrid models rather than binary choices. Migrating from mature SaaS ecosystems incurs heavy integration and user‑experience costs. The price tag is steep, requiring sustained public funding and procurement reform. And an overly aggressive localization drive risks trade friction with partners who supply essential technologies and maintain significant local investments.

Multinational vendors are deeply entrenched: Microsoft’s multi‑billion‑dollar commitments, AWS’s investment pledges, and Google’s manufacturing moves in India signal that these companies are not about to retreat. That reality makes engagement and negotiation realistic levers. The goal should be a balanced strategy—sovereign capacity where risk is highest, domestic alternatives incentivized, procurement hardened, while productive global partnerships continue. Indicators to watch include MeghRaj’s adoption metrics, RBI‑led pilots for locally hosted financial cloud services, the market share growth of Indian cybersecurity firms, and the inclusion of right‑to‑audit and continuity‑of‑service clauses in government contracts.

The brief’s conclusion is blunt: the call for digital sovereignty is not economic nationalism but a response to verifiable dependencies that breed real operational and legal risk. India’s current reliance on an external stack delivers rapid innovation today but carries potential strategic brittleness tomorrow. A phased, practical approach—building sovereign muscle where it matters most while keeping global linkages alive—offers the only path forward that is both secure and economically rational.