Dutch IT Channel – Clingendael: The Netherlands and EU, focus on cloud sovereignty

The Clingendaal report was written by Maaike Okano-Heijmans and Alexandre Gomes. Maaike Okano-Heijmans, Program Head of Geopolitics of Technology and Digitalization at Clingedael, recently briefed the House of Representatives Committee for Digital Affairs.

The policy-oriented analysis ‘Too late to act? According to Clingendael, Europe’s quest for cloud sovereignty consists of the following summary:

‘Currently, a small number of American companies dominate 70-80 percent of the European cloud services market. These so-called hyperscalers (such as Amazon Web Services, Microsoft Azure, and Google) offer the best technology for an attractive price. We really need them right now. However, given the access that the US government can demand to information in the cloud, the question arises as to which data is so private or secret that we in the Netherlands want to retain control. In addition, the question is whether and how we want to build up and maintain our own technological knowledge and skills, in order to make informed choices and have an alternative to foreign solutions. The ever-growing market dominance of American companies is therefore cause for concern about our digital sovereignty. This is even more true for emerging Chinese companies, which are not entirely separate from a government with very different principles regarding data collection and data use.

Concerns about ‘sovereignty’ or ‘open strategic autonomy’ also exist in other areas of the digital infrastructure and society. In the late 2010s, the discussion focused on our telecom networks; specifically the role of the Chinese company Huawei in the rollout of 5G. For security reasons, European technologies from Nokia and Eriksson were used just in time for the core of telecommunications networks. Similar concerns about competitiveness and sovereignty now apply to quantum technologies and Generative AI.

The problem with Dutch/European cloud services is that they are too small in scale and do not offer an ‘All-in-1’ solution. This is partly due to the fact that Europe does not have a venture capital culture, which means companies cannot innovate as quickly as American counterparts.

All major cloud players in the United States were/are helped by government contracts to develop specific solutions. Support not only concerns subsidies and tax benefits, but also purchasing and tendering processes. For example, in 2022 the Pentagon awarded a contract worth 9 billion US dollars to AWS, Microsoft, Google and Oracle. In Europe there is a lack of recognition of this important role of the government as a customer.

Now that Dutch and European government institutions are moving to the cloud, this is the last chance to gain control over this vital infrastructure. The role of the government as a customer is twofold: (1) by choosing European cloud solutions, the government helps European companies to improve their market share – and thus services, technology and knowledge; and 2) as a first mover to European cloud companies, government agencies give a stamp of approval, and thus a signal to politicians and the private sector to also consider European service providers.

If we are serious about economic security and sovereignty in our digital infrastructure and economy, the following points are important:

1. What data do we want to keep at European cloud companies? State secrets naturally fall into this category, as the Dutch government recognizes. But there is much more data that is so sensitive that we should want to keep it to ourselves. Consider, for example, information from courts, politicians and Parliament, medical and other personal data of citizens, and trade secrets from Europe’s most advanced technological companies. Clear decisions and guidelines on how to deal with this are still lacking in the Netherlands and Europe.

2. Guide for pilot projects (sandboxes) and use of market power: The upcoming move of data from many government agencies to the cloud requires management because the choice for European companies is not the cheapest or technically simplest. An attractive European proposition requires an ‘All-in-1 package’ – including storage, databases, security and software development tools – as an alternative to existing American propositions. Only by working together can Dutch and other European cloud companies achieve such a European ‘Beehive Cloud Megascaler‘. Pilot projects can guide this collaboration and gradually create confidence in this solution. In so-called ‘sandboxes’, Dutch and European cloud providers – with government support – would collaborate on the development of a joint product on the market. This starts with orders for companies to offer a total package for the cloud management of non-sensitive data. Local, regional and national government authorities can then be encouraged to opt for these European solutions. The aim is for the successful mini-projects to grow into mature products that will eventually provide a real European alternative.

3. What does a realistic European alternative look like? Although it is too late for a European version of the American so-called hyperscalers, a European ‘Bijenkorf Cloud Megascaler’ still seems feasible. The government has an important role in the construction of such a Bijenkorf Megascaler, as it is not profitable in the short term and requires cooperation between companies that the market does not require. This requires an inventory of which Dutch and European companies would jointly form a realistic proposition, and of the conditions under which companies would invest in this.

In conclusion, champions, knowledge and skills are needed to meet future challenges to our national security – including economic security and cyber security. This is the only way we can prevent ourselves from becoming dependent on (the whims of) foreign countries. Our sovereignty is at stake, so let’s not completely hand over the wheel – not even to American friends.’