The Australian Digital Health Agency’s mandated move out of a Chinese owned data centre cost more than $27 million and is running late, missing the government’s deadline for a new data sovereignty scheme this month.
The health agency this week confirmed it was yet to finish decommissioning its hardware in the Global Switch Ultimo (GSU) facility in Sydney, but completed its migration of sensitive data earlier this month, around a week after the deadline.
The Australian Digital Health Agency (ADHA) is one of four agencies which agreed to exit the GSU by the end of last month under a Home Affairs Affairs-led $115 million ‘securing sovereign data’ project, after missing an original self-imposed 2020 deadline.
The other members of the group – the Department of Home Affairs, the Australian Securities and Investments Commission (ASIC) and the Australian Communications Media Authority (ACMA) – have all left the facility, meeting the latest June 30 deadline.
Earlier this week, iTnews revealed these three agencies had successfully migrated out of GSU, with ASIC and Home Affairs moving to Canberra Data Centres under new deals.
ADHA completed a migration of sensitive data to hosting services on July 7, moving to the government certified Microsoft Azure Cloud in Australia.
Under the main contract for the migration work, DXC Technology is being paid an expected $27.5 million. The IT services firm also received a separate $777,571 contract from the agency two days before the deadline to provide “Global Switch support services” over the following month.
For its part as the cloud subscription provider, Microsoft received a one-year “management advisory services” contract that has tripled from its initial value to $1.85 million.
Accenture has also assisted with the work through the enormous $641 million contract it holds with ADHA as the health National Infrastructure Operator.
An ADHA spokesperson said the delay to sensitive data being moved was because of “unexpected supply chain issues affecting multiple government agencies”, and the full migration out of GSU will be completed by Thursday.
“The Agency is currently undertaking hardware decommissioning activities which will be completed on 21 July 2022 and finalises the Agency’s exit from the GSU facility,” an ADHA spokesperson told InnovationAus.com.
The remaining agency of the Home Affairs-led migration group, ACMA, declined to provide any information on where its data has moved to or how much the migration cost, citing “security reasons.” ACMA did confirm it no longer holds any data at GSU.
The facility came under the spotlight after a Chinese consortium bought a major stake in Global Switch’s parent company in late 2016. Within six months, the Department of Defence had decided to terminate its relationship with the Sydney data centre, at an expected cost of $200 million.
Other agencies would follow, with many missing an original self-imposed exit date of September 2020.
Despite leading the move out of GSU, Defence extended its relationship with GSU shortly after the 2020 deadline because the volume of data it holds there made an earlier migration “impractical”.
Defence is now expecting to take until 2025 to complete its migration out of GSU.
The incident sparked the development of a Whole-of-Government Hosting Strategy and Hosting Certification Framework for suppliers of data centres and services. The sovereignty scheme, which introduces stricter government conditions and controls on suppliers, including recovering re-platforming costs for breaches, began last year, and its grace period ended June 30.
Some of the biggest providers have been certified to hold sensitive government data under the new scheme but dozens more are waiting on certification applications, and parts of the scheme have been scaled back.
Do you know more? Contact James Riley via Email.