Stop using engineers as shock absorbers

Stop using engineers as shock absorbers

Look at almost any modern tech job advertisement today, and you’ll see the exact same list of benefits: “Flexible hybrid work, autonomous culture, latest hardware, and regular team events.” Yet, despite these perks, tech companies worldwide face a persistent crisis: their highest-performing senior engineers and tech leads are silently walking out the door. Industry data confirms this gap. According to global developer experience benchmarks, over 65% of senior engineering turnover is driven by organizational friction and administrative noise, rather than technical difficulty or compensation. Developers do not quit because of a lack of team socials or fruit baskets. They leave when their day-to-day job becomes buffering their team against executive indecision, sitting in low-value alignment meetings, and blunting structural chaos. The "Human Shock Absorber" In many growing software organizations, a subtle leadership failure occurs as teams scale. When executive boards struggle to establish clear strategic boundaries or resolve cross-departmental friction, they quietly delegate that responsibility downward. They create what can only be called a Frankenstein Role: a Tech Lead or Staff Engineer who is asked to be 100% hands-on architect, 100% people coach, and 100% process firefighter. Instead of solving complex technical problems or building scalable cloud architectures, your highest-paid technical experts become human shock absorbers. They spend up to half their working week absorbing leadership noise, translating vague goals, and mediating conflicts that should have been settled at the C-level. Research on developer cognitive load shows that modern software engineers spend less than 30% of their actual workday writing code or designing software. The remaining time is consumed by context-switching, status updates, and navigating organizational friction. The Real Math Behind Senior Engineering Turnover When a burned-out senior engineer or lead resigns from a bloated role, the financial damage on the P&L statement is far larger than most executives realize. The true total cost of losing a key technical figure can be broken down using standard engineering talent benchmarks:Cost Category Impact Level DescriptionDirect Replacement Costs Significant Agency fees, interviewing hours, sign-on packages, and competitive market salaries for senior talent.Onboarding & Ramp-Up Substantial Lost productivity during the 6 to 9 months it takes a new senior engineer to master a complex codebase.Contagion Effect (Domino Turnover) High Risk McKinsey research shows that when a respected lead quits, team members are up to 35% more likely to leave within 6 months due to increased workload and chaos.Roadmap & Market Delay Severe Slid delivery dates, delayed feature releases, and missed market opportunities.Plaguing your organization with high turnover isn't a recruitment issue—it is a direct leadership leak. You Can't Code Out of Broken Governance With the rapid adoption of AI coding assistants, agentic dev-tools, and automated testing suites across engineering teams, leadership teams often assume tech investments will solve their productivity bottlenecks. However, recent studies on AI engineering adoption highlight a clear contradiction: While AI assistant tools improve individual line-of-code generation by 15% to 20%, total organizational delivery velocity in chaotic companies improves by less than 3%.Why? Because generating code was never the primary bottleneck. If your decision-making process is slow, your boundaries are blurry, and your teams are misaligned, AI tools simply help your developers build the wrong things faster. Buying AI licenses to compensate for poor organizational design is one of the most expensive escape routes on an IT balance sheet. You cannot solve a structural leadership deficit with a software subscription. How to Sanitize Your Engineering Leadership Restoring execution speed and retaining top-tier engineering talent requires structural clarity at the top. You don't need another soft skills workshop, agile transformation, or internal culture initiative. You need clean leadership architecture: 1. Keep C-Suite Accountabilities at C-Level Executives must set firm strategic priorities, establish binary boundaries, and clean up inter-departmental politics. Never ask a Tech Lead or Engineering Manager to resolve organizational friction without giving them explicit executive authority. 2. Ruthlessly Separate Technical Roles from Line Management Stop expecting senior engineers to be elite software architects and full-time people managers simultaneously. Create clear, parallel career tracks:Individual Contributor (IC) Track: Focused 100% on architecture, technical execution, and code quality. Engineering Management Track: Focused on people development, resource allocation, and team enablement.3. Measure Friction, Not Just Output Instead of tracking raw output or ticket velocity, measure organizational friction:How many hours a week do senior leads spend in alignment meetings? How often do decisions made at the top get reopened three weeks later? How long does it take to get a clear 'yes' or 'no' on technical decisions?Closing Thought Senior A-players in software engineering do not leave companies because the work is hard. They leave when the work is made unnecessarily chaotic by a lack of leadership structure. The next significant improvement to your bottom line and product delivery won't come from a new framework, a recruitment drive, or another AI tool. It will come from eliminating the hidden operational friction that is draining your lead engineers today. Ask yourself: Is your executive team providing clear boundaries for your engineers to build great products, or are you using them as human shock absorbers for organizational noise?

