Digital Sovereignty is an Indispensable Prerequisite for the Resilience of Our IT Systems – First Lessons from the Corona Crisis

We are in the transition to a “new normal”. However it will look different from the normality before the corona pandemic. Step by step areas of life are being ramped up that until recently were in an unprecedented exceptional situation. This involved a lot of stresses, but it has also brought new and valuable insights into how we can organize our lives. The significance of digital communication options has increased enormously. The use of digital technologies has been accelerated tremendously. It became clear that it is important to have systems that function independently of individual providers or even of foreign countries. Systems that are resilient and can react quickly and effectively to a crisis so that stable conditions can be restored.
These are all characteristics of resilience. A term that comes from physics and describes the ability of technical systems not to fail completely in the event of a partial failure.
In order to better deal with the next crisis and to be able to rely on secure, stable and adaptable systems in general, it is important that targeted steps are now taken. This includes to strengthen the use of Open Source in system-relevant areas – from communication to logistics to administrative work – and to focus on distributed and combinable systems. Only by this we are able to achieve digital sovereignty of these areas, of our entire state and of the economy.
But what constitutes such structures in detail and why is the use of open source imperative for them?

Digital Life During the Corona Crisis

Millions of employees worldwide are working from home. While students and pupils are watching educational videos, people are streaming Netflix to fill up their free time and the network has withstood this rush. For all, mostly justified complaints about the lack of network expansion, this is a success story: The Internet works despite the high load. The reason for this can be found in its federally networked, non-centralized basic architecture. This is an important building block for resilient systems. At the same time, millions of people experience through the use of communication tools what it means to have to rely on central systems such as Microsoft Teams or Zoom, which are at risk of failure and have proven to be problematic in terms of security.

Resilient Structures for Digital Sovereignty

So when it comes to digitizing our infrastructure, we should not rely on monolithic systems but on federated system architectures such as those that characterize the Internet. Only then the individual parts function autonomously and independently of one another – and are simultaneously scalable and controllable.
This is particularly important in two ways:

1. From a technical point of view, because distributed systems operated by independent organizations can be scaled much easier by simply adding additional instances. For example, I have observed how new ownCloud and Nextcloud systems or also Open Source video conference systems such as BigBlueButton or Jitsi went into operation everywhere. This distribution and dissemination was possible, because the software for these applications can be installed and operated both on private servers and through freely selectable cloud providers. This is an important contrast to proprietary, cloud-based programs such as Teams or Zoom, in which the application itself and the infrastructure on which it is operated cannot be separated.
2. But also from political considerations, since there is a risk that borders are closed not only for people but also for data. That is if we make the mistake of making ourselves dependent on individual providers or the states whose laws apply to these providers. With this we would accept a “single point of failure” – with the associated risks of extortion. For example, to assert political or economic interests, entire IT systems could be blocked by switching off central servers.
   In contrast, users stay in control with distributed and combinable systems. They can operate the infrastructures themselves, connect them to structures operated by others and understand and modulate how they function. In addition, user organizations or end users can use such systems to determine for themselves which self-generated and stored data they give to whom and for what purpose. This is a basic requirement for data security but also for the possibility of innovation and for creating new, creative solutions that are especially very much needed in crises.

The Importance of Open Source Software

We should therefore be guided by the Internet’s success story and the following principles:

• We should rely on services and solutions that can be used independently of a particular cloud provider and are not offered by only one single provider or data center.
• The solutions must also be operable by users themselves. Hence, they must be available as software.
• Everyone must be able to transfer their data from one provider to another.
• Finally, verifiability and control options are only guaranteed through the use of Open Source Software with open standards. The same applies to the possibility of independent innovation.

By the way, the possibility of verifiability and independent innovation are also the central reason why corporations like Google, Amazon or Zalando strategically rely on Open Source Software for their own solutions. This is the only way how they can guarantee the highest level of security for their data. It is also the only way for them to determine which data they collect, what happens to it, and how they can serve almost any number of users. At the same time, they remain innovative being able to always adapt their software to the latest needs.

Demands for Sovereign Digitization

From these fundamental considerations and conclusions regarding the corona crisis, we can derive further demands for the development of sovereign digitalization through the state:

1. The state must prefer to use Open Source Software – public clients are required to develop Open Source offerings or to commission them from companies so that the European Open Source economy can continue to grow and solutions are available in times of crisis.
2. The state needs to regulate: Open Source Software is also required for critical infrastructures that are operated privately (e.g. electricity, logistics or the food industry).
3. The state and the economy must rely generally on federated, distributed systems and pay attention to the separation of infrastructures and applications. This is the only way to ensure that you can switch to another provider as easily and smoothly as possible if yours fails.

With GAIA-X, about which a lot has been reported in recent weeks, Europe is already on the way to developing an architecture that is to comply with these principles in many parts. It will be crucial for the future of Europe and mankind as a whole whether we use the current “Window of Opportunity” and react now in the state and economy with open, distributed systems and through the strategic use of Open Source Software. Thus we would create a world in which states, organizations, and individuals exercise control over the whereabouts of data, in which they are independently innovative and can react flexibly to crises.
What makes me optimistic is that this insight has gained acceptance in many crucial places in the past few months. Now it depends on the implementation.