On June 15, 2026, I spoke at IDHEAP in Lausanne during “Digital Sovereignty: Strategic Foresight and Concrete Measures”. The event brought together several prominent voices in the Swiss digital-sovereignty discussion, including Valérie Dittli, Member of the Council of State of the Canton of Vaud; Prof. Dr. Matthias Stürmer and Pascal Stöckli from Berner Fachhochschule; Thomas Jacobsen from Infomaniak; and Jean-Christoph Schwaab, former Member of the Swiss National Council and author of Pour une souveraineté numérique.
The event addressed digital dependency, geopolitical and legal risks, open-source alternatives, sovereign cloud, and the need for coordinated public-sector action. My contribution focused on a more technical, but very concrete, layer of the same discussion: the infrastructure that makes public digital services work.
I used GeoServer 3 as the example. GeoServer is not the kind of software most citizens open directly. It sits behind maps, geodata portals, spatial data services, and public digital platforms. It helps make geographic information publishable, interoperable, and reusable. Cadastre, mobility, energy, climate, risk management, protection civile, urban planning, public works, and open data all depend on geospatial infrastructure of this kind.
A large part of digital sovereignty is decided in components that do not look strategic until they fail, age, or become difficult to secure.
GeoServer 3 did not start as a feature story. It started as a maintenance and security story. The project depended on a technical foundation that needed deep modernisation. A core framework was reaching the end of its security support, and updating it meant work across Java, Spring, Jakarta, servlet containers, extensions, documentation, compatibility, security practices, and ecosystem testing.
This kind of work is easy to ignore and difficult to fund. It rarely creates a visible new feature for one customer. Its value is continuity: keeping a shared infrastructure secure, maintainable, compatible, and usable for many organisations at once.
The scale was too large for one company, one development team, one sprint, one maintenance contract, or one customer. Camptocamp, GeoCat, and GeoSolutions therefore created a consortium and organised a crowdfunding campaign. The financial target was EUR 550,000, with seed contributions from the consortium members and a wider community funding goal.
That campaign transformed a shared risk into a delivery path. It brought together funding, governance, contributor capacity, coordination, milestones, and implementation work.
The result was not only a promise or a position paper: GeoServer 3 was delivered in June 2026.
The lesson I wanted to share was simple. Open source gives essential freedoms: to use, study, modify, and share software. But those freedoms remain theoretical if the ecosystem is no longer maintained, if dependencies become obsolete, if security work is underfunded, or if nobody pays for the less visible work that keeps the infrastructure alive.
For public-sector organisations, this leads to practical questions:
- Critical dependencies: which open-source components are essential to public services?
- Maintenance: who maintains them, and how is security work funded?
- Mutualisation: where can needs be shared with other institutions?
- Procurement: how can governance and continuity be treated as part of the purchase, not as afterthoughts?
My closing point was that digital sovereignty is not obtained once and for all by choosing open source or selecting the right provider.
Digital sovereignty is a capability. And like any capability, it has to be maintained.