Dutch gov't will only allow European company to operate DigiD platform
nltimes.nl255 points by TechTechTech 11 hours ago
255 points by TechTechTech 11 hours ago
As a French person, I'm confused as to why DigiD is not a government-run project like FranceConnect is. I'm even more bewildered that an American company thought that they could take over the national identity management system of an European country, as if this was business as usual.
DigiD is a government project. It's owned and operated by Logius, which is a government-owned entity.
Logius outsourced the hosting and infrastructure to Solvinity.
That's a bit better but it shifts the question:
Why did they not mandate national (or at least EU-based) hosting and infra ?
It feels a bit insane in retrospect for such a critical digital service ?
It's an unfortunate Dutch way of doing things. The firm believe that the market will solve it if you have a contract that says thing will be solved. Write a tender, pick the cheapest party, trust in contracts, hope it won't break before you (the external contractor pushing for it) move on in a few months time.
The people who pointed out that none of the moving parts of DigiD should have been outsourced were ignored until the tide shifted this year.
I'm honestly surprised the government decided to intervene. The usual method is to keep on believing in the signed piece of paper until the shit hits the fan (like with the Fyra high speed trains) — never mind that the US (where the buyer is from) is not likely to give a toss about those pieces of paper if they need something from our data.
It's important to add the context that whenever our government tries to do something by themselves it ends up late and severely over budget.
So you have to weigh the risks of outsourcing to the risk of the whole thing becoming very late and very expensive. The risks around outsourcing are something further down the line, the risks of everything becoming expensive and late are something that will give the responsible politician a headache now.
I work (and always has) in the private sector and we can be even better at ending up over budget and be even later at delivery. I don’t believe for a moment that the government has a monopoly on underachieving!
The problem isn’t public or private, it’s incentives.
If the private company is granted a defacto monopoly, it doesn’t matter that they’re a “private” company, they will have the same incentive and accountability problem.
What we know for certain though: Government taking over something is definitionally a monopoly and 99.99% of government employees are not subject to the accountability mechanism of elections.
Historically, the largest boondoggles of waste have always come from government, given they can legally hold a gun to your head and take 50% of everyones money to fund their “projects.” Private companies can’t take your money by force, unless being given those contracts by government. So again, the the incentive issue fundamentally arises from an entity being entitled to gather assets using violence rather than voluntary exchange.
Expat/kennismigrant here - it's same "ends up late and over budget" for literally every country (and private businesses).
What Dutch government/politicians seems to be "ahead" compared to other countries - is combination of narrow or short sightedness and (over)correction trough rules, laws and regulations.
Like giving subsidies and tax breaks for electrical cars, rooftop solar panels and mandating household switch from gas (LPG and such) to electric heating and cooking. And ignoring industry professionals for decades saying the distribution network won't scale.
More of the same with stuff like 30% tax rule for expats, which was originally introduced as cost saving measures because actually doing bookkeeping for expatriate expenses was costing government more money. But then more recently expat tax breaks have been reduced and phased out "because cost saving". Meanwhile employers have trouble finding highly skilled workers. And we're limiting numbers of foreign students in universities (by forcing them to do it in Dutch instead of English).
Some Bulgarians cheated/defrauded Dutch tax returns or such - and "solution" was ML/AI reviewing things - but it turned out to be broken/biased and (ab)used for other things - leading to the whole toeslag scandal and government resigning.
Same for nitrogen vs lack of housing... And many more.
Outsourced stuff is late and expensive too, just not directly the responsibility of the minister or secretary of state because of the magic piece of paper in between.
IT is hardly something we need to do occasionally, so build up a department that can do it (not just write up huge reports about what it should do and outsource, like Logius) and invest in the people that will work there (retaining them as much as possible). Give a big middle finger to consultants, and listen to the tech experts. Build boring stuff that works instead of a new app every month.
It's not impossible in theory, and cheaper in the long run. It's impossible because asshats who would actually benefit from left and centre politics keep voting right-wing parties in to power.
I agree that the government should do IT in house, ideally, because it's a core business for them. The reality is that it is very hard to attract and retain good IT staff on a government salary. The people who need to manage all that in a cost-effective way are especially hard to find.
So we end up with expensive consultants doing the work. Consultants have the wrong incentive. They don't want to stay in one place to long because it looks bad on their resume and overruns mean more money for them.
So really, I can see why a seasoned politician chooses the safest option for him. By the time an overrun occurs he will have moved on to the next job. I don't think left or right-wing politics has much to do with this dynamic. How will a left-wing politician magically get capable IT staff that higher paying industry can't even get enough of?
