Summary

In public debate it is called the childcare benefits scandal. The Rutte III cabinet fell in January 2021 over parents who had been wrongly labelled as fraudsters and had to repay their childcare allowance. The Donner Committee spoke of human rights violations. The collective memory holds 26,000 affected families, divorces, debts, deaths.

That picture is not wrong. But it is incomplete. And the incompleteness is why the affair can repeat itself.

What actually happened was the visible surfacing of three developments that had been running through the Dutch Tax and Customs Administration since the 1990s. First: mass data collection on an IBM mainframe in Apeldoorn. Second: risk-driven profiling through dozens of algorithms that used nationality as a selection criterion. Third: chain spread to police, Public Prosecution Service, UWV (Employee Insurance Agency), SVB (Social Insurance Bank) and municipalities through at least ten collaborative partnerships.

The Tax and Customs Administration runs on COBOL programs that are sometimes more than 40 years old, housed on IBM mainframes that were still being replaced by the newest generation in August 2025 (IBM z17 + LinuxONE 5). The organisation has more than 100 selection instruments in use, of which more than 50 have no statistically validated basis and are therefore unlawful, according to Follow the Money based on a Woo request in October 2025. The algorithm register publishes less than 20% of them. The remaining 80% runs in the dark.

In that dark live 11 million Dutch citizens and 1.9 million SME entrepreneurs who are almost all included in the systems of the Tax and Customs Administration, usually without knowing it themselves.

It is time to call the affair by its right name. It is The Algorithm Affair of the Netherlands. And it is not yet over.

Part 1 — The thesis

The childcare benefits scandal is a misnamed affair

The parliamentary inquiry committee is officially called Parlementaire Enquêtecommissie Fraudebeleid en Dienstverlening (Parliamentary Inquiry Committee on Fraud Policy and Service Provision). The collective memory emphasises the human victims. That is not wrong, but it distracts from the system that made the victims.

What actually happened

The childcare benefits scandal is the visible manifestation of a structural convergence of three developments.

1. Mass data collection. The Tax and Customs Administration grew from 1998 into a data warehouse operator with access to at least 69 source systems (KPMG, 2025) and possibly 72 sources (SIG, 2016) combining fiscal and non-fiscal data on virtually every Dutch person. Sources range from tax returns and allowances to Land Registry, bank data, vehicles, notarial deeds and fraud information systems.

2. Risk-driven profiling. Since 1998 the Risk Analysis Model (RAM) ran, an environment in which staff could freely make selections on fiscal and non-fiscal criteria, in particular nationality. Amnesty International documented in 2021 that since 2013 a self-learning childcare allowance algorithm ran at the Toeslagen (Allowances) division that systematically used non-Dutch nationality as a risk factor. The Autoriteit Persoonsgegevens (AP, Dutch DPA) concluded in July 2025 that RAM “systematically” violated the law and that “discriminatory processing” had been carried out.

3. Chain spread. The results of this profiling did not stay within the Tax and Customs Administration. Through at least ten collaborative partnerships the data reached police, Public Prosecution Service, UWV, SVB, municipalities and health insurers.

The right name

The childcare benefits scandal is an algorithm affair. Or more precisely: an algorithm and infrastructure affair. The question is not how civil servants could be so cruel. The question is how an IT landscape that processes 70% of the financial transactions of the Dutch state in a COBOL-written mainframe environment in Apeldoorn could grow into a profiling system that for twenty years structurally violated citizens’ fundamental rights without any supervisor intervening.

That is the question. This dossier attempts to answer it.

Part 2 — COBOL: the forgotten language that runs the state

What is COBOL?

COBOL stands for COmmon Business-Oriented Language. The language was designed in 1959 by a committee led by Grace Hopper, an American mathematician and rear admiral in the United States Navy. The goal: a programming language for business applications that was readable by humans and ran on different brands of computers.

That broke with the standard of the time. Before COBOL, programming was machine-specific: code that ran on an IBM 704 did not work on a UNIVAC. COBOL brought the idea that code should be portable. An idea we now take for granted.

Why COBOL still runs

COBOL has gone from a rarity to an architectural fact. According to director-general Koos Veefkind of the Tax and Customs Administration (at the CWI event The Future of COBOL and Mainframe, 18 January 2024):

• 18% of the 900 systems of the Dutch Tax and Customs Administration is written in COBOL
• 70% of all financial transactions of the state runs via COBOL processes
• COBOL is at the heart of ICT for payroll tax, corporate tax and data processing

This is not a Dutch peculiarity. Worldwide, the majority of banking, insurance and government financial systems run on COBOL. The rule of thumb: 70-80% of all business transactions worldwide runs on COBOL.

The strength of COBOL

COBOL has three properties that make it difficult to replace to this day.

1. Decimal exactness. COBOL naturally calculates in exact decimals, not in floating-point binary approximations. For financial amounts that is indispensable. A difference of one cent across millions of transactions quickly produces tons of errors.

2. Batch processing. COBOL was designed for processing large quantities of records in one batch. That is exactly what a tax administration needs: every night millions of returns, supplementary assessments, recoveries and refunds.

3. Stability. A COBOL program written in 1985 still runs. There are programs active that are more than 40 years old. That is unthinkable for JavaScript or Python.

Why no one learns COBOL anymore

Here lies the real problem. COBOL has barely been taught at universities and colleges since the 1990s. Students massively choose Python, JavaScript or Java. The consequence: there is a global shortage of COBOL programmers, and the average COBOL programmer is nearing retirement age.

For the Tax and Customs Administration this means specifically:

• In the coming years ~1,000 person-years of COBOL experience must be replaced (Veefkind, 2024)
• Only three major vendors worldwide still offer COBOL-related services → vendor lock-in
• The sole administrator of the Recovery Support Programme (IHP) retires in 2026 → knowledge evaporation

This is not a futuristic scenario. This is the Tax and Customs Administration apparatus of today.

