Special report

December 2009 — Issue 26

Cyber security: threats and responses in

the information age
by Alastair MacGibbon

Executive summary
risk facing us as a nation. This is due mainly
Cyber security has emerged as a critical issue to the incremental nature of government
on the national security agenda. The threat policy‑making which can’t keep up with the
to Australian interests, both strategic and speed of information and communications
economic, from the manipulation of electronic technology innovation, and more importantly,
data and information systems means that how such systems are abused.
cyber security is now a core national security
priority. The risk is not yet fully understood We argue, too, that industry self-regulation
by the public, and the current government has failed in the cyber security space. The
policy response is less than ideal. This paper paper calls for national leadership where
discusses the cyber threat environment and prompt but considered decisions are
suggests several policy recommendations for arrived at in partnership with industry. We
consideration by government. also recommend the establishment of an
internet crime reporting and analysis centre
The paper approaches the issue of cyber to coordinate the national response. These
security from a risk management perspective: decisions need to be carefully communicated
understanding that in the online space to the public, and privacy must continue to be
absolute security is unachievable. Unlike a central goal.
some other national security concerns
facing Australia, such as the possibility The global risk environment:
of conventional warfare between nation the UK and US
states, we are certain that there are criminal
In line with growing threat perceptions, both
exploitation and state-sponsored computer
Washington and London have embarked
network operations conducted against us
on major policy reviews of the cyber
now and that there will be in the future.
security environment.
This paper seeks to assist in our ability to
In October 2009, during cyber security month
understand the risks, manage them better,
in the United States (US), President Barack
mitigate them where possible, and thereby
Obama described the internet as offering
become a more resilient society.
both ‘great promise and great peril’, as being
There is a widening gap between the cyber a key component of US ‘military superiority
security problem and our national capacity and public safety’, and that the ‘internet
to deal with it, leaving a greater level of and e-commerce are keys to our economic
 2 Special Report

Box 1: The National Security maintenance of our fundamental capacity

to advance economic prosperity for
Statement
all Australians.’ 1
On 4 December 2008 the Prime Minister
The statement included references to
delivered Australia’s inaugural National
cyber warfare, cyber attacks, electronic
Security Statement in which he defined
espionage, threats to critical infrastructure
national security as, ‘freedom from attack
running on computer systems, and
or the threat of attack; the maintenance of
computers used by terrorists. As a
our territorial integrity; the maintenance of
result, bolstering e-Security efforts was
our political sovereignty; the preservation
listed as one of Australia’s top national
of our hard won freedoms; and the
security priorities.

competitiveness’. The President described the 5. Formulate coherent unified policy

victimisation of individual Americans as ‘one guidance that clarifies roles,
of the most serious economic and national responsibilities, and the application
security challenges we face as a nation.’ of agency authorities for cyber
He concluded that while online safety and security‑related activities across the
security requires cooperation at all levels of federal government.
government and the private sector, including 6. Initiate a national public awareness
engagement of citizenry, ‘government has the and education campaign to promote
responsibility to lead’.2 cyber security.
In February 2009 the Obama Administration 7. Develop US Government positions
commissioned Melissa Hathaway to for an international cyber security
conduct a 60-day “clean slate” review of policy framework and strengthen our
US cyber security policies and structures. international partnerships.
Her Cyberspace Policy Review: Assuring 8. Prepare a cyber security incident
a Trusted and Resilient Information and response plan.
Communications Infrastructure was presented
9. Develop a framework for research and
in May 2009.3 The report is strongly worded,
development strategies that focus on
saying that past policies had failed. The
game-changing technologies that have
report recommended, and President Obama
the potential to enhance the security,
accepted, a ‘ten step near term action plan’:
reliability, resilience, and trustworthiness
1. Appoint a cyber security policy official of digital infrastructure.
responsible for coordinating the nation’s
10. Build a cyber security-based identity
cyber security policies and activities.
management vision and strategy that
2. Sign off on an updated national addresses privacy and civil liberties
strategy to secure the information and interests, leveraging privacy-enhancing
communications infrastructure. technologies for the nation.
3. Designate cyber security as one of the
However, to date the White House cyber
President’s key management priorities.
security policy official (‘cyber tsar’) has not
4. Designate a privacy and civil liberties been appointed, and since this role is vital to
official to the National Security Council. the delivery of the remaining nine steps, it
would appear little progress is being made.
 Cyber security: threats and responses in the information age 3

