Tue Feb 28

Australia has a new cybersecurity agenda. Two key questions lie at its heart

Written by Jeffrey Foster, Associate Professor in Cyber Security Studies, Macquarie University

The federal government is pursuing a new cybersecurity agenda in the wake of last year’s major cyber breaches with Optus ^[1] and Medibank ^[2].

“For businesses these days, cybersecurity is as important as having a lock on the door”, said Prime Minister Anthony Albanese in opening the government’s cybersecurity roundtable in Sydney on Monday. There, Minister for Cyber Security Claire O’Neil released a discussion paper ^[3] that seeks to answer questions about the role the government should play in order to improve Australia’s cyber resilience.

The government will also create a National Office of Cyber Security, and a new role based in the Department of Home Affairs – Coordinator for Cyber Security ^[5].

O’Neil said the government was struggling to find appropriate responses to last year’s major hacks due to a lack of prior policy or regulation ^[6].

The Optus and Medibank breaches each affected around a third ^[7] of the Australian population. Hackers leaked personal information including drivers licenses, passports and highly personal medical details.

In both cases, government intervention was necessary, such as by creating methods for people to replace drivers license ID numbers ^[8].

Prime Minister Anthony Albanese and Minister for Home Affairs Clare O’Neil at the cybersecurity roundtable, February 2023

Albanese and O'Neil at the cybersecurity roundtable. Dean Lewins/AAP

The discussion paper consists of 21 questions, and many focus on how government and industry can work together.

But two questions stand out as critically important.

1. Should the government ban ransomware payments?

Whether ransomware payments should be banned is a complicated question, and one that I’ve covered before ^[9].

In short, a blanket ban on all ransomware payments would be unlikely to stop cyber criminals from continuing their attacks. And the damage done to businesses and critical infrastructure could be severe. A legal ban from paying to recover their systems could mean small and medium businesses can’t recover.

O’Neil has previously stated she’s considering a ban ^[11] on ransom payments. The discussion paper demonstrates a more thoughtful approach.

It suggests the possibility of a distinction between different types of ransomware payment bans. For example, whether the government should prohibit payment to keep stolen data secret, versus payment to unlock a company’s hacked systems. It also asks whether, instead of banning companies from paying ransom, we should instead ban insurance payouts to businesses who fall victim.

2. Should the government be able to commandeer companies’ IT systems?

The Security of Critical Infrastructure Act was introduced in 2018 in response to the growing threat of attacks against the nation’s most important systems. It was more recently expanded to include a total of 11 sectors ^[12] from electrical grids and telecommunications, to education and data storage.

The act is specifically about securing the systems that our critical infrastructure run on.

But the discussion paper asks whether that should expand to include the personal data held on these systems, and to allow the Australian Signals Directorate to commandeer the IT systems of companies suffering from a hack.

While a seemingly small addition to the act, the inclusion of personal data and expanded Australian Signals Directorate powers could be reaching too far ^[13].

Specifically, it might include handing over citizens’ personal data held by the telecommunication and health sectors to the government.

What’s more, expansions to the act in 2021 and 2022 to include data storage means virtually any company could fall within its scope.

No specific details of how this potential change could work are included in the discussion paper, but it may be a step with severe consequences.

Anything else I should know?

The discussion paper also calls for simplifying regulations as a priority.

Australia’s data laws are spread across a range of acts: the Privacy Act, the Critical Infrastructure Act, the Telecommunications Act, the National Health Act, and the list goes on. Having the requirements spread out across so many acts makes it difficult for businesses to understand their obligations when it comes to cybersecurity.

What’s more, the paper clearly outlines the need to prioritise cybersecurity workforce training, both in technical and non-technical roles.

Australia has an estimated skills shortage of 30,000 cybersecurity professionals ^[14].

The discussion paper has many suggestions that will likely be welcomed by industry, but clearly some questions raise concerns amongst industry professionals ^[16] about government overreach.

At the moment, these are just questions. And industry, government and education providers will have a chance to respond to these questions over the next six weeks before decisions are finalised. Hopefully, they’ll be heard.