This research explores the use of Artificial Intelligence (AI), specifically Large Language Models (LLMs), into the operationalization of Government Technology (GovTech) benchmarks to increase their utility for policymakers. Research and practice consistently highlight persistent challenges in GovTech benchmarking, such as resource-intensive methodologies that provide retrospective rather than real-time analysis, a lack of complexity that overlooks digital infrastructures and emerging technologies in favor of simpler metrics, and improper levels of aggregation that can render results less useful. Considering that benchmarks can significantly influence political outcomes and shape the development of GovTech services, refining benchmarking methodologies using LLMs can mitigate these issues and potentially improve the responsiveness and relevance of government actions that better serve societal needs. Using Design Science Research Methodology and Activity Theory, an artefact is developed that combines an LLM with Retrieval-Augmented Generation (RAG), fine-tuning and prompt-engineering. The artefact is used to operationalize the GTMI-benchmark by the World Bank. The development of a benchmark specifically tailored for operationalization by LLMs is proposed, with a preliminary design for an AI-Supported GovTech Index (AGTI) outlined.

Governments are increasingly dependent on GovTech, which is the technology that facilitates processes in the public sector. Benchmarking the state of GovTech is done by governments and yields indispensable insights, which are used for optimising resource utilisation, identifying areas for improvement, and facilitating evidence-based policy prioritisation. Current benchmarking efforts are resource-intensive, time-intensive, and have limited scope, resulting in an inefficient assessment of GovTech innovation.

This thesis explores the potential of Large Language Models (LLMs) to overcome the practical limitations of existing GovTech benchmarking methods, analysing the GovTech Maturity Index of the World Bank as a case study. Using an LLM and leveraging state-of-the-art techniques, including fine-tuning, Retrieval Augmented Generation, and Prompt Engineering, the usability of these models as an artefact for GovTech benchmarking is assessed.

The results show that the best-performing model outperforms the random chance accuracy, indicating that the LLM not only understands the question and data format, but also contains the information to correctly answer the benchmark questions. The research concludes that the created artefact has the potential to improve GovTech benchmarking, resulting in more informed policy decision making.

The thesis contributes valuable insights to the field of the GovTech research field by making GovTech benchmarking more efficient, leading to a better analysis of the current GovTech market, and contributing to the academic debate on GovTech market analysis. Furthermore, by streamlining the Dutch benchmarking process, resulting in more accurate insights, the study contributes to the advancement of GovTech solutions within the Netherlands, ultimately benefiting society as a whole.

The artefact created in this research has significant policy relevance, as more efficient benchmarking allows policymakers to better optimise resource allocation, identify key areas for investment, and improve evidence-based policy changes regarding GovTech.

The limitations of this research include model inaccuracies, challenges in handling long contexts, and the potential for incorrect answers. An ethical analysis is performed, from which it can be concluded that the relevance of the information used by the models is the most apparent ethical concern.

Future research may focus on improving the models to better handle long contexts, reducing inaccuracies, and improving the overall performance in populating GovTech benchmarks by incorporating additional data sources and improving the models. The research design is limited by the lack of environmental aspects in the process and the narrow scope of using a single benchmark for one country.

As next steps, this research proposes a roadmap that includes the continuation of the development of the artefact, the extension of ethical analysis, the performance of trials, and the beginning of a wider application of the artefact.

