The internet is "Too Big to Fail" - part two: who owns everything that makes the web work — A Fondo con Kilowatto

The owners of the cables nobody sees

In my draft, I wrote that 95% of international traffic travels through 436 underwater cables spanning 1.3 million kilometers. Of those three figures, two didn't survive fact-checking, and the third I couldn't back up with any primary source. TeleGeography tracks más de 600 cables activos y planeados today, not 436; the CSIS calculates the physical route at aproximadamente 1.2 millones de kilómetros, not 1.3. And the famous 95% I left out of the main text because I couldn't find a primary source. What I did find, and I think is more compelling than any rounded percentage, is the data the FCC uses to size up the alternative: satellites account for 0.37% de la capacidad internacional de Estados Unidos. Zero point three seven. When someone tells you that if a cable is cut, "there are always satellites," show them that number.

Regarding ownership, my draft said that Google, Meta, Microsoft, and Amazon went from less than 10% of submarine infrastructure in 2012 to almost half today. The second half held up: the CSIS states that those four poseen o arriendan alrededor de la mitad de todo el ancho de banda submarino del mundo. The first part I couldn't back up, and I replaced it with documented data: between 2012 and 2016, those four companies multiplicaron por catorce su capacidad internacional hasta 170 Tbps, mientras todos los demás operadores del planeta juntos apenas la triplicaron hasta 273 Tbps. The live list of ownership shows 36 sistemas de Google, 21 de Meta, 10 de Microsoft y 8 de Amazon today — in yellow on purpose, as it's a self-updating page and Meta is already at 22 — and TeleGeography summarizes the decade: de 20 cables en 2017 a más de 60.

Submarine capacity 2012-2016 in Tbps [23] · The same four companies own or lease nearly half of the world's submarine bandwidth today [24] · Their list went from 20 cables in 2017 to over 60 [21]

Four companies increased their cable capacity 14-fold; the rest of the world, three-fold
Year	Google, Meta, Microsoft, and Amazon	All other operators
2012	12	91
2016	170	273

Now, the correction that was hardest for me to swallow, because it was mine and it was categorical. I wrote: "there is no binding international treaty to protect submarine cables." That's false. There is one, and it's 142 years old. The Convention for the Protection of Submarine Telegraph Cables was signed in Paris on 14 de marzo de 1884, entró en vigor en 1888 y sigue vigente para 36 Estados parte. Articles 113 to 115 of the CONVEMAR, the modern framework, están basados literalmente en tres disposiciones de aquel convenio de 1884. The problem isn't the lack of a treaty; it's worse: the treaty exists, but it was designed not to work. Article 113 only obliges a state to criminalize damage caused by ships flying its flag or people under its jurisdiction, no prohíbe explícitamente que los Estados dañen cables deliberadamente ni establece responsabilidad estatal si lo hacen.

There's a historical detail that left me cold: during the 1884 negotiations, Estados Unidos propuso equiparar los crímenes contra cables con la piratería y dar jurisdicción universal a todos los Estados. La mayoría lo rechazó. Worse: that convention did allow for boarding ships suspected of breaking a cable, and la CONVEMAR no heredó esa disposición. Today, there's no grounds for boarding a ship suspected of damaging a cable, and a warship that deliberately damages one enjoys sovereign immunity. Robert Beckman says so bluntly, cited by Alexander Lott on the Lieber Institute blog: "ni el Convenio de Cables de 1884 ni la CONVEMAR abordan adecuadamente el daño intencional".

This isn't theory. On Christmas Day 2024, the ship Eagle S dragged its anchor for about 90 kilometers and damaged five submarine cables, including the EstLink 2 power link between Finland and Estonia. In October 2025, the Helsinki District Court desestimó el caso contra el capitán y dos oficiales por falta de jurisdicción: the incident occurred within Finland's exclusive economic zone but outside its territorial waters, so the matter belonged to Georgia or India — the countries of origin of the crew — or the Cook Islands, the flag state. The reasoning was that the damage constituted a "incidente de navegación" bajo el artículo 97(1) de la CONVEMAR, cuya redacción no permite excluir los delitos intencionales. Critical infrastructure of a NATO country was damaged, and there was no competent court.

My draft became outdated in the worst way: I wrote that Western intelligence had concluded that everything was due to accidents caused by inexperienced crews, and I considered the issue closed. It's not closed. On August 27, 2026 —just two days ago— el Tribunal de Apelación revocó la desestimación y ordenó reabrir el caso, with the argument that the incident falls outside the definition of a maritime accident under CONVEMAR, and therefore Finnish authority still applies. The decision can still go to the Supreme Court. And in the parallel case of the bulk carrier Yi Peng 3, which damaged the C-Lion1 and the Sweden-Lithuania link in November 2024, the Swedish Accident Investigation Authority concluded in April 2025 that "no puede determinarse con certeza si un buque chino dañó intencionalmente los cables". Neither exoneration nor condemnation: indecision. In the Baltic, cuatro incidentes con ocho daños distintos, más cinco incidentes con cinco daños alrededor de Taiwán, entre 2024 y 2025 were recorded —not the "ten cables" I had mentioned—.

The Red Sea was also left incomplete in my draft. I talked about four cables cut in February 2024. There were three —AAE-1, EIG, and SEACOM— and the most accepted explanation is the Rubymar: fue alcanzado por un misil hutí el 18 de febrero de 2024, quedó a la deriva arrastrando el ancla, cortó los tres sistemas el 24 de febrero y se hundió el 2 de marzo. What I didn't mention is what really matters: the repair of global internet infrastructure ended up depending on a permit issued by an authority that almost no one recognizes. The government of Sana'a announced the end of the work on July 23, 2024, stating that "el Gobierno de Yemen ha provisto las facilidades y permisos necesarios de la Autoridad General de Asuntos Marítimos en Saná" and that "Yemeni waters are completely safe". And it happened again: on September 6, 2025, SMW4 and IMEWE were cut near Jeddah, and the Azure status page admitted "mayor latencia en parte del tráfico que antes atravesaba Medio Oriente".

Paris Convention of 1884, in effect for around 36 states [41] · Rubymar and the cuts to AAE-1, EIG, and SEACOM [33] · Announcement by the Sana'a government on repair permits [32] · Yi Peng 3, C-Lion1, and the Sweden-Lithuania link, and report by the Swedish SHK [31] · Eagle S, EstLink 2, and the process in Helsinki [30] · Cuts to SMW4 and IMEWE near Jeddah [34]

142 years of treaty and no competent court
Año	Hecho
1884	March 14: the Paris Convention for the protection of submarine cables is signed, still in effect today for around 36 states.
2024	February 18: a Houthi missile hits the Rubymar; on February 24, the ship cuts the AAE-1, EIG, and SEACOM cables.
2024	July 23: the Sana'a government announces that cable repairs will only proceed with their own permits.
2024	November: the Yi Peng 3 drags its anchor 180 nautical miles over C-Lion1 and the Sweden-Lithuania link.
2024	December 25: the Eagle S damages five cables, including EstLink 2.
2025	April 15: the Swedish SHK concludes that intent cannot be determined.
2025	September 6: SMW4 and IMEWE are cut near Jeddah; Azure admits to increased latency.
2025	October: Helsinki dismisses the case due to lack of jurisdiction.
2026	August 27: the Court of Appeal reopens the case.

What supports all this is a tiny fleet. There are aproximadamente 80 buques en el mundo dedicados a mantener y expandir cables submarinos, and the public register of the International Cable Protection Committee lists unos 63, advirtiendo que la compilación es "solo con fines ilustrativos". Five operators concentrate more than half of this fleet, the average repair time in 2023 was 40 days, in Asia-Pacific it takes 30 days from notification compared to 15 in North America, and in the Red Sea, the paperwork alone puede tomar hasta ocho semanas. Against this, there are the unos 200 fallos al año, dos tercios de ellos causados por pesqueros y anclas. Figure 1 shows this distribution of the fleet, which is the real bottleneck of the entire physical layer.

Breakdown of the global fleet of cable ships [35] · Public registry of the ICPC, which only documents around 63 ships [36] · Repair times: 40 days on average globally, 30 in Asia-Pacific, 15 in North America, and up to 8 weeks just for permits in the Red Sea [35] · Around 200 failures per year, two-thirds caused by anchors and fishing gear [22]

Who fixes the world's cables
Concepto	Valor (%)
Global Marine	13%
Orange Marine	13%
SubCom	11.6%
ASN (Alcatel Submarine Networks)	10%
Optic Marine	10%

And the fleet is aging: a sectoral study estimates that harán falta unos 3,000 millones de dólares hasta 2040 para reemplazar 15 buques, porque el 64% de la flota cruzará el umbral de 40 años de vida útil antes de esa fecha, while annual repairs would increase by 36% to 287. The manufacturer is also a club: in 2021, SubCom, ASN, and NEC had 87% del mercado de manufactura, con HMN Technologies sumando otro 11%; another estimate puts those four at cerca del 98%. Europe finally reacted: un Plan de Acción de Seguridad de Cables en febrero de 2025, a evaluación coordinada de riesgos con siete escenarios y 10 millones de euros para Regional Cable Hubs, and 347 millones de euros entre equipamiento de reparación, monitoreo submarino y 13 "Cable Projects of European Interest". It's the first serious response I've seen. It's also late and regional, and the problem is global.

The sky also has an owner (and now trades on Nasdaq)

When I wrote the draft, the stellar data in this section was an index called SAMCI: Starlink operated 9,600 of 10,622 LEO internet satellites, for a "concentration of 90.4 out of 100". I cited it in good faith. Afterward, I went to verify it and ended up doing an autopsy. I start with that because it seems like the most useful lesson from this entire investigation.

SAMCI is literally defined as "satélites totales de Starlink dividido entre la suma de todos los satélites conocidos de constelaciones activas de internet LEO, por 100", with three inputs: Starlink 9,600 as of March 31, 2026, OneWeb 647 as of December 31, 2025, and Amazon Leo "375+" in July 2026. Three different cut-off dates within the same mathematical reason, and an open figure —"375+"— used as an exact number in the denominator. Additionally, the index excluye explícitamente a las constelaciones chinas Qianfan y Guowang porque "los conteos de fuente primaria no eran verificables". It's not true that they weren't verifiable: SpaceNews reported in April 2026 that Qianfan tenía 126 satélites en órbita y Guowang 168 en fase operativa.

The final part is what bothers me the most. The index justifies its threshold like this: "para contexto, los reguladores de telecomunicaciones de EE.UU. consideran altamente concentrados los mercados con una cuota de una sola firma superior al 70%". It comes without a citation, and it doesn't correspond to the standard of the DOJ and the FTC: the Merger Guidelines of 2023 bajaron el umbral de "altamente concentrado" de un HHI de 2,500 a 1,800 y añadieron una presunción estructural desde una cuota combinada superior al 30%. No 70%. And there's a category error on top: both presumptions are for merger control and require an increase in HHI of more than 100 points, so they're not even a static concentration test. Whoever drafted SAMCI not only invented the figure: they confused the tool. That data is left out of the body of the piece.

Who's publishing this stuff? A company that advertises itself as "la casa de investigación tecnológica que entrega los datos", sin un solo investigador con credenciales verificables y con una LLC estadounidense en el pie que también vende consultoría y seguridad ofensiva. And the pattern is systematic: every report features an index with a trademark symbol. In addition to SAMCI and SSEI, the same site also publishes a "Defense AI Anchoring Score" y un "Industrial Depth Ratio". It's a factory for quotable metrics. I cited it. I'm saying this so it doesn't happen again.

Now for the uncomfortable part: the index is methodologically flawed, but the concentration it's trying to measure is real and documented with credible sources. There are three legitimate denominators, and each gives a different number - which is exactly the point. Jonathan McDowell, who runs the most respected independent catalog in the field, reported as of August 13, 2026, 10,742 Starlinks activos sobre 16,278 payloads activos en órbita: 66% of all flying objects. SpaceX itself, in a filing with the SEC, declared that as of March 31, 2026, it had "aproximadamente 9,600 satélites Starlink en órbita baja, que representaban aproximadamente el 75% de todos los satélites maniobrables activos" - and that this universe pasó de menos de 1,000 en 2015 a unos 12,700 en 2026. As of August 27, 2026, McDowell counted 12,881 Starlinks lanzados y 11,087 funcionando, and CelesTrak's box score adds a geopolitical dimension: de 19,965 payloads en órbita, 13,665 son estadounidenses. Graphic 2 puts the three denominators side by side, with their cutoff dates and sources.

