Australia’s Top National Security Adviser Warned of Microsoft Risk
Hamish Hansford, Home Affairs national security head, warned in August that reliance on Microsoft risked a "disproportionate impact" in an outage. On November 13, an outage hit millions of Australians, including the AFP and ASIO.
A top national security adviser at Australia's Home Affairs department, Hamish Hansford, warned in August that the country's reliance on Microsoft risked a "disproportionate impact" if the company suffered an outage. On November 13, an outage hit millions of Australians.
Both the Australian Federal Police and the Australian Security Intelligence Organisation confirmed they were affected.
What Hansford said
Hansford, Home Affairs' national security head, spoke on the InnovationAus podcast. He described Australia's deep reliance on Microsoft services and directly warned of the risk.
"[Big tech providers] underpin our national security. They underpin the functioning of the economy, and they are individually important for how we operate," he said.
He also called it "unrealistic" for Australia to find alternatives to major US providers. In his view, the country should seek closer ties with the company instead.
Warnings before the outage
Last week, the federal government ran a simulation of a cybersecurity incident with its agencies and private companies, including Microsoft. The aim was to identify and prepare responses for a crisis.
A government-commissioned review released in February had already flagged the danger. The Digital Transformation Agency (DTA) ordered an independent review of "single-seller" relationships, which are deals it negotiates to buy technology for the government.
The review rated single-seller vulnerabilities as rare but potentially catastrophic, with an overall risk assessment of "medium". It noted that the cost and complexity of switching providers drives such deals, and it supported keeping them.
Home Affairs' Critical Infrastructure Security Centre renewed older warnings about concentrated technology dependencies in a risk review released November 2, 11 days before the outage.
Over $1 billion in Microsoft contracts
Microsoft secured more than $1 billion in federal government contracts this year. In February, the DTA announced a new five-year whole-of-government deal with the company.
Several agencies signed multi-year deals in June and July. They include a $720 million arrangement with Defence, a $163.4 million deal with Services Australia and a $151 million deal with the Australian Tax Office. The published values may differ from the final spend.
In June, Home Affairs also signed a first-of-its-kind agreement with Microsoft Australia. It includes a promise to collaborate on strengthening the resilience of Australia's digital technology stack. Both sides also pledged to prioritize recovering Australia's digital economy quickly from significant outages within the Microsoft ecosystem.
That deal helped cement plans for last week's resilience exercise, designed to test the readiness of both government and Microsoft.
At Senate estimates last month, National Cyber Security Coordinator Lieutenant General Michelle McGuinness said the government was working to survey its dependence on providers, including Microsoft. "We will map that critical dependency that we see across both critical government systems and critical infrastructure systems," she said.
