Technological Sovereignty Requires Choice, Skills, and Support, Panelists Say During OSS EU

Technological sovereignty does not necessitate avoiding global technology providers, but it does require viable alternatives and the skills to utilize them, according to panelists at the Open Source Summit Europe in Prague. The discussion revolved around dependencies in cloud infrastructure, open source, security, and hardware. Jonathan Bryce of CNCF and the Linux Foundation highlighted the importance of choice, stating that using providers like Azure or AWS is fine as long as organizations maintain other options.

Grzegorzewska emphasized that switching between proprietary systems can be time-consuming and expertise-intensive for governments. Bryce also pointed out that merely having access to source code does not grant operational sovereignty; instead, organizations need to know how to operate, secure, and monitor their systems. Thierry Carrez from Linux Foundation Europe introduced the concept of cloud and AI assurance levels, with the highest level demanding control over the entire technology supply chain, including hardware.

He also mentioned confidential computing as a means to limit a host's access to workloads when full control is unnecessary. Christopher CRob Robinson, from OpenSSF and Akrites, linked technological sovereignty to security due diligence, suggesting that software repositories should be transparent to enable buyers to assess vendor practices.

The EU Cyber Resilience Act was mentioned, emphasizing manufacturers' responsibility for the products they sell, including any open-source components they include. Carrez noted the need for local companies to support and package mature open-source projects, citing Société Générale as a case where the bank developed expertise in-house due to the lack of a suitable partner.

The discussion also addressed the misconception that open source is merely a cost-effective alternative, arguing that free code can evolve into critical systems requiring ongoing support. Grzegorzewska advocated for developer involvement in policymaking and investment, alongside regulation, while Robinson emphasized the importance of cultivating local expertise without turning away from global collaborations.

Bryce concluded by reiterating that a more resilient approach involves building bridges and preserving options, rather than establishing insular fortresses. The panelists ultimately concurred that achieving true technological sovereignty is an unrealistic expectation.