McDowell catalog [163] · SpaceX S-1 form [166][167] · SAMCI index and its inputs [182][185][181] · CelesTrak, payload nationality [165]

Numerator	Denominator	Cutoff date	Source	Result
10,742	16,278 active payloads	August 13, 2026	McDowell	66%
~9,600	~12,700 maneuverable active satellites	March 31, 2026	SpaceX S-1	~75%
9,600	10,622	Mix of three dates	SAMCI index	90.4 — DISCARDED
13,665 (context)	19,965 payloads	—	CelesTrak	US payloads as a percentage of the total

Three denominators, three concentration figures for Starlink
Numerator	Denominator	Cutoff date	Source	Result
10,742	16,278 active payloads	August 13, 2026	McDowell	66%
~9,600	~12,700 maneuverable active satellites	March 31, 2026	SpaceX S-1	~75%
9,600	10,622	Mix of three dates	SAMCI index	90.4 — DISCARDED
13,665 (context)	19,965 payloads	—	CelesTrak	US payloads as a percentage of the total

And here's what my draft didn't suspect: SpaceX is a public company. It filed its S-1 on May 20, 2026, and has already reported its first quarter as a listed company. That changes the nature of the available evidence, because now there are audited figures and risk factors written by lawyers. In my draft, I said Starlink generated "2.7 billion dollars in 2024". The financial statement says otherwise: the Connectivity segment generated 11,387 millones de dólares en 2025, 7,599 millones en 2024 y 3,869 millones en 2023, sobre ingresos totales de 18,674 millones. I was off by a factor of almost three. On the other hand, the company reports pérdidas netas de 4,937 millones en 2025 y un déficit acumulado de 41,311 millones al 31 de marzo de 2026. However, those losses don't come from Starlink: the Connectivity segment generated 4,423 millones de dólares de utilidad operativa en 2025, mientras Space perdió 657 millones y el segmento de IA 6,355. The orbital concentration was financed with patient capital and losses from other businesses; the part that sustains it is already making money.

SpaceX annual revenue 2023-2025 [168] · Net loss of $4,937 million in 2025 and accumulated deficit of $41,311 million as of March 31, 2026 [169]

The business that pays for orbit tripled its revenue in two years
Year	Connectivity	Total SpaceX
2023	3869	10387
2024	7599	14015
2025	11387	18674

Corporate governance is the part that no index measures. Before the IPO, Elon Musk owned 5,569,053,075 acciones Clase B, el 93.6% de esa clase y el 85.1% del poder de voto, y la empresa se acoge a la figura de "controlled company" de Nasdaq para eximirse de tener mayoría de consejeros independientes. In other words, the operator of two-thirds of active objects in orbit is a public company controlled by a single person without mandatory checks and balances on the board. And the company recognizes this as a business risk, in a paragraph worth its weight in gold: "gobiernos u otros clientes podrían mostrarse reticentes a depender de nuestra conectividad satelital si creen que la disponibilidad de esos servicios podría restringirse o suspenderse con base en consideraciones geopolíticas". It's the kill switch, admitted in writing to the SEC. The company also admits that "ciertos gobiernos extranjeros han discutido públicamente el uso potencial de armas antisatélite contra la constelación Starlink".

Regarding that kill switch, my draft repeated the most famous and also the most incorrect version: that in September 2022, Musk ordered the shutdown of coverage near Crimea, according to Isaacson's biography. Isaacson himself retracted it two days later: "los ucranianos CREÍAN que la cobertura estaba habilitada hasta Crimea, pero no lo estaba. Le pidieron a Musk que la habilitara para su ataque con dron submarino. Musk no la habilitó", and added that he had misinterpreted his source. Musk responded that "las regiones Starlink en cuestión no estaban activadas". Repeating Crimea as fact at this point is negligence. What's documented is another episode in another place: three sources told Reuters that Musk instruyó a un ingeniero senior desactivar la cobertura sobre Beryslav, en Kherson, durante la contraofensiva ucraniana del otoño de 2022, por temor a que un avance exitoso provocara una respuesta nuclear rusa - six months after writing "to be extremely clear, Starlink will never shut down its terminals".

And in February 2026, the mechanism changed in nature. On February 5, at 3:00 AM in Kyiv, a whitelist scheme managed with the Diia civil app went into operation. Minister Mykhailo Fedorov announced it like this: "los Starlink incluidos en la lista blanca están funcionando; las terminales rusas ya fueron bloqueadas", and Musk confirmed that the measures "seemed to have worked". Serhiy "Flash" Beskrestnov, a Ukrainian electronic warfare specialist, summarized it like this: "el enemigo no tiene un problema, el enemigo tiene una catástrofe". And the other side confirmed it: on February 17, Russian Deputy Defense Minister Aleksei Krivoruchko stated on state TV that "las terminales Starlink llevan dos semanas caídas". Both sides of a war recognize the shutdown: that's real cross-corroboration. And what's qualitatively new, reading together what Reuters and the Kyiv Independent reported, is that it's no longer a geographic blackout but a device identity registry: a private company decides, terminal by terminal, who has communications on a European war front.

What about the competition? My draft said Amazon was entering beta with around 375 satellites in April 2026; the count holds up — Amazon reports "375+ satélites en órbita" tras 14 misiones, contra 3,232 autorizados — but I couldn't verify the beta date, so I'm cutting it. What I did find is more revealing: the FCC gave Amazon an exemption because it didn't meet its licensing milestone. It reported 180 satélites lanzados y una proyección de unos 700 para el 30 de julio de 2026, cerca del 21% de las estaciones autorizadas when the license required 1,616. And the regulator's justification is an admission: "en este momento, solo un operador, SpaceX, está proveyendo banda ancha a consumidores estadounidenses desde órbita baja". The FCC bent its own rules a cambio de que Amazon pierda prioridad hasta marzo de 2028 o hasta desplegar 50% de la constelación to manufacture a second competitor. My OneWeb numbers were also wrong: it wasn't 187 million euros or 15% of Eutelsat, but 297 millones de euros de ingresos LEO, +69.5%, alrededor de una cuarta parte del total al cierre del ejercicio en junio de 2026, with más de 650 satélites OneWeb y un CEO que se define como "el único de dos operadores LEO que hoy no es una empresa estadounidense". Starlink makes in about ten days what OneWeb makes in a year. And the European public bet, IRIS², se amplió a 348 satélites más 66 de defensa, con los primeros lanzamientos adelantados a 2029 on a contract of 10,600 millones de euros y entrada en servicio a principios de 2031. By then, Starlink will have been operating for a decade.

Authorization for 3,232 satellites and deployment after 14 missions [176] · Milestone of 1,616 satellites by July 30, 2026, Amazon's own projection and satellites launched when presenting the exemption [173] · The exemption implies loss of priority until March 2028 or until 50% is deployed [174]

The FCC required 1,616 satellites; Amazon came up with 180
Etapa	Valor
Authorized by the FCC	3,232
Required by July 30, 2026	1,616
Projected by Amazon for that date	~700
Deployed after 14 missions	396 deployed / 375+ in orbit
Launched when presenting the exemption	180

Who decides your domain exists

I wrote this section in my draft with a warning in brackets: "[SUSPECT CLAIM] The US Department of Commerce still has the power to approve changes to the root zone — cited from Wikipedia, marked in yellow—". The suspicion was well-founded. The claim has been false since October 1, 2016, and explaining why it's false turned out to be much more interesting than the claim itself.

Before that date, the US government's role wasn't vague oversight: it was a button. The NTIA documented its process in three steps "Paso 1: recibir notificación de cambio... se envía a NTIA un correo automatizado solicitando autorización para que VeriSign implemente el cambio en el archivo de zona raíz. Paso 2: verificar que ICANN siguió el proceso establecido. Paso 3: autorizar". Three parties: ICANN operated the IANA functions, NTIA was the Administrator, and Verisign was the Root Zone Maintainer. The NTIA insisted its role was "clerical and administrative", but the button existed and was in Washington.

What happened in 2016 was a change of one word with enormous consequences. The joint proposal from Verisign and ICANN described replicating the entire root management system "con un nuevo conjunto único de credenciales para la autenticación (versus 'autorización') de las solicitudes de cambio de zona raíz", y que "el rol de RZA que hoy desempeña NTIA será eliminado al completarse la transición". From authorize to authenticate. IANA confirms it: "a partir del 1 de octubre de 2016 las funciones IANA las desempeña Public Technical Identifiers (PTI)... el paso obligatorio de que el Gobierno de EE.UU. apruebe las solicitudes de cambio en la zona raíz se está eliminando". Verisign was released weeks later: "el Departamento de Comercio enmendó el Cooperative Agreement para liberar a Verisign de las responsabilidades de operación, gestión y mantenimiento de la zona raíz", with amendments 33 and 34 on October 20, 2016. That's where the button died. Anyone still writing that the US approves root zone changes is ten years behind.

What replaced it isn't a treaty or a regulator: it's a private contract with a term that seems like a joke. Under the Root Zone Maintainer Agreement, Verisign compila el archivo de zona raíz por instrucción de IANA, lo firma con DNSSEC y lo distribuye a los operadores de servidores raíz; el acuerdo tiene un plazo inicial de ocho años y se renueva automáticamente por periodos sucesivos de ocho años. And the accountability that replaced the NTIA is interna a ICANN: un Customer Standing Committee que revisa cada mes el desempeño de PTI contra los niveles de servicio pactados en el contrato de la función de nombres de IANA. The external supervisor is out, and committees from the supervised party itself are in.

So does the US no longer have residual power? Yes, it does, but not where I thought. It's surgical and limited to a single domain: .com. Verisign describes it in its 10-K: el Cooperative Agreement "se renovó automáticamente el 30 de noviembre de 2024 por un plazo sucesivo de seis años y se renovará el 30 de noviembre de 2030 salvo aviso escrito de no renovación con 120 días de anticipación". Amendment 35 reduced government approval to five specific assumptions: prices, vertical integration, security posture, renewal terms, and the Whois service. Everything else is out of its scope.

That amendment, from October 26, 2018, was the exact moment when the US traded price control for content neutrality. The NTIA published it without euphemisms: "la enmienda deroga los controles de precios de la era Obama y le da a Verisign la flexibilidad de aumentar los precios mayoristas de .com... hasta 7% en cada uno de los últimos cuatro años del plazo de seis". Six years later, the regulator itself admitted in writing that it can't set the price or prevent automatic renewal: "a pesar de nuestros mejores esfuerzos, no hemos podido acordar cómo debería cambiar el precio mayorista del .com... NTIA no tiene autoridad para fijar los precios de los dominios .com", in a text that also mentions the registry handles over 300 billion daily queries.

The price increase window has been exercised again. In April 2026, Verisign announced it's raising the wholesale price of .com from 10.26 a 10.97 dólares anuales, efectivo el 1 de noviembre de 2026, backed by that same 7%; the previous price had taken effect on 1 de septiembre de 2024. Chart 3 plots the complete timeline, from the 2016 button to the 2026 increase.

Three-step process documented by the NTIA [140] · Verisign/ICANN proposal [141] · IANA transition to PTI [142] · Amendments 33 and 34 [143] · Root Zone Maintainer Agreement [144] · Amendment 35 [146] · .com prices [149][148] · Automatic renewal and NTIA's stance on prices [145][147] · DDoS against root identities [157] · Governance model in initiation phase [156]

From authorization to authentication: ten years of the root zone
Año	Hecho
2014	The NTIA documents its three-step process for the root zone, with explicit authorization from the US government.
2015	The Verisign and ICANN proposal replaces the word "authorization" with "authentication".
2016	October 1: the IANA function moves to PTI and the mandatory US government step ends.
2016	October 20: amendments 33 and 34 free Verisign.
2016	The RZMA is signed for 8 years, with automatic renewal.
2018	October 26: amendment 35 changes price control to a content neutrality clause.
2024	September 1: the .com goes up to $10.26.
2024	November 30: the contract renews automatically and the NTIA admits it cannot set prices.
2025	December 23: a DDoS hits ten of the thirteen root identities.
2026	February: the governance group publishes a model that is still in the initiation phase.
2026	April: Verisign announces the .com price increase to $10.97, effective November 1, 2026.

