My name is Felix. This is Nick. We're going to talk about how to get the EU to invest
in open-source maintenance and security. Early on in a Q&A, somebody was asking, okay, how
did you convince governments in different parts of the world to put money into open-source?
That's basically what we're going to talk about today. I'm going to quickly introduce
myself, so I'm director of developer policy at GitHub and in a previous life I was a
politician and managed to get a fund started, so I will talk a little bit from that perspective.
I didn't was not able to do those things. My name is Nick Gates. I'm a policy advisor at
open forum Europe where I kind of specialize in public sector, open-source, the internationalization
of open-source is I'm calling it and then increasingly getting funding into the open-source
ecosystem. Thank you.
All right, so one thing that's really important I think when talking about getting governments
to invest in open-source is to make the argument the narrative. Because a lot of the people
in government are not technologists themselves, they're not software developers, they might
not even have heard about open-source, so really important for a step is kind of getting
them to care about it. How has this worked in the past? So I was involved in starting two
different funding projects. One was the Fossa project back in 2015. I believe I was a
new member of the European Parliament and I was I guess lucky that open-source security
was in the news at the time. So there was the heart-bleed vulnerability which sort of got mainstream
media to report about security issues in open-source and I was able to use that as a hook
to basically start talking about this and get a pilot project in the EU budget. And the
second case was sort of similar with the sovereign tech agency where basically the lock for
shell vulnerability really helped us have this conversations with the German government.
So but basically just waiting for the next open-source security catastrophe and then saying,
hey, you should do something about this is obviously not enough. So the other part that was
really important is having done the research and basically having a feasibility study
in place when these kinds of things happen. So that's basically the challenge that we're
looking at with the EU right now. We want to be prepared that for the next time if something
like this happens, we don't just have ways to talk about open-source to policy makers but we
also have basically a plan for what such a funding instrument could look like. We're pretty
much at the beginning of this journey so we're kind of starting to look into this and doing
this research work and basically want to give you an overview of our plans. Yeah, I think we can
skip this one. Yeah. So in the case of the sovereign tech fund now the sovereign tech agency
this looked like a feasibility study that is also available online. Basically we were able to
use that to convince the German government to get the sovereign tech funds started and get it
off the ground back then. So this is kind of what we're trying to do here.
Yeah, so sovereign tech agency I think has been a huge success story. It has distributed a lot of
funding I think over 23 million euros at this point to a lot of different projects but as you're
going to see compared to how much the EU is spending on digital policy is still relatively small.
So yeah, how do we get the EU to scale up the sovereign tech agency and for that I'm going to
give to Nick. So as we approach this study that Felix alluded to we're thinking about two things,
the economic challenge and the legal challenge. So in terms of the economic challenge we have
some numbers here 65 to 95 billion euros minimum contribution to the EU economy and 8.8 trillion
global estimated demand side value. I'm going to add a few other statistics out for you all
without OSS and OSS networks of developers firms would pay an estimated 3.5 times more to build
the sovereign platforms that run their businesses. That's from a study by Frank Nagle at Harvard.
70 to 90 percent of any given software code base is made up of open source components that
comes from Linux Foundation study. Based on the value and the scale and reach of OSS we believe
that the potential economic impacts of open source vulnerabilities is huge. We know that it is huge
as Felix talked about and so therefore we need an economic argument that carefully considers
the value in scale and reach of OSS building on the work of the sovereign tech agency and that's
what we're trying to do. There we go. So as we think about doing this we're thinking about
two or three different institutional setups. One is kind of scaling a well-resourced EU
wide version of the sovereign tech agency that is in many ways our preference modeled after
the German sovereign tech agency. But we're also looking into different options for how this
could be implemented and actually governed by the European Union and the European Commission.
So there's such things as a common policy framework that could involve a federated setup
with a funded coordinating body or some sort of task force that is given the legal mandate to
coordinate between all of these. Then there's also the free-for-all situation which is that
there is member state setting up their own funding instruments with the common policy framework
in place but no actual kind of institutional mandate within the Commission itself necessary necessarily.
