When a State Needed an Embassy Without an Ambassador

What Survived the Dammam Fire?

On 2 September 2018, fire broke out in the Dammam branch of Saudi Arabia’s Public Prosecution. Smoke rose from the upper floors and firefighters were called. The institution then announced something more consequential than a description of the flames: no case transaction had been lost because case attachments were held in a central electronic system with automatic backups. Work resumed the next day. ¹

The crucial thing identified as surviving was not furniture or the contents of every cabinet. It was a judicial institution’s ability to reconnect an event with a file, a person with a right, and a procedure with its history. The system did not extinguish the fire. It stopped physical damage from automatically erasing institutional memory.

That small distinction opens a large strategic question. What if the danger is not a fire in one building? What if a common cause reaches the primary facility and its recovery site, power and communications fail, or the data remains intact while the keys, software, identities, and permissions needed to use it disappear?

This is not a request for more storage. It is a question of whether a state can still prove rights and perform public functions when geography itself is under strain. The distance between keeping a file and sustaining an institution resembles the distance between owning a copy of a constitution and being able to exercise constitutional government.

An Embassy Without Visas

In April 2007, Estonia faced a wave of cyberattacks that disrupted websites and services in a country that had committed early to digital government. A decade later, on 20 June 2017, Estonia and Luxembourg signed an agreement to host government data and information systems. The arrangement gave practical form to the data embassy: computing infrastructure, archives, systems, and communications protected by more than an ordinary commercial hosting contract. ^{2 3}

The agreement gave the hosting site a defined legal status. It protected the premises from search, requisition, attachment, and execution, and conditioned entry on the prior consent of Estonia’s authorized representative. Consent is presumed in a fire or other emergency only when immediate protective action is required and safety is at risk. Article 6 treated the data and systems as Estonian archives, protected official communications, allowed codes and encryption, and gave those communications priority in certain force-majeure conditions. ³

The servers did not become Estonian territory, and the Vienna Convention did not automatically confer diplomatic status on the data center. The preamble says that the Vienna framework is insufficient for this purpose; the two states therefore created protection through a bilateral agreement. International law, European Union law, and Luxembourg law continue to apply where relevant. The embassy is a carefully drafted legal condition, not a piece of land whose sovereignty moved on the map. ³

Even the day of disagreement was not left to goodwill. The agreement provides for arbitration and termination, with termination taking effect twenty-four months after notice. The assets must then be delivered to Estonia’s authorized representative. If that representative cannot be identified, the assets receive the same protection as Luxembourg’s archives and may be released only to Estonia’s legal representative. Serious states write the difficult ending before circumstances make it necessary. ³

When a Government Governed from Exile

In June 1940, Norway’s government and King Haakon VII arrived in Britain after the German invasion. A Norwegian civil, military, and governmental apparatus operated from London during the occupation, leaving thousands of meters of records. The story does not say that documents created the government’s legitimacy; that legitimacy arose from a particular constitutional, political, and historical position. It does remind us that a state’s institutional survival does not always coincide with access to its capital and customary buildings. ⁴

The twentieth-century question was how to move government, documents, and communications to safety. The twenty-first century adds a more exacting one: how can the capacity to verify a record, identity, signature, and legal authority move into an operational environment that is truly independent?

This is the difference between Disaster Recovery and Continuity of Government. A database may return after a week and the technical team may call the recovery successful. The week in which a death certificate, title deed, or benefit could not be issued does not return when a green status light appears. Technical time may be restored. Social time cannot.

The Kyiv Missile and the Copy That Did Not Die

On 1 March 2022, during the opening days of Russia’s full-scale invasion of Ukraine, a missile struck a national backup center in central Kyiv. According to an official Ukrainian account published that September, the strike did not interrupt a core state register or critical government service. ⁵

The government had temporarily allowed storage outside the country. It said that, in the first weeks of the war, thirty-six authorities moved more than sixty critical registers and systems to cloud resources provided by Amazon. This does not mean that the Ukrainian state moved in full to an American cloud, or that every service remained available in every city. It supports a narrower official claim: a physical records facility was hit, and the government said that core registers and critical services did not stop because of that strike. This is a wartime government account, not an independent availability audit of every system. ⁵

The lesson lies in the usable path, not the mere existence of a copy. A backup without recovery procedures, an operating environment, valid credentials, and working communications is closer to reassurance stored at a distance than to an operational capability.

