Hybrid sovereignty: an interpretive category for the 21st century

Four dimensions — constitutional, economic, international, repressive-technological — of a single transformation. What it means today to exercise Italian state sovereignty in a world where threats are below-the-threshold and actors are no longer only states.

The problem: a contested sovereignty

The concept of sovereignty — Bodin's in Six livres de la République of 1576, Hobbes' in the Leviathan, Westphalia 1648 — was structured around one precise idea: the monopolistic concentration of legitimate force on one's territory (Weber), accompanied by the principle of formal equality between states. It held, with adjustments, for almost four centuries.

That architecture is today subject to a twofold centrifugal movement. From above, supranational integration — in the Italian case, membership of the European Union and the obligations of Articles 11 and 117(1) of the Constitution — has delegated significant portions of normative power to supranational venues. From below, a plurality of non-state actors has stripped the state of exclusive control over critical sectors: multinational corporations with capitalisations exceeding the GDP of small-to-medium states, digital platforms capable of shaping public opinion, transnational terrorist groups, hostile-state-sponsored hackers (the Advanced Persistent Threats).

The result is a condition that doctrine has qualified as "contested sovereignty" (Cassese, 2002) or "multi-level" (D'Atena, 2014): the fundamental political decision, the core of sovereignty according to Schmittian teaching, no longer resides univocally in the constitutional locus of the state, but is fragmented across different centres of imputation, largely removed from the circuit of democratic representation.

The hybrid threats

Complicating the picture further, the category of "hybrid threats" emerged in the second half of the 2000s, the object of study both at NATO (Bi-Strategic Command Capstone Concept 2010) and at the European level (Joint Framework on Countering Hybrid Threats, European Commission, 2016). By hybrid threat is meant the coordinated use, by a state or para-state adversary, of conventional and unconventional instruments — cyber-attacks, disinformation, economic pressure, instrumentalisation of migration flows, influence operations — below the threshold of open armed conflict, but with destabilising effects comparable to a classical war.

Three recent crises have made the phenomenon operationally intelligible: the Russian invasion of Ukraine on 24 February 2022, preceded by a systematic cyber and information campaign; Hamas' aggression against Israel on 7 October 2023; the rising Sino-American conflict over technology value chains (semiconductors, rare earths, artificial intelligence). All elements that have pushed Western constitutionalisms to question the resilience of the ordinary instruments of crisis governance.

The hypothesis: hybrid sovereignty

The expression "hybrid sovereignty" is proposed to capture in a single formula three converging trends in the contemporary Italian legal order.

First, "hybrid" alludes to the composite nature of the threats to which the sovereign apparatus is called to respond: no longer only military nor only economic nor only digital, but all of these together in changing combinations that the law struggles to classify with traditional categories (war, ordinary crime, market regulation, public order).

Second, "hybrid" refers to the plurality of legal instruments mobilised. The setup of Italian national security cuts across constitutional law (emergency powers, political direction), administrative law (special powers, conditional prescriptions), economic law (control of foreign direct investments), criminal law (cyber-crimes, terrorism), international law (intelligence, cyber rules of engagement) and, increasingly, the law of new technologies (AI Act, algorithmic governance).

Third, "hybrid" underlines the mixed public-private and national-supranational nature of the actors. The sovereign state today exercises its powers in an ecosystem where critical infrastructures (electricity grids, telecommunications, payments, cloud, social platforms) are in very large part privately owned, often by foreign entities; where cybersecurity requires structural collaboration with technology providers; where investigations into serious threats depend on the availability of data held by global operators subject to conflicting regulations (US CLOUD Act, European GDPR, Chinese rules).

The four dimensions

Hybrid sovereignty articulates itself across four dimensions which, read together, configure a unified legal-institutional model.

Constitutional-organisational dimension. The progressive concentration of powers in the Prime Minister as the National Authority for security, consolidated through a stratified body of legislation (Law 400/1988, Legislative Decree 303/1999, Law 124/2007, Decree-Law 105/2019, Decree-Law 82/2021). A transformation of the figure of the Head of Government that the 1948 Constitution could not foresee.

Economic dimension. The evolution of the golden power from the privatisations of the 1990s to its current configuration as a proactive instrument of protection of strategic assets. Decree-Law 21/2012, repeatedly modified through 2024, integrated with EU Regulation 2019/452 on foreign direct investment screening and with allied systems (US CFIUS, France, Germany, United Kingdom).

International dimension. The exercise of sovereignty as a medium-sized state stably embedded in Western multilateral systems (NATO, EU, UN): structured cooperation with allied partners, active participation in multilateral norm-making processes (Tallinn Manual 2.0, UN GGE/OEWG, Budapest Convention, EU cyber sanctions), development of autonomous national capabilities.

Repressive-technological dimension. Criminal law on classical and cyber terrorism (Arts. 270-bis ff. Criminal Code), procedural-technological tools (interception, computer trojans, data retention), the use of AI for security purposes, and the balance with constitutional and supranational safeguards (Arts. 13, 14, 15, 21, 24 of the Italian Constitution; Art. 8 ECHR; GDPR; AI Act).

The model's tensions

The hybrid sovereignty model is not without internal tensions and contradictions. The concentration of powers in the Prime Minister risks compromising the role of Parliament and other constitutional bodies. The golden power raises issues of compatibility with single-market principles. Technological investigations pose acute challenges to fundamental rights. Multilateral cooperation requires compromises on national autonomy.

These tensions are not the product of design errors in the system, but the reflection of a structurally complex world, where every legal choice involves trade-offs between competing values. Four deficits emerge with particular sharpness: transparency deficit (golden power decisions and intelligence activities are structurally opaque); parliamentary control deficit (COPASIR operates with limited tools); technological opacity (AI, big data, predictive algorithms pose problems that traditional legal structures cannot manage); regulatory fragmentation (the four dimensions operate through distinct instruments managed by different authorities).

A double loyalty

The contemporary jurist finds themselves in the delicate position of one who must, simultaneously, safeguard the principles of democratic constitutionalism and contribute to their creative adaptation to new realities. This task requires a double loyalty: to tradition and to innovation, to values and to effectiveness, to the person and to the collective.

The risk, in both directions, is high. To yield to the rhetoric of technological efficiency, sacrificing fundamental rights. Or to retreat into nostalgia for a "pure" constitutionalism, incapable of addressing the challenges of the present. The middle path, difficult but necessary, is that of a reflective Kelsenism: recognising the priority of law and the necessity of legally disciplining every emergency, but taking seriously the challenges posed by contemporary hybrid threats, which require tools capable of operating at the speed of crisis without sacrificing constitutional guarantees.

Why it matters for operators

The category of hybrid sovereignty is not an academic exercise. It is the intellectual frame within which concrete operational questions sit — questions that those operating at senior level in Italy encounter daily: how to structure an M&A operation that falls within the golden power perimeter; how to design an automated decision system that satisfies the AI Act without becoming unusable; how to operate across multiple jurisdictions when the CLOUD Act, the GDPR and Chinese regulations give conflicting indications; how to build a technology architecture for medical practices that can withstand scrutiny by the Garante and by administrative courts.

The intellectual foundation of the Costantini & Partners practice is in this frame. The holding's five practices — Corporate Strategy, Capital & Performance, AI Architecture, Magisterium, Mirafiore Editore — are five ways of applying the same analytical framework to specific operational problems. Understanding hybrid sovereignty means understanding why certain problems are tractable and others are not, why certain structures work and others fail.