Now, the sizes, where concentration becomes obscene. As of June 30, 2026, Verisign reports 179.1 millones de registros .com y .net, con ingresos trimestrales de 434.6 millones de dólares y utilidad operativa de 296.3 millones sobre costos totales de 138.3 millones. An operating margin of 68.2%. And the quarter closed with 401.6 millones de dominios registrados en todos los TLD del planeta: a single company operates nearly 45% of all the world's domains, and that same company is the Root Zone Maintainer and operator of two of the thirteen root servers. Provider, dominant registry, and critical infrastructure, all three at once.

Root Zone Maintainer Agreement and its renewal [144] · Operation of root identities [150][153] · Registered domains, revenue, and quarterly margin [150][151] · Verisign's contributions to ICANN's revenue in fiscal year 2025 [152]

One thing that really caught me off guard is how the referee is financed. In the 2025 fiscal year, ICANN received funding totaling 155,278,734.56 dólares, de los cuales VeriSign aportó 48,682,074.36 como registro de TLD legado, más otros conceptos menores, which is around $49.1 million - about 31.6% of the organization's operating budget, based on my calculations using their own numbers. The American Economic Liberties Project puts it more bluntly - with the caveat that this is a policy brief from July 2024, an advocacy document rather than a neutral study: Verisign is "el monopolio designado por el gobierno" que "ha turboalimentado su rentabilidad mediante un acuerdo de renovación automática que en dos décadas ha aumentado 70% el precio del .com mientras los costos reales probablemente han caído", and notes that ICANN "ostensibly protects the public interest but counts Verisign as its largest financial backer". Removing them isn't an option either: the contract has presumptive renewal and ICANN solo podría terminarlo si Verisign no subsana un incumplimiento fundamental y además desacata el fallo del árbitro o del tribunal.

Regarding root servers, my draft said "12 operators, 13 identities, over 1,500 physical servers". The first two numbers are correct, but the third one falls short: the live registry of the operators' association showed, as of August 28, 2026, 2,004 instancias operativas de doce operadores independientes. It's worth looking at who they are: Verisign (with two identities), USC-ISI, Cogent, the University of Maryland, NASA, ISC, the Defense Information Systems Agency, the Army Research Lab, Netnod, RIPE NCC, ICANN, and WIDE Project. Nine out of 12 are US organizations, and two belong to the US military apparatus. ICANN itself acknowledges the asymmetry: "doce organizaciones administran 13 identidades... por razones principalmente históricas, una organización administra dos". These roots support 1,438 dominios de primer nivel vigentes al 28 de agosto de 2026.

Twelve operators, thirteen identities, and 2,004 operational instances as of August 28, 2026, including two military operators [153] · ICANN acknowledges that one organization manages two identities for historical reasons [154] · About 1,438 active TLDs hang from that root [159]

Nine of the twelve root owners are American, two are military
Concepto	Valor
United States	9 out of 12 operators
Sweden (Netnod)	1 out of 12 operators
Netherlands (RIPE NCC)	1 out of 12 operators
Japan (WIDE Project)	1 out of 12 operators

Ten years after the transition, the most-cited analysis of these 12 operators is that they're not accountable to anyone. This isn't an institutional finding - it's the judgment of Geoff Huston, APNIC's chief scientist, who puts it this way: "la dependencia del altruismo de un grupo selecto de entidades sin rendición de cuentas asociada para operar el núcleo del DNS es preocupante", and adds that there have been governance gaps for about 30 years, including undefined procedures for adding or removing operators. The fix is still in draft form: the working group published its functional model in February 2026 and still proposes tres fases —Iniciación, Establecimiento, Gobernanza— antes de que exista una autoridad real, con la primera "intencionalmente limitada en alcance y autoridad". Among the functions being designed is the ability to remove a non-compliant root operator.

Two key points to wrap up. The system is vulnerable to attack: on December 23, 2025, diez de las trece identidades raíz recibieron un ataque volumétrico que superó un terabit por segundo y duró poco menos de diez minutos. And it has a real political limit, tested in 2022: when Ukraine asked to disconnect Russian domains, ICANN responded that "fue construida para asegurar que internet funcione, no para que su rol de coordinación se use para impedir que funcione". I'm correcting my table on concentration by layer: the risk to the DNS isn't that Washington can press a button that no longer exists. It's that the physical production of the root, 45% of the world's domains, and 31.6% of the regulator's operating budget are all in the same company, with a contract that's only renewed every eight years.

The Taiwan bottleneck

The figure I repeated most about TSMC in my draft - 72.3% of the global foundry market in Q1 2026 - turned out to be wrong by three tenths and for the wrong reason. TrendForce's original statement says 72% de cuota en 1T26, con ingresos de casi 35,860 millones de dólares y un alza de 6.3% trimestral, frente a Samsung en 6.5% y SMIC en 5.1%. Samsung and SMIC were correct; the 72.3% figure was invented somewhere in the citation chain. The previous quarter did see 70.4% para TSMC. And what my draft didn't catch is that the curve kept rising: Counterpoint - which measures the pure foundry market, with a different denominator and methodology than TrendForce, so its 73% doesn't contradict the 72% above - reports for Q2 2026 73% para TSMC "por segundo trimestre consecutivo, impulsado por la producción en masa de 2nm, el escalamiento de 3nm y la oferta ajustada…", con Samsung en 7% y SMIC en 5%. For the full year 2025, the share was 69.9%, con ingresos de 122,540 millones de dólares. Chart 4 plots this quarterly series, because the slope matters more than the snapshot: concentration isn't being corrected, it's deepening while the world spends billions trying to correct it.

Quarterly foundry share, references 86, 87, and 88 of the file · Full year 2025, reference 112 · Q2 2026 node mix, reference 89

TSMC's share doesn't get corrected: it goes up
Quarter	TSMC	Samsung Foundry
Q4 2025	70.4	7.1
Q1 2026	72	6.5
Q2 2026	73	7

Regarding the cutting edge, my draft said "over 90% of global capacity in 7nm or smaller nodes". The correct formulation, according to the US Department of Commerce, is geographic rather than corporate: Taiwan concentrates "más del 60% del ingreso global de fundición" y "más del 90% de la manufactura de chips de vanguardia", con una industria que generó más de 165,000 millones de dólares en 2024, alrededor del 20.7% del PIB del país. The ORF, citing the same ITA guide - not independent corroboration - repeats the number and adds that cuatro de las diez mayores fundidoras del mundo son taiwanesas. The Q2 2026 results show what this dominance is made of: 40,200 millones de dólares de ingreso, margen bruto de 67.7%, y 77% del ingreso de obleas en tecnologías de 7nm o menos.

Now, the point that seems most important to me in this section, and which no press release about "Arizona" explains well, is that TSMC announced in March 2025 that su inversión total en Estados Unidos llegaría a 165,000 millones de dólares —tres fábricas nuevas, dos plantas de empaquetado avanzado y un centro de I+D—, "la mayor inversión extranjera directa individual en la historia de EE.UU.", and in July 2026, it expanded on that with 100,000 millones adicionales, hasta 265,000 millones y diez fábricas. These are enormous numbers. Yet, C.C. Wei himself said on the earnings call that once the entire plan is completed, alrededor del 30% de la capacidad de 2nm y más avanzada quedará en Arizona. Seventy percent of the cutting-edge tech will still be on the island. $265 billion to move less than a third of it.

C.C. Wei's statement on July 17, 2025, reference 92 · $165 billion investment announced in March 2025, reference 91 · Expansion to $265 billion, ten factories in Arizona, and thirteen advanced factories planned in Taiwan, July 2026, reference 93

Two hundred sixty-five billion dollars to move 30%
Indicador	Valor
2nm and advanced node capacity that will remain in Arizona after the plan is completed	30%

And that's just the promise, not what's been delivered. The original Arizona announcement from December 2022 promised unos 40,000 millones de dólares, la Fab 1 en N4 produciendo en 2024 y la Fab 2 en 3nm produciendo en 2026. We're now in August 2026, and the only thing Arizona is producing in volume is still 4nm: el 3nm de la Fab 2 se apunta ahora al segundo semestre de 2027. A year late. In Japan, the second Kumamoto plant podría retrasarse hasta 18 meses, a 2029, por infraestructura local insuficiente incluida la congestión vial is being held up by traffic, and Fab 1 has been stalled tras el sismo del 28 de julio de 2026. In Germany, ESMC Dresden apunta a producción en 2027 isn't producing a single wafer today, and the planned node is for automotive, not cutting-edge tech. Meanwhile, the existing 2nm capacity is still where it's always been: múltiples fábricas en Hsinchu y Kaohsiung, hacia 100,000 obleas mensuales a finales de 2026, y aun así esa capacidad sigue siendo insuficiente para la demanda de NVIDIA, AMD, Intel y la automotriz. All of it on the island.

Let's move on to the part of the draft that didn't hold up well, because I got three things wrong in a row. I wrote: "With the closure of the Strait of Hormuz in March 2026, TSMC was left with 11 days of LNG reserves; helium prices doubled after an attack on Qatari facilities that supply a third of the world's helium." I'm correcting this point by point.

First: the 11 days aren't TSMC's reserves, and they're not a consequence of the closure. They're the legal safety reserve for the entire island, and they've been that way since before. The MOEA's Energy Administration publishes the table: 7 días de existencias obligatorias de gas natural en 2019, 8 en 2022, 11 en 2025 y 14 en 2027. The figure is corroborated independently by Global Taiwan Institute, que estima que bajo bloqueo "las reservas de GNL de Taiwán durarían solo 11 días de uso normal" frente a más de 40 días de carbón, AmCham de Taiwán, que compara esos 11 días con los 14 a 20 de Japón y Corea del Sur, and an analysis based on CIER's work that highlights the most revealing regulatory contrast: la ley taiwanesa exige 90 días de reserva de crudo —se reportaron 146 días en 2022— frente a 11 días legales de GNL. And the seasonal nuance I owe to Jong-Shun Chen specifically, not CIER in general: in the summer, the gas would last about seven days.

Crude oil, coal, and LNG reserves in Taiwan, and Jong-Shun Chen's statement, reference 104 · Minimum LNG requirement, reference 103 · Japan and South Korea's LNG reserves, reference 102

Taiwan's law requires ninety days of oil and eleven days of gas
Concepto	Valor (days)
Crude oil - reported reserve in 2022	146 days
Crude oil - minimum required by law	90 days
Coal	41 days
LNG - Japan and South Korea	14 to 20 days
LNG - Taiwan's minimum legal requirement in 2025	11 days
LNG - Taiwan in the summer	≈ 7 days

Second: the closure of the Strait of Hormuz did happen, and it was worse than I implied, but it's not the cause of the 11-day reserve. The CSIS documents that the strait transporta aproximadamente una cuarta parte de los flujos globales de petróleo, estuvo "efectivamente cerrado desde el 2 de marzo" tras ataques estadounidenses e israelíes a Irán, con cientos de tanqueros varados en el Golfo Pérsico. Regarding the impact on Taiwan, the Atlantic Council points out that el gas pasó de ~17% de la generación eléctrica en 2006 a casi 48% en 2025, que Qatar aporta cerca de un tercio del GNL taiwanés y que la isla recibía más del 38% de su gas de Medio Oriente. That's where my third major error comes in: I wrote "37% of their grid relies on Middle Eastern LNG," confusing the percentage of imported gas with the percentage of the power grid. And as for helium: I couldn't find any verified data on helium or an attack on Qatari helium facilities. What does exist is the fact that a third of the world's LNG comes from the region. The helium data point is completely incorrect.

Now, the counterpoint that honesty requires: the Taiwanese government disputes the entire framework. The MOEA responded on March 24, 2026, that "no existe en absoluto una crisis de escasez de gas natural como reportan los medios extranjeros", que "Taiwán obtiene gas natural de 14 países" y que las existencias están por encima del mínimo legal. In May, they stated that "el suministro de gas seguirá seguro hasta septiembre", sin ofrecer cifra alternativa a los 11 días y con CPC comprando cargamentos spot. Both things can be true at the same time: there was no blackout, and the cushion is still 11 days. To put this into perspective: TSMC currently consumes casi el 10% de la electricidad de la isla and could reach al 24% para 2030.

Two more things from the draft that didn't survive: the "blockade scenario" with deliveries taking more than six months and prices 25-35% higher, and the claim that maritime risks had increased semiconductor logistics costs by 15% to 22% during 2026. I couldn't find any source to back these up, so I'm removing them. A scenario modeled by someone I couldn't identify isn't a data point.