But COBOL is not ‘dead’

Having said that: anyone who thinks COBOL is a “dead language” that necessarily must be replaced by something more modern is wrong. IBM is still actively developing Enterprise COBOL for z/OS. Version 6.5 became generally available on 13 June 2025. IBM fully supports this product line and describes COBOL as a full-fledged high-level programming language for large-scale commercial data processing.

What “actively developed” means here: not that IBM invents a completely new language every year, but that the compiler and language environment are continuously evolved:

COBOL
  │
  ├── existing syntax preserved (backward compatibility)
  │
  ├── new compiler optimisations
  ├── Unicode / XML functionality
  ├── Java interoperability
  ├── support for new IBM Z processors
  ├── support for new z/OS versions
  ├── security updates
  └── integration with Db2 / CICS / IMS / modern tooling

And new COBOL code is still being written. That happens mainly in the form of new business rules, new modules, modifications to existing programs, new database interaction, links with Java/APIs, new batch processes, and new selection and calculation logic. A COBOL program newly written in 2014 for the Tax and Customs Administration was therefore not “heritage” or “legacy” — it was modern COBOL on a modern IBM Z environment.

What is more: tools now exist that automatically analyse COBOL code and attempt to transform it into Java, precisely because organisations still have enormous COBOL codebases they want to modernise. A recent study on arXiv (2025) evaluates the quality of COBOL-to-Java transformation and confirms this is an active research and industry field.

The problem of the Tax and Customs Administration is therefore not that COBOL is inherently “bad” or “outdated.” The language performs excellently for what it was designed: massive, precise, batch-mode data processing. The problem is that the knowledge is evaporating, that the complexity of the codebases has become too large to modify safely, and that the organisation that must manage these systems does not have the capacity to modernise them — let alone to add new functionality without breaking existing logic. That is a management and personnel problem, not a technology problem.

Why a new IBM mainframe does not solve the problem

In August 2025 the Tax and Customs Administration took the IBM z17 + LinuxONE 5 into use. Newest generation, fastest hardware, AI integration. But that new hardware does not make the old COBOL programs new. And here the fundamental misconception that often lives in public debate comes to the surface: a new mainframe is not a “reset button.”

You cannot simply “transfer”

The idea “then we just move the old COBOL programs to the new mainframe” is wrong. What is possible: the new IBM Z can run the old z/OS environment via compatibility layers. The old COBOL then runs physically on the new hardware. But the program code itself does not change. The knots, the undocumented dependencies, the embedded business logic — everything stays the same. You have a faster engine, but the same car with the same defects.

What you can do — and what the Tax and Customs Administration partly does — is link old and new systems via middleware, APIs and integration layers. New Java applications can call old COBOL programs via CICS transactions. Modern web interfaces can be placed on top of old batch processes. But that is building a bridge, not rebuilding the house. The old foundations remain standing, and as long as nobody knows where the cracks are — because the blueprints are missing — every renovation is a gamble.

The knowledge is in heads, not in documentation

This is perhaps the most fundamental problem of the Tax and Customs Administration ICT, and it is rarely stated explicitly. The COBOL and Cool:Gen programs that run the core of the tax system are largely insufficiently documented. Not because the language is illegible — COBOL was designed to be readable — but because the developers who built these systems decades ago did not or barely write down their choices and logic.

The reasons are recognisable to anyone who has worked in a large organisation:

• Deadline pressure — the functionality had to work, documentation came “later” (and later never came)
• Locally devised — the State Secretary acknowledged in House document 31066-1066 that “the activities for selection at the Gate were locally devised.” What originates locally is rarely documented nationally
• Oral culture — if you know the person who built it, why write it down? You just walk over to their desk
• No investment in recording — the Tax and Customs Administration has for decades not prioritised maintenance and documentation; the ICT budget went to new functionality, not to recording existing systems

The result: the knowledge of how these systems work — which subroutine calls which other, which fields depend on which tables, which business rules sit in which programs — lives in the heads of a small number of employees. And those employees are retiring. The sole administrator of the Recovery Support Programme (IHP) retires in 2026. In the coming years ~1,000 person-years of COBOL experience must be replaced. But you cannot replace 1,000 person-years if those years were never written down.

This is the real legacy of the Tax and Customs Administration ICT: not that the technology is old, but that the knowledge of that technology is evaporating. And once the knowledge is gone, the code is nothing more than a tangible archive of decisions that no one can retrace — precisely the situation the KPMG report describes for RAM: “the recording of the calibration of the criteria and parameters on which the queries select appears very limited and insufficiently available.”

Part 3 — The mainframe: IBM z17 in Apeldoorn

The physical reality

These algorithms do not run in the cloud. They run on an IBM mainframe physically located in the National Data Center Apeldoorn (Quintax complex, with twin location Walterbosch/Kennedylaan). The complex is “the size of a football pitch and full of computers.” All privacy-sensitive tax data of Dutch taxpayers is stored here. The Tax and Customs Administration manages these data centers “100% in-house, there are no external parties.”

In August 2025 the Tax and Customs Administration took a new mainframe into use: the IBM z17 in combination with the IBM LinuxONE 5. This is the newest generation of IBM mainframes, originally launched in April 2025 with specific AI hardware. State Secretary Tjebbe van Oostenbruggen (VVD) visited the data center and confirmed the purchase. He stated that “data of citizens and companies on the mainframe stays locally, without the intervention of the cloud.”

Twin data center architecture in Apeldoorn

The IBM mainframes of the Dutch Tax and Customs Administration are mainly located in Apeldoorn. For its ICT infrastructure — managed by the Centrum voor Infrastructuur en Exploitatie (B/CIE, Centre for Infrastructure and Operations) — the Tax and Customs Administration uses a mirrored twin data center, officially called the Overheidsdatacenter (ODC, Government Data Center). It is not just a Tax and Customs Administration complex: as part of the Compact Government Service Delivery Programme (Uitvoeringsprogramma Compacte Rijksdienst), the national government consolidated 66 scattered data centers into four major locations, of which ODC Apeldoorn is one.

