It was a well thought out paper. I thought it was particularly interesting that they just drop any pretense and refer to cloud hosting in the US as a security risk.

I thought it was also very interesting that they describe the Munich case as a risk to the program. If they referenced a technological reason for Munich's reversal then I missed it, but instead the reversal was purely due to economic leverage (MS dropped prices) and political reasons (MS offices moved to Munich). I'll bet there's probably some saavy computer science student working on an economics minor (or vice versa) that could go back and look at that and recast it in modern terms of a ransomware attack to be able to assign some economic risk to it. How low would microsoft have to drop their prices before it's no longer cost effective to make the jump (ignoring the desire for digital autonomy).

The paper does a really good job putting everything in dollar terms. Even disgregarding the digital autonomy desire, it still seems cost effective to make the jump if you're willing to eat the transition phase, and their suggestions about setting up a funded foundation, with legislative backing, and a five year sunset gives a good shot at getting started. I think they're probably underestimating the difficulty with the document formats, though. Somewhere in Canada there's at least one zip file embedded in a Word document that an organization is dependent on, but has never reached a point where younger people with all their new-fangled techniques has been able to replace. They do cover this ("Acknowledging Lehman’s laws of software evolution, which dictate that software must continuously adapt or face progressive degradation").

Government procurement culture is risk-averse and will want service agreements for the software.

Some of this might have to be self-underwritten. It's not like MS service agreements are worth anything, anyway, in light of the ICC shenanigans going on. Nobody should feel proud reducing attack surface and increasing uptime by signing a contract with the Attack Surface.

As shown in Table 1, many other countries have been successful in adopting a national Linux distribution. There are challenges, however, to this approach, which can be grouped into three categories: 1) user adoption resistance, 2) organizational resistance, and 3) language factors.

They also reference all the backend stuff they're already using Linux with. The paper almost reads like they don't expect any technological barriers. They're going to need a replacement for Active Directory that Active Directory can authenticate against, and they're going to need something that works like Teams.

Debian LTS is a good choice. I opened the door in the comments by talking about Nix because the Netherlands picked it, but really anything would work. After doing "some research" it looks like Italy and Austria have this either completed or underway^1^.

I think there's every chance of this "just working," and I hope it does.

[1] Italy moved to LibreOffice so long ago that I can't find a recent article about it, so I assume it either worked great or they quietly backed off. Austria is doing something simliar so after some "research" it looks like Canada may be late to the party.