Digital autonomy is unavoidable, but demands more than a quick fix

TU Delft examination results are stored in Osiris, which is owned by an American company closely connected to the American defence industry. TU Delft staff gather using Microsoft Teams. Scientists search for publications in the Web of Science, which is managed by an American company. Emails exchanged between students and staff through TU Delft emails are stored in the Microsoft cloud. You’ve probably guessed already; there is no work or study day in Delft that does not involve the use of big tech. And TU Delft is not the only one like this: no other Dutch university can avoid big tech.

In May, this led eighteen Dutch scientists, including two from TU Delft, to call on Dutch universities to reduce their dependence on big tech. The Rathenau report contained the same message and advised institutions about how to do that. Scherff also realises the necessity for digital autonomy, but says it will take a long time.

Digital autonomy, especially the lack of it, has been in the news a lot in the past few months. For example, when the prosecutor of the International Criminal Court suddenly did not have any access to his email. Do you notice that TU Delft students and staff are thinking differently about this topic now?

“Certainly. There have always been concerns, but on a smaller scale. We have always had a strong open-source community, allowing scientists and staff to experiment with alternatives to big-tech solutions like Big Blue Button Or take the Works Council, which was critical about the transition of our workplace to the Microsoft cloud.

“Given all the media attention, the debate has become more mainstream and now includes a geopolitical dimension. The key question is: can a foreign company or country pull the plug on our digital environment? Previously, we considered that impossible, but unfortunately the world has become a less friendly place in a short time. We estimate that the risk that the US will employ a kill switch has grown.”

How digitally autonomous is TU Delft currently?

“I cannot give you a percentage, but I feel that we are in a reasonably good position compared with other universities. For example, we manage two data centres with a total of around 30 petabytes. A large part of our research data is stored on campus. Just fantastic. But already 80% of this is in use, and the data centres will be full within 4 years at the current rate of use. With the new policy for chat services, we have stated: switch to Signal. I myself use Signal for all my work and private messaging. This shows you how a digitally autonomous choice can become evident in behaviour and use.

“But if we are talking about workplace management or which applications we use on our computers, then we are not doing as well. We use a lot of Microsoft, and it is not always possible to avoid doing so. As a result of our contract negotiations with major players like Google and Microsoft in the SURF connection, we have managed to remove GDPR violations. But since the return of President Trump, we can no longer blindly trust contractual guarantees. Although I do not expect that the American government will pull the plug on our digital landscape today or tomorrow, it is forcing us to negotiate.”

ICT-directeur Erik Scherff in a TU Delft datacenter. (Photo: Quincy van Zijp)

What is involved in that negotiation? For example, having undertaken the migration of our telephones to Microsoft Teams, we are using even more Microsoft. While that falls under the American Cloud Act, even data stored in Europe is not safe from the American investigation services. Do we want to be free of Microsoft? And what are your aims for TU Delft in the long term?  

“We definitely need to be more digitally autonomous, but there is no quick fix. We have built up an enormous dependence on foreign commercial interests over decades. You cannot deconstruct that in six months. There are currently not enough alternatives to abandon all sorts of Microsoft applications, for example.

“It is therefore primarily a question of looking for existing open-source alternatives and finding where we can continue using monitored variants of big tech. And in what parts of our technology landscape does it make sense to be more autonomous by developing our own alternatives? And it’s not just us, European governments and companies also need to take action. We can take our time and primarily need a lot of money to develop our own alternatives, like our own AI. This summer the caretaker cabinet decided to invest €70 million in a Dutch AI factory. That is a real benefit. I hope that in five years’ time we can have two complete digital tracks. One would be a public European digitally autonomous landscape, working fully in terms of workplace, education and research facilities. The other a monitored big-tech alternative.”

‘There are definitely alternatives, but we cannot switch to them en masse right now’

So there are alternatives? Big Blue Button for remote collaboration and meetings, SURFdrive as an alternative for Dropbox. And two TU Delft scientists are associated with a test of collaboration in Nextcloud.