And the largest numerical correction in this section: the Chinese Big Fund. I originally wrote "Phase III: $344 billion." It's actually 344 billion yuan: unos 47,500 millones de dólares, constituidos en mayo de 2024 según los reportes, con 19 accionistas estatales encabezados por el Ministerio de Finanzas. I was off by a factor of seven, and the "commitment of $1 billion by 2030" couldn't be verified, so I'm retracting it. What's interesting isn't the size but the shift: the fund stopped financing mature node factories to focus on "tres pilares clave: empaquetado avanzado e integración de IP, equipo y materiales de semiconductores, y chips de cómputo para IA". They're buying the tools, not the factories. The progress is real but modest: una empresa de Shanghái con respaldo estatal inició producción de bajo volumen de una herramienta DUV de inmersión doméstica, con meta de 5 unidades en 2026 y 20 en 2027, mientras un prototipo EUV existe sin producir chips. Five machines per year compared to the dozens of EUV systems ASML delivers annually. The gap is still huge, but the direction of the investment has changed, and that's what we should be watching.

The memory cartel, 2026 edition

Of all the sections in the draft, this was the one I thought was the most solid, and it's the one that ended up with the most corrections. Let's start with the basics: the case number. I wrote 3:26-cv-06345, but the court seal on the 118 pages of the complaint says "Case No. 5:26-cv-06345-NW". The case was reassigned. Second correction: it's not "17 consumers" - it's 17 named plaintiffs, and at least three of them are companies: Troy's Computers LLC, JB Tech Solutions LLC, and Wastenotime Developments Performance Fabrications. The specialized press got it wrong, and I copied it. Alegan que las tres empresas "redujeron deliberadamente la oferta de DRAM commodity bajo el pretexto de expandir la producción de HBM para IA" y piden daños triples.

Third correction, and it's about methodology: everything that follows from the case file is just one party's allegations, not proven facts. I verified that the transcripts are literally exact - I downloaded the PDF and extracted the text - but just because a quote is perfect doesn't make the accusation a judicial truth. I'm saying this upfront because the draft presented several of these figures as if they were findings. The complaint claims that "tres empresas —Samsung, SK Hynix y Micron— fabrican casi toda la oferta mundial, sumando juntas más del noventa por ciento del ingreso de DRAM" y que desde 2022 han fijado oferta y precios "con una conducta que no tiene sentido económico en ausencia de colusión", elevando el precio de la DRAM convencional aproximadamente 700% en cuatro años. The arithmetic chain is specific: 171.8% interanual al tercer trimestre de 2025, 50% más en el cuarto, y entre 93% y 98% trimestral en el primero de 2026, para un acumulado de ~697% desde 3T24 hasta 1T26. My draft said "more than 450% since September 2025"; that number doesn't appear in any verified source, and I'm replacing it with the one from the case file, with the corresponding allegation label.

What does have a life of its own outside of the court filing are three things, and I verified all three against primary sources. One: SK hynix reported in the second quarter of 2026 un margen operativo de 76%, con ingresos creciendo 257% y utilidad operativa 557% interanual. A 76% margin in commodity manufacturing is, by itself, an anomaly that demands explanation. Two: in December 2025, with consumer prices at historic highs, Micron announced through its own press release that "ha tomado la difícil decisión de salir del negocio de consumo Crucial para mejorar el suministro y el soporte a nuestros clientes estratégicos más grandes en segmentos de mayor crecimiento", shutting down one of the world's most well-known consumer memory brands just when that memory was selling for more than ever. The complaint highlights the obvious: "una empresa compitiendo por la escasez habría usado Crucial para vender a esos precios".

Three, and it's the weirdest data point in the entire investigation: today, the old chip costs more than the new one. The TrendForce spot index, consulted on August 28, 2026, says un promedio de 91.293 dólares para el DDR4 de 16Gb contra 53.933 para el DDR5 equivalente: 69% more expensive for the one that was supposed to be replaced - my summary said 70%, but the division gives 1.6928. This happens after, according to the case file, en 2024 Samsung y SK Hynix salieran del DDR3 y en 2025 las tres avisaran que retirarían la producción mainstream de DDR4, con los últimos embarques entre finales de 2025 y principios de 2026. Graph 5 shows the complete ranges, not just the averages, and that's where you see the trap: the DDR4 ranges from $42.30 to $116.00. That dispersed range means the average is calculated over an illiquid market, and the overprice of an end-of-life piece is an ordinary phenomenon of last-minute buying, not proof of coordination by itself. Reading it as "exactly what predicts a coordinated restriction" is the plaintiffs' interpretation, not a neutral finding.

TrendForce's spot price ranges and averages as of August 28, 2026, reference 123 · Alleged coordinated withdrawal of DDR3 and DDR4, reference 122

The old chip costs more than the new one
Concepto	Low end of spot price range	High end of spot price range
DDR4 16Gb (2Gx8) 3200 — average $91.293 USD	$42.30 USD	$116.00 USD
DDR5 16Gb (2Gx8) 4800/5600 — average $53.933 USD	$37.00 USD	$68.00 USD

Regarding market share, my draft said "Samsung 38-42%, SK Hynix 29.5%, Micron 23%". The real numbers from Counterpoint are different and vary a lot: in the third quarter of 2025, they were Samsung 33%, SK Hynix 33%, Micron 26%, CXMT 6% y Nanya 2%; sobre esos insumos, y suponiendo un reparto de 30/70 entre HBM y memoria convencional, la propia demanda calcula que las tres demandadas suman 88.5% del mercado de DRAM convencional - the 88.5% is a calculation from the court filing, not a Counterpoint measurement; and in the second quarter of 2026 Samsung se amplió a 39%, SK hynix cayó a 26% desde 39% un año antes, y Micron quedó en 25% tras quintuplicar su ingreso de DRAM. The complete quarterly series also shows that el mercado creció 80% trimestral y 260% interanual en el primer trimestre de 2026, y que CXMT pasó de 3% a 8% en cinco trimestres: the Chinese share grows, although from a small base.

DRAM market share by quarter from Counterpoint Research, references 131 and 132 · Market growth in Q1 2026, reference 131

The memory throne changed hands in six quarters
Quarter	Samsung	SK hynix	Micron
Q1 2025	34	36	25
Q2 2025	33	39	22
Q3 2025	33	33	26
Q4 2025	36	32	22
Q1 2026	38	29	22
Q2 2026	39	26	25

The complaint also calculates a concentration index: 91.5% del ingreso reportado en 3T25 y un HHI de aproximadamente 2,868, "muy por encima del umbral de 1,800 que el DOJ y la FTC identifican como presuntivamente indicativo de un mercado altamente concentrado". The threshold is locked in - it's the same standard as the 2023 Merger Guidelines that I already verified through another means in the satellite section - but the arithmetic of 2,868 doesn't add up on its own: summing the squares listed in the complaint itself gives 2,828, and getting to 2,868 requires treating the entire 6.4% residual as a single company. I'm publishing it as the complaint's calculation, not as a fact.

One detail from the draft that I'm removing entirely: I wrote that the complaint states that the companies rehired executives who were convicted in the previous cartel case. I didn't find that statement in any of the verified data, and I'm not going to repeat it. What is documented, and is serious enough, is the precedent: between 1998 and 2002 Samsung, Hynix y Micron participaron con otros fabricantes en una conspiración criminal para fijar precios de DRAM vendida a los grandes fabricantes de computadoras estadounidenses; Samsung se declaró culpable y pagó 300 millones de dólares, el predecesor de SK Hynix pagó 185 millones, las penas criminales totales superaron 730 millones y varios ejecutivos fueron a prisión. Micron participó pero evitó la multa al delatar la conspiración. My draft said "more than 700 million"; the DOJ number is more than 730, and the original press release adds that los fabricantes directamente afectados fueron Dell, Compaq, HP, Apple, IBM y Gateway. Europe closed its own case in 2010 with 331,273,800 euros de multa a diez productores, con Micron otra vez sin multa por haber revelado el cartel. Same pattern, same whistleblower, twenty years later.

What's making me tone down my own draft, which was initially more alarmist, are the reports from TrendForce that I cited myself. In January 2026, the forecast was for 55 a 60% de alza trimestral en precios de contrato de DRAM convencional para el primer trimestre. By the third quarter, the projection had dropped to 13-18% trimestral, and the title of the analysis literally says that profits are moderating because consumer demand is weakening. Furthermore, "los acuerdos de largo plazo topan los aumentos de precio", and several US cloud providers have already signed multi-year contracts that prevent manufacturers from raising prices. This directly contradicts the central claim in the lawsuit that los coreanos subieron 60-70% en un solo trimestre a Google y Microsoft mientras rechazaban los contratos plurianuales que esos clientes querían. The contracts that the lawsuit claims were rejected do exist and are in effect. It doesn't necessarily debunk the thesis – they could have been rejected initially and then accepted later – but omitting this information would be dishonest.

Claims from the case, references 113 and 114 · TrendForce's statements, references 133, 134, and 135 · Alleged multi-year contracts, reference 121

Period	What the case claims	What TrendForce published
Q3 2025	+171.8% year over year	—
Q4 2025	+50% quarter over quarter	—
Q1 2026	93-98% quarter over quarter	Forecast of +55-60% quarter over quarter contract
Q3 2026	—	Forecast of +13-18% quarter over quarter, with weakening consumer demand
Multi-year contracts	Koreans rejected them while raising prices 60-70% to Google and Microsoft	Long-term agreements cap increases and several cloud providers have already signed them
Accumulated from Q3 2024 to Q1 2026	≈ 697%	—

Demand says squeeze; TrendForce's statements say slowdown
Period	What the case claims	What TrendForce published
Q3 2025	+171.8% year over year	—
Q4 2025	+50% quarter over quarter	—
Q1 2026	93-98% quarter over quarter	Forecast of +55-60% quarter over quarter contract
Q3 2026	—	Forecast of +13-18% quarter over quarter, with weakening consumer demand
Multi-year contracts	Koreans rejected them while raising prices 60-70% to Google and Microsoft	Long-term agreements cap increases and several cloud providers have already signed them
Accumulated from Q3 2024 to Q1 2026	≈ 697%	—

The cost to the rest of us is real, though. The lawsuit documents that kits de 32 GB de DDR5 que costaban entre 100 y 200 dólares en octubre de 2025 arrancaban en unos 350 en enero de 2026; un kit de 64 GB pasó de unos 189 dólares en marzo de 2025 a unos 1,080 en marzo de 2026; CyberPowerPC avisó a sus clientes que subía precios porque sus costos de memoria habían subido 500% en meses, y Dell añadió entre 130 y 230 dólares a sus equipos comerciales con 32 GB. My draft mentioned price increases for the PS5 and Switch 2, but I didn't find verified data for those, so I'm retracting that point, even though the mechanism is the same. IDC projects the overall effect: contracción de 4.9% del mercado de PC con precios promedio subiendo 4-6% en el escenario moderado, y hasta 8.9% de caída con precios 6-8% arriba en el pesimista; en teléfonos de gama media "la memoria puede representar entre 15% y 20% del total de la lista de materiales".

Prices for the 64 GB DDR5 kit, 32 GB kits, CyberPowerPC's warning, and Dell's surcharge, reference 115

The same 64 GB kit: $189 in March, $1,080 a year later
Concepto	Valor (USD)
March 2025	≈ $189
November 2025	over $425
March 2026	≈ $1,080

So, what are the chances of the lawsuit succeeding? Less than the outrage suggests. The Ninth Circuit itself, back in 2022, upheld the dismissal of a nearly identical antitrust action against DRAM manufacturers, ruling that quienes se apoyan en conducta paralela deben alegar "algún realce fáctico adicional" que sitúe ese paralelismo en un contexto que sugiera un acuerdo previo, y que ocho factores plus considerados uno por uno y en conjunto no bastaron. That's the precedent that the plaintiffs need to overcome. The companies have already taken a stance: Micron stated that "competimos vigorosamente, con justicia y cumpliendo todas las leyes aplicables dondequiera que hacemos negocios; nos defenderemos de estas acusaciones", and Samsung's defense team – O'Melveny & Myers, led by Ian Simmons and Brian P. Quinn – agreed with the plaintiffs that un plazo hasta el 2 de septiembre de 2026 para contestar o pedir la desestimación. In other words, we'll know in just four days whether this case will move forward or meet the same fate as the previous one. I wouldn't bet against the house.

