Dutch Intelligence: History, Structure, and the Headlines

The Netherlands is a small country with an outsized intelligence footprint. The Hague hosts the International Criminal Court, the Organisation for the Prohibition of Chemical Weapons, Europol, and Eurojust; Dutch firms such as ASML sit at the center of the world’s semiconductor supply chain; and Dutch services have, more than most of their peers, chosen to name foreign hackers and spies in public. Since the downing of flight MH17 over Ukraine in 2014, killing 298 people, Russia has been a constant subject of that work, and in recent years China has joined it.

This page is a working overview of Dutch intelligence: where it came from, how it is organized under the law today, who runs it after the 2024–2026 leadership changes, and the cases that have put it in the news. It relies on Dutch statutes, parliamentary records, government announcements, court rulings, archival records, and named reporting, and it notes where a claim comes from a party with an interest in the outcome.

Dutch intelligence at a glance

• General intelligence and security: the General Intelligence and Security Service (Algemene Inlichtingen- en Veiligheidsdienst, AIVD), which by law answers to the Minister of the Interior and Kingdom Relations (Wiv 2017, Article 1). Director-general: Simone Smit, the service’s deputy head since February 2021, whose appointment the cabinet approved with effect from March 1, 2026 (Government of the Netherlands). She succeeded Erik Akerboom, who had led the AIVD since 2020 (ANP via Welingelichte Kringen).
• Military intelligence and security: the Defence Intelligence and Security Service (Militaire Inlichtingen- en Veiligheidsdienst, MIVD), under the Minister of Defence (Wiv 2017, Article 1). Director: Vice Admiral Peter Reesink, who took over in February 2024 (Ministry of Defence; Leiden University).
• Joint signals and cyber: the Joint Sigint Cyber Unit (JSCU), in which, in the AIVD’s words, “the AIVD and MIVD have joined forces” on signals intelligence and cyber operations (AIVD).
• Counterterrorism coordination: the National Coordinator for Security and Counterterrorism (NCTV), part of the Ministry of Justice and Security. Marc Kuipers became coordinator on January 1, 2026 (Government of the Netherlands).
• Oversight: the Review Committee on the Intelligence and Security Services (CTIVD), set up under Article 97 of the 2017 act, and the Investigatory Powers Commission (Toetsingscommissie Inzet Bevoegdheden, TIB), set up under Article 32, which reviews in advance whether the use of specific special powers is lawful. “Het oordeel van de TIB is bindend” (the TIB’s judgment is binding) (TIB).
• Relationship with the United States: allied. The Netherlands is a founding member of NATO (NATO), and the cases below show close intelligence cooperation with Washington, from warnings about Russian hackers to a Russian officer later charged by U.S. prosecutors.

History: from London exile to the 2017 act

Modern Dutch intelligence was born in exile. After the German invasion in May 1940, the government in London built its own services. The Dutch National Archives’ inventory of the London war archives records a Central Intelligence Service represented in Lisbon from 1941, an office that continued from November 28, 1942, as part of the Bureau Inlichtingen (Intelligence Bureau), and a Bureau Bijzondere Opdrachten (Special Assignments Bureau) that ran from March 15, 1944, to June 1, 1946 (Nationaal Archief, inventory 2.13.71).

The worst failure of that period was the Englandspiel. Beginning in 1942, German counterintelligence, the Abwehr and the Sicherheitsdienst, with Hermann Giskes of the Abwehr and Schreieder of the Sicherheitsdienst at the center, turned the clandestine links between London and the occupied Netherlands against Britain’s Special Operations Executive (SOE), and most of the agents dropped into the country were arrested. In a 1959 lecture on the postwar parliamentary inquiry, the historian Loe de Jong wrote that Schreieder and Giskes set up their Englandspiel “met een vindingrijkheid” (with an ingenuity), and he endorsed its account of “ernstige beleidsfouten van de Britse Special Operations Executive, gekoppeld aan beleidsfouten van Nederlandse kant” (serious policy errors of the British SOE, coupled with policy errors on the Dutch side) (L. de Jong, Bijdragen en Mededelingen van het Historisch Genootschap, 1959). The inquiry ran from 1947 to 1956 and listed the Englandspiel among its subjects (Parlement.com). Most of the captured agents were sent to the Mauthausen concentration camp in Austria; one record of an agent, Michiel Pals, says he was executed with 22 other SOE agents on September 6, 1944 (International Bomber Command Centre). Claims that London knowingly sacrificed the agents have circulated for decades; reviewing the literature, the historian Cees Wiebes doubted that blunders alone explain the disaster, but no official body has found deliberate sacrifice (C. Wiebes, BMGN).

