India’s digital backbone is more dependent on US-controlled software, platforms and cloud services than most citizens realize — and that dependence now reads as a strategic vulnerability in the eyes of national security analysts and independent researchers.
India’s public discourse over the last two years has moved rapidly from conversations about digital inclusion to far tougher questions about digital sovereignty — who controls the software, data flows and cloud infrastructure that run government, banking, critical industry and defence. A recent brief circulated in Indian media argued that Windows, Android, foreign cloud services and major social platforms sit at the centre of that dependence, and recommended a national push toward self-reliance by 2030.
That argument is part geopolitical warning, part technical audit. It draws on several visible facts: Chrome dominates web access; Android powers the overwhelming majority of Indian smartphones; hyperscale cloud providers host a large share of enterprise and government workloads; and leading cybersecurity vendors that defend endpoints are global, US-headquartered companies. These are not abstract points — they translate into the possibility that a non-technical decision by a foreign company or a foreign government could have immediate operational consequences for Indian institutions.
At the same time, sovereignty is a long, expensive and politically complex undertaking. The pragmatic path for India is a phased blend of building sovereign capacity where risk is highest, incentivising domestic alternatives, hardening procurement and audit regimes, and maintaining healthy engagement with global technology partners. Doing so will require sustained public investment, procurement discipline, and a strategic industrial policy that incentivises scale — not slogans. The alternative is continued reliance on an external stack that delivers rapid innovation and convenience today but potential strategic brittleness tomorrow.
Source: Deccan Chronicle India Should Achieve Digital Sovereignty And Cut Dependence On US-controlled Digital Infra: GTRI
Background
India’s public discourse over the last two years has moved rapidly from conversations about digital inclusion to far tougher questions about digital sovereignty — who controls the software, data flows and cloud infrastructure that run government, banking, critical industry and defence. A recent brief circulated in Indian media argued that Windows, Android, foreign cloud services and major social platforms sit at the centre of that dependence, and recommended a national push toward self-reliance by 2030.That argument is part geopolitical warning, part technical audit. It draws on several visible facts: Chrome dominates web access; Android powers the overwhelming majority of Indian smartphones; hyperscale cloud providers host a large share of enterprise and government workloads; and leading cybersecurity vendors that defend endpoints are global, US-headquartered companies. These are not abstract points — they translate into the possibility that a non-technical decision by a foreign company or a foreign government could have immediate operational consequences for Indian institutions.
The scale of the dependency: a closer look
Operating systems on desktops and laptops
- Windows remains a major desktop OS in India — StatCounter’s desktop OS metrics show Windows commanding a large share of desktop usage in India, though not to the exclusion of Linux and other options. Current month snapshots place Windows well above other desktop OSes, but precise counts of government and enterprise Windows laptops are not centrally published and therefore vary between reports and vendor claims. (gs.statcounter.com)
- The widely reported figure in some commentary — that “more than 25 million government and enterprise laptops run on Microsoft Windows” — is plausible in scale but not verifiable from public central registries. It should be treated as an estimate rather than a documented inventory. The government’s own device counts, when released, often focus on services rather than blanket hardware tallies. Flag: unverifiable exact number.
