Jutta Kreyss – How the city of Munich measures digital sovereignty #FOSSBack

This talk explores the concept of digital sovereignty as implemented by the City of Munich, focusing on their methodologies for assessing and measuring digital services. The speaker, Uta Uta Chry, discusses her transition from IT architect for workplaces to IT architect for cloud services and the city's decision to establish a framework for digital sovereignty measurement. She outlines the process of defining digital sovereignty, the challenges in evaluating the city's IT service portfolio, and the development of specific metrics to assess over 194 application services. The approach includes adapting existing frameworks and creating a focused set of easy-to-answer questions for service owners. The talk emphasizes the importance of transparency and the commitment to continual improvement of these assessment methods in alignment with public administration processes.

Thanks for having me. I'm Uta Uta Chry. I'm the uh I joined the city of Munich in 2009. And at that point in time, I had been responsible as an IT architect for the Linux project. At that point in time, we developed and deployed the Linux workspace to the city up to 2017 uh when the city council decided to switch again for the workspace uh of the

whole city to Windows. So I stayed nevertheless I stayed with the team and in 20122 I moved from being IT architect for workplaces to IT architect for cloud. So um the city of Munich um established a measurement for digital sovereignity. We heard it already a couple of times this morning but I hope uh you get a little more a little bit more detailed now how we do

it, how we define it and perhaps also how it can help you and your organization really to be concrete and to apply it to your IT service tech. So let's have a look at the story started in June last year. So that was a point in time when the city council asked for us asked us with three different types of digital sovereignity. So this is the most

important part for us because it it requests that we measure the digital sovereignity of over our whole existing IT service portfolio. So the the problem was for sure um everybody here know is very well known with the definition of digital sovereignity. So it's different in Munich. So at that point in time the first uh thing which we had to do is to check for a baseline. So

which definition do we choose for digital sovereignity and really then to establish in the next step a measurement um than to measure all the services. You have seen this definition already I think at least twice today. Um the good thing is it's a really an old one. It's uh it was formulated in 2020 by the Franho Institute and reused by a lot of different people plan and

and a lot lot of ministries and for sure for senders and whatever. So I think that's is really a very good definition what I heard there at the moment in the ministry responsible ministry they are working to improve it to develop it further but I think it's really fine as it is today. So um what do we have? We have the ability and opportunity of individuals and

institutions as we to exercise their roles in the digital world independently, self-determined and securely. So um self-determined. So just the easy example. So I like to eat bread. So I can uh self-determined determinedly decide to which bakery I go. So and if I try to be independent in eating bread, I try to get rid of the dependency. So I check for not buying bread, I going to

baking bread. So I um get rid of that dependency. Nevertheless, for sure I stay with the dependency to flavor and for sure to the institution I get the electricity from. So this is you really have to think what is important where you like to go to. So when we have chosen so uh just for you to imagine so there is a city council and they have a

request and then we know in the department have to answer this request. So and we are gen generating a report and evaluating a method and so we did now the first part we have the definition for the lasting report everything has been uh became to an end in 20 in January end of January the city council improved what we had and so therefore I'm we are fine

now to communicate it to everyone everybody who likes to know it. So having the definition now the question is how we measure digital and if we as an IT department of the city of Munich we look into our content management database and we found more than 270 application services. Why application services? Um we have for sure business services, technical services, application services and we need somebody who

is able capable to answer the questions we ask. So there is no technical person on business services and technical services. So we have to go up to the level of application services. So we saw it's really too much at that point. It really has been 2,700. So we made a lot of rearrangements. So we are a lot better now also due to the request of the city

council in in June and nevertheless we need to set a focus and really it was that was really easy because we are always looking which of the services we have are business critical. So and then we decided let's just take these. So we just ended up with 194 services we have to assess finally instead of more than 2007 whatsoever. So we have a clear focus also a

a businessoriented focus for our customers in the city of Munich. Now the next question was what are the questions we asked the service owner of these application services and um we checked the market uh the market last year in uh in in summer up to October last year but first of all we formulated all the requirements we have so we have the requirements that we have to

evaluate our whole existing IT portfolio not just one business or just the whole system or an organization. It's just all the different services we have. That was the first challenge. Uh then it's clear whom we can ask the service owner and therefore we we have to be clear precise and just few questions formulate few questions. So if you're familiar with public sector you know you get as

a technical person you get a lot of administration stuff always on top and you ask that one and that one for this request for the city council and that one and it's never decrease is always just increase these question and technically people don't like it. So therefore we have to really to reduce the uh amount of questions um reduce to the max. Um the next point is

if we are looking in the market we we want to we have to select a method which makes a scarring which is transparent fast because we like to we have our only our own content management database and we like to reconstruct the method for evaluating the scoring. So we have to read it. It's freely available. it's published so we can use it. And um at the end

