Is there anything like "sovereign open source"?, Vittorio Bertola, #FOSSASIA Summit 2026

Duration: 13:00 2629 transcript words EN summary

Video summary

The presentation addresses the critical concept of "sovereign open source," emerging from the realization that the modern internet has become a captive market dominated by very few global companies, primarily based in the United States and China. This concentration creates significant vulnerabilities for nations outside these powers, as reliance on foreign providers exposes countries to security risks where data can be accessed by other governments, economic espionage, and the potential for services to be abruptly shut down during geopolitical conflicts or embargoes. Beyond national security concerns, this dependency also harms local economies by causing wealth leakage through taxes paid abroad and depriving domestic industries of opportunities to develop their own digital infrastructure, effectively forcing citizens into business models centered on surveillance and data exploitation. To counter these threats, the speaker argues that open source is a powerful enabler for both national security and economic resilience because it offers transparency, allowing nations to audit code for backdoors and modify software as needed. However, simply adopting existing global open-source projects or replacing proprietary foreign vendors with non-local open-source companies does not automatically solve the sovereignty problem if the underlying infrastructure remains hosted outside the country or controlled by external entities. True digital sovereignty requires a shift from merely using free code to establishing local commercial entities that can package, customize, and support these globally developed tools within their specific legal, linguistic, and cultural contexts. This ensures that even if original developers disappear due to political changes in their home countries, local vendors remain capable of maintaining services, keeping the software running reliably for national defense and essential public functions. The discussion further explores the nuanced conditions required for open source to be considered truly sovereign, moving beyond a debate on whether governments should rewrite all code themselves or simply host existing projects locally. The consensus leans toward preserving global cooperation in coding while insisting that local companies must exist to provide support, customization, and financial sustainability through upstream contributions rather than free-riding. This approach avoids replacing one monopoly with another by ensuring there are always viable alternatives available if a dominant provider stops selling services, thereby fostering competition and choice without sacrificing the benefits of an open ecosystem. The definition of what constitutes a "local" company also remains complex, particularly for smaller nations where ownership structures may be international, necessitating careful scrutiny of management and control to ensure genuine local accountability. Ultimately, while there is no single agreed-upon formula that applies universally, the core conclusion is that digital sovereignty must be actively cultivated through strategic choices regarding which sectors require strict localization versus those open to global suppliers. Strategic areas such as national defense are identified as critical zones where reliance on foreign-controlled cloud services or hardware could lead to catastrophic failures if geopolitical tensions arise, making local control over these technologies imperative even in a globally collaborative development model. The speaker concludes that this issue is not merely an European concern but a universal challenge for all nations, urging Southeast Asia and other regions to begin discussing how they can build resilient digital economies capable of withstanding global political shifts without becoming dependent on external powers who might turn off their services at will.