> Why did they not mandate national (or at least EU-based) hosting and infra ?
They did, and they moved to block the acquisition of the local company handling it. What's unclear in the article?
The "local" company is already UK owned though, so at most "European", not national or EU.
What I find strange is that the Dutch government does have its own datacenters, e.g. ODC-Noord (1), but they're still looking to outsource the hosting even after the current contract ends in 2027.
I suspect that most government departments see data centers as a liability and are very happy to outsource to the big providers, apart perhaps from the ones hosting stuff they don't really want you to know about.
It's always better to be able to blame a supplier for something going wrong if you're a senior leader or politician. For some reason, if it does happen no one has to resign.
There is loads of UK Critical National Infrastructure on AWS, probably Azure too. And the Home Office put up £10 million tender to shut down an old data centre not that long ago without a confirmed replacement - https://www.find-tender.service.gov.uk/Notice/018193-2024
Seems like governments, at least ones of the size under discussion here, are big enough to have a general services agency run a consolidated data center for the rest of the government, allowing individual agencies/departments get similar benefits of outsourcing to a commercial entity.
They didn’t
> Currently, DigiD is partially managed by Solvinity, a company owned by a British investor
Britain is neither local nor in the EU
The company is incorporated in the netherlands, and the workers are there. The corporate structure means the shareholder can't do whatever they want.
I don't see why they should bother with who invests in it, when they have the power to do what they just did and block the acquisition.
Most National governments embraced globalism and free market solutioning. It worked both ways.
American Federal Systems also have European and Indian operators but it gets more restricted depending on what part of the system you're dealing with. Even then, the operators get it wrong.
Many "American" firms are being served by Irish, Bulgarian, and Dutch operators for example. When you get to Fedpod, the restrictions are usually tiered, not all or nothing. It's why US firms got caught with Chinese handling data.
The question isn't should Europe and even America clean it up - it's how much is legitimate national soverignty and how much is going to be straight mercantilism in the Cloud/SaaS sector.
"Most National governments embraced globalism and free market"
One could say globalists and free marketeers 'embraced' governments.
I'm mostly bewildered that the Dutch government was ok with that, and it took way too much effort from the opposition to get them to pivot on this.
The entire customs system of all of China used to be run by European foreigners. Not because of Western imperialism, but on invitation from the Chinese rulers, as a measure to combat corruption.
Some European countries right now have their currency printing and their passport printing outsourced to foreign nations.
These things aren't too unusual.
> Some European countries right now have their currency printing and their passport printing outsourced to foreign nations.
Whilst I still agree with your premise that this is not wise, I should point out that, for example UK passports, whilst produced in Poland, are personalised in the UK. Not that that helps the UK case since the personalisation is done by Thales...
For France it certainly is, probably because of our stubborn focus on strategic autonomy. For example, offshoring passport printing to me sounds like a great opportunity for identity theft and document forgery by people outside of your jurisdiction.
I do kinda get the China customs system example though, only because if corruption is bad enough that it's a greater concern than opsec, then you're kinda hosed anyways.
> For France it certainly is, probably because of our stubborn focus on strategic autonomy.
You're seeing people wake up to the threat now, with the opposition against Kyndryl and the Nexperia thing.
Somewhat more controversially, I'm also worried about the French government owning large parts of the Dutch defense industry through Thales and Airbus. (And, to a lesser extent, German and Spanish governments.)
Very little of the Dutch defense industry is still Dutch-owned. Only Damen comes to mind.
The days of nationalized French defense companies and state arsenals have been over for quite a while. Assuming I didn't make any mistakes:
GIAT was privatized, then renamed to Nexter, then merged with German KMW to form European KNDS and now it's about to do an IPO.
All of the French aerospace industry (including missiles) bar Dassault and Thales is inside Airbus.
Arquus was bought by Belgian John Cockerill.
I could probably cite more if I dug deeper, but while we still have French defense companies like Dassault, Naval Group and Thales, a fair amount of our defense industry is no longer exclusively French owned.
And if the French government or owner starts getting uppity, you could always take a page from the Swedes and how they Kockums the shit out of ThyssenKrupp.
The Netherlands is a small but very tasty fish in a pond infested with sharks.
None of the sharks ultimately ever managed to agree who gets to eat it- because whoever did would upset the balance between the sharks.
But China and America are mega sharks who don't care about balance and want to eat everything or die trying.