Indeed, with the number of US agencies Defence Signals Directorate (DSD) in Australia,
involved in the cyber security space, and with Government Communications Headquarters
significant jurisdictional overlap between in the UK, and the Cyber Command within the
them, it is unlikely Australia would benefit US National Security Agency.
greatly from following current US practices
(but could gain from some of the principles Why e-Security matters in the
espoused in the review).
Australian National Security
In June 2009 UK Prime Minister context
Gordon Brown delivered the UK’s first Cyber
According to the Australian Bureau of
Security Strategy. The strategy concluded
Statistics there’s a continued rise in internet
with the following assessment:
use and access (see Figure 1). As of June
Just as in the nineteenth century we had to 2009 there were 8.4 million active internet
secure the seas for our national safety and subscribers in Australia.5
prosperity, and in the twentieth century
Consumer passion for the use of information
we had to secure the air, in the twenty first
and communications technologies (ICT),
century we also have to secure our position
the internet and mobile telephones in
in cyber space in order to give people and
particular, is matched by companies, and, to
businesses the confidence they need to
an almost equal extent, government agencies.
operate safely there. 4
Networked computer systems, laptops,
The strategy argues that economic removable storage media, mobile telephones
considerations alone make cyber security with the power of many personal computers,
a priority: 90 percent of offline purchases have all made information less physical and
use credit or debit cards relying upon thereby more susceptible to loss, redirection,
telecommunications systems; £50 billion in and outright theft.
e-commerce transactions occur each year. As
In the past decade the unauthorised
part of the strategy, the British Government
exploitation of online systems by criminals
has established an Office of Cyber Security
has evolved from a cottage industry
and appointed a Cyber Security Minister.
to a factory production line. Uptake of
UK government capabilities and policy technologies has outpaced our capacity to
developments have more in common with deal with the unintended cyber security
Australia than the US experience. In fact, the risks. Criminals break into computers to steal
UK program of work is almost identical to that information like credit card details, email
in Australia’s Attorney–General’s Department. addresses, passwords, and economic secrets,
A significant point of departure between the and use or sell it. There are well developed
British and Australian responses has been the global markets trading in this information.
notion of privacy which receives less attention
Governments have realised the benefits too,
in current Australian thinking.
developing computer network exploitation
It is also of note that in May 2009 capabilities to gather information from
Australia—and in June 2009 the US and the economic, military and government
UK—announced the formation of operational systems offshore.
cyber defence centres within their respective
Bad actors can use a compromised computer
signals intelligence agencies: the Cyber
to pretend to be the actual subscriber of a
Security Operations Centre as part of the
4 Special Report

