Digital Transformation Agency chief Randall Brugeaud has defended his agency’s decision to use Amazon Web Services for the government’s COVIDSafe contact tracing app.
Brugeaud told a Senate Inquiry into the government’s COVID-19 response that the hyperscale cloud provider was chosen due to the extent of its service offering, which extends beyond hosting.
He said the contract, which will set the government back $710,000 between April and October, was for “a combination of hosting, development and operational services”.
“One of the benefits of a company such as AWS is that it can scale very quickly and provide a broader range of services than simply hosting,” Brugeaud said on Wednesday.
While there were a number of other “pure hosting providers which are Australian” offering similar services, he said that didn't necessarily extend to the company's entire supply chain.
“I can't comment on whether all of their infrastructure and networks are based on Australian built infrastructure, Australian run networks and Australian owned companies that provide those services,” Brugeaud said.
He also noted that there were a “very, very small proportion” of Australian hosting providers offering what the DTA engaged AWS to do.
“Our focus was on getting an outcome with a partner that was capable of delivering the services that we needed in the time available,” he said.
“The services that we procured with AWS were much more extensive than the range of services provided by pure hosting providers.”
In answers to questions on notice provided to the committee, the DTA also said AWS was used due to an earlier decision by the Department of Home Affairs, which kicked off the work.
“Due to genuine urgency and continuation of an existing agreement (Commonwealth Procurement Rules 10.3.b and 10.3.e) to align with the arrangements that were originally established by the Department of Home Affairs,” it said.
Home Affairs handed work over to the DTA on April 3, and three days later the DTA approached AWS using a limited tender process under the the whole-of-government AWS deal.
Answers to questions on notice from Centre Alliance senator Rex Patrick also offer more information on the particulars of the contract, which was executed on April 24.
The AWS contract (with Melbourne-based Shine Solutions as a contractor) extends to “ platform design and build”, “ mobile web app build” and administration and “project control”.
“AWS solution is a robust, risk assessed solution with data sovereignty and supply chain integrity,” the DTA said.
Other contracts for the project are held with Boston Consulting Group, Shine Solutions (helpdesk support) and Ionize (cyber security assessment services).
A total of $1.5 million was spent by the DTA on the app’s development.
Back end up and running this week
While the app is currently collecting data, the portal that will allow state and territory health officials to access the information for contact tracing is not yet up and running.
Brugeaud said the portal would be activated once agreements with the states and territories around “how to use the system and [their] obligations in accessing the data” were finalised.
Department of Health secretary Caroline Edwards said this would occur in the next day or so, with the portal already ready to go.
Brugeaud also revealed that health officials would not take copies of the data, which is stored centrally in the COVIDSafe national data store.
“They [the contact tracers] will deal with the individuals who then upload the data,” he said.
“They provide a pin number to make sure that only those that tested positive upload their data to the central store.
“But that central store is in one place, and states and territories will only be able to access information relevant to their jurisdictions - they don't copy it.”
Brugeaud also said the COVIDSafe source code would be also be released at “the end of this week or early next week”.
“We have taken the code from Singapore and updated it and Singapore has since open sourced it,” he said.
“Our intention is to release the source code as well and that will be something we own and are able to use for future applications as they might be required.”