is the questions have to be special. They have to be so special that you can answer them with yes or no because we like to evaluate them at the end automatically. So that was the challenge we had and um then we we checked what was available at that point in time. Uh and if anybody of you is uh knows more of these measurements, I really would be

happy to join me uh and and let me know because I'm always interested to see what's going on there. Uh because I know for sure I missed I missed important things. Um the baseline is the Frown Hof Institute 2020. Uh great work conceptual report. Great, very good. Um bad news, no questions. And the next one and I think it's I have seen it in November last year

the cloud sovereignity framework and I hope to get the breakthrough when I read it but they divided uh digital soenity in eight different objectives so such as strategy legal data operational technology security and each of them at least with four question up to six questions. So they're rendered up with 39 questions that's not practical that's not usable for a city of Munich within a service owner and

the most important part is uh in comparison so just it's a consequence of the found institute report they assess an organization top down so with the processes skill the people the data um the the um the infrastructure and a little bit of software and we really look from another side. We we have all the software and we have to assess the software and the other things are

for sure important stuff but no answer to the request request we got from the city council. So um and what I really was disappointed when I read the report is uh there the framework you can't answer these questions couple of questions really give a you have to rate write a one page or whatsoever so really far beyond any automatical evulation. So what's next? For sure a lot

of consulting paid consultation uh companies organizations offer things. DISC has an has conceptual base at that point in time it was available last year. So what I have seen now is that they try to sell for sure consultation. Uh Avatar does the same bea also. So this is uh you don't see what they ask. You don't know how they measure it. You can't track it. you get

no um uh no actions afterwards. So if if you have enough money perhaps it's it's a good choice not for the city of Munich. Um and then there is a consultation also by paid consultation by beering point but you can the difference is you can access all the questions here 23 questions the same uh approach really a top- down approach to assess the um the whole organization

um at least you get impulse from that and what we finally uh had are the most we used as our blueprint is the qu are the questions from digital serverity.net there are easy answerable questions um which we took as blueprint adopted proofed so change for sure we changed it a lot but that this is a blueprint and the credentials go to University of Munich to Harold to

professor Harold Venus thanks a lot so for sure that's not all um feel welcome to inform me about other approaches and concepts to measure digital soenity so now we have we are fine we have our questions. We have the blueprint. We reworked it and now we can go through it and check it. So just seven questions easy to answer. The first one for sure you you know

it's always uh the goal that you can switch the uh the company you get the service from the organization. So uh interoperability to change um the service provider. So the first question is uh the question um does the software have the dominant market position within its c category so over 50% and the next one is special for us because we we are a huge for public sector

we are a huge organization in within the IT and we have to look for another enterprise service or whether we can build it of um of our own with reasonable cost and effort. So these are the two first questions. Then we have we check for security regarding with software updates. An easy question we ask whether it's open source but not just a piece of just two or

three or whatsoever libraries but the whole service have to be open source that you really can guarantee that they can switch the provider. And then two questions regarding standardiz standardizations the API and the file format. And finally not last um last but not least is the headquarter of the parent company of the software manufacturer or co cloud service provider located in the European Union. So for sure

for geopolitical reasons. And then how did we did we the evaluation? Um if you have a monopolist and you have no software alternative you end up in the worst degree so in five and then for the next question if you pass it you go step by step through the questions and you get always 20% uh benefit uh and then the appropriate ranking of your service for which

you answer the questions. So below again the uh giving the credentials to to University of Vitzburg. So that's now the whole picture we have. We have the five categories. We have our questions. We know what we assess and where we end up. That's our that's our ending up for our 194 services. So I'm really happy with the 60 66% uh with highly sovereign and largely sovereign services

and for sure um I always try to improve things. Therefore I I'm focused more mostly on the fifth category. So that's the not so server in part with 21% and you know if you answer the first entry questions and then you ended up in um which services do we have there? We have the services which are what which we have to use by law. Then services uh

which uh we need to um to operate our infrastructure. Then we have uh services by a huge um enterprise uh personal management company located in Europe. Uh and we have a couple of small applications which are really requested by the uh which are really specialized which are requested by the different uh departments in our city. So um we are proud to end up with that we as

an IT department uh base on this current underlying questionnaire and the selection of the critical application services so that we find that we have a high degree of digital sovereignity. Keep in mind that's our version 1.0. So uh we have been requested um we have been requested to do it. We did it in the first version. really we like to improve it, develop it further. So let's

see where we end up. So that's is that's and when we so in January when uh for sure the source is in German so if somebody like to check it but thanks you you can uh easily translate even that German stuff. Um what we promised the city council is um that we are going to further develop it uh the meth methodology and that we also integrating it

into the processes of our public administration in within the IT and that we are going to report on it on a annual basis and last but not least also to name a representative for digital soenity. What ch what opportunities do we have as an IP department? We can go now through these 194 services and check are we going to accept the risk? Are we don't we accept

the risk? Do we like to have any actions against to reduce the risk so that we make a uh a decision what to do with these um sovereignity a result of the sovereignity digital sovereignity checks. We put it put everything on the creative common license. So you're welcome to use it, to adopt it, to spread it, to comment it. Feel welcome. And finally, thank you. >> Thank

you very much for the talk and for the work you do in Munich. Um, can you explain what critical uh processes mean? Is that something you have to do by law? And uh, maybe a second question if I may. um the overview of the one to five classes. Is there any evaluation how much a service is used if it's in class five? So is it used by

