A top national security official warned months ago that the country's reliance on Microsoft risked a "disproportionate impact" if the tech company suffered an outage.
asserted
company → warn → outage
And just last week, the federal government ran a simulation of a cyber security incident with its agencies and private companies, including Microsoft, to identify and prepare their responses in the event of a crisis.
asserted
government → run → crisis
Speaking on a podcast in August, Home Affairs national security head, Hamish Hansford, referenced Australia's deep reliance on Microsoft services, and directly warned of a "disproportionate impact" if the company was hit by an outage.
asserted
company → speak → outage
"[Big tech providers] underpin our national security.
asserted
providers → underpin → security
They underpin the functioning of the economy, and they are individually important for how we operate," he said.
asserted
he → underpin → economy
Mr Hansford's comments — and the cybersecurity simulation — follow numerous recent reports and alerts by government agencies of the potentially "catastrophic" consequences of outages from major tech suppliers like Microsoft, which secured more than $1 billion in federal government contracts this year.
asserted
which → follow → contracts
Both the Australian Federal Police (AFP) and the Australian Security Intelligence Organisation (ASIO) confirmed they were impacted by today’s outage, along with millions of Australians.
asserted
they → confirm → Australians
A government-commissioned review released in February highlighted how dependence on a small number of technology suppliers could threaten critical services.
uncertain
dependence → commission → services
The Digital Transformation Agency (DTA) commissioned an independent review of "single-seller" relationships, which are deals negotiated by the agency for buying technology on behalf of the government.
asserted
which → commission → government
The review assessed single-seller vulnerabilities as rare but potentially catastrophic in their impact with an overall risk assessment of "medium".
asserted
review → assess → medium
It identified the cost and complexity of changing providers as one of the factors driving towards single-seller deals, and ultimately supported keeping these arrangements.
asserted
It → identify → arrangements
Similarly, Home Affairs' Critical Infrastructure Security Centre renewed older warnings about concentrated technology dependencies in a risk review released as recently as November 2, 11 days before the outage.
asserted
Centre → renew → outage
At Senate estimates last month, the Australian Cybersecurity Co-ordinator, Lieutenant General Michelle McGuinness, said the government was working to survey its dependence on providers like Microsoft.
asserted
government → say → Microsoft
"We will map that critical dependency that we see across both critical government systems and critical infrastructure systems," she said.
asserted
she → map → systems
$1 billion in Microsoft deals struck since July
The same month as the review, the DTA announced a new five-year whole-of-government deal with Microsoft.
asserted
DTA → strike → Microsoft
Several government agencies signed multi-year deals with Microsoft in June and July, including a $720 million arrangement with Defence, a $163.4 million deal with Services Australia, and a $151 million deal with the Australian Tax Office.
asserted
agencies → sign → Office
The deals include everything from licenses for Microsoft products like Office 365 to cloud computing contracts, and the published values may differ from the final spend.
uncertain
values → include → spend
While acknowledging the need for diversity of tech providers, Mr Hansford also said it was "unrealistic" for Australia to find alternatives to major US providers, and that it should instead seek closer ties with the company.
asserted
it → acknowledge → company
He cited a Department of Home Affairs's first-of-its-kind agreement with Microsoft Australia signed in June.
asserted
He → cite → June
The deal outlined a number of commitments, including a promise to collaborate on initiatives to "strengthen the resilience of Australia's digital technology stack".
asserted
deal → outline → stack
It also included a pledge to, "work together to prioritise the recovery of Australia's digital economy as soon as possible from significant technology outages or digital disruptions within the Microsoft Corporation ecosystem".
asserted
It → include → ecosystem
It was through this deal that last week's resilience exercise was first imagined, with the goal to test both government and Microsoft's readiness.
asserted
exercise → imagine → readiness
Spokespeople for Microsoft and Home Affairs confirmed this satisfied the relevant part of the agreement with Home Affairs.
asserted
this → confirm → Affairs
Microsoft and government have done 'good work' on cybersecurity:
asserted
Microsoft → do → cybersecurity
On Friday, Home Affairs Minister Tony Burke said the government had activated a provision in that deal that required Microsoft to prioritise Australia's recovery from an outage.
asserted
that → say → outage
"That agreement has in fact been activated today, to make sure that we get appropriate prioritisation of Australian interests in this," he said.
asserted
he → activate → this
Asked whether Australia should diversify its reliance on Microsoft, Mr Burke said diversity was relevant across software, trade and other areas.
asserted
diversity → ask → software
But he said that should not detract from the security work done with the company.
asserted
that → say → company
"There is very significant good work that is done between Australia and Microsoft in terms of making sure we have high levels of security," he said.
asserted
he → be → security
A spokesperson for Home Affairs said the department was aware of the outage and was working with Microsoft to prioritise the recovery of Australia’s digital economy as soon as possible.
asserted
department → say → economy
The Aporia