The electrons don't arrive with a press release

Of all the layers I reviewed, this is where I was most wrong. I had noted that data centers were going from 485 TWh in 2025 to "950 or 1,000 TWh" in 2030. The first figure is correct, but the second one isn't: the International Energy Agency says 950 TWh, without a range, and adds the number that really matters, 🟢 around 3% of global electricity demand by that date IEA: 485→950 TWh a 2030. I rounded up to "1,000" on my own, and rounding up in a piece about whether we're exaggerating the systemic risk is exactly the sin I was trying to avoid.

The one-year picture is more dramatic than the five-year projection: global data center demand grew 17% in 2025, and the AI-specific portion skyrocketed 50% IEA: +17% total, +50% IA en 2025. The baseline: 415 TWh in 2024, close to 1.5% of global electricity consumption; the US adds around 240 TWh by 2030 – a 130% increase – and, along with China, accounts for nearly 80% of global growth; per-capita consumption rises from 540 kWh to over 1,200 kWh by the end of the decade IEA 2025: línea base 415 TWh y per cápita EE.UU..

Consumption in 2024, 2025, and projection to 2030, references 64 and 67 · Weight on global electricity demand, reference 65 · 2025 growth of +17% overall and +50% in AI, reference 64

Data center electricity consumption, 2024-2030
Year	Data center consumption (TWh)
2024	415
2025	485
2030	950

Now, the key finding. I wrote this section as if the problem was generating more electricity. But that's not it – the problem is connecting it. The IEA says it outright – a 70% increase in gas turbine orders in 2025 exposed the bottlenecks in the energy supply chain, the project pipeline is straining planning and regulatory systems, and "not all projects will come to fruition" IEA: cuellos de botella y "not all projects". The timelines are from a different era: two to three years to get cable, up to four for a large power transformer, over five for DC cable; cable prices have almost doubled since 2019, and transformers are up around 75%, with 1,650 GW of solar and wind in advanced stages waiting to be connected IEA: plazos y precios de cables y transformadores. In the US, the details are even worse: 🟡 128 weeks for a power transformer, 144 for a GSU, with GSU demand 274% above 2019 and an estimated 30% deficit POWER: 128/144 semanas y precios de transformadores. A two-and-a-half-year wait for a piece of metal with copper inside – that's the real speed limit for AI, not the GPUs.

Delivery times for power cables and transformers, price increase since 2019, and 1,650 GW of solar and wind waiting to be connected, reference 68 · Delivery times for GSU, transformers, and switchgear in the US, GSU demand +274% since 2019, and estimated deficit of 30%, reference 69

The AI speed limit is measured in weeks of waiting for a transformer
Concepto	Valor (weeks)
Direct current cable	more than 260 weeks
Large power transformer	up to 208 weeks
Cable	104 to 156 weeks
GSU transformer in the US	144 weeks
Power transformer in the US	128 weeks
Switchgear (2T25)	44 weeks

Mandatory correction. The draft had an entire paragraph about the backlog of GE Vernova turbines — 116 GW in the second quarter of 2026, with a target of 125 GW, deliveries until 2031, plus 69 GW from Siemens Energy. Verification completely debunked it: the note I used as a source is from the first quarter and says something different (100 GW under contract, 44 GW of equipment backlog, restrictions in 2029-2030) and doesn't mention Siemens or Mitsubishi. I removed it; the 70% increase in orders documented by the AIE supports the argument without inventing digits.

Where this stops being engineering and becomes cost allocation is in capacity auctions. Data centers account for $6.3 billion — 38% — of the $16.4 billion in charges from the latest PJM auction, and $29.4 billion — 46% — of the last four; the attribution comes from independent market monitor Joseph Bowring PJM: 38% y 46% de cargos por data centers. That auction went from $2.2 billion in 2024-25 to $16.4 billion in 2027-28; CenterPoint's requests in Houston jumped from 1 GW to 25 GW in twelve months; Exelon calculates that only 22% of its 65 GW portfolio will materialize, with retail prices 8.25% higher nationally and 19.35% in Virginia POWER: subasta PJM, CenterPoint, Exelon 22%.

That 22% is key. In Texas, over 233 GW of high-load requests are being evaluated, with more than 70% coming from data centers, and ERCOT's vice president summed it up better than any analyst: "we have outgrown the process that was established for reviewing these large loads" ERCOT: 233 GW de cola de gran carga. On the generation side, the national queue closed 2025 with 2,061 GW active, 10% less than in 2024 due to mass retirements LBNL Queued Up 2026: 2,061 GW en cola. And Wood Mackenzie estimates that the grids will end up committing to serve around 298 GW of the 1,066 GW requested: two-thirds of the announced demand is smoke, duplicate requests from the same developer in several territories 298 de 1,066 GW: la carga que no se construirá.

US data center requests and Wood Mackenzie estimate, reference 85 · Exelon's 2040 portfolio and CenterPoint's jump from 1 to 25 GW in twelve months, reference 71 · US generation interconnection queue, reference 73 · ERCOT evaluates over 233 GW with more than 70% of data centers, reference 72

Two-thirds of announced electricity demand will never be built
Concepto	Requested or announced	What will remain
US data centers (Wood Mackenzie)	1,066 GW	≈ 298 GW
Exelon's 2040 portfolio	65 GW	≈ 14.3 GW (22%)
US generation interconnection queue	≈ 2,600 GW active (as of 2023)	2,061 GW (as of 2025)

The second big correction is nuclear, and it's the one that hurt me the most. Compare the announcement column to the actual date column in the table.

Microsoft-Crane/TMI, reference 77 · Amazon-X-energy Cascade, reference 78 · Google-Kairos Hermes 2, reference 79 · Meta-TerraPower/Oklo/Vistra, reference 80 · Meta-Constellation Clinton, reference 81

Agreement	Announced capacity	Actual status as of August 2026	New energy to the grid?
Microsoft — Crane / Three Mile Island	—	—	—
Amazon — X-energy, Cascade project	960 MWe	The 960 MWe is the maximum theoretical option; construction won't start before the end of the decade	No
Google — Kairos, Hermes 2	Up to 50 MW for TVA	Groundbreaking in April 2026	Not yet
Meta — TerraPower, Oklo and Vistra	Up to 6.6 GW by 2035	Of those 6.6 GW, 2.1 GW are existing plants that will only have their life extended	Partial: 2.1 GW is not new capacity
Meta — Constellation, Clinton	1,121 MW from June 2027	Of the 1,121 MW, only 30 MW are new due to uprate	Only 30 MW

The nuclear agreements of the hyperscalers: what was announced versus what's connected
Agreement	Announced capacity	Actual status as of August 2026	New energy to the grid?
Microsoft — Crane / Three Mile Island	—	—	—
Amazon — X-energy, Cascade project	960 MWe	The 960 MWe is the maximum theoretical option; construction won't start before the end of the decade	No
Google — Kairos, Hermes 2	Up to 50 MW for TVA	Groundbreaking in April 2026	Not yet
Meta — TerraPower, Oklo and Vistra	Up to 6.6 GW by 2035	Of those 6.6 GW, 2.1 GW are existing plants that will only have their life extended	Partial: 2.1 GW is not new capacity
Meta — Constellation, Clinton	1,121 MW from June 2027	Of the 1,121 MW, only 30 MW are new due to uprate	Only 30 MW

Microsoft: the Three Mile Island reactor, renamed Crane, still doesn't have a license; the NRC will decide in May 2027, and startup is estimated after June of that year, with no fixed connection date Crane/TMI: licencia esperada mayo 2027. Amazon: the Cascade project with X-energy involves four units and 320 MW, with an option for twelve and 960 MWe, and won't start construction before the end of the decade Amazon/X-energy: construcción al final de la década. That's where one of my errors originated: I had "Amazon 2024: 960 MW data center". Those 960 MWe are the theoretical maximum option for a project that hasn't laid a brick. Google: the first stone of Hermes 2 was laid in April 2026 and will deliver up to 50 megawatts to TVA Kairos Hermes 2: hasta 50 MW a TVA; the "seven SMR by 2030" in the draft couldn't be supported. Meta is the closest to what was promised, but it's still an announcement, not a delivery: 🟢 up to 6.6 GW for 2035 between TerraPower, Oklo, and Vistra, all towards PJM, and 2.1 of those gigawatts are existing plants that Vistra is just extending the life of Meta: hasta 6.6 GW nucleares para 2035. The only agreement with a reactor up and running and a close date is Constellation-Meta: 1,121 MW starting in June 2027, and it only adds 30 MW of new power through uprate: what it does is preserve a plant that was going to close Constellation-Meta: 1,121 MW desde junio 2027.

There's also the issue of water, which the draft didn't touch on. Google consumed 41 million cubic meters in 2025, 34% more than in 2024, replenishing around 78% of its freshwater consumption Google 2026: 41 millones de m³ de agua, +34%, with a total electricity consumption of 43.6 TWh — 42.4 TWh from data centers, compared to 30.6 TWh the previous year, almost a 39% increase Google 2026: 43.6 TWh totales, 42.4 TWh en data centers. Microsoft reports 37 TWh in its fiscal year 2025, compared to 10.8 TWh in 2020 — more than triple in five years — and 8,170 megaliters of water, 48% of which is consumed in watersheds with water stress Microsoft FY25: 37 TWh y 48% del agua en estrés hídrico.

Here's what changes the thesis: it's not a treaty or a global regulator that's slowing down this expansion - it's local municipalities. At least 75 projects worth around $130 billion were blocked or delayed in just the first quarter of 2026, which is as much as in all of 2025. Opposition groups have more than doubled and are now present in 49 states, with over 300 state initiatives introduced in just six weeks, and Maine was just one vote away from becoming the first state to ban this Data Center Watch: 75 proyectos, 130 mil MDD en 1T26. Not even the flagship project is immune: Oracle and OpenAI abandoned their plans to expand the 600 MW Stargate project in Abilene in March 2026 Stargate Abilene: cancelación de 600 MW. The closest thing to prudent oversight came from the FERC, which declared PJM's tariff unfair and unreasonable in December 2025 due to the lack of co-location rules and ordered them to create three new services FERC 193 FERC ¶ 61,217: PJM sin reglas de co-ubicación. A tariff dispute ended up being the closest thing to a central bank that this layer has.

The 63% that does exist and the 24.9% that should scare us more

In the draft table, I listed "Public cloud/CDN: AWS + Azure + GCP + Cloudflare, 63% combined". This is incorrect, as it lumps together two layers that behave differently. The 63% refers only to the three hyperscalers - Amazon 28%, Microsoft 20%, and Google 15% in the second quarter of 2026 - out of a $143.4 billion quarterly market, with 12-month rolling revenues over $500 billion and 43% year-over-year growth, the highest in eight years Synergy Research Group (primaria). The previous quarter, the numbers were 28/21/14 out of $128.6 billion, with 35% growth Synergy Research Group (primaria). What's notable is not that the market share moves by a point, but that the market gained eight points of rate in just three months. It's concentrating as it grows.

Underneath the revenue is the ironclad quota that decides what happens when something goes down: the three hyperscalers concentrate 57% of the world's total hyperscale capacity, and twenty state or metropolitan markets concentrate 60% of the world's total hyperscale capacity - not just the 57% of the three. Of those twenty markets, fifteen are in the United States and only one is in Europe Synergy Research Group (primaria). When we see European parliaments discussing how to opt out later, it's worth remembering: this isn't a problem of contracts, it's a problem of concrete geography.

And then there's Cloudflare, the box I understood the least. It's not a fourth hyperscaler, but another layer, with much higher concentration. It's in front of 24.9% of all websites on the planet, which is 84.5% of the reverse proxy market; the second is Amazon CloudFront with 1.7% of sites and 5.7% of the segment, followed by Fastly (0.9%), DDoS-Guard, and Akamai (0.7% each) W3Techs (primaria, panel propio). That's 84 to 5. In authoritative DNS, the pattern repeats, albeit more subtly: Cloudflare 18.1%, GoDaddy 9.9%, Hostinger 4.5% W3Techs (primaria, panel propio). I'm leaving a warning about the other layer of DNS: verifying the governance angle of domain names debunked what I claimed in the draft - that the US Department of Commerce still approves changes to the root zone. That ended with the IANA transition on October 1, 2016, and the relevant section will cover it in depth. Authority over domain names and concentration of domain name services are different things; I got them mixed up.

