We will increasingly face DDoS attacks intended to disrupt societies, and sometimes they will succeed. However, there is no cause for concern, but we do need to focus more on a collective approach to DDoS resilience.
DDoS attacks are a growing threat. In 2025 alone, in the Netherlands and Europe, we have seen attacks affecting higher education, healthcare and public transport. Other digital infrastructure was also targeted, crippling government websites and online services for citizens, targeting elections and aiming to cause societal unrest. In short, these attacks are now used as political weapons. To remain resilient, we need to approach this problem differently.
Arms race in a hybrid battle
DDoS attacks are part of a new normal characterised by a hybrid conflict between different geopolitical power blocs. They are now being used strategically to disrupt free, democratic societies in Europe. Not surprisingly, the intelligence agencies recently sounded the alarm about this.
This is not to say, incidentally, that recent attacks have all had this intention. This is known about some attacks, others not so much. But we do know that the motives of attackers often lie in retaliation and the disruptive effect of attacks and that they themselves often link these motives to developments in the geopolitical arena. With this, DDoS attacks have long since ceased to be “mischief” or “digital vandalism”, but are part of a broader, global struggle.
DDoS and the protection measures that are taken, moreover, have the dynamics of a classic arms race. Defences that are adequate today may be insufficient or obsolete tomorrow. This dynamic makes it virtually impossible to achieve 100% protection. And it is a big task to keep up to date in terms of knowledge and technology to repel these kinds of attacks.
Dependency
It stings in this respect that we in Europe have made ourselves largely dependent on non-European-made DDoS protection. Because in this area too, as for many other online services, it is only a handful of mainly US companies that control almost the entire market. If we feel that the government has made itself vulnerable by hosting sensitive data at US cloud providers, we should also ask ourselves whether we should not organise our resilience against cyber-attacks such as DDoS differently.
After all, European countries have every interest in organising their own digital resilience. With their own knowledge, technology and on their own soil. This is of great importance for the digital sovereignty and strategic autonomy of Europe and thus also the Netherlands.
It is therefore obvious to seek much more cooperation, both within the Netherlands and within Europe. This is already happening in the Netherlands in the anti-DDoS coalition, in which government and critical sectors work together on their resilience against DDoS attacks. For example, a methodology has been developed there to exchange characteristics of attacks via a so-called Clearing House, as a result of which attacks can be better recognised and repelled by organisations that have access to this Clearing House.
In Europe, in addition, as part of the multi-billion programme Important Projects of Common European Interest – Cloud Infrastructure and Services (IPCEI-CIS), digital resilience (security by design) is being worked on where it matters most, namely in tomorrow’s digital infrastructure at Europe’s geographical borders.
But while useful and important, both examples do not solve the challenges we face today. For that, something else is needed first.
Shift in thinking
We must be realistic: as long as many organisations (have to) organise their resilience against DDoS attacks individually, we will remain vulnerable as a society. A shift in thinking is therefore needed here. We have been stuck for too long in a paradigm in which individual responsibility for organisations’ digital resilience prevails. The new Cyber Security Act offers and enforces a different approach to cyber security, but only for a limited group of organisations. We will therefore have to approach this issue from the perspective of collective responsibility. Commercial interests are thereby subordinated to the broader, societal interest: stability through the availability of (critical) online services. And, not unimportantly, making a fist against those who try to disrupt our societies and way of life. We should not be naive about that.
By joining forces in initiatives that increase our collective resilience, we ensure that individual organisations stay afloat. We must develop, exchange knowledge and organise our own resilience ourselves in a Dutch and European context, without dependencies outside our own, European sphere. This is only possible if we think differently about DDoS and further organise ourselves collectively. In this way, the new normal need not be a threat, but an important step towards a digitally sovereign and resilient Netherlands and Europe.
Octavia de Weerdt is general director of the NBIP non-for-profit and chair of the NL anti-DDoS coalition. This article appeared in abridged form in the Dutch national newspaper NRC on 3 May 2025.
