Breaking Big Tech Lock-In: SURF’s Digital Sovereignty Route

 

Breaking the Big Tech Lock-In: How the Dutch Education System is Building a Practical Route to Digital Sovereignty

When a team of Dutch researchers investigating the societal impact of algorithms realized they were conducting their work entirely on commercial platforms beyond their control, they turned to SURF—the IT cooperative serving Dutch education and research institutions. Their question was straightforward: What are our open, value-driven alternatives?

The response from SURF was candid: "We do not have an alternative right now. But we will figure it out."

Four years after that initial inquiry from the AlgoSoc (Algorithmic Society) research program, what began as a targeted problem has grown into a nationwide movement. Across SURF’s 120 member institutions, open-source pilots and production services are creating a real-world roadmap to digital sovereignty.

This initiative is led by Wladimir Mufty, Program Manager for Public Values and Collective Digital Sovereignty at SURF. Working with a focused team, SURF—the Dutch equivalent to Jisc in the UK—has spent five years turning abstract principles like privacy, vendor independence, and governance into operational technology choices.

"Sovereignty is not binary. It is not a switch you flip on or off. But the more control you have, the more of those values you can factor into your decisions."

— Wladimir Mufty, Program Manager, SURF

Rather than relying on position papers, SURF’s strategy centers on action: deploying robust open-source alternatives alongside existing commercial software, evaluating performance under production conditions, and scaling viable solutions across higher education.

The Trap of Total Vendor Dependency

The structural dependency SURF is addressing developed over decades. Historically, the relationship between academic institutions and commercial IT vendors was viewed as a balanced commercial arrangement: universities paid for software, vendors delivered services, and underperforming vendors could be replaced.

In modern enterprise cloud environments, that dynamic no longer exists.

When a single cloud ecosystem controls an organization's core identities, communication workflows, and institutional data, switching vendors becomes cost-prohibitive. As Mufty points out, this differs fundamentally from commodities like energy or materials:

"When a vendor holds your data, your identity systems, and your infrastructure, you cannot simply walk over to the competitor. This is a fundamentally different kind of dependency than buying gas or grain."

The COVID-19 Acceleration

The COVID-19 pandemic accelerated this shift. José van Dijck, Professor of Media and Digital Society at Utrecht University, has documented how the crisis forced European higher education deeper into Big Tech ecosystems. Facing immediate shutdowns, universities required instant, scalable solutions for remote instruction. Enterprise cloud platforms supplied turn-key tools overnight, sidelining decades of self-hosted, community-governed infrastructure built by SURF and member universities in favor of operational speed.

While the immediate operational risks were acknowledged, they were long viewed as theoretical edge cases.

"Nobody believed a trade war would actually happen, or that a government would cut off access to services overnight. That probability was always perceived as zero. Now, it’s not zero anymore, and that changes everything."

— Wladimir Mufty

From Pilot Projects to Production Platforms

Following AlgoSoc’s initial request, SURF evaluated multiple collaboration tools and selected Nextcloud. Though structured differently than incumbent commercial suites, Nextcloud proved mature enough to handle enterprise-scale workloads.

What started as a shared environment for a small group of algorithm researchers has evolved into a national footprint:

• Surfdrive Migration: SURF’s primary cloud file-sharing platform, serving tens of thousands of academic users, was systematically migrated to Nextcloud on its backend.

• Enterprise Workspaces: SURF delivers full Nextcloud digital workspaces—including video conferencing, real-time document editing, chat, and calendar management—to 30 institutions.

• Dedicated Research Enclaves: Through SRAM (SURF Research Access Management) and federated authentication, consortia like AlgoSoc run isolated environments compliant with strict European data regulations.

Expanding the Alternative Ecosystem

SURF’s digital sovereignty efforts extend across the open-source software stack:

1. Video Streaming via PeerTube: Proprietary platforms like YouTube frequently flag educational videos covering sensitive research topics—such as pharmacology, addiction treatment, or clinical medical procedures—due to automated moderation algorithms. PeerTube provides a self-hosted alternative where content moderation rules remain under institutional control.

2. Academic Social Networking via Mastodon: SURF deployed social.edu.nl, an open-source federated social network for Dutch research and higher education institutions. By integrating with existing institutional logins, it enables verified, ad-free academic communication free from opaque algorithmic feeds.

3. Data Ownership: Across all deployments, institutional data, algorithms, and core system architectures remain hosted within European borders on infrastructure owned or managed by the cooperative.

Decoupling the Next Frontier: Sovereign Artificial Intelligence

As generative AI tools become embedded in higher education, SURF sees a new layer of vendor lock-in emerging. Universities face demands from students and faculty for advanced AI capabilities, yet long-term API contracts risk deepening institutional dependencies.

