10 ms·
Netherlands blocks US takeover of vital digital supplier
- kleiba2 5mo agoIf it's such a vital piece of Dutch infrastructure, why is it in private hands at all?
- danslo 5mo agoDigiD itself is government-owned, but its infrastructure is managed by Solvinity (a private company). Not really different from the US gov running half its stack on AWS.
- conceptme 5mo agobecause privatisation
- Nevermark 5mo agoApologies in advance for wasting anyone's time with a light hearted tangent. But as I scrolled past your comment I read: > If it's such a vital piece of infrastructure, why is it in Dutch hands at all? It was the funniest thing I have misread in a while.
- Cthulhu_ 5mo agoBecause too few IT capable people are willing to work under the government's pay scales; in most cases going private / corporate earns more. So most Dutch IT projects end up with private companies, which also means that, in the case of DigID and the secure / official messaging platform, the hosting party can charge exorbitant rates. Did you know it costs 25 cents to send a message via the Berichtenbox? So when the government does its annual "it's time to fill in your taxes" message, they have to pay millions. Assuming they don't get a bulk deal, anyway.
- Muromec 5mo agoFor the record, Logius (the government owned enterprise dealing with DigID) vacancy for Java developer: https://www.werkenvoornederland.nl/vacatures/lead-java-developer-LOG-2026-1600 https://www.werkenvoornederland.nl/vacatures/lead-java-devel... . 92k EUR per year for whatever they measure as 40 hours a week (I bet they close the shop at 4 pm). >Did you know it costs 25 cents to send a message via the Berichtenbox? In a country with paid toilets what do you expect lol
- arlcode 5mo agoThat doesn't sound bad at all. At least for me as a German that would be a salary that you wouldn't get at every random company. Maybe the Netherlands are different (country can vary a lot with what is included in a salary) ?
- Muromec 5mo agoIt's a good salary if you don't work for booking, amazon or whatever americans of the day. I got lowballed a few days ago with 85 in a startup. On the other hand this wont buy you a house in Amsterdam on one income.
- rahkiin 5mo agoThats the top level though, attainable with 10-15 years of ‘lead java dev’ experience. That is different from 10-15 years of java experience
- znnajdla 5mo agoBecause very powerful private VCs and investment bankers want to ensure that governments stay impotent when compared to their capital. Welcome to the Western world.
- deleted 5mo ago[deleted]
- SirFatty 5mo ago"US Takeover"
- deleted 5mo ago[deleted]
- vrganj 5mo agohttps://archive.ph/GbZhm https://archive.ph/GbZhm
- mcv 5mo agoFinally! The entire country has been clamouring for this for weeks, and the government has been completely silent about it. A couple of weeks ago, the entire parliament (with only a single party dissenting) voted for a motion to end the contract with Solvinity, but the government extended it anyway, leaving blocking the takeover as the only option, and there wasn't a lot of confidence that the government would do that. The whole reason for this is that Solvinity host DigiD, the Dutch e-ID system that handles authentication to all government and many other sensitive systems (healthcare). With the US law that the US government should be able to get access to any data held by a US company, regardless of where it's hosted, this system clearly should be kept out of American hands. Of course there's still plenty of sensitive data in the hands of Microsoft, Amazon and other US companies. No idea when they're going to do something about that.
- hvb2 5mo ago> A couple of weeks ago, the entire parliament (with only a single party dissenting) voted for a motion to end the contract with Solvinity, but the government extended it anyway, leaving blocking the takeover as the only option, Given what we know now, this seems perfectly logical. It's just that we don't know what else is going on behind the scenes. I'm sure there was some negotiations on how to keep the data separate or something, with the threat of blocking it altogether as a final solution. But agreed, this is a good outcome
- monegator 5mo ago> I'm sure there was some negotiations which i'm sure the current administration would honour There should be grave consequences alone for the fact that the goverment acted against the parliament
- hvb2 5mo ago> which i'm sure the current administration would honour It would've been the same administration as the one doing the negotiations, so I would assume yes. > There should be grave consequences alone for the fact that the goverment acted against the parliament In general I think there's a pretty good understanding between the legislative branch and the executive branch. The Netherlands has always had coalitions. Also, every single government will talk to the other parties. I'm not sure what country you're referring to but the Netherlands has a properly functioning democracy. The only problem it has is splintering into too many small factions making coalitions super hard
- applfanboysbgon 5mo agoGood on the Dutch government for actually doing something.
