Cloud (Photo: Jose Ramos | Unsplash)
Universities have become too dependent on large American IT companies, many researchers believe. They wonder if there is still a way back. In February, five Dutch universities will launch a trial with the NextCloud open source platform. What if this proves successful?
This article in 1 minute
The Netherlands is making increasing use of cloud services, including hardware, software, and data storage, via the internet. The Netherlands Court of Audit recently pointed out (link in Dutch) the risks involved, such as data leaks or the provider going bankrupt. “It’s not as bad as in the US or the UK yet,” says Seda Gürses (Faculty of Technology, Policy and Management), “but even here, all sorts of things are outsourced without much thought, and that’s worrying.”
A recent example from TU Delft is the migration of its email and calendar items from university servers to the Microsoft cloud. Late last year, the Works Council raised concerns about privacy and data security. Are corporate information on finances, personal details of sick employees, and reports on staff performance properly protected? Since the Patriot Act (which gave the US Government access to millions of citizens’ call records in 2001), it has become clear how easily this can happen.
Dutch universities are leading the way in using cloud services, alongside the US and the UK. In other European countries such as Germany, Austria, Switzerland, and France, universities are more cautious and still handle many IT services in-house. The trend of outsourcing IT services started long before COVID-19, as Seda Gürses (TPM) and Tobias Fiebig (Max Planck Institute) discovered. In their 2023 article entitled Heads in the Clouds?, they write that outsourcing has been going on for 15 years already. Just think about cloud storage, emails, student tracking systems, and online lectures.
Dark Clouds
So why is this growing reliance on cloud services suddenly a problem? Apart from the growing cultural divide between Europe and the US, Gürses and Fiebig argue that dependence on American IT companies is undesirable because they do not respect academic freedom. As an example, they cite Zoom’s blocking of a lecture organised by New York University – an outright violation of academic freedom, they claim. Additionally, Gürses believes Microsoft’s software is primarily designed for the (American) corporate world, whereas adaptable open-source software is a better fit for the open and educational nature of universities.
‘You end up in a trap that is hard to escape from’
AI researcher Roel Dobbe (also at TPM) goes as far as to say this is a loss of sovereignty. “It has been scientifically proven that outsourcing to cloud services not only means handing over your data but also surrendering your ability to shape your own services or core functions.” In IT project tenders, price is often the determining factor, Dobbe explains, while other requirements are quickly forgotten. “As a result, education has increasingly ended up in a Microsoft or Google environment. You gradually lose your autonomy and end up in a trap that is hard to escape from.”
TU Delft IT director Erik Scherff agrees with this analysis. “Over the past 10 to 20 years, outsourcing has become more common. This happened gradually, partly because convenient off-the-shelf software was available for education.” As a result, IT departments developed less software themselves, with the research portal PURE being a rare exception. “We run hundreds of applications here, most of which are not cloud-based.” TU Delft manages most of its data storage in two on-campus data centres but TU Delft also uses services and storage from the SURF educational and research IT cooperative.
Scherff does not view Microsoft as ‘the big bad company’. “Everyone is familiar with it as workplace software, so it gets a lot of attention. But for me, Office 365 is just one of the hundreds of programmes offered by TU Delft’s IT department.” Scherff says his focus is on ‘digital sovereignty’, which he defines as control over data and infrastructure and the freedom to purchase or develop software independently.
Cumulus
Dutch universities rarely use American companies for cloud storage and only do so with permission. SURF also stores most data from its own services on its own servers, says Wladimir Mufty, Programme Manager for Digital Sovereignty at SURF. He distinguishes between ‘infrastructure as a service’ (IaaS), such as cloud storage, and ‘software as a service’ (SaaS), such as Office 365.
‘American companies are subject to US law’
For cloud storage, universities can use SURFcumulus, which aggregates offerings from various cloud providers, Mufty explains. SURF has contracts with commercial cloud services, including Amazon, Microsoft, Google, and Oracle. Universities can choose from 13 providers, including Dutch ones.
Mufty understands the concerns about data stored with American IT companies, but he believes these concerns are more about cloud software (SaaS) than cloud storage (IaaS). “The US intelligence services can simply access your data,” he says. “It doesn’t matter if the server is in America, Frankfurt, or Middenmeer. American companies are subject to US law. Even if the server is next to my front door, US law still grants access to my documents.”