The ungoverned cloud: Why cloud strategies fail at execution.

The ungoverned cloud: Why cloud strategies fail at execution.

In boardrooms across Europe, cloud strategy is undergoing a harsh reality check. For years, the narrative was centered on speed and migration. Today, executive teams face a very different set of challenges: unpredictable cloud expenditure, strict regulatory mandates (NIS2, BIO2, EU AI Act), and diffuse operational accountability. When external audits reveal that two-thirds of cloud environments lack proper control, the executive reflex is predictable: install a heavy Governance Board, write 80-page policy manuals, and require manual sign-offs for every change. This approach fails every time. It creates shadow IT, paralyzes delivery teams, and fails to eliminate actual risk. Personally, I view cloud governance not as a bureaucratic brake, but as an operational operating system. True governance provides clear guardrails, automated compliance, and organizational clarity—allowing engineering teams to move fast safely. To achieve this, organizations must move away from theoretical policies and implement a functional Cloud Center of Excellence (CCoE).The 5 Pillars of Cloud Governance Before structuring your team, you must define what cloud governance actually encompasses. Mature cloud governance covers five distinct operational domain pillars:Pillar 1: Financial Management (FinOps)Shifting from static annual IT budgets to dynamic unit economics, continuous cost allocation, and real-time optimization.Pillar 2: Security & Regulatory Compliance (NIS2 / BIO2)Enforcing baseline controls aligned with NIS2, BIO2, ISO 27001, and GDPR across all cloud landing zones.Pillar 3: Automation & Platform EngineeringEliminating manual infrastructure configuration through Infrastructure as Code (IaC) and automated developer platforms.Pillar 4: Identity & Data Control (Zero Trust)Implementing Zero Trust architecture, strict least-privilege principles, and explicit data boundaries.Pillar 5: AI & Emerging Tech Governance (ISO/IEC 42001)Setting parameters for responsible AI use under the EU AI Act and ISO/IEC 42001, preventing unmanaged shadow-AI implementations.What Is Expected of C-Level Leadership? Cloud governance cannot be delegated away to IT or a compliance team. Real governance requires active C-level involvement, clear sponsorship, and strategic alignment. Here is what is explicitly expected of executive leadership across each core domain:C-Level Role Core Executive Expectation & Operational ResponsibilityChief Executive Officer (CEO) & Board Treat Cloud Governance as Risk Management: Recognize that cloud failure, data breaches, and non-compliance carry direct board liability under NIS2. Establish risk appetite boundaries and mandate cross-functional governance across the company.Chief Operating Officer (COO) Align the Operating Model & CCoE Mandate: Provide the CCoE with formal authority to set organizational standards. Break down functional silos between IT, Security, and Business units, ensuring that delivery speed never bypasses compliance.Chief Financial Officer (CFO) Enforce Financial Accountability (FinOps): Shift financial oversight from traditional CapEx IT depreciation to dynamic OpEx management. Demand unit-cost transparency and require Business/Product Owners to account for cloud consumption within their P&L.Chief Information / Technology Officer (CIO/CTO) Drive Modern Architecture & Enablement: Transition engineering teams away from manual ticketing towards self-service platforms (IDPs). Enforce "Policy as Code" and ensure cloud infrastructure aligns with architecture goals.Chief Information Security Officer (CISO) Automate Guardrails Over Gatekeeping: Move from reactive security reviews to proactive, automated policy enforcement. Integrate NIS2, ISO 27001, and AI compliance directly into deployment pipelines.Key Leadership Takeaway: Executive leadership is not expected to manage cloud settings or review code. Leadership is expected to set parameters, grant mandate, enforce accountability, and model the culture required for operational discipline.Enablement, Not Control The central execution engine of cloud governance is the Cloud Center of Excellence (CCoE). Too many companies misinterpret the CCoE as an architectural approval committee that meets every Thursday to review tickets. That is the quickest way to kill organizational momentum. Gatekeeper vs. EnablementAnti-Pattern: The Gatekeeper CCoE Modern Pattern: The Enablement CCoEManually reviews and approves architectural change requests. Builds automated guardrails and self-service templates.Writes static policy PDFs that engineers rarely read. Embeds policy directly into deployment pipelines (Policy as Code).Acts as a centralized bottleneck for cloud adoption. Functions as an internal product team serving delivery teams.Measures success by policy compliance and audit logs. Measures success by engineering velocity, security, and cost efficiency.Structure & Core Roles A successful CCoE is a lean, cross-functional team that brings together key domains. It does not replace engineering teams; it empowers them.Executive Sponsor (COO / VP Operations): Secures budget, aligns governance with corporate P&L goals, and resolves organizational friction between business units. Cloud Lead / Architect: Defines overall multi-cloud strategy, Landing Zone standards, and reference architectures. Cloud Security & Risk Specialist: Translates regulatory requirements (NIS2, ISO 27001, EU AI Act) into actionable security policies and automated checks. Platform Lead / Software Architect: Drives Platform Engineering, building Internal Developer Platforms (IDPs) and self-service "Golden Paths". FinOps Practitioner: Analyzes cloud consumption data, establishes unit-cost metrics, and works directly with product owners on cost accountability.Practical Implementation: A 4-Phase Roadmap Implementing cloud governance across an organization requires a phased, practical approach. Phase 1: Establish the Charter & Landing Zone ArchitectureDefine the CCoE Charter: Formally declare the team's purpose, scope, and mandate across the business. Build Landing Zones: Create standard multi-account cloud structures (e.g., AWS Organizations or Azure Management Groups). Isolate workloads by environment (Dev, Test, Prod) and business unit. Implement Centralized Logging: Ensure audit trails, identity logs, and network traffic are automatically ingested into a central SIEM system from day one.Phase 2: Automate Guardrails (Policy-as-Code)Define Preventive & Detective Controls: Use native cloud policies (e.g., Azure Policy, AWS Service Control Policies) to enforce mandatory constraints: Preventative: Block public S3 buckets or unencrypted storage volumes from ever being created. Detective: Automatically flag and alert security teams when a resource drifts from baseline configuration.Tagging Strategy Enforcement: Mandate metadata tags (Owner, CostCenter, Environment, DataClassification) at deployment time. If a resource lacks tags, auto-remediate or reject the build.Phase 3: Platform Engineering & Self-Service (Golden Paths)Build the Internal Developer Platform (IDP): Provide engineering teams with a self-service portal (e.g., Backstage) to provision compliant infrastructure in minutes. Publish Golden Paths: Pre-package approved architectures (e.g., secure microservice deployment, compliant SQL cluster) that include security, monitoring, and backups by default. Community of Practice: Establish cloud guilds to train product teams, share best practices, and accelerate internal skills development.Phase 4: FinOps Maturity & Responsible AI GovernanceShift-Left Cost Management: Integrate cost-estimation tools into CI/CD pipelines so developers see the estimated monthly bill before merging code. Establish AI Guardrails: Deploy private API endpoints for Generative AI. Ensure corporate data is isolated and protected under strict tenant boundaries. Continuous Executive Dashboards: Provide board-level visibility into compliance posture, operational risks, and cloud cost efficiency.What the Board Needs to See To ensure your CCoE is delivering real value, track concrete operational metrics rather than subjective milestones:Metric Target / Good Practice Executive FocusLanding Zone Coverage > 95% of workloads in governed Landing Zones Risk & ComplianceUntagged Cloud Resources < 2% of total cloud assets Financial AccountabilityPolicy Drift MTTR < 4 hours to remediate non-compliant resources NIS2 / Security PostureGolden Path Adoption > 80% of new microservices deployed via IDP Velocity & StandardizationCloud Unit Cost Decreasing cost per business transaction P&L & ScalabilityClosing Thoughts Solving cloud governance is not a technical problem; it is an organizational design challenge. Relying on manual audits, reactive firefighting, and bureaucratic approvals inevitably leads to higher costs and increased business risk. True operational leadership means building a system where compliance, security, and cost control are automated and frictionless. By establishing a modern Cloud Center of Excellence, embedding Policy as Code, and adopting Platform Engineering, executive teams can bridge the gap between high-level strategy and ground-level execution. When governance is built directly into your operating model, compliance stops being a burden—it becomes a competitive advantage that enables rapid, resilient, and profitable growth.

