Published on the 03/07/2025 | Written by Heather Wright

Industry reaction…

Appropriately, for a facility which will be run by New Zealand’s spy agency, the launch of an ‘all-of-government’ data centre for New Zealand’s ‘most sensitive’ government data has raised as many, if not more, questions than it has answered.

The Government Communications Security Bureau (GSCB) has taken possession of the $326 million data centre on the New Zealand Defence Force’s RNZAF Whenuapai base.

“From that perspective, this would be in line with international best practice.”

The data centre, nearly 10 years in the making but kept quiet until 2023, is designed to provide safe, secure storage for ‘a range’ of New Zealand agencies to process and store some of the governments ‘most sensitive information’ for the next 25 years.

Minister Responsible for the GCSB and Minister of Defence Judith Collins says the data centre is ‘an essential piece of government infrastructure’.

“Today we conduct the vast majority of our business digitally, and the amount of government data that requires safe and secure storage is only going to increase,” Collins says.

“We recognise the importance of data sovereignty which is why we have built this facility to process and store our most sensitive government information over other options such as cloud storage.”

Andrew Clark, director-general of the Government Communications Security Bureau (GCSB), which will run the facility, named Mātai, says the investment has been ‘years in the planning’ due to the facility’s role processing and storing some the sensitive information.

“Both the design and location of the facility were informed by a number of factors, including our unique environment and New Zealand’s specific data storage needs,” Clark says.

While the build began in September 2024, planning for the facility started back in 2016, with four options for the location of the facility shortlisted in the North Island in 2019. Official Information Act documents show the decision was made early that the facility needed to be within New Zealand, preferably on existing Crown land. Value for money was a ‘strong’ factor, along with geographical diversity and resilience.

GCSB staff will operate the centre, though no details have been released on how many will work there or the size of the facility, with GCSB previously deeming that information as too sensitive.

Ian Rogers, managing director of Team IM New Zealand, notes most new data centre builds in Australia and New Zealand are in the range of 15-25 megawatts and come with a price tag of around $250-$500 million, ‘so I can only assume it’s about that’.

His big question, however, is around the location of a second facility to provide disaster recovery.

“Normally you would operate two regions because you need to have production and disaster recovery. If something happens to the data centre – there’s a fire, you lose connectivity, a power cut lasts a long time or a plane crashes into the data centre on landing or takeoff [Whenuapai’s RNZAF Base Auckland is the NZ Defence Force’s largest operational air base], or something, how are they going to handle disaster recovery and business continuity?”

He notes that most data centres across Australia and New Zealand can handle up to classified information, rather than the higher level ‘top secret’.

“That’s the only reason I can see that they would decide to do it themselves,” Rogers says.

Don Christie, managing director of Catalyst IT, an open source software company which also runs Catalyst Cloud, says the new facility reflects what the Australian government and others are doing in terms of building government-run data centres for their super secure datasets.

“Though they are calling it an all-of-government data centre, I would imagine 90 percent of government data isn’t going to be at the top secret level of data management,” he says.

“From that perspective, this would be in line with international best practice.”

Rogers notes that in Australia there are dedicated data centres for defence and top secret data, but commercial companies run the facilities.

Vault Cloud, which the Australian government has invested AU$22.5 million in via its National Reconstruction Fund, is used to provide Australian-based cloud storage services for defence, federal and state government agencies, along with private sector business.

The Australian federal government also announced a $2 billion-plus deal (over 10 years) with AWS to build a Top Secret Cloud for sharing Australia’s most sensitive information and intelligence materials with the 10 agencies forming the National Intelligence Community.

Agencies such as the Australian Security Intelligence Organisation and the Secret Intelligence Service will be able to collaborate using the service.

The Australian government had been looking at a cloud solution for several years. Microsoft was initially involved in talks, but walked away from the project.

Agencies have previously operated their own data centres.

Christie, who stresses he has no inside knowledge of the Kiwi data centre, urges caution about any infrastructure being built on proprietary software owned by businesses falling outside New Zealand’s jurisdiction.

“Whatever we might like to think about everything being air gapped and tightly controlled, which I’m sure it is, that still means we are exposed to jurisdictional risks beyond our control, which in the current geopolitical environment is a risk.”

The Australian government, he notes, has built their cloud capability on open-source software.

“Rather than doubling down on a homogenous infrastructure inside the data centre, they [New Zealand] should consider having different stacks within that data centre. They can be compatible and complementary, but this is a risk mitigation approach where you get more resilience out of a heterogenous approach to technology than you do by constantly doubling down on big fortresses – because once that fortress is breached, it falls down.

“This is a risk in general that New Zealand is facing.

“The government could make New Zealand a more resilient, sustainable place if it was strategically engaged with the sector in having alternative locations for where it puts its data and using a variety of different providers and making sure we are compatible through standardisation.”

Igor Portugal who has co-founded successful tech companies and has extensive experience in cloud and infrastructure, also sees the opportunity for a different approach: Sovereign SaaS.

He says much like how the Reserve Bank of New Zealand mandates local incorporation within New Zealand to prevent ‘distress from abroad spreading to New Zealand’, the government could mandate that data centres in New Zealand, and all the software and hardware, had to be controlled by New Zealand entities.

“It wouldn’t mean we couldn’t buy things like Salesforce anymore, but would mandate it running in a local data centre – Microsoft setting up the Azure data centre as a wholly owned subsidiary with New Zealand ownership where no government can go and chop us off. That would be super cool and give us the ability to access the best of both worlds.”

As to the new data centre, he says: “If the government wants to build a storage facility for all their super-sensitive government data, which is under control of a super-secrative agency, it doesn’t sound too bad. It doesn’t sound like a wrong thing to do. You’ve got country secrets you have to store somewhere and you don’t want them stored under the control of a corporation which falls under a foreign government.

“But it sounds a lot like GCSB have built a server room and the government decided to make it newsworthy!”