Open Source and Digital Sovereignty

In the name of speed and convenience, many organizations are increasingly woven into a complex network of dependencies on third-party solutions outside their direct control — often proprietary software or cloud-based Software as a Service (SaaS) platforms. The price you pay for that convenience is the erosion of control over your mission-critical data and operations. Growing awareness of this risk to autonomy is focusing attention on digital sovereignty, which we discuss in this article, alongside the role open source software plays in assuring it.

Digital sovereignty refers to a government, organization, business, or individual's ability to maintain independent control over their digital assets, data, and operations. 

“Digital sovereignty means you can act independently on all digital matters without undue influence from external entities or foreign powers, ensuring autonomy over data, assets, and the security of your IT systems.”

- Daniel Fau, CEO of TYPO3 GmbH

A note on terminology: Digital sovereignty, sometimes referred to as digital autonomy, encompasses digital governance (regulation and control of operations, policies, and infrastructure) and data sovereignty (control of data and digital assets, their storage, and use). Read more below under Digital vs. data sovereignty: understanding the differences.

Download this article as a PDF booklet

Getting to digital autonomy: location + open source

When you trust your technology stack to external providers, you are forced to place the availability, security, and confidentiality of your digital assets, data, and applications into their hands. Some providers are located in countries where sensitive data can be exposed to surveillance or forced disclosure by foreign governments. Business-critical software placed beyond your control — on a third-party SaaS or hosting platform, for example — can become unusable for your purpose or permanently unavailable.

Furthermore, to exercise genuine digital self-governance, you must have unrestricted access to and control over the software you rely on. Proprietary technologies often come with usage restrictions — like per-seat licenses — and dependency on a vendor. Free and open source software (FOSS) is, by definition, free to use, study, modify, and share with others.

Digital autonomy is attainable only by running FOSS applications and storing your data and digital assets on infrastructure you control — or in jurisdictions like the European Union (EU) with strong privacy and data-protection schemas.

This article looks at digital sovereignty and how open source technologies put it within our grasp as individuals, organizations, and institutions:

1. Introduction: Open source and digital sovereignty
2. Historical context and evolution of digital sovereignty
3. Digital sovereignty in the European landscape
4. Open source software: catalyst for independence
5. Digital vs. data sovereignty: understanding the differences
6. Practical implications of digital sovereignty
7. Challenges and solutions in achieving digital sovereignty
8. Real-world applications and case studies in digital sovereignty
9. Future trends and predictions
10. The road ahead for digital sovereignty and open source

Milestones in open source development

Open source software — built on transparency and collective participation — plays a pivotal role in pursuing digital sovereignty. The following milestones significantly contributed to the democratization of software development. They affirmed the importance of open systems and autonomy in the digital domain:

• The Creation of the GNU Project (1983): This project, initiated by Richard Stallman, sought to create a completely free and open Unix-like operating system. It laid the foundational principles of open source and public collaboration.
• The release of the Linux Kernel (1991): Linus Torvalds' released the Linux kernel, providing a crucial component to the nascent GNU system and creating a fully open source operating system that thrived on community contributions.
• The Apache HTTP Server Project (1995): After releasing the open source HTTP server that would go on to power a significant portion of the World Wide Web, the Apache Software Foundation has become a cornerstone of the open source ecosystem.
• The Open Source Initiative (OSI) (1998): The OSI formalized the definition of open source, strengthening the legal framework for open source software. (The TYPO3 Association is a member of OSI and a signatory to the Open Source Definition.)
• The rise of open source in enterprise (2000s onward): With companies like Red Hat proving the viability of open source-based business models, many other corporations recognized the strategic value in supporting digital sovereignty and started to adopt and contribute to open source projects.

Case Studies: The European Union’s Digital Strategies

The European Union has made concerted efforts to establish frameworks and policies to achieve and enable digital sovereignty. The EU is already a large consumer and contributor to open source software. The new frameworks and policies provide legal and economic advantages to open source projects. They will strengthen the mutually beneficial symbiotic relationship as more European governments discover the benefits of using open source products. 

The following initiatives reflect how the EU is reinforcing its digital autonomy and competitive edge. The European Union is signaling its commitment to a secure, open, and resilient ecosystem for European businesses and consumers by moving towards digital sovereignty. 

• Promotion of open source hardware and software: Creating an open source ecosystem that is not reliant on licensing intellectual property from outside the EU. For example, the European Processor Initiative uses the RISC-V open source hardware architecture, lowering barriers to designing innovative chips and systems.
• Encouraging Innovation and Competition: The Digital Markets Act (DMA) promotes innovation and prohibits online platforms acting unfairly as gatekeepers in digital markets.
• Open Access to Supercomputers: The European Commission has opened access to EU supercomputers to “European artificial intelligence (AI) start-ups, SMEs and the broader AI community” to speed up European artificial intelligence development.

Considering the digital-sovereignty benefits of open source, such an ecosystem should be powered by open source software — with far-reaching implications for the open source landscape.

