Summary
- Amsterdam police seized an Autistici/Inventati server on 13 October following a US legal assistance request.
- Two sets of Dutch parliamentary questions submitted on 16 October challenge the legal basis, safeguards and implications for European internet providers.
- Reports differ on whether the forensic copy has already been transferred; the precise status and scope of disclosure remain unclear.
Dutch parliamentarians have demanded an explanation of the legal safeguards governing the seizure of an Amsterdam-hosted server belonging to Italian internet provider Autistici/Inventati, after police acted on a legal assistance request from the United States.
Two sets of written questions were submitted on 16 October following reports that Amsterdam police had removed the server from a data centre in the city’s eastern district three days earlier. Police have confirmed that the action followed a US request and that a digital copy of the stored information was being prepared for American authorities.
The circumstances have prompted scrutiny of the process through which overseas law enforcement agencies can obtain access to physical infrastructure hosted in the Netherlands. MPs are seeking clarity about the legal authority for the seizure, the safeguards applied and the circumstances under which a foreign request may be refused.
The development follows US sanctions against Autistici/Inventati, an Italian collective that provided email, web hosting and other communications services to political and activist organisations. The collective rejected American allegations that it supported terrorism and decided in September to terminate its services to protect users and associated communities.
The seizure itself is confirmed, but the legal and political conclusions raised by parliamentarians remain questions rather than established findings. There has been no published Dutch ministerial determination that the request was unlawful or that required safeguards were disregarded.
Parliament asks how the request was approved
The first set of questions was submitted by Christine Teunissen of the Party for the Animals and Sarah Dobbe of the Socialist Party. They ask the justice minister to identify the legal basis for the seizure and explain how the request was assessed against Dutch law and international human rights obligations.
The MPs also ask whether officials considered the consequences of complying with a request concerning a provider that had already been targeted by US sanctions. Their questions raise concerns about political motivation, but do not establish that Dutch officials acted for an improper purpose.
Further clarification has been requested about the creation and transfer of the server’s digital image. Police previously indicated that they intended to copy information from the equipment and make it available to American authorities before returning the hardware.
Subsequent reporting has described the copy as already delivered, while earlier police statements referred to a future transfer. The publicly available accounts do not provide a complete, independently verified record of when the image was transferred, which material it contained or the restrictions governing its subsequent use.
The second parliamentary submission, from Barbara Kathmann and Sarah El Boujdaini, asks whether Dutch authorities must automatically comply with American legal assistance requests and what grounds exist for rejecting requests that conflict with Dutch or European law.
Their questions also seek figures covering similar requests over the preceding two years, including the number accepted and refused. Such information could establish whether the Amsterdam seizure followed an established pattern or involved unusual circumstances.
Both submissions distinguish the confirmed actions of Dutch authorities from the broader political concerns arising from American sanctions policy. Neither parliamentary document represents a court ruling, and neither establishes that the Dutch government has approved any new rules governing foreign access to data centres.
Physical infrastructure and jurisdiction
The server was reportedly housed at Amsterdam Science Park, a location containing significant digital and research infrastructure. Its physical presence in the Netherlands meant that Dutch authorities could act through domestic procedures in response to an overseas request.
Legal jurisdiction over equipment is not determined solely by the nationality of the organisation using it. A server operated by an Italian provider may be located in a Dutch facility, while the information stored on it may relate to users in several countries.
International legal assistance arrangements exist to support investigations involving evidence held across national borders. The requirements for executing a request depend on the relevant domestic law, applicable international agreements and judicial or prosecutorial safeguards.
The existence of such arrangements does not give foreign investigators unrestricted authority to enter a European data centre. Equally, keeping equipment physically within Europe does not prevent lawful requests for evidence from overseas authorities.
Creating a forensic image introduces a further distinction between the physical hardware and the information it contains. Investigators may copy data for examination while leaving the original server to be returned after the relevant process has been completed.
The exact information accessible through such a copy depends on the storage configuration, any encryption and the scope of the legal authorisation. The available reporting does not establish that investigators obtained readable access to every item of information previously held on the seized equipment.
The Dutch Cloud Community, representing organisations in the country’s internet and cloud sector, has also raised concerns about the procedure. Its intervention seeks clarity about whether the request received appropriate examination by Dutch judicial or prosecutorial authorities.
Industry concerns have extended to the position of European infrastructure providers that may face legal obligations in more than one jurisdiction. Kathmann and El Boujdaini explicitly ask about potential consequences for companies supplying services to organisations affected by American sanctions, including the International Criminal Court.
These questions concern operational risk as well as legal principle. Providers need to understand which authorities can compel access to equipment, what evidence must be preserved, and how legal demands interact with contractual commitments to customers.
Data residency and data sovereignty assurances therefore require more than identifying the country in which a server is installed. The legal identity of the provider, the location of the equipment, the contractual relationship and applicable disclosure procedures can each affect the protections available.
The Dutch government has been asked to explain the legal examination applied to the Autistici/Inventati case and whether additional safeguards or policy clarification are necessary. Its response will determine whether the parliamentary challenge leads to further scrutiny of foreign legal assistance requests involving European-hosted digital infrastructure.
