The Dangers of Moving Key Internet Governance Functions to Amazon’s Cloud: The Case of the Netherlands

In the Netherlands, the Stichting Internet Domeinregistratie Nederland (SIDN) manages the digital registry of over 6 million '.NL' websites, including government sites like government.nl and politie.nl. When consumers want to visit these .NL websites for tax filing, applying for rent or childcare benefits, or vaccination planning, SIDN ensures that this is possible. In its role as a technical registry, SIDN plays a critical role in the use of the .NL part of the Internet. Today, SIDN wants to expand its core competencies, seemingly to generate more income at the expense of the collective security, stability and sustainability of the Dutch Internet.

Recently, SIDN surprisingly decided to outsource a part of its relatively mundane registry work to the US cloud company Amazon Web Services (AWS). This announcement led to a flurry of astonishment and critique. Academics, industry representatives in the EU cloud community, technologists in the Internet governance ecosystem, civil society members, and politicians all spoke out on the dangers of moving part of SIDN’s functioning from its servers to the AWS cloud. SIDN, an organization most Dutch Internet users will never have heard of even if they use its services daily, suddenly made front-page news. The case is interesting for a broader tech policy audience, as it speaks to a key trend—whereby critical services run by governments are moved to big US cloud behemoths, with little thought about the potentially harmful long-term consequences.

Why this move to AWS by the Dutch registry and why now? The chief technology officer of SIDN claims, based on externally outsourced advice, that no European cloud company can provide the required services. The advisory report on which he bases these claims is not public. If SIDN's claims are true, it suggests that European cloud companies are unable to deliver a relatively simple computer system. This is an absurd assumption, given the independent management of Internet domains by SIDN counterparts in other European countries, such as France (.FR) and Germany (.DE). These countries and markets are significantly larger than the Netherlands, a small country with only 18 million residents and 6 million registered domain names.

The choice to move these critical Internet governance services to AWS seems to be as much commercially motivated as technically. SIDN, like many registries, is looking for ways to convert its technical expertise into new revenue streams, and enter the lucrative Software-as-a-Service (Saas) market. In a few brief sentences in the SIDN press release that caused the initial stir, the organization also states that it intends to offer domain name registration software and sell it as a service, i.e. sell it like a plan in the same way consumers pay for Spotify or Netflix accounts. This would be a new commercial direction for SIDN, generating a recurring stream of revenue on top of their existing income. Interestingly, SIDN intends to do this based not on its own software, but by partnering with Canadian registry CIRA, which runs th .CA domain.

The SaaS ambitions do indeed require a cloud platform as global as the market SIDN aims to tap into. If these commercial plans significantly influenced SIDN's decision to switch to a US provider, then the SIDN CTO is correct, and AWS is indeed a more suitable partner than its European competitors.

SIDN is also correct in noting that the organization is following a broader trend. European businesses are rapidly outsourcing the management of digital systems to US firms. By loudly claiming that it is no longer possible to find cloud providers in Europe, SIDN is accelerating this problematic trend further. The well-known dangers to political independence that citizens expect from an organization classified under Dutch law as a 'provider of essential services', seem to be disregarded. If even the Dutch Internet domain registry, which describes itself on its website as 'an expert in what we do and fully independent,' chooses to outsource key services to Amazon, then who is still independent? This gives everyone a license to outsource all their technology.

Let it be clear that we do not consider this move to AWS a good idea. As a key national infrastructure player, what business does SIDN have in the commercial software industry, or with AWS, for that matter? Regardless of the wisdom of choices made by the broader European business community, we should set higher standards for 'the company behind .NL,' as SIDN once called itself. The importance of .NL cannot be overstated. A disruption in AWS services for .NL would not only disrupt the Internet in the Netherlands but also cut off communication from abroad. In such a situation, SIDN will not be first in line at the AWS helpdesk, given its small size relative to the global clientele of this cloud giant. And since everything is outsourced, SIDN will struggle to rebuild or rehost their services should this be needed. To be good with technology requires actually doing technology. We must openly question SIDN's commercial ambitions, especially if it comes at the expense of retaining control over its core capabilities and critical services.

Can’t the Dutch government intervene? It's hard to believe, yet .NL (which does in the end stand for "Netherlands") is not within the government’s direct remit. SIDN is a private law foundation, now composed of four different private limited companies (BV’s). However, there is a possibility for pressure. There is a "covenant" in which the government acknowledges that SIDN may operate the .NL services, under two stipulations. First, decisions must be made in consultation with the internet community. Second, there must be a "connection" to the Netherlands. How much consultation has there been on this issue with the government is unclear at the moment. Equally unclear is how SIDN aims to meet the “connection to the Netherlands” stipulation following its decision to outsource key functions to AWS. The lack of answers to these questions underscores the importance of ensuring that the European cloud industry is at least involved in 'essential' applications like .NL, if not the primary provider for them. By outsourcing its country domain, seemingly without in-depth consultation, to organizations outside the Netherlands, SIDN has violated the trust in the non-binding convention.

Dutch Parliament is now paying attention to this situation, with multiple politicians asking formal questions about this decision. We hope that they will revisit their oversight of SIDN and recognize that this kind of core infrastructure should not become even more dependent on the cloud in general, and the American tech sector in particular, just to make a proverbial buck.