100,000 people or is it used by one uh person or is there some measure maybe in euro or so which where you can see I don't know how hard the problem is to solve. The difficult question is the second one. Let's give you an answer on the first question. Um what does business critical for a public sector mean? So we have three criterias. The first is um

the um our highest management of our city council uh is we we get rid of them for what reason? So that's so the management the highest management um disappears. So um if this that that's the first criteria of the business critical. So it's a neon don't don't ask me for the numbers. So there is one and um but as a public sector we don't care about that

one because we just vote. So the next one is if we don't have the uh the land of um the organization the land is going to be we're going to lose the land. That's also not very uh likely within the city of Munich. But the third thing is um that we are going to lose the people who going to take the services which are then going to

be assessed as critical business critical. So that for sure can happen. For example, if we have uh we have um uh we have a registry with all people living in uh in in Munich and if we lose this database. So the third criteria is a critical criteria and this was the base we make the assessment of each new coming service within the IT surface portfolio of the

city of Munich. So that's where business critical business criticality comes from and the other point you ask for a correlation between people and number of users of a service and the service itself. Um I think it's I already know that that's business critical. So if I even if I have just few people here and I would lose the service so I lose a business critical service. So

that's really impacting my business as city of Munich. So it I really do not care how many people that is because the main um assessment is that it's has been business business critical. The other question is you ask how how difficult is it to get rid of the service? Um that's um that's it depends on the service itself. If I have for example a service which is

requested by law that could change uh if I perhaps easily I don't know uh I'm not so familiar with the with the details in the government on that. uh but if we have something in the infrastructure it's difficult to change but it's our own stuff for example for sure if a um if a if a hypervisor increases the the license uh the charge charge of the license

significantly so for sure we have assessed that we we check what alternatives we have so that's really the thing and that's baseline that impacts all of the services because it's it's our hypervisor beyond don't know whether that's answer the >> yeah thank you for the presentation of the figures u uh but that are figures now my question for your opinion I remember when there was this bank

crisis or financial crisis they the banks had to do some stress tests >> could how what do you think would that also make sense or could you imagine to have stress tests for city of Munich what if um to really get a testing. Okay. Now, because figures because 21% on level five is nevertheless 21% on level five, right, that you had and the impact is the question

is 20% potentially making a bigger impact. >> Yeah. we are good on answering technical questions. So we have we have two uh data center we can do a failover so that we prepared very well. Um but we didn't think what we if if we would all miss all these all these services probably uh the 194 services probably the city of Munich wouldn't exist any longer. So we

wouldn't have a real different problem than keeping up alive these services. Um but to making um yeah to to check a mental check what that would be if just one for example we have uh a lot of services regarding voting voting just uh is just important if you v when you vote if you don't vote so no problem so it's also a question in time so but

I think it's it's a very good idea really to to think of scenarios and to go through if which services are impacted when I have which scenario. So yeah, thanks. >> Can you can you elaborate a bit on the consequences of this study? So now you have the baseline, you have the inventory and the criticalities and do you have a outlook for the future for potential remediation

plans or what's what's up next? What's up next is that we are going first of all to to move the responsibility in in our regular organization so that there's that there is a team which takes uh it cares for this uh topic all over the time. So that's the first really to have one to look for uh and then uh these person then uh check which method

are we going to do that in in this way or in a different way. It it depends whether for example which part of the organization it goes through. Um we have to report uh annually. So that's a fix. Um so these are the the few parts what we already have um fixed on what what is sure so far. But uh probably if you ask me in six

months though I know more. Right. Now I can ask a stage host a question myself because I have a mic anyways. Um I happen to come from the Netherlands where we have the association of municipalities. Is the work of the city of Punin also shared uh across Germany and across Europe via cir collaborations where you share the material of what you find out about this research with

other uh municipalities? >> Uh I would be very happy to do so. Um the initial uh publication has been in German. So uh that's the first talk in English on the topic. So it could be the uh the actions ready to to spread it further. You are welcome. All right. Thank you. And if there are no further questions then I'd like to wrap it up. And thank

you very much. >> Thanks.