Read the full video transcript

So, my presentation is about what is sovereign open source? Is there anything like sovereign open source? Because we all know what open source is, but what what do you mean by sovereign? And as I said, the the problem starts when at least in Europe, people started to realize that the internet now is a captive market, meaning that there are very few companies that provide us with all the services we use. This is of course different country to country, but these these are global market shares. In practice, the result is that the for some key stuff, whether it's browsers, whether it's mobile operating systems, whether it's cloud services, and much more, uh and you always get the mostly always get the service from the same few companies there. And and so it's very hard for anything any other company, any other service, including open source based services, to gain significant market shares. And the problem seems from a from Europe, but it's the same here, is that these these companies are not just very few. It's and not just that they are always the same, it's these companies are almost all American, and sometimes they are Chinese, but basically for the basic internet services, they are all either American or Chinese. So, if you're not the US and not China, you have a problem that you are buying significant services for your digital economy from outside the country. And and this is a problem. It is a problem and it creates all sorts of problems. So, this is just an attempt to map some of these, depending on the viewpoint that that that that you have, but first of all, you create security issues because all your data, all your services are somewhere else. So, other governments, other people can access the data of your country, whether it's public services, especially, whether it's defense, but also basic economical information. And uh and and so, I mean, you are subject to control, meaning that if another country the other country where the this services come from decides to turn off your services, your country goes dark. Everything stops because if you don't have the basic internet services, nowadays everything stops. And and then from the citizens you are forced into the business models of these countries of these companies which are generally are based on surveillance, on exploiting your data, on depriving you of privacy, selling you And and from the governmental point of view there's also a problem in terms of jobs, of money that goes out of the country, lack of tax revenue, and and [clears throat] anti-competitive so the inability to develop a local industry. So, there are basically two big groups of problems that are created by the lack of digital sovereignty, meaning the lack of local providers. One is about security, as we said. So, you this is endangering your national security and the other one is about economy. So, this is making you lose wealth and moving wealth from your country to the US mostly or to China. And what do we do? Well, open source is the solution and this is generally a [clears throat] conclusion that we are reaching in Europe but should be I mean agreed also in other parts of the world. That to solve this problem open source helps you is the is the way to go. And there are many reasons for this. So, open source is a good enable enabler of national security because it gives you transparency over what the software does. So, you if you suspect that maybe some other countries are putting backdoors into your code or exploiting your data, with open source you can check what happens. And you can even modify it. You can store the data locally. So, if you if you want to start a service in in any country of the world, you don't have to develop all the software that you need to do something that can compete with like Gmail or with whatever service. You can take all the software for free and start using it. And this enables the creation of local services. And there is no way for other governments to mean like deprive you of the services by taking away the code, by putting a 200% tariff on digital services, or by putting an embargo against your country, or the things that are happening in the real world today with the current US administration. And open source is also an enabler for the national economies, as we were saying, because you can start up a companies and you don't have to develop everything. You just get the code and you have to develop maybe the part that is missing. But if you wouldn't able be able I mean if you weren't able to take Linux for free and to take the databases, whatever you use, Postgres, MySQL, and and the web server and and everything for free. So, starting up a company in Thailand, for example, would be much more expensive, a digital company. And and also the openness of open source built on open standards promotes the cooperation, promotes the federation. You can have access to other services because the interfaces are open, the API are public, everything is documented. And so in the end this also creates a adopting open source promotes the growth of the nation of the local industry. But the point is that for this to happen open source has to be sovereign. So, it has to be actually local. And this is something we encountered when we discussed this with politicians, with civil servants in Europe. I mean, in the end they say, "Okay, it's good. You convinced me. We want to push on open source." But then if we replace like the Google, the Microsoft, I mean the the proprietary foreign companies with foreign open source companies, then nothing not much has changed. I mean, we have the transparency, we have the security, we have all the benefits, but we still don't have the jobs, the wealth, because we're still buying services from outside the country. And so we we we want to have some not just open source, but local sovereign open source. And so the discussion in the open source community now in Europe is what what does this mean? So, what are the conditions for saying that a software that an open source software is good for digital sovereignty? Because I mean, some some governments are I mean, especially the French one, for example, that the idea is like let's let's have the government to develop everything again. So, they take the code, they fork it, and they start to hire developers and develop code. And other other people are like, "No, you maybe you just need to rewrite the global libraries. Maybe you don't." And others are just you don't need to rewrite any code. You just have to host the services locally. So, there's a discussion going on over what are the conditions for open source to be good for your local economy. And so, the point is exactly this. We know what open source is. Open source is well defined in terms of licenses and whatever. But, we don't know what sovereign open source is. And commercial open source commercial software in terms of sovereignty is is easy because in commercial software you have a single company doing everything. So, they they write the code, they release it, they package, they sell it, they support it. And so, it's easy. You usually have a company that is in your country maybe and is doing all of this. So, the proprietary software people are