- spwa4 5mo agoAll governments are "doing something". It just isn't at all effective and mostly because they're unwilling to invest even marginal amounts. Like in this case. The technology here utterly depends on Google Play Services on Android or App Attest on Apple (or "secure enclave"), and that is in fact essentially the only functionality. This could have been solved instead switching to a standard (switching to OATH, RFC 4226 and RFC 6238), thus killing the dependency on Google/Apple while still allowing those devices to work smoothly, but also allowing a Linux implementation, allowing anyone . Plenty of European companies provide implementations for this, some with and some without the dependency on Google/Apple attestation.
- Vinnl 5mo agoI can sign in to DigID without using my phone, except sometimes with an SMS verification code. (Of course they want to, and should, phase that out. Hopefully that won't be replaced by app store dependence.)
- lxgr 5mo agoWhat alternative is there, today, that would allow securely doing this without an app store dependency? Only a few EU countries have rolled out NFC-based eID functionality (as only physical ICAO-based ID verification via NFC is a mandatory part of the EU ID card standard); those are the only ones with a viable path forward in the short term.
- jeroenhd 5mo agoThe default will likely be the app, but if you have an NFC reader you should be able to use your passport or ID to authenticate as well. The app has the benefit of being free, getting a working reader costs 60-90 euros last time I checked and Linux driver support isn't great.
- mkj 5mo agoSolvinity is a pretty terrible company name.
- cactusplant7374 5mo agoSolvinity = Solvent Divinity
- TacticalCoder 5mo ago> Solvinity is a pretty terrible company name. I find it okay'ish. At least it's unique. Say, as much as I like Mario Zechner (who doesn't like HNers anymore for whatever reason), naming your product "Pi" is just terribly bad. Facebook was a good name (hate the company but the name was good). But "Meta" is just dumbfucktarded. Wait... I've got an idea: I'm going to make a product and name it "Alt". Or "Control". Really: there are a lot of totally unhelpful name that just confuses everybody, including search engines, humans, and LLMs but I don't think "Solvinity" is that bad.
- agmater 5mo agoI've always found Whatsapp a terrible name, but its so established now that 'apping' is understood. If you're big enough it seems that a bad name hardly hold you back.
- amelius 5mo agoReminds me of the old joke: After Bill and Melinda Gates have their honeymoon, Melinda says, "Now I know why you call it Microsoft."
- arrowsmith 5mo ago"To whatsapp" is a common verb, but I have never heard anyone say "apping". Where do you live where "apping" is understood?
- JSR_FDED 5mo agoHeard it many times in the Netherlands.
- sjamaan 5mo agoBest news of the year!
- fusslo 5mo agoNever heard of 'Kyndryl' before. https://en.wikipedia.org/wiki/Kyndryl https://en.wikipedia.org/wiki/Kyndryl > Officially formed in late 2021, Kyndryl was created from the spin-off of IBM's infrastructure services > Kyndryl operated in 63 countries in November 2021
- Cthulhu_ 5mo agoI wish more news outlets actually stated so - Kyndryl was formerly IBM, has 73.000 employees worldwide. When this news first broke, nobody had ever heard of it so it sounded like some small random hosting company, but it's huge.
- pantulis 5mo agoNobody gets fired from hiring Kyndryl.
- frevib 5mo agoThey’re not doing too great atm: https://www.msn.com/en-us/money/topstocks/kyndryl-s-stock-is-tumbling-more-than-50-here-s-what-s-gone-wrong-at-the-it-provider/ar-AA1VZn3T https://www.msn.com/en-us/money/topstocks/kyndryl-s-stock-is...
- pantulis 5mo agoAs are all consulting firms, to ve fair
- petcat 5mo agoGood for them, but I doubt this will be the last we hear about this especially with the current US government. ASML was only permitted to acquire US company Cymer (the actually valuable EUV light source technology) back in 2013 under a strict technology sharing and export control agreement. The Netherlands blocking a US acquisition due to technology control concerns is sure to ruffle some feathers in Washington.
