All right, so we are going to have our next speaker, so this talk is about from policy
to practice, open source in the Dutch government by China and we have the floor to see
us.
Awesome, thank you.
Hey guys, it's very warm here, it's all very grateful for you all to see you all here.
It is the seventh year that I am here, seven years ago, I came here with my colleague
Angela who I hope is in the...there she is, in the audience, we were building an open source
environment for an international loan profit and we came here for inspiration.
We love that so much that we came here every year, albeit sometimes digitally.
So I am very honored to be speaking here today, thank you.
I'm going to tell you a little bit about policy in the open source...sorry, open source
policy in the Dutch government because there is a lot happening.
It would be nice at this work, that works so well.
As I think all of you know, open source started as fun little hobby projects that we were
all eager to contribute to and for us, the government sort of became a tool to maybe
save some money somewhere along the way, to now being integral to our digital sovereignty,
both on a national level and at the European level.
So with all of the developments with Microsoft and all of the other news and Greenland,
digital sovereignty has become a really hot topic and thus open source also gain traction.
And now we're even contributing, collaborating on a European level on open source
and the European Parliament Commission is also involved in bringing this to a European
stage. I don't think I need to show you this slide. I think you are all aware of why open
source and digital sovereignty are now connected, but I would always like to highlight the
example of the international criminal court having their email blocked by Microsoft,
which was sort of the catalyst for government to see open source as this important tool
for a digital sovereignty. I hope this is readable, especially the first part.
This is a timeline of policy in the Dutch government regarding open source and it starts all the way
back when my frontal lobe wasn't even developed yet in 2003 with the vendor commotion, which was
the first piece of policy that promoted the use of open source. And I would like to emphasize
that policy is more than just boring rules. It is what we as a government find important and
thus what we will find funding for does policy equals money.
It all explained this, but it all started with the vendor commotion from that came a few
programs that sort of implemented open source and open stand there. It's not really that actively yet.
It wasn't until open unless came as a policy measure that open source really started to gain
traction and really started to get noticed. Unless means that governments who
procure or build their own software need to use open source as default, unless there's a reason not
to. Now unfortunately especially in the beginning, the unless was very popular. So
took a while to choose the right way. But it meant that we were now held to active publication
of our source code because source code is government information. There between 2003 and this moment
there were countless other policy documents that my colleagues will know, but this is a big one
that was recently recently. The focus here is transparency making sure that our government code
is also usable and eligible for civilians for citizens. And of course you see here the influence
of the public money is public code campaign so shout out to the FS of the. Yeah, it's been
since 2020, a lot of stuff has happened. Open source has got a lot of traction because it's been
linked to digital sovereignty. We have the Dutch digital strategy that came out last year
which has sort of six pillars in which open source is at the foundation we think and especially
digital autonomy. Which means that now that we have prioritized this funding is being allocated towards
it. Same with the next one. This is a gift from the previous government as of yesterday.
We have a new government with a new vision but they seem to be very well influenced by this piece.
Which means that there's now political commitments to digital autonomy and this will sovereignty
and the use of open source and open standards. And it focuses a lot on the sovereignty part of it.
And with that to much to our pleasure came a strong call to use European open source alternatives
which we have been building. Oh, got a little too fast. Sorry. That's sort of the policy side.
I would also like to tell you some examples of where this policy came to be,
where it how it came to be in practice. Starting with and what challenges arose from that.
Starting with a very small project called OpenCat. And OpenCat came to be around 2020 during the
COVID crisis and is sort of linked to the first signs of the open-unless policy.
So it's a vulnerability tool used to strengthen the ecosystem around the COVID app and later a bunch
of other apps because it's just a great tool to secure the production environments. And it was built
by the Ministry of Health. After a while after COVID app wasn't that necessary anymore,
the app was still being used by also a lot of other parties but the Health Department was kind of
done with it. So then the question came to be, okay, what do we do now?
Before that there was also a discussion on, okay, there's this open-unless policy. Should we
maybe open-source this and then how do we do that? There was a strong conversation. I'm
I and my colleague here at the Ministry of the Health Department. There was a strong conversation
with the legal department of the Ministry to ask, yeah, what are we allowed to publish and how and where.
And once that was figured out, it was made open-source. One of the first projects. And then the
question came to be, okay, once we're done with it, where will it lens? Who is going to maintain it?