like, you know, we are sovereign by definition just by proprietary software. But, open source is different because open source is really based on global cooperation and it should be like this. It should continue to be based on global projects with people from all the countries participating together. And all the different parts of our software development cycle are are often done by different companies or by entities that are not even companies, by individuals, by universities, by nonprofits, foundations. There's all sorts of entities developing open source or packaging open source or promoting open source. And so, what do you do here? Well, which parts of this process have to be local? So, of course you the ideal case is this. I mean, we we are I mean, I work for Open Exchange. It's a German open source company. We make Dovecot, which is the in any Linux distribution. We make PowerDNS. So, in our case, when the German government wanted an email solution, we were German and it was fine. But, then the French government wanted them. And they said, "Okay, you're European." But, then other other countries outside the European Union wanted So, So, in the end we got to this conclusion that the important part in open source for for sovereignty, for freedom, for is not really who writes the code. So, we should continue to develop the code globally and accept contributions from everywhere. And I would love it I mean to to have projects that are contributions from the US and from China and from Europe and from Africa and from Latin from everywhere. It So, open source should continue to be a global cooperation. But then what you need to make sure that the open source doesn't disappear like in the way that the proprietary software or the big tech services can disappear or be taken away from you is the final part. So, what you need is to have open source vendors in the country that know the code, that I mean take the code that is developed globally and integrate it into I mean maybe customize it for your local language and customs and laws and whatever. Sell it because in the end there there needs to be money and possibly this the money that vendors make should be upstreamed back to support the projects, of course. No. So, it should not just be free riding. And then support it. And so, if you are a public administration or a company that just needs to buy like a whatever a desktop application or cloud services or whatever, you need to have a local company to to work with. And then the local company cannot go away, cannot be taken away by a foreign embargo or whatever. And so, the point is really not who writes the code, but the point is who I mean packages it and provides it and yeah. And the ability to keep the code the software available even if the original authors disappear. So, that's a point because maybe the original authors are in the US and there will be a US embargo again or there will be a problem or whatever, they will disappear simply they will stop developing it. The important thing for the reliability of your services that the local company is able to keep this running and possibly to continue developing it the software since it's open. And so, the the the what you really need is sort of a digital sovereignty check when the code is entering your local ecosystem of services. And you need to make sure that that the code is secure, so there needs to be I mean some control, some audit. You shouldn't just download libraries by chance. I mean random libraries from GitHub and integrating it into your key national defense services or And um and there needs to be the the ability to keep it up and running, to control it. So, so the the people the local people must have the know-how to know what the software does in depth and to be able to keep it running and maintain it and fix it and develop it. And so, this is pretty much the conclusion we reached. And this is more or less what we are sort of agreeing in Europe. But so, of course, there's still a debate. There are global open-source companies that say, "No, you you shouldn't have any kind of local I mean, open source is global. Go away." There are people that would like a stricter condition. So, it's an open debate. And finally, this is the last slide and may take questions. Even when you agree on what what it means to have some sovereign I mean, open-source software fit for digital sovereignty, there are many more discussions to have. So, one of the points is, do we really need to have open source in any kind of service? Do we only need it for certain things? And because the national sovereignty needs are different. So, if you talk about defense, the the the typical case in Europe now is uh Denmark. Denmark is a country that I mean, of which Greenland is one of the constituent nations. And of course, the US has said, "No, we want to take away Greenland from you." And they say, "We're going to defend our country with with our jets." But their jets are made in the US and the US said, "You know, we control the we control the cloud. And if if we want, we could turn off your jets from the US because we control the cloud services that are necessary for the jet to work." So, this this is why the Den- Denmark now is rapidly moving out of Microsoft and And so, in indeed, for national sovereign on digital for defense, for these kind of strategic sectors, you need open source, you need sovereignty. Maybe you don't need them for basic other stuff. So, in the end, this is a discussion. And also, do you always need a local supplier? In some cases, you maybe you just uh you it's okay if you have a global supplier. Also, you might not want to have only local suppliers. So, it's entirely fine if Google and Microsoft to sell software around the world. The point is that you need to have an alternative. So, if all of a sudden Microsoft stops selling you you can move to something else. So, the point is not to replace a monopoly or an oligopoly with another monopoly of local open source companies. The point is having more choice. And and also there's there's a discussion on when can you consider a company local and this is especially important in smaller countries, even in Europe, because of course in the smaller countries the companies likely to come from other countries. So, I mean maybe [clears throat] you you're in Latvia or you're in Portugal and the company's German and doing this something or even if you are outside of the European Union maybe. So, the point is do you need to check whether the management is local, whether the the owners are local. There's plenty of European companies owned by American groups. Do they qualify as European companies or So, this is also a discussion that nobody has answers for us. And and it's even true in the open in the open source world. There are now some big open source companies owned by foreign groups. So, thank you. This was possibly food for thoughts. I'm sure that the digital sovereignty discussion is not very high on the agenda in Southeast Asia. It is in Europe and I think you should start discussing this because in the end it's it's a problem for everyone. So, you never know when the global geopolitics will suddenly involve you and you will be in trouble. Thank you. >> [applause]