Open source is more than a licence. It combines development practices, economic incentives and institutions, and those arrangements shape security, contributor experience and long-term maintenance. Strong research here asks how the arrangements work in practice, specifically in Norway.
Topic 1: Why is there no Norwegian OS2? Shared open source as an answer to fragmented municipal demand
The question. Danish municipalities co-own software through OS2, a shared open-source community. Norwegian municipalities mostly buy separately. What explains the difference, given both countries follow the same EEA procurement rules?
What you'll do. Run a comparative case study of Denmark and Norway covering financing, the role of the municipal associations, procurement practice and legal interpretation.
Topic 2: What's actually in the exit plan? Studying cloud contingency through freedom-of-information requests
The question. Norwegian public bodies were urged to prepare for losing access to US cloud services. Did they, and what do their plans actually contain?
What you'll do.
- Request contingency plans and risk assessments from a sample of municipalities and agencies under offentleglova, Norway's freedom-of-information law.
- Code the documents against a maturity framework.
- Follow up with interviews.
How you'll evaluate it. Coverage and maturity of the plans, consistency between agencies, and patterns in what is withheld.
Topic 3: Can an organisation realistically take control? Open source and digital sovereignty
Governance and technical assessment ยท Case study with exercise
The question. What practical capabilities does an organisation need to keep using and maintaining software if its principal supplier withdraws? An open-source licence grants the right to continue; it does not grant the ability.
What you'll do.
- Select one infrastructure component.
- Assess independent builds, deployment, updates, documentation, dependencies and access to decision-making.
Topic 4: Does Norway's public code actually rebuild? A reproducibility audit
The question. Published source only builds trust if deployed software can be tied back to it. How much Norwegian public-sector code builds reproducibly, meaning the same source always produces an identical binary, and what systematically breaks it?
What you'll do.
- Sample repositories from NAV, Digdir and Skatteetaten.
- Build each twice in isolated environments and compare the outputs.
- Classify the sources of difference: timestamps, unpinned dependencies, build tooling.
- Fix a subset and measure the effort required.
Topic 5: AI-generated vulnerability reports: help or extra work for maintainers?
The question. Under what conditions do AI-assisted vulnerability reports improve security work, and when do they consume maintainers' scarce review time?
What you'll do.
- Study public reports, or an agreed and anonymised dataset.
- Develop a structured reporting or triage intervention.
- Evaluate it with consenting reviewers on historical or seeded cases.
Topic 6: The first contribution: where capable developers get stuck
The question. Which barriers stop technically capable newcomers from completing a first meaningful contribution to an open-source project?
What you'll do.
- Observe developers working through realistic contribution tasks in one or two projects.
- Improve one part of the experience, such as setup, guidance or tooling, and evaluate the change.
Open source, the public sector and digital sovereignty
Norwegian public bodies increasingly depend on software they do not control, and the question of who maintains, funds and can take over that software has become a policy issue. A KS-commissioned study found significant municipal dependence on Microsoft and Google, alongside concentrated supplier markets, high switching costs and fragmented demand (KS).
This theme turns that debate into researchable questions: what Norway depends on, who pays to maintain it, why municipalities don't share more, and whether organisations could really leave a supplier. Several topics use methods that work particularly well in Norway, including freedom-of-information requests and comparisons with Nordic neighbours.
Topic 7: Mapping Norway's invisible dependencies: critical open source beneath public services
The question. Which unpaid or under-maintained open-source components do Norwegian public services depend on, and what would it cost to secure them?
What you'll do.
- Build a dependency graph from public repositories, using software bills of materials (SBOMs) where available.
- Rank components by how central they are and by maintainer health, such as how many people keep them running.
- Estimate stewardship costs for the most critical few.
Topic 8: Who should fund shared open-source infrastructure in Norway?
The question. How could Norwegian public agencies and companies jointly fund open-source maintenance while sharing decision-making authority fairly?
What you'll do.
- Compare existing models, such as Germany's Sovereign Tech Agency, member-funded associations like Denmark's OS2, and foundation-based consortia.
- Analyse how each allocates money and control.
- Test two or three candidate models for Norway with stakeholder interviews.