W3Techs, reverse proxy services panel (August 28, 2026) · W3Techs, DNS servers panel

Eighty-four to five: the layer that almost no one looks at
Concepto	Valor
Cloudflare	84.5%
Amazon CloudFront	5.7%
Fastly	3.1%
DDoS-Guard	2.5%
Akamai	2.3%
Rest	1.9%

Formal measurement confirms intuition: the Herfindahl-Hirschman index of the CDN market rose from 2,448 to 3,410 since June 2021 among the 10,000 most visited sites - above 2,500 is already considered high concentration, and the DOJ and FTC's 2023 Merger Guidelines lowered that threshold to 1,800 - and the Internet Society warns that the top three in each category can affect 50-70% of all sites Internet Society Pulse (secundaria confiable). I also correct an omission: I had given this layer an index of 7, but with these numbers, that's too low. And a correction for hygiene: the draft claimed Cloudflare's scale using stats from an SEO aggregator - "over 20% of global traffic", "41.88 million sites". Verification debunked all of those: a site with no methodology or traceable primary source. I replaced them with W3Techs.

Internet Society Pulse, on consolidation (Nov 2025) · DOJ and FTC, Merger Guidelines (Dec 18, 2023)

The CDN thermometer reads 3,410; the DOJ alarm sounds at 1,800
Indicador	Valor
HHI of the CDN market among the 10,000 most visited sites	3,410

Cloudflare, 1.1.1.1 incident on July 14, 2025 · Amazon Web Services, incident summary on October 19, 2025 · Cloudflare, November 18, 2025 outage · Cloudflare, Venezuelan route leak · Cloudflare, January 22, 2026 route leak

Twelve months of decline in the invisible layer (Jul 2025 - Jan 2026)
Año	Hecho
July 14, 2025	Cloudflare's public resolver 1.1.1.1 is down for 62 minutes.
October 19-20, 2025	A DNS failure in DynamoDB takes down AWS services for two days.
November 18, 2025	Cloudflare: Bot Management fails from 11:20 to 17:06 UTC.
January 2, 2026	CANTV hairpin leak in Venezuela; Cloudflare concludes it was probably an accident.
January 22, 2026	Cloudflare's BGP route leak from Miami, 25 minutes.

So, why does this matter? Because I've got the whole year documented. On October 19, 2025, AWS went down due to what its own postmortem called "a latent race condition in the DynamoDB DNS management system that resulted in an incorrect empty DNS record for the service's regional endpoint". This empty DNS record spread to Lambda, ECS, EKS, Fargate, Connect, STS, IAM authentication, and Redshift Amazon Web Services (primaria). A month later, Cloudflare was hit: a database permission change caused a query to return duplicate metadata, and the Bot Management feature file "doubled in size", exceeding a hard limit of 200; CDN, security, Turnstile, Workers KV, the panel, Access, and Email Security all went down for nearly six hours, and the company wrote it off without sugarcoating: "an outage like this is unacceptable" Cloudflare (primaria).

None of these were attacks, and the next three incidents don't show any signs of being attacks either. On July 14, 2025, the 1.1.1.1 resolver was down for 62 minutes due to a configuration error that linked its prefixes to a pre-production topology; when 1.1.1.0/24 was withdrawn, Tata Communications announced it, although that hijacking wasn't the cause Cloudflare (primaria). On January 22, 2026, an overly permissive export policy on a Miami router caused Cloudflare to leak prefixes for 25 minutes, peaking at around 12 Gbps Cloudflare (primaria). And on January 2, CANTV took Sparkle's routes and redistributed them to V.tal GlobeNet in a "hairpin"-style leak; the diagnosis is that the operator "has insufficient routing export and import policies" and that it was probably an accident - as Cloudflare writes, in the conditional tense - with the chilling detail: "since the beginning of December alone there have been eleven route leak events where AS8048 is the leaker" Cloudflare (primaria). Here's the counterpoint, because otherwise this is just alarmism: Doug Madory argues that many reported leaks are "ephemeral leaks" that only exist during convergence - in his 2026 examples, no message circulated for more than one or two seconds - and that automated detection inflates the count by flagging each message Madory / Kentik en APNIC Blog (secundaria confiable). Not every tremor is an earthquake.

The defense is called RPKI, and it's halfway there: of the observed prefixes, 45.38% are valid, 1.29% are invalid, and 53.33% are simply unknown Cloudflare Radar (primaria, panel en vivo). Traffic to valid routes increased from 56.4% to 62.5%, and the reason is revealing: most traffic goes to signed routes, even though only about four out of ten routes are signed (43.2% in IPv4 and 45.2% in IPv6 at the time of measurement), because major content providers have already finished their rollout Kentik (secundaria confiable). Translation: routing security has also become concentrated. A Tsinghua study that measured over 200 invalid prefixes across over 1,600 ASes found that only ~27% achieve nearly complete protection, and 30.4% maintain permissive stances; among Tier-1 providers, Deutsche Telekom filters 99.1% and AT&T filters 98.7%, but Level 3 diverts traffic to invalid origins in more than half of cases Tian et al., Universidad de Tsinghua (preprint arXiv). The FCC tried to regulate this: it would require nine major providers to have confidential BGP risk management plans with goals and quarterly reports FCC, Estados Unidos (primaria). The same "winner-takes-almost-all" logic appears in exchange points: Akamai leads with 79 Tbps deployed in 248 exchanges, Meta has 69.4, Amazon has 51.2; Cloudflare is the most connected network, present in 352 Hernandez / APNIC Blog (secundaria confiable).

The new development in this draft is that regulators are now treating these companies like what they are. The Bank of England, PRA, and FCA started supervising the first "Critical Third Parties" on July 13, 2026 — AWS EMEA, Google Cloud EMEA, Microsoft Ireland, and Oracle UK — defined as providers whose failure "could threaten the stability of, or confidence in, the UK financial system" FCA, Reino Unido (primaria). In the European Union, the three authorities designated critical TIC providers under DORA in November 2025, evaluating systemic importance and substitutability Autoridad Bancaria Europea, EBA (primaria). This is prudential supervision applied to the cloud: exactly what I left as an open question. Although the British outcome is chilling: the CMA closed its market investigation on July 31, 2025, concluding that AWS and Azure have up to 40% each and "substantial and entrenched market power", and recommended opening Strategic Market Status investigations into both; the case file doesn't go further than saying that the council expected to decide in the first quarter of 2026 which option to prioritize CMA, Reino Unido (primaria). And the fact that worries me the most: Cloudflare billed $696.1 million in the second quarter of 2026 with a GAAP operating loss of $205.7 million, 30% of its revenue Cloudflare / SEC 8-K (primaria). A company that doesn't even reach $3 billion annually and loses money is the single point of failure for a quarter of the web.

Two factories in Germany

I wrote this section with the phrase that an ASML mirror enlarged to the size of Germany would have irregularities of less than a millimeter. It's a beautiful image, and I had to take it out: it's not in the Form 20-F or any primary source from this angle. What I did find, reading that complete annual report to the SEC, is a drier and more terrifying phrase. Carl Zeiss SMT is the sole supplier of lenses, mirrors, illuminators, collectors, and other critical optics, with an exclusive arrangement, and ASML writes in its own risk file that if Zeiss were to end the relationship or not be able to sustain production for an extended period, "we would effectively cease to be able to conduct our business" 20-F: Zeiss proveedor único de óptica.

We would effectively cease to be able to operate our business. That's what the company that manufactures 100% of the planet's EUV machines says about its supplier. And the supplier is not a vague conglomerate: note 26 specifies that Zeiss SMT can develop and produce those optical columns "only in limited numbers and only through the use of manufacturing and testing facilities in Oberkochen and Wetzlar, Germany", under the principle of "two companies, one business" 20-F Nota 26: dos plantas en Alemania. Two plants. The entire digital economy hangs on two postal addresses in Baden-Wurtemberg and Hesse.

The financial link is deeper than I thought. ASML has owned 24.9% of Carl Zeiss SMT Holding since 2016, when it paid one billion euros in cash plus around 220 million in R&D and 540 million in capex over six years, with the explicit goal of developing High-NA optics 2016: compra del 24,9% de Zeiss SMT. As of the end of 2025, it also has three loans: two lines of up to one billion each — $839.1 million drawn from the 2021 line and $610.0 from the 2024 line — and a third of 444 million euros granted in July 2025; and it recognized $322.8 million in profit from its participation plus a $320.5 million dividend 20-F: préstamos y participación en Zeiss. The single customer finances its single supplier so that it remains its single supplier. It's not a supply chain: it's an organism with two heads.

There's a third partner that the draft didn't mention: TRUMPF. The laser amplifier that powers the EUV source has 40 kilowatts and fires 50,000 pulses per second against 50,000 tin droplets per second, amplifying the pulse more than 10,000 times; TRUMPF itself describes the technology as the work of three companies that together brought it to industrial maturity TRUMPF: láser de 40 kW. In April 2025, ASML achieved the first 1,000-watt EUV light source, after 25 years of accumulated engineering, and by the end of the year, its customers had run over 400,000 wafers on High-NA systems 20-F: fuente de 1.000 W y 400.000 obleas High NA.

Now, let's talk about price corrections - the kind I like because the real data is better than what I initially had. I previously wrote "High-NA EXE: 5000: ~380 million dollars per unit". But the sales table by technology tells a different story: in 2025, ASML reported 1,156.9 million euros for four EXE systems - that's an average of 289.2 million euros. The 44 NXE systems averaged 237.4 million euros, the 131 ArF immersion systems averaged 78.7 million euros, and the i-line systems averaged 5.7 million euros. A High-NA machine costs about 51 times more than an i-line machine 20-F: ingresos por tecnología y precios derivados. With a caveat: these are recognized revenues per unit, not list prices, and the document itself warns that "fast shipments" can delay recognition. The volume isn't what you'd imagine for the bottleneck of civilization: "we derive most of our revenues from the sale of a relatively small number of lithography systems (327 units in 2025, 418 units in 2024, and 449 units in 2023)" 20-F: 327 sistemas en 2025. Just 327 machines per year support everything, and that number is decreasing. The business behind it: 32,700 million euros in sales, 52.8% gross margin, 9,600 million euros in net income, and 38,800 million euros in backlog at the end of 2025 Resultados 2025 y guía 2026.

ASML's units and revenue per system in 2025, and warning about fast shipments, references 2 and 5 · Total of 327 systems in 2025, compared to 418 in 2024 and 449 in 2023, reference 3

The less the machine is sold, the more it costs: 51 times from i-line to High-NA
Units sold in 2025	Average revenue per unit (M€)	Etiqueta
4	289.2	EXE / High-NA
44	237.4	NXE
131	78.7	ArF immersion
78	12.8	KrF
54	5.7	i-line

ASML's net sales by region in 2025, reference 7 · The export license applies to EUV systems, certain DUV immersion systems, and some other products, not the entire revenue, reference 4

Where ASML sells: 79.6% in three jurisdictions
Segmento	Valor
China	9,519.7 M€
Taiwan	8,337.9 M€
South Korea	8,159.6 M€
United States	4,089.1 M€
Japan	1,420.9 M€
Singapore	608.4 M€
EMEA	524.3 M€
Netherlands	4.7 M€

Geography is the geopolitical heart, and it wasn't in my initial draft. In 2025, China accounted for 29.1% of net sales, Taiwan for 25.5%, and South Korea for 25.0%: almost 80% of revenue comes from just three jurisdictions. The 20-F report specifies the scope of control, which isn't total: under Dutch, US, and other laws, ASML requires an export license for EUV systems, certain DUV immersion systems, and some other products 20-F: licencias y 79,6% en tres jurisdicciones. In euros, that's China with 9,519.7 million, Taiwan with 8,337.9 million, South Korea with 8,159.6 million, the US with 4,089.1 million, and the Netherlands - where manufacturing is concentrated - with 4.7 million, although there are 5,342.4 million euros in long-term assets. And that's not all: the US also contributes another 1,380.4 million euros in fixed assets 20-F: ventas y activos por región. The country hosting the monopoly is the one that buys the least from it.

Regarding who's in charge, I found two things that correct my initial draft. First: the licensing authority has already moved. Since September 7, 2024, the NXT:1970i and 1980i immersion systems require a Dutch license - the NXT:2000i and later models already did - a change that ASML described as "a technical change" with no financial impact 2024: la licencia pasa de Washington a La Haya. Second: be careful with dates, even those published by the company itself. ASML writes that the Dutch controls are "effective January 15, 2025", but the government announced that day that they would take effect on April 1 Países Bajos: controles vigentes desde abril 2025; and with the Affiliates Rule - which automatically restricts any entity owned by at least 50% by someone on the Entity List BIS Affiliates Rule (regla del 50%) - the 20-F report contains two incorrect dates: it says "October 1, 2025" when it was published on September 30, and it says the suspension is "until November 10, 2026" when it actually runs from November 10, 2025, to November 9, 2026 Suspensión de un año de la Affiliates Rule. If the issuer makes a mistake in its own annual report, anyone can repeat the error in good faith: that's why its complete chronology remains 20-F: cronología de controles (fechas en disputa).