There's also many other funding and financing instruments out there and this is also not just about
funding and financing it is also about kind of resourcing more broadly. So there's many different
aspects of this that we're considering as we go forward. All right yeah this kind of economic
way of thinking about open source might be a little bit unusual to a lot of open source
maintainers because the value of open source is pretty obvious to you if you're working
on it every day but if you're talking to policy makers kind of having this
kind of quantitative, economic evidence is really important to tell them this is why you should
do something about it because you might care about the economy and then this is how you should
approach the problem. Right now we're in a really critical point in the EU budget negotiations
because the EU always sets its budget in multi-year circles. So currently we're kind of in the
multi-annual financial framework or MFF for 2021 to 2027 and this year they're going to start
negotiating the next MFF so basically we're talking about setting up a fund for the time
2028 going forward and this is like very long term things so it's important to do this ground
work now to be able to influence the next MFF. So here I've just broken down to you what the current
MFF looks like so basically what does the EU spend money on in very large terms and you can see
like natural resources that's most the agriculture so that's like one area where the EU is spending a
lot of money cohesion is making the economic differences between the member states in the EU smaller
because like if you want to have a single market it's important that there aren't these huge
economic difference so the vast majority of EU funding goes into those two areas and actually
everything that is about research and innovation you might be familiar with the NGI project which
does a lot of open source funding that's part of the EU's research funding what we have under
innovation here. What we're talking about is more kind of long term maintenance of open source
software and the place that this would best fit sort of in the EU budget right now is this digital
Europe program which you can see is a tiny tiny part of this broader industry and innovation funding.
So it's really I would say like from the perspective of an EU politician not a huge sum of
money that we're talking about but nevertheless if you look at what how big the digital Europe
program is and how big the sovereign tech funds spending has been over the last two years it's
still like orders of magnitude bigger than that and actually even if all of the submissions
that the sovereign tech fund has received in the first two years had been funded it would have been
this much so we can do a lot even with a relatively small program. How these negotiations are going to
work in very broad terms is there's going to be a public consultation sometime in the spring
where people can basically participate that's something that we encourage you all to do
but and then all of the member states of the EU are going to get together with the European Commission
to decide on the size of those big pieces of the pie chart that part we're not particularly interested in
because that's more like okay is the EU going to spend more on agriculture than before or not.
What we are interested in is when they start renewing those different programs such as digital
Europe this particular program might not continue to exist beyond 2028 but they're certainly going
to be some form of a digital program and that's kind of what we want to target to make sure
that open source is going to be part of that and that's those negotiations are probably going to
start in the early fall so by then we want to have this feasibility study ready and then it would
be adopted for the period of 2028 onward. Why doesn't the current digital Europe program already
address the needs of open source? There are a number of reasons for that one is the digital
Europe regulation which sets out the digital Europe has these five areas where it is spending and
it's very much sectoral so usually the way that they think about this is like okay we want
we have particular areas that we think are important like high performance computing or AI and
then they spend a lot of money there but open source is really much more horizontal if you have a
critical dependency it's going to be used in the environmental sector it's going to be used in
research it's going to be used in the financial sector so you can't really break it down in
this sector away and another really important barrier to open source is that digital Europe funding
only goes to EU companies so it's a particular way of thinking about sort of subsidies it's like
okay where the European Union we're going to support European companies and when you want to support
open source you have to think about this differently like for example we have to find ways of
giving money directly to natural persons or to projects that might have participants from different
parts of the world so one way that this could be done better for example is in the cyber resilience
act which I think a lot of open source people are thinking about more as a problem but there are
some interesting things in there like for example it says that the European Union can do a dependency
assessment so basically collecting data from all the European companies that are putting products on the
market and find out which open source projects are dependencies there and we could imagine a future
funding program that doesn't say you have to be a European company to get funding but instead it could
say you have to be a dependency that European companies rely on and that's still going to benefit the
EU economy so right now we're kind of at the start of this process this is the president of the
European Commission and she has said that she wants her next budget for this period after 2020