NextCloud
A trial starting in February aims to take a first step towards change. Seventy researchers across five Dutch universities (TU Delft, University of Amsterdam, Erasmus University Rotterdam, Utrecht University, and Tilburg University) will collaborate using NextCloud. They are part of the AlgoSoc (in Dutch) research programme, funded by the Dutch Research Council (NWO), which studies public values in a society increasingly shaped by algorithms. Seda Gürses and Roel Dobbe represent TU Delft in AlgoSoc, alongside Catholijn Jonker, Professor of Interactive Intelligence (Faculty of Electrical Engineering, Mathematics and Computer Science). The team, which also includes legal scholars, communication experts, data scientists, AI researchers, psychologists, and behavioural scientists, will use NextCloud as their primary work environment, replacing Zoom, Teams, Google Docs, Outlook, and other tools.
NextCloud offers everything needed for remote collaboration:
- cloud storage and file sharing;
- real-time document collaboration with Office-like software;
- video calls, chats, and webinars;
- various plug-ins, such as web surveys;
- AI assistant of choice;
- watch a short video for an overview.
Why NextCloud is well suited for an academic environment:
- data stored on a self-selected server (for this trial, at SURF);
- privacy & security compliant with GDPR by default;
- uses open standards for integration with other programmes and systems;
- open-source software that can be customized;
- expansions and improvements are shared within a non-profit ecosystem;
- control over datasets and transparency in AI assistant selection.
“It will really become their primary work environment,” says Mufty, SURF’s Programme Manager, who previously conducted a NextCloud trial with SURF employees. The system must now function continuously across five different cities. Do all features work as intended, such as collaboration, editing, and file storage? “Is everything running stably? Is security guaranteed?” Mufty asks. “Of course, we will conduct various penetration tests to see if we can hack the server. We want to know how security and privacy hold up and if the system delivers on its promises.”
Impact on students and staff
If the trial is successful, what will this mean for students and staff? “I understand that many people aren’t keen on switching to an entirely new system for email, meetings, and file sharing,” says Roel Dobbe. However, he believes the experience of the AlgoSoc team could help lower the barrier.
‘A concrete step towards greater digital autonomy’
Mufty will closely follow the two-year trial. “If the software meets expectations and there is demand in the Netherlands, we could start offering NextCloud via SURF within a year.”
IT director Erik Scherff does not believe in forcing NextCloud on users. “That won’t work with highly educated people.” However, he would like to offer it as an option to TU Delft account holders. “I hope this will be a concrete step towards greater digital autonomy – something we’ve only talked about before now.”
Cloud Atlas: Federated vs. Centralised Internet
The World Wide Web was developed in 1989 by British scientist Tim Berners-Lee while working at CERN. Based on the existing internet, the web was designed to allow articles to be published on a server so others elsewhere could read them through a web browser. Berners-Lee envisioned a free and open exchange of information between research institutions, each connected to the internet via its own server. The internet had a federated structure: decentralised but interconnected.
The internet’s commercial breakthrough in the late 1990s changed that. As the number of users grew, the internet became increasingly centralised. In the Netherlands, KPN initially dominated, but later, large American companies took over a growing share. Many institutions, including universities, which once had their own servers, have since switched to commercial providers for software and cloud storage.
The problem is that tech giants prioritise customer retention over open exchange. Rather than facilitating the sharing of files and information, they often make it more difficult. There are always workarounds, but this is not how the internet was originally intended.
NextCloud follows a federated architecture. The software runs on an institution’s own server, keeping all data in-house while still allowing it to be shared with others.
SURF also provides a federated network for connected educational institutions. Users benefit from features like a single username and password across institutions (Surfconext) and the convenience of Eduroam.
“Federated means you trust each other while maintaining autonomy and control,” explains SURF director Wladimir Mufty. “If TU Delft has its own NextCloud server in a few years, and other universities have theirs, that doesn’t mean I can access TU Delft’s files from UvA. But you can specify what access you allow. Video calls? Tick the box. File sharing? The same. These are the kinds of innovations possible when using open standards. And that opens the door to great possibilities.”
- The article Heads in the Clouds? is available as a .pdf in the link.
- Wladimir Mufty wrote an article on why the NextCloud trial strengthens digital sovereignty.
- Curious about NextCloud? Find more information
Do you have a question or comment about this article?
j.w.wassink@tudelft.nl
Comments are closed.