summarize this:
The Netherlands: organizational collaboration
In the past decade, the defense cybersecurity strategies of the Netherlands have displayed the nation’s ambition to develop offensive cyber capabilities (Bunk and Smeets
2021; Claver 2018). In 2014, the Netherlands established a Defence Cyber Command
(DCC), with the aim to strengthen the country’s defense and offense in the cyber
134 T. LIEBETRAUdomain. The DCC, located under the commander-in-chief of the Dutch Armed Forces
since 2018, became operational by the end of 2015 (Ducheine, Arnold, and Peter
2020). The DCC concentrates on establishing and deploying defensive, intelligence,
and offensive cyber capabilities. In this context, the DCC5
sees offensive cyber capabilities as digital resources the purpose of which is to influence
or pre-empt the actions of an opponent by infiltrating computers, computer networks
and weapons and sensor systems so as to influence information and systems. The
Netherlands Defence organisation deploys offensive digital resources exclusively against
military targets
The mission of the DCC is to carry out offensive cyber operations in the context
of armed conflict and war and act as a potential deterrent measure in time of peace
(Ministry of Defense 2015, 2018). The DCC does not have mandate to play an
active role in disrupting continuous adversarial cyber behavior short of war. The
operational capability of the DCC is, however, hampered by its limited mandate
that restricts the DCC’s possibility to gather intelligence and conduct reconnaissance
when not in war. This not only makes it difficult to select and impact targets, but
it also makes it hard to attract and maintain the necessary human skills (Smeets
2021). According to interviewees, the DCC lacks the necessary human expertise and
technical infrastructure to carry out offensive cyber activities on its own. Hence, the
DCC is primarily able to act as “coordinator and operational hub” when it comes
to the deployment of Dutch offensive cyber operations in armed conflict (Claver
2018, 169). At the time of writing, there is no public information that the DCC has
conducted offensive cyber operations.
On the contrary, the Military Security and Intelligence Service (MIVD) has demonstrated significant operational cyber capacity in several cases.6 Some of its work is
undertaken in collaboration with the General Intelligence and Security Service (AIVD)
in the Joint SIGINT Cyber Unit (JSCU).7 As a collaboration between the MIVD and
the AIVD, the JSCU forms a cornerstone of the Dutch cybersecurity. The primary tasks
of the unit are the collection of signal intelligence and the delivery of intelligence
through cyber operations. The MIVD and JSCU are therefore crucial partners for the
DCC. It is not publicly disclosed how the human and technical infrastructure resources
are pooled in the event of a cyber-attack on the Netherlands surmounting to
armed conflict.
The collaboration between the DCC and MIVD/JSCU raises strategic and legal
issues as the MIVD and JSCU operate under different political and legal mandates. As
part of the intelligence community, the MIVD is placed under the Secretary-General of
the Ministry of Defense.8 In addition, the MIVD does not conduct military operations.
Instead, its operations are based on a specific intelligence services legislation.9 The legal
framework does allow MIVD to conduct counter-operations. As stressed by Claver
(2018, 168), “all three organizations are very different in procedures, operating style,
tasks, and outlook”. According to Sergie Boeke (2018, 28), it hampers the effectiveness
and execution of Dutch cyber power that intelligence and military operations operate
on different mandates, cultures, and methods of working. Moreover, it spurs the risk
that the operational capability and activity of intelligence and military entities are mismatched with the broader strategic or governance goals.
POLICY DESIGN AND PRACTICE 135The Netherlands presented a military cyber doctrine in 2019. The doctrine calls for
increased coordination and collaboration between the Cyber Command and the intelligence services. It stresses that the difference between the conduct of cyber operations
in war and for espionage relates to the purpose and the desired effect and underlines
that those cyber capabilities are complementary and non-competing (Defence Cyber
Command 2019, 14–15). Along the same line, the Ministry of Defense emphasizes, in
its ‘Defence Vision 2035: Fighting for a safer future’, the need for organizational
decompartmentalization when countering hybrid threats in the information environment (Ministry of Defense 2020, 17) and promises to devote attention to the hybrid
strategic competition between war and peace (Ministry of Defense 2020, 23). However,
the documents do neither elaborate on the organizational collaboration between the
Cyber Command and the intelligence services nor how cyber operations are meant to
complement to each other at the strategic, tactical, or operational levels.
The analysis of the Dutch organization of cyber capabilities shows organizational
separation between the DCC – which can deploy cyber capabilities in the event of
armed conflict and war – and the intelligence services that can deploy cyber capabilities
for intelligence and active defense purposes. While the Dutch model strongly notes the
need for collaboration between the DCC and the intelligence services, it remains
ambiguous how they complement each other in practice and how organizational collaboration is supposed to fulfill goals of increased effectiveness, synergy, and flexibility.
This raises concern that the operational cyber capability of the Netherlands is hampered by the current organizational structure and legal mandate.