Who Owns the Code That Protects the Country?

Why Australia’s AI Sovereignty Problem Can’t Wait

In a small fire control room in regional Queensland, smoke rises faintly above a distant tree line. Within minutes a camera linked to an AI detection system spots the plume. Coordinates are locked, alerts go out, and firefighters are already moving.

This is AI at its best: fast, accurate, and life-saving.

But there’s a bigger question lurking behind the screen—where does that data go, and who controls it?

When Your Data Travels Without You Knowing

Artificial intelligence now underpins some of Australia’s most critical services: emergency response, hospital diagnostics, farm monitoring, and even parts of our defence systems. It is embedded in the machinery that keeps the country running.

Yet much of this infrastructure isn’t built here. Instead, it’s designed, owned, and hosted by foreign companies—often American. As a result, a foreign government may be able to access it, whether we like it or not.

The reason is a little-known 2018 law in Washington: the U.S. CLOUD Act. This legislation gives American authorities the power to demand data from any U.S.-headquartered company, wherever that data lives.

It doesn’t matter if it’s stored in a Sydney data centre and guarded by Australian staff. If the parent company is American, the U.S. government can reach it. This is more than a privacy issue—it’s about control. Moreover, if another country can legally access your emergency alerts, your hospital logs, or your power grid data, then you don’t fully own your own systems.

The Australian-Made Alternative

exci AI Wildfire Detection

While new arrivals make headlines with flashy promises, the first commercial AI bushfire/wildfire detection system in Australia was exci. Since 2019, exci, Australian-made and owned has detected more than 180,000 fires across the country and overseas, within minutes of ignition.

All of it is done onshore. That means AI models, servers, and data handling remain under Australian law, not subject to foreign warrants. This isn’t just a technical choice; it’s a matter of self-determination.

What Sovereign AI Really Means

• Built and owned domestically
• Hosted on national infrastructure
• Governed entirely by local laws
• Free from foreign political or investor control

Sovereignty. Image by Nick Youngson – http://www.nyphotographic.com/

Why it matters most:

• Emergency response – delays cost lives
• Healthcare – privacy breaches cost trust
• Defence & infrastructure – foreign access can compromise national security

In these sectors, “close enough” isn’t good enough.

Therefore, Sovereignty means holding the keys to the code, not renting them from someone else.

The CLOUD Act in Plain English

The U.S. CLOUD Act gives American authorities the power to demand data from any U.S.-headquartered company, no matter where it’s stored. Even if the information sits on servers in Australia and never crosses a border, it can still be accessed if the company that owns it is American.

Two situations put Australian data at risk:

• U.S. parent, offshore storage – All data is fair game for American legal orders.
• U.S. parent, local storage – Jurisdiction follows ownership, not geography.

In both cases, Australians are unlikely to be told if their data is taken. There’s no appeal, no local veto. This isn’t paranoia—it’s written into the law.

A Pivotal Legal Moment

The CLOUD Act wasn’t an accident. It followed a legal battle between United States and Microsoft Corporation over emails stored on Irish servers. The U.S. government wanted them. Microsoft refused. Eventually, the case headed for the Supreme Court.

Rather than risk a loss, Congress changed the rules entirely. It passed the CLOUD Act, giving American authorities explicit powers to demand data from U.S. companies anywhere in the world.

It was a turning point. The U.S. had hard-coded into law what privacy advocates had long feared: the globalisation of American digital jurisdiction.

Not Just an American Problem

China has similar laws granting state access to any data held by Chinese companies, even if collected abroad. When critical infrastructure is in play, those powers are not theoretical—they are operational.

This is why exci has refused foreign investment. We build and maintain everything here. Because when critical infrastructure is at stake, “mostly local” isn’t local enough.

Furthermore, sovereignty isn’t a slogan—it’s insurance.

The Rest of the World Gets It. Do We?

France is spending €109 billion on domestic AI. Denmark has its own national supercomputer. The U.S.—ironically—has committed $500 billion to keep its own AI infrastructure onshore.

Even Nvidia, the world’s leading AI chipmaker, is now telling countries to build “sovereign AI factories” tailored to local needs and laws.

Australia? We have the brains and the know-how. What’s missing is political will.

The Stakes Couldn’t be Clearer

When a bushfire breaks out, every minute matters. Likewise, when hospital records leak, public trust collapses. When defence systems are exposed, national security takes a hit.

Australia doesn’t need to own every piece of tech in the world. However, we do need to own the ones that keep us alive, safe, and independent.

A Call for Digital Self-Determination

We stand at a choice point: build, govern, and defend our own AI future—or let foreign companies and their governments hold the keys.

Sovereign AI isn’t isolationist. Instead, it’s practical. It means having the infrastructure, laws, and expertise to run our own systems without waiting for permission from someone else’s capital city.

If we don’t act, we risk becoming permanent tenants in someone else’s digital property.

On the other hand, if we do act, we secure our ability to protect lives, landscapes, and the values we claim to stand for.

by Gabrielle Tylor

exci.ai – AI powered Early Wildfire & Bushfire Detection in Minutes

AUSTRALIA

8 August 2025