Digital sovereignty is the ability of governments, organisations, and citizens to make their own choices about digital technology and data, and to control how that technology works. According to Van Vulpen, this control is often more limited than cloud and software vendors suggest.

Sovereignty-washing and legal reality

Van Vulpen introduces the term sovereignty-washing. This describes companies that present their product as sovereign, while control over data and infrastructure is in fact restricted. He points to providers that fall under United States laws such as the Patriot Act and the Cloud Act. These laws can require companies to give United States authorities access to data, even when the data is stored on servers in Europe. If such vendors still claim that foreign governments have no access to data from Dutch public bodies, Van Vulpen sees that as sovereignty-washing.
His advice to municipalities is to check such claims carefully. They should examine which laws apply, who controls the infrastructure, and which parties in the technical stack can see data and metadata.

Breaking dependence and learning from SURF

In his dissertation Debating Digital Dominance: Decentralized Technology Governance For Strategic Autonomy, Van Vulpen shows how many public organisations have become dependent on a small number of large vendors over several decades. Many municipalities, ministries, universities, and hospitals are tied to Microsoft and a few other major suppliers. Alternatives exist, but they have had little chance to grow because there was limited demand.

Van Vulpen argues that governments can help break this dependence by explicitly asking for alternatives and by giving new solutions time to mature. He refers to SURF, the ICT cooperative for Dutch education and research, as an example of a different model. Member institutions jointly set policy, and SURF implements it. In his view, this combines scale with accountability to public institutions.

Open source alternatives and the role of municipalities

At Amsterdam Business School, Van Vulpen studies how open-source alternatives such as Linux, Nextcloud, Signal, and Mastodon can scale up. Open-source software has publicly available source code. This makes it easier for public organisations to inspect and, if needed, adapt the software, which supports digital sovereignty.

However, many of these tools are still less user friendly than dominant commercial platforms. Van Vulpen suggests that municipalities can help change this by allowing open-source options to coexist with current tools, by letting small groups of users experiment. They will initially have to accept that some functions may be missing at first. This can grow a user base and stimulate investment in better usability.

A long-term policy challenge

Van Vulpen is cautious about political promises on digital autonomy. He sees the structure of the IT market as the core challenge, not just who manages the software. Strategic policy and smart regulation, he argues, can help shape a market for more sovereign digital infrastructure, even when public attention shifts to other crises. In that long term effort, he sees an important role for universities and public research.