Trust is a crucial factor in multi-actor data-sharing initiatives, particularly in sensitive domains like healthcare, where patient privacy, regulatory requirements, and organizational collaboration intersect. However, achieving trust-by-design, creating trust through intentional design choices, is challenging. To address this challenge, this paper investigates how trust frameworks in healthcare data-sharing are designed and how they evolve over time. Central to this inquiry is the conceptualization of “trust anchors”– designable components that provide a foundation for creating trust. Drawing on Technological Innovative Systems theory, this research qualitatively examines two healthcare trust frameworks, each at different lifecycle stages. The case studies reveal how trust anchors contribute to both the development and active management of trust frameworks. The contribution includes a lifecycle approach for trust frameworks and a matrix for categorizing trust anchors, providing guidance for organizations aiming to implement and maintain multi-actor data-sharing frameworks. We find that enforceable trust anchors are more important in the mature phase of a trust frameworks, while in the growing phase, less designable and enforceable trust factors assume a greater role.

Central government policy departments need to collaborate with executive agencies to provide IT-based services to society. These collaborations are complicated by the fact that the executive agencies are controlled by different ministerial hierarchies, resulting in conflicting interests. Yet, a detailed analysis of these challenges is lacking in the literature. In this paper, we analyze the challenges at several ministries through interviews focused on specific cases as well as interviews focused on expert knowledge. We identified the challenge themes and compared them with the literature, finding several new challenges in practice, including restricted procurement, a Goldilocks zone for escalation, the inability to hold an agent ultimately accountable, and the low priority the central government policy departments give to the implementation. Paradoxically, central government policy departments, as principals, are less powerful and highly dependent on executive agencies instead of the other way around, as suggested by principal-agent theory. These findings imply that there is a need for new governance mechanisms able to deal with all the challenges encountered. The overview of the challenges can serve as a sound foundation for conducting further research into cross-ministerial governance.

Governments struggle to harness emerging technologies to improve public services, address social needs, and produce public value. In response, we see a rise in GovTech startups and other non-government actors trying to bring innovative solutions to governments. While some public agencies welcome such help, many are reluctant to rely on external organizations to provide digital identities, data wallets and AI-based services to citizens, businesses, and the government itself. Many also fear engaging a dynamic ecosystem of small non-government actors working together and gaining more experience in the process. Consequently, the GovTech supply and demand are misaligned with each other and the public value imperative. Public tendering may help but does not protect against vendor lock-in and innovation-blocking. Co-creation of public and private solutions may be technically possible but may face institutional void, calling for trust frameworks, steward-ownership, ecosystem building or other alternative instruments. This paper presents a research challenge to examine GovTech evidence, learn about applicable theories, methods and knowledge gaps, and formulate theoretically and empirically well-grounded recommendations on GovTech and public value creation. It also outlines the response to the challenge: organizing a dg.o 2024 workshop and developing a special issue of Government Information Quarterly (GIQ).

Ensuring the secure provision of data and services using critical information infrastructures amidst the evolving technology landscape is a crucial yet recurrent task. However, these infrastructures can become vulnerable due to developments in quantum computing and modifying the infrastructures with quantum-safe (QS) technology is unlike regular control and maintenance. Organizations need to modify their cryptographic layers, which act as the fundamental building blocks of infrastructures. For organizations, many uncertainties pose challenges across technological, organizational and ecosystem areas. While QS technology is new and not yet available for implementation and adoption, changes in critical information infrastructures require collaboration among multiple public and private organizations spanning industries and borders. By understanding the roles, organizations may better understand what should be done for QS transitions. Until now, there has been no academic research examining the roles that government could or should play in QS transitions. This paper reveals 12 different roles, showing the diversity and breadth of actions needed. While there are many possible roles that still need to be allocated for coordinated efforts, there is a high reliance on the government, and organizations are waiting for and expecting governments to take more active roles in QS transitions. The results also signals that QS transition research is at its early stage with a clear governance void and lack of collective urgency in the ecosystem.

