NATO’s data war: Built to connect, built to be cut

Human-Machine Teaming experiment

NATO has spent the past three years building something it can’t point to on a map: a shared digital nervous system meant to let 32 militaries, with wildly different levels of technological maturity, fight as one force. Allied Command Transformation (ACT), headquartered in Norfolk, Virginia, is responsible for making that happen, and it has quietly become one of the Alliance’s most consequential institutions.

Connecting the dots, literally

ACT’s mandate comes down to one concrete task: turn useful technology into interoperable capability before an operational need makes the gap fatal. NATO’s Digital Transformation Implementation Strategy, approved by defense ministers in June 2023, breaks the Alliance’s digital overhaul into 54 separate workstreams — from cloud infrastructure to data governance to AI adoption — and ACT leads or supports two-thirds of them. By 2030, that effort is meant to have positioned the Alliance to conduct genuine multi-domain operations.

In practice, ACT operates as a connective institution rather than a builder of individual weapons systems. It works with member states, other NATO commands, industry, and academia to test emerging technology and validate what actually works under real operational conditions. The goal is to shape common standards early, before capabilities get locked into incompatible national systems. ACT runs roughly 20 formal experiments a year through wargaming, modelling, and simulation. It also sponsors “Beacon Projects” that show what data-enabled decision-making looks like in practice. Two 2026 flagship examples: SINBAD, which uses commercial satellite monitoring to track change across areas of interest, and MAINSAIL, which fuses maritime data from multiple sources to flag threats to undersea infrastructure.

Allied Command Transformation headquarters in Norfolk, Virginia

Allied Command Transformation headquarters in Norfolk, Virginia

Still under construction

The centerpiece of ACT’s effort is what NATO calls the Digital Backbone — a secure, scalable cloud environment meant to underpin everything else. Around it sit six foundational elements: synthetic environments for situational awareness, orchestration of operational effects, embedded risk management, faster adoption of new capabilities, data aggregation, and stronger data protection. The most concrete piece of that aggregation effort is the Alliance Data Sharing Ecosystem (ADSE) — a set of federated “data lakes” spanning logistics, command and control, intelligence, space, and finance, designed to make NATO data findable and usable across the Alliance rather than trapped in national silos. Initial pilots with classified data began in late 2025; full development, including industry and academic partners, isn’t expected until 2028.

That timeline matters, because it tells you where NATO actually is: past the concept stage, into early implementation, but years from a finished system. A 2026 assessment from The Hague Centre for Strategic Studies put it plainly — interoperability “must be treated as a strategic imperative, not an afterthought,” which is another way of saying it currently isn’t always treated that way.

Where interoperability gets proven

NATO doesn’t take interoperability on faith — it stress-tests it, repeatedly, through a small set of recurring events that function as the Alliance’s de facto quality-control system. The largest is the Coalition Warrior Interoperability Exercise (CWIX), held annually at the Joint Force Training Centre in Bydgoszcz, Poland, and led by ACT. CWIX 2026 drew more than 4,000 participants from 46 Allied and partner nations — engineers, operators, and capability specialists working side by side for three weeks to stress-test hundreds of command-and-control systems and IT services across 18 focus areas, from battlefield communications to medical logistics. The exercise has grown steadily: from roughly 2,500 participants in 2024 to over 4,000 two years later, alongside similar growth in the number of systems tested.

CWIX sits inside what ACT calls the Interoperability Continuum, alongside the TIDE Sprint and TIDE Hackathon — smaller, more experimental events focused on emerging concepts rather than fielded systems — and the newer Digital Interoperability Validation Events (DIVE), which let individual nations test specific capabilities, such as data-centric security measures, against NATO standards outside the annual CWIX cycle. The U.S. Joint Staff’s J6 directorate, for instance, has used DIVE specifically to develop and test data security measures with multiple partners in parallel with its CWIX participation. The logic behind all of these events is the same: interoperability isn’t something you declare in a policy document, it’s something you test, break, and fix, repeatedly, under conditions that approximate a real coalition operation.

Polish soldier during CWIX in Bydgoszcz, June 17, 2024.

Polish soldier during CWIX in Bydgoszcz, June 17, 2024.

Thirty-two speeds, one Alliance

Despite that machinery, NATO’s own reporting and independent assessments converge on the same underlying problem: digital maturity varies enormously across the Alliance, and that gap is the main obstacle to everything ACT is trying to build. Nations face different legacy-system burdens, different cybersecurity postures, different appetites for risk, and different comfort levels with data sovereignty — and those differences don’t disappear because a strategy document says they should. ACT’s own National Digital Transformation Champions Network, created specifically to keep national efforts aligned with NATO’s collective push, worked virtually for its first year before members met face-to-face for the first time in June 2026. The network expects to ratify a shared set of priorities this September, followed by six months of tracking progress against them.

