0
A view of downtown Almaty, Kazakhstan. /EPA-Yonhap News Agency

Concerns are growing over potential data security vulnerabilities in Kazakhstan's key industries following reports that a local company managing the information technology (IT) infrastructure of major state-owned enterprises is cooperating with a Russian cloud service provider.

Although the companies have denied leaking sensitive information to Russia, questions remain over whether they can maintain control over their data, given their reliance on Russia-based core cloud technologies.

According to Kazakh news outlet AZH on Nov. 11, Olzhas Satiyev, President of the Center for Analysis and Investigation of Cyber Attacks (TSARKA), one of Central Asia's largest private cybersecurity companies based in the capital Astana, warned in a recent interview that cooperation between Russian cloud platform VK Cloud and Kazakh IT infrastructure operator QazCloud could pose potential risks to national data security.

Satiyev explained, "Russian cloud service providers such as VK Cloud, Servercore and IT-GRAD operate in Kazakhstan, but they do not own data centers in the country and instead rent facilities from local operators."

He added, "In some cases, core technical support and system management are provided from Russia," warning that dependence on foreign technology could pose potential risks to the country's digital sovereignty.

QazCloud, a subsidiary of Kazakhstan's sovereign wealth fund Samruk-Kazyna, manages the IT infrastructure of major state-owned and quasi-state-owned enterprises.

The fund also oversees major state-owned companies operating in the country's core industries, including oil and gas producer KazMunayGas, uranium producer Kazatomprom, national power grid operator Kazakhstan Electricity Grid Operating Company (KEGOC), and railway and logistics company Kazakhstan Temir Zholy.

Russian cloud service provider VK Cloud entered the Kazakh market in 2023 through a partnership with QazCloud, deploying its cloud technologies at local data centers.

In February this year, VK Cloud further expanded its operations by deploying its technologies at the Kazteleport data center in Astana.

Samruk-Kazyna and QazCloud maintain that sensitive corporate data is secure because it is managed through separately established, independent systems.

Nevertheless, concerns persist over reports that the core technology and operational infrastructure of the cloud services are based in Russia. Even if data is stored on servers in Kazakhstan and managed through separate systems, the underlying technology and operating architecture are based in Russia, raising questions about the extent to which access from outside the country can be controlled.

It has also not been publicly confirmed whether the security systems have undergone independent verification by a third-party organization.

                                                                                                               Kim Min-kyu