When Proof of a Right Becomes the Second Casualty

Kashmir offers a smaller case with an immediate human consequence. A judgment issued on 13 April 2022 recorded that the September 2014 floods inundated government offices in Srinagar and that documents for an appeal dating to 1981 could not be found because of the damage to the records. The judgment was not an account of the collapse of an entire judicial archive. It was one dispute showing how a disaster can complicate the proof of a legal event decades old. ⁶

In Syria, Human Rights Watch warned in 2018 that the destruction of local property records, displacement, lost papers, and the procedures created by Law No. 10 could leave rights holders unable to establish or claim ownership. A register here is not merely a table in a database. It is shared legal memory, and a failure to verify it weakens a right when that right is contested. ⁷

Sudan presents a third form of fragility. In June 2026, Asharq Al-Awsat described severe damage to the National Records Office in Khartoum, which holds more than thirty million documents. It quoted the director as saying that most paper material had survived the fires, while the electronic archive was lost and the documents remained in a building where deterioration threatened them. Paper may survive shelling only to be lost to humidity. Digital memory may look modern until the facility carrying it fails. ⁸

In February 2024, widespread telephone and internet outages cut millions of Sudanese people off from communications and obstructed family contact, aid, and financial services. A database can remain pristine abroad while the citizen cannot reach it because communications, power, or digital identity has failed. Preserving data is necessary. It is not the same thing as continuing a service. ⁹

From Aleppo to Svalbard: Preserving a Capacity, Not a Copy

Inside a mountain in Norway’s Svalbard archipelago, the Global Seed Vault holds duplicate samples of genetic diversity deposited by gene banks. The International Center for Agricultural Research in the Dry Areas maintained a valuable crop collection in Aleppo. The Syrian war made the gene bank’s normal operation impossible.

The institution had deposited more than 116,000 duplicate samples in Svalbard between 2008 and 2014. In September 2015 it withdrew 38,073 samples and moved them to Lebanon and Morocco. After planting and multiplying them, it deposited more than 20,000 regenerated samples in two batches during 2017. The Aleppo collection was not shown to have been destroyed in full; normal operation and distribution became impossible, and earlier deposits helped establish active collections in Lebanon and Morocco. ¹⁰

Svalbard’s purpose was not to keep seed in the ice forever. It was to preserve the ability to grow it again: a movement from preservation to regeneration. That is the distance between a center that stores a ministry’s files and a system that can restore the ministry’s function. Patient data is not a health service simply because it has been copied. A tax register is not a functioning authority without its software, identities, certificates, communications, and authorized procedures.

When Markets Price the Possibility of Stoppage

Saudi Arabia is familiar with compound risk. In 2012, malware known as Shamoon affected about 30,000 Saudi Aramco workstations. In September 2019, the attacks on Abqaiq and Khurais temporarily interrupted production of about 5.7 million barrels per day, according to the company. ^{11 12}

In 2026, the Gulf entered another period of military escalation. A Reuters visual investigation published on 15 October counted at least 135 missile and drone attacks on at least 84 infrastructure sites across Gulf states since 28 February. It distinguished direct Iranian operations from attacks by Iran-aligned groups and documented damage to pumping stations along Saudi Arabia’s East–West pipeline. The count belongs to that investigation; it is not a complete official registry of every incident. ¹³

Amid attacks for which the Houthis claimed responsibility, an administrative building belonging to Aramco in Dhahran was struck on 13 October, and the Ministry of Energy reported a limited fire. The following day, the Saudi index closed 1.7 percent lower and Aramco shares fell 1.6 percent. One report cannot explain an entire market move, and a claim of responsibility is not an independent technical attribution. The market report said escalation concerns deepened alongside pressure on bank shares and other regional factors. Markets begin pricing the chance of interruption before a service has actually stopped. ¹⁴

A component failure may cascade through a system, then spread economically as systemic risk beyond the sector first hit. There is no evidence for a promise that data embassies will lift an index or prevent every decline. Preparedness can be measured more soberly: in outage duration, recovery cost, speed of service restoration, and the transmission of disruption to firms and citizens.