Open source software has emerged as an essential tool for organizations — and even entire countries — seeking digital autonomy. Organizations benefit from the transparency, flexibility, and vendor neutrality built into its licensing, distribution, and collective development models by using open source software. In practical terms, open source:

• Reduces reliance on external technology providers
• Enables you to maintain and contribute to the software you use
• Increases control over digital infrastructure, securing operational autonomy

How open source transparency promotes autonomy

Unlike traditional (commercial, proprietary) software, open source code is publicly accessible for inspection, modification, and redistribution. This transparency offers clear benefits:

• Perfectly tailored software solutions that meet your exact needs rather than being locked into a vendor’s roadmap, conventions, and upgrade cycles.
• More robust and secure solutions tend to emerge from the open, collaborative FOSS development model.
• Open standards prevent vendor lock-in, allowing easier migration between different suppliers.
• Own your technology stacks rather than ceding influence to dominant market players.
• Invest in local economies, companies, people, and their skills. 
• Create local innovation ecosystems and build community and participation.

In the discourse around technological self-determination, two terms that frequently emerge are digital sovereignty and data sovereignty. These concepts are very closely related.

• Digital sovereignty is the ability of an entity to act independently on all digital matters without undue influence from third parties or foreign powers. For example:
  • A government entity’s authority over the digital ecosystem within its jurisdiction: infrastructure, networks, platforms, and other technological capabilities.
  • A business or organization’s ability to maintain autonomous control over its digital assets, data, security, and operations. 
• Digital governance is the power an organization has to regulate and its actions to control its digital operations, policies, and infrastructure.
• Data sovereignty is an individual or entity’s control of the data that it generates, including where it can be stored, who can access it, and how it can be used.
  • Data sovereignty focuses specifically on the governance of data collection, storage, sharing, privacy, and usage policies according to applicable laws and regulations.

Data sovereignty and digital governance are subsets of digital sovereignty

• There is no digital sovereignty without data sovereignty and digital governance. If an entity doesn’t control its systems or who uses its data and how, it is not digitally sovereign.

Data sovereignty is possible without full digital sovereignty. For example, the EU General Data Protection Regulation (GDPR) “protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data,” without giving them control over all systems that may store and process personal data.

Achieving digital sovereignty — with the help of open source software — offers demonstrable and tangible benefits.

Policymakers and civil society benefit:

• Companies in control of their data can better comply with local regulations.
• Compliance builds credibility, attracting more local clients.
• Local businesses grow, keeping talent and revenue in local economies.

Organizations that use and contribute to open source technologies benefit:

• Shared development costs and efforts
• Increased control over innovation and functionality

Furthermore, open source helps you move closer to digital sovereignty by:

• Making you less dependent on non-local technology and service providers
• Letting you decide how and where your data is processed and stored

The last point, also known as data residency, is particularly significant, as it determines the legal and regulatory frameworks under which data handling occurs.

Companies and governments face significant obstacles on the road to attaining digital sovereignty. Here, we explain how open source technologies are indispensable for achieving digital sovereignty.

Common challenges in the digital landscape

The dominant model of technology sourcing, relying on proprietary software or services, presents barriers to digital sovereignty. Breaking free from these challenges generally requires considerable coordination, resources, and technical capabilities — more than most individuals or companies acting on their own can muster.

• Privacy risks from third-party providers
• Security vulnerabilities from unpatched closed-source code
• Vendor lock-in that prohibits unrestricted use of a product
• Restricted innovation from restrictive licensing

Open source communities like TYPO3 provide digital infrastructure as a collaborative public good, enabling the collective self-determination underpinning and advancing digital sovereignty. 

• Transparency: Analyze and understand all the open source code you run. 
  • Mitigates privacy risks
  • Reduces security vulnerabilities
• Multi-vendor service provider landscape: Work with local open source experts.
  • Eliminates vendor lock-in
  • Encourages localization and customization
  • Invests project budgets in your local economy
• Permissive licensing protects and enables contributors and users.
  • Rewards contribution, thereby engendering community
  • Enables collective development
  • Distributes the costs and benefits of innovation

TYPO3's approach to overcoming digital sovereignty challenges

The vibrant professional community in and around TYPO3 actively invests in the digital sovereignty of anyone who uses the system.

Using TYPO3 CMS, you:

• Retain control over your mission-critical infrastructure
• Benefit from decentralized community innovation
• Encounter fewer security threats thanks to transparent, auditable code
• Avoid vendor lock-in, and enable local and regional contribution with open standards

The TYPO3 community is also actively taking steps to pave the way for digital sovereignty. 

• To evaluate the level of support for digital sovereignty, Anastasia Schmidt of CPS Berlin suggests the conception of an index for digital sovereignty based on the example of TYPO3 to help organizations pick a suitable CMS.
• T3CON23 hosted a panel discussion on government and digital sovereignty, exploring the current state and future possibilities of digital sovereignty in the public sector as of late 2023.

To help you make the shift from theory to practice, here are some case studies from various contexts. Every change you can implement towards digital autonomy is an improvement.