Both data centers are physically separated, but linked through a fast, low-latency fibre optic connection. The IBM mainframes and the rest of the server park are duplicated (mirrored). Should a disruption or calamity break out at one location — fire, power failure, break-in — the other location can immediately take over the processing of tax returns and financial data. For an administration that processes €375 billion in tax revenue annually, that continuity is not a luxury but a hard requirement.

The renovation was carried out by Heijmans commissioned by the Rijksgebouwendienst (Government Buildings Agency), in close collaboration with the Tax and Customs Administration. The construction phase took approximately two years, with the special challenge that all operational systems of the Tax and Customs Administration had to remain online during the renovation. The computer rooms were reconfigured with cold corridors, and a new energy house was built.

Technical specifications

Security and users

The sites qualify as heavily secured government complexes with:

• Strict physical access control — limited access for employees with the appropriate clearances
• Advanced extinguishing systems — including gas suppression (such as FM-200 or Inergen) rather than water, to protect electronics
• Own power supply — redundant power supply with UPS systems and emergency generators for continued operation during grid failure

Within the data centers all data of “BV Nederland” (the Netherlands Inc.) runs on redundantly configured servers. This concerns applications, decisions and benefits correspondence, return data, import and export data and VAT payments. Users of the computer center are the Tax and Customs Administration (including the former Toeslagen division), the Douane (Customs) and the FIOD (Investigative Service). In the near future the complex will also be opened to other government services.

This architecture — twin data center with active mirroring — is typical for critical government infrastructure and matches the design at major banks, defense facilities and telecom hubs.

From 66 to 4: the consolidation of government data centers

The Apeldoorn twin data center is part of a broader government-wide consolidation. As part of the Compact Government Service Delivery Programme (Uitvoeringsprogramma Compacte Rijksdienst), the national government consolidated 66 scattered data centers into four major locations, of which one in Apeldoorn. The original policy documents spoke of 64 data centers (source: open.overheid.nl CRD-4 document), later corrected to 66 (Computable, July 2013).

Of the four locations, only Apeldoorn is publicly known as housing the Tax and Customs Administration mainframes. The other three locations are managed by the broader national government (via SSC-ICT Utrecht) and house other ministries and services. The exact locations of those other three are only partially documented publicly.

                ╔═══════════════╗
                ║   GRONINGEN?  ║     ← Location 2 (not publicly confirmed)
                ╚═════════╤═════╝
                          │
       ╔══════════════════╧════════════════╗
       ║          NORTH-HOLLAND             ║
       ║       Amsterdam / Haarlem?         ║     ← Location 3 (not publicly confirmed)
       ╚══════════════════╤════════════════╝
                          │
   ╔══════════════════════╧════════════════════╗
   ║               ★ APELDOORN ★                ║     ← Location 1 (KNOWN)
   ║                                           ║
   ║   ODC 1: Quintax complex                  ║
   ║   ODC 2: Walterbosch (Kennedylaan)        ║
   ║   Operator: B/CIE Tax and Customs Admin   ║
   ║   IBM z17 + LinuxONE 5                    ║
   ║   4 petabyte storage                      ║
   ║   1 megawatt power                        ║
   ╚══════════════════════╤════════════════════╝
                          │
       ╔══════════════════╧════════════════╗
       ║          SOUTH-HOLLAND             ║
       ║    The Hague / Rijswijk?            ║     ← Location 4 (not publicly confirmed)
       ╚═══════════════════════════════════╝

The consolidation in numbers:

The consolidation from 66 to 4 data centers was not a tax administration project but a government-wide programme. The Apeldoorn twin ODC is however the largest and most critical location, because it houses the mainframes that keep the entire tax system running — from returns to allowances, from recovery to risk selection.

Brief mainframe history of the Tax and Customs Administration

What runs on the mainframe?

According to public sources, the following run on the mainframe:

• All mass transactional processes for tax and premium collection
• Assessment Tax System (ABS) in Cool:Gen (4GL from the 1980s, COBOL-like) — indispensable for income tax
• Wage tax processing (HLP system)
• VAT system — “more than 40 years old and changes other than very limited are hardly possible” (Technical briefing 2023)
• First data warehouse of the Tax and Customs Administration — partly developed in COBOL with Db2 as database

Why migration to “the cloud” is not simple

There is a tendency in public debate to say: “then we just move those old systems to the cloud, right?” That is a misunderstanding this dossier explicitly wants to puncture.

A mainframe-to-cloud migration is not a “copy-paste operation”. It is a reconstruction. Here are the reasons why this is specifically complex for the Tax and Customs Administration.

1. Scale and business criticality

The Tax and Customs Administration processes €375 billion in revenue annually (2024 Annual Report). One week of VAT revenue is approximately €1.5 billion. If the VAT system is down for one week, that is the budget of a medium-sized municipality. There is no room for “trial and error”.

2. “Knotted” code

Mainframe COBOL programs are rarely modular. They are often “knotted together” — subroutines calling other subroutines, with shared data structures, in cycles that have grown for decades. This is technically a form of extreme coupling. Replacing a single subroutine can have unforeseen effects elsewhere.

3. Business logic baked into code

Decades of tax legislation have been literally translated into COBOL code. Every article of law, every implementing regulation, every INT message, every policy rule is in the code. A migration does not just mean translating code, but re-documenting the entire body of tax law in a new form. That is a scientific-legal exercise of unprecedented scale.

4. Personnel

The people who built these systems are retired or deceased. The knowledge is not in documentation but in heads. And the heads that still have knowledge are done.

5. Continuous workload

The mainframe cannot go offline. Returns, recovery and refund processes run 24/7. There is no “upgrade window”. There is only nightly batch processing that must be ready for the next working day.