From waiting too long to moving ahead: Why Cbw and AI governance need one clear plan.

From waiting too long to moving ahead: Why Cbw and AI governance need one clear plan.

In the Netherlands, waiting until the very last moment to deal with new rules is very common. For a long time, the standard approach to IT security was simple: "They won't check us yet," or "Let's wait and see what others do." With the European NIS2 directive and the new Dutch cybersecurity law — the Cyberbeveiligingswet (Cbw) — that time is over. The laws are active, supervision is starting, and the final responsibility now sits directly with company directors and executive management. Viewing the Cbw as just a burden or a boring checklist is a mistake. At the same time, the EU AI Act and frameworks like ISO 42001 are coming at us fast. Treating these as completely separate projects will waste budget and burn out your team. The smartest move is to stop waiting and combine IT security and AI governance into one clear strategy. The Cyberbeveiligingswet (Cbw): Why Waiting Is No Longer an Option The goal of NIS2 and the Cbw is simple: raise the basic level of digital security across Europe. The old rules mostly applied to traditional vital sectors like energy and water. The new Cbw applies to many more organizations. Medium and large companies in logistics, food, chemistry, digital services, and IT providers (MSPs and MSSPs) now fall under the law. Because of this, supply chain security becomes a shared legal responsibility. Two core parts of the Cbw change how companies must operate:Duty of Care & Fast Reporting: Companies must prove they take the right technical and organizational security steps. If a major incident happens, strict rules apply: a first warning must be sent to regulators within 24 hours. Personal Board Responsibility & Mandatory Training: Directors can now be held personally responsible if they ignore basic security rules. On top of that, executives are legally required to take regular training to understand cyber risks. Leaving IT security completely to the IT department without director oversight is no longer allowed by law.BIO2 Becomes Law: Your Foundation Is Already There For Dutch government bodies and their IT suppliers, an important change is happening. The Baseline Informatiebeveiliging Overheid (BIO2) is moving from a voluntary framework to a binding law under the Cyberbeveiligingsbesluit. While many organizations worry about this, the truth is that BIO2 gives you a solid foundation you might already own. It builds on well-known global standards:ISO/IEC 27001: The process foundation for security management (ISMS). It sets up risk checks, policies, and continuous improvement. CIS Controls: The practical, technical checklist. Where ISO tells you what goals to reach, CIS Controls give you a concrete list of actions (device management, multi-factor authentication, logging, and endpoint protection).If your organization already works with ISO 27001 or BIO2, you already cover most of the technical requirements of the Cbw. The AI Side: Don't Build Another Separate Project At the same time, company boards are hearing about the EU AI Act and ISO 42001 (the standard for Artificial Intelligence management). The usual reaction is to push AI away: "Let's finish the Cbw project first. We will worry about AI in a few years." This is a missed opportunity. If you compare BIO2 and ISO 27001 with ISO 42001, you see something interesting: a company running a good ISO 27001 or BIO2 setup already covers 70% to 80% of what ISO 42001 requires. That is because AI management uses the exact same basics as normal IT security: risk checks, data rules, access management, supplier controls, and incident handling. You do not need to build a whole new management system. The Specific "AI Gap" The remaining 20% to 30% gap is very specific:AI Ethics & Fairness: Making sure algorithms work fairly without discrimination. Explanation & Human Control: Understanding how an AI tool reaches a decision and keeping a human in control (human-in-the-loop). Impact on People: Checking how the AI tool affects employees, customers, and privacy. AI Lifecycle Management: Checking data quality and monitoring if the AI model changes over time (data drift). AI Incident Handling: Preparing for new threats like prompt injection or accidental data leaks through AI tools.These extra steps are not a new system; they are just a direct addition to your current IT security setup. One Integrated Plan: Build It Once The AI Act timeline moves forward regardless of your Cbw deadlines. Companies that treat these things as three separate projects — one for Cbw, one for ISO 27001, and one for AI — will pay three times as much for the same result. The practical order to follow is: BIO2 / ISO 27001 Foundation ➡️ CIS Controls (Technical Setup) ➡️ ISO 42001 (AI Extension) Practical Steps to TakeCombine Risk Checks: Add AI tools and algorithms directly to your existing risk lists in your security management system. Use Clear Technical Rules: Use CIS Controls to secure your cloud environments (like Microsoft Azure) to meet the requirements for both Cbw and ISO standards. Extend Your Security Policies: Add the specific ISO 42001 points for AI ethics and control directly into your daily processes. Train the Board: Combine the required Cbw training for directors with a practical update on AI risks and opportunities.Closing Thoughts Putting off rules and regulations until the last minute no longer works. The Cyberbeveiligingswet, mandatory BIO2 rules, and the EU AI Act mean that IT security and AI are now direct topics for company leadership. Instead of running separate compliance projects, combining these standards into one clear plan turns a legal obligation into a practical advantage. You protect directors from liability, remain a trustworthy partner in your supply chain, and build a safe foundation to use AI effectively in your business.

