There's been a lot of talk recently about sovereign capability in Australia but I've not really heard anyone (at least in the mainstream) talking about our sovereign software capability.
Yes, advanced manufacturing is important and we should be investing there, but I'm convinced that our biggest sovereign risk in the 2020s is our software. The reality is that if a hostile US administration pressured just 2 companies, Microsoft and Amazon, to deny service to Australia, it would cripple virtually all government and business services in our country overnight. Add in 2 more companies, Google and Apple, and virtually all business and consumer devices and services could be out of action.
Is that likely? No. 10 years ago, we might have been safe to ignore the possibility entirely. However, given the increasingly erratic nature of the current US administration (including direct criticism of Australia from the president) coupled with the near complete capitulation of the US tech industry with their whims, it's a possibility we need to take seriously.
What would a mitigation strategy look like? Here's 2 policy ideas I'd like to see the Australian government advance:
1. A government-backed, Australian maintained Linux distribution, with out of the box compliance with the Australian Signals Directorate Essential Eight strategies to mitigate cybersecurity incidents. This should be used by all levels of government and available for use by the private sector. This is far from a novel idea, it is already in place (in whole or in part) in several countries, sub-national governments, or sectors within national governments.
2. All government cloud services should be located in Australian owned and controlled data centres. All government contracts should insist on the same as part of the tender process where government data is being stored on cloud-based systems. I find it genuinely terrifying how much critical Australian Government IT infrastructure is being run on AWS data centres; even if a data centre is physically located in Australia, the fact that Australian's don't have complete control over this critical infrastructure is an unacceptable sovereign risk.
I'm focusing on risk mitigation here, but these changes could also result in significant potential cost savings and economic gains.
Sorry about the long post, but this has been on my mind a lot lately.
#Australia #Linux #auspol #software #CyberSecurity