6. Test complexity

A modern system can be tested with unit tests, integration tests, end-to-end tests. A 40-year-old mainframe system with millions of lines of code has no test suite. You can only black-box test: input → output → cross fingers. At the Tax and Customs Administration, a failed test means €1.5 billion per week.

Cool:Gen: the other legacy problem

In addition to COBOL, the Tax and Customs Administration has a large number of systems in Cool:Gen. This is a 4GL (fourth-generation language) from the 1980s that strongly resembles COBOL but with its own syntax and tooling. The Assessment Tax System (ABS), which processes income tax, is written in Cool:Gen.

The number of IT staff with Cool:Gen knowledge “is rapidly decreasing” and is “currently very limited available”. The original planning was that Cool:Gen would be fully phased out by the end of 2026. In October 2024, State Secretary Folkert Idsinga (NSC) moved that deadline to the end of 2027. According to the Algemene Rekenkamer (Netherlands Court of Audit), even that date is optimistic.

The FAST Enterprises affair

A case study in how migrations fail: in 2024 the Dutch VAT system was tendered. FAST Enterprises, an American company, won the tender with their product GenTax. Value: €190 million. The alternative was SAPTRM (SAP), implemented by Capgemini.

In 2026 the Tax and Customs Administration partly reversed this decision. The servers would come into the administration’s own data centers, in-house management, to limit American influence (the so-called Trump risk: an American president who could block Dutch VAT revenue via FAST Enterprises). Bert Hubert wrote his analysis “btw-as-an-American-service” about this. The balance between modernisation and digital sovereignty has become an essential part of Dutch IT policy.

Part 4 — The algorithmic landscape

What is an algorithm really?

Before we map the landscape, we must clear up a misunderstanding. In public debate algorithm sounds like something mysterious, mathematical, incomprehensible. But an algorithm is in essence simple: an instrument. A recipe. A set of instructions that a computer executes to get from input to output. Just as a blender is a kitchen instrument, or a hammer is a carpentry instrument, an algorithm is a decision-making instrument.

That insight matters because it changes the debate. We do not ask “which incomprehensible AI did this?” We ask: “which instrument did the Tax and Customs Administration deploy, who designed it, based on what criteria, and with what legal basis?” An instrument is something you can inspect, can shut down, can forbid. An algorithm too.

That is why the Autoriteit Persoonsgegevens and KPMG consistently use the term selection instrument. That is exactly what these algorithms do: they select citizens based on criteria. Sometimes those criteria are transparent and statistically validated. Often not. Sometimes a human makes the final decision. Often not. Sometimes there is a legal basis. Often not.

In the rest of this investigation we use algorithm, selection instrument and risk model interchangeably — because they are different words for the same kind of tool. The question is always: what does the instrument do, who wields it, and against whom.

100+ selection instruments, >50 unlawful

The childcare benefits scandal proved one specific algorithm — one single instrument from an arsenal of more than a hundred. The self-learning childcare allowance algorithm at the Toeslagen division that since 2013 used nationality as a risk factor (Amnesty International, “Xenophobic Machines”, October 2021). That one instrument has since been shut down. But it was not an exception. It was the instrument that happened to come to light.

Follow the Money reported in October 2025 based on a Woo request:

The Tax and Customs Administration has more than 100 selection instruments in use. More than 50 of them have no statistically validated basis and are therefore unlawful and potentially discriminatory.

One hundred instruments. Fifty without a sound basis. That is not a case of one wrongly designed algorithm, but of a complete arsenal of which half does not meet the basic requirements of the rule of law.

Only a fraction of these instruments has been tested for bias or discrimination. Some algorithms work without human intervention — which violates Article 22 of the GDPR (automated decision-making with legal effect). The algorithm register at algoritmes.overheid.nl showed in August 2026 a total of 1,533 algorithms, of which only 18 are explicitly attributed to the Tax and Customs Administration. The gap between what runs and what is public is at least a factor of five.

The main systems

RAM (Risk Analysis Model, 1998-2018)

RAM was not an algorithm in the strict sense. It was a data warehouse in which staff could freely make selections on data from at least 69 sources. Since 1998 the instrument grew into an environment in which approximately 20,000 selections per year were made (2017). KPMG found 1,170 unique RAM spreadsheets in 2025, of which 14 selected on first or second nationality (Bulgarian, Romanian, Afghan, Albanian). The Autoriteit Persoonsgegevens concluded on 9 July 2025 that RAM “systematically” violated the law and that “fundamental rights of citizens were seriously violated.” A fine was not imposed due to statute of limitations.

FSV (Fraude Signalering Voorziening, 2013-2020)

FSV was the fraud list on which the Tax and Customs Administration stores signals about potentially fraudulent citizens. The system was taken offline in February 2020 after the AP declared it unlawful. In 2020, more than 100,000 unknowing registered persons were counted. The AP imposed a fine of €3.7 million in July 2020 — for a government organisation with a budget of billions, a fraction of a working day.

KTA (Klantbeeld Toezicht Applicatie, 2013-present)

KTA is the “godmode” of the Tax and Customs Administration. The system displays in one screen all (personal) data the administration has about one citizen or entrepreneur, including calculations. The system has 18,000 employees as users, all with the same authorisation role. Export is not logged. The AP demanded immediate replacement on 9 July 2025. The Tax and Customs Administration states that KTA will only be fully replaced by Inzicht in 2028.

Informatiesjabloon

The Informatiesjabloon (Information Template) is a procedure for staff to request and deliver large quantities of personal data in Excel format. The AP argues that this causes personal data to leave the secured systems of the Tax and Customs Administration, resulting in loss of control. The system is used for deliveries to police, Public Prosecution Service, RIEC and iCOV. In 2024 it covered approximately 38,000 subjects. The AP demanded immediate replacement in July 2025. Current planning is 2027.

Gruff

Gruff is a visualisation tool with which the Tax and Customs Administration can visualise networks of persons, companies and objects. The system has about 60 users and processed 13,500 subjects in 2024. Gruff stops in September 2026.