- NietTim 5mo agoThis is not some sort of company making unique tech, it's a company handling some of the most the vital infrastructure for our government, you can imagine the privacy concerns. Completely different case
- petcat 5mo agoSure, but the point is that it's tit-for-tat. This US administration is petty.
- Epskampie 5mo agoAll the more reason to block vital stuff going to the US. They cannot be trusted anymore.
- Paradigma11 5mo agoTrue, but the question is if it isn't smarter to wait for the midterms in November where it currently looks like it's going to be a disaster for Trump and the Republicans.
- ragebol 5mo agoSale was happening soon, couldn't wait longer, IIUC.
- exceptione 5mo agoTrue. But the reaction also depends on how much money the leverage is worth and how much Solvinity has to offer here.
- midasz 5mo agoGreat news. Would have been devastating to have such an integral part of our society at the whims of not just another nation, but an unstable and downright hostile one.
- ndsipa_pomu 5mo agoUnfortunately, they're still heavily dependent on Microsoft products and OS
- thisislife2 5mo agoThe Dutch should be aware that if Netherland has some information-sharing agreements with Five Eyes or Fourteen Eyes, all this data will still be available to the US (and other allies) (hopefully, presumably, with your government acting as the gatekeeper).
- Deukhoofd 5mo agoThe issue was less privacy concerns, and more "hey lets not hand over one of the most critical pieces of infrastructure to a potentially hostile state". DigID is the user authentication platform for basically every government site in The Netherlands. A foreign government could use sanctions to pressure Dutch individuals to comply by limiting access to it.
- troad 5mo agoMore broadly, I think it's "let's not hand over essential infrastructure to any foreign state". Friendly or not, it doesn't matter. Private companies ought to have the freedom to do business with whomever they like, but for essential public services, better to assume essential public infrastructure simply must not be offshored at all.
- Deukhoofd 5mo agoI don't know about that. I don't think it'd have been a major issue in the country if it were a Belgian or German takeover. It may still not have been desirable, but I doubt the government would have stepped in like they did here.
- WJW 5mo agoIt's not only about the data, it's about the risk that the US would basically turn off things like tax collection and doctors' visits in the Netherlands as part of (say) a first strike on Greenland. Sure, the chance is low. But in the current climate people are nervous and it's best not to risk it. The current government has already embarked on a long-term strategy to bring more of critical software infrastructure back in-country, selling the core identity provider software abroad would go directly against current policy.
- selectively 5mo ago[flagged]
- creaturemachine 5mo agoBy that we mean, send a whitehouse crony over to throw a temper tantrum on Dutch soil.
- Muromec 5mo agoSomething something, a free ticket to Den Haag
- _HMCB_ 5mo agoOne word: good.
- carlosjobim 5mo agoHow come the Dutch people aren't offering more than the US investors to purchase this company, since this seems to be so close at heart?
- deleted 5mo ago[deleted]
- raziel2p 5mo agomaybe how much money you are willing to spend isn't a perfect measure of how important something is?
- carlosjobim 5mo agoIt is just about the only measure. People who claim something is extremely important and then will not take any action or spend any money - they're dishonest people. Let's see if the Dutch are men of their words. I expect the government to offer to buy this company, or an offering being made for the Dutch investing public to get shares.
- vrganj 5mo agoIs water less important to the poor person dying of thirst than to the rich guy watering his lawn?
- carlosjobim 5mo agoThe question is rather: Why would a person complain about dying of thirst, but refuse to go to the river to drink, and also refuse to pay for a glass of water. That makes me believe he is dishonest when he's saying he is thirsty. Or are we pretending that the Dutch people don't have any money between them to make an offer on this company?
- vrganj 5mo agoWe're just establishing that what one can pay is in fact not the only measure, disproving your universal assertion by counterexample. Regarding the specific case, they probably have the money. But they don't need it. Such is the beauty of regulatory power, vested in a democracy.
