An “extremely disappointed” Kyndryl has been blocked by the Dutch government in its pursuit of taking over Dutch IT provider Solvinity. A “politicization” of the process surrounding the acquisition is said to have thrown a wrench in the works. DigiD, the digital identification system Dutch citizens use for managing their affairs with the state, risked being taken over by a foreign entity. In the process, an American company has found itself in the same hot seat as counterparts in Russia and China. What are the lessons from the Solvinity controversy? And has the Netherlands gotten what it wanted: full control—and thus sovereignty—over its own digital crown jewels?
Independent IT expert Michiel Steltman told Techzine that the blocking of Kyndryl’s proposed acquisition of cloud provider Solvinity has been received positively. “I fully understand the motivation to keep DigiD management with a wholly Dutch company. At the same time, the story raises questions for me.” He is not alone. Tech luminary Bert Hubert, for instance, emphasizes that the Unwanted Control in Telecommunications Act (WOZT), cited by the nation’s Investment Assessment Bureau (BTI) in its recommendation to block the takeover, is based on “difficult-to-define” issues such as public interest, public order, or public safety. Specifically, the BTI expressed concerns about the potential use of the CLOUD Act and FISA to access DigiD data via Solvinity.
The Dutch, like many Europeans, have become painfully aware of their digital dependence on the United States. In years prior to Trump’s re-election, only Russia, China and various pariah states were seen as no-go partners in sensitive governmental areas. Now, long-established U.S. laws are perceived as threats to European sovereignty, with the specific risk of losing access or control over critical data and applications. Solvinity and Kyndryl have found themselves amidst a roiling debate over digital autonomy, resulting in an unprecedented blockade of a U.S. takeover.
Mixed Signals
Willemijn Aerdts, the Dutch State Secretary for the Digital Economy and Sovereignty, addressed the BTI’s recommendation to block the acquisition. Steltman speaks of “contradictory signals regarding the risk assessment.” Previously, government officials and public agencies had actually been relatively positive about the Solvinity deal. “For example, [governmental IT provider] Logius, followed by Minister Van der Burg of the Interior, recently indicated that the risk of U.S. intervention in DigiD was considered acceptable.” Steltman sees “little consistency” in this policy.
The Netherlands Authority for Consumers and Markets (ACM) issued a positive opinion in February regarding the acquisition of Solvinity, though this was limited to the areas of market functioning and competition. After all, that is the ACM’s purview. It is not surprising that the BTI reached a different conclusion, as it applied different criteria. Nevertheless, the series of signals mentioned by Steltman is certainly difficult to follow. It would not surprise us if this cabinet were to remain quieter on the next issue concerning sovereignty until it issues a ruling.
The public reaction was clearer, though it was not directly cited as Aerdts’ motivation for imposing a ban at this stage. 200,000 citizens signed a petition against the takeover. Initially, the announcement of the Solvinity takeover elicited little public reaction. Admittedly, we too did not initially realize that a row was brewing. But summary proceedings and a lawsuit against the Dutch State followed, alongside massive negative sentiment about the deal in the public debate. The court ruled this month that the Netherlands was permitted to extend the DigiD contract with Solvinity to ensure the continuity of service. A transition, whenever it might occur, would take months in any case. Another case, filed by media platform and Follow the Money affiliate The Firewall, has been withdrawn now that the acquisition has been blocked.
Simon Besteman, director of the Dutch Cloud Community, tells us that his organization is pleased with the decision to block the deal. “With the sale, our country would have allowed access to the core tasks and data used to govern the Netherlands to fall into non-European hands. We shared the concern that many in society had for our national security and independence.”
Dutch Cloud Community, a point of contact and community of more than a hundred cloud companies active in the Netherlands, has “full confidence in hosting important services such as DigiD within the Dutch cloud ecosystem,” according to Besteman.
Loss of control and oversight
DigiD management appears to be secured for the time being. A Dutch provider will continue to provide this crucial digital service, even if it is not Solvinity. But Steltman wonders what would have happened if Solvinity had not been the administrator of DigiD. “Is this rather heavy-handed instrument of market intervention really being deployed here because of broader national interests, or mainly because of this one specific case? It seems difficult to me to justify intervening with one hat on against a provider because, with your other hat on, you find it difficult to switch to another provider due to public pressure.”
Non-European investors, particularly American ones, can often dig deeper into their pockets. For acquisitions, this is not only a competitive advantage over European parties but is naturally attractive to the target company. Solvinity found the most lucrative option in Kyndryl. “Potential investors with non-European capital in their structure will think twice before even considering parties with a customer portfolio in the public sector,” Steltman tells us. “You never know how that will end if the press gets wind of it.”
Pieter van Oordt, Chief Privacy Officer at Logius and now known as the DigiD whistleblower, was suspended as a civil servant. We have asked him whether he has since been reinstated to his position and will update this post once we have clarity on that. Van Oordt did mention on LinkedIn that the cabinet followed “80 percent of my guidance.” However, that remaining 20 percent encompasses “the oversight and control over the follow-up,” he states. “What didn’t we do? We didn’t sit down with all parties. Can everyone walk away with their heads held high? No.”
Conclusion: an uncomfortable path to maturity
The road to the Kyndryl blockade was full of detours. Experts point out that the communication, the reasoning, and the timing could have been better. Nevertheless, everyone except Kyndryl and the U.S. Embassy is at least neutral and largely positive about the final outcome. The question is whether a similar public uproar would have arisen if the proposed acquisition of the DigiD administrator had taken place years ago. Sovereignty has since become a familiar topic in public debate. For a long time, it had been unthinkable to block a legitimate U.S. company. In fact, the now-infamous 2017 acquisition of former NXP component Nexperia by Chinese investors (later Wingtech) only sparked widespread controversy in the past year.
Admittedly, Solvinity and Nexperia have little to do with each other. But the public reaction is, as Steltman rightly concludes, a potentially limiting factor for any foreign buyer of companies that play a critical role in the public sector. Without wishing to downplay Solvinity’s expertise, we can conclude that DigiD management can remain in Dutch hands just fine. That is not the problem either. However, this saga highlights many sore spots. On all sorts of fronts, there is a lack of clarity, consistency, and thus predictability surrounding this issue. Sovereignty must crystallize into a definable factor and, in one way or another, be explainable to potential investors. There are always borderline cases, which is why it is good that the BTI, the ACM, and the government can act according to context. Steltman: “I wonder if blocking this acquisition will really improve the situation. I mainly see it as a political gesture. But I would rather see a government that visibly and seriously invests in a strong Dutch market by doing business with smaller Dutch parties.”
Also read: The Netherlands blocks Kyndryl’s acquisition of Solvinity