After liberation, the Bureau Nationale Veiligheid was set up in 1945; it became the Centrale Veiligheidsdienst in 1946 and the Binnenlandse Veiligheidsdienst (BVD, Domestic Security Service) in 1949, a name it kept until 2002, when the service was also given tasks abroad and became the AIVD (Parlement.com). On the military side, the army, navy, and air force each ran their own service after the war; they were merged into the Military Intelligence Service (MID) in 1988, renamed the MIVD under the 2002 act (Crypto Museum).

The Cold War left one legacy that surfaced only in 2020. On February 11, 2020, the Washington Post, Germany’s ZDF, and the Dutch radio program Argos reported, from internal histories, that the CIA and Germany’s BND had secretly owned the Swiss cipher firm Crypto AG and sold weakened machines to governments around the world, an operation known as Rubicon. The reporting said that when Germany refused to help with one effort, against NATO ally Turkey, the Netherlands stepped in: “De BVD, voorloper van de AIVD, en Philips schoten te hulp, waardoor de Amerikanen konden meelezen met de Turken” (the BVD, the AIVD’s predecessor, and Philips came to the rescue, so that the Americans could read along with the Turks) (NOS). A former Philips cryptographer, Cees Jansen, told Argos that he weakened devices on instruction, saying, “I did whatever my boss asked me, and made what had to be made”; Philips declined to comment and said it found nothing in its archives (Argos). Members of parliament put written questions to the interior minister about Dutch involvement (Tweede Kamer, 2020Z06643).

The current legal framework is the Intelligence and Security Services Act 2017 (Wet op de inlichtingen- en veiligheidsdiensten 2017, Wiv 2017), which expanded the services’ powers to intercept cable traffic in bulk. The act was put to an advisory referendum on March 21, 2018; 49.44 percent voted against the law and 46.53 percent in favor, on a turnout of 51.54 percent (Tweede Kamer). The cabinet kept the law, announcing that “De Wiv gaat, zoals beoogd, in per 1 mei 2018” (the act takes effect, as planned, on May 1, 2018), while promising amendments on sharing with foreign partners, narrower targeting of cable interception, and shorter data retention (Government of the Netherlands).

How Dutch intelligence is organized today

Unlike many countries, the Netherlands sets out its services, their ministers, and their overseers in one public statute, and the heads give public annual reports. The system has four main parts.

• The AIVD handles counterterrorism, counterintelligence, extremism, and foreign intelligence, and it runs the security screening of officials. It has directorates for intelligence, operations, and security screenings, and its operations side includes the National Communications Security Agency (NBV), which protects sensitive government information (AIVD).
• The MIVD serves the armed forces and the Defence Ministry. Presenting its 2025 annual report in April 2026, Reesink named the war in Ukraine as the largest threat to Dutch security and said the service expected more Chinese cyberattacks; he stressed strong ties with the United States while calling for closer European cooperation (Devdiscourse).
• The Joint Sigint Cyber Unit pools the two services’ signals intelligence and cyber capabilities.
• The NCTV, at the Ministry of Justice and Security, coordinates counterterrorism and national security policy; the 2017 act governs only the AIVD and MIVD.

Oversight comes in two layers: the TIB reviews certain warrants before they are used, and the CTIVD reviews the services’ conduct afterward, can see all documents, handles complaints, and reports publicly each year (Parlement.com). The arrangement is under steady pressure. In March 2024, the Senate passed a temporary law for investigations into countries with offensive cyber programs, which the government said would give the services “meer operationele snelheid en wendbaarheid, terwijl het niveau van toezicht gelijk blijft” (more operational speed and agility, while the level of oversight stays the same). It loosened deadlines on keeping bulk data, with the CTIVD given binding oversight of retention extensions, and it expires four years after taking effect (Eerste Kamer, bill 36263).

