AltLibre is an independent research practice working on digital sovereignty: where data sits, whose laws it answers to, and what that costs. It publishes papers, analysis and a public evidence base. Advisory work is available.
Technology & Cyber Security Leader · Founder of AltLibre
I’ve spent thirty years in technology: UK central government, higher education, and international development in some of the world’s most fragile states. These days I make one argument more than any other. Where your data sits matters far less than whose laws it answers to.
I’ve worked in and around technology for over thirty years, in places that don’t usually turn up on the same CV: Whitehall, universities, and aid programmes in fragile and conflict-affected states across Africa, Asia and the Middle East. The same question followed me through all of them. Not whether we could build the thing, but who would control it once we had.
AltLibre is my attempt at an answer. I started it to help British and European organisations see a dependency most had never priced: data held by a US company answers to US law, wherever the servers happen to sit. Some of that work is practical, swapping Microsoft, Google and SAP for open-source and European tools that are GDPR-compliant by default. Some of it is duller and matters more: working out which of your data needs protecting, and knowing how you’d leave a supplier before the day you have to.
I write here, and post most days on LinkedIn and Bluesky, about digital sovereignty, cyber security in the aid sector, AI and where its ethics give way, and the risks technology dependency carries in poorer countries. I work from Cornwall, which turns out to be a good place to think about this. The cables, the wind farms, the new data centre and the question of who owns it keep the sovereignty argument from ever staying abstract.
AltLibre is a personal research practice, run in my own time. Everything published here is my own view, and does not represent any employer, client or organisation I work with.
Using AI without handing over your judgement.
Read articles →Keeping data and people safe, especially where the stakes run high.
Read articles →GDPR in practice, and why your personal data is not your employer's asset.
Read articles →Where your data sits, and who it answers to.
Read articles →Cost, lock-in, and the long game of what you choose to depend on.
Read articles →Staying out of the way of people who are good at their jobs.
Read articles →
Digital Sovereignty
European defence runs on American cloud: nineteen countries on Microsoft alone. Brussels has drafted the law to change that, and the ministries are fighting it. What the Cloud and AI Development Act does, the oath that settled the sovereignty question, the precedent that shows the machinery has already turned, and three scenarios labelled as what they are.
IT Strategy
Year one of paid Windows 10 security updates ends on 13 October 2026, and year two costs twice as much. What ESU costs in the UK, what Cyber Essentials accepts, and the four exits compared, including Linux.
Digital Sovereignty
The compliance case for sovereignty is well rehearsed and slightly dull. The commercial case is newer: a market being created by procurement, and a supplier position that can now be priced.
If you want to know where your organisation answers to, and what changing it would take, get in touch. If you’d rather start with the numbers, the calculator is a fair first look.