As a Dutch person, I'm not. Dutch administrators are traditionally wary of doing anything themselves that they could conceivably outsource to a commercial party. That also results in endless swarms of locus^H^H^H^H^Hconsultants feeding on our taxes.
I hate it, but what can you do, this is sadly what people here keep voting for.
I’m unaware of this kind of topic ever being one of the points in election time. This as opposed to topics like animal welfare. Sovereignty is only now becoming more visible as a votable topic.
Sadly, I don’t know of a way to influence how our government practices IT. Except maybe to work for Logius. And even then there will be the topic of funding.
I’m unaware of this kind of topic ever being one of the points in election time.
IT sovereignty may not have been a topic during elections, but it should be clear to anyone now that the VVD (political party that has been in most governments in the past decades) is a revolving door. When given a choice, they will always prefer letting the market do it/deregulate. This is not limited to IT. Banks, insurance companies, gas companies (Shell), etc. is where they work before they go into politics and/or work after they leave politics.
Governments are not the only players needing working digital id, and sometimes banks are faster to build it.
Banks have nothing to do with DigiD. There is eidas which allows you to attest your identity using a bank.
Probably because it is wildly expensive to have a government directly run any tech project.
The neoliberal party VVD love involving private businesses in government operations, they considered that a win-win.
France is a lot more socialist luckily.
Finally taking the digital threath from USA, Israel and China serious.
When EU ID is needed for Eurovision voting we can all act surprised by the change in rankings.
“This year's Eurovision winner: Tommy, Käärijä, and Joost, the Euroboys!”
“Huh. Israel hardly got any votes this year.”
I'm getting spam and harassment from accounts promoting Israels eurovision contestant, on IRC, in 2026. It's every year and probably on all newer socials too.
Yes.. their days of not taking the threat seriously certainly have come to a middle.
Finally.
But now they want NL Wallet to use Google and Apple accounts for login, so this is happening again.
There is hope:
Thank you for raising this issue. We are aware that our current implementation does not yet work on GrapheneOS. This is a temporary situation we plan to resolve before this app goes public.
https://github.com/MinBZK/nl-wallet/issues/34#issuecomment-4...
Until then, I'd recommend every Dutch person (or probably every EU person, since this could also influence other wallets) to upvote/heart the initial request in that issue to show that there is serious demand for this.
Here is my naive take on sovereignty, and how everything should work in the new "USA decided to kill its own dominance, and attack its allies" world. The world is now balkanized, let's live in that reality.
1. Almost every country has amazing universities with software tracks. A big issue is that universities often don't prepare their students for the real work, aka making and supporting products.
2. Governments should greatly favor products created by the students of their own universities.
The goal of every country should be to foster a sovereign software flywheel. Anything else seems pretty darn silly.
I ve had exactly same idea for many years now, but apparently that's not as obvisous to others
Developing new software? Universities! Maintaining/migrating old software? Universities! IT counseling and advise? You won't believe it ... Unive okey i stop here you got the point
SV VCs have been Stanford's biz dev team. Every country should use that as a template.
>The goal of every country should be to foster a sovereign software flywheel
The very simple economic problem with this is that autarky does not increase aggregate output. Saying "I will do this myself", always requires the qualification "at the expense of what else that I'm not doing?"
The adaption to a reality of a balkanized world for small countries is, like Singapore does successfully, triangulate between large countries, specialize what you're good at, be pragmatic and flexible and strategically neutral which makes big powers compete for you without drawing hostility, rather than trying to become 'sovereign', which makes you poor and a target.
When your previous major ally now threatens to destroy your country, and system of government, new compromises need to be made.
We are all in for a wild ride in the coming years. Many adjustments will need to be made. Those who adjust fastest will come out on top.
IDK what it's like now, but DigiD used to be 2 racks in a separate cage. Even if you can access the floor, you're not getting physically near the servers.
Why not just dutch company?
There are European countries that are obviously pro-russia...
What if this European company decides to contract out its job to other continents?
Then they'll be in breach of contract. Lots of government contracts have a "no outsourcing" clause.
What's wrong with the government taking over admin of DigiD? I just don't understand why the government won't consider funding it. It's a public infrastructure service at this point.
For some reason the government isn't willing to pay software developer salaries. It would rather pay a company to pay them instead.
In some countries that is a dream job.
The public servant benefits in vacations, work hours, health support, plus an above average salary as highly educated technician.
