Reaction of the University CIOs to the open letter "Moving to the Cloud, look before you leap".

SURF has read ACCSS's open letter with interest. We share the concerns expressed. SURF has been discussing this with its members for some time and has taken action in various ways. In response to the letter from ACCSS, there is good contact with the authors. We are happy to work together to address the concerns and determine the strategy of institutions within SURF.

The letter below from the university CIOs, united in SURF's CSC-wo, gives further substance to this;

The ACCSS initiative of Dutch cybersecurity professors recently published an open letter titled "Switching to the Cloud, look before you leap."  The cybersecurity professors are not against the use of cloud technology or products from large companies such as Microsoft, Google or Elsevier, but have major concerns about the increasing influence of BigTech companies on education and research within Dutch universities. The CIOs of all Dutch universities share these concerns. They are working jointly, with SURF as well as in their own universities, on implementations with a focus on public values and data autonomy. The public values are broader than cyber security; they include purchasing conditions, architecture and open standards. The CIOs also argue, together with university chancellors and principals, for improved legislation and regulations at national and European level.

Within the sector, these concerns are addressed among other things by concluding sector-specific contracts with large (cloud) providers such as Microsoft, where extra attention is paid to data storage locations in Europe, agreements in the field of privacy in accordance with GDPR and the possibility of switching to alternatives based on the existence of exit strategies. The CIOs are seeking to work together via SURF and are linking up with initiatives from the central government.

The focus on public values extends beyond IT; this has led to discussions about giving public values a place in selection and procurement processes. This is not a decision for the CIOs alone; it is being worked out in consultation with stakeholders in the institutions. Representatives of the CIOs also participate in the VSNU working group in which a joint digitization strategy for the sector is being developed with the protection of public values as its starting point.