When implementing and adopting new technologies, knowing the level of organizational readiness is crucial. By assessing the readiness levels, organizations can focus on areas with low readiness levels and prepare for the change processes. Due to the increasing vulnerabilities presented by the advancement of quantum computing technology, today’s widely used cryptographic algorithms and encryption methods need to be modified with quantum-safe (QS) ones. However, organizations currently lack tools to understand the complexity of implementing and adopting QS technology, and there is no readiness assessment model available in the context of QS transition. By including different dimensions that organizations should consider when implementing and adopting QS technology, we develop an organizational readiness assessment model for QS transition. The dimensions used in the model include collaboration, governance, policy & regulation, awareness, QS solution standards, hybrid QS solutions, cryptographic agility strategies and knowledge on QS transition. While the organizational readiness assessment model with different dimensions shows the complexity involved in implementing and adopting QS technology, it acts as a guidance tool for organizations to navigate and prepare for uncertainties surrounding QS transition.

By utilizing the properties of quantum mechanics, quantum computers have the potential to factor a key pair of a large prime number and break some of the core cryptographic primitives that most information infrastructures depend on. This means that today's widely used cryptographic algorithms can soon become unsafe and need to be modified with quantum-safe (QS) cryptography. While much work is still needed in developing QS cryptographic algorithms, the institutional, organizational, and policy aspects of transitioning the current infrastructures have received less attention. This paper provides an empirical analysis of QS transition challenges and policy recommendations for moving to a QS situation. We analyzed the data collected through interviews with experts and practitioners from the Dutch government. The results reveal that institutional, organizational and policy aspects of QS transitions are interconnected, and solutions for QS transitions are scattered. Consequently, organizations may face a Catch-22 loop without further actionable approaches and planning for QS transitions.

The transition towards a circular economy (CE) will require data sharing across different platforms and data spaces of parties operating in a variety of supply chains. From a circular economy compliance monitoring perspective, beyond the access to mandatory data that governments will receive, authorities may benefit from accessing additional business data from the source on a voluntary basis, which is challenging. While platforms and data spaces solve a great deal of complexity and interoperability within their realm, platform, and data space interoperability is still challenging. In the logistics domain, efforts have been made to overcome these issues of data sharing across logistics platforms with a Semantic data sharing architecture developed by the CEF FEDeRATED Action, at the heart of which is a semantic model aligning other semantic models for logistics. In this paper, we take the Semantic data sharing architecture as a point of departure and examine the opportunities and limitations that it has for CE monitoring, and how it relates to other developments in the EU and beyond. Many of these developments acknowledge the need for data access across heterogeneous systems and – processes of actors; others add security and trust to data sharing that goes all the way to the level to cover legal obligations. The goal of this paper is to gain further insights into how data sharing across multiple platforms and data spaces enables circular economy monitoring, where government organizations would need to address the issue of how they would interface with, and access data that resides in multiple platforms and data spaces. We found that the various models can be aligned on some architecture principles that promote interoperability across dimensions (e.g. federation, keeping data at the source), yet they still differ on other dimensions (e.g. data model and semantics, as well as how they address issues of identification, authentication and authorization). We suggest further efforts towards developing meta-level agreements and standardization for data space interoperability and we propose further research directions on that topic.

Artificial intelligence (AI) adoption by public sector organizations (PSOs) introduces various ethical risks stemming from a lack of integrating human values into AI design. Addressing these ethical risks is a complex collective responsibility among designers, developers, risk experts, and public sector managers. Embedding these risks in existing risk management practices is crucial for responsible AI adoption, as emphasized by the legal requirements of the EU AI Act. However, the responsibility for managing these ethical risks is often unclear. Public sector organizations face unique challenges due to the complex, uncertain, and rapidly evolving nature of AI technologies, further complicating the management of ethical risks. This paper explores using the Three Lines of Defense (TLoD) risk management model to understand and address these ethical risks in public sector AI adoption. The TLoD model structures risk management across three lines: operational management, risk oversight and compliance, and internal audit. This framework helps to distribute and integrate the collective responsibility for ethical AI risk management within public sector organizations, emphasizing alignment and collaboration among different actors. Through an exploratory study involving a survey and semi-structured interviews with professionals responsible for AI-related risk management in Dutch public sector organizations, we assess the TLoD model’s usefulness in addressing ethical AI risks. The study examines the challenges and opportunities in applying the TLoD model to manage ethical risks and identifies the potential gaps in responsibility and oversight. The findings suggest that while the TLoD model offers a valuable lens for distributing risk management responsibilities, there are limitations in addressing the emergent and complex nature of ethical risks in AI adoption.

