Principles of "openness" in an increasingly captured environment: A perspective from Southwest Asia and North Africa

The word that got away from us

There is a sentence I have heard more times than I can count, in meetings, in policy forums, in the carefully worded press releases of technology companies: "We are committed to openness." It gets said by governments announcing digital transformation strategies that are, on closer inspection, primarily about centralising control. It gets said by corporations releasing artificial intelligence (AI) models under licences that look permissive until you read the fine print. It gets said, sometimes, by institutions that have done genuine work in this space and are now watching the vocabulary they built get borrowed, diluted and turned back against the communities it was supposed to serve.

From where I sit working on digital rights in a region where the question of who controls the tools of communication is not abstract but genuinely urgent, the erosion of the word "open" feels personal. Not because any of us had exclusive rights to it, but because the political tradition it pointed to was built on something real: the idea that software freedom is inseparable from the freedom of people to govern their own digital lives. That tradition is under pressure, and the pressure is not coming only from bad actors. It is coming from the steady drift of language itself, pulled by corporate incentives, state power and the sheer speed at which "open source" has become a marketing term.

This report is an attempt to name that drift clearly, and to think through what it means specifically in Southwest Asia and North Africa (SWANA). The capture of the openness narrative takes different forms in different contexts. In this region, it lands in a particular way: on top of existing surveillance infrastructure, inside the shrinking space of civil society, and alongside the everyday reality of activists who depend on genuinely free and auditable tools to stay safe.

What we mean when we say “free”

The distinction between "free software" and "open source" is one that the global free/libre and open source software (FLOSS) movement has debated for decades, and it is one that still matters. When Richard Stallman and the Free Software Foundation articulated the Free Software Definition in 1986, they were making a political argument: that the freedom to run, study, modify and redistribute software was not a technical nicety, but a question of power, of who has it, and who does not.1 The Four Essential Freedoms were not a consumer rights charter. They were a way of insisting that the tools of the digital economy should not be instruments of control.

When the Open Source Initiative was founded in 1998, it made a strategic decision to reframe those same technical characteristics in terms that the corporate world could accept, emphasising the public availability of source code and the permissive licensing conditions of its use. The political language was replaced with the language of efficiency and innovation. What was lost in that translation, as critics have argued since, was precisely the content: the idea that software freedom is part of a broader struggle over who controls the infrastructure of modern life.2

For civil society in the Global South, including in SWANA, this distinction was never just theoretical. The FLOSS tradition, with its emphasis on freedom as a political concept, connected to real debates about intellectual property regimes imposed through trade agreements, about the cost of proprietary software in economies where that cost is prohibitive, and about the right of communities to build and govern their own technological futures. The Association for Progressive Communications (APC) has articulated this clearly: FLOSS is the "only truly safe and sustainable digital tools choice that respects the needs of communities and reflects the culture of sharing, participation and collaboration."3 That framing resonates in SWANA not because it is idealistic, but because it describes something practitioners in the region experience every day.

Today, the corporate capture of "open source" is accelerating. The GitHub Octoverse report and the Eclipse Foundation's State of Open Source in the Global South both document remarkable growth in FLOSS developer communities across Africa, Asia and Latin America.4 That growth is real and worth celebrating. But it is happening in an ecosystem where "open source" increasingly means “the code is downloadable" rather than "this system is transparent, community-governed and built in the interest of its users." The vocabulary has been stretched until it covers things it was never meant to cover. 

Open-washing and the AI moment

The most visible current form of corporate capture is what researchers have called "open-washing", or claiming the benefits of an open source brand that has been developed without the substance. In a 2024 study of over 45 generative AI systems, Liesenfeld and Dingemanse found that while “the term open source is widely used, many models are 'open weight' at best," with providers routinely withholding information on training data, fine-tuning methods and governance.5 The launches of Meta's Llama models were greeted with headlines describing them as "open source", a framing that was almost never challenged, despite the fact that Llama is released under a custom commercial licence with significant restrictions and with Meta retaining effective control over its development.

