Crown Hosting inches closer to £250m, competition-free framework
HMG still feels there's just one good place for sensitive workloads...
Crown Hosting Data Centres (CHDC) looks set to be the sole beneficiary of a competition-free government hosting framework worth up to £250 million. While the government plans to start “negotiations” for a new contract, it says that the public-private joint venture (JV) is the "only supplier in the market" capable of supplying co-location facilities suitable for the "high security classification requirements and/or support services critical to the national interest" of its customers -- even as many take less sensitive workloads to the public cloud.
The Crown Commercial Service (CCS) and Ark Data Cenres created the 25.1%-government-owned JV in 2015 under a framework which estimated spending between £50 million and £700 million over four years. In 2018 the government extended the deal for four years, up to £500 million – and this new extension (per a public tenders notice) would allow for up to £250 million in spending over seven years, starting from March 2023.
Actual spending under the Crown Hosting framework doesn’t come close to these maximum figures. CHDC’s total turnover from 2015 up to 30 June 2021 was £164 million and the new seven-year Crown Hosting II framework with CHDC as the sole supplier anticipates a substantially lower pro-rata spending cap, suggests the government expects utilisation of the service to fall in the coming years, thanks to HMG’s “Cloud First Policy”.
(The voluntary ex-ante transparency notice (VEAT) issued by the government last week specifically references “Cloud First”, noting: “The net effect of this policy is an overall diminishing of potential data centre business, especially that with a security classification of OFFICIAL, and so a greater proportion of continued data centre requirements are those that are critical to the national interest and or have higher security classifications.”)
Those government ICT services which can’t move to the cloud have very strict datacentre requirements. The government’s agreement with CHDC makes significant demands on the hosting business, including having “at least three locations separated by no less than 15km, suitable for HMG data at all security classifications”, along extremely robust physical security, lead times of no more than a month for multiple rack spaces, and no more than six months for a whole datacentre building -- and also requires contractual terms that some commercial providers may find unpalatable including the ability to terminate contracts at short notice without penalty.
Even some highly sensitive government hosting contracts are moving to hyperscalers meanwhile: last year the UK’s security services signed a hosting deal with AWS, which the FT estimated could be worth up to £1 billion.
See also: 10 key insights into UK’s bullish new national cybersecurity strategy
The original rationale for the Crown Hosting agreement was to offer better-value co-location to government under a shared services agreement. Another key aim was to reduce the number of outdated, inefficient ad-hoc data centres in use across government: a 2018 study by the EU Eureca project of 350 small public sector data centres found 40% of the servers in use were more than five years old, and consumed 66% of the energy for only 7% of the computing power of the sample. It also found three-quarters of energy consumed was wasted.
CHDC has played up those efficiency credentials, with CTO Jason Liggins noting in a 2020 post: “DEFRA has been tracking electricity use in central government ‘server rooms’ for nearly a decade. The last report in 2019 estimated that 56% of all electricity consumed by central government IT was within data centres. This percentage will likely be similar across the public sector and is an enormous electricity bill just for the IT, but then think about the three times amount wasted through inefficient facilities".
The CCS's description of Crown Hosting with CHDC notes: “Existing customers report an average of 66% savings on their like-for-like cost (facility and electricity) after relocation to Crown Hosting. The typical return on investment for removal to Crown Hosting is nine months; two years if an ICT refresh is included.”
"Subject to CCS receiving no responses to this VEAT notice, it shall commence negotiations with the supplier with the intention of awarding the contract on or around 15 March 2023" it said. Conversations with hyperscalers suggest that they are winning so much government business that the framework's sole-supplier set-up is unlikely to be challenged. AWS, for example, has won over £300 million in work under the G-Cloud frameworks alone in the past five years.