Mobile platforms: the Android problem (and the Apple exception)
- Android dominates India’s mobile market by a very wide margin. StatCounter’s mobile OS view shows Android at roughly the mid-90s percentage range in India, leaving iOS with a small single-digit share. That means hundreds of millions of devices in India run software stacks whose upstream control points and update mechanisms are governed by a handful of international corporations. (gs.statcounter.com)
- Public reporting that “over 500 million smartphones rely on Google’s Android” is conservative relative to market-share metrics and the country’s smartphone base (estimates for India’s active smartphone population now run into the 600–750 million band in recent trade reporting). Still, the precise device totals and the portion that can be updated or remotely controlled by platform vendors are not disclosed in a single official ledger. Flag: approximate but consistent with market-share data. (reuters.com)
Productivity software and collaboration tools
- Microsoft 365 (Office, Exchange, Teams) and Google Workspace occupy an outsized share of enterprise productivity and collaboration. Independent market trackers and vendor disclosures show both suites are used widely in India, particularly in corporate and startup sectors. The specific claim that “Microsoft Office/Exchange/Teams dominate 20 million devices, with Google Workspace covering another 5–10 million users” is plausible for enterprise seats but not independently verifiable at that granularity from public sources. Government email replacements (NIC’s offerings) exist but currently operate at a smaller scale than these global SaaS deployments. (nic.gov.in)
Cloud computing: hyperscalers in control
- Global market trackers put Amazon Web Services, Microsoft Azure and Google Cloud as the dominant hyperscalers: collectively they command roughly two-thirds of worldwide infrastructure spend, and that dominance is echoed inside India’s cloud market. Canalys and other industry analyses put AWS in the lead, with Azure second and Google Cloud third; India’s market structure mirrors the global trend with local variations and fast growth. That means a sizable portion of Indian enterprise and startup workloads live on US-headquartered platforms. (smetimes.in)
- At the same time, India’s government-owned cloud initiative (MeghRaj or “GI Cloud”) has expanded steadily, and adoption across departments has grown in recent years, but it is not yet a universal replacement for hyperscalers for all classes of workloads — especially AI-heavy or globally distributed SaaS services. Public adoption numbers for MeghRaj (departments onboarded, virtual machine counts) show progress but also underline the gap in scale and range of services compared with hyperscalers. (360analytika.com)
Cybersecurity and critical infrastructure suppliers
- The global cybersecurity market — which supplies endpoint detection and response (EDR), firewalls, cloud security and threat intelligence — is dominated by a small set of vendors that include Palo Alto Networks, Cisco, Microsoft and CrowdStrike among others. Canalys market breakdowns show these firms occupying meaningful market share globally; they also account for large enterprise deployments in India. This concentration means that the defensive stack protecting Indian endpoints and networks is largely provided by foreign commercial vendors. (infotechlead.com)
- Industrial control systems (SCADA/PLC) in power grids, water, transport and manufacturing commonly use products from global vendors — Rockwell Automation, Siemens, Schneider Electric, ABB and Emerson figure prominently in industry reports. These systems are mission-critical and historically have had complex supply chains and proprietary components; their ubiquity in Indian infrastructure is well-documented by specialised market analyses and project reporting. (marketsandmarkets.com)
Browsers, social media and the public square
- Google Chrome dominates browser usage in India. StatCounter places Chrome’s share in the high 80–90% range on many recent monthly snapshots — a figure lower than the 95% sometimes quoted in commentary, but still overwhelmingly dominant. That concentration concentrates web platform dependencies and distribution of web-based controls. (gs.statcounter.com)
- U.S.-based social platforms (Meta’s Facebook/WhatsApp/Instagram, YouTube, X/Twitter) remain central to Indian online discourse. These platforms are regulated unevenly at the national level and often implement global content and safety policies that are set far from Delhi.
