Digital Sovereignty: Why We Need It – and the Importance of Open Source in Achieving It

The coronavirus crisis has shown the whole world the vital importance of digital technologies to keep businesses doing business, workers working, and consumers consuming. Yet, here in Europe, it has also highlighted the extent to which European organisations’ freedom of choice regarding digital services can be limited.

There can be no denying the huge influence technology giants hold over both the consumer and business landscape — and we all know where they’re headquartered. In 2020, as the pandemic raged across the globe, leaving thousands of businesses for dust, seven US tech companies — Amazon, Google, Facebook, Apple, Microsoft, Tesla, and Nvidia — added $3.4 trillion to their collective value. Worth over $9 trillion in total, US tech stocks are now worth more than the entire European stock market — and Chinese companies, too, operate at a similar scale.

Indeed, Europe’s dependency on overseas companies not only to provide digital technology, but also to collect, transport, and process the data these technologies generate — particularly in the consumer space, though there are profound dependencies in the B2B space, too (especially when it comes to cloud services) — is now more visible than ever before.

And while the EU has taken the lead in digital policymaking over the last decade or so — the General Data Protection Regulation (GDPR), for example, has raised privacy standards globally, while the Digital Markets Act and Data Governance Act aim to strengthen policies related to competition and antitrust — there are increasing concerns that people and businesses alike in Europe are losing control over their data as the EU fails to secure independence from technology providers in the US and Asia.

This has led to a debate regarding Europe’s place in the global digital order — and calls to mount a defence of Europe’s digital sovereignty.

“When it comes to technology, in particular software technology, Europe lacks sovereignty,” said Yann Lechelle, CEO of French software company Scaleway, lamenting the fact that US companies have become all but the sole providers of email software, office applications, and cloud services. “I have been spoon-fed by technology made in California, and I actually adore it. But as a result, Europe finds itself in a position where it could end up having little say in the digital technologies of the future. The situation where we are now here in Europe, is that we get 100% of our technologies from Shenzhen and California. I do wish to rebalance the current situation.”

Lechelle is not alone in his concerns and desires. As digital technologies become increasingly important in government, industry, and daily life, people from all over the continent are becoming increasingly concerned about their reliance on foreign technology providers. In an exclusive survey by the Munich Security Conference (MSC) of more than 6,000 Europeans, published in the March 2021 Munich Security Brief Error 404 — Trust Not Found, majorities of respondents agreed that their country is too dependent on digital technologies from the US and China.

Expectations for how such dependencies will develop in the coming decades are equally bleak — a separate survey for MSC’s July 2021 Munich Security Brief Update Required: European Digital Sovereignty and the Transatlantic Partnership shows that, around the world, including in Europe, the vast majority of people believe the US and China will be the leading tech powers in 50 years’ time, not the European Union.

The European Parliament Think Tank gives form to some of the most pressing concerns in its EPRS Ideas Paper Digital Sovereignty for Europe. It finds, like the MSC, that though Europe has strengths in some technologies, it needs to accelerate the pace of development, commercialisation, and adoption in others.

For example, innovations such as 5G, AI, cloud computing, and IoT have become major strategic assets for the EU economy — yet many indicators show that the EU also exhibits some weaknesses that are detrimental in the global race to develop such new technologies. “In the area of AI, for instance, the EU is lagging behind the United States (US) and China in private investment and the level of adoption of AI technologies by companies and by the general public is comparatively low compared to the US,” the EPRS report says. “The US also attracts more AI talent and researchers and is the world leader in patent applications, while China leads the race on data collection and data access (i.e., the raw material for most AI technologies) and has made significant progress in developing new hardware equipment such as supercomputers.”

In terms of privacy and data protection, concern has grown in the EU as to how European citizens can recover control of their digital data in an online environment that is now largely dominated by non-EU tech companies, such as Google, Apple, Facebook, Amazon, and Microsoft (sometimes referred to as GAFAM). A recent example is the controversy concerning the development of contact-tracing solutions for controlling the spread of coronavirus. The technological choices made by Apple and Google frustrated the ability of some Member States to design their own contact-tracing solutions (such as ‚Stop Covid‘ in France) and further fuelled the quest for digital sovereignty.

In the field of cybersecurity, reliance on Chinese 5G infrastructure has been identified as a critical weakness for the EU. Meanwhile, development of cybersecurity technology and investments in cybersecurity companies and startups disproportionately skew towards the US.