a to be policy based so we have to explain how does open source funding benefit European policies
this is kind of what the discourse looks like right now this is the Commission by President
responsible for a lot of digital industry topics and she thinks open source is a great thing
but she still thinks about it in terms of sectors like for example she mentioned mentioned
connectivity electronic ID AI so it's always like use cases and we have to change this conversation
to show that open source is basically infrastructure that benefits all parts of the European
economy so how do we do that for that I guess I give the floor to Nick so one of the vital aspects
of this study is that we really want to link it up with contemporary policy discourses that are
actually going to resonate with policy makers so we're going to talk a little bit
allow in some of those dominant narratives so Felix is already talked about the middle one
cybersecurity of course it's imperative that we continue to make a case for cybersecurity but
two others were talking about our competitiveness and digital sovereignty so competitiveness you may
have seen in the news had a big splash with this report that was put out by druggy the so-called
druggy report Mario Draghi from Italy and it proposes an annual investment of 800 billion euros
to enhance digital infrastructure open sources is not mentioned as part of that but we do see
that there is this kind of notional kind of number out there a subset of which could be put towards
open source maintenance and security funding so a little bit more about that why is open source
potentially important to the Jackie manifesto when interpreted right we think that there is
clearly a complementary use case for open source maintenance and security funding in the
allocation of that funding through two open source projects would be strategic in supporting the
broader goals around digital infrastructure competitiveness as a policy tool would promote collaboration
between enterprises and open source communities something that would resonate very much with the
commission and we want to ensure that regulations support both proprietary and open source
innovation models but that open source infrastructure the powers that proprietary software
is well maintained and taken care of. Additionally there's this talk of digital sovereignty
digital sovereignty is kind of a buzzword so to speak and it can be very political but there is this
kind of noional idea out there that Europe and Don Big Tech that Europe has been quote colonized by
Big Tech has crecina kafara would put it and that there's a need for investment in sovereign
digital infrastructures and so we've seen this with the euro stack initiative that is calling for
critical investment in strategic sectors of the economy that are supported by digital infrastructure
but we also see it in a number of different initiatives whether it be things like digital
commons or or DPI or what have you. So what is the focus of our proposed study we kind of
alluded to it a little bit already but really what we want to do is assess the opportunity
and feasibility for a fund at the EU level. So we will have a two-part study and what the goal is
is to create a white paper that will have an implementable policy proposal with a number that
is a defensible impact up in social and economic research. So the guiding question here is what
is the opportunity and feasibility of building and implementing an EU-wide funding instrument
modeled after the sovereign tech agency which is focused on sustainability, maintenance,
and security of critical open source software and so we plan to have that ready for the summer
but that will be a lot of work in the coming ones for us. Who is involved in the project so at the
bottom you'll see the three kind of research partners open for Europe from hope for ISI based in Germany
and GitHub and then at the top we have kind of support from sovereign tech agency and the government
of France, D-NOOM. We've also had expressions of interest from some other governments that are
interested in participating in the research or at least learning from it and so we're hoping to
onboard other partners as the research goes on as well. In particular I think the support of the
sovereign tech agency is of course vital for us they have data which is going to be you know
highly relevant for us in kind of building an economic case that we can present to the commission.
So here are some of the high-level objectives of our study. I won't go too much into detail on this
but you know this is why we're doing this effort and the goals for the final white paper are to
really kind of lay the landscape and the opportunity so to find the scope of the challenge to
English the different maintenance investments and then establish a use case or a case for a business
case for a rather appropriate funding levels and we really want that to be rigorous if it all
possible to the extent that it is. Finally we want to assess the economic and legal feasibility
we'll bring you bringing onboard illegal consultant to actually help analyze the different setups
that we mentioned before and we'll be offering financing and government options and the
attendant policy recommendations that actually actually make this implementable. So what can
happen to make the EU listen to whatever recommendations we make? Well in time for June we need
this feasibility study ready but we also need an advocacy plan and we actually need to mobilize
the engagement of the open source ecosystem so that's why Felix and I are here at the funding
the fossil ecosystem dev room we're really trying to make the case for you all getting involved
in this work as well and so Felix is going to finish things off by offering a sort of
call-to-action around steps that you guys can take over the next months to get involved in this work.
