Context: DigiD is the Dutch national infrastructure for authenticating to government (and semi-government) services. It's used for anything from doing taxes to checking the status of your pension.
The company that basically runs it for the government is being sold to an American investment company, which brings with it obvious national security risks.
Oh, the joys of public infrastructure privatization...
There's a lesson to be learnt here, extending beyond digital infrastructures.
The Dutch government should have outsourced DigiD hosting to SURF [1] which already had extensive experience with cloud services and is virtually immune to foreign influence.
Yes but our government was deeply neoliberal, pushed for by the VVD party and obsessed with privatisation and markets. This is what caused this mess and many others.
They also adore the US (as an example Mark Rutte, the current NATO boss was their foreman and prime minister for a decade) so dependency on the US was never a problem for them until 2025 when Trump turned against his allies.
Yes, but I like to think the hacker community is persistent enough that if there were backdoors embedded in US or Chinese made hardware, it would have been found already.
Then again, they never found out about the Crypto AG communications backdoor (https://en.wikipedia.org/wiki/Crypto_AG) until 2018 as far as I know. Or they did know but since it's CIA they allowed it.
The company that runs it for the government, or the company who owns it for the government?
If the government owns the infrastructure, but outsources the day-to-day running to a company that's one thing. But if the infrastructure is owned by the third party then that's a lot harder to deal with.
> If the government owns the infrastructure, but outsources the day-to-day running to a company that's one thing
This is still very problematic. To be honest, even using foreign hardware or propietary software is problematic. But you should reduce dependence as much as possible because it is a huge vector that should the foreign government decide to turn on you openly or secretly, it could bring you down before you have a chance to detect what is happening. I believe wars between developed countries will operate at this level (i.e. by targeting foreign dependency chains whether it be national systems for id or simply cutting undersea cables)
I agree that it's still problematic. But you can recover from that by hiring your own staff and slowly taking over the running of the system. No doubt there would be issues, but it would be doable.
Recovering from "Your critical national infrastructure is physically owned by someone else" is much trickier.
The key issue here and in many similar cases is for governments to define what they mean by sovereignty. Because if it means not only ownership but also keep it out of outsiders control then it means that governments will by necessity have to get involved in data ownership and data sharing arrangements of the companies that run and manage their systems. Trust is eroding quick.
The company that basically runs it for the government is being sold to an American investment company, which brings with it obvious national security risks.