Box 2: The government’s After its 2006 review, the ESNA priorities
became to:
policy today
• reduce the e-security risk to Australian
Since 2001 the E-Security National Government information and
Agenda (ESNA) has been the Australian communications systems
Government’s policy vehicle aimed at
• reduce the e-security risk to Australia’s
creating ‘a secure and trusted electronic
national critical infrastructure, and
operating environment.’
• enhance the protection of home users
ESNA has been the primary (but not and SMEs from electronic attacks
only) source of funding for Australia’s and fraud.
preparations against (criminal and
state‑sponsored) cyber attacks on In 2008 a further review of ESNA was
Australia’s National Information conducted. The ‘E-Security Review’
Infrastructure (NII). ESNA has also provided recommended several new core capabilities
for broader cyber security initiatives, and initiatives, including:
including specific funding for building • the creation of a national Computer
operational agencies’ capabilities in Emergency Response Team (CERT)
the areas of crime and intelligence, utilising (and building on) the
information sharing (under the auspices contracted services of AusCERT
of the Trusted Information Sharing • the establishment of a Cyber Security
Network) between government and Operations Centre within the
private companies owning and operating Department of Defence
critical infrastructure (water, electricity,
• the creation of an e-security code
telecommunications, food, etc), as well as
of practice for Internet Service
public and business education (including
Providers (ISPs)
E-Security Awareness Week).
• the development of a
Throughout the life of ESNA the whole‑of‑government international
Attorney–General’s Department has been engagement strategy for e-security.
the lead policy agency for cyber security.
ESNA policy priorities talk about reducing
One of the enduring arrangements risk and enhancing protection, but the
of ESNA has been the Joint Operating initiatives over the past 8 years have largely
Agreement between the Australian Federal been reactive, relating to information
Police, the Australian Security Intelligence sharing and investigation—with the
Organisation, and the Defence Signals exception of the ISP code of practice—not
Directorate allowing for information attempting to change the structural
sharing and investigations relating to NII settings in which cyber attacks occur.
incidents, threats and vulnerabilities. This is symptomatic of the “light touch”,
The ESNA was first reviewed in 2006. co-regulatory-based approach towards
One of the review’s findings was telecommunications of the era, which has
‘that because the online environment relied upon industry self-regulation and,
is highly interconnected, e-security largely, failed.
threats to different segments of the
Australian economy cannot be addressed
in isolation.’6
 Cyber security: threats and responses in the information age 5

service or can add the compromised machine difficulty in absolute attribution—in the
to networks of other compromised computers online space that emboldens criminals.
called ‘botnets’. Botnets are controlled
The unfortunate reality of all types of online
remotely, and can be used to shut down
crime is that there is a very low likelihood
the internet activities of businesses and
of offenders being caught. This low risk of
governments through distributed denial of
apprehension or conviction combined with
service (DDOS) attacks, as well as to deliver
the profitability of activities has ensured a
spam emails, crack passwords, and a growing
steady supply of willing offenders and drives
number of other illegal activities.
lucrative ongoing criminal innovation.
In short, cyber security is a growing national
There is plenty of opportunity for online
security concern for three main reasons: the
crime, with over a billion internet users
threat posed to Australia’s economic interests;
globally, and millions of businesses and
the integrity of Australian Government
government agencies holding data in
information and systems; and the wellbeing
networked computer systems. Sometimes
of the Australian public.
users lack experience and understanding
Most importantly, the pace of change, of the consequences of their actions; other
the scale of the problem and its extended times the computer itself is vulnerable to
geographic nature necessitates national exploitation. Often it is both.
leadership and robust action consistent with
It is easy to see how problems can keep
other national security interests.
occurring. A March 2009 report by the
Australian Communications and Media
The drivers for wrongful online Authority, Australia in the Digital Economy
activity Report 1: Trust and Confidence highlights
the complacency of the Australian
One of the key factors driving increased
internet population—less than 50 percent
criminal behaviour online is that there is a
presumption of anonymity—and a real
Figure 1: Internet subscribers in Australia

Source: Australian Bureau of Statistics, Report on Household Use of Information Technology, Australia, 2007–08.
 6 Special Report

of survey respondents have installed All IT security companies can show charts
anti-virus software, and even fewer had indicating near exponential growth in criminal
firewalls or other protective measures on attacks and exploits against computer
home computers. operating systems.