I've got two corrections to make. I wrote "Nikon and Canon tried and failed": that's not true in the present tense. ASML has about 90% of the ArF immersion market — not "over 80%" like I said —, Nikon sold 11 systems in their 2024 fiscal year and is aiming to deliver a next-gen prototype in 2027 with a collaboration that extends beyond 2030. On the EUV side, there aren't any announced competitors Nikon: el competidor residual en DUV. The CSIS is sober about the Chinese alternative: SMEE has 4% of the i-line equipment market, SMIC's 7nm achievement was done with accumulated DUV before the controls, the 5nm rumors "have been disproven", and EUV remains "firmly out of reach despite massive state investment" CSIS: veredicto sobrio sobre litografía china. TrendForce adds some texture: 🟡 SiCarrier patented quadruple patterning with DUV for "5nm-class" performance without EUV, there's an alternative plasma etch path reportedly developed by Harbin Provincial Innovation and tested at Huawei's Dongguan facilities — the source hedges with "believed" and "reportedly" —, and the forecast is that they won't reach sub-10nm production before 2030, with SMIC's 5nm wafers yielding only 33% TrendForce: DUV chino y la vía LDP. I also removed the episode from August 2026 where the US Secretary of Commerce allegedly pressured ASML's management: I couldn't find it supported in the 20-F or primary sources, and an accusation like that requires more than that.

Twenty-five countries looking for the emergency exit

This is the section where fact-checking did the most damage to the draft. Let's start with Mexico: I had written "ATDT created in 2024". The Interior Regulation of the Agency for Digital and Telecommunications Transformation was published on January 24, 2025, with the attribution of "leading the national policy on technological sovereignty for the digitization of procedures and services" and the operation of a public software factory Diario Oficial de la Federación (México), 2025. The 2025-2030 Sectoral Program goes further — it proposes a Data Center and a Government Cloud to reduce dependence on private providers —, but it sets the context that no strategy can skip: 20,355,270 people without internet, 99.72% urban coverage vs 61.32% rural and only 46.37% in indigenous communities Programa Sectorial ATDT 2025-2030, DOF, 2025. Technological sovereignty for twenty million people who still don't have a connection.

Diario Oficial de la Federación, Reglamento Interior de la ATDT (Jan 24, 2025) · Programa Sectorial ATDT 2025-2030 · Sénat français, Rapport n°830 (Jul 2025) · Tweede Kamer, motion 26643-1315 (Mar 2025) · Government of Schleswig-Holstein (Dec 2025) · NITDA, National Cloud Policy 2025 · Ellipsis, summary of South Africa's National Policy on Data and Cloud (GG 50741) · Reserve Bank of India, circular from April 2018 · Vietnam Business Law, Decree 53/2022 · Baker McKenzie, Global Data and Cyber Handbook (Saudi Arabia) · Gün + Partners, analysis of Law 5651 · The Korea Herald, fire at the NIRS in Daejeon · SubmarineNetworks and DFAT, Coral Sea Cable System · Observatorio Privatech, Universidad Externado, on CONPES 4144 · Buenos Aires Times, on Stargate Argentina

What each country is really doing: digital sovereignty measured by instrument
	Data localization	Sovereign cloud	Software migration	Physical infrastructure
Mexico	0	3	2	2
France	0	1	1	0
Netherlands	1	2	1	0
Germany (Schleswig-Holstein)	0	0	3	0
Nigeria	3	3	0	1
South Africa	3	3	0	0
India	3	0	0	0
Vietnam	3	0	0	0
Saudi Arabia	3	3	0	0
Turkey	2	0	0	0
South Korea	0	3	0	3
Australia	0	0	0	3
Colombia	0	1	0	1
Argentina	0	0	0	1

In Europe, the conversation moved from rhetoric to budget. The French Senate deposited the Rapport n° 830 in July 2025, whose title is already a thesis: "L'urgence d'agir pour éviter la sortie de route". It documents 230 million euros spent on Microsoft in 2024, 100 million on Oracle, and 146 million accumulated in cloud since 2020, out of a total state IT expenditure of 4,500 million; Education renewed licenses for almost 75 million, with a ceiling of 152 Sénat français, Rapport n°830, 2025. It was triggered by a hearing: 🟡 when asked under oath if Microsoft would never transfer French citizens' data to the US government without consent from French authorities, its public affairs director replied that he couldn't guarantee it Sénat français, audition Microsoft, 2025. And it's the Rapport n°830, not the hearing, that qualifies the choice of Microsoft for the Health Data Hub as a "erreur caractérisée, si ce n'est une faute politique" Sénat français, Rapport n°830, 2025.

In the Netherlands, something unprecedented happened: motion 26643-1315 states that "total dependence on American tech giants poses a danger to the autonomy and cybersecurity of the Netherlands" and asks to stop migrations of government IT to US clouds unless independently verified. The government advised against it — "ontraden" — and the parliament approved it anyway, 85 to 65, along with motions to repatriate the .nl domain and demand a strategy to exit all systems hosted with US tech companies Tweede Kamer (Países Bajos), Motie 26643-1315, 2025. In Germany, there's actual migration, not just planning: Schleswig-Holstein reported in December 2025 that about 80% of its state administration's positions outside the tax area already use LibreOffice, after moving around 44,000 mailboxes, with annual savings of over 15 million euros versus a one-time cost of 9 million Gobierno de Schleswig-Holstein, 2025.

Now, the corrections - four of them, and all are important. **Brazil:** I had mentioned the Medida Provisória of ReData as a current digital sovereignty policy; however, the Congressional record marks it as "SEM EFICÁCIA" — with 155 amendments, a postponement in November 2025, and expiration on February 27, 2026, without becoming law — and the figures I cited are not found in the record. Publishing it as current would have been an easily refutable error. **Kenya:** The draft stated that its data localization rules were in effect since February 2022 and covered "primary or secondary healthcare"; the source is from December 2021 and describes proposed regulations, the trigger is not "strategic interest of the state" but "actualizing a public good", and the reference to primary and secondary is about education, not healthcare. Three errors in one line. **Indonesia:** The correction I was going to publish — that only public operators must localize data — is not supported by the cited source, which states the opposite; the correction falls apart, not just the data. **Canada:** I couldn't support the percentages I provided. The legal argument remains: an executive agreement under the CLOUD Act would allow US authorities to obtain Canadian data with standards that Canadian courts declared unconstitutional, without judicial review or notification Appleton, "Whose Law Governs Canadian Data?", SSRN.

The toughest mandates came from the Global South. Nigeria published its National Cloud Policy in October 2025 with "Mandatory" compliance, and section 4.3 leaves no room for interpretation: Level 3 and 4 sovereign data "shall be hosted exclusively within Nigeria", with exemptions only through a verifiable strategic investment waiver NITDA (Nigeria), National Cloud Policy 2025. South Africa did it earlier: government data related to security and national sovereignty "shall be stored only in digital infrastructure located locally", and its data centers cannot be built on heritage sites or land reform areas Ellipsis, síntesis de la National Policy on Data and Cloud (GG 50741), 2024.

In Asia, the model is sectoral. The Reserve Bank of India's 2018 circular requires that all payment system data be stored "in a system only in India", with complete end-to-end details Reserve Bank of India, Circular 2018. Vietnam has required its domestic telecom, cloud, payment, and social media companies to store data in the country since October 2022; for foreign companies, the requirement is triggered by a request from the Ministry of Public Security Vietnam Business Law, 2022. Saudi Arabia prohibits public sector data from leaving the Kingdom for any purpose, including caching, redundancy, or backup Baker McKenzie, Global Data and Cyber Handbook (Arabia Saudita). And Turkey — another correction: I couldn't support the claim of a "prohibition on cloud services for public institutions since July 2019" — does require social media platforms with over a million daily accesses to appoint a local representative and store data in the country, with an interesting detail: for this requirement, "no explicit penalty was provided", unlike the hefty fines that exist for other obligations Gün + Partners, análisis Ley 5651 (Turquía).

South Korea needs to be recounted because I got it wrong. The fire started on September 26, 2025, in a lithium-ion battery at the NIRS data center in Daejeon, taking out 647 services: 96 destroyed by the fire and 551 shut down preventively; three days later, only 73 had been restored. The critical gap was the lack of a twin-server architecture, which prevented automatic failover The Korea Herald, 2025. I had written that "of 96 affected systems, 95 had backups and that one didn't". That's not true: 858 terabytes of the G-Drive system were lost, representing eight years of work by 125,000 officials, and authorities admitted there were no backups because the system was "too large" to back up DataCenterDynamics, 2025. It's worse than my version: the system that lost those 858 terabytes simply had no backup, and the reason authorities gave was its size.

The Korea Herald, on the fire at the NIRS in Daejeon · DataCenterDynamics, on the 858 TB from the G-Drive

Six hundred forty-seven services down and 858 terabytes without backup
Etapa	Valor
Government services out of operation	647
Preventive shutdowns	551
Directly destroyed by fire	96
Restored by September 29	73
Critical Grade 1 systems back online	20 out of 36 (55.6%)

The Pacific confirms the geopolitical aspect. The Coral Sea Cable System was 66.7% funded by Australia, with a contract worth around $136.6 million to Vocus; the project had been awarded to Huawei Marine in 2017, which had already signed with the Solomon Islands' state-owned company, until Australia stepped in and offered to co-fund it SubmarineNetworks, Coral Sea Cable System. The reason, as stated bluntly by the Lowy Institute, was that the cable would have connected Chinese hardware to the backbone of Australia's domestic internet, "that was seen as a red line that Australia would not cross and so we jumped in with a better deal" ABC News Australia, 2021. Australia also maintains a center for cable resilience in the Indo-Pacific DFAT (Australia), Cable Connectivity and Resilience Centre.

I'll conclude with two cases that best illustrate the gap between announcement and action. Colombia approved its national AI policy, CONPES 4144, in February 2025, which outlines its goals until 2030, and the document itself acknowledges that "Colombia lacks a solid infrastructure to develop and operate AI systems efficiently and sustainably" Observatorio Privatech, Universidad Externado, 2025. And Argentina, which I described as "lacking a coherent strategy", did make a big announcement: "Stargate Argentina", presented in October 2025, a Patagonian data center with up to 500 MW and a $25 billion investment under a 30-year tax benefit regime. By mid-2026, it was still just a letter of intent: no binding contracts, no funding, no site, no permits, and it hadn't even been presented to the Argentine government Buenos Aires Times, 2026. Twenty-five billion dollars in announced sovereignty, zero cubic meters of concrete.

The layers I hadn't counted

When I finished the draft, I thought I had nine layers. I was missing six, and one is the most fragile of all. Everything that follows is new.

I'll start with the one that kept me up at night. The entire encrypted web – the little padlock – relies on certificates, and most of them are issued for free by a non-profit organization. In her year-end letter, the executive director of ISRG writes that Let's Encrypt went from serving 492 million sites to 762 million in a year, that it issues "ten million certificates on some days", that when it started, 39% of page loads were encrypted, and today, in many parts of the world, over 95% are, and – the fact that needs to be read twice – that the organization is "100% supported through the generosity of those who share our vision" Let's Encrypt: 762 millones de sitios, 100% donativos. The cryptographic root of about two-thirds of the planet's websites is an NGO funded by donations.

And who decides which certificates to trust isn't a regulator either. The Chrome Root Program policy requires that included certificate authorities provide value that exceeds the risk of their presence; with that criteria, Google removed default trust from the roots of Chunghwa Telecom, from Taiwan, and NetLock, from Hungary, citing "a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress" Chrome Root Program remueve Chunghwa y NetLock. The biggest precedent is Entrust: in June 2024, Google announced it would no longer trust its roots, and Apple and Mozilla did the same weeks later, after Entrust had misissued 26,668 EV certificates between September 2023 and March 2024, and, 70 days later, had only revoked around 75% of them, despite a required five-day deadline Distrust de Entrust por Chrome (jun 2024). A private company removed another from the global trust map by its own decision, with a blog post announcement. There's no court, no appeal, no Basel. It's exactly the thesis of this piece, and I had it outside.

