Digital autonomy discussions are stagnating; civil society must focus on practical implementation beyond legislation and values.
Achieving digital sovereignty requires action from government technical staff, procurement departments, and ministries, but these groups are often absent from civil society discussions.
Civil society can facilitate policy by discussing novel ideas safely, smoothing the path for legislative changes and providing talking points for politicians.
Moving to digital autonomy involves physical changes like new contracts, vendors, and IT systems, which governments typically resist due to inertia and big-tech alignment.
Key areas civil society should address include procurement incentives, legal clarity on restricting tenders to European suppliers, and exposing illegal procurement practices.
Lack of understanding of the hierarchy of digital problems (e.g., cloud dependence, Microsoft dominance) and the need for regime change in government IT must be highlighted.
Issues like poor user experience, lack of European vendor skills in government tenders, open source user satisfaction, and media biases should be tackled.
AI implications for sovereignty, mapping EU digital policies to existing initiatives, and leveraging the EU Digital Commons EDIC are also critical topics.
US big tech companies (Microsoft, Google, Amazon) should not be invited to discussions on European digital autonomy because their interests conflict with reducing dependencies.
Their representatives often repeat misleading talking points, such as claims that they can protect European data from US laws, despite counterexamples like Microsoft complying with US sanctions against the ICC.
Including them wastes meeting time on debunking their narratives and creates a false impression of legitimacy through 'both-sidesing' the issue.
Big tech's goal is to preserve their market share, so they cannot genuinely help Europe achieve sovereignty; their participation only raises doubts or offers pseudo-solutions.
Analogous to excluding tobacco and alcohol companies from health discussions, big tech should be excluded from autonomy-focused events due to inherent conflicts of interest.
Beware of European industry groups or think tanks that have been co-opted by big tech funding.
Digital autonomy and resilience are interconnected; the Netherlands is critically dependent on US cloud providers (e.g., Microsoft, Amazon), with all government, banking, and education sectors relying on them, creating vulnerabilities.
US companies can access data or shut down services at any time, and special agreements do not prevent this; European alternatives exist (e.g., Aisle, Galileo, SURF Nextcloud) but are underused due to lack of awareness and training.
The IT education system exclusively trains users for US cloud platforms, while management and IT staff resist change because it disrupts established routines and profit models.
Political will for digital autonomy exists (150 votes in parliament), but funding is lacking, and middle management is the biggest obstacle, having ignored IT for decades.
Solutions include starting small but significant (e.g., SURF's Nextcloud pilot), building on standard open components (PostgreSQL, Keycloak), and treating IT as a core government task.
Organizations should first implement low-hanging fruit (e.g., self-hosted services); if they refuse, it shows lack of genuine commitment.