The MIT Technology Review has noted that the industry "can't agree on what open source AI means" and that this is a genuine problem.6 It is a problem, but not only because of definitional imprecision. It is a problem because the confusion is useful to certain actors. When "open" can mean almost anything, it becomes impossible to make the distinctions that actually matter: between a system that can be audited for surveillance capabilities and one that cannot; between infrastructure that a community can govern and infrastructure over which a corporation exercises control; between tools that protect users and tools that extract from them.

For the region I work in, this is not a theoretical concern. The question of whether a tool is genuinely auditable is, for many of the activists and journalists we work with at SMEX, a security question. The APC FLOSS policy is explicit about why: FLOSS is more secure than proprietary solutions specifically because its code is open to inspection – or as it puts it, "Given enough eyeballs, all bugs are shallow."³ That argument only holds if "open" still means genuinely inspectable. Open-washing undermines security, not just rhetorically but structurally, by populating the ecosystem with things that look like FLOSS but are not.

The common governance dimension matters here too. The International Journal of the Commons has documented that commons-based innovation depends not just on access to resources, but on the governance structures that determine who shapes their development.7 When a corporation releases model weights while retaining control over training pipelines, data and future direction, it is not creating a commons. It is creating a dependency relationship, one that looks like openness but functions like capture.

How governments in the region learned to speak the language

Corporate open-washing is one thing. What governments in SWANA have done with the language of openness and digital sovereignty is something else, and in some ways more corrosive, because it comes dressed in the vocabulary of national interest and citizen protection.

The Arab Spring was the turning point. The mobilisations of 2011, enabled in part by digital platforms, demonstrated to governments across the region that open communication infrastructure was a political risk. The response was not primarily technical, it was regulatory and rhetorical. States began building data localisation regimes, national digital transformation strategies and cybersecurity frameworks, all presented in the language of sovereignty, protection and modernisation. Saudi Arabia, the United Arab Emirates (UAE) and Egypt have all implemented laws requiring data to remain within national borders, such as Egypt's Personal Data Protection Law No. 151, passed in 2020, which prohibits transfers of personal data outside the country.8 These measures are framed as protecting citizens. Their operational effect is to make citizens' digital lives more legible to the state.

Alongside this, governments have been building surveillance infrastructure that is the antithesis of openness by any definition. Researchers have documented how China's Digital Silk Road has exported what they describe as a "techno-authoritarian toolkit" to Egypt, Morocco, Qatar, Saudi Arabia and the UAE – AI surveillance systems integrating facial recognition, movement mapping and network analysis.9 The UAE has blocked FaceTime, Skype, WhatsApp and Zoom, and pushed residents toward ToTok, a platform developed with state connections and government-accessible data. Egypt and the UAE have both blocked Signal, the open source encrypted messaging application that much of the region's civil society depends on for operational security.

In Jordan, the pattern is present but less visible. TikTok has been blocked. Various virtual private network (VPN) services have been restricted. During the Jordanian teachers' union protests in July 2020, Facebook Live was also restricted. The Jordan Open Source Association (JOSA),10 which has been doing some of the most consistent and serious FLOSS advocacy work in the region since 2009, has noted the contradiction directly: 

Surveillance technologies and censorship of websites and platforms are some of the biggest issues we are facing in Jordan. [...] They can put you in prison for what you say in person or post online.11

At the same time, Jordan's government has adopted a National Strategy for Digital Transformation that, partly through JOSA's advocacy, explicitly recognises open source software as a key technology. The word "openness" appears in official strategy documents. The political substance it is supposed to carry does not. This is state capture at its most complete, not the rejection of openness language but its institutionalisation, hollowed out and made safe.

Pegasus, and what is actually at stake

I want to be concrete about what the dilution of openness costs in this region, because the cost is not abstract.

The 2021 Pegasus Project, a joint investigation by Forbidden Stories, Amnesty International and media partners, identified 50,000 phone numbers on a list of potential surveillance targets. Operators in Saudi Arabia, the UAE, Bahrain, Morocco, Jordan, Qatar, Algeria, Egypt and Turkey were confirmed or probable clients using Pegasus spyware. Journalists, lawyers, union organisers, activists, human rights defenders and their family members were targeted. The Citizen Lab identified two Pegasus operators named “Mansaf”         and “Blackiris” active in Jordan since at least 2018. Between 2019 and September 2023, at least 35 Jordanian and Jordan-based individuals had their devices infected,12 including Hala Ahed Deeb, a Jordanian human rights lawyer defending teachers' union members, whose phone was compromised in March 2021. Meanwhile, around 300 Lebanese phone numbers appeared on the list. Lama Fakih, director of Human Rights Watch's Beirut office, had her iPhone infected five times between April and August 2021. These are people doing work that is, by any standard, legitimate and necessary. They were targeted not despite their work, but because of it.

