Why the AWS public cloud is our preferred option

Over the last few weeks, we have shared details of the background to our proposal with our direct stakeholders. At a series of engagements and meetings, we have presented the findings of the external consultants' report and explained why we believe the AWS cloud is our best option. We have also listened to stakeholders' views, answered questions and addressed concerns wherever possible. Nevertheless, it was impossible to cover all the relevant points, and dialogue therefore continues.

More information needed

We expect that similar questions and concerns are being raised in the wider stakeholder community. Because we failed to communicate our plans clearly enough, their portrayal in the news media and on social media did not accurately reflect our true intentions. We would therefore like to clarify a number of matters before setting out the background to our proposal.

Clarifications

• It is only the infrastructure used to register domain names and update existing registrations that we're planning to migrate to the AWS cloud. Our proposal doesn't involve the DNS, the .nl zone file or .nl domain names. Nor does it relate to .nl websites or e-mail addresses -- things like that aren't under our control.

• The management of .nl is not being transferred to AWS, but will remain with SIDN.

• Data about .nl registrants will remain in Europe; it will not be transferred to the US or anywhere else. We will be using the AWS data centres in Frankfurt and Dublin. And we'll remain in full compliance with all relevant Dutch and European legislation and regulations, including the Networks and Information Systems (Security) Act and the GDPR.

• All the data stored in the cloud will be encrypted, and SIDN will retain exclusive control of the encryption keys. We intend to make use of the functionalities and control capabilities for the encryption of data in transit, at rest or in memory storage.

• All .nl websites and e-mail addresses will continue to work, even in the event of a global AWS outage.

• We'll be using open-source technology and open standards, and our registration system will be designed to facilitate potential migration to another cloud service provider at a later date. We will not therefore be tied to AWS.

• The decision to work with our Canadian colleagues at CIRA on the development of a new registration system is entirely separate from our intention to use the AWS public cloud.

• SIDN is a non-profit organisation. Our partnership with CIRA will enable us both to manage the rising costs of our respective registry operations, and to pool our knowledge.Use of the public cloud for our registration system is not commercially motivated.

Background

In recent years, we 've been devoting ever more time, attention and resources to our domain registration system and particularly to the supporting infrastructure, with its aging technology. That's a huge drain on our capacity, which we would prefer to use for further enhancing our core service (DNS resolving), developing knowledge, and increasing the security of the .nl domain and the wider internet. So we want to outsource the management of our generic infrastructure and more routine processes, and to make more use of generic, open-source software and open standards, in order to ensure that data security remains at the highest level, and to enable us to focus on our primary responsibility: assuring the stability, availability and security of the .nl domain.

Next steps

We'll continue our dialogue with stakeholders, including the government, regarding the considerations behind our proposal. In that context, we'll look at the results of a quick scan that the Dutch government's economics ministry will carry out with stakeholder support to establish whether any Dutch or European alternative that meets our requirements can be identified. Furthermore, any migration will ultimately depend on fulfilment of a number of criteria, including positive DPIA and DTIA findings and the availability of an exit strategy. We'll also keep the Dutch Authority for Digital Infrastructure informed about how we intend to assure compliance with the Networks and Information Systems (Security) Act. No irreversible action will be taken until the consultation process has been concluded.

Read more about the background to our proposal and the external consultants' report, including an explanation from the consultancy firm.