The Aotearoa Digital Commission suspended new certifications for the Home Harbour programme on Friday, hours after former contractor Neerendra Mitter showed reporters how a recovery key for a test government account could be issued through a Singapore-based service. The programme has been promoted as a way to keep public data and computing jobs in New Zealand.
Six agencies have paused planned migrations, the commission said, while 38 services already moved to domestic data centres will remain online. Mitter said the overseas key route affected every project he reviewed over 14 months, including systems holding tax, health appointment and benefit records. Officials said those categories were not evidence of a breach.
The key that travelled offshore
At a Wellington briefing, Mitter used a dummy account and a screen recording to show a recovery request passing from a server in Lower Hutt to a key-management service operated in Singapore. He said the overseas provider could approve restoration of encrypted backups, despite the programme’s requirement that control of recovery keys remain in New Zealand.
Mitter said he raised the issue with Southern Vault Networks, the domestic contractor running the migration service, in May. He left the work in August after being told the Singapore system was a temporary technical bridge. “The data sat here, but the power to unlock it did not,” he said.
The data sat here, but the power to unlock it did not.
Neerendra Mitter, former assurance lead
The commission’s chair, Jūsma Priede, said an initial technical check confirmed that some recovery requests were routed offshore, but had not found evidence that customer records or encryption keys were copied. She said the pause was precautionary and would apply until reviewers tested the service’s configuration and access history.
Agencies count the cost
Southern Vault Networks said the route was used for backup recovery and did not give its Singapore operator routine access to government information. Its spokesperson, Rashad Wolf, said the company had disclosed the arrangement to the commission as a subcontracted support function, but conceded the programme’s public description had not made that clear.
The suspension could push back the next migration wave, which was due to cover 11 agencies before Christmas. Deputy digital services minister Kirsty Moore-Wilkinson said each agency would now decide whether to keep its existing provider or delay a move. She rejected calls to scrap the project, saying domestic data centres had already taken on 38 services without interruption.
The political stakes extend beyond the halted contracts. Home Harbour was launched in 2024 after officials argued that public bodies spent too much on offshore computing and that local hosting would strengthen control over critical systems. The programme’s budget includes NZ$190 million for infrastructure grants and workforce training.
The commission will publish its review findings on 30 October and decide whether the six paused agencies can resume migration. Priede said the panel would test who could authorise a recovery, where that approval was recorded and whether the route could be removed without disrupting live services. The government has not yet said whether it will seek repayment from the contractor.