IHP (Invorderings Hulp Programma)

IHP (Recovery Support Programme) gives staff an overview of outstanding debts, letters and corrections. The system has been active since 2005, has 2,000 users, and is being dismantled in Q2 2026. Notable detail: the sole administrator of the system retires in 2026.

SMOB (Selectie Module OB)

SMOB is the customer image module for VAT, active since 2001 with 2,300 users. The system previously delivered “hit list” checks. Replacement by the new VAT package is foreseen in 2027.

PRISMA (Douane)

PRISMA is the risk selection system of the Douane (Customs), active since 2005 without replacement. The system has 40 users and contains only company data. Still, it may conflict with Article 22 GDPR (automated decision-making) in cases where no “experienced eye” weighs in.

Other and overlapping systems

In addition to these seven systems investigated by the AP, the Tax and Customs Administration has at least another 100 selection instruments in use. A small selection:

• RDM (Regio Data Model / Risicomodel Rivierenland) — SME-specific layer on top of RAM, with compliance colours
• RAT family (Risk Analysis Tools): RAT StiVer, RAT ANBI, RAT Follow the Money, RAT Verhuurdersheffing
• Risk Model Wage Tax
• Analyse aan de Poort (Analysis at the Gate) — risk analysis for income tax returns, investigated by PwC due to nationality + age as fraud risk factor; removed in 2021
• ZVP (Zeer Vermogende Personen / Very Wealthy Persons) — integral treatment of persons >€25 million wealth
• FD-monitor (Fiscaal Dienstverleners / Tax Service Providers monitor) — temporarily not deployed for enforcement after unlawfulness
• Projects: Lekkerbek (fish stalls), Security companies, Cleaning sector, Amsterdam Taxi companies, Bulgarian fraud, Dual nationality checks

The scale: 900 systems, 300 applications — but no complete public name list

Before proceeding, we must be honest about what we do not know. The Tax and Customs Administration counts, by its own account, 900 systems, 300 applications and 43,000 digital workstations, managed by about 4,400 IT staff in 30 different programming languages. This figure appears in House document 31066, no. 1002, in the Ministry of Finance introduction dossier, and in multiple House letters on ICT.

But — and this is the problem — there exists no complete public name list of all these 900 systems. The House of Representatives has repeatedly asked for insight into the application landscape, but keeps receiving only categories, numbers and top systems. The names of the other 880+ systems are nowhere publicly listed.

The most detailed public list that exists comes from two sources. In House document 31066-1066 (21 June 2022) the House asked: “Which 71 other sources did the Risk Analysis Model (RAM) use, besides FSV?” The State Secretary gave only the top 25 — not all 71. The remaining 46 were withheld until the KPMG report of February 2025, which published 69 source systems with name and description (KPMG table 3.2.1.1.2).

The complete list of 69 RAM source systems (KPMG, 2025)

Source: KPMG, Report investigation Risk Analysis Model (RAM) at Tax and Customs Administration, Dienst Toeslagen and Customs, 25 February 2025, table 3.2.1.1.2.

Key observations from this list:

• FSV (no. 24) was a standard source in RAM — an FSV registration automatically ran as a risk indicator (House document 31066-1066, question 113)
• PHT (no. 51) — Postcode House Number Addition — was in the ODW-RAM-FleXviewer with template “06b Region by nationality”
• TSL HUUR / KGB / KOT / ZORG (no. 59-62) — all four allowance types (rent, child-related, childcare, healthcare) were included as sources in RAM. Dienst Toeslagen had only one direct RAM query in 2017, but the allowance data of all citizens was available in RAM
• RBG (no. 53) — Registration Bank Data: bank data of citizens in a risk model
• RIS (no. 54) — Intelligence: intelligence/signals about citizens in a risk model
• GEFIS (no. 26) — Integrated Fraud Information System: including criminal data
• ZVP (no. 69) — Very Wealthy Persons: shares administration of the richest in a risk model that also selected the poorest

The seven “RAM-comparable” systems investigated by the AP (KTA, Informatiesjabloon, Gruff, IHP, SMOB, PRISMA, plus the already phased-out RAM) are separately documented in the AP report of 9 July 2025. But that brings the total of systems known by name to approximately 80 out of 900 — less than 10%.

What runs on the other 820 systems? What data do they process? Which are written in COBOL, which in Cool:Gen, which in Java? Which have already been phased out and which are still running? The Tax and Customs Administration does not make this information public. The House has asked repeatedly. The answer remains stuck at numbers and top systems.

This is one of the reasons why this investigation includes the ten Woo requests. Without a complete public list of Tax and Customs Administration systems, independent oversight of the algorithmic infrastructure of the Dutch state is impossible.

Algorithm register: structurally incomplete

The algorithm register at algoritmes.overheid.nl showed in August 2026 a total of 1,533 algorithms from Dutch government organisations. Of these, only 18 are published under the Tax and Customs Administration. For an organisation with 100+ selection instruments, that means a publication rate of less than 20%. And what is published consists of relatively harmless systems (signalling models, refund algorithms, optimal allocation of fiscal partners). The impactful, profiling-based instruments remain out of view. The gap between reality and register is structural.

Part 5 — The disappeared data vault

A vault with 64 million files that nobody searched

In May 2019, around the introduction of the GDPR, the Tax and Customs Administration created a shielded digital environment it itself called the “data vault” (datakluis). Officially an emergency measure: the administration would not meet the GDPR deadline of 25 May 2019, and therefore decided to move outdated personal data to a shielded environment. The vault explicitly had “no archive function” — but the promised follow-up step (assessing what to delete, keep or restore) was never carried out.

In April 2026, seven years later, the vault was found to contain at least 64 million unsorted files. In May 2026, House letter 2026D24511 confirmed that 24.3 million of these were substantively relevant. Two million of them Excel files. One thousand and four mailboxes of employees of the former Toeslagen division. More than 180,000 ZIP files that had not yet been extracted.

