Editorial
A record-high distrust in government and a quieter, technical reality about how governments build websites both point to the same problem: institutions depend on software they don't fully fund or control. Today's picks look at the political signal in the polls, a practical update on encrypted computing, and why the code choices in public procurement are shaping "digital sovereignty."
In Brief
Record-High 89% in U.S. Say Government Corruption Widespread
Why this matters now: The new Gallup poll showing 89% of U.S. adults view government corruption as widespread signals broad erosion of institutional trust that will reshape debates about elections, oversight, and public legitimacy this year.
A new Gallup poll reports a record-high 89% of U.S. adults saying government corruption is "widespread" — a 10-point jump from last year and the highest reading in two decades. Gallup notes the rise is driven largely by Democrats (now 91%), with independents (90%) aligning similarly and Republicans (83%) holding steadier. As the poll puts it, this is less partisan noise and more a shared alarm:
"bipartisanship reflects shared alarm as much as shared consensus."
The immediate effect is political: low trust complicates policy rollouts, fuels calls for oversight and reform, and can depress civic participation. Practically, technologists and policy wonks should expect increased scrutiny of procurement, transparency, and anti-corruption controls in the months ahead.
Updates on HEIR, the Homomorphic Encryption Compiler Project
Why this matters now: HEIR's progress makes running real workloads on encrypted data more attainable for privacy-sensitive applications like joint fraud detection or private model inference.
Jeremy Kun's update on HEIR walks through demos (fraud detection, anomaly detection, recommender systems, and a small convolutional hotword model) and reality checks performance: encrypted inference can be done, but it's slower. As the post notes, one simple demo runs encrypted inference in about two seconds on a single-threaded CPU versus 0.5 ms cleartext — roughly a 4,000x slowdown. A concise reminder: homomorphic encryption (HE) lets you compute on encrypted data so the server never sees the plaintext; it's powerful but currently costly in CPU, memory, and key management.
HEIR's roadmap is practical: emit lower-level arithmetic suitable for accelerators, add GPU/TPU support, contribute benchmarks to fhe-benchmarking.org, and broaden scheme support. For teams considering HE, the immediate takeaway is to scope for mid-sized models, low concurrency, and scenarios where both parties have strong incentives to preserve privacy or IP.
Deep Dive
Digital Sovereignty Is Written in PHP
Why this matters now: European and other governments are consolidating public-facing services on PHP stacks (TYPO3, Drupal, GovCMS, Nextcloud), meaning procurement choices today will determine who maintains the software millions of citizens use tomorrow.
Governments don't just pick colors and copy for their sites; they pick languages, frameworks, and ecosystems that carry long-term maintenance obligations. The PHP Foundation's analysis and the recent essay shows that real-world digital sovereignty is, in many places, practically implemented on PHP-based platforms: Germany's €108 million move toward a single Government Site Builder (TYPO3-based), the Commission's hundreds of Drupal sites, Australia's GovCMS, and Nextcloud deployments illustrate scale and concentration.
That concentration creates a paradox. Public services demand high reliability and security, but the upstream projects that underpin them are often underfunded. The PHP Foundation reportedly raised about $730,534 in 2025 while these government deployments serve millions of visits annually. The math doesn't add up: major public infrastructure depends on community-maintained software with only tiny direct funding flows.
The essay proposes procurement levers that are worth copying: require verified open-source contributions as part of tender evaluation, allocate 2–5% of a project's budget to upstream maintenance, and implement a short (30-day) rule to return non-sensitive public-facing code upstream. These are practical, targeted policies that convert dependence into predictable maintenance funding, directly aligning vendor incentives with public interest.
"Digital Sovereignty Is Written in PHP"
Think of these proposals as small changes to procurement scoring and budgeting that produce outsized returns. A 2–5% upstream line item doesn't dramatically change a project's budget, but it makes security patches and major upgrades feasible for the maintainers who need to do the work. Requiring verifiable contributions during tendering shifts procurement from a purely outputs-based tick-box to a lifecycle-aware process that rewards stewardship.
There are implementation details to watch. Evaluating contributions has to be robust against staged or trivial commits — scoring should favor long-term engagement and measurable impact (patches merged, security fixes backported, CI improvements). A short upstream return window needs a sensible definition of "non-sensitive" and a compliance mechanism that doesn't penalize rapid local adaptations. But the core idea — buy software with the upstream health you expect to depend on — is straightforward and scalable.
For technologists and policy teams, this is actionable: when drafting or responding to tenders, build upstream maintenance as a line item, and when designing vendor evaluation, include contribution history and upstream commitment as factors. If governments start making these moves standard, the sustainability of the PHP ecosystem (and the uptime of citizen-facing services) improves measurably.
Closing Thought
The theme tying today's stories together is dependence: citizens depend on institutions they distrust, institutions depend on software they underfund, and sensitive computations depend on technologies that are still maturing. Fixing any of that requires realistic technical timelines and procurement rules that match long-term risk. Small policy shifts — upstream funding lines, contribution-weighted tenders, privacy-aware tooling adoption — add up.