NOS: most Dutch governments outsource mail management to Microsoft

The majority of Dutch government services and infrastructure have outsourced their email management to large American tech companies, according to research by NOS. This research focused on the MX records of more than 20,000 institutions in the Netherlands.

At only a quarter of the institutions surveyed, the management of e-mail is not in the hands of Microsoft or Google, NOS writes. This examined the DNS records of 21,670 Dutch government institutions and independent administrative bodies, such as the Chamber of Commerce and the Netherlands Authority for the Financial Markets. NOS also looked at 3,800 large companies, such as ASML, Damen and Royal Haskoning, and 110 companies that are considered vital infrastructure, such as banks and energy suppliers. The NOS specifically looked for MX records to see how email traffic was organized.

The broadcaster concludes that more than 66 percent of institutions do not manage their email services themselves, but place them with Microsoft. In another 10 percent of cases, companies use Google services. In 17 percent of the services, email use is part of a Dutch service and in 7 percent of cases the institutions manage their email themselves.

In large companies, the percentage of Microsoft or Google users is 63 percent. For vital companies this is 60 percent.

Although the NOS only looked at mail records, there is a good chance that these companies have accommodated their entire internal workspaces with American companies. These companies often purchase a package such as Microsoft Office or Google Workspace, which also includes communication channels and office software. It is not clear whether this is also the case here.

However, outsourcing to international cloud providers does not automatically mean that there are privacy risks for companies. In 2020, the Dutch government commissioned research into the use of cloud services in the government. This revealed a number of points for improvement, which have now been implemented by Microsoft and Google.

Nevertheless, experts warn about the risks that the Netherlands still faces. For example, there may be changes in the law. The Clingendael institute, among others, recommends in a report that European sovereignty be safeguarded in the cloud field.