Why dependence becomes a risk: legal, technical and geopolitical vectors
Extraterritorial law and sanction spillovers
The Nayara Energy incident — when corporate cloud access was temporarily cut following a sanctions update — is a vivid operational example often cited in Indian policy debates. That episode showed how a compliance decision by a global vendor, influenced by third-country law or regulation, can cascade into national disruption. It highlighted the legal grey area where a vendor may opt to suspend services to avoid secondary sanctions or legal exposure, even where the local jurisdiction has not imposed a ban. This dynamic is an important reason governments worry about sovereignty of service provision.Single-vendor failure and vendor lock-in
Operational continuity can be threatened by contractual or technical lock-in. Migrating large estates of productivity tools, mailbox archives, identity and access systems, or cloud-hosted applications is expensive and time-consuming. Multi-year contracts, custom integrations, and regulatory certifications make rapid substitution impractical for many public and private systems.Security and supply-chain risk
Foreign-supplied SCADA/PLC systems and defence mission software can be a vector for both inadvertent failure and targeted attack. While there is no open evidence of deliberate, widescale "remote kill switches" in legitimate vendor products, the technical architecture of networked industrial controls and the presence of proprietary, non-auditable code in mission-critical stacks means risk profiles are materially higher than for simpler commodity systems. Market analyses of SCADA vendors and the place of multinational vendors in India’s grid modernization projects underscore that dependency. (marketsandmarkets.com)Defence dependence
India operates platforms supplied by US manufacturers — for example, the AH-64E Apache attack helicopter and Boeing’s P-8I maritime patrol aircraft include mission systems, avionics and software developed by US defense contractors and integrated by US primes. Lifecycle support, certified updates and certain classified mission software elements are tied to foreign suppliers’ support chains. That creates a clear, direct dependence in defence capabilities on external providers and legal regimes. (boeing.co.in)What “digital sovereignty” would actually require
Digital sovereignty is not a slogan — it is a complex programme that must be planned across hardware, software, cloud, policy and human capital. Key pillars include:- Operating system alternatives and desktop migration
- An auditable, local or open-source stack (Linux distributions built for government security, or domestically developed OSes) for classified and sensitive desktops.
- A practical migration plan to reduce operational risk while keeping user productivity intact.
- Sovereign cloud capacity and certified data handling
- A credible sovereign-cloud ecosystem with interoperable, certified services for government, financial and defence workloads.
- Programs like MeghRaj show progress in government cloud adoption, but need scale, service breadth and operational SLAs to be a true replacement for hyperscalers in sensitive domains. (360analytika.com)
- Domestic cybersecurity industry scaling
- Investment, certification and procurement levers to scale Indian cybersecurity vendors and to require supply-chain transparency for critical sectors. Industry data shows the market is currently concentrated among global players, so public procurement can be a lever to grow local champions. (infotechlead.com)
- Open-source, audited alternatives for critical software
- Where possible, migrate core government services to auditable, open-source stacks. Kerala’s experimentation with Free and Open Source Software (FOSS) for government services is one model, but scaling this to national-level services requires sustained investment, training and procurement reform.
- Legal and diplomatic safeguards
- Bilateral agreements and procurement clauses that limit the scope for arbitrary service suspension, and legal instruments that clarify jurisdiction over data and service continuity in emergencies.
International models and lessons
European Union: regulatory-led sovereignty
The EU is actively pursuing sovereign digital infrastructure goals: regulation (DSA/DMA) reshapes platform behaviour and competition, while initiatives like Gaia-X and “sovereign cloud” efforts aim to foster interoperable European cloud alternatives and standards. The EU approach blends regulation, funding and industrial policy to create an ecosystem that reduces reliance on non-EU operators for critical workloads. (en.wikipedia.org)China: whole-of-state industrial stack
China has pushed aggressively toward an indigenous software and hardware stack. Homegrown OS options (Kylin family and OpenKylin) and Huawei’s HarmonyOS have made material progress for domestic use in government procurement and key industries. That effort is supported by state incentives and procurement decisions that privilege domestic suppliers. However, China’s model combines industrial policy, large state procurement and tight regulatory control — not a direct template for a pluralistic democracy — but nonetheless instructive on scale and commitment. Importantly, even in China Microsoft Windows remained widely used for years, illustrating that transitions are gradual and complex. (news.cgtn.com)Practical roadmap for India: five strategic priorities (a pragmatic, phased approach)
- Inventory and risk mapping (0–12 months)
- Mandate a central, verifiable inventory of critical digital assets (OSes, cloud workloads, SCADA/PLC vendors, device fleets, productivity software).
- Categorize systems by sensitivity and operational criticality.
- Ring-fencing the highest risk workloads (12–36 months)
- Define a class of workloads (national security, critical financial infrastructure, essential services) that require sovereign hosting and audited supply chains.