There is a strong link between bandwidth Below is a chart taken from the IBM Internet
and computer use: more of one leads to Security Systems X Force 2008 Trend and
more of the other. This holds true for misuse Risk Report published in January 2009 which
and victimisation. With the announcement shows the steady climb of vulnerability
of the National Broadband Network (NBN) disclosures in software.7 These vulnerabilities
to deliver 100 megabits of data per second are potentially used by criminals and state
to 90 percent of the Australian population, actors to attack the computer systems and
a step-change in safety and security must applications that we use.
be developed.
The McAfee Labs Blog8 (Figure 3) looks at the
Now is a unique opportunity for Australia unique attack tools used by criminals, which,
to redress some of the structural and policy as with the chart above, shows a rapid growth
weaknesses of the past and to establish global in the threat.
leadership in this field.
Oftentimes such malware is combined with
‘social engineering’, aimed at convincing users
Death by a thousand cuts to undertake activities they otherwise would
We have seen that malware—malicious not. It is this amalgam of devious software
criminal programs which perform functions and human trickery which has compounded
not authorised by the user like leaving a “back the problem, multiplying the vectors of attack
door” open to the computer or transmitting and making it much harder to reduce risk.
passwords or sequences of keystrokes to A tipping point occurred around 2003 with
online collection points—has proliferated. the advent of phishing, whereby criminals

Figure 2: Vulnerability disclosures, 2000–2008

Source: IBM Internet Security Systems X Force 2008 Trend and Risk Report.
 Cyber security: threats and responses in the information age 7

Figure 3: Unique malware growth

Source: McAfee Labs Blog.

Heartland Payment Systems, 7-Eleven, and

masquerade as reputable businesses, and use Hannaford Brothers supermarkets.
fake emails and websites to trick users out of
Anywhere financial or identity information
their passwords and other identity credentials.
sits it is fair game. For example, in October
Criminals realised that the average consumer 2009 the UK’s Guardian newspaper admitted
held information of value, like their password to losing up to 500,000 job applicant’s
and identity information. It was at that point details9. Similarly, the NSW Government’s job
that the scale and jurisdiction of the threat site was hacked in early 2009, exposing the
moved beyond the capability of individual personal details of an undisclosed number of
government agencies. Rather than attacking job applicants.
a centralised bank system that might have
So far the best protection we have had
the details of five million account holders,
against victimisation is criminal inefficiency.
criminals duped account holders directly,
Criminals often get hold of data—but their
who are largely unprotected and therefore
capacity to exploit it can be limited. It is an
unaware of the risk to themselves or others.
important distinction.
The criminal can get the same information in
a scaled way, individual by individual, with a
very low likelihood of detection and an even
Espionage—Computer
lower likelihood of prosecution. Network Exploitation
Of course that is not to say central Certain countries also have an interest in a
repositories are disregarded by cyber range of sensitive Australian Government
criminals. For example, in August 2009, Miami information. This is especially true for
resident Albert Gonzalez was charged for his information which sits in the realm of
part in stealing 140 million credit card details traditional national security considerations:
after compromising US credit card processor trade, defence, foreign affairs and intelligence.
Australia’s close intelligence partnership with
 8 Special Report

the US, UK, Canada and New Zealand make it serve to solidify DSD’s information assurance
a more obvious target for attack. capacity and broaden its ability to assist
other agencies.
The Australian Security Intelligence
Organisation (ASIO) acknowledges that Although some progress is being made in
Australian Government and business improving resilience of government systems
computers have been the target of foreign and the practices of staff, there is still
intelligence agencies.10 The US Office of the significant discretion granted in the Australian
National Counterintelligence Executive in its Government Information Security Manual
2008 Annual Report to Congress on Foreign (formerly ASCI 33) to chief executives of
Economic Collection and Industrial Espionage government departments to issue waivers
gives more detail about attacks against the and to diverge from security best practices
US Government, and specifically identifies provided by DSD. Though it is interesting to
mobile telephones, particularly the Blackberry note in certain circumstances discretion is
and iPhone, as being of increasing importance being eroded, evidenced by the Australian
and concomitant risk.11 Open source reporting Government Information Management Office
indicates just how pervasive and damaging Instructions on the Allocation and Use of
attacks against mobile devices may become.12 Blackberry in the Australian Government.13