- stego-tech 5mo agoI keep seeing variations of “okay but this will be temporary” or “this is a one off” or “they’ll relent eventually, they have no choice” in response to the EU’s (and to a lesser extent, global) divorce from US tech stacks. You cannot unring this bell, however, nor can you put the genie back in the bottle, close Pandora’s Box, etc, pick your own metaphor. The US burned through the trust thermocline very suddenly these past few years, snapping the tension that had been brewing over several decades from US hegemony and the abusive diplomacy it created. Now that the US regime is openly hostile to everyone else and US firms have dropped the pretense of being anything less than a global surveillance state, there’s nothing to go back to. These sorts of rejections and blocks will continue to escalate until a new norm is agreed upon by cooler heads, which I don’t see happening in the current climate. Make no mistake, power everywhere wants more surveillance capabilities; the EU wants it as much as China or the USA. The difference is that with the leading empire in decline, everyone realizes that owning their own surveillance state is an advantage over outsourcing it to a potential enemy.
- hunglee2 5mo agoShould be simple matter to escalate this up to the President, who will put the squeeze on the Dutch government, and then secure his 10% fee for rescuing the take over deal
- gyanchawdhary 5mo agoThe subtitle “Across Europe, there have been increased concerns about the bloc’s reliance on American tech.” is false and really an economic chamber. The author has no basis for this claim, factually or otherwise .. maybe a small tiny group would love to see this happen, but EU is happy like rest of the world minus China to enjoy the products made by great American software companies.
- Tepix 5mo agoAre you serious? You did notice that there was even a EU digital sovereignty summit recently?
- gyanchawdhary 5mo agoI didn’t notice. But regardless, a summit doesn't dictate or reflect the desires and opinions of 27 member states and its 450 million citizens and more importantly its companies and business to want to switch to European alternatives. To give you an example, if India or China or Africa holds a summit on climate change, it doesn’t mean that its citizens want that or even care about it. Anyway, the idea that such a big geography should move away from the best software factory of the world because it has some political agenda with its current leader is both impossible and overall quite childish and will never come to fruition.
- Tepix 5mo agoIt would be foolish to continue to rely on them given a leader who has openly expressed his very negative views about Europe and who likes extorting countries.
- gbear605 5mo agoTwo thirds of Europeans want this - https://www.techpolicy.press/almost-two-thirds-of-europeans-back-replacing-us-tech-poll-finds/ https://www.techpolicy.press/almost-two-thirds-of-europeans-... > The figures were almost universal across all categories: 62 percent of those surveyed across the five European countries said they favored or had considered replacing US data storage and payment services, while 59 percent of respondents said they would back a change from American video-conferencing companies like Zoom. (Technically only five countries in the EU in this survey, but the five most populous countries, and presumably other countries generally agree)
- dncornholio 5mo agoThis is a direct result of Trump being in power. Before his regime, we (The Netherlands) trusted USA 1000%, this takeover would not even have been news. This stance has shifted completely. And you can thank one guy for it.
- wildekek 5mo agoAs a Dutch citizen, I don't understand why we can't self-host an open source identity solution for 20M users with 30K requests an hour. How hard can it be?
- dncornholio 5mo ago30k requests and hour? A 5 euro VPS can handle this easily.
- Muromec 5mo agoHow hard can it be to hire a competent engineer when you hire for a bank or a government.
- thephyber 5mo agoTechs trying to solve the tech problem. Governments need it to be solved by a team (either within the government or a vendor company) because it is the non-tech things that are missing from the open source solution: high availability / redundancy, hosting, backups, business continuity, audits, someone to grill when there is a leak. The people who work in government and banks aren’t incompetent. They are just like you and I but they work within a highly rigid system because if their system isn’t rigid, societies fall. People don’t think rationally during bank runs or when nobody in a country can access public services for weeks at a time. This is the core hazard of Mr. Robot.
- flossly 5mo ago> Vital digital supplier. They make the login-screen. And now for businesses there are like 5 providers of the login screen (that you HAVE to use in order to use govt websites): you have to choose one and pay like 40EUR/y in order to log in. Calling a login screen vital is, yes, the truth. Out-sourcing --and creating a market for-- the login screen is, to me, one of the most bizarre thing I've seen the Dutch govt do in recent years.
