Digital state resilience under crisis - the case of Ukraine's Diia (panel discussion)

On 30 April, I joined a panel at the Hertie School of Governance in Berlin to discuss how digital states continue to function during crises. Ukraine's Diia ecosystem (now serving over 23 million users) was our central case as we explored what genuine crisis preparedness means for Europe.

Here are my key takeaways:

1. Resilience is architectural, not an add-on. We need to look past the shiny surface of government apps to the underlying stack. Digital state resilience requires a robust digital identity infrastructure, interoperable data exchange layers, and adaptable and, ideally, sovereign cloud solutions - all anchored in legal and organizational frameworks negotiated before a crisis hits.

2. Agility is survival. By leveraging Diia's adaptable architecture, the Ukrainian government launched new digital services as rapid MVPs - deploying over 100 wartime services, including displacement registration and cash assistance, within days or weeks of emerging threats.

   But agility requires data redundancy. Ukraine had passed enabling legislation days before the invasion, allowing emergency cloud migration the moment the attack came - the state stayed online despite physical strikes on data centers. Estonia runs a sovereign Data Embassy in Luxembourg. Others, like Singapore, build on national cloud interoperability. Whatever the solution: critical data must move beyond vulnerable physical systems before a crisis hits.

3. Federalism as an engine for bottom-up agility. Germany is building the necessary structural pillars: register modernization via NOOTS, sovereign cloud strategies, the EUDI wallet. Federal complexity and fragmented IT governance have notoriously stalled implementation. But federalism is also an incubator. Agile solutions can emerge bottom-up; the "One-for-All" (EfA) principle and broader collaboration between IT service providers and local government institutions are key enablers.

4. Speed requires pre-negotiated trust. We don’t have to and should not sacrifice democratic safeguards for agility. European and national frameworks for security, critical service provision, and data protection are important sources of legitimacy. In order to prevent improvising legal authorizations under pressure, they need explicit "crisis-modes" defined in advance. And crucially, digital-first cannot mean digital-only; true inclusion means maintaining analog fallbacks.

On a personal note: my 5-month-old daughter came along, and Hertie students stepped up to care for her during the panel. Such actions enable real inclusion.

Huge thanks to the student EPIS Thinktank for the invitation, the great event and moderation. My thanks also to co-panelists Viola von Cramon, Nataliya Pryhornytska, Mathias Großklaus, and moderator Age Steenbreker.