Microsoft outage shows Australia must develop digital resilience, experts warn, but it will cost - ABC News & Headlines – Australian Broadcasting Corporation

Some experts say improving digital resiliency would require significant investment. (AP: Lindsey Wasson)

A Melbourne University academic says Australia is dependent on US tech companies, including Microsoft, Google and Amazon. 

Another says governments have to make our tech infrastructure as robust as our banking system, through legislation, oversight and regulatory controls.

A scientist expects more outages and hacks in the years to come.

Shifting Australia's dependence away from US technology companies towards a more resilient and sovereign digital infrastructure will require significant investments, experts warn.

The calls for improved "digital resilience" follow widespread, global outages affecting Microsoft platforms, including Outlook, SharePoint and Copilot.

The company posted an update just after 9am (AEST) yesterday saying it had begun a "gradual recovery" of access to its email and other online services.

An hour later, it posted another update that restored servers were becoming unresponsive again.

And as the day unfolded, Microsoft reported the ups and downs of its efforts to restore services.    

University of Melbourne's Andrew Cullen, who specialises in cybersecurity and artificial intelligence (AI), said US tech is integrated throughout Australia's digital infrastructure.

"We're so dependent upon these tech companies. Most of our emails come through either Microsoft or Google. Most of our websites are managed under the hood by Amazon or a few other kind of key cloud providers.

University of Melbourne's Toby Murray, who previously worked for the Department of Defence and specialises in cybersecurity, said advice about what organisations should be doing to be more resilient was changing.

"The usual way we set up our organisations, at least in the last 10 to 15 years, has been to move to cloud-based services," Professor Murray said.

"It is a real challenge once you move these systems into the cloud and when we all rely on a very small number of vendors for those cloud services."

Dr Cullen said organisations had to create plans for outages, because they might not be able to anticipate the source of an outage, but could create contingencies.

"So, for businesses, that means having a plan to work out how you run operations if you don't have access to email or access to Teams," he said.

Microsoft has been working on its back-end servers to find a solution. (Supplied: Microsoft)

"It's important for governments to play a role in saying we are dependent upon these services. They can't be treated as being too big to fail.

"There really needs to be a push to try and make sure that they're as robust as our banking system is through legislation, through oversight and regulatory controls."

Apart from legislation, Professor Murray said government or businesses could create alternatives to the likes of Microsoft to improve resiliency, but moving those services in-house would be more expensive and require significant investment.

"You're then responsible for maintaining them yourself, which brings its own risks and its own costs as well.

"For many organisations, it's much cheaper, and it's often more secure, to put these services in the cloud. Instead of having a thousand different small businesses each having to run their own email systems."

Toby Walsh, the chief scientist at the University of New South Wales AI Institute, said he expects more outages and hacks in the years to come.

Professor Walsh pointed to the vulnerabilities found within PHP, a programming language used by more than two-thirds of websites, that led to millions of hacking attempts.

"I hate to be a doom monger, but we're discovering that the foundations of the internet are somewhat shaky.

"I'm told that to discover the PHP bug, the prompt was 'find a serious flaw in PHP'. That's all you had to type into the prompt and let the system run. So those tools now are available pretty much to anyone," Professor Walsh said.

Last month, hackers launched a "large-scale" attack on French supermarkets, raising refrigerator and freezer temperatures at hundreds of stores to as high as 50 degrees Celsius, causing fires and spoiling food.

Professor Walsh said our digital systems were critical assets similar to power stations and air traffic control systems.

"When we see fridges in France being disrupted by bad overseas actors we realise that we're going to have to put a lot more care and attention into protecting our digital assets," he said.

Fridge aisles across hundreds of stores in France were closed after hackers raised temperatures. (Reuters: Stephane Mahe)

Dr Cullen said it is important to consider how to improve the resiliency of digital systems, but not everything needed to have online access.

"Fundamentally, anything that we put on the internet is going to be exposed to hackers and that's going to be a real risk going forward.

"So, while lots of businesses across the economy recently have been putting things on the cloud and kind of moving to more internet-enabled devices, we really should be asking ourselves, 'what things actually do need to be connected to the internet?'"

There is scope for Australia to wean itself off its digital dependency on large US tech companies, Dr Cullen said. It just needs to look to France.

In April, the French government announced it would be moving its operating systems from Microsoft to Linux, a free open-source operating system.

"So rather than working with Zoom, the French government has its own version of Zoom. Rather than working with Teams, they've got their own version of Teams.

France's President Emmanuel Macron has called for Europe to reduce dependency on US tech companies. (Reuters: Thomas Samson/Pool)

"That may seem slightly crazy on the surface, like it's a lot of investment to make, [but] there are real dividends because now the French government is in full control of their kind of digital infrastructure.

"They can invest in things that matter to them. They can make sure they've got the security in place, the resiliency in place, they can be accountable to themselves."

Dr Cullen said government authorities in Germany and Austria were reassessing their dependency on US-based technology companies.

He believes there is scope for Australia to follow suit and begin developing its own sovereign digital infrastructure.

"We might not be able to kind of shed ourselves completely of Amazon or Microsoft, we probably shouldn't be completely shed of them because these companies do provide good services," he said.

"But there is also scope for Australia to take a little bit more of an active role in our digital future by investing in services and systems that we can say are Australian made, Australian owned, Australian controlled."