Fortunately, it found a strong community of maintainers and they set up a foundation and it found
its home there. I mentioned this one because it's one of the first ones, sure that there are many
before but this is one of the big ones where government got involved and realized, oh, we need a strategy here.
The next one is one that I'm very proud of. It's Manburo. It is the Dutch version of last
suite and the German openness. It's the open-source alternative workspace for government employees.
And it's filled with open-source alternatives. This is sort of what online I did six years ago
at the Mama Cash Foundation but now on a national level. It's really nice and it's made in the
edict. So it's made in collaboration with France, Germany and a bunch of other countries.
But this also raises the question again of where we're building this. Where is this going to land?
Who's going to maintain it? But also procurement questions. So how will a support of the apps work?
Who is going to, how the SLAs? All of the legal stuff behind procurement but now it's a bunch of
open-source apps and we've never done that before. How does that work? And how do we collaborate
and finance to the cross government? Because everyone wants to use it but who's going to finance?
So that's something that we are discovering. And my personal favorite, my pet project is the
co-platform because we are going to move all our code or at least offer an alternative to GitHub
for government code. That is most likely going to be before J.O. if I pronounce it correctly this time.
We are going to pilot that and we're going to host it on the Daoostec that digitally autonomous
workspace stack. But that also again, we have the same challenges again. So how do we
how do we ensure that we have a strong community of maintainers and not just that, not just on our side
but also how do we support the for J.O. community? How do we ensure that once we choose the
solution that it will still be there 10 years and how do we ensure its sustainability?
That is a question that we have never had to ask because we've always just paid for a contract and then
they would be legally obligated and it's arranged. And now there's a whole different way of engaging
with these communities and with code and with not just taking but also contributing. So that's
what we're trying to figure out. And also yes, we've got mentioned on Hacker News because we are
trying to do this as openness possible. So this is sort of our conclusion.
It's not the tech. The tech is fine. We've seen that in my bido and all of the other examples
it's governments. We need to get out of our own way. There's just a lot to sort out.
Whether it's procurement, that my reason I was a lot about or community building, all that stuff.
So the lessons learned from government, from the Ospo, from also for the communities,
is that and within the government mostly, is that a lot of it is happening.
I don't want to say the bottom, but at the level of people that actually code,
that's where the solutions come from. They build the tech. And we should be funding them.
Because too often we see that someone comes up with a great solution and then all of a sudden
now they have to maintain it. And how do we ensure that that is done sustainably?
Second, if we do build open source, if we do build our own solutions, or we start contributing,
then maybe we need a place where it can land. Because I think the perception still is that if we
choose these open source solutions, then we're done. No, it also needs infrastructure. And that also
needs to be sovereign to host your app on Azure, that sort of defeats point.
And finally, if we decide to buy, so if procurement happens, then we need to help open source
communities small or large with getting information to be able to help to be involved in this
procurement. Because we have a lot of rules, it's about the size of your company, the amount of money
you have, the amount of boys you have, to get through that that's a different way of procurement.
Otherwise you'll keep on ending up with big tech, big consultancy, and just the same sort of solutions.
So that's a challenge for us, not even for the communities. I think that is about it.
I've kept it short, so there could be questions.
Any questions in the back?
What's your thoughts on a set of life versus a set of life approach for the legislation
of governments? Like, for example, do you want to hear speech touch across the Belgian
approach, which is they started fading as the government will need to see if they're leaving
that out of them, because we need to continue to act with all of the services.
Then, of course, we worked, the EI can easily get success to read from that, and that is also
about the only success to read out of that, so I'm curious what your thoughts are about,
do you think the second life thing that we should build to make that happen?
Or is it a set of life things where you have multiple government needs to kind of do their own things?
Yeah. Yeah. So the question was about thoughts on centralization and the centralization,
and there was an example from Belgium, but it's mostly decentralization across government agencies
then, right? That's a very good question. I think that when choosing open source, you should have
the freedom, as usual, and the liberty to choose your own stack. But since we are governments,
and we need to provide certain services, they should be linked and be able to work together as well.
So, same with the co-platform, we are going to set up for you. You're free to choose another platform,
if you want. But there will be probably an obligation to mirror your code there,
because of this transparency laws. I am personally all for decentralization, as long as it works
well together. It needs to be interoperable and compatible with each other.
Okay. I will wait one second with the microphone.