At SMEX we have watched this unfold at close range. We signed the Middle East and North Africa (MENA) coalition statement alongside JOSA, Access Now, the Gulf Centre for Human Rights, Masaar and others calling for a moratorium on the sale and transfer of surveillance technology to autocratic governments.13 We run a Digital Safety Helpdesk that receives multiple requests per month from across the region – activists, journalists and lawyers facing surveillance threats, digital harassment and compromised devices. The tools we recommend are FLOSS tools: Signal, Jitsi, Nextcloud, Tails. This is not because of brand loyalty, but because the security argument for those tools rests on auditability, on the fact that their code can be inspected, and that they are not controlled by a single commercial entity subject to government pressure. No one needs to just take their word for it.

The gendered dimension deserves to be named clearly. Surveillance in SWANA falls harder on women human rights defenders, as Access Now and Front Line Defenders have documented in detail.14 Women activists in the region are often already navigating conservative social environments and patriarchal institutional structures to do their work. Digital surveillance adds another layer: the compromise of their phones means the compromise of their clients, their networks, their families. As Marwa Fatafta of Access Now has put it, "when governments surveil women, they are working to destroy them." The tools that offer genuine protection against this are precisely the tools whose political foundations are being eroded by the capture of "open source" as a concept.

This is the cost. When corporations hollow out the term "open source" by applying it to systems that are not genuinely auditable, and when governments adopt openness language while deploying surveillance infrastructure against their own people, they are not just being rhetorically dishonest. They are degrading the conceptual vocabulary on which the security of the region's civil society depends.

When the infrastructure of openness is itself gated

There is a third form of capture that receives less attention, but that I think is structurally the most revealing: the way the platforms on which FLOSS development now primarily depends are subject to the same geopolitical power structures they are supposed to transcend.

In 2019, GitHub, owned by Microsoft, and the platform that hosts the majority of the world's open source code, blocked developers in Syria, Iran and Crimea from accessing private repositories and paid services. The reason was compliance with United States (US) trade sanctions. A Syrian developer could be locked out of their own code repository without warning, not because of anything they had done, but because of where they lived. GitHub's CEO, Nat Friedman, acknowledged the pain this caused but was clear about the constraint: "We're not doing this because we want to; we're doing it because we have to."15

That sentence is worth sitting with. GitHub presents itself as the home of the global open source community, a space where geography does not limit participation, where code is a universal language. And yet, the moment US foreign policy required it, the platform became an instrument of geopolitical exclusion. Public repositories technically remained accessible, but the infrastructure of serious collaborative development, private repositories, organisational accounts, the full toolchain of modern FLOSS work, was restricted on the basis of location.

An empirical study of GitHub activity published in 2024 found measurable drops in collaborative output from developers in Crimea, Cuba and Syria following sanctions. Iran largely recovered after restrictions were lifted in 2021 through licensing negotiations with the US’s Office of Foreign Assets Control (OFAC), confirming that the dependency was real and the platform central to how these communities participate in the global FLOSS ecosystem. Syria's restrictions were only fully lifted in 2025 after sanctions relaxation under changed US political conditions16 – but f        or six years, Syrian developers were structurally second-class participants in a commons that, in principle, belongs to everyone.

This is what infrastructural capture looks like. The Eclipse Foundation's State of Open Source in the Global South documents the structural barriers facing FLOSS communities in the Global South, namely, connectivity, skills, institutional support and funding.17 The sanctions barrier compounds all of these, and it exposes something that the movement has not fully reckoned with: that "open source" as a political commitment cannot be separated from the question of who owns and controls the infrastructure on which it runs. A commons hosted on platforms subject to US trade law is not, in any meaningful sense, a global commons. It is a conditional commons open to those whom geopolitics permits, closed to others.