All right obviously we're still sort of at the beginning of all of this but we really
will need all of you to make the case why this is something that people care about I mean
members of the European Parliament are motivated by their voters, by their constituents and the
things that they care about like for example if you have a company that relies on open source
technologies that's something you can talk to your representatives about the European Commission
cares very much about these large macro economic questions like how is the EU going to be competitive
in the future? Member States governments can have very different things that motivate them so for
example it can be about cybersecurity about defending against cyber attacks from Russia it can be
about democracy and resilience and so it's really important to be able to translate the importance
of open source maintenance into these different policy framings so in terms of practical things
that you can do sometime in the spring there's going to be this public consultation by the European
Commission they're probably going to be a lot of responses from very different like farmers from
researchers so I think it's really important that the open source organizations but also
individuals involved in open source will participate in that it's also I think really useful for us
if you have great case studies or already existing research numbers that can help us especially
develop this economic argument I think that's really valuable for us to exchange about
do you want to say something on writing about success stories but yeah I think it's always
important like when you think about a lot of these open source basic technologies are not necessarily
known to policy makers because a lot of it is kind of at the level of programming languages,
libraries, things like that it's not necessarily the end user applications that they will have
heard of so if you have a great success story that is understandable to a non-technical audience
it's really valuable to write that down or to do a video about it or talk about it because those
are also things that can then be reused in those kinds of communications to policy makers
and yeah finally finding champions for open source so MEPs members of the European Parliament when
I was in the European Parliament the way that I would go about this would be to do a lot of research
into the backgrounds of the people that I was talking to and see how the thing that I was trying
to achieve matters to them so like to give you a practical example I wanted to get rid of
geoblocking so basically this video is not available in your country kind of messages and then
I would try to find champions for that in also different political groups and so for example
I was really able to find a great ally in a colleague who happened to be a former professional
cricket player and was unable to watch the cricket in Brussels because it was geoblocked so like
I think yeah it's going to be really important also with the current members of Parliament to find
people who really care about that and I happen to know more the German members of Parliament in their
backgrounds but there might be somebody in your country who maybe has a software engineering background
or who for some other reason might be particularly interested in that so reach out to the people you
voted for or maybe you didn't vote for but who might want your votes in the future and yeah
maybe see if there's somebody who would be a good champion for this topic in your country
yeah and the same also applies to the national government so all EU decision making is kind of
complex you have the European Commission making proposals but they're of course also listening to
what is happening in the member states so I think for example the fact that the sovereignty
agency has this great support of the German government and that it's being put on stages at the
United Nations as a good example is extremely helpful to make the case for the European Commission
to take action in this area because they want to of course elevate success stories so if you have
a good open source program in your country especially if it's in EU member state talk to your
government representatives about also bringing this up at a European level I think that was our last
slide you know this doesn't say anything about innovation funding necessarily so you might have
seen other talks here at Boston today about you know getting more money for the NGI extending
the life of the NGI getting money into smaller open source projects that isn't really what we're
talking about here so that is a limitation but you know the same principles that we just talked about in
the last slides apply for that as well but yeah we're happy to take some questions now I think we have
eight minutes yeah
yes so my question is are you looking at the next generation you and resilience and
record facility funds because you just mentioned we need to find something that resonates with
whatever the MEP is at 24 and right now the problem I'm looking at an article from two as
the commission to lose on rooms on how counters deploy unspent cash they have 500 billion euros
that they've been unable to disperse and the latest projection from the European central bank
is at least a billion euros are going to be unspent so the commission proposes as a
there is much solution to it just give this money to big corporations they're faster
