Kristof Tuyteleers

Kristof Tuyteleers speaks as someone who has had to translate an abstract policy debate into an operational decision, and that grounding shapes everything he says. As CISO of DNS Belgium, he frames the migration away from AWS not as a technical upgrade but as an obligation tied to the organization's role: "Wij zijn een kritische component in het internet in België. Dus wij vinden het gewoon onze verdomde plicht om ervoor te zorgen dat we klaar zijn" ¹². This sense of duty recurs throughout his thinking. He is careful to note that DNS Belgium never ran its core DNS 'address book' function on cloud infrastructure, only the registrar/notary function, and that even that more limited exposure eventually came to look too risky ¹². The decision, he stresses, was not a reaction to a single incident but the product of an annual risk assessment repeated for more than a decade, during which geopolitical risk simply kept climbing until it tipped the scale ¹².

A central theme is demystifying the cloud itself. Tuyteleers repeatedly punctures the term with a plain, almost dismissive definition: "De cloud, dat is een heel duur woord voor het is iemand anders computer" ¹². This is not a rejection of cloud technology as such, but an insistence that organizations recognize what they are actually doing when they outsource: handing control of their infrastructure to someone else's machine, often on someone else's continent. From there he builds his sovereignty argument: "Als alles aan het internet hangt en we hebben eigenlijk bijna geen controle meer over dat internet zelf, over die snelweg, die datasnelweg. Ja, hoe soeverein zijn we dan nog?" ¹². For him sovereignty is not an ideological posture but a direct consequence of losing control over infrastructure that everything else depends on.

He is equally direct about the scale of power concentration in Big Tech, coining his own shorthand for it: "Ik noem dat too big to regulate" ¹². His point is not simply that these companies are large, but that their war chests let them pre-emptively absorb not just startups but mid-size companies that might otherwise mature into competitors, which he sees as an unhealthy concentration of power that regulation has failed to check ¹². He extends this into a sharp observation about unintended consequences: EU privacy legislation aimed partly at reining in the ad market ended up entrenching Google's position in online advertising, a case study he uses to show that good intentions in regulation can still produce the opposite of the desired effect ¹².

Tuyteleers is also attentive to how dependency reproduces itself structurally, beyond mere convenience. He points to education as a quiet mechanism of lock-in: schools now train graduates almost exclusively on American cloud technology rather than open standards, so the next generation of engineers arrives already fluent in dependency ¹². He pairs this with a market-distortion argument, noting that European providers face higher compliance costs to prove regulatory adherence than American competitors selling into the same market, which undercuts their ability to compete on cost ¹². Running through both points is a conviction that Europe's malaise is not a talent problem but a funding and infrastructure problem: "Wij zijn toch altijd een innovatief continent geweest. Maar voor innovatie is er geld nodig" ². He wants European ICT and ad spending redirected toward local providers so that money gets reinvested in European innovation rather than leaking abroad, weakening both local media and local ICT companies in the process ¹².

On what the internet has become, his diagnosis is that decentralization has quietly failed. The network was built for redundancy, but as everything from smart meters to cars gets connected to it, control has concentrated in six to ten companies, so a single cloud outage can take down a large share of a country's websites at once. He calls this what it is: "Er is helemaal geen redundantie niet meer. Het is een soort schijnredundantie" ¹². This is paired with a broader plea to institutions and individual businesses alike, delivered in his most memorable line: "Leg al je eieren niet in dat ene mandje" ¹². He applies this concretely to SMEs, warning against building a business entirely on Instagram or Facebook, since profile blocks are often impossible to appeal or even understand, and urging companies to maintain their own website and domain as a baseline of resilience ¹².

His concrete takeaway for organizations is pragmatic rather than alarmist: companies do not need to migrate away from Big Tech providers immediately, but they should be technically ready to do so, containerizing workloads and treating a potential migration as a plannable project rather than a crisis response, especially if they operate anything resembling critical infrastructure ¹². Even here, though, he is candid about the limits of his own solution. Having moved DNS Belgium toward a European provider, he admits openly that the organization has no ready answer for what happens if that provider is later acquired by an American Big Tech player, something their financial firepower makes entirely plausible ¹². That admission is characteristic of his overall stance: confident about the direction of travel and the urgency of acting, but honest that sovereignty, once ceded, is not easily or permanently reclaimed.