Blog

Sovereignty is not ideology, it is security policy

My article Sovereignty is not ideology, it is security policy has been published in AG Connect 5 (2026). Using the US sanctions against the International Criminal Court as a case, it shows that digital dependency is a concrete information security risk.

A foreign government does not need to hack a server to bring an organisation’s IT to a halt; a sanctions decision can be enough. Karim Khan, Chief Prosecutor of the International Criminal Court, lost his Microsoft workplace, and the Dutch service provider ProcoliX informed the Court that it had to stop its services. That directly affects the three goals of information security: availability, integrity and confidentiality.

OpenKAT 1.23 (Cody): better insight into software, leaks and vulnerabilities

OpenKAT 1.23, released under the name Cody, is now available. This release shows more of what is out there: more software, more context around leaks and more results from external sources. OpenKAT also runs on new platforms and scales better in large environments.

Better insight into software

OpenKAT now recognises software from Shodan banners, nmap results (CPEs) and service banners, including over IPv6. This gives a more complete picture of what is running on systems. Version 1.23 also uses a newer version of the Playwright browser to take more complete snapshots of web pages, which reveals more of the software in use.

SAFARI makes digital sovereignty measurable

This morning (7 October 2026), SAFARI was presented to an audience of 325 auditors from the Dutch Tax and Customs Administration. SAFARI is an open methodology that helps organisations assess and substantiate their digital sovereignty systematically.

Digital sovereignty concerns the control an organisation actually has over its digital services, data and suppliers. Can it make its own choices? Can it continue operating if a supplier, technology or part of the supply chain becomes unavailable? And can it demonstrate which laws govern its data and systems?

The foundation has been there for thirty years

The Netherlands has been taken to court by the European Commission. The reason: the government has still not converted the directive for the protection of vital sectors such as energy, transport, healthcare and digital infrastructure into national legislation. The Ministry of Justice and Security responds that ‘a good foundation is first needed’. That answer deserves a closer look.

The information security standards framework on which this relies, ISO 27001, has existed in the form of its predecessors since the 1990s. The European directive has been on the table for years. Moreover, legislation starts in Brussels and the Netherlands is a member and can simply participate, not only once the text is final. A foundation could and should have been in place a long time ago. How much more time does the government want?

OpenKAT 1.22 (Deanna): Faster work, quieter systems

We are proud of the release of OpenKAT 1.22 “Deanna”. This version is named after Deana, the mother of our mascot Keiko. She recently passed away. We honor her with this name and at the same time this release symbolizes a solid, reliable foundation. This release is all about one thing: performance. OpenKAT has been heavily optimized in many places. You will notice this immediately:

• Everything feels faster
• Systems are less burdened
• Analyzes run more efficiently and smoothly In other words, OpenKAT does the same job, but smarter and lighter.

Just works better In addition to the technical improvements, daily use was also taken into account:

Opinion: Keep DigiD out of American hands while you still can

“Digital autonomy must be the starting point for the government,” the government states in the coalition agreement. A sensible course. With the recent deal with a European cloud provider, the government is taking a step in the right direction, after years of putting all data and processes in the American cloud without hesitation. However, now that Solvinity, the supplier behind the infrastructure on which DigiD and the Message Box run, is sold to investors from the United States, we are once again making our country more dependent on the American government. The Netherlands can easily put geopolitical pressure on this, for example with the threat to suspend services. The sale must therefore be stopped, argue Pieter Omtzigt, Reijer Passchier, Jesse Six Dijkstra, Ferd Grapperhaus, Marleen Stikker and Brenno de Winter.

Core value: freedom and openness

For LibreKAT, freedom and openness are not a decoration around technology. They are conditions for trust. Those who depend on systems that cannot be studied, questioned or adjusted ultimately have to rely on promises. Open technology makes it possible to verify those promises.

Open source is important, but not magical. Open source code does not automatically mean that software is safe, mature or suitable. It does mean that users have rights: view, test, modify, improve and share. That changes the balance of power. An organization does not have to be completely tied to the original supplier if the rate, price or conditions change.

Core value: humanity and respect

There are people behind every system. People who write code, manage systems, investigate reports, make mistakes, implement policies, and experience consequences. Information security without humanity quickly becomes harsh, procedural and blind to the reality in which technology is used.

Humanity and respect mean that safety is not organized across people, but with people. Users are not a difficult factor in an otherwise perfect architecture. They are part of the system. A measure that structurally frustrates people, is unclear or is only understood by specialists, leads to detours and a false sense of security.

Core value: integrity and independence

Integrity and independence determine whether research, advice and technology can be reliable. Not because people never have interests, but because those interests must be visible, manageable and subordinate to public values. For LibreKAT this means that choices are testable and are not driven by commercial dependencies that color the outcome in advance.

In information security, integrity also has a technical meaning: data and systems must be correct and must not be changed unnoticed. That meaning fits well with the organizational side. Decision-making must also be honest. Anyone who advises a security measure, points out a vulnerability or assesses a dependency must be able to explain the facts, standards and considerations that underlie it.