The thesis explores the complexities and risks associated with Automated Decision-Making (ADM) systems in social welfare, focusing on the phenomenon of ”digital cages.” The digital cage concept refers to a situation where rigid systems, perpetuated through algorithmic misclassification, inadvertently trap citizens in bureaucratic complications without recourse. This thesis analyzes the digital cages concept from a system safety perspective, on the example of the Dutch Toeslagenaffair. The thesis centers on understanding how digital cages form within social welfare systems and seeks methods to mitigate their emergence through targeted interventions using system safety theory. The pivotal question addressed is: ”What are safety control interventions to curb the emergence of algorithmic decision-making systems-induced digital cages in the context of national social welfare administration in the Netherlands?” The research concludes by highlighting the potential of assumption-based leading indicators. Assumptionbased leading indicators are predictive measures that rely on underlying assumptions about how certain inputs or actions correlate with future outcomes. The leading indicators provide a novel approach to enhancing system safety in social welfare administration by addressing the underlying assumptions of the system in operation. This offers a substantial potential to transform how social welfare systems manage and utilize ADM, potentially reducing the incidence of digital cages. By detecting early signs of hazardous systems states digital cages can be mitigated before they solidify into systemic issues. The thesis not only addresses the immediate concerns regarding digital cages but also opens pathways for future inquiries into safer and more equitable administrative practices. Future research is suggested to further refine these indicators and explore their applicability in diverse administrative contexts, ensuring they can effectively adapt to the evolving landscape of public administration and technology.

This thesis examines the pressing environmental issue stemming from the accumulation of Waste Electrical and Electronic Equipment (WEEE), particularly within the automotive sector. Despite directives from the European Commission aiming to promote a circular economy, challenges persist in effectively managing WEEE, particularly in End-of-Life Vehicles (ELVs). Current dismantling practices often lead to the loss of valuable materials, exacerbating environmental and health risks. Recognizing the need for improved data sharing, this research investigates the potential of the International Data Spaces (IDS) initiative in enhancing WEEE management within the automotive industry, with a focus on ELV dismantling.

The primary research question centers on how IDS can facilitate WEEE information exchange between manufacturers and dismantlers within the automotive sector. The study is structured into five phases to comprehensively address this question:

Exploratory Phase: This phase identifies current barriers to WEEE information sharing in the automotive industry, employing the Circular Economy (CE) monitoring framework for analysis.

Requirements Elicitation Phase: Through desk research, legislative analysis, and stakeholder interviews, essential requirements for effective information sharing are identified, considering barriers, legislative mandates, and dismantlers' perspectives.

Application Phase: The feasibility of meeting identified requirements using IDS is explored, drawing on academic literature and documentation from the IDS initiative.

Concluding Phase: Findings from previous stages are integrated to address the main research question regarding IDS's role in facilitating WEEE information sharing.

Discussion Phase: The final phase evaluates the research approach, discusses conclusions, limitations, and suggests avenues for future research.

Barriers to WEEE information sharing within the automotive industry encompass incomplete documentation, lack of harmonization, information gaps, inconsistent data entry, and restricted accessibility. These findings inform the elicitation of requirements, emphasizing the need for detailed dismantling information, interoperability, and user-friendly interfaces.

Evaluation of IDS demonstrates its potential in providing dismantlers access to fundamental information, simplifying data access processes, ensuring data sovereignty, facilitating interoperability, and supporting initiatives like the circularity vehicle passport. However, its effectiveness relies on stakeholder participation and regulatory support.

In conclusion, this thesis proposes IDS as a solution to enhance WEEE information sharing in the automotive industry, contributing to sustainable development and advancing scientific understanding. Further research is recommended to address implementation challenges and develop specific ontologies tailored to the automotive sector.

Technology advancements and growing demands from citizens brought about a digital transformation of the Dutch public sector. As the digital standard rises higher and higher, the Dutch public sector is faced with the task to offer a strong digital environment and can choose to do so by either maintaining current IT infrastructures or by investing in alternatives.

At the moment the most promising alternative seems to be cloud technology. Cloud technology, or more specifically public cloud technology, provides the option to ’rent’ computing resources remotely from an external party. It is already widely in use within the private sector, as well as in some European governments. However, to introduce public cloud technology some hurdles must be overcome, such as concerns related to data security or the dependence on soft- and hardware that has been superseded but is difficult to replace. To gain more insight into the issue of the public cloud being a viable option to accommodate future digital transformation, it is first and foremost important to know what variables play a role in the decision-making process: what are the incentives to answer this question with either a ’yes’ or a ’no’? The objective of this study will therefore be to investigate this landscape of variables that influence the decision to adopt public cloud technology. It starts with the identification of variables from current research and reports, and then explores possible interrelationships. The identification and classification of these relationships could eventually help to bring about a well-considered decision about public cloud adoption in the Dutch public sector.

