MPs ask why key parts of UK IT infrastructure is hosted abroad after AWS outage

MPs have raised concerns that “key parts” of UK IT infrastructure are hosted abroad after disruption to Amazon Web Services led to outages across a wide range of internet services including HMRC, Halifax and Lloyds.

Downdetector, a website which tracks complaints about online services, showed a spike in reports on Monday, with thousands reporting outages at Amazon Web Services (AWS), HM Revenue & Customs (HMRC) as well as at Snapchat, Starbucks, Slack and Ring.

Customers also reported an increase in outage reports at UK banks including Lloyds, Halifax, and Bank of Scotland – with 6,925 Downdetector outage reports at Lloyds at 9.31am.

An error message posted on Halifax’s website read: “Sorry, we’re unable to process your request at the moment. We’re currently having some technical problems.”

Gaming platforms Roblox and Fortnite were also affected.

A spokesperson for VodafoneThree said that although its networks were “operating normally” the outages had affected some of its apps and websites.

AWS is the world’s largest cloud computing provider and offers a wide variety of services, including storage, databases, machine learning, and security tools.

The Treasury Committee has now queried why Amazon had not been designated a critical third party (CTP).

New rules came into force at the start of the year which allowed regulators to intervene to improve the resilience of CTPs which are key service providers to the financial sector.

In a letter to Lucy Rigby MP, the economic secretary to the Treasury, the committee of MPs set out a series of questions linked to the outages.

They asked why the Treasury had not designated Amazon Web Services, or any other major technology firm, a CTP.

Committee chairwoman Meg Hillier also cited speculation that the AWS outage related to its US operations and asked if the Treasury was concerned that “seemingly key parts of our IT infrastructure are hosted abroad”?

The committee also asked what work the Treasury was doing with HMRC, which it said might have been affected by the outages, to look at what went wrong and how to prevent such incidents in future.

Reported outages on Downdetector appeared to spike between 9am and 10am for most services, and then decline through Monday, with AWS saying at 10.27am it had seen “significant signs of recovery”.

AWS added at 11.35am that the “underlying DNS (domain name system) issue has been fully mitigated” although issues were still peaking in the US on Monday evening according to the Downdetector site.

Professor Oli Buckley, an expert in cyber security at Loughborough University, said that DNS acted like “a phone book for the internet” by telling devices where they needed to go to find a particular service.

He said that a DNS error can cause thousands of systems to slow down as they attempt to locate the service until they “eventually just stop trying”.

Professor Alan Woodward, of the University of Surrey, said: “Once these errors propagate across the internet, it takes a while for the update to reach the far corners of the internet, so the outage can appear longer than you might expect for such minor errors.

“What this episode has highlighted is just how interdependent our infrastructure is.

“So many online services rely upon third parties for their physical infrastructure, and this shows that problems can occur in even the largest of those third-party providers.

“Small errors, often human-made, can have widespread and significant impact.”

Marijus Briedis, chief technology officer at NordVPN, said the outages highlighted “a serious issue with how some of the world’s biggest companies often rely on the same digital infrastructure, meaning that when one domino falls, they all do”.

Mr Briedis added that the technical fault could provide opportunities for hackers and warned of a possible increase in phishing and malware attacks.

An HM Treasury spokesperson said: “We are aware of the situation impacting Amazon Web Services.

“We and the Bank of England are monitoring the situation and are in close contact with firms.”