- flossly 5mo agoOh, and if you out-source it, then I do not thing you should have a say in whom the contract. Either keep it in house, or out-source. They contracted the market and now they want to control it as if it's in house.
- locknitpicker 5mo agoFrom the article: > Kyndryl said in a statement it was "extremely disappointed" about the decision. "The politicization of this process has overshadowed the clear and important benefits this transaction would have brought to Solvinity's customers and Dutch citizens." Are these guys so tone-death to the point they even try to gaslight the world? They are trying to take over a nation's ID system. Who in their right mind sees this as anything other than a national security issue?
- markvdb 5mo agoAs per the Dutch language saying: "Trust comes on foot, but leaves on horseback." Trust breakdowns are costly, except to the vultures "winning" the negative-sum game. Might want to read about the fall of the Warsaw pact.
- benced 5mo agoThe concerning thing for the EU should be that this valuable firm had no European capital trying to buy it. The Dutch have protected their sovereignty today while decreasing the incentive for the next entrepreneur to make something on European shores. Probably the best choice but doesn't change the structural problem.
- vanviegen 5mo agoWho knows what other offers they may have had? Perhaps the company is just worth more to a non-EU company because of the leverage controlling vital infrastructure would give them.
- znnajdla 5mo agoConcerning for you, perhaps. I take the opposite lesson: this incentivizes and invites the exact kind of entrepreneurs you want to have in a country. You profit-driven Americans assume that all entrepreneurs build things to maximize profit at the expense of everything else. No, not everyone is driven by that, and many of the best company builders were not primarily profit driven (e.g. Steve Jobs believed in beauty and excellence). There are plenty of entrepreneurs who want to build things to support the sovereignty and livelihood of the places that they live in while making a profit that doesn’t jeopardize that. I say, blocking foreign takeover of vital companies would actually incentivize me as an entrepreneur to choose the EU, and I say that as a startup founder in Europe. Because it levels the playing field for founders who believe in sovereignty: now I don’t have to worry about competitors selling out to foreign capital doing better than me due to that.
- benced 5mo agoIt is very true that if your company is a political vehicle, having the powers that be enforce that all companies must be political vehicles is quite good for you. America certainly has its version of this in its defense companies. I would not say those are the American companies that make me most proud to be American though.
- x0x0 5mo ago> Probably the best choice but doesn't change the structural problem. The structural problem is that we are destroying trading relationships built with Europe over generations.
- bilekas 5mo ago> "The politicization of this process has overshadowed the clear and important benefits this transaction would have brought to Solvinity's customers and Dutch citizens." That is unbelievably rich. It's politicians job to protect the privacy and interests of its citizens. Must be a strange idea for the US these days.
- ykurtov 5mo agoThis comment gets my personal "The most logical position of the day" award
- burnerRhodov3 5mo ago> It's politicians job to protect the privacy and interests of its citizens. So...they outsource to Logius, who then hires Solvinity to give two for-profit corps access to your information? Why are the blocking the acquisition entirely and not... ya know, hosting their own infrastructure?
- bilekas 5mo ago> hosting their own infrastructure? Because they're not a tech company and they're aware of that so they place bidding contractors to specialists in the field who offer a proposal and bid. This is nothing new.
- FaridIO 5mo agoThat's a very optimistic view. They care about getting elected, and enough tech-savvy people in the country made a big enough stink about it a critical mass of "normal people" got pissed. If they cared about privacy this whole thing wouldn't have been possible in the first place.
- port11 5mo agoI think they should point out the “clear and important benefits” they’d bring. Corporate PR is fucking hollow.
- deleted 5mo ago[deleted]
- iamalizard 5mo agoCan someone tell me what actual technical issue do identification providers solve that couldn't be solved with a public key cryptography or even a password and 2FA? The whole sector seems like it was created out of corruption and shortsightedness.
- jauco 5mo agoYou want an idp who verified that the account belongs to a specific citizen. There needs to be some loop closing between your bsn (akin to a social security number) and user accounts. That in itself is not something you can just handoff to auth0 or that you want different departments to self select and self-host. Digid is used to submit taxes and for getting benefits from the government.
- Muromec 5mo agoDigId is used to log into systems that one uses to submit taxes and claim benefits.
