Conference Agenda

As governments migrate essential public services to the web, concerns about digital sovereignty, infrastructure dependence, and public sector resilience have intensified. Policy discussions frequently interpret high concentration in government web infrastructure as evidence of problematic reliance on a small set of global providers. However, concentration metrics alone provide limited guidance for policymakers: similar dependency patterns can arise either from structural constraints in national provider ecosystems or from discretionary choices embedded in public sector procurement frameworks. Distinguishing these cases is essential for designing appropriate policy responses to digital dependency.

This paper examines how government procurement regimes shape national dependency patterns across three critical infrastructure layers: hosting platforms, authoritative Domain Name System (DNS) providers, and certificate authorities. Using a cross-country empirical analysis of government and commercial websites, we evaluate whether public sector consolidation mirrors the surrounding commercial ecosystem or instead reflects government-specific purchasing and governance decisions. We do so by treating each country as a shared structural block and comparing government websites to popularity-stratified commercial baselines drawn from the same national web ecosystem. Across 61 countries covering more than 82% of the world’s Internet population, the study analyzes over one million government URLs and approximately 174,000 commercial URLs. For each website, we identify dependencies in the three focal service layers using validated in-country measurement vantage points. We infer hosting providers from the organizations associated with infrastructure serving resources loaded by a webpage, identify DNS providers from the organizations operating the domain’s authoritative nameserver infrastructure, and derive certificate authorities from observed TLS certificate chains mapped to issuing organizations, such as Cloudflare, Amazon Route 53, and Let’s Encrypt, respectively. Provider concentration is then quantified using the Herfindahl Hirschman Index within each country, service layer, and website group, and bootstrap-based inference is used to assess whether government concentration differs meaningfully from commercial baselines. This design allows us to distinguish structural consolidation, where government dependency patterns are statistically indistinguishable from the surrounding market, from strategic consolidation, where public sector dependence diverges from market-wide patterns in ways consistent with procurement or governance choices.

Empirically, we find that hosting and authoritative DNS are often moderately to highly concentrated across countries, while certificate authorities are the most globally concentrated service layer overall. Yet the comparative baseline reveals that similar concentration levels can reflect very different underlying conditions. In some countries, government concentration closely tracks the commercial ecosystem, suggesting that public agencies operate within the same structural constraints that shape commercial sector deployments. In others, governments are significantly more or less concentrated than comparable commercial sites, especially in hosting, indicating that institutional choices materially narrow or reshape the provider set supporting public services. Observationally, structural and strategic regimes also differ in their downstream implications. Most notably, strategically consolidated cases tend to exhibit lower latency from domestic vantage points and more localized infrastructure, but they do not systematically improve provider redundancy. This counterintuitive pattern suggests that procurement-driven centralization can deliver performance and localization benefits without meaningfully expanding fallback options in the event of provider failure, highlighting that sovereignty and resilience do not always move together.

The paper draws on scholarship in communications policy, Internet governance, and Internet measurement. Its novelty lies in reframing concentration as a policy diagnostic problem, enabling more meaningful interpretation of similar concentration levels across different institutional settings. Existing work has shown that governments often depend on a small set of third-party infrastructure providers, but it has not cleanly distinguished dependency driven by ecosystem structure from dependency amplified by procurement design. By comparing government websites to commercial baselines within the same national ecosystem, the analysis distinguishes dependence that reflects shared market structure from dependence that is more consistent with procurement, governance, and compliance choices. This distinction is highly relevant to contemporary communications policy because the policy levers differ substantially across these cases. If concentration is primarily structural, governments may have limited short-term room to diversify without broader ecosystem development. If it is strategic, procurement and governance reform may offer a more direct path to improving localization and performance, though resilience across services and sectors may still require deliberate efforts to expand redundancy.

We conclude by outlining a policy-oriented diagnostic framework to help regulators and public sector technology authorities distinguish structural lock-in from procurement-driven centralization, and to better align cloud adoption strategies with resilience and sovereignty objectives in increasingly interdependent digital infrastructures.

Note: A systems-focused version of this work emphasizing measurement and inference methodology is currently under review at a computer networking venue.