Why AI pilots stall on operational reality (and how to build real value)

Why AI pilots stall on operational reality (and how to build real value)

Almost every organization is investing heavily in Artificial Intelligence. Budgets are expanding, executive teams are eager, and press releases about new AI pilots appear daily. Yet behind boardroom doors, the reality is far more frustrating. According to a global CEO survey by Bain & Company, 80% of chief executives are unhappy with the progress of their AI programs. Even more telling, 85% report that their organizations have failed to turn AI experiments into lasting, structural change. Research from Gartner shows a similar picture: only 28% of AI projects in infrastructure and operations fully succeed and meet their expected return on investment (ROI). Why are so many organizations getting stuck? Why do promising AI experiments fail the moment they touch day-to-day operations? In my work advising and leading IT service organizations—the companies I work with—I see this pattern repeatedly. The problem is rarely the underlying AI technology or the models themselves. The problem is that companies are trying to plug modern AI into outdated, fragmented, and disorganized operational foundations. The "humanoid theater" and the layoff illusion To understand why AI transformations stall, we must first look at where companies spend their energy. Many organizations get distracted by what can be called "humanoid theater"—flashy demonstrations of chatbots, novel tools, or complex dashboards that look impressive in demos but fail to improve the bottom line. At the same time, we see a troubling trend across the technology sector. Over 160,000 jobs have been cut across tech companies in recent months. Wall Street often rewards leaders who label these mass layoffs as an "AI efficiency strategy." But cutting headcount without redesigning your operational workflows is not an AI strategy; it is simply reducing capacity while keeping the same inefficient processes. Real value is not created by buying a shiny new software tool or cutting workforce numbers. It is created by doing the hard, complex work: integrating AI deeply into legacy IT systems, unifying fragmented data sources, and reshaping daily workflows. This explains why established IT integrators and software providers are seeing strong growth. They solve the difficult integration challenges that prevent most companies from scaling. Fix the process before adding the technology A major misconception among business leaders is that deploying new technology automatically drives adoption and business results. If your underlying business processes are confusing, inconsistent, or broken, adding AI will only automate that confusion at higher speed. As an executive, you often need to act as the organization's traffic light. Turning lights green for good ideas is easy, but your most critical decisions are the red lights: stopping teams from wasting time, money, and energy on the wrong initiatives. Before layering AI into your business, you must build a strong operational foundation:Standardize core workflows: Simplify business processes and remove unnecessary manual handoffs between teams. Clean and organize data: AI outputs depend directly on data quality; un-silo your systems and establish clear data ownership. Remove daily friction: Focus first on administrative tasks and repetitive work that slow down your employees.In a recent operational transformation, standardizing and consolidating service management processes reduced support ticket volumes by 30% on its own. Only after that clean operational foundation was established did adding automation and AI capabilities bring total ticket reductions close to 70%. The primary gain came from operational discipline; technology simply accelerated the result. [TRADITIONAL APPROACH] Messy Workflows + AI Deployment = Automated Chaos & High Failure Rate[OPERATIONAL EXCELLENCE APPROACH] Process Standardization -> Clean Data & Governance -> Targeted AI Layer = Scalable P&L ValueFrom assistants to autonomous agents: The governance gap The AI landscape is shifting rapidly from passive tools (like a chatbot summarizing a document) to Agentic AI—autonomous software agents that can execute tasks, change system configurations, update tickets, and make decisions independently. This evolution fundamentally changes an organization's risk profile. An employee typing an awkward prompt into a chat interface is a minor issue. An autonomous AI agent carrying full employee access rights and executing dozens of automated system actions is a major operational risk. Boardrooms and executive teams must address new governance questions:Identity: Who or what is authenticated when an AI agent acts on behalf of an employee? Authorization: What specific system boundaries and guardrails limit the agent's actions? Accountability: Who is responsible when an autonomous agent makes an incorrect decision?Without clear governance, companies risk creating a dangerous new form of shadow IT. Furthermore, as software takes over operational execution, traditional service models built purely on billable hours will face severe pressure. Successful companies will build AI-by-design operating models where software handles repetitive execution, allowing human teams to focus on strategy, quality, and high-value customer relationships. Measure business impact, not activity AI programs lose momentum when leadership measures activity instead of real outcomes. The P&L statement does not care how many Copilot licenses you have assigned or how many pilots you have launched. To build sustainable value, executives must track hard operational indicators:Reductions in service turnaround times and cycle times. Improvements in gross margin and unit economics. Reductions in error rates and operational incidents. Scalability—handling higher business volumes without increasing headcount proportionally.Scaling technology requires active change management and leadership. Avoid broad, blanket rollouts that confuse employees. Instead, deploy capabilities in phases, focus on specific team cohorts, and clearly demonstrate how the tools improve daily work. Building scalable value Artificial Intelligence is a powerful lever, but a lever only works if it rests on a solid fulcrum. Companies do not fail with AI because they lack advanced algorithms. They fail because they lack execution discipline, clear governance, and standardized processes. The market leaders of tomorrow will not be the companies running the most AI pilots, but those that build an operational foundation capable of turning technology into predictable, scalable performance. Closing thought Technology will not fix a broken operational model, but leaders who build disciplined, adaptable organizations will use AI to widen their competitive advantage rapidly. The goal of AI transformation is not to turn managers into programmers or replace human judgment with automated software. It is about creating the operational clarity, governance, and culture needed for people and technology to perform at their best together. Stop looking for quick AI wins. Start building the operational foundation that turns technology into real value.