The important thing is not the number. The important thing is that this vault was not searched in any parliamentary investigation. Not by the Parliamentary Inquiry Fraud Policy and Service Provision (PEFD). Not by the POK investigation. Not by the FSV, CAF or RAM investigations. Not by the KPMG investigations. Not by the AP investigation.

The official excuse: “references had an index.html”

When the House debate of 26 May 2026 asked how this was possible, the House got a technical-sounding answer. At the place where the files originally stood, only a reference in HTML format had been left behind. That file type was not included in the search actions for the PEFD. The vault itself was therefore invisible to the search software.

That sounds like an accident. A technical error. A forgotten file extension.

But the facts tell a different story. This is not about one forgotten file type. This is about a systematic exclusion of HTML in all PEFD search actions — a file type that occurs millions of times on the Tax and Customs Administration network. And it was not about one search action, but about a series of search actions running from 2020 to 2024, with multiple moments when it should have been noticed that HTML was systematically skipped.

The technical reality: HTML structurally excluded from indexing

The Tax and Customs Administration received on 19 October 2022 a list of file extensions that would be searched in the PEFD search actions. HTML was not on that list. The search software was therefore instructed: skip everything ending in .html or .htm. Millions of files fell out of view as a result.

The question is: was this a technical choice or a deliberate choice?

Senior official Teusjan Vlot declared during the debate of 26 May 2026 that he had personally approved the extensions PEFD used. So those are not the extensions PEFD itself had devised. Those are the extensions the Tax and Customs Administration proposed to PEFD, and that Vlot personally approved. The same search actions that systematically excluded HTML.

That is not an accident. That is a choice. A choice that resulted in the parliamentary inquiry committee — the highest conceivable investigative power in a democracy — receiving an incomplete file.

The timeline of obstruction

The distance between 31 July 2025 (signalling to State Secretaries) and 15 April 2026 (House informed) is 258 days. During that period, Woo requests, GDPR requests and ongoing lawsuits were all running, all without the data vault being mentioned.

Why this is worse than “a forgotten extension”

The official excuse suggests the Tax and Customs Administration accidentally skipped HTML. But there are three reasons why that excuse does not hold.

1. HTML is not a rare file type. It is the standard format for web pages, documentation, and — relevant for an administration that has been building intranet applications for decades — for internal references. Anyone who excludes HTML excludes millions of files. Every IT person who drafted the list knew that. Teusjan Vlot knew it when he approved.

2. The search actions ran for years. From 2020 through 2024, the PEFD searched Tax and Customs Administration systems. In those four years, at no point did anyone think to check whether the exclusion of HTML had consequences? No one wondered whether files were missing?

3. The data vault was no secret. The vault was created in May 2019, formally decided in MT BD, and again brought to the attention of the State Secretaries in July 2025. In the 2022-2024 search actions, the vault was known. Still, it was not searched.

The broader pattern: what was not indexed

The HTML exclusion was not the only thing that hampered the search actions. The same debate revealed:

• Employee mailboxes at scale 16+ possibly missed in PEFD search actions (Stavers)
• Q-drives and Connect People environments — personal work environments of employees, still not searched in 2026
• 1,004 mailboxes of employees of the former Toeslagen division, safeguarded in May 2020, never searched
• Excel files on network drives without archive management, not searched

The state speaks of “one data vault”. The reality is an archipel of shielded environments: data vault, mailboxes, Q-drives, Connect People, HTML references. None of these has been systematically searched. Together they form an invisible archive of what the Tax and Customs Administration actually did with the data of 11 million citizens in the 2013-2020 period.

The legal grounds that were violated

OpenBrief’s call

OpenBrief has long called for:

1. An independent external committee to systematically search the data vault — not a committee set up by the Tax and Customs Administration itself
2. Full disclosure of the list of file extensions provided to PEFD in 2022, including all versions and modifications thereof
3. Personal accountability for the officials who approved the HTML exclusion, in particular Teusjan Vlot
4. A parliamentary inquiry into the obstruction itself, separate from the content of the files

Without these steps, the data vault remains what it was for seven years: a disappeared archive of an algorithmic affair.

Part 6 — The chain: from tax return to bankruptcy

How a “suspect” citizen moved through the algorithmic landscape of the Dutch government — and moves.

Step 1 — Application or return

A citizen applies for childcare allowance, files an income tax return, or starts a sole proprietorship. The data comes in via the Toeslagen website (logged in Heidi) or via the BelastingTelefoon / digital return.

Step 2 — Self-learning algorithm Toeslagen (2013-2019)

The application passes a self-learning risk model at the Toeslagen division. The model uses nationality as one of the risk factors. Non-Dutch nationality produces a higher risk score. The model learns without human oversight, creating discriminatory feedback loops (Amnesty International, “Xenophobic Machines”, October 2021).

Step 3 — Suspension and flagging

At “high risk” the allowance is suspended. The citizen must repay everything. The official signing the decision gets no information about why the system flagged the application — it is a black box (IEEE Spectrum, 2021).

Step 4 — FSV registration (4 November 2013 - 27 February 2020)

The citizen is placed on the FSV list. The signal is shared with UWV, SVB, municipalities, Public Prosecution Service, police, chain partners LSI/RIEC/iCOV. In 2019 there were 58,500 persons with the “highest risk profile”; more than 100,000 people did not know they were registered.

Step 5 — CAF-11 collective action

In 2014, 232 parents in the context of CAF-11 (Combiteam Approach Facilitators 11, in the context of the Bulgarian fraud) collectively had their allowance suspended. This later became the pivot of the childcare benefits scandal. The CAF-11 compensation scheme was set up separately.

Step 6 — RAM enrichment

For tax supervision and investigation: RAM combines fiscal and non-fiscal data (nationality, debts, Chamber of Commerce, Land Registry, WOZ, criminal). Free selection on 1st/2nd nationality (Bulgarian, Romanian, Afghan, Albanian) was possible without objective justification. Approximately 20,000 selections per year (2017).

