A New Collaborative Model for the National Crypto Strategy

Dutch encryption companies are set to develop a new collaborative model aimed at working together with the Dutch government, the AIVD, and the Ministry of Defence, to secure the Netherlands' position as a sovereign producer of cryptographic technologies. A stable Dutch market for the development of cryptographic products—capable of securing State secrets—is essential.

A mutual dependency has developed between the State and a small group of high-assurance cryptography companies. These firms often count the State among their largest clients. Currently, tenders — sometimes confidential — are issued for both development work and the procurement of specific products and services, complete with detailed requirements. The AIVD’s Defense and Resilience Unit plays a central role in this process: it commissions assignments and is also responsible for evaluating the resulting products.

However, the current model of cooperation has significant limitations and does not provide the State with sufficient control or supply assurance. On one hand, market-developed products are not always accessible to the State, requiring custom development projects to fill the gaps. On the other hand, the project-based approach offers industry partners little continuity or long-term certainty.

Obstacles within the current collaboration

Unfortunately, there are several obstacles to the current collaboration, such as:

• Complex business cases: For several parties, the Dutch government is one of their most important consumers, necessitating assurance about their development and manufacturing capability. The complex business case heightens the risk of international acquisitions.

• Market failure during tendering: Due to high technical requirements, there are high entry costs. Businesses must adhere to stringent standards, such as having highly qualified staff and ABDO-certified facilities.

• Uncertainty due to disconnected assignments: Because development, product, and maintenance contracts are not interconnected, businesses do not have enough long-term security. For businesses, this leads to financial uncertainty.

• Vague roadmaps: The roadmaps issued by the government do not include enough information about long-term requirements. Future demand cannot be sufficiently predicted by the industry.

Collaborative Business Models

Collaborative Business Models (CBMs) focus on joint value creation within a multi-stakeholder context, embedded in an ecosystem. They centre on cooperation, the sharing of resources, knowledge, and expertise, to generate greater collective value than any individual organisation could achieve on its own. Both the State and industry share responsibility for ensuring the digital autonomy and sovereignty of the Netherlands. Participation in the collaborative model implies an acceptance of that shared responsibility.

The shift from transactional interactions to deep, long-term relationships lies at the heart of a successful collaborative business model. Unlike short-term exchanges, this model embraces enduring, multi-year commitments between the parties involved.

Roadmap towards stronger collaboration

Step 1: Tendering with Transparency and Input: The State provides trusted industry partners with access to its technology roadmaps under specific conditions. This enables these companies to align their roadmaps with those of the State and to contribute input on upcoming developments.

Step 2: Strategic Partnerships: Existing Strategic Partnerships can be expanded — both by establishing new strategic relationships with a select number of companies and by ensuring alignment with the civil demand for high-assurance (HA) cryptographic products.

Step 3: Public-Private Ecosystem of State and Industry: A public-private HA crypto ecosystem will be established, consisting of multiple "tiers" (Strategic partners at the core, an inner ring of preferred suppliers, and an outer ring of potential new entrants).

This growth model towards deeper collaboration provides a pathway to the ultimate goal: cooperation within an ecosystem structure. Each of these steps represents a distinct collaboration model, each with its advantages and disadvantages.

Recommendations

A public-private high-assurance (HA) crypto ecosystem provides the guarantees necessary for the long-term supply security of Dutch cryptographic products for the State. It also offers companies the certainty and stability required to further invest in their development and production capacities. Within this ecosystem, State entities—specifically the Government CIO, the AIVD (uWBH), and the Ministry of Defence—collaborate intensively and actively with industry partners based on trust and maximum transparency, working together to safeguard the digital autonomy and sovereignty of our country in the field of HA cryptography.

Furthermore, identify which parties currently qualify as preferred suppliers of products and services, and initiate discussions with them regarding, for example, framework agreements that provide certain guarantees from the State in exchange for transparency from the industry.

It is also important to explore the extent to which it is possible to provide the industry, in the short term, with a degree of insight and perhaps input into the existing roadmaps. The successful establishment of an ecosystem depends on these parties being able to retain the necessary personnel capacity and capabilities.

An ecosystem such as the one outlined in this report cannot be developed in a matter of days, weeks, or even months. Experience shows that establishing and refining a robust ecosystem requires a joint effort to find the right approach for aligning needs and interests, and, quite literally, learning to speak each other’s language. Both the State and industry acknowledge the necessity of increased collaboration and have indicated their willingness to make compromises in the short term in favour of shared benefits over the longer term.

Source: Security.nl & Dutch IT Leaders

Photo credits: iStock/oatawa