Cyber operations in the open

What sets Dutch intelligence apart is how often it shows its work. Most allied services attribute cyberattacks quietly, through partners or anonymous briefings; the Dutch services have repeatedly named the culprit at a press conference or in a public advisory.

The pattern started with a leak rather than an announcement. In January 2018, de Volkskrant and the television program Nieuwsuur reported, citing six anonymous sources, that AIVD hackers had for one to two and a half years watched the Russian group known as Cozy Bear from inside its network, and through a security camera in its building, as it attacked the White House, the State Department, and the Democratic Party, and that the AIVD warned U.S. authorities from November 2014. The interior minister, Kajsa Ollongren, declined to comment; the then AIVD chief Rob Bertholee said he had “no doubt” the Kremlin was behind the campaign; and Kremlin spokesman Dmitri Peskov said Dutch media were fueling “anti Russian hysteria” (DutchNews.nl).

Nine months later came the first deliberate public exposure: the October 2018 press conference on the GRU team caught outside the OPCW, described in the cases below. In February 2024, the MIVD announced that Chinese state hackers had gained access the year before to a stand-alone Defence Ministry research network with fewer than 50 users, using malware the services called Coathanger. Defence Minister Kajsa Ollongren said, “I think we have to assume that this happens more widely.” The Chinese embassy rejected the claims, saying, “China always firmly opposes and cracks down on cyber attacks in all forms in accordance with the law” (DutchNews.nl).

On May 27, 2025, the AIVD and MIVD went further and introduced a previously unknown Russian group, which they named Laundry Bear (Microsoft calls it Void Blizzard). They said it had broken into a Dutch police account in September 2024 using a stolen browser cookie and taken police officers’ work contact details, and that it targets defense ministries, contractors, and high-technology firms in NATO countries and organizations in Ukraine (The Record). No Russian response was reported. The AIVD’s annual report for 2025, presented in April 2026, added Russian attacks on the Signal and WhatsApp accounts of officials and military personnel and said Chinese efforts to acquire Dutch technology grew in 2025; Smit said, “The threat to national security has not come from so many directions and for so long” (DutchNews.nl).

Dutch intelligence in the news

Most public knowledge of Dutch intelligence comes from six cases. In each, the allegations come from Dutch services, prosecutors, or reporters, and the accused governments have denied them or not commented.

MH17 and the courts (2014–2025)

Malaysia Airlines flight MH17 was shot down over eastern Ukraine on July 17, 2014. On November 17, 2022, the District Court of The Hague, sitting at Schiphol, sentenced Igor Girkin, Sergey Dubinskiy, and Leonid Kharchenko in absentia to life imprisonment for causing the crash and for the murder of everyone on board, and acquitted Oleg Pulatov (Public Prosecution Service). The court found that a Russian-made Buk missile downed the plane and that Russia had “overall control” of the self-proclaimed Donetsk People’s Republic at the time. A Russian Foreign Ministry spokesman said, “We will study this decision because in all these issues, every nuance matters”; Moscow denies any involvement, and the convicted men remain at large (Al Jazeera). On May 12, 2025, the Council of the International Civil Aviation Organization found that Russia had failed to meet its obligations under international air law; Russia disputes the findings and blames Ukrainian forces (DutchNews.nl). The investigation also drew intelligence interest: the GRU officers caught in The Hague in 2018 carried a laptop that Dutch officials linked to activity in Malaysia connected to the MH17 inquiry.

The GRU at the OPCW (2018)

On October 4, 2018, Defence Minister Ank Bijleveld announced that the MIVD had disrupted an attempt by four officers of Russia’s GRU military intelligence to hack the OPCW in April, using equipment in a car parked near its headquarters in The Hague, and that the four had been expelled. She said a laptop belonging to one of them had been used in Brazil, Switzerland, and Malaysia, where the activity related to the MH17 investigation. U.S. prosecutors later charged the same four men in a wider GRU indictment. Russia’s Foreign Ministry said, “The Western spy mania is gathering pace,” and spokeswoman Maria Zakharova called the allegations a “diabolical perfume cocktail” (RFE/RL). No one has been tried.