Step 7 — Recovery via IHP

The resulting debts become visible in IHP (Invorderings Hulp Programma / Recovery Support Programme). The citizen receives collection orders, recovery costs, and ultimately a bailiff.

Step 8 — Chain spread

Via Informatiesjabloon and other tools, the data reaches RIEC, LIEC, LSI, iCOV, FEC, BIBOB, CT infobox, Healthcare Fraud Node. The police can use the data in a criminal investigation. The municipality can use the data for a social assistance investigation. The UWV can use the data for a benefit trajectory.

Step 9 — Social consequence

The citizen gets into debt, loses their home, can no longer get a mortgage, becomes unemployed, develops psychological problems, leaves their family, or — in a number of cases — dies. The Donner Committee concluded in 2022 that human rights violations had occurred.

Step 10 — No legal protection

The citizen cannot defend themselves. They do not know they have been selected in an algorithm. They do not know they are on a fraud list. They cannot object to the risk score. The Supreme Court ruled in 2021 that evidence from discriminatory selection is inadmissible — but that may mean that millions of assessments are challengeable, a problem the Tax and Customs Administration surrounds with silence.

Part 7 — International parallels

The Dutch childcare benefits scandal is not unique. It fits an international pattern of automated state harm — the systematic disadvantaging of citizens by failing or discriminatory algorithms.

Robodebt (Australia, 2016-2019)

The Australian Online Compliance Intervention system, better known as Robodebt, automatically calculated “debt” against citizens receiving welfare benefits. The algorithm made systematic errors and demanded an average of A$3,000 back per citizen. A Royal Commission concluded in July 2023 that the system was “crude, cruel and unlawful”. Approximately 500,000 wrongful debt notices were repaid, totalling A$1.8 billion.

Horizon IT (United Kingdom, 1999-2015)

The Horizon system by Fujitsu at the British Post Office caused more than 900 wrongful prosecutions of subpostmasters. The errors in the system were known at Fujitsu but were concealed for decades. It is considered the largest series of wrongful convictions in British legal history. Dozens of convicts died before they were exonerated.

SyRI (Netherlands, 2014-2020)

The Systeem Risico Indicatie (System Risk Indication, SyRI) was used by the Government to generate risk indications in neighbourhoods with many “signals”. The District Court of The Hague ruled on 5 February 2020 that SyRI violated Article 8 ECHR. The system was mainly deployed in poor neighbourhoods in Rotterdam. The judgment was a precedent for privacy and algorithmic transparency.

DUO fraud algorithm (Netherlands, until 2024)

The Ministry of Education used a risk model for student finance and benefits that disproportionately affected students with a migration background. The AP imposed a fine at the end of 2024. The criteria were largely based on “experience and common sense” — the same wording that also frequently appears at the Tax and Customs Administration.

Common pattern

All these affairs share six characteristics:

1. Efficiency obsession — political pressure to tackle “fraud” hard leads to risk-driven systems without safeguards
2. Black box systems — neither citizen nor official knows why a decision is made
3. Burden of proof on citizen — the system is “truth”; the citizen must prove otherwise
4. Weakest groups disproportionately affected — the poor, migrants, single people
5. Regulators enforce late and softly — the AP imposed only one fine on the Tax and Customs Administration in 5 years
6. “Never again” promises not kept — after every affair follows “never again”, while the systems just keep running

Conclusion

The childcare benefits scandal is not resolved. It is not even correctly named. What passes in public debate for an incidental bureaucratic cruelty is in fact the visible manifestation of a structurally failing algorithmic ecosystem deeply anchored in the Dutch state.

The Tax and Customs Administration runs on COBOL systems that are sometimes more than 40 years old, housed on IBM mainframes in Apeldoorn that in 2025 were still being replaced by the latest generation hardware. Knowledge of these systems is evaporating: in the coming years 1,000 person-years of COBOL experience must be replaced. At the same time, the Tax and Customs Administration has 100+ selection instruments in use, of which more than 50 without statistically validated basis and therefore unlawful. The algorithm register shows less than 20% of them. The remaining 80% runs in the dark.

In that dark live 11 million Dutch citizens and 1.9 million SME entrepreneurs who are almost all included in the systems of the Tax and Customs Administration. Most of them without knowing it themselves. The childcare benefits scandal was the first time the consequences of this system came out so loudly that a cabinet fell. But RAM, FSV, KTA, Informatiesjabloon, Gruff, IHP, SMOB, PRISMA, the RAT family, Analyse aan de Poort — they are all still running. Or have only just been replaced by a next generation that makes the same architectural choices.

The state profiles on. Not in secret — the House of Representatives has been informed. But the consequences are lacking. No official or officeholder has been held personally accountable. No successor system has been taken out of use. The data vault with 64 million files is not being systematically searched. The mayor of Apeldoorn and the directorate of the Tax and Customs Administration proudly show visitors the renewed data center. The IBM z17, the LinuxONE 5, the AI hardware — the new mainframe is a source of national pride. What they do not tell is that the same hardware runs a system that the Autoriteit Persoonsgegevens calls “systematic violation” and that “seriously violated citizens’ fundamental rights.”

It is time to call the affair by its right name.

It is The Algorithm Affair of the Netherlands.

And it is not yet over.

Do you have information? Public call to share sources

This investigation is a living document. It will be updated as new information becomes available. We request citizens, officials, Woo litigants, journalists, academics and whistleblowers to share information that can contribute to a more complete picture of the algorithmic infrastructure of the Dutch Tax and Customs Administration.

Ten Woo requests we would like to see filed or supported

The following Woo requests have not yet been filed or not fully answered at this time. Have you filed these or similar requests, or do you have (parts of) the answers? Contact via Open Brief Network. We treat sources confidentially if desired.

Do you have one of the following documents?

