I'm Lokke Moerel, professor of Global ICT law in Tilburg.
I'm an attorney with international law firm Morrison & Foerster,
and I'm a Cyber Security Council member representing the sciences.
I'm Gerrit van der Burg, Chair of the Board of Public Prosecutors.
I'm a member of the Cyber Security Council representing the public sector.
The Netherlands is one of the world’s most digital countries.
That was very clear during the Covid-19 pandemic, we all switched to working from home in no time.
And I think everyone can agree that it’s created new dependencies and vulnerabilities.
And the CSC's advice is focused on the fact that our digital dependencies have grown so much…
that our national digital sovereignty is in jeopardy.
But for us, the real question is how, in the digital world, can the Netherlands…
maintain control of essential ecosystems and democratic processes.
Of course digital infrastructure is key, for our economy, for us as citizens,
and even for the democratic legal system.
That's why our digital infrastructure has to be protected, we have to maintain control of it.
And have autonomy around the safety of our digital infrastructure.
A few examples. If we don't keep innovating our critical technologies,
it will continue to endanger our sovereignty.
Take artificial intelligence. AI facilitates cyber attacks.
Criminals can use AI to automatically identify and exploit online vulnerabilities.
But AI also allows us to automatically trace and repair vulnerabilities.
An example within our democratic process is the election process.
If the state doesn't have control of it because the election process has been infiltrated…
and manipulated by foreign powers, that puts our digital sovereignty in jeopardy.
Professionally, as a public prosecutor, autonomy is crucial.
We have to act independently in cases.
That means that when it comes to dependencies, dependencies on organisations and companies…
put the professionalism of our occupation at risk.
We need protection.
The same issue comes up when it comes to the control that countries can and must have…
over digital infrastructure.
So they're very comparable, and Public Prosecutors experience that every day,
particularly when it comes to online criminal activity.
A specific example from my work is that when governmental institutions switch to the cloud,
they are very concerned with transfer regulations under GDPR.
But we've seen that the issue is much broader than access to data.
It's really about our entire economic ecosystem.
One example is that you need a ton of processing power for AI data analysis.
Which means you need the cloud.
So the cloud infrastructure is essential to innovation and future earning potential.
Keeping control of that is a vital part of our digital autonomy.
We're issuing these recommendations because...
digital sovereignty isn't being sufficiently addressed…
on the political agenda in the Netherlands.
We approach cyber security primarily from the technical, reactive perspective,
and not from the perspective of strategic autonomy.
Europe is at the forefront here. Europe feels the pressure of what we call tech colonialism,
and regaining our digital sovereignty has become a core ambition within Europe.
With our recommendations, the Council hopes to make this a top priority.
The safety of our digital infrastructure has to reach the boardroom.
It has to be the first question asked around innovation developments.
It has to be part of legislation that can set standards for things like party dependence.
We have to focus on cloud protection.
Essentially, we have to focus on protecting our vital elements.
A better understanding that cyber security isn't just about securing IT systems,
you have to see cyber security from a broader perspective,
digital sovereignty.
And that doesn't mean we have to do everything ourselves.
As a country, we can't, and that's certainly not what we want.
As a country, we have to know what our current and future critical technologies are,
what kind of infrastructure does it require, and where are our unilateral dependencies?
And which elements are we going to concentrate on?
The ones that complement what we're doing well, fit into our major industries,
and above all, align with the European innovation agenda,
where we can take advantage of EU financing.
So our goal is to motivate the government to create a proactive national strategy…
for digital autonomy.
The Council has identified several priorities.
First of all, the cloud. The cloud has to be secure.
We need to have control of it, so we need standards...
to be able to actually maintain that control and security.
The second key point is our digital communication.
Security needs to be continuously optimised here, too.
And third, the cryptology issue. How are we going to apply encryption in the future?
How can we continue to encrypt safely while keeping others out.
Those are important key points.
And the Cyber Security Council has developed a system of standards…
to develop behavioural standards that give directors and leaders the opportunity…
to check whether innovations in development meet and can continue to meet safety standards.