The future is likely to see an increase in the use of automated decision-making systems in the public sector, which employ Artificial Intelligence and, in particular, machine learning techniques, to enable more proactive and personalised delivery of public services. Proactive delivery can reduce the administrative burdens on citizens and government staff. While there is a small but growing body of literature that highlights the benefits of proactive public services, the implementation of such services is data intensive and can harm citizens beyond privacy concerns. Proactive service delivery requires high degrees of automated data processing using various data sources and algorithms that reduce the level of human control that both citizens and public officials have in verifying or correcting system errors. The purpose of this workshop is to initiate a discussion about proactive and personalised public services, discussing them and learning from the EGOV community about the practice of applying proactive and personalised services in different countries. This includes presenting an initial version of the developed framework for proactive and personalised public services, which is expected to provide further research directions.

The quantum computing-based threats call for a critical information infrastructure to modify widely used cryptographic algorithms to ones that are quantum-safe (QS). Yet, little scholarly research has been undertaken to study QS transition, and the guidance to prepare for socio-technical predicaments of the transition falls short. To address the gaps, the paper aims to determine the contextual interaction between QS transition challenges and classify these challenges into driving power and dependency power. In doing so, we use an integrated Interpretive Structural Modelling (ISM)-Matrice d'Impacts Croisés Multiplication Appliqués à un Classement (MICMAC) approach. The results of ISM-MICMAC analysis indicate that the dominant challenges that organizations need to prioritize are establishing a clear QS transition governance and collaborations in the ecosystem. The findings show that it is crucial for organizations to understand the ecosystem making up the critical information infrastructure they are operating in and collaboratively navigate the action approaches for the QS transition. This also implies that preparation for the QS transition not only includes developing QS solution standards but also requires well-defined roles and responsibilities for various actors in the ecosystem.

As the development of quantum computers advances, actors relying on public key infrastructures (PKI) for secure information exchange are becoming aware of the disruptive implications. Currently, governments and businesses employ PKI for many core processes that may become insecure or unavailable when quantum computers break the cryptographic algorithms foundational to PKI. While standardization institutes are currently testing quantum safe cryptographic algorithms, there are no globally agreed-upon cryptographic solutions available. Actors looking to prepare for the implementation of quantum safe cryptographic algorithms lack methods that allow for collective planning and action across organizations, sectors, and nations. The goal of this policy paper is to elicit requirements for a serious game on QS PKI, and derive policy guidelines that actors can use to prepare and formulate governance arrangements. We followed a two-step approach, drawing on technology threat avoidance theory and collective action theory, followed by empirical grounding through a focus group. The results from the literature confirm that a serious game could be a suitable governance mechanism for QS PKI. The focus group results discussed 12 requirements and the requirement's relation to the theoretical background. From this, the findings section arrived at four policy guidelines derived from the requirements that can function as focus areas for further requirement development and as input for policy makers. The policy guidelines concluded are (1) prioritize increasing collective awareness through emphasizing social networks, (2) acknowledge the interdependencies in migrating towards QS PKI, (3) create an understanding of the technical standards in the field and their issuers, and (4) being highly realistic with both negative and positive scenarios to center the players' understanding of real-world impact.

Across the European continent, governments and GovTech companies are rushing to launch digital identity wallets for citizens. These wallets should allow citizens to obtain a higher level of control over their personal data. While there are some regulations and policy directions, actors are struggling with the design, launch, and governance of these digital wallets. Those looking for help will find little guidance in academic literature. The objective of this paper is to provide insights in barriers for launching digital identity wallets by a public-private ecosystem. Drawing on the case study approach, we study the available regulations and policy directions, and collect insights from workshops with policy makers and aspiring wallet providers. The main findings indicate that barriers such as the lack of boundary resources (e.g. shared data specifications and exchange standards) and the absence of a collaborative, public-private governance impede the launch of digital identity wallets. Policy makers looking to speed up the launch of digital wallets must focus on removing these barriers, starting with the development and governance of boundary resources by the public-private ecosystem.

In the management of national electronic identity (eID) infrastructure, cooperation between public and private parties becomes more and more important, as the mutual dependencies between the provision of e-services and the provision of the national public key infrastructure (PKI) continuously increases. Yet, it is not clear which key factors affect the public-private collaboration in the eID field, as existing studies do not provide insight into this particular matter. Therefore, we aim to identify the factors that affect public-private partnership (PPP) in the field of eID. We also describe feasible formats that help to improve the cooperation between the two sectors, based on insights from the case of Estonia. In service of that study, we conducted twelve qualitative interviews with high-level experts representing several parties from the public and the private sector. By conducting a thematic analysis of the interviews, we identified five key factors for successful PPP in the eID field, i.e., engagement, joint understanding, two-way communication, clear role division, and process orientation. Furthermore, we generalize our results by discussing, in how far the found cooperation formats can be used by stakeholders to manage state-critical information technology (IT) infrastructure components similar to eID such as mobile phone services, data transmission services and digital signature services.

