State-owned Dutch railway company NS is going to contract out a large part of its automation processes to a US computer services company, placing the management of crucial Dutch infrastructure in American hands, the NRC reported on Tuesday.

The move comes at a time when European governments and industry are striving for digital autonomy from the US. Until recently, KPN was responsible for the bulk of NS’s hosting, technical applications and monitoring.

Experts told the paper that NS is naïve to make such a move, particularly given current geopolitical tensions.

The agreement, worth €400 million, will run for at least six and possibly up to 12 years. Confidential documents seen by the NRC show that the US provider DXC Technology made the cheapest offer but did not score best in terms of quality.

The biggest risk to NS if the move goes ahead is US sanctions law, ICT law professor Lokke Moerel told the NRC. The US can sanction companies, organisations and individuals in “the interests of national security” and has already taken action against International Criminal Court judges.

An NS spokesman told the paper the company is well aware that DXC is part of an American company. However, the systems the company will manage are “not mission critical” and do not involve processing personnel or passengers’ information, he said. Those systems are hosted by Dutch firms.

Moerel said NS is ignoring the fact that hosting services are part of the critical infrastructure. “If everyone acts like NS, we will never build our own digital infrastructure,” she said.

The NS’ IT chief Hessel Dikkers said later that if the systems DXC is to manage shut down “trains will not come to a standstill”.

He also said that the NS has to comply with the law and is not allowed to refuse a tender from a US firm just because they are American.

Cloud services

At the end of last year it emerged that Solvinity, which provides cloud services for the Dutch government’s DigiD identity system as well as the justice ministry, is being sold to an American company.

Under the US Cloud Act, cloud service providers can be required by law to make information available to government authorities, even if the data are stored in Europe.

The new Dutch government has stressed the need for digital autonomy in its coalition agreement.