Published on the 16/06/2022 | Written by Heather Wright

Are we giving up too much to international cloud operators?…

Suggestions that the government believes storage of its data with foreign cloud providers only poses a jurisdictional risk while data is stored overseas has sounded warning bells locally, with one cloud provider calling for government to relook at the issue of jurisdictional risk.

Last week documents obtained under the Official Information Act by Newsroom showed the government was advised of the risk of storing Parliamentary Service data offshore, because the data wouldn’t fall solely under New Zealand’s legal regime. Labour and the Greens are reportedly ‘unable’ to use the Microsoft cloud tools until a Kiwi data centre is built.

“Cloud is by far and away our biggest existential threat as a country at the moment.”

Much has been made of both Microsoft and AWS’ plans for Kiwi data centres and their potential to address data sovereignty concerns. 

But the suggestion that Kiwi data centres will remove the risk of data being subject to laws of other countries sounded alarms for some in the sector. 

Doug Dixon, CEO of New Zealand cloud computing provider Catalyst Cloud, says “The problem here is not that the data is overseas necessarily, it’s that it is being held by cloud providers with US ownership and the ownership is what is at issue, not the location.”

He told iStart the development of foreign-owned hyper-scale data centres in New Zealand won’t remove the jurisdictional issues.

Dixon points to legislation such as the US Cloud Act, enacted back in 2018, which can be used to compel US technology companies to provide data stored on their servers, no matter where they are in the world. 

“Companies are subject to not just those laws, but any future laws passed,” he notes.

“We are putting all these eggs into baskets that we don’t really control.

“The ongoing ownership issues have direct consequences on our digital sovereignty.”

Catalyst Cloud does have a stake in the argument. The company secured an all-of-government agreement in February – the only New Zealand cloud provider on the all-of-government panel – and Dixon says the company is starting to see some agencies sign up. But he says its been a concern for him for some time and says there is also a growing awareness among companies of the issue of data sovereignty. 

He’s keen to see more focus by both government and the wider business market on digital sovereignty issues – and acknowledgement that there is an issue.

“The first thing is to understand the jurisdictional risk and for there to be an assessment of what the jurisdictional status is of foreign-owned cloud providers and to be absolutely clear that they do not, and can not ever, operate exclusively under New Zealand jurisdiction,” Dixon told iStart.

“That is a really inconvenient fact, because it makes government use of very popular office productivity suites problematic and it is really inconvenient.”

Don Christie, managing director of Catalyst Cloud’s sister company Catalyst IT, has also taken to LinkedIn to call for government agencies to hold a ‘serious review of their data storage policies’ saying the fact the overseas data was a jurisdictional risk ‘is treated as a big surprise’ was what most concerned him. 

Dixon also wants a closer look at whether we need a locally owned set of capabilities, sovereign to New Zealand, saying a ‘conscious movement towards a more balanced technology ecosystem would be healthy’.

“What you could do is identify all of the systems that are of critical national importance or that have very high privacy requirements, for example health, financial, social welfare, corrections data – these type of things where really the expectations of citizens is that the data never ever leaves NZ jurisdiction.

“And then you need to work out what you do with that data. And you could keep that data within NZ’s jurisdiction by storing it here and never letting it leave here and never letting it go into systems that are owned by other countries.

“The systems you build on top of that data – almost like a data vault or a data lake – sometimes will be absolutely fine to use US owned providers as long as the data that must remain under NZ’s sole jurisdiction does not go into them.”

Looking across the ditch to Australia, may provide some inspiration.

The NSW Digital Sovereign Task Force which has measurable targets on buying locally owned technology. 

It’s a move that has long been called for in New Zealand but has amounted to little here.

“That’s really what I think is the next step: To build up our own capability, give us some choices which let’s be fair in the past we have had limited choices and that’s why some of the decisions have been absolutely understandable. But we have sacrificed some of our future by not consciously building up our own capability,” Dixon says.

New Zealand cloud spend is projected to hit nearly $2.6 billion this year, with Dixon estimating that about 40 percent of that is government controlled spending.

“A billion dollars of spend can transform entire industries. We have seen it before. And a proportion of that going to specifically targeting local, strategic technology capabilities would be fantastic.”

Of course, there’s the old argument that the big name companies offer cost advantages and greater potential for innovation.

Dixon agrees they can have the upper hand in their potential for innovating quickly, but disputes the pricing argument. He says some Catalyst Cloud services are cheaper than AWS’, and notes that France’s OVH Cloud, built on the same Open Stack that Catalyst Cloud is built on, is two to five times cheaper than the big names.

“Really all we need in New Zealand is for us to back ourselves, build scale domestically and once we do that the prices just jump down because of the economies of scale.

“And when we’re talking about innovation, if we spent $1 billion on Microsoft, where does that money go? What asset does New Zealand get at the end of it? Absolutely nothing. Imagine if we spent some of that money and built software assets in New Zealand that we could build, keep, reuse. Imagine what we could innovate and build.

Earlier this week Gartner’s Brian Prentice told iStart there’s a growing wariness globally of the dangers of relying heavily on international companies for technology.

“Governments are recognising that the social and economic fabric of their own country, culture, society is being hinged to digital tech and that digital technology is coming from somewhere – it’s coming from the suppliers,” he says.

“If your supplier for a critical piece of economic or social infrastructure is in the jurisdiction of another country then the politicians in that country can make decisions that impact stuff in your country.”

Dixon agrees. 

“Cloud is by far and away our biggest existential threat as a country at the moment – it’s the loss of control of critical systems to foreign owned companies.”

Has the horse already bolted though?

“We have to run after the horse, shoot a tranquilliser in its flank and bring it back to the stable,” he says.