Dutch Surf tests practical route out of Big Tech dependency
The Netherlands’ education and research IT cooperative is running pilots with open source tools, placing working alternatives alongside existing Big Tech services
When a group of Dutch researchers studying the societal impact of algorithms realised they were doing that work entirely on platforms they had no control over, they turned to Surf, the IT cooperative for Dutch education and research. The answer they got was honest: “we do not have an alternative, but we will figure it out”.
Four years later, that request from AlgoSoc, a research programme across five Dutch universities, has grown into a series of open source pilots across Surf’s 120 member institutions. Wladimir Mufty, programme manager for public value and collective digital sovereignty at Surf. The cooperative, comparable to Jisc in the UK, has spent five years working with a small team on turning abstract values such as privacy and autonomy into concrete technology choices.
“Sovereignty is not binary,” says Mufty. “It is not a switch you flip on or off. But the more control you have, the more of those values you can factor into your decisions.”
In practice, that means running pilots, placing alternatives alongside existing services and scaling up what proves viable. “We do not just write position papers about becoming independent from a supplier,” he adds. “We try to act on them as well.”
The dependency that Surf is trying to address did not appear overnight. For years, the relationship between Dutch education institutions and their technology suppliers was treated as broadly symmetrical: institutions paid, suppliers delivered, and if a supplier underperformed, you could take your business elsewhere. That assumption no longer holds. “When a vendor holds your data, your identity systems and your infrastructure, you cannot simply walk over to the competitor,” says Mufty. “This is a fundamentally different kind of dependency than buying gas or grain.”
The Covid-19 pandemic accelerated the shift. José van Dijck, professor of media and digital society at Utrecht University, has described the pandemic as a turning point that pushed Dutch universities deep into Big Tech dependency. There was an acute need to switch to online education, and commercial platforms could provide ready-made products immediately. Collective services that Surf and universities had built over decades were scaled back in favour of speed.
Mufty sees the same pattern. The risks of depending on a handful of US technology companies were always acknowledged, he says, but treated as theoretical. “Nobody believed a trade war would actually happen, or that a government would cut off access to services overnight,” says Mufty. “That probability was always perceived zero. Now, it’s not zero anymore, and that changes everything.”
From pilot to platform
After AlgoSoc’s request, Surf evaluated several candidates and ended up selecting Nextcloud. “It was different from what people were used to, but it was mature,” says Mufty.
What started as a collaboration environment for a small group of researchers has since expanded. Surfdrive, the cooperative’s file-sharing service used by tens of thousands of people, originally ran on OwnCloud software, but has been migrated to Nextcloud as its back end. Separately, Surf now offers 30 institutions a full Nextcloud workspace including video calls, chat and calendars, used by between 1,500 and 2,000 people.
Other pilots address different dependencies. Surf is testing PeerTube as an alternative video platform, partly because Dutch educational videos about subjects such as drugs or breast cancer research can fall foul of YouTube’s content moderation policies. A Mastodon pilot provides an alternative social media channel. In each case, the ownership of the data, the algorithms and the infrastructure remains with the institutions themselves.
Mufty sees artificial intelligence (AI) creating a new layer of dependency. Institutions face pressure from students and staff to provide the latest tools, while long-term vendor contracts risk deepening the lock-in Surf is trying to loosen elsewhere. The cooperative’s response is an AI hub on its own infrastructure, where open models are offered through a shared environment with high standards and requirements for quality, privacy and legal jurisdiction managed centrally.
“We make sure the hub contains high-quality models,” says Mufty. “If an institution is not satisfied with Mistral, or if one query needs to go to Mistral and another to GPT-NL, it can switch without rebuilding anything.”
For providers, the model creates a different incentive. “You only need to meet our standards once,” he says. “And you potentially have 120 institutions as customers.”
Open source underpins all of these pilot initiatives, but Mufty frames it as an instrument rather than a mission. Of Surf’s 50 services, 38 are built on or with open source software, he says. “Transparency, interoperability, building on each other’s work, reuse: you can achieve those almost exclusively with open source,” says Mufty. “With proprietary software, you pay twice for every improvement you make.”
Proof in a weekend
The clearest evidence of what that means in practice came when Surf had to act on it. Surfdrive ran on OwnCloud for years until changes in the ownership and commercial direction of the company behind it created uncertainty over support contracts and the product’s future.
“Did we enjoy that? No. But did it cause us stress? Also no,” says Mufty. “The code was on our own machines, and we knew alternatives existed.”
After six months of preparation, Surf replaced the OwnCloud foundation with Nextcloud and migrated tens of thousands of users in a single weekend. “If it had been a proprietary system, we could never have moved from one product to another in a weekend,” he adds.
Changing the perception of open source at board level has been a separate effort. For years, the automatic association among education leaders was that open source meant amateurish, insecure and difficult to use. Mufty acknowledges that some projects are not ready for large-scale deployment, but says the conversation has shifted towards what open source can deliver rather than what it is.
Surf and the Dutch Ministry of the Interior have co-organised an open source leadership summit aimed at directors and board members. A second edition is planned for 1 October 2026, expanding to include leaders from water authorities and provincial governments.
Surf is not operating in isolation in the Netherlands. On 10 July, the Dutch Tax Administration paused the roll-out of Microsoft 365 after the government’s IT advisory board concluded that the current approach would not deliver a suitable or future-proof working environment. That same day, five Dutch regulators, the Netherlands Authority for Consumers and Markets, the Dutch Authority for the Financial Markets, the Dutch Data Protection Authority, De Nederlandsche Bank and the Dutch Authority for Digital Infrastructure, published a joint position paper calling on public authorities and businesses to make digital autonomy a central consideration in IT procurement.
Collective control but individual compromise
The cooperative model helps absorb early risk. Surf pools costs and distributes them proportionally across its members, from small vocational colleges to large research universities, so that early adopters do not carry the full burden alone. But Mufty is candid about the tension in that model. To build collective autonomy, each institution must accept less individual control over a shared service.
“Sometimes an institution thinks: I would have preferred this feature, or a little more of that,” he says. “But you cannot choose your own background colour when you are building a platform together.”
For the programme manager, the harder problem is not the absence of alternatives, but the expectation that an alternative must match every feature of an established platform before anyone is willing to use it. Surf itself offers 14 cloud services to its members. However, most institutions still choose the US options.
“The only way to turn something that is a six into an eight is to start using it,” says Mufty. “If we keep asking whether it is already as good as Big Tech, the answer will always be ‘no’. That is the whole point.”
Read more about digital sovereignty in Europe
- Dutch universities are calling for greater digital autonomy as more research and educational data is stored in American clouds, posing risks to academic freedom, privacy and accessibility.
- Nextcloud Summit in Munich shows that Europe’s sovereignty ambitions meet their real test not in the technology, but in the procurement decisions.
- European Commission launches package spanning chips, cloud and energy to reduce dependency on US and Chinese supply chains.