Reviewing current research related to variables that influence cloud adoption, three research gaps emerged. Firstly, current research was delineated to the Netherlands and therefore failed to capture geographically specific variables, such as legal or cultural characteristics. Secondly, authors that analysed the decision-making process of adopting cloud technology neglected any interrelations between different variables. Thirdly, existing theories fell short in capturing the full scope of could computing adoption decisions, being either too generic or not specific enough.

To address the knowledge gaps and simultaneously fulfil the objective of this study, Interpretive Structural Modeling (ISM) and Fuzzy Matrice d’Impacts Croisés Multiplication Appliquée à un Classement (MICMAC) methods are used. ISM aims to simplify complex relationships between a system of variables by providing a graphical representation of the hierarchical structure of that system. Fuzzy MICMAC is used to assess the strength of the relationship between the variables. In total, 22 interviews with experts in the field were held as input for the analysis. The experts worked in the Dutch public sector and were familiar with the decision-making process related to cloud computing adoption.

In the first step of ISM, relevant current literature and official Dutch documents and reports were used to create a list of eight variables that would have a negative effect on the decision to adopt cloud computing within the Dutch public sector. These were classified as the ’barriers’. Additionally, a list of eight positive variables was created and classified as the ’drivers’. Then, the ISM Fuzzy MICMAC steps were followed for both lists.

Key findings for ISM can be described as ’how many’ other variables are influenced by a certain variable, or by ’how many’ other variables this certain variable influences (including indirect effects). For Fuzzy MICMAC, results can be described by using the terms driving power, i.e. how ’strong’ does a variable influence other variables in the system, and dependence power, i.e. how ’strong’ is a variable influenced by other variables.

For the barriers, Regulations and government policy was the variable that had the most influence on other variables within the barrier system. The barrier that influenced other variables the strongest however (i.e. had the highest driving power), was Lack of knowledge and capabilities. Both Internal resistance to change and Negative business case were influenced by the highest number of other variables and did not affect any new variables. The variables with the highest dependence power were Internal resistance to change and Data security concerns.

For the drivers, Bigger knowledge market, Ease of use and Improved hard- and software were the variables that had the most influence on other variables within the drivers’ system. The driver with the highest driving power was Improved hard- and software. Governmental strategy was influenced by the highest number of other variables and did not affect any new variables. The variables with the highest dependence power were Lower and flexible cost and Governmental strategy.

The findings of this research have practical and theoretical implications. Practical, because they can support decisions about cloud within the Dutch public sector. Theoretical, since the findings suggest new variables, interrelations and theories related to public cloud computing. Furthermore, it uses ISM Fuzzy MICMAC, which is often used in the context of novel technologies, but never before for cloud computing adoption decisions.

Future research could address the limitations of this study, such as the exclusion of a feedback loop from the experts during the identification of the variables. Alternatively, research could use the Total Interpretive Structural Modelling (TISM) method to investigate the relationships further.

As stated this research aims to provide insights into the criteria and trade-offs that determine a responsible level of automation when automating decision-making by civil servants through artificial intelligence within smaller public organisations, such as municipalities, in the Netherlands. Making use of expert interviews and vignette experiments in order to provide guidance to those willing to experiment with responsible AI implementation in the public domain.