The second missing layer is time - not connectivity, but time. A study commissioned by NIST and conducted by RTI estimates that losing GPS service would cost the US economy $1 billion per day, with a 30-day outage during planting season potentially reaching $45 billion, and puts the cumulative benefit of GPS since the 1980s at $1.4 trillion NIST/RTI: GPS vale $1,000 millones al día. What makes this a structural dependency is that it's mandated: FINRA Rule 4590 requires businesses to sync their clocks with a designated source, and MiFID II's RTS 25 demands accuracy to within 100 microseconds for high-frequency operators, accepting GNSS as a traceable source to UTC FINRA 4590 y MiFID II RTS 25: el tiempo es obligatorio. Financial regulations require dependency on a satellite signal, which is degrading: GPS loss events increased by 220% between 2021 and 2024, and a joint EASA and IATA plan from June 2025 recommends "maintaining a backup for GNSS with a minimum operational network of traditional navigation aids" IATA/EASA: eventos de pérdida de GPS +220%. The official recommendation is to go back to radio beacons. The US recognized this as early as 2020, when Executive Order 13905 stated that disruption or manipulation of positioning, navigation, and timing services can affect national and economic security Orden Ejecutiva 13905 sobre PNT.

Arm, investor materials · CSIS, on Chinese restrictions on rare earths · CMA, mobile ecosystem study (2022) · Mordor Intelligence, silicon wafer market · TrendForce, OSAT ranking (May 2025) · CSIS citing Reuters, on Ukrainian neon (Mar 2022) · Ajinomoto, Build-up Film · ISRG / Let's Encrypt, 2025 year-end letter

The missing layers: concentration of invisible infrastructure
Concepto	Valor (%)
Arm · smartphone CPU	>99%
China · heavy rare earth processing	99%
Play Store · Android downloads	>90%
Five manufacturers · 300 mm wafers	85%
ASE + Amkor · assembly and testing (top 10 OSAT)	~60%
Ingas + Cryoin · semiconductor-grade neon	45-54%

The third point demonstrates the argument in practice, with a specific date. In May 2025, the Bureau of Industry and Security sent "is-informed" letters to Synopsys, Cadence, and Siemens EDA, stating that a license is now required for the export, re-export, or in-country transfer of EDA software when a party is in China. Synopsys suspended its financial guidance. On July 2, the BIS revoked the restriction BIS enciende y apaga el EDA en cinco semanas. Five weeks of being turned on and off: without this software, no modern chip can be designed, and three companies proved to be an operable switch controlled from Washington. Here's another correction: I was going to publish that these three companies account for around 74% of the market (31, 30, and 13%). Verification showed that the quote is not in the source it was attributed to, and that source says something different and stronger. Since the number didn't hold up, I won't publish any: I'll stick with the demonstrated fact, which is the switch.

gps.gov, Executive Order 13905 on PNT · Google Security Blog, distrust of Entrust (Jun 2024) · MOFCOM, Announcement No. 18 (Apr 2025) · Kirkland & Ellis, on the BIS "is-informed" letters · CMA, Apple mobile platform case (Oct 2025) · Google, changes to the Chrome Root Store

The switches that turn off with a letter or a blog post
Año	Hecho
Feb 2020	Executive Order 13905 recognizes that manipulating position, navigation, and time services affects national and economic security.
Jun 27, 2024	Chrome announces distrust of Entrust roots; Apple applies it after November 15 and Mozilla after November 30.
Apr 4, 2025	MOFCOM Announcement No. 18 imposes immediate licensing on seven medium and heavy rare earths and their magnets.
May 2025	The BIS sends "is-informed" letters to Synopsys, Cadence, and Siemens EDA, demanding licenses.
Jul 2, 2025	The BIS revokes the restriction five weeks later.
Oct 22, 2025	The CMA designates Apple and Google as having "strategic market status".

The fourth layer is the intellectual property of the architecture. Arm claims that its CPUs have enabled advanced computing in more than 99% of smartphones sold in the fiscal year ending March 31, 2025, and that its customers have cumulatively shipped over 310 billion Arm-based chips Arm: >99% de smartphones, 310 mil millones de chips. A SoftBank-controlled intellectual property licensor collects royalties on almost every phone on the planet without manufacturing anything.

The fifth layer is the gateway through which software reaches the user. The UK's CMA described it bluntly: the App Store is the only way to access native apps on iOS, "so it has a monopoly," and although alternative stores can be pre-installed on Android, they face barriers to attracting developers and users; both are "must-have trading partners" CMA 2022: duopolio de tiendas de apps. More than 90% of downloads on Android come from the Play Store, and the report calls the arrangement a "stranglehold over these key gateways" where both companies unilaterally set "the rules of the game" CMA 2022: 90% de descargas Android vía Play Store. There was a response: on October 22, 2025, the CMA designated Apple and Google as having "strategic market status" in mobile platforms, the first full application of the British regime, after the European Commission had already designated them as core platform services under the DMA in 2023 Designación SMS de la CMA (oct 2025).

The sixth one is materials, the most physical aspect. Until 2023, China controlled 99% of the world's processing of heavy rare earths, with minimal production in a Vietnamese refinery that has been closed for a year; even Lynas, the largest non-Chinese producer, sends its oxides to China for refinement CSIS: China procesa 99% de tierras raras pesadas. On April 4, 2025, the Chinese Ministry of Commerce imposed an immediate export license on seven medium and heavy rare earths — samarium, gadolinium, terbium, dysprosium, lutetium, scandium, and yttrium — and their permanent magnetic materials MOFCOM Anuncio No. 18: siete tierras raras. Below that, there are three more bottlenecks, all yellow: 🟡 Ajinomoto's ABF substrate, the material of choice for "nearly all high-performance CPUs" Ajinomoto Build-up Film (ABF); 300mm wafers, where five manufacturers control about 85% of global capacity and the two Japanese companies combined account for more than half of the world's volume Obleas de 300 mm: cinco fabricantes, 85%; and neon, where Ukraine supplied about 70% of the world's neon before the war Neón ucraniano: el peso de Ucrania, with two companies — Ingas and Cryoin — that, according to a Reuters report on March 11, 2022, covered between 45% and 54% of the world's semiconductor-grade neon and stopped shipments after the invasion.

There's a seventh one that comes with nuances: assembly and testing. The top ten OSATs billed $41.56 billion in 2024, and ASE took $18.54 billion — almost 45% — with Amkor second at 15.2%: two companies control about 60% of the last physical step before a chip reaches a board OSAT: ASE + Amkor ~60% del top 10. I'm framing this with nuances because ASE is Taiwanese: that risk overlaps with the risk of Taiwan, which the piece already covers, and counting it twice would inflate the tally.

Bits&Chips, on ASML and Nikon · US Department of Commerce / ITA (Dec 2025) · Observer Research Foundation, Special Report No. 304 (Apr 2026) · DRAM antitrust lawsuit, paragraphs 202-203 · W3Techs, reverse proxy panel · SpaceX, Form S-1 with the SEC (May 2026) · CSIS, on rare earths · Arm, investor materials · Synergy Research Group, cloud market · W3Techs, certificate authorities · Verisign, Form 10-Q Q2 2026 and Domain Name Industry Brief · DOJ and FTC, Merger Guidelines of Dec 18, 2023

I'll wrap up with what I decided not to include, because in a piece about concentration, it's essential to say where it's not present. I considered opening a layer on domain registrars and discarded it: GoDaddy, the world's largest, has only 12.27% of the market, with Namecheap second at 2.78% and over 2,400 registrars accredited by ICANN; that's fragmentation, and the real bottleneck is in the registration of .com and the DNS root, which the piece already covers Descarte: registradores de dominio. I also discarded giving a separate section to email CAs and S/MIME: the concentration there is the same as in web PKI — Let's Encrypt issues certificates for 64.4% of all sites, according to W3Techs — so I merged it into the trust layer Descarte: CA de correo / S-MIME. I initially saw nine layers, but there are fifteen, and the most fragile one is sustained by donations.

Ten layers, and in all of them, the owner far exceeds the threshold that concerns the DOJ

Each axis is a layer, and the value is the share of the dominant player: ASML in EUV lithography, Taiwan in leading-edge manufacturing, Samsung + SK hynix + Micron in DRAM, Cloudflare in reverse proxy, Starlink in active maneuverable satellites, China in heavy rare earths, Arm in smartphone CPUs, AWS + Azure + Google Cloud in public cloud, Let's Encrypt in TLS certificates, and Verisign in registered domains. The inner polygon is the 30% threshold, the combined share from which the 2023 Merger Guidelines trigger a structural presumption. And here's the nuance that needs to be said out loud: this presumption is for merger control and also requires an increase in the HHI of more than 100 points; it's not a static concentration test. Reading it as if it were would be exactly the same category error that this piece criticizes the SAMCI index for.

EUV lithographyLeading-edge chipsDRAMReverse proxyActive satellitesHeavy rare earthsSmartphone CPUsPublic cloudTLS certificatesDomains

Dominant actor or block share (%)
Structural presumption threshold (30%)

Ver los datos

Ten layers, and in all of them, the owner far exceeds the threshold that concerns the DOJ
Eje	Dominant actor or block share (%)	Structural presumption threshold (30%)
EUV lithography	100	30
Leading-edge chips	90	30
DRAM	91.5	30
Reverse proxy	84.5	30
Active satellites	75	30
Heavy rare earths	99	30
Smartphone CPUs	99	30
Public cloud	63	30
TLS certificates	63.7	30
Domains	44.6	30

Bits&Chips, on ASML and Nikon · US Department of Commerce / ITA (Dec 2025) · Observer Research Foundation, Special Report No. 304 (Apr 2026) · DRAM antitrust lawsuit, paragraphs 202-203 · W3Techs, reverse proxy panel · SpaceX, Form S-1 with the SEC (May 2026) · CSIS, on rare earths · Arm, investor materials · Synergy Research Group, cloud market · W3Techs, certificate authorities · Verisign, Form 10-Q Q2 2026 and Domain Name Industry Brief · DOJ and FTC, Merger Guidelines of Dec 18, 2023

Metodología de esta investigación

This piece started as a 38-minute draft of mine and ended up being its revision. Ten parallel research lines, one per layer, consulted 660 different sources and produced 249 statements; an adversarial fact-check verified 248 and debunked 12 in red. A second audit ran over the written text, phrase by phrase, looking for figures without backing in the cited source, overinterpretations, and incorrect attributions: it found 58 issues, and all the serious ones were corrected.

Each piece of data has its confidence level: 🟢 primary source or several independent coinciding sources, 🟡 secondary source or a single specialized analysis. The traffic light for each citation was automatically aligned with the verified corpus, not based on the writer's judgment.

What cost me the most was accepting how much of my draft didn't hold up. "There is no binding international treaty to protect submarine cables" is false: the 1884 Paris Convention exists. The Starlink revenues I published were off by a factor of three, the Big Fund Chinese by a factor of seven, and the Crimea episode I attributed to Isaacson was retracted by Isaacson himself. The satellite concentration index I cited turned out to be a fabricated metric, and I dedicated an autopsy to it within the piece because the error is instructive.

Cómo investigo, en general →

Fuentes

Frequently asked questions

How many undersea cables are there in the world?

TeleGeography currently tracks over 600 active and planned cables.

Who owns most of the undersea infrastructure?

The CSIS claims that Google, Meta, Microsoft, and Amazon own or lease around half of the world's total undersea bandwidth.

What percentage of international traffic travels through undersea cables?

No primary data was found to confirm the exact percentage, but it's known that satellites account for only 0.37% of the US's international capacity.

What international treaty protects undersea cables?

The Convention for the Protection of Submarine Telegraph Cables, signed in Paris in 1884, is still in force for 36 states parties.

How many ships worldwide are dedicated to maintaining and expanding undersea cables?

There are approximately 80 ships worldwide dedicated to maintaining and expanding undersea cables, and the International Cable Protection Committee's public register lists around 63.

What's the average repair time for an undersea cable?

The average repair time in 2023 was 40 days, although in Asia-Pacific it can be as short as 30 days from notification.

What percentage of the cable ship fleet needs to be replaced before 2040?

A sector study estimates that 64% of the fleet will cross the 40-year service life threshold before 2040.

Comentarios

Sé el primero en comentar.

The internet is "Too Big to Fail" - part two: who owns everything that makes the web work