The Netherlands and the EU: Prioritising Cloud Sovereignty

This is a translation of a Position Paper (originally written in Dutch) used and presented by Dr Maaike Okano-Heijmans before the Standing Committee on Digital Affairs of the Dutch House of Representatives. The discussion was part of a roundtable on Digital Infrastructure and Economy held on 18 April 2024.

Policymakers and companies are increasingly questioning whether the Netherlands still has control over the digital society and economy. The storage of data in the cloud raises concerns about retaining control. How sovereign are countries and companies when their sensitive data is stored by foreign companies?

On this topic, the Clingendael Institute published the Policy Brief ‘Too late to act? Europe’s quest for cloud sovereignty’ in March 2024. Its key points:

• Market dominance by US companies: Currently, a small number of US companies dominate 70–80 per cent of the European market for cloud services. These so-called ‘hyperscalers’ (for example, Microsoft Azure, Amazon Web Services and Google) offer cutting-edge technology at attractive prices and have become indispensable. However, the US government’s potential access to cloud-stored data raises concerns about what types of data should remain under national control. Additionally, Europe must address how to develop and retain its technological expertise to create alternatives to foreign solutions. The growing market dominance of US companies is disconcerting for Europe’s digital sovereignty. This concern is even more applicable for the emerging Chinese companies with different principles that are also entering the field.
• Broader concerns about sovereignty: Sovereignty concerns extend beyond the cloud to other areas of digital infrastructure and society. In the late 2010s, discussions centred on telecommunication networks, particularly the role of Chinese corporation Huawei in 5G deployment. Security considerations led to a late but crucial decision to rely on European technologies from Nokia and Ericsson. Similar sovereignty concerns now apply to quantum technologies and generative AI.
• Challenges for European cloud services: European cloud providers lack the scale and comprehensive solutions offered by US competitors. This is partly because of Europe’s lack of a venture-capital culture, which hampers innovation compared to American counterparts.
• Government role in the US versus Europe: Major US cloud players benefit from government contracts that support the development of specific solutions. For instance, in 2022, the Pentagon awarded a $9 billion contract to AWS, Microsoft, Google and Oracle. Europe has yet to recognise the critical role of government as a customer.
• The last chance for sovereignty: With Dutch and European public institutions moving to the cloud, this is the last opportunity to secure control over vital infrastructure. The government’s dual role as a customer is pivotal:
  1. Choosing European cloud solutions helps European companies gain market share and improve services, technologies and expertise.
  2. As first movers to European cloud services, public institutions set an example, encouraging political and private sectors to consider European providers.

To address economic security and sovereignty in the digital economy seriously, it is essential to consider the following points:

1. Identify sensitive data for European storage: While state secrets are an obvious category, other sensitive data should remain under local control, such as information from courts, politicians, Parliament, citizens’ medical and personal data, and trade secrets of Europe’s advanced technology firms. Clear decisions and guidelines remain lacking in both the Netherlands and Europe.
2. Pilot projects and leveraging market power: Transitioning the data of public institutions to the cloud requires guidance, as choosing European providers is neither the cheapest nor the easiest solution. Developing an attractive ‘all-in-one’ European cloud package—offering storage, databases, security and development tools—requires collaboration among European providers. Pilot projects can foster trust in a European alternative and showcase its feasibility. So-called ‘sandboxes’ could enable collaboration between Dutch and European providers, with government support, to create comprehensive solutions. Initial projects could focus on non-sensitive data, gradually scaling up to a robust European alternative.
3. A realistic European alternative: While it is too late for a European version of US hyperscalers, a ‘European Department Store Megascaler’ (Bijenkorf Megascaler in Dutch, the equivalent to Harrod’s in the UK) is achievable. Government involvement is crucial, as short-term profitability and market-driven cooperation are unlikely. Identifying Dutch and European companies capable of forming a viable proposition is the first step, along with determining the conditions under which they would invest.

In short: Champions, knowledge and expertise are essential to address future challenges to national security, including economic and cyber security. This is the only way to avoid dependency on the whims of foreign actors. Our sovereignty is at stake, and we cannot fully relinquish control—even to our American allies.