Nations Seek Security in the Same Few Clouds

Last week, American hyperscaler AWS signed a memorandum with Singapore’s Cyber Security Agency (CSA) to strengthen the country’s digital security. This comes a year after the cloud company also joined a partnership with the Australian Government to build a private cloud for national security use.

The Singapore deal centers on joint threat-intelligence sharing and training programs to turn local engineers into “digital” first responders using AWS’s infrastructure. In Australia, AWS is working with the Australian Signals Directorate (ASD) on a “Top Secret Cloud” that lets agencies share intelligence securely and seamlessly across their own networks.

It’s clear as day that cybersecurity is a national security crisis: A World Bank study says cyber incidents in upper-middle-income nations are climbing roughly 37% per year, which is far faster than the global average of 21%.

Even INTERPOL urges that many governments still “need significant improvement” in their ability to respond to cybercrime. So it’s no surprise that nearly every nation now partners with major cloud providers to build and defend its data systems.

A KPMG report says 65% of government/public-sector organizations are less confident about investing in new cyber technologies because of trust issues. But Singapore and Australia have extremely sophisticated, mature digital markets, so why rely on U.S. cloud hyperscalers?

Call it planetary scale, blind luck, or both — but Azure, GCP, and AWS all have dozens of regions, millions of servers, and a global redundancy network governments can’t mimic.

In fact, the Big Three control about 63% of the world’s infrastructure cloud market. There’s little transparency around which clouds U.S. agencies use, but odds are high it’s the same trio carrying Australia’s and Singapore’s national security.

Just like John Dinsdale, chief analyst at Synergy Research Group, said: “This is a good time to be a cloud provider.” It sure is. Still, there’s true irony here: To protect themselves, nations are surrendering parts of their digital sovereignty to the same few conglomerates.

Interestingly, even Australia’s banking regulator has warned of the risk of concentration for banks’ reliance on a few cloud and tech providers. England’s own regulator agrees, saying the financial system faces “systemic risk” for few-vendor dependency.

Funny enough, the U.S. recognizes these shortfalls. Just look at the failed JEDI deal — originally designed to be a single-vendor, massive cloud deal between the U.S. government and Microsoft. Backlash led the DoD to create the Joint Warfighting Cloud Capability (JWCC), which now splits contracts among AWS, Azure, Google, and Oracle.

Yet here we are, still looking at the same few companies. So if AWS, Azure, and Google Cloud are in charge of the world’s most critical infra, what’s the plan when one of them goes down?

We got a preview earlier this month when AWS’s network shut down for several hours on a Monday morning. Slack, Zoom, and Docker Hub were all down or at the very least degraded. Risk & Insurance says more than 70,000 organizations were affected while CRN reported that insured losses could climb as high as $581 million.

And that wasn’t because of a cyberattack or global failure. It happened because a data center in Virginia miscommunicated with its own DNS.