Top national security advisor warned of Microsoft risks months ago

A top national security official warned months ago that the country's reliance on Microsoft risked a "disproportionate impact" if the tech company suffered an outage.

And just last week, the federal government ran a simulation of a cyber security incident with its agencies and private companies, including Microsoft, to identify and prepare their responses in the event of a crisis.

Speaking on a podcast in August, Home Affairs national security head, Hamish Hansford, referenced Australia's deep reliance on Microsoft services, and directly warned of a "disproportionate impact" if the company was hit by an outage.

"[Big tech providers] underpin our national security. They underpin the functioning of the economy, and they are individually important for how we operate," he said.

Mr Hansford's comments — and the cybersecurity simulation — follow numerous recent reports and alerts by government agencies of the potentially "catastrophic" consequences of outages from major tech suppliers like Microsoft, which secured more than $1 billion in federal government contracts this year.

Both the Australian Federal Police (AFP) and the Australian Security Intelligence Organisation (ASIO) confirmed they were impacted by today’s outage, along with millions of Australians. 

A government-commissioned review released in February highlighted how dependence on a small number of technology suppliers could threaten critical services.

The Digital Transformation Agency (DTA) commissioned an independent review of "single-seller" relationships, which are deals negotiated by the agency for buying technology on behalf of the government.

The review assessed single-seller vulnerabilities as rare but potentially catastrophic in their impact with an overall risk assessment of "medium".

It identified the cost and complexity of changing providers as one of the factors driving towards single-seller deals, and ultimately supported keeping these arrangements.

Similarly, Home Affairs' Critical Infrastructure Security Centre renewed older warnings about concentrated technology dependencies in a risk review released as recently as November 2, 11 days before the outage.

At Senate estimates last month, the Australian Cybersecurity Co-ordinator, Lieutenant General Michelle McGuinness, said the government was working to survey its dependence on providers like Microsoft.

"We will map that critical dependency that we see across both critical government systems and critical infrastructure systems," she said.

$1 billion in Microsoft deals struck since July

The same month as the review, the DTA announced a new five-year whole-of-government deal with Microsoft.

Several government agencies signed multi-year deals with Microsoft in June and July, including a $720 million arrangement with Defence, a $163.4 million deal with Services Australia, and a $151 million deal with the Australian Tax Office.

The deals include everything from licenses for Microsoft products like Office 365 to cloud computing contracts, and the published values may differ from the final spend.

While acknowledging the need for diversity of tech providers, Mr Hansford also said it was "unrealistic" for Australia to find alternatives to major US providers, and that it should instead seek closer ties with the company.

He cited a Department of Home Affairs's first-of-its-kind agreement with Microsoft Australia signed in June.

The deal outlined a number of commitments, including a promise to collaborate on initiatives to "strengthen the resilience of Australia's digital technology stack".

It also included a pledge to, "work together to prioritise the recovery of Australia's digital economy as soon as possible from significant technology outages or digital disruptions within the Microsoft Corporation ecosystem".

It was through this deal that last week's resilience exercise was first imagined, with the goal to test both government and Microsoft's readiness.

Spokespeople for Microsoft and Home Affairs confirmed this satisfied the relevant part of the agreement with Home Affairs.

Microsoft and government have done 'good work' on cybersecurity: Burke

On Friday, Home Affairs Minister Tony Burke said the government had activated a provision in that deal that required Microsoft to prioritise Australia's recovery from an outage.

"That agreement has in fact been activated today, to make sure that we get appropriate prioritisation of Australian interests in this," he said.

Asked whether Australia should diversify its reliance on Microsoft, Mr Burke said diversity was relevant across software, trade and other areas.

But he said that should not detract from the security work done with the company.

"There is very significant good work that is done between Australia and Microsoft in terms of making sure we have high levels of security," he said.

A spokesperson for Home Affairs said the department was aware of the outage and was working with Microsoft to prioritise the recovery of Australia’s digital economy as soon as possible.