“There are definitely alternatives, but we cannot switch to them en masse right now. Take Nextcloud, for example. At some universities it has been used for 10 years already, but only by 5-10% of the employees. But the company barely has a support desk. It is thus not yet a scalable, robust product for the long term. We are working on the purchase policy. Digital autonomy will soon be part of the assessment framework. That means that we can set requirements for data location, exit clauses and open standards. So far, open-source alternatives are often unacceptable because their scope is not large enough or their management is not properly arranged.”

How can we ensure that big-tech alternatives do not win, for example because of their support desk?

“We make daily choices about replacing and implementing new technology. We look at the choices on offer. Their number has shrunk due to the market concentration of big-tech companies in the fields of software, AI and cloud services, and educational technology companies in education. To take Osiris as an example, next year we will be the last university to move it to the cloud. Osiris lies in the heart of our education, we have put out a tender for it, but no open-source alternative appeared. For other aspects this is possible, and I feel we must incorporate alternatives into the tender procedure even if they are not yet mature or need support. Even if that means it will not be as easy to use.”

Accepting less ease of use and adjusting the purchasing policy are included among the recommendations made by the Rathenau researcher Van Eeden and her colleagues in their report about digital autonomy. Which steps are you taking to improve our digital autonomy even more?

“At ICT, we have set up a digital sovereignty workgroup that has already inventoried which in-house services are still autonomous and what we should devote our finances to. That was another of the recommendations in the open letter from May. I fully support the message in that letter. In addition, we are developing a data centre strategy together with all the other faculties that covers issues like: do we want to expand once our data centres are full? What do we want to store in the cloud and where will we get them? We are participating in the Nextcloud pilot in connection with SURF and exploring whether we can do more with our Linux workplaces. Currently, 10% of the workplaces employ this open-source alternative. If we want to expand that, we shall probably need more intensive support from TU Delft. Using Linux requires a lot of knowledge. Another aspect of digital autonomy is creating awareness among staff and students. For example, we published intranet videos on how to best save data.”

An exit strategy – in which organisations determine how they can free themselves from specific technologies, suppliers or platforms – is essential for digital autonomy. Do we have one?

“The short answer is no. We have traditionally had only legal exit strategies, such as specifying contractually that you gain access to the source code if a software supplier goes bankrupt. Given all the geopolitical turmoil, we are considering having a broader exit strategy. I want to ultimately link this to the new cyber security act. According to the act, we have to establish how the university can continue functioning if we get hacked, for example. To that end, we are preparing an analysis of which services are critical. This is information that will be very useful for our exit strategy as well. But I dare not guess how soon this will be available.”

‘Call me for good ideas on digital autonomy’

TU Delft has to make radical budget cuts in the near future. Will there be any funds left over for digital autonomy?

“When preparing cost-cutting plans, I was able to suggest priorities. Cyber security is one of them, and that is a component of digital autonomy. Luckily that has remained a priority now that the plans have been set. And in the long term, say ten or fifteen years, digital autonomy will save money. We will not be entirely dependent on technology companies with so much power that they can decide to raise their fees unilaterally.

“Furthermore, I hope that we as a technical university can make a bigger contribution in terms of solutions to make society more digitally independent. We have brilliant scientists on staff, so my message to them is: come to me with your ideas, even though I am still searching for a way to combine those ideas.”

You said it yourself. How can we ensure that those ideas are followed up? Former TPM scientist Tobias Fiebig set up and elaborated Big Blue Button for his faculty. But after he left, that initiative died a lonely death.
“I think that we must gradually examine together how we can design something like that: large meetings? roundtable sessions? It doesn’t just concern concrete initiatives like Fiebig’s, it also includes for example thinking about which principles to base our digital autonomy on. My door is always open, call me on my telephone, that is a start.”