Interview - Digital sovereignty in telecoms, with Yann Chevalier

Yann Chevalier, our co-founder and CEO, recently took part in Mobile Europe’s The Briefing to discuss digital sovereignty in telecoms. Most discussions of sovereignty stop at where the data sits: which country hosts the data centre, whose jurisdiction the cloud provider answers to. This one started from a harder question. Who can change the system, who can switch it off, and who you have to call when it breaks.

The transcript below, lightly edited, runs in two parts. The first covers the public-safety capabilities European networks still control, from 112 caller location to population warning, and why they need protecting now. The second turns to the commercial side of the same asset: the location-based services market operators have barely begun to capture, and what it would take to claim a share of it.

Here's the recording: 

Introduction

Tell us about Intersec, your role and what the company does.

I'm one of the founders of Intersec. We started the company in 2004.

For the past 21-22 years we've been working with mobile network operators on one question: how to capture the data their networks produce and turn it into something useful. In the early days, operators came to us because they wanted to leverage their subscriber data the way the OTT were beginning to. So the data sovereignty debate is not a new one for us.

Today we have customers on five continents, which gives us a fairly diversified view of how differently this plays out from one region to another.

As CEO, my job is about two things that have to go together: delivering high-value use cases for operators, and being clear about where the limits are, so that those use cases stay ethical.

Part 1 — Operators at the heart of European sovereignty

Digital sovereignty means many different things depending on who you ask. What does it actually mean in telecoms?

Most of the debate is about where things sit — which country hosts the data centre, whose jurisdiction the cloud provider falls under, what's written on the building. That matters, but it's the easy half, and it's the half everyone is already working on.

To my view, the harder question is operational: who can change the system, who can switch it off, and who you have to call when it breaks. You can hold all your data in Europe and still not be able to act.

Where is Europe most exposed right now, concretely?

We work a lot on location data, and it's an asset operators should treasure. A mobile network is, among other things, a very large network of sensors: every base station tells you something about where a device is. That's what makes network-derived location possible in the first place.

Take the most basic thing a citizen expects: that when they dial 112, someone knows where they are. That works today because of Advanced Mobile Location — and AML is not a European capability. It's implemented by Google as ELS and by Apple as HELO, and between them Android and iOS are essentially the entire handset base. The network-derived location is the fallback underneath, and it's the only part Europe still controls — which is precisely why it has to be protected.

Does Europe need more regulation to fix this, or does it already have enough?

Europe's problem is usually not a shortage of rules. Brussels has written excellent rules for emergency location and population warning. But implementation and testing vary widely across member states.

The European emergency number association (EENA) has had to file complaints with the Commission over caller location in Poland and Malta, and over public warning in Finland. Before we ask Brussels for more, we should finish what's already binding.

You've pointed to Apple's location setting as an example. What's the issue there?

In January 2026 Apple introduced "Limit Precise Location" in iOS, which reduces the location precision available to mobile networks from street level to neighbourhood level. This touches a capability which is used in emergency response, counter-terrorism and organised crime investigation — and no public safety authority or regulator, whether at European or country level, was part of that decision.

Apple would say this is a privacy feature, and plenty of people would say Europe should welcome it. Aren't you arguing against your users' privacy?

The privacy concern is real. Carriers in the US were fined heavily for selling location data, and the case for limiting unnecessary collection is sound. This isn't privacy versus safety. It's about who arbitrates between them. In Europe, the balance between privacy and public safety is supposed to be struck by accountable authorities, through a process, with the people responsible for emergency response in the room.

And are they in the room?

No, they are not. It was a unilateral decision. No European regulator and no emergency services authority was consulted before that feature shipped.

The Digital Networks Act is on the table. What should be included in it?

The Commission and the Parliament should make sure to include three elements:

1. a duty to notify and consult European authorities before any operating-system change that affects emergency capability;
2. conformity testing for safety-critical device functions;
3. and explicit recognition that network-based location is the mandated fallback and must be preserved.

The DNA proposal came out in January 2026 and Parliament and Council are still forming their positions, so in principle the window is open now.

And the figures make the case on their own:

• 270 million emergency calls per year in the EU
• around 800 lives that could be saved annually with better location
• 10% of calls received with no location information at all
• €55–100 billion of potential net benefit over ten years

That's why we filed our position paper on the DNA. The European Electronic Communications Code was adopted in 2018 precisely to improve emergency communications across Europe, and yet several Member States remain in breach of EU law — the vast majority have still not published the required criteria for caller location accuracy and reliability. The rules exist. What's missing is that they are applied and verified.

So there's still time to contribute?

Hopefully so. Parliament and Council haven't closed their positions, and what we're asking for is narrow and technical — three clauses, not a redesign of the text. That's exactly the kind of thing that can still get in.

You talked about conformity testing for safety-critical device functions. Can you explain what that means?

It means verifying that the capability actually delivers the right result when someone's life depends on it. If an ambulance is being sent to a person calling for help, the location has to be right: the correct latitude and longitude, and inside a building, ideally the right floor. That location can come from the network or from the handset. Today the handset side is tested by whoever builds the handset, against their own criteria. For a function that critical, there should be an independent conformity test, the way there is for anything else safety-critical we put on the market.

Can you share a recent mission-critical deployment with a real sovereignty component to it?

Yes. In May we deployed Kuwait's national public warning system in under ten days, in response to the country's urgent security needs during the regional conflict in the Middle East. CITRA, the national telecommunications regulator, worked hand in hand with the three mobile operators — Zain, Ooredoo and STC — to roll out cell broadcast alerting while the population was facing missile and drone threats.