Five Baskets, One Hole in the Floor

The old advice seems obvious: do not put all your eggs in one basket. Modern systems have discovered that there may be five baskets and only one floor beneath them. An institution may build five centers in five cities, then make every center depend on the same identity provider, key system, management interface, and small team with enough access to stop them all.

These are not five independent systems. They are five copies of one dependency. Charles Perrow’s theory of Normal Accidents explains how complexity and tight coupling create systemic hazards. Reliability engineering uses the term Common-Mode Failure for redundant arrangements defeated by a shared cause. Diversity, rather than the raw number of copies, is the relevant response. ^{15 16}

Risk must therefore be spread, as far as practical, across geographies, legal jurisdictions, power sources, communications networks, technology suppliers, and control mechanisms. Two centers can sit on different continents and still answer to one management console. Every copy can be healthy and still unreadable because one key is missing. Redundancy increases the number of copies; independence reduces the chance that they die from the same cause.

A Picture That No Single Piece Owns

A Saudi design could go further than placing a complete, readable copy at every site. It must first separate techniques that appear together in sales decks but perform different jobs. Authenticated Encryption protects confidentiality and detects tampering. Erasure Coding distributes encrypted content so that a sufficient number of fragments can reconstruct the original. Threshold Cryptography distributes control over keys or cryptographic operations so that no single person or site can decrypt or sign alone.

In 1979, Adi Shamir introduced Shamir’s Secret Sharing. A mathematical secret can be divided into shares so that a group reaching the threshold recovers it, while a smaller group reveals no information about it under the correct mathematical model. A three-of-five example is useful: two shares may be lost, and two alone are insufficient. It is not a ready-made Saudi specification. It still requires correct finite-field implementation, protection against theft and substitution of shares, and administrative and operational independence among custodians. ¹⁷

Splitting a key is not the same as splitting content, and encryption does not stop a host from deleting or disabling a copy. More advanced systems may use Multi-Party Computation and Threshold Signatures to perform distributed operations without assembling a complete key each time. Such systems still need audited protocols, Hardware Security Modules (HSMs), share rotation, access controls, and a tested way to replace a custodian.

The goal is for a site to hold something that gives it no unilateral authority over the information, and for the site to be lost without killing the system. The design lies in the rules of recombination and authorization, not in the number of boxes. Recovery keys should not become the hostage of one host state, cloud company, or administrator account.

A Ledger That Never Forgets, Even When It Remembers the Error

Distributed-ledger techniques may help establish the Integrity of records and the order of changes. They do not replace encryption, key distribution, or service continuity. There is also no good reason to place sensitive personal data in a permanent ledger merely because the word blockchain has had an unusually successful publicist.

Guardtime describes its Keyless Signature Infrastructure (KSI) as supporting verification of signing time, data integrity, sequence, and the fingerprint of an input. Cryptographic Hashes, Merkle Trees, and a Tamper-Evident Log can provide evidence that a copy has remained intact since it was recorded. That describes the evidentiary scope of the technology, and the source is its provider. It does not independently establish the truth of the original event. ¹⁸

If an owner’s name enters the record incorrectly and remains unchanged for fifty years, the system has preserved the mistake beautifully. Input correctness, data integrity, and the authority that approved a change must remain separate questions. They belong to distinct technical, legal, and administrative processes. The right answer may be a tightly controlled audit record with independent proofs and clear signature chains, rather than a public network or a famous product searching for a problem.

Who May Order the Pieces Reassembled?