Outside assessments are blunter. RAND Europe has flagged fragmented funding and a shortage of “suitably qualified experienced personnel” as structural constraints on NATO’s digital capability development, guided as it is by the Alliance’s traditional, consensus-heavy Defence Planning Process. A 2025 analysis from the Center for European Policy Analysis described a persistent “say/do gap” — NATO’s 2022 Digital Transformation Strategy already contains most of the right ideas, the paper argued, but implementation lags badly behind the ambition, held back by a shortage of skilled personnel and procurement processes that simply aren’t agile enough for software timelines. NATO’s own Supreme Allied Commander Transformation, Admiral Pierre Vandier, has said as much publicly, telling Politico the Alliance needs to “take more risks, spend more, be faster, and cut bureaucracy,” warning that procedural compliance is too often prioritized over actual operational effectiveness.

The unevenness cuts across Europe as well as between Europe and Washington: cloud computing adoption, one of the more basic building blocks of the Digital Backbone, remains inconsistent across European militaries, and researchers have warned that parallel European programs — the Future Combat Air System and the Global Combat Air Programme among them — risk building their own stovepiped digital architectures unless they’re deliberately aligned with NATO’s wider framework rather than developed in isolation.

The other side’s plan

NATO isn’t building this system in a vacuum. Digital connectivity is precisely the advantage rivals have concluded they cannot match head-on — so both Russia and China have built doctrines aimed not at outcompeting it, but at cutting it, jamming it, or getting inside it before a shot is ever fired.

Russia’s approach is physical and deliberately deniable. Its GUGI undersea warfare directorate — the same unit NATO forces intercepted training near Svalbard on September 10, 2026, as it rehearsed deploying technology designed to disable subsea cables without a trace — has made critical undersea infrastructure a standing target. The cables at risk near Svalbard specifically carry satellite data from the world’s largest ground station; more broadly, more than 20 undersea cables in the Baltic and Arctic have been damaged since 2024, many linked to Russia’s “shadow fleet” of vessels with obscured ownership and disabled transponders. Alongside cable sabotage, GPS jamming has become a near-daily occurrence across Finland, Estonia, and Latvia, degrading the same positioning and timing data that feeds situational awareness into systems like ACT’s own SINBAD and MAINSAIL projects. NATO has already had to stand up dedicated responses — the Baltic Sentry mission launched in January 2025 — precisely because these operations are calibrated to stay below the threshold that would trigger a collective response under Article 5, while still degrading the physical and electromagnetic layer every digital capability ultimately depends on.

China’s approach targets the same dependency from a different angle: not the cables and receivers in Europe, but the networks and satellites that make American power projection into any future crisis possible in the first place. The Volt Typhoon campaign, active since at least 2021 and still not fully evicted from U.S. systems as of 2026 according to threat-intelligence assessments, has pre-positioned inside American power, water, telecommunications, and transportation networks — with Guam, a critical U.S. military hub in the Pacific, singled out as a specific target. U.S. officials describe the goal not as espionage but as battlespace preparation: maintaining quiet access that can be triggered to disrupt real-world services at the moment of a crisis, most plausibly a conflict over Taiwan. In parallel, China has built a counterspace posture combining jammers, cyberattacks, directed-energy dazzling, and attacks on satellite data links with hard-kill anti-satellite weapons — a posture U.S. analysts assess is explicitly designed to sever America’s space-based intelligence, surveillance, and reconnaissance backbone within the opening 24 hours of a Taiwan campaign, before conventional fighting even starts.

The two strategies converge on the same insight. NATO’s entire multi-domain vision assumes persistent, trusted, high-bandwidth connectivity between commanders, sensors, and forces. Cutting a cable, jamming a signal, blinding a satellite, or sitting dormant inside a power grid doesn’t require matching NATO’s technology — it only requires reaching the physical infrastructure that every digital system depends on to function at all. That is precisely why ACT and outside analysts alike increasingly treat resilience, not just capability, as the actual measure of whether the Digital Backbone will hold up when it’s tested for real.

Why it matters

 The payoff NATO is chasing is specific: a commander who can see what’s happening across a multinational force in real time, trust the data feeding that picture, and coordinate action across land, air, sea, cyber, and space without waiting on incompatible national systems to be reconciled in the field. That’s the practical meaning behind the abstract phrase “multi-domain operations” — not a new doctrine so much as the ability to actually execute the doctrines NATO already has, at the speed modern warfare requires. Officials frame the stakes in stark terms: the character of warfare is shifting fast, autonomous systems, AI, commercial space services, and cheap scalable capability are already reshaping how military advantage is won, and NATO’s constraint isn’t a shortage of promising technology — it’s the Alliance’s ability to turn that technology into interoperable capability before an adversary forces the issue.

Whether NATO gets there on its own 2030 timeline is genuinely an open question, and not only because of internal coordination gaps. The institutional machinery — CWIX, DIVE, the Champions Network, the Beacon Projects — is real, growing, and increasingly well-funded. But nearly every independent review of the effort reaches the same conclusion Vandier himself has stated publicly: the Alliance knows what it needs to build, and has largely known for years. What remains uncertain is whether 32 nations, moving at 32 different speeds, can close that internal gap and build in the resilience such a system requires — before an adversary decides to test it for real.