To address this, SURF launched a centralized AI Hub hosted on its own sovereign hardware. The platform provides access to open-weights models under strict European legal jurisdiction, unified governance, and data protection standards.

The AI Hub decoupled application integration from model providers:

"We make sure the hub contains high-quality models. If an institution is not satisfied with Mistral, or if one query needs to go to Mistral and another to GPT-NL, it can switch without rebuilding anything."

— Wladimir Mufty

For model developers, SURF provides a clear incentive: by satisfying the cooperative's central security and compliance criteria once, providers gain potential access to 120 member institutions.

Open Source as a Strategic Instrument

While open source underpins these initiatives, SURF views open code as a pragmatic tool rather than a political ideology. Of SURF’s 50 core operational services, 38 are built using open-source components.

"Transparency, interoperability, building on each other’s work, reuse: you can achieve those almost exclusively with open source. With proprietary software, you pay twice for every improvement you make."

— Wladimir Mufty

The "Migration in a Weekend" Proof Point

The practical value of this approach was demonstrated when SURF shifted the underlying foundation of Surfdrive.

Surfdrive originally operated on OwnCloud. When corporate restructurings and shifting commercial licensing generated long-term uncertainty around enterprise support, SURF took advantage of its open-source setup. Because the code ran on SURF’s local hardware and the underlying data schemas were transparent, the team prepared a transition plan over six months.

Over a single weekend, SURF replaced the backend code with Nextcloud, seamlessly migrating tens of thousands of active users with no system downtime or loss of user files.

"Did we enjoy that? No. But did it cause us stress? Also no. The code was on our own machines, and we knew alternatives existed. If it had been a proprietary system, we could never have moved from one product to another in a weekend."

— Wladimir Mufty

Shifting Boardroom Perceptions Across Government

Historically, university boards and IT directors viewed open-source software with skepticism, often associating it with security vulnerabilities, unpolished user interfaces, or lack of commercial accountability. SURF has focused on reshaping this narrative, demonstrating that modern open-source solutions can deliver enterprise-grade performance.

To bridge this gap, SURF partnered with the Dutch Ministry of the Interior to organize an Open Source Leadership Summit, designed specifically for executive leaders, university boards, and government directors. The initiative has expanded beyond academia, with municipal authorities, provincial leaders, and water management boards joining the summit to align public sector IT procurement with public values.

This effort coincides with a broader policy shift across the Dutch public sector:

• Microsoft 365 Deployment Paused: The Dutch Tax Administration (Belastingdienst) paused its planned rollout of Microsoft 365 following advice from government IT review bodies warning against unresolved lock-in risks and data sovereign concerns.

• Regulatory Alignment: Five key national regulators—including the Dutch Data Protection Authority (AP), the Authority for Consumers and Markets (ACM), and the Dutch Central Bank (DNB)—issued a joint regulatory paper calling for digital autonomy to be integrated as a non-negotiable metric in all public sector procurement.

The Tension Between Collective Control and Individual Features

Rebuilding digital infrastructure requires navigating real operational trade-offs. SURF’s cooperative funding structure absorbs early financial risk by distributing software development and hosting costs proportionally across its 120 member institutions. This enables smaller vocational colleges to access open-source platforms alongside large research universities.

However, shared autonomy requires institutional compromise:

"Sometimes an institution thinks: I would have preferred this feature, or a little more of that. But you cannot choose your own background color when you are building a platform together."

— Wladimir Mufty

Overcoming Feature Parity Paralyzation

For SURF, the primary barrier to adoption is not a lack of open-source alternatives, but the expectation that an alternative must match every feature of an established commercial platform before it can be deployed.

While SURF offers 14 self-hosted cloud alternatives, many institutions still default to major commercial cloud vendors due to familiar interfaces and convenience.

Mufty stresses that software development requires active usage to mature:

"The only way to turn something that is a six into an eight is to start using it. If we keep asking whether it is already as good as Big Tech, the answer will always be no. That is the whole point."

— Wladimir Mufty

Key Takeaways for IT Leaders and Decision Makers

1. Sovereignty is Incremental: Digital autonomy is a spectrum, not an all-or-nothing choice. Introducing open-source platforms alongside existing systems steadily builds operational resilience.

2. Infrastructure Ownership Matters: Hosting code and data on sovereign infrastructure allows organizations to switch software providers smoothly when commercial terms change.

3. Decouple Applications from AI Models: Centralizing AI deployment through unified gateway infrastructure prevents deep vendor lock-in with AI providers.

4. Accept Functional Pragmatism: Independent software requires institutional adoption to mature. Waiting for feature parity before migrating prolongs dependency.