Ever since the word ‘sovereignty’ cross-pollinated with the IT industry owing to geopolitical instability, its definition has been flimsy at best. At Open Source Summit Europe, the continent’s control over its digital destiny was once again put to the test. The reality is that there are no shortcuts, and a price must be paid for true self-reliance.
Make whatever checklist you desire, none will lead you to a fully European tech stack. Those pushing for an EU-based AWS equivalent will be left waiting for years, if not forever. The end result is that sovereignty, so popular a term that it now seemingly requires no introduction, is untenable based on proprietary IT solutions alone. Open source provides a “certain level of digital sovereignty but doesn’t get you all the way,” says Thierry Carrez, General Manager of Linux Foundation Europe and the OpenInfra Foundation. “You need more than just open source. You need openly governed ecosystems, and you need participation into them so that you get enough familiarity with the software to be able to be sovereign with it and have effective control over it.”
Participate, don’t fork
Therein lies the rub. Open source is often touted as some kind of cheat code, a hack of sorts, to wiggle oneself towards a sovereign solution. After all, you can see the code. If maintainers drop out or take the solution in an unwanted direction, forking it is one rather drastic solution. It’s drastic because a fork is hard to maintain, and because there’s a much easier way to get what you want: to participate more in the first place and steer these projects.
This is easier said than done. Maintainers are not an amorphous blob. The professional developer community is regularly cited as consisting of something like 20-30 million members across the globe. Many of these members are in fact European. Still, if one is to accept the notion that an employee’s knowledge is also their employer’s knowledge, then much of the expertise resides with US firms as well as Chinese companies.
The missing link
Open source is as much about value generation as it is about a sense of community, practical needs and ideological considerations around a free and open digital ecosystem. Hardly anyone sells these freely available standards, tools and programs, but they are productized and part of an abstraction layer cake that makes up everything from clouds to CDNs, security software and enterprise SaaS. European organizations are missing out here: 59 percent of them contribute code upstream, but only 37 percent take part in governance.
Carrez sees a related gap further down the line. “The technology is there. No need to reinvent it. No need to make European open source, whatever that would be,” he says. “What you need though is an ecosystem of companies that take that open-source software and packages it in a way that’s consumable locally by companies.” Everyone in France seems to want their own private cloud now, often on OpenStack, he notes, yet there are “maybe 1, 2 companies, it’s like maybe 20 people in France that can actually do that right now. And everyone else is turning to a US-based service provider because that’s the only answer they have.” A bank like Société Générale ended up building the expertise in-house instead. Europe writes much of the code, but the money goes elsewhere.
What the US and China do have
Paula Grzegorzewska, Senior Manager, Strategic Partnerships at Linux Foundation Europe, points out that the open source escape valve for sovereignty is a result of European policymakers and other stakeholders implicitly accepting there are no EU-based equivalents to American and Chinese IT giants. Both are actually important to consider: the US has it all, so to speak. It is digitally sovereign because nearly every part of the IT supply chain is American. Only the Taiwan-based TSMC and the technically-Dutch-but-heavily-globalized ASML truly complicate matters, but even at this stage of the chip production cycle, US control is enormous. Just look at directives not to sell advanced chipmaking tools to China, or the heavy investments in US plants for both TSMC and Intel.
China, meanwhile, had its sovereignty scare long ago. Not only was Huawei cut off from major markets for telecommunications, but export controls also forced China to essentially do what Europe could never imagine: build its own IT stacks holistically. While a proper ASML of the East is seemingly a decade away, progress has been steady. China will become digitally autonomous and sovereign.
The price of sovereignty
In EU terms, China is trying to be SEAL-4. This Sovereignty Effectiveness Assurance Level can be roughly summarized as 0 being digitally helpless, 1 meaning little more than falling under EU jurisdiction, 2 about securing data sovereignty, 3 meaning ‘digital resilience’ against supply chain disruption from outside the EU and 4 being fully self-reliant, chips included. Europe can get to SEAL-2 with very few changes in habit, heavily scrutinizing and securing whatever sovereign cloud offering the hyperscalers provide, but for SEAL-3 to be at all tenable, open source may well offer deliverance. After all, projects you steer along are as much yours as they are anybody’s.
What that independence costs is hotly contested. CCIA Europe, the lobby group whose members include Amazon, Google and Meta, had think tank ECIPE calculate that the sovereignty requirements in the proposed Cloud and AI Development Act (CADA) could cost Europe 115 billion euros over ten years, according to CCIA more than six times the Commission’s upper estimate of 18 billion euros. In the study, the largest item, 79 billion euros, is migrating and rewriting applications. That is precisely the switching cost open source is supposed to bring down, yet ECIPE’s paper doesn’t discuss open source at all.
The non-quantifiable
Speaking with OpenSSF’s EU Policy Advisor Madalin Neag, we discuss how hard it can be to nail down what organizations are really getting from open source participation. He suggests a few: attracting better talent, retaining talent, having early access to updates only open source insiders are aware of. He also mentions being able to influence project roadmaps, as well as “receiving much faster answers from upstream. Those cannot be quantified.” Some of it can be measured, though. Organizations without formal open source governance recoup 3.6 times their investment, while those with a mature approach get 4.6 times back, according to the Linux Foundation.
The costs are quantifiable, or at least noticeable when committed. Open source participation is “not free and it is not easy,” says Christopher “CRob” Robinson, Chief Technology Officer and Chief Security Architect at OpenSSF. Not participating isn’t free either: organizations that maintain private forks spend an average of 311 hours per release cycle keeping them patched. And as much as Europe is looking to ‘move away’ and ‘repatriate’, its execution cannot be stubborn or self-defeating. “What I would encourage the Europeans as you’re moving forward in your sovereignty journey,” continues CRob, “is to try not to be isolationist. […] Don’t close off yourself to these amazing ideas and this innovation, but groom, cultivate that expertise locally because you do want to have a strong identity.”
“The reality is that no one region is going to be able to create all of the technology they need,” says Jonathan Bryce, Executive Director of the Cloud Native Computing Foundation (CNCF), who shared the stage with CRob. “I think it’s actually much more resilient to have a very broad base of contributors to a project.”
Conclusion: trust and belief need to meet pragmatism
What’s striking about all this is that, ironically, much of the sovereignty talk focuses on Europe even though it’s a global concern. Much of the encouragement to participate also comes from the Linux Foundation, a US-headquartered organization with a stake of its own. That need not be irksome. Much of it stems from open source beliefs, a desire to gain as much as one gives, or a mix of the two.
One can look at plenty of sovereign initiatives, from NeoNephos to ECOFED and the venerable OpenStack. We needn’t lament Gaia-X, the Franco-German initiative announced in 2019 to build a European data infrastructure. These ambitions all seem to gesture at something broader, an “IT Airbus”, if you will, where one can simply count up the applications, tools and hardware one needs until SEAL-4 is reached and every IT component is integrated into one whole. What use would that be?
Instead, open source can deliver more than a shortcut to adhere to some theoretical standard or upcoming regulation around control. Technically being compliant and actually being technically competent are going to be distinctions tested by geopolitical concerns. Better to let such turmoil lead to forks where they can and proprietary solutions where they must, than having organizations lose access to their tooling and mutter that their foreign, closed source solution ticked all the sovereignty boxes.