Sovereignty Is Engineered, Not Procured

-->

Sovereignty Is Engineered, Not Procured

Europe often asks whether it can build a company like Palantir: a software champion capable of serving intelligence, defence, law enforcement, crisis response, cyber defence, and public-sector decision-making at scale.

The usual answer is that Europe lacks data, capital, talent, or legal room. I do not think this is the full story.

The capacity is there. The data is there. The technical talent is there. The public-sector problems are real, urgent, and interesting. What is often missing is the will to tackle complex programmes seriously, over time, with teams that are allowed to build, fail, iterate, and take responsibility.

Europe does not need a Palantir clone and definitely does not want such a proprietary tool. It needs the capacity to build strategic software for intelligence and security missions without outsourcing the core of its thinking.

The problem is not only procurement

European intelligence and security organisations often buy American intelligence products, American analytics platforms, American cloud stacks, and American operational software. This is sometimes justified by speed, maturity, interoperability, or political convenience. Those arguments are not always false.

But they hide a deeper problem: dependency becomes culture.

Once an organisation accepts that the difficult software will be bought elsewhere, internal teams slowly lose the habit of building. Procurement becomes a substitute for strategy. Legal review becomes a substitute for leadership. Risk management becomes a substitute for execution.

In such environments, the safest answer is always “no”:<br>No, we cannot expose this.<br>No, we cannot publish this.<br>No, we cannot collaborate.<br>No, we cannot build it ourselves.<br>No, legal will not allow it.<br>No, procurement will take too long.<br>No, it is too sensitive.

Some of these objections are valid. Many are excuses.

The result is predictable: Europe keeps producing excellent policy documents about sovereignty while buying the operational substrate of sovereignty from others.

Intelligence software is not magic

The mystique around intelligence software is harmful. Much of the work is not magical. It is hard engineering, data modelling, workflow design, access control, auditability, graph analysis, entity resolution, case management, knowledge management, search, enrichment, automation, feedback loops, and user experience.

These are difficult problems, but they are not impossible problems.

The difficult part is not only technical. It is organisational.

You need teams that understand the mission and the technology. You need product owners who know the analysts’ work. You need engineers who are trusted with real problems, not toy datasets. You need security and legal teams that help build safe ways forward instead of only producing reasons to stop. You need leadership willing to accept that serious internal capacity cannot be built through one-year projects, rotating committees, or PowerPoint roadmaps.

A European intelligence champion would not emerge from a single procurement framework. It would emerge from a culture that rewards building.

The counterexample: agencies that publish

There are public counterexamples.

The NSA has released and maintained open-source software. Ghidra, its reverse-engineering framework, is one of the most visible examples. Apache NiFi and Apache Accumulo also show a pattern: internal capabilities can be released, reused, governed, and improved outside the original classified context. SELinux is another historical example of a security capability that moved into the broader ecosystem.

National Geospatial-Intelligence Agency (NGA) produces a significant numbers of geo-spatial open-source tooling such as MAGE.

GCHQ released CyberChef, a widely used browser-based tool for encoding, decoding, transformation, and data analysis. It also published Gaffer, a graph database framework designed for large-scale entity and relationship analysis.

In Europe, ANSSI has published tools and policy around open source, including CLIP OS and digital forensics tooling. CIRCL’s MISP is a strong European example of an open-source threat intelligence and sharing platform built by practitioners for practitioners.

These examples matter because they show that “sensitive mission” and “public engineering” are not mutually exclusive. You do not publish secrets. You publish reusable infrastructure, generic tooling, schemas, libraries, documentation, and lessons learned.

The public artefact is not the operation. It is the scaffolding that makes the operation more mature.

Open source is not charity; it is capacity building

When an intelligence or cyber agency releases useful software, it is not doing charity. It is doing industrial policy, recruitment, standardisation, quality assurance, and ecosystem building at the same time.

Open source can:

attract engineers who want to work on real...