- Pilot migrations to certified sovereign cloud nodes and to auditable OS environments.
- Scale MeghRaj and certified sovereign cloud providers (12–60 months)
- Invest to match operational SLAs and service breadth for critical workloads.
- Certify and accredit private Indian cloud providers under a clear security and audit framework, and use procurement to scale demand. (360analytika.com)
- Accelerate domestic cybersecurity capability (18–60 months)
- Fund R&D and accelerate public procurement of Indian EDR, XDR and cloud-security solutions.
- Mandate third-party code audits and “right to audit” clauses for all critical vendors.
- People, training and global interoperability (ongoing)
- Massive upskilling programs for cloud operations, open-source development and secure systems engineering.
- Maintain interoperability for global trade: sovereignty does not mean isolation; rather, it means selectivity and resilience.
Strengths, roadblocks and political economy
Strengths of the sovereignty push
- Reduces single points of failure and legal/extraterritorial risk.
- Builds a domestic industrial base with long-term economic and technological benefits.
- Improves auditability and transparency for sensitive systems.
Key roadblocks
- Scale and capability gap. Hyperscalers have decades of engineering and billions in capex — matching that overnight is impossible. India needs pragmatic hybrid models rather than binary choices. (smetimes.in)
- Vendor ecosystems and applications. Migrating away from mature SaaS ecosystems (productivity suites, enterprise collaboration, identity systems) carries heavy integration and user-experience costs.
- Cost and time. Building sovereign alternatives and certifying them to enterprise-grade levels requires sustained public investment, procurement reform and patient capital.
- Global trade and diplomatic friction. An aggressive localisation push can raise trade frictions and complicate relationships with partners who supply essential technologies.
Political economy considerations
Large multinational vendors are deeply invested in India — both commercially and in terms of local engineering mills. Microsoft’s commitments, AWS’s investment pledges and Google’s retail and manufacturing moves show that hyperscalers will not exit abruptly from India; they also signal that India is central to global cloud and AI strategies. That makes engagement and negotiation realistic levers: the goal should be a balanced sovereignty strategy that reduces risk without unnecessarily decoupling productive partnerships. (reuters.com)What to watch next (short list of indicators)
- Progress metrics for MeghRaj adoption: number of departments migrated, VMs and storage capacity growth, service catalogue expansion. (360analytika.com)
- RBI and financial-sector pilots for locally hosted cloud services (these will be a bellwether for sovereign-cloud viability). (reuters.com)
- Growth of Indian cybersecurity firms and any public procurement programs that give them scale and certification. (infotechlead.com)
- Procurement clauses and policies requiring right to audit and localised code review for critical vendors.
- Legal frameworks addressing extraterritorial enforcement, continuity-of-service obligations and vendor arbitration in geopolitical crises.
Conclusion
The argument advanced by commentators and think tanks — that India should pursue digital sovereignty and reduce dependence on US-controlled digital infrastructure — is not an abstract appeal to economic nationalism. It stems from concrete, verifiable dependencies: a dominant global browser and mobile OS ecosystem, hyperscaler control of large swathes of enterprise workloads, widespread use of foreign cybersecurity and industrial-control vendors, and defence platforms that include foreign mission software. These create real operational risk and legal exposure in moments of friction. (gs.statcounter.com)At the same time, sovereignty is a long, expensive and politically complex undertaking. The pragmatic path for India is a phased blend of building sovereign capacity where risk is highest, incentivising domestic alternatives, hardening procurement and audit regimes, and maintaining healthy engagement with global technology partners. Doing so will require sustained public investment, procurement discipline, and a strategic industrial policy that incentivises scale — not slogans. The alternative is continued reliance on an external stack that delivers rapid innovation and convenience today but potential strategic brittleness tomorrow.
Source: Deccan Chronicle India Should Achieve Digital Sovereignty And Cut Dependence On US-controlled Digital Infra: GTRI