One problem remains outside mathematics: who has the right to order recovery? Key custodians may receive conflicting requests from bodies that each claim lawful authority. The data may be intact, the keys protected, and the servers ready, while the decisive risk lies in the identity of the person who orders the system to operate.

This is Constitutional Authority, not a cryptographic property. The ability to decrypt does not confer legitimacy, and a foreign host is not the court that should decide who represents the state. The design must separate possession of shares, legal authority, executive authorization, and independent verification. It must define emergencies, objections, succession, and a durable decision record.

Distributing the state’s keys does not distribute its sovereignty among companies and capitals. Sovereignty remains with its lawful holder; the means of preserving it and auditing their use are distributed. This is why the Estonian agreement’s provisions on representation, delivery, and termination belong to the continuity architecture rather than to diplomatic footnotes. ³

Outside the Kingdom Is Not Outside the Law

Any Saudi proposal must begin with the classification of the data and the purpose of processing, not with a preferred host country. The Implementing Regulations for Personal Data Transfer outside the Kingdom treat transfer as conditional. It must not prejudice national security, vital interests, or another law; it must meet necessity, protection, and data-subject rights requirements. The rules also address adequacy, appropriate safeguards, defined derogations, and risk assessment for certain sensitive, continuous, or large-scale transfers. ¹⁹

The regulations recognize an international agreement as a possible route within the competent authority’s procedures after protection has been assessed. They do not create a self-executing permission to transfer. The Cloud Cybersecurity Controls likewise establish a minimum security baseline within their scope. They are not a general license to send every category of government data abroad, and they do not displace data-protection law, classification rules, or sector requirements. ^{19 20}

The analysis may conclude that some functions must remain wholly within the Kingdom, that a small class can be kept abroad under special legal protection, and that some cases warrant distributing keys without distributing content. Not every piece of information belongs in a data embassy. An encrypted copy does not become lawful merely because its operator cannot read it. The law and engineering of each category determine the path.

What Is the Minimum That Must Stay Alive?

Records do not have equal relationships to the continuity of a state. Historical archives may wait for restoration. Daily services may tolerate a pause of several hours. Other functions quickly become crises of rights, health, or security when they fail. Priority should therefore begin with the effect of losing a function, not the size of its database or the prominence of its institution.

For a land register, the sovereign minimum might be the ability to verify the last approved state and issue temporary proof, rather than to reopen every form of amendment. For a health system, it may be controlled access to information that saves life, with every use logged, rather than full operation of the platform. In government payments, releasing defined benefits may matter more than restoring every accounting path at once. Defining this minimum turns continuity from an absolute slogan into a testable obligation.

A cold archive also differs from a system that receives transactions every minute. The archive emphasizes durable evidence and long-term readability. The active system needs consistency among copies, transaction ordering, and a way to resolve conflict when connectivity returns. Treating both alike may over-engineer the archive or accept loss that the live system cannot bear.

Reducing functionality cannot mean discarding safeguards that prevent injustice. Emergency operation that bypasses identity checks or drops the audit record may return a service at the expense of a right. What is needed is a Controlled Degraded Mode: fewer functions, clear permissions, time limits, and later review, rather than a permanent emergency door cut around the rules.

Three questions help order functions: what harm begins immediately when this service stops; what cannot be repaired after it returns; and what is the smallest trustworthy output that preserves a right or stops the crisis from spreading? The answers determine what belongs in a data embassy, what requires an alternate operating environment, and what can rely on an independent domestic copy.

Where Data Resides Is Not the Whole of Data Sovereignty

The debate is often reduced to one question: where is the server? Location matters, but it is not enough. Data may sit inside national borders while a foreign company administers its keys through an interface the public authority does not control. An encrypted copy may sit abroad while keys, authorization, and the audit record remain under distributed national control. Location is one element of operational sovereignty, not its full definition.

Control is divided among those who can read, alter, delete, stop service, change software, and possess audit evidence. If all of those powers collect in one administrator account, the map has not removed the risk. If they are separated so rigidly that no workable emergency path remains, protection has turned into self-imposed paralysis.

