While attending the 18th International Conference on Cyber Conflict (CyCon 2026) in Tallinn, 26–29 May 2026 I had many discussions about improving Digital Sovereignty by using Open-Source Software (OSS). The reasons I kept hearing were the standard ones:

• freedom from vendor lockin
• no license fees
• IT-Security
• Adaptability
• Auditability

What is Open-Source Software

Open-Source Software (OSS) is a Software whose Source-Code is available under an Open-Source License as approved by the Open Source Initiative (OSI). Typical building blocks of an Open-Source License are:

• The right to
  • Use, study, copy, modify, create derivatives
  • Redistribute (original or modified)
• Conditions
  • Preserve copyright and license notices (attribution)
• Disclaimer
  • no warranty of any kind
  • No liability for damages
  • No endorsement, no trademark rights granted
  • No sublicensing (usually)

Why using OSS is the way to go

OSS is an important building block of digital sovereignty. The rights given by an open-source license support many important aspects of digital sovereignty.

Adaptability

You are not forced to accept the update cycle and the development goals of the upstream project. If they do not fit your requirements, you can modify the software yourself or fork it — provided you have the competence and the resources to maintain the result.

Auditability

Verification that software does not contain backdoors or kill-switches is very important for digital sovereignty. Access to the source code is the requirement for verification.

IT-Security

Many people auditing the source code improves the IT-Security of an application — if there are many people auditing it.

No Vendor Lock-In

Vendor lock-in means that the vendor holds the off-switch. Prices, end-of-life decisions, and legal compulsion can all be turned against you. The only document that obligates the vendor to keep providing the software is the service-level agreement (SLA). An open-source license contains no such obligation.

Note what all of the above has in common. It is about what you are permitted to do. A license grants permission. It does not do the work.

Why OSS is not enough

Under a proprietary license, keeping the software working is a contractual obligation of the vendor. Patches, updates, and support are delivered because the SLA says so. Under an open-source license, none of that is covered by anything. And the license does not just stay silent. It actively disclaims every warranty and every liability.

The work

Running a piece of software is not one action. It is a continuous process of tracking upstream changes, applying patches, testing, releasing, and reacting to vulnerability reports. A full software lifecycle management is required. The license tells you that you may do all of this. It does not tell you who will do it.

The maintainers

In practice, the work is done by a handful of maintainers. Many of them are volunteers; many work for companies whose goals are not yours. You can read the code and inspect the process, but goodwill is not a schedule, and an inbox is not a SLA.

The takeover

Maintainers leave. When they do, you must find someone to take over — or become that person. In 2015 the maintainer of the small npm package left-pad deleted it from the registry. There was no vendor to call and no contract to enforce. The package simply stopped existing until someone else picked it up.

Digital Sovereignty

There is a way out of this. You buy the work back. Companies sell maintenance, patches, and support for open-source components, and that is a legitimate model. But notice what it is. You have replaced one vendor SLA with another. You have not removed the dependency. You have changed the contract.