To meet that urgency, we initially ran the system in our secure cloud environment in France, while in parallel establishing the local infrastructure in Kuwait, so the country would end up with full sovereignty over its own alerting system and its data. GSMA used the deployment as a case study in its September 2026 report on mobile-enabled early warning systems.

That is the practical shape of sovereignty: speed when it's needed, and control where it belongs.

Part 2 — Location as a commercial opportunity

All of this sounds like telecom compliance. Is it possible to monetize?

It is, and it's the same asset. The network's ability to know where devices are is what lets Europe warn a population and find a 112 caller — and it's also the most under-exploited commercial asset European operators hold. The location-based services market is expanding fast, and operators are capturing a small fraction of it.

The global location-based services (LBS) market was worth around USD 37 billion in 2025, and is projected to reach USD 164 billion by 2034 — a compound annual growth rate of over 20%. Europe accounts for roughly a quarter of it, about USD 10 billion in 2026. Operators run the networks that make all of it possible, and capture a small share of the value.

Which models are the most successful?

It depends on the region — Europe, the Middle East and Africa don't look the same, so there's no single answer. But there is a business case, and it is strongest in the more developed markets. There's a virtuous circle there: where operators can make money from these capabilities, they're far more willing to innovate, because it's a service they're selling rather than an obligation they're absorbing.

That market already exists and the American platforms own it. How can operators take any of it back?

Precise location today is assembled from cookies, app SDKs (software development kits) and data brokers — a chain so long that often neither the user nor the buyer can say where a data point came from or on what legal basis. Under GDPR and ePrivacy that is getting harder to defend every year. What enterprise buyers increasingly want is location data with a traceable origin, and that is precisely what a regulated European operator can provide. That's a real foundation stone to build on.

What do the commercial use cases actually look like?

We can distinguish three families.

1. Network operations — operational excellence, subscriber fraud detection… essentially running the core services, and adding technical value to services that already exist.
2. Telecom monetisation — personalized onboarding, proximity advertising and marketing…
3. Commercial applications — network exposure through APIs, IoT fleet management, advanced analytics, fraud detection… for the benefit of third parties such as banks.

Which is the most advanced?

All three are live, honestly. Network operations have been around for more than a decade and are mature. Commercial applications are where there's still real room for innovation.

Are operators interested? Aware?

Yes. A number of operators are already active: the services are in production, they're being sold, there are teams behind them. Plenty of others are earlier in the journey, building the business case or running their first projects. What we see as a software vendor is how fast this has climbed the agenda. Two or three years ago it was a side conversation, today it's on the roadmap.

In which regions do you see more traction?

Developed markets, mainly: high penetration rates mean there is real value to extract and margin to defend. In less developed markets penetration is lower and the model still relies largely on selling SIM cards, so there's less traction for these higher-value use cases.

What makes an operator's location data genuinely different?

Four things.

1. A single identified, regulated controller instead of a chain of intermediaries.
2. Consent collected in the subscriber relationship, where opt-in is explicit, auditable and actually revocable.
3. Precision that can be tuned to the purpose — aggregated and anonymised for retail analytics, street level for an emergency service.
4. And processing that happens inside the operator's own network, so the raw data never leaves; only the answer does.

Taken together, that's a powerful set of characteristics — and nobody else in the chain can offer all four.

What turns that into a market rather than a set of national one-offs?

Standardisation, which has finally arrived. CAMARA, run through the GSMA and the Linux Foundation, gives developers one interface instead of a separate integration per operator per country. For example, the location APIs can be built to answer "is this device in this area, yes or no" rather than returning coordinates, which is privacy-preserving by design and still commercially valuable.

In Europe there's a nuance worth mentioning. On the technical side cooperation is easy: all operators understand that very well. On the commercial side it's harder: offering the same capability at the same price across a competitive market is not a natural act between competitors.

Can you explain the fraud use case further?

Take a card payment made in Singapore. The bank wants to check that the customer's phone is actually in Singapore before approving it. The operator can answer that question — often as a simple yes or no, without ever handing over a position. It's a B2B2C model: the end customer, the bank, and the operator in between. And the value is clear to everyone in that chain.

Are you working with European telcos on these commercial opportunities?

There's a lot of traction, particularly given the current geopolitical context — there is real appetite to work with European vendors. With all due respect to Emmanuel, I'll mention Orange as a long-standing customer and partner, and in particular Orange Belgium, which has being doing a tremendous job.

Strategically, Orange Belgium wanted a single scalable foundation able to address both its regulatory obligations — 112 caller location, population alerting, legal obligations — and new commercial use cases: subscriber data monetisation, inbound roaming monetisation, national geostatistics, and access to CAMARA APIs for 5G monetisation. And in a context of growing technological dependency, they wanted to rely on a European sovereign supplier end to end, from the architecture to the applications, in order to rule out any exposure to non-European legislation on infrastructure that critical.

Looking ahead — what should an operator do in the next twelve months?

Three things.

1. Make the obligations genuinely work, because emergency location and public warning are both a legal duty and the proof that the capability is reliable.
2. Productise location behind standard APIs instead of treating every request as a custom project.
3. And build the consent and provenance layer properly — in Europe that's the real moat. Everyone claims accuracy. Almost nobody can demonstrate where the data came from and under what basis.

We're in 2026. Everything needed to make this happen is ready — the standards, the technology and the demand.