Sovereign Tech Agency

could also be used by adversaries to pick into those weaknesses when they find them.

One of the other interesting bits that I've spotted in the PHP Foundation press release about this, which is so detailed and worth reading because it just lays it all out in quite a lot of interesting detail and it's quite accessible, is that the first time they spotted it back in 2024, it was thanks to some funding they'd got from this German agency called, which I now can't remember the name of and I've got it on my laptop, the German Sovereign Tech Agency, which was set up by the German government to invest in... just keeping technology safe for Europeans.

That's the sovereign bit of it.

And it was some funding from them that alerted the PHP Foundation to this flaw.

That is, until one government chose to look at open source software as a public infrastructure problem.

In Germany, they created the Sovereign Tech Agency, which is the first publicly funded organization in Europe that supports the development, improvement, and maintenance of open digital infrastructures.

Its sovereign tech fund invested 15.25 million euros in 40 projects in its first year alone, and it has since provided more than 24.6 million euros to over 60 open-source projects around the world.

A few things about its standout.

I mean, there was quite a few.

So, um, I was there, um, actually by invitation from the Sovereign Tech Agency.

Um, the Sovereign Tech Agency is... was sort of spun off by, um, the UN, and in particular by the, uh, German delegation originally to, uh, look up- at creating digital sovereignty, and they've been sponsoring open source folks to go to events like UN Open Source Week.

So there were people from the Python Software Foundation-

Hmm

...

PyPy, um, uh, the Processing Foundation, the Sovereign Tech Agency itself, Drupal of course, um, Open Science Foundation.

There were people in robotics.

And that was part of what we set out to solve with Clara is making sure that when these companies had either a desire to just see some development happen or see the support happen or had specific support needs or specific features they wanted to add, that there was somewhere they could go.

But to your question about are there any other solutions, one of the interesting ones that Germany has done is they've founded the Sovereign Tech Agency.

which is basically they gave a pool of money to this nonprofit to go through different open source projects and find the maintenance type things that need to be done, but nobody's paying for because they're not the sexy features that companies pay for.

And they're just not the thing anybody... you know, a voluntary developer is going to do in their spare time because it's all the janitorial type stuff.

And by actually being able to fund developers to do that work, and it's done a lot for a lot of projects, whether that's OpenSSL and FreeBSD and all kinds of different open source projects have got really useful help from projects like the Sovereign Tech Agency, or there's another one called Alpha Omega that's focused on helping projects stand up better vulnerability reporting and making sure that they can handle the fact that with AI now, every project's getting vulnerabilities found against it.

And projects that previously didn't really have the whole infrastructure of a security team need to be able to deal with these bug reports.

And maybe they didn't have the structure and the policies in place to do that.

you.

And also an example, Germany has something called the Sovereign Tech Agency to the funding point that helps open source maintainers.

But there are very few examples of that.

And of course, a lot of the conversation from global south countries often is that most of the open source maintainers and funding for it are in the global north.

They replicate them still in some of the public sector, but that'll die a death too.

And I think you need to think beyond that and where is it going? You see things like the Sovereign Tech Agency in Germany distributing funds.

I think that's another thing that this foundation, it won't be a real foundation because we don't have the same corporate structures, but this institute, this body would be for the UK.

But we really need that centralised body and we don't need to build an ivory tower or a silo.

Yeah.

I think that makes perfect sense.

And I mean, this harkens back, I think, to some of the work like the, I'll pick on the Sovereign Tech Agency right now, is while they are a German organization, they are happy to fund efforts outside of the country of Germany.

Mm-hmm.