Timeline
The recent discovery of the XZ utils backdoor has been widely discussed in the open source and cybersecurity communities. It has highlighted the challenges faced by a system whose maintenance relies heavily on volunteers. A growing number of experts are calling for these challenges to be addressed through increased public support, similar to what the Sovereign Tech Fund is doing in Germany, or our proposal for a Public Digital Infrastructure Fund.
Together with our partners in the NGI Commons Consortium, we just published a blog post arguing that this support must uphold and strengthen the core principles on which most open source projects rely, such as collaboration, freedom of use, and standardization. We therefore believe that more deliberate governance of key open source software packages used as Digital Commons in security infrastructure could help to codify community norms and overcome the problem of burnout that we saw at play in the XZ utils case.
On Tuesday at the European Cybersecurity conference, Roberto Viola, Director General of the European Commission's Directorate General for Communications Networks, Content and Technology)emphasized the need to increase European investment in cybersecurity. According to his remarks, this need is driven by the growing threats and the anticipated costs associated with implementing the new Cyber Resilience Act regulation.
While the new regulation excludes non-commercial free and open source software (FOSS) development, the distinction between such software and that used by private and public entities can be unclear. For example, certain community-based resources may qualify as critical open source software components, as they are integrated into software used by European public services. This underlines the need for broader public support for community-based projects supporting critical infrastructure. It also underlines the importance of integrating support for the cyber commons into cybersecurity policies, as experienced by Campus Cyber in France with the launch of a “studio for cyber commons.” Neglecting to invest in FOSS can lead to security risks with far-reaching economic consequences, as demonstrated by the Log4Shell vulnerability discovered in 2021. Establishing maintenance and vulnerability reporting protocols is a shared responsibility that Digital Commons projects cannot shoulder alone.
The Dutch government is reportedly alarmed by the possibility that ASML will move its operations out of the country due to concerns over restrictive immigration policies.
ASML is the exclusive producer of crucial equipment required for building chips that are the foundational hardware for processing vast amounts of data and executing complex algorithms.
The company is said to be concerned about its ability to attract and retain skilled personnel under new immigration rules. In addition, issues such as electricity grid congestion and environmental regulations are also influencing ASML's thinking.
News about ASML serves as a good reminder of the key role of infrastructure in AI development and the fact that currently, a handful of companies play the role of “checkpoints” in the AI ecosystem. It also points to the intersection of digital and environmental policies, an aspect that, up until recently, has not been given too much attention. However, with the rise of AI the environmental costs of digital technologies become difficult to ignore.
The French Data Protection Authority (CNIL) has published a resolution on the 31st of January explaining its decision to greenlight the hosting of the French “Health Data Hub” by Microsoft, acknowledging the absence of an immediate alternative that aligns with the project's technical and functional requirements. According to Contexte, the CNIL has itself underscored the potential risks of the project’s hosting solution, cautioning that American authorities may compel Microsoft to transmit data hosted in the project, thereby raising concerns about data sovereignty and privacy.
The Health Data Hub is a public structure whose aim is to facilitate access to data hosted on a secure platform, in compliance with regulations and citizens' rights. The new insights allowed by this sharing of data aims to improve the quality of care and support for patients.
As European countries all grapple with the dilemma of balancing the benefits of increased data sharing with sovereignty, this decision underscores the imperative for strategic investments in digital public infrastructures at the European level, in order to build credible alternatives safeguarding the digital values and autonomy that Europe aspires to. You can read more about this in our proposal for a European Public Digital Infrastructure Fund.
“When I see that initial critique went wrong, was in formulating this alternative third path, this alternative third way, strictly through the paradigm of software. They didn't perceive institutions as also capable of facilitating social coordination. But ultimately, that's what institutions are. If you look at most public institutions in society, whether it's the post office, or the library, or the university, or many of the other examples I've given you before, their primary task is facilitating coordination among people, among people in institutions, among people and knowledge bases, but social coordination is at the heart of what they do. And the reason why I went into this detour, into thinking about institutions, is that (...) it is obvious that in this day and age, we can not just be building alternative free software products to match those that Silicon Valley is building.
This is nice, but I think those thinking about this through the paradigm of digital commons are probably getting a little bit closer to the right answer. Because digital commons imply not just the passive use of infrastructures, it means active care and maintenance of them. It means an actual involvement in an infrastructure as an institution, as opposed to just passive use. And it's obvious that if the path that the progressives would like to follow is neither that of the market AI nor the centrally planned AI. Then, the alternative that I think is consistent with their own philosophy and with their ideology is that of an institutionally mediated AI that facilitates social coordination. And that would be social coordination for perhaps the provision of public services; perhaps it would be for reinventing health institutions; perhaps it would be for facilitating and getting people away from the kind of alienation that we feel about politics and civic life. But ultimately, an answer to a properly distinct need for a properly socialist or social-democratic, progressive AI, I think, has to start with recognizing that this is a deeply political mission, and the deeply political mission has to return to the progressivism as something that is about allowing people to reach the maximum of their potential in a socially mediated and institutionally mediated environment and to do it in a way that does not solely rely on the market as the only institution capable of getting us there. I think it is very important to account for the costs of relying on the market, and as we account for them I think it is time that we also develop alternatives.
To develop these alternatives, I do think that a proper re-examination of our own project is needed, and I do think that trying to think about this through the lens of a massive push for digital commons as a hybrid path between infrastructures and institutions that societies and groups can be using to coordinate their own activities outside of the market, as the only reference point, would be a step in the right direction.
