Digital autonomy is high on the political agenda, yet it will be a long time before the Netherlands can truly disconnect from American tech hyperscalers. How do you deal with this as a privacy and ICT professional? Menno Weij, tech and privacy lawyer at The Data Laywers offers tips. 'It's good to start small. Send a text message sometimes. Or switch to Signal.'
In February, U.S. President Donald Trump decided to impose sweeping sanctions on the International Criminal Court. One of the consequences: the chief prosecutor lost access to his Microsoft email account - which was presumably blocked - and had to switch to another mail server as a result. The sanctions ride roughshod over the work of the Criminal Court.
Trump has thus put the Netherlands, as well as other European allies, on notice: the Americans have quite a lot of leverage because, like the Criminal Court, many organizations depend on American hyperscalers and their cloud and software services.
Politics, which for years has allowed this dependency relationship to run its course - after all, America was that staunch ally, wasn't it? - has been shaken awake. The theme of digital autonomy, being the master of one's own digital domain, independent of non-European parties that one does not want to be dependent on in turbulent geopolitical times, is high on the agenda of, for example, the Standing Parliamentary Committee for Digital Affairs. Digital autonomy is also an important part of the Dutch Digitalization Strategy that was presented in early July.
There are sounds of alarm to take action now, yet it will be another 10 to 15 years before we start seeing significant change, such as building a national cloud infrastructure, European or otherwise. In short, it is an issue that requires a long haul, and therefore can create uncertainty among privacy professionals. Where do I stand and what can I do myself to bring that desired digital autonomy closer?
Trump is indeed erratic and an unguided projectile, says Menno Weij. "We don't really know what to expect from him in the coming period, and that causes unrest, also in the workplace. Is the continuity of American services guaranteed?" At the same time, he puts concerns into perspective regarding this last point. "I don't see any real changes in the policies of Amazon, Microsoft and Oracle, for example, at the moment. After all, the U.S. infrastructure is now functioning quite nicely and it is - not insignificantly - also technically quite reliable in terms of security of supply."
And: they are also comfortable and relatively inexpensive applications. "It remains to be seen whether the European alternatives will be the same. If internal organizations are hanging onto something, it does require that they can do their work without too many bumps."
Moreover, Weij points out: Microsoft's European cloud has to comply with our privacy laws, and so far that's going pretty well. "Those tech giants do have their calling card in order on this point." According to him, Microsoft is hell-bent on reassuring Europeans, with a designed charm offensive in May in which a high-ranking delegation from the tech giant knocked on the door of Art de Blaauw, director CIO Rijk - the face of digitization inside and outside government.
That, according to the lawyer, does not take away from the fact that the sanctions against the Criminal Court are "quite severe. But, he says, at the same time it is also good to realize that this is a presidential decree in which the U.S. Microsoft has no choice but to implement it. "That is not to say that this is going to happen more often and certainly not on a large scale. 'After all, the financial stakes are also huge, including for the U.S. economy."
Weij can well imagine that these kinds of actions cause anxiety in the workplace, especially among privacy and ICT professionals. "The most common question is: Should we do something? Also at our office. The honest answer to that at the moment is that you can't do it just yet. You can't change your IT infrastructure overnight." It might still work with the cloud, but as far as applications are concerned, it's going to be a lot harder, Weij says.
He suggests starting small. Baby steps. That way we can reduce the sensitivity of transmitted data. Weij: "As a civil servant you can say: we stop using WhatsApp and switch to Signal. And sometimes send each other an old-fashioned text message. As for mail, you could switch to ProtonMail." That's a Swiss company that offers (heavily) encrypted mail.
And, says Weij, also dare to take a pass. Take, for example, the AI chatbots with which the government wants to improve its services to citizens. "Nice, exciting and useful to work with generative AI tools like OpenAI, ChatGPT and Microsoft's CoPilot, but why not also look at European alternatives that are already available? For example, partner with France's Mistral, which offers similar services."
From a step-by-step approach, you can slowly work toward a more fundamental change, Weij said. "Above all, you have to be a bit realistic about it." That a municipality like Amsterdam wants to be digitally autonomous by 2030, as previously was announced, he doesn't really believe in that. "It's a nice aspiration. But then again, those Amsterdam citizens are really all on Instagram and Facebook, through which they also communicate with the municipality of Amsterdam. I have yet to see if they will all switch to an alternative within five years."
As the interview progresses, it becomes clear that Weij sees more in collaboration and debate within organizations. "Don't be too ambitious with that proverbial dot on the horizon. Achieving digital autonomy is a long-term process. Talk to each other and create a cultural change. As far as I'm concerned, it's really about a change in mentality."
Finally, he needs to get something off his chest. "If we as Europeans really want to make a fist in the digital field, we will have to take a harder and more power-political stance, also towards the Americans. Show that you are digitally resilient. That you really don't take everything, for example when it comes to data transfer. Then we will start to see real change."
