This article has been reviewed according to Science X's editorial process and policies. Editors have highlighted the following attributes while ensuring the content's credibility:


trusted source


Many Dutch municipalities do not yet respond adequately to security vulnerabilities, research finds

Many municipalities do not yet respond adequately to security vulnerabilities
Credit: AI-generated image (disclaimer)

Many local authorities respond too slowly or inadequately to reports about security vulnerabilities. These coordinated vulnerability disclosures (CVD reports) are often made by ethical hackers who aim to make the internet safer. While this process has improved in recent years, the study by the University of Twente and the Dutch Institute for Vulnerability Disclosure (DIVD) indicates that there is still much room for improvement for local authorities.

Out of 114 Dutch municipalities, it was tracked whether the issue was resolved in 89 of them. Among these 89 contacted municipalities, 44 did not respond within 90 days—the period specified by the University of Twente in its Coordinated Vulnerability Disclosure for research—regarding the security notification. In 49 of the responding municipalities, the problem was found to remain unresolved. In 10 municipalities, the security was fixed, but this was not communicated back to the notifier.

However, there are reasons for optimism, as there were municipalities that proactively responded to the notifications. In 19 municipalities, the report was handled appropriately, and there was a response to the notification.

The research was conducted by Koen van Hove, a Ph.D. candidate at the University of Twente, a software and research engineer at NLnet Labs, and a researcher at the volunteer organization Dutch Institute of Vulnerability Disclosure (DIVD). He initiated the research out of curiosity about the functioning of CVD procedures in Dutch municipalities.

Between 30 August 2022, and 23 February 2023, Van Hove reported a security vulnerability in commonly used software to municipalities. Where possible, he used the CVD procedure on the municipalities' websites. In total, he contacted 114 Dutch municipalities. The security vulnerability involved the ability to send emails through the infrastructure used by municipalities that were indistinguishable from legitimate municipal correspondence.

During the reporting process, there were challenges, including malfunctioning forms and email addresses, and confusing reporting methods. Notably, many reporting forms were only accessible after logging in via DigiD, making anonymous reporting impossible. Additionally, it was observed that in 11 out of 114 cases, an automated process started after the report.

Personal information such as date of birth, marriage date, financial status, residence permit for both the notifier and partner, parents, and children were requested from the Personal Records Database (BRP). This occurred without the responsible parties at the municipalities being informed.

Since January 1, 2019, the government has introduced the Baseline Information Security Government (BIO), which makes it mandatory to have and publicly disclose a procedure for reporting issues (CVD procedure). The research indicates that there is room for improvement, as more than half (60) of the 114 contacted municipalities have not yet published or enforced a clear CVD procedure.

The importance of reporting through the CVD system for municipalities is evident, as illustrated in 2020 during a ransomware attack on the of Hof van Twente. Volunteers making these reports are not legally obliged to do so, but they contribute due to their awareness of its significance. Therefore, keeping the threshold for making such reports as low as possible is crucial.

This can be achieved by publishing a clear and accessible reporting procedure on municipal websites, preferably also anonymously and without unnecessarily requesting . Furthermore, the research emphasizes the importance of timely and informative communication with the notifier.

Citation: Many Dutch municipalities do not yet respond adequately to security vulnerabilities, research finds (2023, October 4) retrieved 24 May 2024 from
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.

Explore further

In Sweden, municipal housing policy influences refugee reception


Feedback to editors