Parliamentary statement made on SIDN's registration system proposal
Conditional go-ahead given for more limited migration of the .nl registration system
Conditional go-ahead given for more limited migration of the .nl registration system
Last year, we announced our provisional decision to use the services of a US hyperscaler, prompting some observers to question the need for the move and to express concerns, particularly regarding the implications for Dutch digital sovereignty and strategic autonomy. In response, the then Minister of Economic Affairs and Climate Policy authorised a quick scan to establish, for example, whether services meeting our requirements could be obtained from a Dutch or European service provider instead. SIDN subsequently undertook not to take any irreversible steps until the quick scan, a data protection impact assessment and a security risk analysis had been completed.
On 17 January 2025, the Dutch Minister of Economic Affairs, acting also on behalf of the State Secretary for Digitalisation and Kingdom Relations, made a written statement to parliament in response to questions raised in the house last year regarding our provisional decision to migrate part of our generic technical infrastructure to the cloud platform operated by Amazon Web Services (AWS). The various activities and investigations set in motion by the economy ministry and the interior ministry have now been completed. On the basis of a quick scan of the Dutch and European cloud services markets, a data protection impact assessment (DPIA) and a risk analysis by the General Intelligence and Security Service (AIVD), SIDN has been given the go-ahead to make use of AWS's public cloud services, subject to certain conditions and modifications to the original proposal.
The findings of the quick scan confirm that our decision-making had been as considered and rational as could reasonably be expected, with the reliability and availability of the .nl domain as our primary concerns. No Dutch or European cloud service provider is currently able to fully satisfy our technical and functional criteria or meet our legal and organisational requirements. Furthermore, a solution based on the integration of multiple Dutch and European services would be very difficult for a small organisation like SIDN to realise, as well as entailing considerable risk and expense. Those findings are consistent with a survey of the cloud services market that we commissioned in 2023.
The DPIA confirmed that, with the proposed configuration of the SIDN environment, the additional risk-mitigation measures to be taken, and AWS's participation in the EU-US Data Privacy Framework, the privacy risks associated with migration could be adequately addressed. For security reasons, it was decided that certain parts of the DPIA, mainly those relating to the configuration and the risk-mitigation measures, should not be made public.
The written statement also says that, taking advice from the AIVD into account, SIDN and the economy minister have agreed on a number of important measures to assure the security and availability of .nl independently from AWS. The central feature of those measures is that the database for the zone file will be hosted by a Dutch cloud service provider. The database forms the primary, reliable and trusted source, on the basis of which the zone file will be generated, signed and published using a Dutch service provider, without the use of AWS. The decision to have the zone file hosted in the Netherlands means that a smaller portion of our domain registration system will be hosted by AWS in Frankfurt than we originally envisaged. The agreed measures will reduce our dependence on AWS and help to assure (digital) autonomy.
With the investigation findings to hand and a number of key adjustments agreed, we are now able to proceed with the project. Detailed planning and implementation will take place in close consultation with the economics ministry, the chosen Dutch service provider and the Registrars' Association. We aim to launch the new domain registration system in the first quarter of 2026.
Over the last year, we have engaged in extensive dialogue with stakeholders, and we will continue to do so. We are happy to talk to anyone who has a question regarding the outcome of the investigations, or a suggestion regarding how we proceed with implementation.