- Muromec 5mo agoThey don't solve the technical issue, that's the thing. Once you can match the public key to a legal person with their tax number, it's more or less a weekend of coding to get 80% there. But to get there you first need to have access to the government API giving you information about a person with certain tax number (name, DOB, address) so you can send them a letter with the code, for which you likely need to be inside their security perimeter. Then you have to actually send the code and have the app generate the key. Then sure, you can expose oauth2 provider and authenticate user with an HOTP you enrolled after they entered the binding key from mail. That's about the whole thing if you don't count bells and whistles. Bells and whistles include: - talking to the physical id card so you can mark the key as high trust; - keeping the session open so second login during 15 minutes would be confirmed with one tap in the app; - backup authentication method with sms-otp; - all the nasty stuff that happens with fraud and blocking access but you can't just block the customer and tell them to go somewhere else; - antidebugging and obfuscation nonsence in mobile apps because CyBErsEcUritTy (second level scam); - fancy paper to print one time codes that come by mail (not sure DigID does this, but banks do)
- madbo1 5mo agoThis is exactly why privacy by architecture matters more than privacy by policy. The Netherlands trusted a policy ("Solvinity can't access the data") but the architecture allowed it anyway. The only real solution is cryptographic sovereignty systems where even the vendor mathematically cannot access user data, regardless of what US law says. Not we promise we won't look but we literally cannot look. Building something small in this direction a mesh network where identity is a BIP-39 seed phrase and messages are E2E encrypted at the protocol level,not the application level. The goal is that even I as the developer cannot read user messages. It's still early, but this problem you're describing is exactly why it needs to exist.
- davedx 5mo ago> The only real solution is cryptographic sovereignty systems where even the vendor mathematically cannot access user data, regardless of what US law says. ...OR, we host our data in our own countries with companies incorporated in our countries. (Sovereign cloud)
- jkl5xx 5mo agoThis misses the point that parent was making. The conversation shouldn’t be “move your data to countries you can trust”. It should be “use protocols that don’t require trust in the first place”.
- rolandog 5mo agoI think both ideas should be the norm: privacy by architecture and sovereignty and/or decentralization where it makes sense.
- thephyber 5mo ago> identity is a BIP-39 seed phrase So we are back to a single “something you know” factor as identity? There’s a reason your idea doesn’t exist.
- throawayonthe 5mo agojohnny will suddenly be able to encrypt
- Animats 5mo agoOh, Solvinity / DigiD. From the title, it sounded like someone had bought ASML.
- Halian 5mo agoDoes anyone have a version that doesn't start with an unskippable full-page advertisement?
- mahirsaid 5mo agoWe will see this trend of blocking US ownership more often. Any government cannot and should not give access to their own government, citizen data to foreign buyers no matter how good the relationship is. Beside the point, this is drawing clearer picture of US control: losing. Us is seen as a threat and coercion making practices start with owning data using that as control.
- thephyber 5mo agoYou seem to be assuming citizen data was being transferred. Do you have evidence of that?
- ninth_ant 5mo agoBy law the US govt is able to compel access to any data controlled by an American company, regardless of where those companies operate. There doesn’t need to be specific evidence of this case, it’s true of all cases. Some American companies have tried to establish convoluted workarounds in Europe to get around this, but as far as I’m aware it hasn’t been tested in court yet.
- mahirsaid 5mo agoThat was the info of individuals = citizen's data. Am I wrong? What would be considered "citizen data" just to be clear?
- EchoReflection 5mo agohttps://web.archive.org/web/20260526123110/https://www.politico.eu/article/netherlands-blocks-us-takeover-vital-digital-supplier/# https://web.archive.org/web/20260526123110/https://www.polit...
- grunkolsky 5mo ago[dead]
- h4kunamata 5mo ago[flagged]
- 6510 5mo agoFrom what I gather it is hard to hire the highest level developers because they hate the endless meetings, bureaucracy and micromanagment. Salaries are comparable to industry which seems quite high for dutch standards but if you make education hard and expensive with unreasonable time constraints and little adjustment to demand you are just going to end up enforcing scarcity which calls for even higher salaries. We also continue to suffer from managerialism. It makes it strange to pay someone building stuff more than someone managing them.