That's a logical thing for governments to do. Governments are under pressure on different axes than the companies they contract to do things. Governments switching contracts won't ever make the news, but it's much harder for them to fire people in order to take advantage of increasing efficiencies. Likewise, they cannot short-term employ people easily without this structure.
I think there's a reasonable argument to be made that if the civil service doesn't have a decent amount of technically proficient people on staff, that they can't know what's possible - You just end up with a hollowed-out political class that has no idea what they're out-sourcing, and can't learn lessons post-project.
In most cases its illegal to set up something inside the public org. It needs to be put out as a public offer. It's part of New public management pushed by neoliberal interests.
Bullshit. Its not illegal.
It often is. Above a certain value you need EU wide bidding.
Post and trains already had to be privatised since them being government owned was deemed anti competitive by EU standards
One important note: It's not the admin of the system that's in question here, that is government ran.
The company in question only provides cloud services, and has no access to any data.
> I just don't understand why the government won't consider funding it. It's a public infrastructure service at this point.
It has been 9 years since the last centrist ("purple") government in the Netherlands. 24 years since the last left-wing led government. Nothing more to it.
It's just decades of Neoliberal "outsource government tasks to the free market" policy. There really isn't any other reason; The Dutch government has multiple divisions which are quite good at IT. It could choose to do so at any moment, it just doesn't.
Voters just didn't care. The system worked fairly reliably. So they just kept voting for a very charismatic politician, regardless of the long term consequences.
> What's wrong with the government taking over admin of DigiD?
Because they're a government and they are therefore going to fuck it up.
the netherlands is far from perfect but unless you have a specific grievance with their government, you really have no idea how much better it can be. it's night and day when compared with places like the united states. things can be better even though it feels impossible sometimes.
Unfortunately you will never realize how this ideology is fucking up every facet of society and which interests that are never your own put a momentous effort into drilling that propaganda into your head.
Plot twist: the data will still be stored outside of the EU - the magic of cloud computing. :D
Related:
Netherlands blocks US takeover of vital digital supplier
Good luck with digital id. Not gonna play along. No matter what.
When you are interacting with the government for official business, what purpose is there to hide one's identity? You can't exactly not fill in your name in your tax return.
For the non-government/private business however, it is indeed a matter of privacy. France rolled out a while ago the requirement to establish the user's age when accessing porn sites. I refuse to do that.
> what purpose is there to hide one's identity?
I'm not hiding it. It's on a plastic card that I paid the government to print for me. I'm happy to let them see that anytime they ask in relation to official business or legal concerns.
I do not want this ID to be digital, attached to any devices, or available for inspection outside of my control at any point in time.
> You can't exactly not fill in your name in your tax return.
I just sign them with ink. The same I do with any other contract or agreement. Surprisingly those contracts are just as valid as the tax bill I receive every year and yet no digital anything was ever involved with them. They're fully analog and yet fully enforceable by law.
> France rolled out a while ago the requirement to establish the user's age when accessing porn sites.
If you give them an inch they will take a mile, or perhaps, if you give them a centimeter they will take a kilometer. I couldn't care less if the government is somehow inconvenienced by analog privacy. I do not perceive any personal benefits from having my ID be "digital."
Why? It’s been around in the netherlands for a while and it’s extremely convenient, basically just functions as SSO for government apps.
I knew a fellow with the same idea about government id of any form. No driver's license, no social security card, no state id.
To say the least, he made some pretty serious compromises in life. He was a tattoo artist with no shop and effectively homeless when I knew him, if you were curious.
Anyway, sometimes the world moves on without you.
[dead]
Why is DigiD even a product that needs constant maintenance? From my experience using it it's just a pretty simple authentication/data sharing system. Every oauth provider has something similar. Why is it a whole separate product that is owned by some company?
Any network service with 24x7 availability and millions of users requires constant maintenance. Hardware has some lifetime and needs to be maintained and replaced. OS needs patching. Dependencies need security updates and, time to time, migrations to next major LTS update. Sometimes new requirements come from regulatory, that need development of new features. The skill set needs to be maintained. Support requests need to be served. Law enforcement may ask for some data.
Add to this hard digital sovereignty requirements: continuity of service must be guaranteed for decades. All this requires quite a special setup in which commercial entities are rather tolerated than welcomed, but they may still make more sense than a government agency so constrained by budget process that they cannot hire any decent engineer.
Of course, I understand why some maintenance is required. I just don't get why there is apparently a big maintenance burden over something that is usually a single small feature of a service