Each asset therefore needs a register of authority as well as a register of location: the country where it sits, the law that applies, the operators with access, the location of keys, the update path, shared dependencies, and the exit procedure. Two distant sites can then be compared honestly. One may add real diversity; the other may repeat the same supplier, legal exposure, and communications network.

Independence must be tested in operation. A faulty update from a central management platform can take down sites in several countries at once. The loss of an overlooked naming, certificate, or identity service can turn healthy servers into silent islands. Measurable sovereignty is the capacity to continue after losing some of these services, not simply the ownership of a contract or a machine.

What Do We Pay For Before the Disaster?

Storage looks cheap because its price appears on a legible invoice. The cost of continuity is scattered across training, exercises, software maintenance, key rotation, alternate communications, contracts, and people able to work under pressure. It is easy to buy many copies and postpone the part that makes them useful.

A serious economic comparison does not place the cost of an external site against zero. It places that cost against downtime, lost transactions, manual reconstruction, legal disputes, and dependence on a supplier that cannot be left. These figures must be estimated function by function. There is no national multiplier that makes every foreign-hosting arrangement a profitable investment.

Complexity also has a price. Every host, key custodian, communications channel, and agreement adds a capability and a new surface for failure or miscoordination. The best architecture is not the one with the most layers. It is the least complex option that reaches the required level of continuity while making residual risk explicit and acceptable.

Some benefits are indirect. Restoring a license, identity, or payment quickly may stop a company or hospital from failing and prevent the shock from reaching parties untouched by the original incident. That is a hypothesis to measure against a baseline and realistic exercises, not a marketing promise to book as a guaranteed return.

A Saudi Architecture for Sovereign Continuity

The useful response is neither to copy Estonia nor to give a cloud project a diplomatic name. Saudi Arabia needs an architecture for Sovereign Continuity: a system that preserves the state’s capacity to perform selected functions and verify their outputs under multi-site disruption, while legal decisions and cryptographic control remain in national hands.

The architecture begins with a map of functions and dependencies. Which register does a function need? Which software interprets it? Which identity service admits the user? Which certificates validate a signature? Who holds authority? What communications, energy, staff, and procedures are required? Data may be present at three sites while one verification service remains in one building. In that case, replication has delivered a handsome diagram rather than continuity.

Preservation, alternate operation, keys, identity, signing, and monitoring should then be separated. Host agreements must specify audit and exit rights and the return of assets, with a credible ability to change suppliers. Alternate communications and limited operation during outages also matter; Sudan shows that a distant record does not help a citizen who cannot reach it.

The aim is not the largest Data Lake outside the country. It is the smallest complete set of components that keeps a selected sovereign function usable. A copy costs storage. Continuity costs training, testing, contracting, maintenance, and the renewal of keys and software. Decision makers need to see those costs separately.

The architecture needs a memory of its own. If only two engineers know how it works, or if its procedures sit in documents that no one updates, the project has become its own single point of failure. Cross-training, decision records, handover exercises, and participation by owners of the public function are as much a part of the system as the servers. Continuity that cannot survive staff turnover has made too ambitious a claim for itself.

The Day We Should Assume Two Sites Are Gone

Success is not the recovery of a file in a quiet laboratory. A useful exercise assumes that the primary center is lost, an international link fails, one key share is unavailable, and tampering appears in a backup at the same time. It asks which function returns first, who authorizes it, whether staff identities work when their provider is down, whether a citizen can verify a document, and which recent transactions failed to reach the recovery site.

The Recovery Time Objective (RTO) is the maximum time a system resource may remain unavailable before its effect becomes unacceptable. The Recovery Point Objective (RPO) identifies the point in time to which recovery must return, and therefore the amount of data loss the mission can tolerate relative to the latest copy. A historical archive may accept hours. A health or financial function may tolerate neither the same time nor the same loss. ²¹

Synchronous replication can spread an error very efficiently. If an authorized user deletes a record, or an attacker acquires permission to alter it, the result may reach every site before anyone notices. Recovery therefore needs independent historical copies, Immutable Backups, and integrity checks before service resumes.

