U.S. government can gain access to Dutch government's emails

The United States government could gain access to the emails of Dutch governments, vital companies, schools, and, to a lesser extent, healthcare institutions. That is because they outsource their mail services to American companies, mainly Microsoft and Google, NOS reports after researching the cloud use of over 20,000 companies, organizations, and governments.

Microsoft controls the most Dutch email. Six out of ten organizations have outsourced their mail services to Microsoft, including the Tweede Kamer, the Eerste Kamer, the Netherlands Authority for Financial Markets, the Dutch Healthcare Authority, the National Ombudsman, the Netherlands Environmental Assessment Agency, the Chamber of Commerce, and more than half of Dutch municipalities. The Ministries mainly maintain their own mail servers.

Although the used Microsoft and Google servers are mainly located in the Netherlands or elsewhere in the European Union, the American government can gain access to them. American legislation makes it possible for the government to view data controlled by American companies regardless of where it is housed, think tank Clingendael warns in a critical report it will publish today.

Microsoft told NOS it protects customers’ privacy and adheres to the GDPR privacy law. “The legislation to request data specifically addresses exceptional circumstances where a suspicion of a serious crime is established,” the company said, adding that it opposes such requests “where possible.”

But American companies can’t refuse to give the government access to their data, Clingendael researcher Maaike Okano-Heijmans told the broadcaster. “The fact that it has not happened so far does not say much. There are laws that require American companies to hand over data.” And laws can be changed, he added. If something sours the EU-U.S. relationship, the Netherlands’ high dependence on American services is a significant risk.

Sixty percent of the 110 vital companies NOS looked at outsourced their mail services to Microsoft or Google. That includes all power grid operators, ABN Amro, ING, Rabobank, most drinking water companies, and Schiphol Airport. NOS also looked at 3,800 large companies and found that 63 percent use cloud services from Microsoft or Google. That includes industry giants like Tata Steel, shipbuilder Damen, and engineering company Royal Haskoning.

Over half of Dutch schools use Microsoft, and 15 percent use Google. Dutch media organizations also heavily rely on American tech companies, with three-quarters of the 69 examined organizations using mail servers from Microsoft or Google. The healthcare sector is more cautious. Just over a quarter have outsourced their mail services to American companies.

Even the Dutch internet companies use Microsoft cloud services. Telecom providers KPN, Odido, and internet exchange NL-IX have their emails with Mircosoft. KPN is the most remarkable name on that list because the telecom provider also offers cloud services to business customers.