The language gap is also a power gap

There is one more dimension of capture that I want to address, because it is structural and because it is rarely named as such: the underrepresentation of Arabic in the global FLOSS ecosystem.

Arabic is spoken by over 420 million people. It is one of the world's major languages. It is also, as researchers have documented, semantically underrepresented in the digital commons in natural language processing (NLP) resources, in open source software documentation, and in the governance spaces and community infrastructure of the FLOSS movement. The technical complexities are real: Arabic's right-to-left rendering, its root-pattern morphology and its enormous dialectal diversity all create localisation challenges that require sustained investment. That investment has historically not been made at anything like the scale devoted to European languages.

JOSA has said this directly: "expressions like 'open source' and 'digital rights' are not common in Jordan and the region, and it's our duty to change that."18 At SMEX, we produce Arabic-language training guides and digital safety resources in part for the same reason, not just because of accessibility, but because knowledge that is only available in English is knowledge that does not belong equally to everyone. The political claims of FLOSS that the commons is for all, that freedom of software is for all users regardless of geography or background, are undermined if the spaces where those claims are debated and where the norms that govern the commons are constituted are only legible to English speakers.

There have been recent efforts to address this. Inception released Jais, an open source Arabic large language model, explicitly positioning it as a resource for the Arabic-speaking developer and scientific community, and as a model for other underrepresented languages. The Open Arabic LLM Leaderboard, established by Hugging Face and the Technology Innovation Institute, has created evaluation infrastructure for Arabic models. These are significant. But they also sit in tension with the broader picture: some of this work is driven by Gulf state-backed institutions with their own governance interests, and the question of whether "open Arabic AI" serves the political tradition of FLOSS or the digital sovereignty projects of Gulf states is genuinely open.

What resistance looks like from here

None of this is cause for despair, or at least it should not be. The civil society organisations working on FLOSS and digital rights in SWANA are among the most practically sophisticated I have encountered anywhere. Their sophistication comes not from theory, but from the necessity of operating in environments where the stakes of getting it wrong are immediate.

SMEX was founded in Beirut in 2008, growing out of the experience of using digital tools to support communities during the 2006 Israeli war on Lebanon. That origin matters: it means the organisation's relationship with technology was never purely developmental or idealistic. It was shaped from the beginning by the question of what tools are genuinely trustworthy when lives are at risk. The Digital Safety Helpdesk receives requests from across the SWANA region, and operates from the same premise. As mentioned, the tools we promote are not selected for their brand. They are selected because they are auditable, because their governance is not controlled by a single commercial entity, and because the security guarantees they offer are not taken on faith.

Bread&Net, SMEX's annual conference, has become the most important convening space for digital rights thinking in the region. The 2025 edition in Beirut brought together over 550 participants from across SWANA. The conversations about AI imperialism, corporate power, surveillance, and the militarisation of technology were not abstract. They were happening "amid ongoing wars in the region," as our own account noted. Compared to the previous events, participants arrived with what we described as "in-depth analysis, stronger technical capacity, and a shared understanding that digital rights work must move faster and coordinate better."19

JOSA's work in Jordan tells a different but related story. Founded in 2009, it has evolved from a student FLOSS initiative into an organisation that simultaneously advocates for open source in government policy, provides emergency digital security support to activists under threat, and publicly documents censorship and surveillance. It is registered under Jordan's Ministry of Digital Economy and Entrepreneurship, one of the few civil society FLOSS organisations in the region with formal government registration, which gives it access to policy conversations, but also places it in a complex relationship with the same state apparatus it documents and challenges.20

What both organisations share, and what I think defines the best digital rights work happening in SWANA, is a refusal to separate the technical from the political. Tools are not neutral. Openness is not a property of code; it is a relationship between code, governance and power. The choice to use Signal instead of WhatsApp, to run Nextcloud instead of Dropbox, and to advocate for open source in national policy – these are not consumer preferences. They are political commitments, and they are made in the knowledge that the vocabulary used to articulate them is under sustained pressure from actors with far more resources.

What openness should mean in this region

I want to try to articulate, concretely, what the principles of openness should mean when they are worked out from the perspective of those living in SWANA, rather than applied to the region.

