Central Asia is digitalizing quickly. Governments across the region have invested in smart cities, 5G, and AI-powered platforms. Kazakhstan ranks 24^th in the world in global e-government indexes, and in Tashkent and Bishkek, young, tech-savvy populations are pushing for innovation.

But such progress is not without risks. A new report from the German Marshall Fund (GMF), a Washington-based think tank, outlines how Central Asia is becoming ever more reliant on Chinese and Russian technology. These two countries, the report argues, are using digital tools not just to supply infrastructure but to shape how governments in the region manage data, surveillance, and speech. Beijing and Moscow’s tech exports act as snares, tying customers into their own economies.

“Central Asian governments are aware of these challenges,” Dylan Welch, the author of the report and a China analyst at the GMF, told The Times of Central Asia. But he notes that it can be difficult to convince policymakers to prioritize the dangers of such overexposure.

“For the national leaders, their imperative is to deliver economic growth because they have these young, dynamic populations that need jobs… if they don’t deliver on that, then they’re in for a long period of instability at home,” he said.

This makes Chinese and Russian offers to develop their digital industries extremely tempting.

An Entrenched Presence

The report coincides with a flurry of Russian and Chinese engagement in the region. Over the weekend, Kazakhstan announced that between them, Beijing and Moscow will be responsible for delivering a new generation of nuclear reactors to the country, currently leaving French and Korean alternatives out in the cold.

Then came this week’s visit of Chinese President Xi Jinping to Astana for a summit with the five Central Asian leaders.

On the digital front, one notable announcement from this summit included a plan to develop an Artificial Intelligence Cooperation Center in Kyrgyzstan. China has used the term “Digital Silk Road” to describe its investments in Central Asia, and it has built much of the physical infrastructure behind the region’s digitization drive.

For its part, Russia has exported its software, legal models and surveillance practices. Taken together, these systems are helping local governments tighten control over digital life.

“This strategic integration makes it more difficult for regional states to diversify in the future, even though many continue to pursue multi-vector foreign policies aimed at balancing global partnerships,” Yunis Sharifli, Non-Resident Fellow at the China-Global South Project, told TCA.

Where the Vulnerabilities Lie

The report uses a “technology stack” framework to explain the problem. This framework looks at five layers: network infrastructure, data storage, consumer devices, digital platforms, and government policies. Across these layers, it argues, Central Asia is exposed to Chinese and Russian influence.

Take Kazakhstan. It may be the most advanced digital economy in the region, but most of its internet traffic still passes through Russia. Telecom firms across the region are also required to install a Russian-made surveillance technology known as SORM (System for Operative Investigative Activities), which can intercept internet traffic.

“As a message or a data packet is traveling through a network, it passes through a collection point managed by the telecom company,” explained Welch. “It’s captured and decrypted by SORM, and then, near or at the same moment of capture, sent along to the end receiver who doesn’t necessarily know that their messages have been read already.”

He adds that well-known “encrypted” messenger apps like Telegram or WhatsApp are not immune.

“There have been enough reported cases by investigative journalists who focus on Russia that the Russian state definitely has the ability to decrypt or access such messages,” he said.

User data on other apps is also vulnerable to Kremlin snooping. In 2023, Russia passed a law allowing the Federal Security Service (FSB) real-time access to user data and locations on the ubiquitous Yandex Go ride-hailing app.

In the legal realm, Russia sets the norms, with many Central Asian countries, notably Kyrgyzstan, cut-and-pasting laws enacted by the Russian Duma, sometimes verbatim. This includes a 2024 version of the “foreign agents” law used in Russia to target NGOs and media.

In terms of hardware and physical infrastructure, China plays a more prominent role. Chinese companies dominate the market for surveillance cameras, telecom equipment, 5G, and cloud storage. In Uzbekistan, Huawei built the national data center that runs its e-government services, putting sensitive data at risk of exposure or disruption.

“China’s expanding digital footprint in the region has coincided with heightened cybersecurity threats,” said Sharifli. He points to a Distributed Denial of Service (DDoS) attack in Kazakhstan in May, which he says has been linked to Chinese actors. He adds that Uzbekistan has similarly experienced a dramatic spike in cybercrime linked to Chinese hackers, “including attempted intrusions into sensitive government systems like the Ministry of Foreign Affairs.”

Can the Risks be Reduced?

Central Asian states are not walking blindly into dependency, and Kazakhstan is leading diversification efforts. In March, it signed an agreement with Azerbaijan to build a new fiber-optic cable across the Caspian Sea to avoid routing data through Russia – a development which would also provide an alternative for internet traffic from Uzbekistan and Kyrgyzstan.

Last week, Astana also announced a deal with U.S. firm SpaceX to receive Starlink satellite internet, after a protracted battle over data storage. It has signed further satellite broadband agreements with European firms Eutelsat and OneWeb.

Welch argues that while satellite internet is no substitute for the speed and price of fiber-optic cables, they do offer a useful back-up service.

“From a developmental perspective, satellite internet is important for connecting rural areas that are really hard to reach. Also, in the case of a conflict like you’ve seen in Ukraine, those services can be an important backup if telecommunications networks fail,” he said.

Meanwhile, Kyrgyzstan and Uzbekistan have resisted Chinese hegemony by banning apps such as TikTok (although anecdotal evidence suggests it is still popular in both countries and accessed by VPN).

Tech DIY

All three countries are also investing in creating their own tech hubs. The most recent of these to launch, Kyrgyzstan’s High Technology Park (HTP), seeks to offer legal and financial incentives to attract businesses and entrepreneurs.

“Through HTP, the country has created a special economic zone that exempts resident companies from VAT, corporate tax, and sales tax – a significant advantage for startups and outsourcing firms seeking cost efficiency,” Azis Abakirov, the park’s director, told TCA.

His pitch to investors is that operational costs in Kyrgyzstan are very low and the country has a growing pool of English-speaking talent.

The country has also launched a Digital Nomad Visa, available to citizens from the EU, United Kingdom, United States, Japan, and Korea. While this is nothing new, an eye-catching element is that this visa does not stipulate a minimum salary – in contrast to Kazakhstan, whose Digital Nomad Visa requires that applicants earn $3,000 or more a month.

“This means professionals can open a business, set up a bank account, and access public services with minimal bureaucracy,” said Abakirov. “These combined factors make Kyrgyzstan a practical and legally accessible base for Western tech operations.”

The Need for State Aid

Outside actors are also stepping in. At April’s summit in Samarkand, the European Union announced €12 billion in new investments for Central Asia, including €100 million for satellite internet.

But despite Central Asia rolling out the welcome mat, Western firms face real hurdles to compete. Regulatory requirements are burdensome – including from their own governments.

“We’re operating in a part of the world where it’s very common for technology to get rerouted either to Russia for the war machine or as a backdoor to China on chip controls,” said Welch. “None of these companies wants to get in trouble with the U.S. government.”

This adds an extra layer of risk for companies that are already nervous about investment due to perceptions of corruption. Many conclude that the profit margins and relatively small market size are simply not worth their time.

Welch believes this is where private Western companies are at a disadvantage compared to the state-backed Russian and Chinese giants, who often invest for strategic purposes.

“We’re asking a lot of these private companies to go into these geopolitically risky areas, and then we get upset with them when they’re not competing,” he said. He compares the €100 million EU investment package in satellite internet to the figures that Chinese firms are pumping in.

“We’re talking about a multi, multi-billion-dollar enterprise to upgrade and modernize the region’s tech infrastructure using Chinese fiber optics, data centers, telecommunications equipment… So, €100 million is a great start, but it is a drop in the bucket compared to that scale of investment.”