UU’s long road towards digital autonomy

“If Trump wants, Europe could be at a standstill tomorrow,” Marije de Vries, Strategic Coordinator for Digital Autonomy at Utrecht University (UU) sighs. 

Last year, the US President’s attacks on academic freedom prompted professors José van Dijck and Albert Meijer to pen an open letter to the Executive Board, accompanied by a petition, highlighting the dangers of the university’s dependence on big tech. A few months later, Trump instructed Microsoft to deny the Chief Prosecutor of the International Criminal Court (ICC) access to his account in retaliation for the conviction of the Israeli Prime Minister.

“How great is the risk that Trump will push a button tomorrow and affect UU?” De Vries wonders. “Well, I’d say both high and low. He could target a particular researcher who is critical of Israel or retaliate against research into sustainability or diversity, for example.”

All the more reason for UU to commission a study into how dependent it is on American big tech companies. In February, the university asked De Vries, Head of IT at the Faculty of Veterinary Medicine, to lead an exploratory study into digital autonomy, alongside her current position, for two days a week until the summer of 2027.

Since then, De Vries has spoken with many people, both inside and outside the university, to determine what UU needs to do to reduce its vulnerability and how. 

“This is not a full-fledged project with considerable funding, aimed at making everything digitally autonomous. Instead, we aim to define where we should focus our efforts. After all, this costs a lot of money and requires a lot of manpower. We must make strategic choices.”

Her discussions will inform a memo, to be presented to the Executive Board in March or April 2027, and then to the UU Council. “By summer, the broad outlines of where we’re heading should be clear.”

In addition, UU is working with the association of Dutch universities, UNL, and the Dutch government on a roadmap for the coming years. Former UU Vice-President Margot van der Starre was one of the university representatives on this committee until she stepped down. However, UU will still be closely involved in the decision-making process, as De Vries was asked to join the support team. 

A stroke of genius
De Vries says UU is one of the leading universities on the road towards more digital autonomy. The university can thank Tim van Neerbos among others for the head start. He and colleagues developed the Digital Autonomy Assessment Framework (DAAF), a free, open-source tool to help organisations measure and map their technological dependencies and vulnerabilities. 

Launched in April 2026, the tool evaluates software and applications on three levels: the magnitude of external risks, how well the institution can mitigate them, and how important the application is for core tasks. 

“A stroke of genius,” as far as De Vries is concerned. “You choose an application and then answer a questionnaire. In half an hour, you get a score, which you can compare with other applications’ scores or see how your organisation fares in comparison with others.” 

Before the summer break, UU finished assessing 140 of its most-used applications, such as Microsoft365, SAP, Osiris, and YODA. Other Dutch universities have now started doing the same, as well as primary education and higher professional education institutions. The word has spread internationally, too: according to De Vries, the universities involved in the Charm-EU alliance are also interested in testing DAAF.  

DAAF’s assessment revealed that UU’s biggest risks lie in infrastructure and the work floor. “We currently rely heavily on US software for logging into our applications and managing our network; if that software were to stop working, the university's entire IT landscape would grind to a halt.”, she explains. “That’s mostly IT work behind the scenes, which students and staff don’t even notice.” De Vries says. 

The Faculty of Geosciences hosted the Digital Autonomy Café on 6 July. The next edition will take place on 2 November at the Faculty of Humanities. Photo: Laura Hompus

Pilot projects
The assessment has also inspired four new pilot projects, to be carried out jointly by IT staff at the faculty level and the university’s ITS department. For three months, they will explore alternatives to some of UU’s most vulnerable applications, and the findings will be included in De Vries’ report. One such pilot is an internal email platform, which would be a back-up for Microsoft’s Outlook.

“We want to look at what kind of issues we’d run into if an emergency forced us to get something up and running very quickly,” De Vries explains. “Getting an email server up and running isn’t all that complicated. The issue is, we’re such a large organisation. Users must log in without any problems; they don’t want any spam in their inboxes... And what do we do with the old mailboxes?” 

Next, De Vries shows us her Linux laptop and her Fairphone, both of which UU’s pilots are also testing. Fairphone is a Dutch smartphone designed for long-term user repairability. UU is testing a Fairphone version that runs Murena, a French, privacy-focused operating system. 

De Vries enumerates some of the questions the pilot aims to answer: “How feasible would it be to have it in our range, alongside Android- and iOS-operated phones? Is it secure enough in the long run? Is it a sound investment? What would it mean for the telecommunications department to have to manage this as well?”

A research group from the Faculty of Science, led by Slinger Jansen, will address these questions alongside the IT staff of Humanities and the ITS department in the coming months. 

Hackathon
The remaining two pilots involve offering a Linux workstation to an “IT-savvy user group” and developing an alternative module to the educational system Osiris, which is owned by CACI, an American company closely connected to that country’s defence industry. Osiris is “constantly” adding new modules, making the university increasingly dependent. “We come to rely on a single product for many aspects of the educational process,” De Vries explains. 

Therefore, the pilot aims to build an internal substitute for one of Osiris’ components; namely, the one with course descriptions. “It’s pretty innocuous,” says De Vries, “none of that information is sensitive. But suppose we want to create a separate little module? How complicated would it be? What would that entail?” 

For this pilot, the university will call on students to help. UU will soon announce a hackathon to build such a course-description system.

Nextcloud
UU’s new pilots will run alongside the Nextcloud pilot initiated by the SURF ICT cooperative. A group of 120 UU employees had the opportunity to out this German alternative to Microsoft  – including De Vries, of course.

“My IT team at Veterinary Medicine uses Nextcloud to communicate with each other, but we still have Teams to talk to the rest of the university,” she says. “It takes some getting used to, but it’s pretty good. The tricky thing is that you have two systems running side by side, and they don’t quite work together properly.”

UU expects to complete its first Nextcloud evaluations by the end of the year, but the pilot will continue into 2027. UU’s conclusions will be added to SURF’s final report. 

De Vries hopes everyone will be on board with the changes, but also believes in a more top-down approach. “Of course, it’s better when people do it voluntarily, but I also think we’ll need to have some impetus from the top in the future,” she ponders. 

“It’s important that we use services like Signal or Nextcloud. After all, if we keep using the same systems, not only are our core processes at risk, but we’re also putting money into companies that do not act in accordance with public values. This way, alternatives can never develop.”

Those interested in joining the pilots can email da@uu.nl. For more information on participating, visit this page.