Open source and digital sovereignty

Digital sovereignty is on everyone’s mind these days, and open source is seen as a critical enabler. But how, and at what costs?

First off, it is not just about open source code. Next to code, you also need to consider your data and where it resides. The code and the data dimension then create the space of digital sovereignty (or the lack thereof).

On the code dimension, you can have, ordered in an increasing degree of sovereignty for the user-customer

1. Closed-source software and the vendor behind it
2. Single-vendor open-source software and the vendor behind it
3. Community open-source software and potential vendors behind it

On the data dimension, you can have, ordered in an increasing degree of sovereignty for the user-customer

1. Hosted as cloud service under foreign control
2. Hosted as a cloud service under domestic control
3. Operated by yourself in a data center of your choosing

The following Figure 1 illustrates this using email tools as an example. You get the least sovereignty if you are using a closed source cloud service under foreign control. Economically, under proper competition, this should also be the cheapest solution.

You get some sovereignty if you are using a cloud service under domestic control, where the vendor behind the service makes its code available under an open source license to allow you to switch to self-hosted operations. Because of the increased leverage (domestic control) and the price insurance (threat to switch to open source), all other things being equal, this option should be more expensive than the closed source cloud service.

You get the most sovereignty if you are using community open-source software and run the software yourself, in your data center. This is also the most expensive option.

Walking through the options

Figure 1 skips over the details of the digital sovereignty design space. The following Figure 2 gives a bit more detail, including the added costs that accrue when you increase your sovereignty.

On the code dimension, you can improve your fate by moving from a closed source vendor to a single-vendor open source firm. As the name suggests, the latter is the single (sole) owner of their code, and they make their proprietary product available under an open source license, in addition to the commercial license they sell. This open source license acts as an implied price insurance, suggesting the vendor will not arbitrarily raise prices on you, because you could switch to a self-hosted open source version of the software. One way or another, you pay for this insurance.

You can improve your fate even further, if you switch from single-vendor open source to communally-owned open source, i.e. community open source. In this case, the rights to the code (primarily copyright) are broadly distributed among participants and there is likely to be only one open source license. You can then operate the software yourself without incurring license costs. Such self-hosting, however, is typically more expensive than just subscribing to a cloud service, because of your increased labor and data center costs.

On the data dimension, you can improve your fate by moving from a cloud service under foreign control to one under domestic control. This gives you more leverage if push comes to shove. It also is likely to increase the service costs.

You can improve your fate even further, if you operate the software yourself rather than paying for a service. As mentioned, this is likely to create the highest costs.

Economic theory, meet practice

The economic arguments above make the unrealistic assumption that the software / products are all the same. In practice, they are not, and hence your needs for sovereignty may have to be balanced with your needs for functionality and quality of service.

Also, as soon as you rely on a commercial vendor, the profit motive will continuously push to increase lock-in and pull to erode your ability to switch from commercial service to an open source version, and you have to work to counteract this.

I intend to extend this post into an IEEE Computer article in my open source column. The extensions will cover the practical reality of lived cloud services and open-source software. Let me know any thoughts you may have!