Digital sovereignty in action

State power and control over technology can manifest in different ways, regulating online activities and actors, economic independence from tech giants, and protecting data. The following case studies highlight some challenges and opportunities national governments face in balancing digital sovereignty with the need for regulation, technological innovation, and data protection.

1. GAIA-X is a Franco-German-initiated European cloud computing project that aims to reduce dependence on large non-European hyperscalers like AWS, Microsoft Azure, or Alibaba Cloud. It is envisioned as a decentralized, federated system that connects existing cloud service providers in Europe. The project is based on common standards and complies with European regulations such as the GDPR. GAIA-X seeks to strengthen European digital sovereignty by providing a secure and transparent cloud infrastructure anchored in European values.
2. The US CLOUD Act demonstrates the complexities arising when a nation's laws have extraterritorial implications. It allows US law enforcement to access overseas data, which has led to conflicts with other countries, particularly the EU, over concerns about privacy, civil liberties, and digital sovereignty.
3. Blockchain and GDPR in France: The French Data Protection Authority published guidelines in 2018 on ensuring the compatibility of the GDPR with Distributed Ledger Technology (DLT) or blockchain, balancing the need for national regulations and technological independence.
4. Estonia's digital platform: Estonia's utilization of a blockchain-based digital platform for public services demonstrates its commitment to digital sovereignty. The country's innovative approach, which includes a data embassy in Luxembourg for added security against potential cyber threats or an invasion, showcases how nations can leverage technology for efficient and secure governance.

Achieving digital sovereignty is a journey, not a destination. Once you have your autonomy, don’t take it for granted. Changes in the digital landscape can threaten your control over your data or systems. Broadly adopted open source software like TYPO3 and the other CMSs mentioned here are powerful allies. 

TYPO3’s contributors and service provider landscape are constantly building new solutions for clients and themselves. They are at the forefront of technical innovation — you benefit from new opportunities as they arise — and mitigation — you are protected as soon as risks are recognized and rectified in the software. Your open source software adapts and evolves with your needs and technological paradigms. It is the foundation of sustainable digital autonomy.

Emerging technologies and digital sovereignty

The essence of digital sovereignty revolves around the central questions of what do I own? and what do I control? Emerging technologies, threats, and opportunities are driving us inexorably toward a future where digital sovereignty isn’t a nice-to-have, but rather a strategic imperative. 

For individuals and organizations alike, the common dilemma has often been framed as a binary choice: adopting a proprietary solution or creating a custom one. Yet, this perspective overlooks a critical third option: choosing open source technologies, which offer a unique middle ground. Rather than passively conforming to the role of a consumer, open source encourages users to actively engage in and contribute to the development of the very product they also consume. 

TYPO3 sits at the heart of this discussion in the CMS domain. Its flexible, scalable, and community-driven approach exemplifies how open source platforms empower you to own and control your technology tools. Beyond code, open source communities are influencing policy, governance, and the ethical use of technology.

The evolving role of open source CMSs in digital sovereignty

The digital world is content-driven. Content management systems empower us all to build and manage digital content. Open source CMSs give us autonomy and flexibility to do it on our own terms, putting digital sovereignty within the grasp of many. 

With open source tools, you can create, deploy, and govern your digital presence without being beholden to proprietary vendors, thus ensuring your control over the dissemination of information and your engagement with other stakeholders in the digital ecosystem.

Digital sovereignty is a critical, multifaceted issue in the digital age. Open source projects are a key ally in achieving technological autonomy.

• Digital sovereignty means independence: As you outsource your IT infrastructure, you risk losing control over your digital assets, especially when relying on international service providers. Digital sovereignty means businesses and governments can manage their digital presence and data independently and free from external control, essential for safeguarding operational autonomy.
• Open source as catalyst: Open source software is a crucial facilitator for digital sovereignty, offering freedom from proprietary constraints and enabling transparent collaboration in software development. Historical milestones, such as the GNU Project and Linux Kernel, underscore free and open source software’s pivotal role in empowering users with control and stewardship over their technology tools.
• Challenges to digital sovereignty and the European response: Achieving digital sovereignty is fraught with challenges like privacy risks and vendor lock-in. Despite these obstacles, the European Union is a prime example of proactive efforts to assert digital sovereignty through policies like the GDPR and strategic adoption of open source solutions like TYPO3, thus reinforcing local innovation and autonomy.

Since its earliest beginnings, the TYPO3 project has been living the spirit of open source — and turning it into tangible digital infrastructure. And we are still doing so today. TYPO3’s journey enables your digital sovereignty journey. We are unwaveringly committed to open source values, which, in turn, are central to you achieving technological autonomy and control. 

The TYPO3 CMS is more than a tool — our community and technology are your allies in the fight for digital self-reliance. TYPO3 is breaking down barriers and fostering innovation, expertise, and independence by providing communities and governments worldwide with a robust and adaptable platform. 

Our project emphasizes the importance of your freedom to build, modify, and use our software free from proprietary license restrictions. The success stories, like those emerging from the collaboration with Rwanda, highlight TYPO3's pivotal role in shaping a future where digital sovereignty is not just an ideal but a concrete reality for all.