We are specifically looking for:

• WRR Working Paper 021 “Big Data for Fraud Enforcement” (April 2016) — ISBN 978-94-90186-30-2
• Internal TC advices from 2021 and 2022 on stopping 3 SME algorithms (reported by FTM)
• Technical briefings Tax and Customs Administration ICT 2023-2026 — not just House summaries
• Covenants Tax and Customs Administration ↔ RIEC/LIEC/LSI/iCOV — current versions
• PRISMA validation reports (Customs) — bias and discrimination tests
• Toeslagen documentation CAF-11 — all 232 individual files (anonymised)

Already in our possession thanks to online availability:

• ✅ Donner report “Omzien in verwondering 2 — Final advice” (12 March 2020, 98 pages) — blg-926526
• ✅ WRR Working Paper 021 (April 2016) — downloaded via wrr.nl
• ✅ AcICT advice Rationalise Cool:Gen Income Tax (16 April 2025) — downloaded via adviescollegeicttoetsing.nl
• ✅ PwC investigations FSV effects (2022, SME + Toeslagen versions) — tweedekamer.nl/downloads/document?id=2022D07421 and eerstekamer.nl/overig/20220329/pwc_onderzoek_fsv_mkb/document

Share anonymously

Are you a (former) employee of the Tax and Customs Administration, Dienst Toeslagen, Douane, Auditdienst Rijk, Autoriteit Persoonsgegevens, or one of the chain partners (RIEC, LIEC, LSI, iCOV)? And do you have information relevant to this investigation?

We treat sources strictly confidentially and can process anonymous contributions. Email via Open Brief Network or write to us at the postal address on the about page.

This dossier can only be as complete as the sources we collectively make available.

References

Primary sources

• KPMG Report investigation Risk Analysis Model (RAM), 25 February 2025
• House letter policy response external investigation RAM, 6 March 2025
• Written consultation on the Risk Analysis Model, 26 May 2025
• AP report investigation RAM and ‘systems comparable to RAM’, 9 July 2025
• Amnesty International — “Xenophobic Machines: Dutch Child Benefit Scandal”, October 2021
• AP fine FSV, July 2020
• POK report “Unprecedented Injustice”, 18 December 2020
• Inquiry Committee “Blind to Human and Justice”, February 2024

IT infrastructure

• House letter ICT Tax and Customs Administration, 20 February 2023
• Binnenlands Bestuur: “How an ancient programming language keeps government in its grip”, 19 January 2024
• Dutch IT Channel: “State Secretary visits Tax and Customs Administration for ICT infrastructure modernisation”, 17 August 2025
• EC/OSOR: “Dutch Tax Office looking for Linux OS for IBM mainframe”, 14 September 2016
• NRC: “Tax and Customs Administration became dependent on IBM”, 11 August 2007
• AcICT advice Rationalise Cool:Gen Income Tax, 16 April 2025
• Techzine: VAT system fully outsourced to US, 27 February 2026
• Dutch IT Channel: “Tax administration opens third Government Data Center (ODC) in Apeldoorn”, 20 June 2014 — twin ODC architecture, B/CIE, Heijmans renovation, 4 PB storage, 1 MW energy house, 66→4 government data centers
• De Ondernemer: “Inside look: this fortress processes BV Netherlands tax returns” — inside the Apeldoorn data center

Data vault and HTML exclusion

• House letter 2026D17991 data vault, 15 April 2026, Eerenberg & Palmen
• House letter 2026D24511 file types data vault, 22 May 2026, Eerenberg & Palmen
• Debatdirect House of Representatives, 26 May 2026, Operation of digital data vaults — testimony Teusjan Vlot on personal approval of extensions
• OpenBrief: “RAM never disappeared: the state profiles on”, 27 May 2026 — section on HTML systematically excluded
• OpenBrief: “The corrupt agenda of the data vault”, 29 July 2026 — system failure HTML references
• OpenBrief: “Credibility of the Dutch rule of law”, 25 May 2026

Algorithm and profiling investigation

• Follow the Money: “More than 50 algorithms of the Tax and Customs Administration are unlawful”, October 2025
• IEEE Spectrum: “Artificial Intelligence in Government”
• Politico EU: “Dutch scandal serves as a warning for Europe over risks of using algorithms”
• Algorithm register Tax and Customs Administration

International parallels

• Robodebt Royal Commission Report, July 2023
• Wikipedia: British Post Office scandal (Horizon)
• District Court The Hague, SyRI judgment, 5 February 2020 (ECLI:NL:RBDHA:2020:865)

Investigative journalism

• NRC dossier “The state of the Tax and Customs Administration”
• Trouw: “Tax and Customs Administration had a secret fraud list in breach of privacy law”

Relevant WRR reports

• WRR Working Paper 021, “Big Data for Fraud Enforcement”, April 2016 — ISBN 978-94-90186-30-2

Related OpenBrief investigations

• RAM never disappeared: the state profiles on — 27 May 2026
• RDM: the Regio Data Model on top of RAM at the Tax and Customs Administration MKB — 10 August 2026
• Data vault: 64 million hidden files discovered — 13 March 2026
• PwC working document FSV effects racism — background racism analysis FSV
• WRR Big Data for Fraud Enforcement — analysis — analysis of the 2016 WRR warning report

Methodological notes

• This dossier combines five types of sources: (1) parliamentary documents and official reports, (2) supervisor reports (AP, ADR), (3) parliamentary inquiries and committees (POK, Donner, inquiry), (4) investigative journalism (NRC, Trouw, FTM, AG Connect, Computable, Tweakers), (5) international reports (Amnesty, EC, Royal Commission AU)
• All quotes are directly traceable to published sources with URL
• The OSINT matrix with more than 100 verified URLs is available on request
• This is a living document — corrections and additions welcome via Open Brief Network
• Next update: after publication AP judgment and ADR reports Sept-Oct 2025

Open Brief Network — Independent Investigative Archive. This investigation is licensed under Creative Commons Attribution 4.0. Reuse with source attribution permitted.