GovTech, an acronym of Government Technologies, is a novel concept that is gaining attention in the public and private sector. It entails improving the design and delivery of human centric public services and data-driven processes with the use of emerging (digital) technologies. Furthermore, GovTech is concerned with the development of digital technologies that are used in these processes or services, but that are often developed by organizations outside the public sector. As a result, GovTech ecosystems emerge, in which public and private organizations as well as civic partners, including citizens, collaborate. GovTech ecosystems can be defined as networks of citizens, public and private actors, academia, and (venture) capital involved in the development of technological solutions to address public challenges. At this moment, literature on GovTech is still scarce and empirical studies into the emergence and impact of GovTech ecosystems are even scarcer. Therefore, this study explores the emergence and development of GovTech ecosystems. More specifically, the goal of this study is to contribute to the understanding of the barriers and success factors for the emergence of GovTech ecosystems. To do so, this paper conducts an explorative case study of success factors and barriers of GovTech ecosystems in two frontrunner countries: the Netherlands and Lithuania. Regarding the emergence of GovTech ecosystems, we find that the way in which the two GovTech ecosystems emerged and are built up, differs. Whereas the ecosystem in Lithuania is more centralized, the ecosystem in the Netherlands is more scattered. In addition, we find that factors that contribute to successful GovTech ecosystems include public-private collaborations, having a clear vision and strategy, sufficient space for experimentation, having infrastructure, networks and initiatives in place that stimulate sharing of knowledge and resources, and the presence of a culture of co-creation and innovation.

As GovTech solutions are steadily entering the public sector, they have yet to find their way into the mainstream literature. GovTech refers to socio-technical solutions – that are developed and operated by private organisations – intertwined with public sector components for facilitating processes in the public sector. GovTech solutions promise a superior customer journey for citizens and businesses compared to current government portals and front desks. GovTech solutions can be a blessing in disguise for governments struggling in their digital transformation journey, carrying the burden of public service innovation and replacing legacy systems with modern GovTech solutions. Yet, there are also concerns that GovTech solutions are a Trojan horse, exploiting the lack of technical knowledge at public agencies and shifting decision-making power from public agencies to market parties, thereby undermining digital sovereignty and public values. This paper develops a research agenda for GovTech based on a conceptual framework. This framework reveals four interrelated design areas for GovTech: institutional, governance, technical and human-centred design. Governments can employ the conceptual framework to further align and develop their strategies by focussing on GovTech governance, referring to the ability to manage the various interdependencies between the four design areas.

The computation power of quantum computers introduces new security threats in Public Key Infrastructure (PKI), a system used by many governments to secure their digital public services and communication. This calls for an inevitable need for governments to be quantum-safe (QS) by modifying their PKI systems to be resistant to the attacks of quantum computers. However, there is limited academic literature on a QS PKI system, and in this limited literature, the transition challenges are perceived as exclusively technological. This paper aims to create a structured overview of challenges when transitioning to a QS PKI system. We do this by reviewing literature and classifying the challenges using Technology-Organization-Environment (TOE) framework and using an expert workshop to explore the challenges in the context of the PKI system in the Dutch government. The main challenges in the technological context include no universal QS solution, legacy system, complex PKI interoperability, and vulnerable Root CA. The main challenges in the organizational context include knowledge gap, unclear governance, lack of urgency, and in-house management support. Furthermore, the main challenges in the environmental context include institutional void, stakeholder collaboration, lack of awareness, and policy guidance. The results indicate that the QS transition from the current PKI system is complex, and the challenges are socio-Technical. For policy-makers, this implies that they should start early to prepare, whereas organizations are hardly aware of the process of QS transition and the topic of quantum computing is yet to develop the urgency in organizations.