Great technology. Yeah, it's more of a scaling question that I have, because you talked about
the government and how to use like, yeah, open source in the public sector, right? But how can we
raise awareness? Because especially if we want to be more sovereign, it should not be just
in the public sector. I believe. Yeah. So, what can we do and how can we raise awareness so that
outside of these two kilometer radius? People actually know that open source exists that there are
non-US or Chinese or commercial solutions that actually exist and that are as good if not better,
than what they actually use. Just as a quick, you mentioned like, top down, bottom up, right?
Would it be possible that the European governments, if they really believe in open source,
they would start spreading the word that open source actually exists, right? So that it would be like
government initiative to actually share and, yeah, so not just in public, basically, but also in our daily
lives. Yeah. I think that's an excellent question, because it touched upon how do we involve not
just government, but also regular people, civilians, and not just to select group programmers that
we happen to like or to fund, but the broader public and how do we create awareness? I think
I think the European Commission and the parliament already do a great job, and we have lobby
organizations such as the FSFE who are doing campaigns. It's still a task for governments to
create more awareness on it, but for the Dutch governments, I'm actually mildly impressed with how
prioritizing this as of the new government, I know. But yeah, it is a task for government to make
to create more awareness and to make this more visible. But also for these projects that I mentioned,
at some point, we will have to think about how are we going to engage a broader public,
and not just have it foreign by governments that will be a shame. We have another question here,
one thing about questions, when you race your hand, keep it up so that I know, and it's also
like who holds it longer, has a higher chance that I will see that.
Thank you very much for your talk. You say how do we ensure sustainability? This is the question
we've never had to ask from the open source community from maintainers and people who are
doing the actual coding, what would be the most useful resources for you to understand that
question as a policy maker? What can we provide for you that would make that an easier question
around sustainability? Yeah, so I'm very active on that on, and I asked our server in the wider
Fediver's once, what would you, how would you like to be supported if we chose your solution?
Would you want money? Would you want hand to help out with coding? Would you want to be left alone?
And I got many answers. There wasn't one uniform answer, but even if the answer is we want money,
or we want hands, then we still need to help them get into a place where they can accept that help.
And that goes from the start of procurement, we want to buy our user solution all the way to
we're now active collaborators and maintainers. Yeah, that's something that we still need to figure out.
On the Dutch level, the Ospo helped found the DulseBad, the Dutch open source business
alliance, there's also the appell at the European level where a lot of open source communities
and businesses come together, and they then conform a block sort of a group to deal with governments,
and to bid on tenors together, for example. So I have another question here, then here,
then there and there. I will do my best. I understand that my presentation.
Yeah, who made a quick question, you stated a lot of very good, very fundamental questions in
the presentation, but can you elaborate a little bit further on where you are on exploring those questions?
Like, what are the actual outcomes that you've already achieved or not yet achieved,
struggle with in particular? Can you talk a bit more about that? Yeah, yeah. So what we have figured
out is, in this use case, what is allowed? When can we publish something? That's something that
we're now pretty comfortable answering. This is something that we're in the middle of, so how
is it going to work when we use a suite with all of these different open source solutions,
and then we have to prepare some and so on or free, and now do we collaborate? So that's where we're still
finding answers, basically. So another question here? Thank you very much. I wanted to ask about
a point you touch upon in the presentation about cloud services, about big tech, and how we want to
look at those with a critical eyes, right? And I just wondering what do you think the gaps are,
I'm thinking about cloud services, for example, and how to tackle maybe those gaps, and what
the Dutch government can do, and you mentioned policy equal money, which is a good,
no-mechanical, it also can be tackled at the Dutch level and what maybe the European level.
Yeah, so the question being about the infrastructure and then the big tech alternatives on
Yeah, and the gaps that there are. Well, I'm glad that this slide is open, because we've been
very active on this front, but this is of course sort of the front end of what a civil
government sees, and then where are you going to host this? That is still a big problem for Dutch
government, because we don't have an integrated, nice government cloud. So we're still in the
awkward position that we have, all of these great alternatives, and then oh, where are we going to
host it, and oh, that's like 10 times more expensive than AWS, for example. So that's something
for us to figure out. Unfortunately, we do have, as I mentioned on this slide, but we have a team
that is working on that, besides the whole cloud infrastructure, but also Davo, the digitally
autonomous workspace, they're sort of looking at alternatives on a server level, infrastructure,
the whole networks, and then the OS, and then to bring that together. So another question here,
and again, if you want to ask a question, I saw some with the order, keep it up, else I will think,
okay, answer your question is answered, and you're at the back of the queue again. Sorry.