In 2019 a quantum computer performed a highly complex operation in 4 minutes, which would have taken the most powerful supercomputers of today around 10,000 years. Performing calculations unimaginably faster than is currently possible may bring great opportunities, but may implicate a threat to digital communications. Digital communication is kept secure through cryptography, which uses mathematical problems to protect sensitive information and communication from malicious acts of cybercrime. Cryptography is widely adopted across the cyberspace. The world’s fastest classical computers of today are unable to break cryptography’s underlying mathematical schemes, ensuring confidentiality and integrity of everyone’s data. However, it is predicted that future quantum computers could theoretically break current cryptography in just a few hours. The moment that a powerful enough quantum computer exists (called Y2Q) thus implicates that cryptography systems will become unusable as digital services are no longer secure. This could have catastrophic consequences for society’s critical digital infrastructures, such as those provided by Dutch banks. This problem is very relevant for banks, because of the sector’s abundance of sensitive data and information streams that rely on cryptography, as well as their critical role in society’s functionality (facilitating payments).
Because of the serious disruptions in critical financial infrastructures that the quantum threat could ignite, decision-makers within banks will be needing governing tools to mitigate risks. Adopting new quantum-resistant cryptographic algorithms, known as post-quantum-cryptography (PQC) is absolutely critical in facilitating safety and security from the quantum threat. However, there is currently little or no governance, or guidance, for the management of this transition towards PQC and guidance is urgently needed. The formulation of these guidance-measures is one of the main challenges regarding the transition towards security in the quantum-era. Therefore, this research focusses on ensuring the Dutch banking sector’s safety and security of its digital infrastructures, from the cryptography-related cyber threats posed by quantum computing technology – from not merely a technological perspective, but with a holistic approach, considering the involved socio-technical challenges. In order to provide guidance to decision-makers from Dutch banks, this thesis aims to answer the following research question:
How can the Dutch banking sector ensure the safety and security of its digital infrastructures, from the cryptography-related cyber threats posed by quantum computing technology?

In order to answer the main research question, the Technology Roadmap (TRM) framework will be used. This framework provides the vital link between a first idea phase (i.e., banks’ digital infrastructures face a threat from quantum computing technologies) and the concrete implementation phase (i.e., how do we ensure protection from this threat?). The TRM is a diagram which consists of features, services, systems, resources, and drivers in relation with one another, that together facilitate an overview of what is required for the banks to become quantum-safe. Constructing this roadmap required three main methods:
(1) Exploratory research to identify in which parts of the banks’ processes and operations the vulnerabilities to the quantum threat are the highest. This included describing key concepts within cryptography, PQC-developments, and banking services, as well as stakeholder- and dependency-mapping of the Dutch banking environment.
(2) Semi-structured interviews with security architects, payment security specialists, and cryptography specialists from Dutch banks. Herein the perceptions of the Dutch banks on the impact, challenges, resources, capabilities, preparedness, and governance were obtained.
(3) TRM development based on thematic analysis of qualitative data derived from semi-structured interviews in which the perceptions were translated into elements fit for the TRM.
Lastly, the TRM was validated and revised by presenting it to experts and asking for critique, which enabled the final TRM to be developed. after which conclusions and recommendations could be drawn up.
The core banking services were analyzed in terms of the role that cryptography plays to ensure the security of these services, which helped to identify in which parts of the banks’ processes and operations the vulnerabilities to the quantum threat are the highest. The exploratory analysis identified the critical processes that entail the certain infrastructures that need to transition towards PQC. These being within the online payment process, the physical card transaction process, and the ATM transaction process. Within these processes the main vulnerabilities lie in: data channels through external public networks and service providers relating to payment gateways, payment processors, local store webservers, online merchant webservers, card association networks and Point-of-Sale (PoS)-terminals. Less vulnerable infrastructures, due to their primary use of symmetric cryptography, are: ATM networks, internal storage and communication infrastructures, inter-bank data exchange, and ATM controllers.
Through combining these insights with findings from the thematic analysis of perceptions derived from the semi-structured interviews, the TRM was developed which presented a 3-phase transition plan that aims to ensure the Dutch banking sector safety and security of its digital infrastructures from cryptography-related cyber threats posed by quantum computing technology. Phase 1 of this transition plan entails the development of a response plan for a potential privacy breach and the development of central cryptographic inventory, through management priority, internal alignment, and experimentation with to-be-standardized PQC algorithms. After PQC algorithms have been standardized, Phase 2 involves the adoption of PQC algorithms in online payment networks, requiring banks to draw up a PQC requirement list for vendors and external service providers. With a hardware replacement strategy in place, Phase 3 entails the replacement of all relevant hardware related to payment processes (payment cards, PoS-terminals, and ATM controllers), updating less prioritized software and network infrastructures, and overcoming technical challenges related to PQC algorithms' larger key-sizes. It is important to note that the implementation of PQC is not a one-time event, but rather an ongoing, ever-evolving, and uncertain process. The continuous development of quantum computing technology means that banks must remain vigilant and adaptable to stay ahead of potential threats, and may need to accelerate certain phases within the transition on a relatively short notice. Additionally, the success of this transition relies heavily on organizational awareness, as well as close collaboration between various stakeholders, vendors, service providers, regulators, and other financial service organizations.

