At least 1,722 websites operated by the Dutch government, public bodies and “crucial” companies such as KPN depend on at least one US cloud service, broadcaster NOS reported on Saturday, following an investigation.

Experts are concerned that US security services could access the sites and that Dutch websites could therefore be vulnerable in the event of a dispute between the two countries, NOS said.

For example, nine of the 15 government ministries use Microsoft services. All 12 provinces and all but one local authority also use US cloud services. The financial services watchdog AFM, the security council and parliament are also dependent on storage facilities in the US.

“It is a big risk, and it is not difficult for the US government to read them,” IT expert Bert Hubert told the broadcaster. “And they can search what has happened years ago.”

Under the US Cloud Act, cloud service providers can be required by law to make information available to government authorities, even if the storage is located in Europe.

The AFM told NOS it is following developments closely, while the local authorities association said the risks are “limited”. The provincial authorities association said there would be “enormous practical implications” in leaving US cloud services, but “we are, nevertheless, looking at how we can increase our digital autonomy”.

International Criminal Court

Earlier this month, it emerged that the Microsoft email account of the International Criminal Court’s chief prosecutor had been blocked as part of US sanctions policy — a move seen by some in The Hague as a clear sign that digital tools can be used for geopolitical leverage.

Barbara Kathmann, an MP for Labour and GroenLinks, warned last week that the government’s digital dependence on the US is increasingly risky. “We are completely dependent on the United States for our IT systems, and Trump is now putting pressure on us through Big Tech,” she told the AD. “He could pull the plug or raise the prices. If we do nothing, we are asking for trouble.”

Kathmann and Jesse Six Dijkstra, an MP for the centre-right NSC, have submitted a policy proposal calling on the government to overhaul its cloud strategy and prioritise European or Dutch-based alternatives. Some steps are already being taken: the tax office now uses a hybrid cloud system, partly hosted on its own private servers.

The government said in January it would explore how to reduce dependence on foreign providers, but the resulting plan will not be sent to parliament until after the summer.

Microsoft has acknowledged the risks. “A court order in the United States can apply to information held outside the US,” Microsoft vice-chairman Brad Smith told broadcaster NOS. “But we would take the matter to court.”

Microsoft has done so before, and successfully. That verdict was a direct reason for the US Congress to adopt legislation explicitly allowing the collection of information held outside the US.

There should be a treaty to regulate this, Smith said. “People have already been working on one for about ten years. If it finally comes into force, that would be a very good thing: there would be clear rules on the circumstances in which data can be requested by a foreign government, and how.”