The spy who wanted an ICC internship (2022–2023)

On June 16, 2022, the AIVD announced that in April it had refused entry to a GRU officer, Sergey Vladimirovich Cherkasov, who had traveled as a Brazilian, Viktor Muller Ferreira, to take up an internship at the International Criminal Court; he was sent back to Brazil on the first flight. Akerboom called it “very rare” to catch a Russian agent “of this caliber.” There was no immediate Russian reaction (The Moscow Times). Brazilian police arrested him for identity fraud. In March 2023, federal prosecutors in Washington charged him over alleged espionage in the United States, charges that remain untried because he is in Brazil, and Moscow sought his extradition on drug charges (Brussels Times). In 2023, a federal court in São Paulo reduced his sentence for document forgery, and Brazil’s justice minister said he would remain in Brazil until he served it (The Brazilian Report).

China, chips, and Nexperia (2024–2025)

After Coathanger, Dutch officials became more outspoken about China. In May 2025, Defence Minister Ruben Brekelmans told a conference in Singapore that China was stepping up espionage against the Dutch semiconductor sector and was “using their economic position for geopolitical purposes.” In September 2025, the caretaker economic affairs minister, Vincent Karremans, placed the Nijmegen chipmaker Nexperia, owned by China’s Wingtech, under state supervision, saying the government had seen intelligence that the owner meant to move the company’s intellectual property to China. Beijing reacted angrily and imposed an export ban on Nexperia chips made in China. In December 2025, the names and photos of six people China claimed were Dutch spies appeared on a Chinese-language website based in Hungary; the AIVD said it had “taken note of the article” and, as a matter of policy, would not discuss its officers (DutchNews.nl). China’s embassy had also denied the Coathanger accusation in 2024, as described above.

The chip engineer and the FSB (2025)

In July 2025, a Dutch court sentenced German Aksenov, a 43-year-old Russian engineer who worked in the Dutch semiconductor industry from 2015 to 2024, including at ASML and NXP, to three years in prison for violating EU sanctions. Prosecutors said he copied chip-production specifications from company servers to hand to an officer of Russia’s FSB security service in Moscow, and they had sought four years; the court found the material could strengthen Russia’s military and strategic capabilities. Aksenov denied wrongdoing and said he kept the files for professional use (The Moscow Times). Whether the verdict was appealed was not reported in the sources reviewed.

The teenagers with a Wi-Fi sniffer (2025)

In September 2025, police arrested two 17-year-olds on suspicion of espionage after a tip from the AIVD. According to the father of one, a pro-Russian hacker recruited his son on Telegram, and in August the boy walked past the offices of Europol, Eurojust, and the Canadian embassy in The Hague carrying a “wifi sniffer” that detects and intercepts nearby networks. The Public Prosecution Service declined to comment because of the suspects’ ages; one remained in custody and the other was placed under house arrest with an electronic tag. It was the first case of its kind to come to light in the Netherlands (DutchNews.nl). No verdict had been reported in the sources reviewed.

How to read coverage of Dutch intelligence

Dutch cases are easier to check than most, because the services, ministers, and courts say a great deal in public, and the parliamentary record is online. The harder problem is that the most dramatic stories, such as Cozy Bear and Crypto AG, rest on anonymous sources or leaked internal histories that the Dutch government has not confirmed. Public attributions are also policy choices: when the services name Russia or China, they are making an evidentiary claim and sending a diplomatic signal at the same time. Russian and Chinese denials come from governments with every reason to deny, and the Russian state media that amplify them are not independent sources; Dutch officials, for their part, have an institutional interest in budgets and powers that were debated hard in the 2018 referendum.

The discipline is the one taught in our guide to trend analysis: climb toward primary records. For the Netherlands, that means the Wiv 2017 on wetten.overheid.nl, the AIVD and MIVD annual reports, CTIVD review reports, parliamentary papers on officielebekendmakingen.nl, MH17 trial records, and the Nationaal Archief’s war archives. For lobbying by foreign governments in Washington, the U.S. Justice Department’s database of registrations under the Foreign Agents Registration Act (FARA eFile) is the place to check. When a story rests on a single anonymous source, treat it as a lead, not a finding.

Frequently asked questions

Related reading

• Intelligence Services Around the World: Structure, History, and the Headlines
• Qatari Intelligence: History, Structure, and the Headlines
• German Intelligence: History, Structure, and the Headlines
• Trend Analysis: How to Tell a Real Trend From Media Hype

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and the Netherlands and Europe; details are on the services page.