An exercise is not a ribbon-cutting ceremony held once. Every change to identity, encryption, integration, or a contract changes the recovery conditions. Resilience is a repeating cycle of exercise, bounded failure, diagnosis, repair, and another exercise. Otherwise it is only an adjective an institution awards itself on the About page.

When the File Remains Intact and the Truth Decays

Artificial intelligence and task-executing software make origins more important. Lower costs for producing content and code may also lower the cost of falsifying records, impersonating identities, poisoning data, and manipulating audits. An adversary need not delete a title deed. A small alteration can enter the record and let every backup distribute it as though it were legitimate.

This is the role of Provenance: knowing where data came from, how it changed, who touched it, and under what authority. Protected memory is not memory that no one can touch. It is memory whose transformations can be explained and reversed to a known-good state when a defect is discovered.

Cryptography also ages. In August 2024, the US National Institute of Standards and Technology approved Federal Information Processing Standards (FIPS) 203, 204, and 205, designed to resist future attacks by quantum computers. This does not mean that all present cryptography has failed. It does make Cryptographic Agility a reasonable requirement for an archive intended to live for decades: an inventory of algorithms and keys, a migration plan, and the ability to re-protect material without losing confidence in the record. ²²

Before Choosing the First Capital

The work begins with a question framed by the competent authorities: which functions must the state still operate and verify if domestic sites and international routes fail? A dependency map follows from that question. A server shopping list does not.

A limited pilot should then use no real personal or security data in its early stages. It should test content encryption, distribution of key shares, recovery of an integrated system from independent sites, the authority of the party requesting recovery, and the ability to change supplier and host. Time, cost, and common dependencies should be measured rather than assumed.

In parallel, diplomatic, digital, cybersecurity, and regulatory bodies can study an international agreement that borrows the legal ambition of Estonia’s model without copying its European details. The study may find that only narrow classes deserve protected foreign hosting, and that Saudi Arabia could later host reciprocal arrangements if the public interest and controls justify it. The right beginning is to identify the right that must not vanish when the lights go out.

The host country comes later and should be evaluated across several dimensions: stability of law, judicial independence, strength of communications and energy, distance from shared hazards, practical capacity to enforce the agreement, and the host’s relationship to suppliers and supply chains. Political closeness on the day of signature matters. It cannot replace clauses designed to work when governments, markets, and alliances change.

The project must also possess its last day from its first. When does alternate operation end? How are assets returned? How are copies no longer required destroyed? Who proves that deletion occurred, and who retains the audit record? Without an exit plan, the continuity arrangement becomes another dependency that is difficult to leave, turning temporary safety into a long-term constraint.

What Remains When the Building Goes Dark?

I return to Dammam because it brings the argument close to the person whose right is at stake. A party to a case did not need to know the database type or the server vendor. What mattered was that the attachments did not disappear with the smoke, and that the right did not have to begin again because its building had suffered a failure in the physical world.

Kyiv made the question harsher. In Kashmir a flood became an absent party in an old dispute. In Syria the ownership of homes became entangled with the fate of papers. Sudan exposed the fragility of memory and communications together. Aleppo and Svalbard taught a different lesson: the most valuable copy is the one from which the thing preserved can live again.

None of these cases says that foreign territory is always safe, that encryption abolishes geography, or that legal inviolability stops a missile. They say that continuity grows stronger when its parts do not share one place, decision, and cause of failure. Saudi Arabia must protect domestic capabilities. It should also examine how the conditions for sovereign functions to survive can be distributed away from common points of failure while remaining under national legal authority and distributed cryptographic control.

The mature question is not which country should receive the first Saudi data embassy. It is how many facilities, routes, and key custodians can be lost before the state can no longer prove a right or operate an essential service. A state confident in its future does not assume that its buildings will never burn. It refuses to let the fire write the final record.