Hi, my name is Katina Mayerson from the Coalition for Fair to do this to education,
and I'm trying to move the entire education sector also to open source, but what I noticed is mentioned
a lot of positive things in energy that are things that are happening, but what I noticed,
if you look back into the history, it's since most of the Hendrik, so like over 20 years,
over 20 years, the politics, or say, oh, you shoot, do open source, and after such a motion is adopted,
then there's a bit of positive vibe, and some things happen. And after a few months,
everybody goes back to normal, so the American cloud again. I mean, at the same time we're talking
about this, and all the positive things you mentioned, the tax offices still busy migrating towards
the American cloud. So why would it this time be different? I think, yeah, excellent question.
Why would this time be different? Because we've done it so often, and then we saw the
our back on Microsoft and Google and Amazon. I think this time is going to be different,
and I might be a bit of an optimist in that, because it's now gone from, oh, we might say,
if money, or we don't like bush, but Microsoft's so easy to digital sovereignty.
That's now the hope that we hang everything on, and that these stories are very, very
visible to also people in charge who are not super concerned with open source.
So I, it is my hope that this time it will be different.
Yeah. Yeah. Thank you very much for the talk. Driven's off from a two-delft, and we work with
surf, within the Netherlands, for early often. My question here is about how does the strategy work
when even something like surf wants to say, birch the cloud, it's still depending on AWS,
Azure, and to you, Delph, we are essentially an unwilling matter with Microsoft, and we keep
having it more and more coming. What did you think of as the strategy within the government
to say address that? Is there any specific strategy to move away from it? Or is it just allowed
to say, okay, we'll see where it goes, because right now we are being pushed to Microsoft 365,
like strongly. Yeah. So it's about cloud infrastructure and the strategy for it.
Yeah. Well, it's not as, we're not as blusher about it as, oh, we'll see where it goes.
There's definitely strategies you've been worked out for cloud alternatives, and especially European
sovereign and Dutch national alternatives. But that will take time. That's a lot of infrastructure
builds. There's an infamous story of a Dutch civil servant on the hoods who build a I tool kit
and wanted it to, wanted to host it somewhere, and he looked up on AWS, how to host it,
and it took like 19 minutes to have it deployed, and then he went to the Dutch data centers
that we have, and after 10 months, and 10 times the amount of money, it still wasn't there.
So that's sort of indicates what a journey was, we're all on.
My name is, maybe. Oh, sorry. The mic is there. I'm sorry.
Thank you. I have a different question about the policy about open source on this, and the
on this part is very vague and still not really defined. They use it. I've experienced it myself
that they use it for all kinds of reasons, mostly security. And now with Solfinity, and dehyde,
which is an identity provider, basically, in the Netherlands, which is required,
being sold to an American company, it seems to see why this whole process is there in the first place,
and why there is no clear line on less and security, because everything just falls on the
security basically. So, maybe explain a little bit about that process over there. And if there's
any chance that that will be refined or better with this new government?
Yeah. So, just to explain the example, Solfinity is a company that hosts our
identity access provider for all the civilians in the Netherlands, and am I saying that correctly?
Right? Yeah. I've just about Solfinity Parked, and it was sold to an American company,
and that was all of our infrastructure. So that's sort of sort of proves, because dehyde,
the identity and access provider, is open source for the most part.
But the infrastructure was sold to an American company, and then that raises the question,
okay, how did Solfinity are you, actually? That requires a strategy, and I see that the current
government and the previous government has that in scope, but it still needs to be worked out.
We try one last question. I'm very sorry for those who still raised their hand that we
can't cover them very quick one. I'm very happy to see more open source of
during the central government of the Netherlands, but I'm curious how would you also make
this enthusiasm translate into the other forms of government or public sectors?
So like municipalities, provinces, schools, hospitals, and so on, because you might
have some enthusiasm in open source, but you need to also convince the others.
It's funny that you mentioned that because the decentral governments, the municipalities, the
provinces, are way more enthusiastic about this than us. And sometimes they're even further ahead,
because they have a smaller scale to work with, and can easier deploy alternatives. So there's no
convincing on our part. They're usually come to us to say like, okay, but when, when can we start?
So it's great. Yeah. Yeah. That's, I'm sorry. That's good point.
I'm sorry that we have to cut it here. Please show me for a big round of applause for Jena.
And if you want to go to another session, and please try to leave
you