expanding the money so which I mean it's true so if you want to give a solution to
politician yeah it would be not to ask 20 million euros because that doesn't solve anything but it would
be to ask them five billion euros until them just give them to these companies and we will spend
so in short the question was whether we've looked into other funding instruments the
short answer is yes and Felix can talk a little bit more while why we talked about digital
European particular so the next generation you fund that you're talking about is part of the
current MFF we are not looking at trying to take money out of existing programs for this project
but we are rather talking about including open source in the next EU budget from the start so
that's not to say that it isn't possible or that somebody else shouldn't be doing that but what
we're talking about is the period 2028 going forward and I guess the reason for that is sort of
strategy versus tactics in a way like we're trying to lay the groundwork that when the next EU
budget gets negotiated open source is kind of thought about from the start that doesn't mean that
from a tactical perspective it might not also be a good idea to try to jump on an opportunity
when it arises but we're doing a little bit more kind of long-term work to basically try to
mainstream open source funding into the EU budget in the long term because at the end of the day this
is infrastructure I think open source maintenance so we should be thinking about it sort of in the
same way that we're talking thinking about agricultural policy in the EU that it's not something
that you have to kind of make the case for every time so that the question shouldn't be
should there be an open source fund but the question should be how much money is going to be
allocated to our open source infrastructure this year around does that make sense?
Yes, I think there's a question and then we'll talk more at the end
yeah did somebody else have a question yeah thanks for the presentation like what happens
generally is that the big companies like France and Germany have a very strong and well-designed
policies they integrate them in their own governmental stuff for example you have a total
total afar what you have also the same thing for Germany everybody has their own things but when
it comes to the small countries practically they don't have me the capacity maybe
neither the design or the necessity to actually implement that so like whenever you see a document
even in interoperable EU that we are website aimed and all those that are there you see a little
bit the distance that it's not really recognized like the two three four biggest players are
really taking everybody on there are ways to reconcile that and you can actually just kind of
concentrate on the project that make our sense or make you can specify specific to the
like for example public administration training everything should be going in that thing but like
I'll have you thought on handling this kind of big small big fish small fish kind of the
dependencies so yeah the question is around how we're thinking about kind of the discrepancy
in action between kind of some of the larger EU member states and the smaller ones I can say that
one of the key parts of the outreach that we'll be doing in the coming months is to the so-called
frugal states so countries like Netherlands Denmark has a EU presidency coming up Sweden
these are all countries which are a bit more conservative and they're spending and so we'll be
looking to advocate to them but it's also around building coalitions with people from different countries
that have you know different levels of bargaining power but that being said you know the reason
we put friends and Germany up on that slide are because they do have a lot of weight and they can
but get behind an initiative behind us like this but we do want to plurality of actors to be
involved in something we're actively thinking about do you want to add anything Felix you didn't
mention anything about EU AI act in a safety where it seems like open source compensation are
help make do you think would that be a good connection from policy perspective so the question is
if we have looked at the AI act and the work that is being done around AI safety and open source
there I'm trying to go a little bit away from the sexual approach because I mean of course open source
has been a big debate in the context of the AI act and of course the EU is spending a lot of
money on AI but I think we need to find a different way of thinking about basically open source
not as a means to an end like AI or high-performance computing or other kind of areas that the EU
is focusing on in spending and treated more like infrastructure spending so you know we we don't
know necessarily what will be the next sort of sectors that the EU will focus on but we have some
ideas but really the idea is to get kind of open source mainstreamed as I think it's
undoubtable that AI development wouldn't exist in the form we have it without open source but
that is true for almost every industry so yeah we have one minute so very short question
I'm in the pouring work about in purchasing regulations and better levels purchasing
regulations and short how do we make the value of levels of administration by less PDFs and to
write more code or maybe we may get it but if the purchasing studies and analysis and stuff next
Goodbye for this interesting work I