In addition, another growing concern for Member States is the lack of control over data produced on their territory. Again, the global public cloud market is currently dominated by US companies.

The concern is that GAFAM’s control over data makes it difficult for others to compete in new and innovative markets. Meanwhile, large online platforms — which are mostly non-EU-based — are increasingly seen as dominating entire sectors of the EU economy, depriving Member States of their sovereignty in areas such as copyright, data protection, transportation, and ecommerce.

One solution might be for European and public institutions companies to attain complete independence from foreign services and infrastructures – excluding foreign actors completely from the European market and rebuilding from the ground up. This model, however, is unrealistic. As Angela Merkel put it in a speech at the Internet Governance Forum in Berlin, “Digital sovereignty does not mean protectionism, […] rather, it describes the ability both of individuals and society to shape digital transformation in a self-determined way,” adding that, “technological innovation has to be in the service of humanity, not the other way around [and that] commitment to a shared, free, open and secure global internet is in fact an expression of sovereignty.”

Indeed, the more realistic model is to acknowledge dependencies between foreign actors and European ones, whilst promoting the EU’s own competences and preserving its freedom of choice.

To this end, a number of initiatives have been established to promote digital sovereignty in Europe. For example, as cloud storage becomes the primary data storage solution worldwide over the coming years, the fact that the market is almost exclusively dominated by non-EU suppliers has potentially detrimental implications for security, data protection, and EU citizens’ rights.

As such, calls to build and secure a pan-European cloud and data infrastructure to strengthen Europe’s data sovereignty have been growing in volume. In response, the European cloud initiative Gaia-X project was announced jointly by Germany and France, and aims to establish a federated data infrastructure at the European level.

“Companies and citizens will collate and share data — in such a way that they keep control over them,” explains the Federal Ministry for Economic Affairs and Energy. “They should decide what happens to their data, where it is stored, and always retain data sovereignty. The architecture of Gaia-X is based on the principle of decentralisation. Gaia-X is the result of a multitude of individual platforms that all follow a common standard — the Gaia-X standard. Together, we are developing a data infrastructure based on the values of openness, transparency, and trust. So, what emerges is not a cloud, but a networked system that links many cloud services providers together.”

Then there is the Sovereign Cloud Stack (SCS) — a cloud operating system built entirely with open source software to create a technical underpinning for the European Gaia-X data space. This is crucial, as “Only open source guarantees digital sovereignty by interoperability, transparency, and independence from unlawful claims of third parties and thus from any unauthorised interference.”

Indeed, being open source means that SCS is not bound to any proprietary technologies of a single provider, which prevents vendor lock-in. SCS is data- and technology-agnostic and provides all the necessary components a cloud provider needs to “offer state-of-the-art Infrastructure-as-a-Service and Container-as-a-Service while being fully compliant with European data protection and security standards without depending on other vendors.”
With SCS, European companies have 100% freedom of choice — and can avoid lock-in effects and dependencies on providers from foreign jurisdictions.

Europe’s reliance and dependency on foreign digital technologies and services is a huge concern for governments, businesses, and citizens. The EU must continue to develop its own competences and preserve its freedom of choice — and open source technologies are the great enabler of such freedoms.

At metasfresh, we fully support and enable your company’s digital sovereignty with our open source ERP software. With complete vendor-independence and freedom from licencing, ready access to community development resources, the ability to customise and modify at will, and full control of updates, security and maintenance, metasfresh open source ERP means you are able to make self-determined and confident decisions on the technologies, vendors, and partners you want to work with. Opting for an ERP solution like metasfresh opens up the full potential of digital sovereignty and guarantees security, independence, and trustworthy infrastructures.

Talk to us here at metasfresh about how we can support you on the path to digital sovereignty.

metasfresh is a member of the Open Source Business (OSB) Alliance, which initiated the Sovereign Cloud Stack. Together with scientific institutions and user organisations, the OSB Alliance is committed to sustainably anchoring the central importance of open source software and open standards for a digitally sovereign society in the public consciousness, and advocates establishing open source as the standard in research and business development to the benefit of companies, governments, public authorities, and citizens alike through digital transformation.

At metasfresh, our mission is to enable each and every company to access a powerful ERP system that supports digital transformation and fuels corporate growth. Get in touch today for more information and insights.