Based on this conclusion, this research has made several recommendations to the Dutch banking sector:

Accomplish management priority. Management priority is crucial for allocating resources to execute the first steps that have to be taken to ensure quantum-safety. Therefore, the banking sector should shift the focus of management toward addressing the quantum threat and transitioning towards post-quantum cryptography (PQC) as a top priority, integrating quantum-readiness into the key strategic goals of the bank by means of organizational awareness. Organizational awareness can be created through workshops, seminars, and events that are aimed at educating management on the business implications of the quantum threat, as well as presenting them with solutions on addressing this threat.
Execute initial risk-free actions. Banks can already take certain risk-free actions in preparation for the PQC-transition, which will strengthen the preparedness of the banks. These actions include:
- Developing a privacy breach response plan
- Developing a centralized cryptographic inventory
- Doubling key-lengths for symmetric-key cryptography algorithms
- Developing a hardware replacement strategy
Extend continuous collaborative research to PQC. Dutch banks should proactively utilize their existing collaborative structures with other vendors, service providers, regulators, and other financial service organizations., to share their experiences and jointly develop strategies for addressing the quantum threat. This will benefit the Dutch financial market as a whole, as sharing experiences with executing the risk-free actions or experimenting with PQC-algorithms is highly relevant for creating a comprehensive understanding of the practical implications and technical challenges associated with becoming quantum-safe.

Quantum computing presents a threat to the current cryptographic standards in place, supporting our digital scoiety. As our lives are increasingly dependent on electronic transactions, our society becomes increasingly vulnerable to distortions of digital trust. By taking a design science research approach, this thesis designs a risk assessment method to assess the societal risks posed by quantum computing to public key infrastructures. Through reviewing literature, user workshops, and expert consultation a Societal Risk Assessment (SRA) is made and preliminarily tested. By performing an instrumental case study of Logius as the Policy Authority of PKIoverheid, the potential impacts on society of the quantum threat become visible. This thesis was written as part of the research project HAPKIDO, investigating the transition to quantum safe public key infrastructure. The resulting SRA method is deemed useful, but remains somewhat complicated to apply.

The revision of the eIDAS Regulation proposes the implementation of a European digital identity wallet for citizens to authenticate themselves across the EU. The process to decide if a person already has an account at the service where they seek to authenticate themselves is called identity matching. Regulated and public Dutch Relying Parties and the Dutch government are not always able to assess whether a citizen authenticating themselves has a pre-existing record at the Relying Party or in the Dutch national registry. Moreover, the current dependency on the Dutch central identity matching service creates a Single Point of Failure. Besides these reliability problems, privacy issues such as profiling data minimization must be accounted for. To this end, this research proposes three possible solution directions for solving these problems: a government-centric, wallet provider-centric, and a hybrid solution direction. The design of the solution directions follows a design science research methodology. The possible solution directions are evaluated by experts in focus groups to elicit the benefits and the barriers which these experts identify as relevant factors for accepting a solution direction. These factors are categorized using the TOE model, which is adapted to suit the current context. Expert evaluations during the focus groups have resulted in factors which relate to the organizational, technological, and external environment of the solution directions. The evaluation uncovered tradeoffs which the Dutch Ministry of the Interior must make to choose between one of the proposed solution directions: reuse of infrastructure at the cost of citizen privacy, or more privacy for citizens at the cost of additional logic requirements needed for the identity wallet. Based on the privacy and reliability requirements and the objective of the Dutch government to give citizens more control over their personal data, the wallet provider-centric solution direction is the most fitting choice of the three proposed solution directions. The explication of the problem, requirements, and solution directions can be used as a starting point in the exploration of new solution directions for the identity matching problems. More research is needed on other possible solution directions than are proposed in this research and their viability to meet the objectives of the Dutch government and deadlines set by the European Commission.