The involuntary digital citizen: How public systems expose private lives.

The involuntary digital citizen: How public systems expose private lives.

There was a time when using the internet was a choice. You logged on to send an email, read the news, or order a product. If you didn't trust a website, you simply closed your browser. Today, that choice no longer exists. If you want to file your income tax, view your medical lab results, apply for student support, or register a business, you are forced to use a digital platform. Governments and public institutions across Europe, the United Kingdom, and North America call this "digital transformation" and "efficiency." However, technical investigations reveal an uncomfortable truth: public digital platforms silently leak sensitive citizen data to commercial advertising networks, data brokers, and global tech corporations. Because you cannot opt out of paying taxes or seeking medical care, you are no longer just a citizen using a public service. You have been turned into an involuntary data provider. The illusion of voluntary consent Modern privacy regulations like the GDPR in Europe or the CCPA in California are built on a simple promise: consent. Companies must ask for your permission before collecting your data, and you have the right to say no. When applied to public services, this promise breaks down completely. Consent requires a genuine choice. But consider what happens when a citizen tries to opt out of public digital systems:Refuse a digital portal? You face administrative delays, physical office visits during work hours, or financial penalties. Refuse a health app? You lose direct access to your test results, prescriptions, and appointment schedules. Refuse digital identity verification? You are locked out of essential state benefits and civic rights.When saying "no" results in social or financial exclusion, consent is no longer voluntary. It is forced. Public platforms place cookie banners on their websites and act as if citizens have made a free choice. But clicking "accept" when you have no alternative is not consent. It is compliance. Public portals on foreign clouds One of the main reasons public data leaks so easily is that governments rarely build or operate their own digital infrastructure. Instead, they outsource their systems to global cloud platforms and commercial software vendors. This creates structural dependencies that few public institutions can control.Domain What Citizens See What Happens Behind the ScreenTax & Benefits Official state login portals Analytics scripts and tracking pixels measure payment behavior and session length.Healthcare Patient portals and medical apps Third-party cloud hosts process health records under extra-territorial legal regimes.Crisis Support Helplines and mental health sites Session recording tools track mouse clicks and text fields in real time.When a tax authority or public health service runs its infrastructure on cloud providers owned by foreign corporations, that data becomes subject to laws like the US CLOUD Act. This law allows foreign law enforcement agencies to demand access to data stored on systems owned by domestic companies, regardless of where the physical server is located. Furthermore, technical audits of government websites frequently discover commercial tracking tools—such as Google Tag Manager or Adobe Analytics—embedded directly into payment flows and application forms. What starts as an official interaction between a citizen and their government quietly turns into a data stream for third-party ad networks. Surveillance at our most vulnerable The failure of data protection becomes even more serious in the healthcare and welfare sectors. This is where citizens interact with the state during their most vulnerable moments. Consider crisis helplines and mental health platforms. Investigations across multiple countries have revealed that third-party trackers were active on suicide prevention websites and emergency mental health portals. Search terms, location data, and visits to specific support pages were transmitted to commercial analytics vendors. Another widespread practice