Government agencies are becoming more data-driven and need high-quality data to fulfill their roles in society. In the past, each agency organized its own data exchange system according to its own needs. Today, data is distributed over many organizations, and government agencies need to adopt an ecosystem approach for data exchange. Fundamental in the ecosystem approach is the dependence on other parties for the execution of stewardship strategies. Data-driven government agencies increasingly depend on other organizations for high-quality data and data stewardship across organizations is becoming more critical. While there is ample research on data stewardship within organizations, little is known about data stewardship in ecosystems. More specifically, it is unclear which data stewardship strategies government agencies can employ in ecosystems. The main goal of this explorative paper is to identify and compare data stewardship strategies used in empirical government-business ecosystems. Following an explorative case study approach, this paper reveals three different configurations of inter-organizational data stewardship: 1) the government-led ecosystem, 2) the government-business-led ecosystem, and 3) the regulation-led ecosystem. The case studies expose a wide array of data stewardship strategies across ecosystems. While the ecosystem approach provides advantages such as cost-sharing and innovation by private parties, government agencies become increasingly dependent on private parties to gain high-quality data and provide distributed infrastructure components. Maximizing the benefits and minimizing the risks of the ecosystem approach requires government agencies to be cautious when selecting a specific ecosystem configuration.

Governments are increasingly using sophisticated self-learning algorithms to automate and standardize decision-making on a large scale. However, despite aspirations for predictive data and more efficient decision-making, the introduction of artificial intelligence (AI) also gives rise to risks and creates a potential for harm. The attribution of responsibility to individuals for the harm caused by these novel socio-Technical decision-making systems is epistemically and normatively challenging. The conditions necessary for individuals to be adequately held responsible-moral agency, freedom, control, and knowledge, can be undermined by the introduction of algorithmic decision-making. Thereby responsibility gaps are created where seemingly no one is sufficiently responsible for the system's outcome. We turn this challenge to adequately attribute responsibility into a design challenge to design for these responsibility conditions. Drawing on philosophical responsibility literature, we develop a conceptual framework to scrutinize the task responsibilities of actors involved in the (re-)design and application of algorithmic decision-making systems. This framework is applied to an empirical case study involving AI in automated governmental decision-making. We find that the framework enables the critical assessment of a socio-Technical system's design for responsibility and provides valuable insights to prevent future harm. The article addresses the current academic and empirical lack of philosophical insights to understand and design for responsibilities in novel algorithmic ICT systems.

Public agencies struggle with engaging citizens in digital public service innovation. The notion that citizen engagement in public service innovation can lead to more citizen-friendly digital services is widely accepted. Moreover, citizen engagement has also become an indicator of legitimacy; public service innovation without citizen engagement is more likely to be scrutinized on public values like privacy, transparency, fairness, and citizen control. Yet it remains difficult to engage with citizens throughout the various stages of innovation. Often, the hard question of how to balance system performance and public values in innovation resurfaces, and we cannot leave it to software programmers to answer this question. This short paper reveals how the Netherlands and Italy are engaging citizens in public service innovation. We found that in both countries, the quadruple helix approach is gaining support and citizen engagement is increasingly becoming the norm rather than the exception. Both countries are gaining experience with new citizen engagement methods like user-driven prototyping and living labs. We found that these methods increase empathy, creativity and reflection on ethical dilemmas. Following such methods also signals to policymakers that a democratic process was followed, ultimately backing a specific innovation direction. Other countries looking to enhance citizen engagement in public services innovation can benefit from the insights presented in this paper.

The COVID-19 pandemic highlights the dependence on digital public service delivery in many nations. The intensified use of digital public services also shifted the spotlight to accessibility and reactive design of digital public services. Inspired by the high level of proactivity provided in commercial digital services, policy-makers are looking for guidance on employing the vast amount of (personal) data available at various public agencies to proactively aid citizens during important life events. Proactivity, however, is a very complex multi-level concept with a myriad of case-specific forms and conditions and is not always desired. Moreover, there is little guidance in the literature on how to classify the level of proactivity and design more proactive public services. The objective of this paper is to provide guidance for classifying, understanding, and designing proactivity. Drawing on previous conceptualizations in literature, this paper introduces a proactivity classification framework that is substantiated using empirical cases from the Netherlands. We found that fully proactive services are not always desired or possible due to public service characteristics. The two key variables in this framework - service eligibility and service delivery - were used to propose design principles for increasing public services' proactivity. The principles were validated and prioritized by four public service innovators. Policy-makers looking to enhance inclusivity through service proactivity can start by classifying current services and integrating the design principles in their innovation roadmap.