The quality of governmental service provision can be increased by raising the level of proactivity of public services, however only few best practices have been identified. This master thesis will try to fill this gap by developing a framework of design principles for proactive public services in the Netherlands. Case studies of governmental service delivery will be combined with interviews of information system architects and an academic expert to provide the necessary information for the development of a mock-up of a public service with a raised level of proactivity. The design science framework of (Hevner et al., 2004) will be combined with the Principle-Based Design methodology of (Bharosa & Janssen, 2015) in order to extract principles from the design process. The main contribution of this thesis will be the developed framework of design principles for proactive public service design in the Netherlands, which could guide governmental organizations in raising the level of proactivity of their public services.

Getting trustworthy data in the right format and with the required accuracy is imperative for organizational processes. All governments face this challenge in getting the high quality data for administrative processes, decision-making and policy-making. In practice, many government agencies still struggle with getting the right data in the right format at the right moments. Standard Business Reporting (SBR) is steadily developing towards becoming the national instrument for trustworthy data exchange. SBR includes a broad framework of standards for trustworthy data exchange and a comprehensive governance structure that steers adoption and decision making. While more public agencies are adopting SBR, this instrument itself has not developed to its full potential. Thus far, literature does not provide a model for assessing and communicating this potential.

Digitization often comes with its challenges. This thesis focuses on a new approach to innovating digital public services in the Netherlands. Innovation in the public sector encounters public sector specific innovation barriers, hampering the innovation process. Innovation in the public sector is still a little researched topic in the innovation literature. The co-creation lab is a proposed solution to overcome the innovation barriers through collaboration for innovation and experiments for innovation. Both of these have proposed benefits. Collaboration for innovation increases innovativeness and aids in creating ideas that are prone to adoption. Experimentation for innovation creates learning opportunities, increases the effectiveness of innovation processes, and proposes a solution to overcome governmental innovation barriers.
While the potential benefits of the co-creation lab are understood, it is unclear how the co-creation lab should be operationalized. This is the basis for the main research problem: Although experimentation and collaboration for innovation are adopted to overcome the government’s innovation barriers, it is not clear how to make those concepts operational in the co-creation lab. A tool is designed to support the co-creation lab’s operations. The design of the tool is the goal of the main research question: How can a co-creation tool be designed for a governmental innovation platform in which experiments are conducted with governmental IT infrastructures to foster innovation in the Dutch e-government? The co-creation tool is a tool that supports the co-creation lab in its operations to enable collaborations and to perform experiments. The main research question aims to solve the six challenges that are attached to the research problem: meager research into innovation in the public sector, the adoption of the quadruple helix model, enabling co-creation, requirements to perform experiments, the conditions of the technology used in experiments, and enabling use and reuse of already existing knowledge. The research is based on the design science research methodology of Peffers, Tuunanen, Rothenberger, & Chatterjee (2007), which focuses on design research of Information Systems (IS). This thesis alters the activities to create three research phases: discovery, utilization, and design. For the discovery phase, a review is carried out of relevant scientific literature related to the research challenges. Also, semi-structured interviews are conducted with five people close to the Digicampus to discover the current innovation journey for digital innovations in the Dutch government. The utilization phase is carried out by creating use cases about the process of the experiments according to the UML standard. From the use cases, functional requirements are derived. The design phase is carried out by creating a prototype of the co-creation tool. The UX program Sketch is used to create the prototype. The prototype is evaluated in an interactive workshop. The outcome of this research is a UX/UI design prototype of the co-creation tool. The tool’s design is a website that discloses the required information to support the innovation journey of innovators in the public sector.