is the use of "Session Replay" software on public health and charity portals. These tools record a visitor's screen experience in real time. They capture mouse movements, clicks, and even text typed into form fields before the user presses "submit." When someone enters sensitive personal information while searching for debt relief, mental health support, or medical advice, that interaction should be private by default. Instead, it is recorded, analyzed, and stored on external servers operated by third-party vendors. The low-tech reality of public breaches When governments force citizens to surrender their personal data, they have a strict responsibility to protect it. Yet public sector cybersecurity is frequently weakened by outdated systems, lack of technical understanding, and basic operational errors. Data leaks in the public sector rarely require sophisticated state-sponsored hackers. More often, they happen because of fundamental mistakes:Redaction errors: Official documents are routinely published with black shapes placed over sensitive names and addresses in PDF editors, leaving the underlying text readable and easy to copy. Misconfigured storage: Databases containing scanned passports, driver's licenses, and tax records are regularly discovered sitting on open cloud storage without basic authentication. Unmanaged API endpoints: Public applications often expose internal data interfaces that allow unauthorized users to request citizen records without proper authorization checks.These leaked records do not stay isolated. Data brokers combine scattered data points to build detailed profiles on millions of people. When your phone number, home address, and tax information leak from a public database, that information is quickly weaponized. It directly fuels targeted phishing campaigns, identity theft, and bank impersonation fraud against unsuspecting citizens. Sovereignty cannot be bought with a cookie banner Many public institutions believe that placing a privacy banner on their website or passing a compliance checklist means their platform is secure. This misses the point. Privacy is not a legal statement added to a website after it is built. It is an architectural constraint that must shape how systems are designed from the start. There is a profound asymmetry of power in digital government:The state demands complete transparency from the citizen (income, health status, living situation, identity). The state offers almost no transparency about where that data flows, which vendors process it, or who has access to it.When privacy watchdogs discover these violations, the response is usually an administrative warning or a fine. But when a public agency pays a privacy fine, it pays that fine using taxpayer money. The citizen pays twice: first with their data, and then with their tax money to settle the fine. The real cost of forced digitalization Digital progress should make life simpler without stripping people of their basic rights. When public services make digital interaction mandatory, they create a system where citizens are forced to trade their personal privacy for access to society. You cannot choose another tax authority. You cannot choose another national healthcare system. You have no market choice. If governments insist on digital-first public services, they must guarantee true digital sovereignty. That means public platforms built on open, audited, locally controlled infrastructure—completely free from commercial tracking, third-party profiling, and foreign jurisdiction. Until that happens, digital citizenship is not an upgrade. It is an obligation. Closing thought The argument "I have nothing to hide" completely fails when you do not know where your data goes, who profits from it, or how it might be used against you in the future. Privacy is not a feature you turn on in a settings menu. It is not a luxury for people who have the time and money to avoid digital channels. Privacy is a fundamental human right. A government that demands complete transparency from its citizens while offering complete opacity in its technology is no longer serving its people—it is monitoring them.