Netherlands launches sovereign cloud blueprint with hardware limitations
Dutch government's ambitious cloud project confronts Europe's hardware dependency reality.
1Ambitious public sector cloud
The Dutch government released version 0.9 of its sovereign cloud architecture in August 2023, marking the country's most significant public IT infrastructure project in years. After evaluating four scenarios in a Gartner study, officials chose to build a new centralized cloud rather than federate existing platforms. The design shifts from previous reliance on American tech companies, addressing what CIO Ron Kolkman calls a strategic vulnerability in government operations. The project aims to become the backbone of Dutch digital services.
2European sovereignty framework
The architecture adopts the European SEAL framework with five sovereignty levels (0-4). For software, the Netherlands targets SEAL-4: full control over code with no proprietary dependencies. Hardware sovereignty is capped at SEAL-3 due to Europe's lack of CPU/GPU manufacturers. This means controlling hardware location and operators but not processor firmware from non-European entities. The design treats this hardware limitation as a structural reality rather than temporary gap.
3Technical specifications
The cloud centers on a Haven-standard container platform running Kubernetes directly on physical servers, eliminating virtualization layers. Designed to scale to 50,000 servers, it mandates OSI-approved open source software with preference for European projects like NeoNephos. Development follows phases: starting with container IaaS, adding platform services later. A parallel proof-of-concept tests architectural choices. The design prioritizes European open source but acknowledges substantial expertise investment requirements.
4Three-part financing model
The architecture proposes central funding for fixed costs, consumption-based variable charges, and an innovation budget - though specific amounts remain unspecified. It allows all government levels to use the cloud according to data sensitivity, with strictest controls for critical workloads. CIO Kolkman emphasizes sovereignty means not being at providers' mercy, but the document lacks budget commitments beyond the current proof-of-concept phase.
5Industry dissatisfaction
Dutch cloud providers expressed frustration with the government's approach. After April's framework agreement with Germany's StackIT, the Dutch Cloud Community called it a missed opportunity. Domestic providers meeting sovereignty requirements reportedly weren't given competitive chances. A June position paper advocated including multiple European providers and splitting large contracts for smaller firms. The DCC estimates 3-5 years needed for digital autonomy with transitional costs.
6Open source challenges
While open source eliminates vendor lock-in, former Dutch Cyber Security Council member Bert Hubert warns European organizations underestimate maintaining government-scale open source infrastructure. The challenge isn't finding suitable code but ensuring communities deliver reliable security updates. The design mitigates this by choosing established open source projects with formal governance, offering better continuity than single-supplier dependencies.
7European capability gap
The design acknowledges European providers excel at basic infrastructure but lack the integrated service depth of American hyperscalers. Hubert's analogy contrasts European 'beautiful wood' with customers needing 'finished furniture.' This capability gap influences the architecture's phased approach and hybrid model combining government control with commercial expertise. The proof-of-concept running parallel to design aims to validate technical choices.
8Strategic imperative
The sovereign cloud represents a fundamental shift in Dutch digital strategy, prioritizing control over convenience. While hardware sovereignty remains constrained by European industrial realities, the project pushes boundaries where possible. Kolkman's urgency reflects growing recognition of cloud infrastructure as critical national infrastructure. The success hinges on balancing technical ambitions with practical procurement and sustaining open source communities long-term.