The first principle is that openness without auditability is a fiction. This is technically true anywhere, but it is politically urgent here. In a region where surveillance tools, many of them developed by companies that also produce legitimate security products, are routinely deployed against civil society, the security argument for FLOSS depends entirely on the ability of independent researchers to inspect code for backdoors, vulnerabilities and undisclosed functions. The moment "open source" can be claimed by systems that are not genuinely auditable, that argument collapses. SWANA civil society has a direct stake in maintaining the technical integrity of this standard, and in resisting any definitional drift that weakens it.

The second principle is that openness must confront geopolitical exclusion. The sanctions paradox, where the infrastructure of the open source commons is subject to US trade law and can be turned into an instrument of exclusion at any moment, is not a marginal issue for this region. It is structural. Addressing it requires the global FLOSS movement to do something it has been reluctant to do: acknowledge that the universalism it claims is conditional on the politics of the platforms that host it, and work actively to build infrastructure that is more genuinely universal. At minimum, it needs to be honest about the conditionality.

The third principle is that openness requires linguistic inclusion – not as a courtesy, but as a structural condition of genuine participation. If the governance spaces of the global FLOSS movement, the documentation, the community infrastructure, the forums where norms are negotiated, are accessible only to English speakers, then the communities whose growth the movement celebrates are participating on terms they did not set and cannot fully contest. The under-representation of Arabic in the digital commons is a governance problem, not just an accessibility problem.

The fourth and most fundamental principle is one the movement has always articulated but has had increasing difficulty defending: that openness is not a technical property but a political one. Software freedom is not separable from the freedom of communities to govern their own digital lives. In SWANA, where activists use FLOSS tools for physical safety, where the language of openness is simultaneously used by governments to legitimate surveillance, and where the infrastructure of the commons is subject to geopolitical power, the political stakes of this principle are not hypothetical. They are the daily reality of the people we work with.

The digital justice framework discuss    ed in a recent GISWatch report, and which APC's work embodies, is useful here precisely because it refuses to treat digital rights as a sector.21 Digitalisation is now permeated through every domain of political and social life, and the tools we use to communicate, organise and resist are entangled with every other struggle. In SWANA, this entanglement is especially visible: the militarisation of technology, the compression of civic space, the weaponisation of personal data against the people whose data it is. An openness that does not address power, that does not ask who controls the tools, who audits them, who governs them, who is excluded, is not openness – it is empty branding.

Conclusion: The word is still worth fighting for

The capture of the openness narrative did not happen overnight, and it will not be reversed quickly. Corporate open-washing, state appropriation of digital sovereignty language and the geopolitical gatekeeping of FLOSS infrastructure are not temporary confusions. They are structural features of the current digital landscape, driven by actors with significant resources and clear interests in blurring the distinctions that the FLOSS movement depends on.

But the word is worth fighting for, precisely because the tradition it points to is worth preserving. The insistence that software freedom is a political question, that it is about justice and power and the right of communities to govern their own digital lives, not just about efficiency and innovation, is as relevant as it has ever been. In SWANA, that insistence is not an ideological position held at a comfortable distance from practice. It is the operating premise of organisations that have built their work around it, and that have seen, at close range, what it costs when the tools of resistance are compromised.

What "the open source we want" should mean in this region is a FLOSS tradition that is technically rigorous about auditability, honest about its own geopolitical limitations, accessible across languages and cultures, and politically clear about the relationship between software freedom and human freedom. That tradition exists. It is being practised, under difficult conditions, by the civil society actors described here. The question is whether the global movement will defend and extend it or whether it will continue to allow the word "open" to be borrowed until there is nothing left to borrow from.

 

Notes

This report was originally published as part of a larger compilation: “Global Information Society Watch 2026 special edition: Free/libre and open source software: Visions of openness from the Global South"

Creative Commons Attribution 4.0 International (CC BY 4.0) - Some rights reserved.

Web and e-book
ISBN 978-92-95113-91-6 
APC-202607-APC-R-EN-DIGITAL-384

Print
ISBN 978-92-95113-92-3
APC-202607-APC-R-EN-P-385