Australia’s top-secret AUKUS cloud may hand our data over to the U.S.

Australia’s AUKUS cloud deal with Amazon may deepen military ties — but critics warn it risks surrendering digital sovereignty, writes Jemma Nott.

AUKUS DOESN'T JUST MEAN a stronger defence pact with the United States or a very expensive submarine — it means potentially a new frontier in permanently ceding technological sovereignty.

The Australian Government announced that it was building a “Top Secret Cloud” with Amazon Web Services last year — the largest tech investment in Australia’s history. At the time of the announcement, the government made no specific link to its broader use other than to “secure and share our nation’s data at speed and at scale.” However, they also emphasised its use would be to create greater “interoperability and deeper collaboration between the US and Australia.”

Cloud services such as this one aren’t simply for intelligence storage.

According to the Government, they are:

'...[a] critical enabling capability in supporting the Australian Defence Force’s military operations.'

Microsoft and IBM wrote vision pieces positioning themselves for AUKUS-cooperation on 11 July 2024, right after the Government minted the deal with Amazon Web Services to roll out the “Top Secret Cloud” on 4 July 2024. The pieces laid out how to operationalise AUKUS cloud infrastructure, which includes a description of how to 'automate routine actions and augment human decision-making.' The implications of this new build-out in Australia have thus far been fairly understated by the defence, intelligence community and media alike.

Canberra’s $1.6B AUKUS gamble risks destabilising the Indo-Pacific

Australia’s escalating $1.6 billion AUKUS spend promises nuclear submarines but threatens to fuel division and arms racing across the Indo-Pacific.

The REDSPICE Program, first announced in 2022, is the domestic engine of this transformation: a $9.9 billion overhaul of the Australian Signals Directorate designed to move the nation’s cyber and intelligence capabilities into cloud-based, AI-enabled systems. The AWS Top Secret Cloud, launched two years later, provides the physical and computational substrate on which REDSPICE’s data-fusion and automation ambitions can actually run. Together they feed directly into AUKUS Pillar 2, where the United States, United Kingdom, and Australia plan to co-develop and operate shared capabilities in AI, cyber operations, quantum technologies, electronic warfare and autonomous weapons systems. A continuously networked intelligence and defence ecosystem that no single country can easily unplug from once built.

Most governments now run what’s called a public key infrastructure (PKI) — basically, a giant digital ID system that makes sure everyone logging into government networks is who they say they are. Each agency issues digital certificates (like secure ID cards) from a trusted certificate authority, and those authorities are connected in a wider network called a federation. This means agencies can automatically trust each other’s logins — whether it’s someone accessing tax records or a defence database. In the United States, this is known as the Federal Public Key Infrastructure (FPKI).

It connects civilian, military, and intelligence systems through a single network of trusted digital certificates. In the United Kingdom, the equivalent framework is run by the Government Digital Service (GDS) under the National Cyber Security Centre (NCSC). It provides a shared “trust anchor” for government departments and the Ministry of Defence to verify users. In other words, “increased operability” between the nations at least implies some kind of federated system where Australia, the U.S., and the U.K. can make their secure cloud systems recognise and trust each other’s digital credentials — so that a verified user from one nation can seamlessly access controlled parts of another’s classified infrastructure.

Chinese investor buys land near AUKUS ports, sparking security fears

As AUKUS subs prepare to dock, Chinese-linked firms quietly buy land nearby — and no one in Canberra seems to notice.

We already know that Five Eyes share citizen data, but this would potentially extend or streamline the sharing of citizen data. Not to mention, based on the stated goal, the plan is likely to leverage AI to provide more effective data analysis in a broader surveillance architecture. What's more, having autonomous or semi-autonomous weapons systems, or decision-making within intelligence or military operations run by AI hosted on a cloud stored by a foreign company with foreign decision-makers access is quite unlike anything Australia will have seen before.

Even though the intention of the building of this cloud infrastructure is to share data, a company like Amazon Web Services or Microsoft is subject to the U.S. Cloud Act. This means they can be legally compelled to disclose logs that weren’t intended to be shared. So, what is intended to be shared and what is not intended to be shared via the Amazon Web Services Cloud in real terms potentially won’t actually matter.

Even without compulsion, on a day-to-day basis, the US would potentially have access to the metadata of who accesses what, where and when. Building a system like this is essentially a generational decision because the more metadata is integrated into the system, the harder it is to undo and rebuilding it on a new cloud service requires billions more dollars. Once you run the brain of your alliance through a foreign-controlled cloud, integrated with AI, it’s not just data sharing — it’s shared cognition. You can’t unwind that without giving the whole alliance, in essence, brain damage.