As well, some of Australia’s trading partners If the Australian Government expects

and commercial competitors show a keen strategic businesses to improve their IT
interest in data held by Australian businesses. systems and practices, which are not
Economic espionage makes good sense: progressing at the pace of government
access to sensitive information, like the price efforts, it must lead by example and further
a large exporting company will accept for reduce the discretionary powers of individual
wheat, coal, or iron could cost the nation departmental chief executives within the
billions of dollars in lost export revenue, either Information Security Manual, while increasing
through purchasers driving a well-informed the authority of DSD. A controversial, but
harder bargain, or being undercut by a rival necessary, change.
seller. Yet—on the whole—such information
There is no current capacity to measure and
is stored and accessed in corporate systems
report on the cyber health of government
which have questionable defences, and often
networks, and such a system needs to
handled by staff unaware of the value of
be introduced, based on self assessment
such information.
against criteria established by DSD, and
Under the Australian Government IT monitored by the Cyber Security and
security arrangements, the Defence Signals Coordination Committee chaired by the
Directorate has the lead information Attorney–General’s Department.
assurance function for government, providing
The government must endeavour to
advice to other agencies. The logic being that
provide a cohesive and comprehensive
since DSD is Australia’s signals intelligence
set of information assurance policies,
agency, knowing how to attack and exploit
recommendations, and guidelines to
can assist in defence.
Australian businesses to ensure that
The establishment of a Cyber Security reasonable best practices are encouraged and
Operations Centre within DSD, which will poor practices are never rewarded.
provide a 24/7 watch and warning role, with
staff from AFP, ASIO and CERT Australia, will
 Cyber security: threats and responses in the information age 9

In an effort to speed up private sector Much legitimate internet traffic emanating

change, the government must increase the out of South Korea was dropped by the US in
scope and frequency of intelligence briefings an attempt to stem the attacks, hampering
to Australian businesses on the types of the activities of innocent South Korean
activities and threats they may encounter, citizens, business and government. This
as well as expand ongoing communications highlights the collateral damage that can
channels. CERT Australia and DSD will play occur with such attacks, helping dispel
significant roles in this endeavour. the ‘clean’ or surgical notion suggested by
some. A New York Times report suggested
Cyber Warfare—Computer that concerns over lack of ability to
contain the effects of an attack led to the
Network Attack
Bush Administration shelving a plan to launch
The notion of cyber warfare has remained a cyber attack on Iraq’s financial system
attractive to military commentators before their invasion in 2003.15
over several years mainly because of the
Most commentators agree though, that such
asymmetric nature of the attack, the
attacks are more annoying than damaging,
supposed ‘clean’ nature of the attack, and the
and the most successful cyber efforts will
deniability associated with the attack.
operate in the realm of less overtly visible
Two significant examples are the distributed compromise of computer systems.
denial of service (DDOS) attacks conducted
A report on Capability of the People’s Republic
against Estonia in 2007, and Georgia during
of China to Conduct Cyber Warfare and
the South Ossetia War in 2008, both carried
Computer Network Exploitation prepared
out by Russian interests. Most evidence would
for the US–China Economic and Security
point to Russian nationalists who may have
Review Commission highlights conventional
acted on behalf of Russian authorities.
and irregular forces being developed for war
We have seen examples in Australia where fighting, but devotes most of its effort to the
issue-motivated groups have used website espionage side.16
defacement as a means of disruption and
There are, of course, offensive cyber
spreading propaganda, but they pose no
capabilities being developed by various
greater security risk than the embarrassment
militaries, and China is most often cited. The
to governments: the equivalent of an
concept of developing computer network
electronic poke in the eye.14 So do most of the
attack capabilities to work alongside other
denial of service attacks launched against
military assets is a rational one for all
government websites, as there is little if any
militaries; it is a reasonable extension of the
impairment to non-public systems.
role that electronic warfare plays in modern
But the July 2009 attacks launched out of conflicts. The US National Research Council
South Korea against US Government (and of the National Academies has published
other) websites shows how such attacks could a thoughtful document on the various
have more significant implications. It seems considerations that need to be taken into
that the attackers had been careful to use account when developing a cyber attack
mostly computers from South Korea whereas capacity: legal training, command and control,
in other DDOS attacks computers would political fallout and a range of other issues.17
generally be more geographically dispersed.
Australia has announced the formation of a
Joint Electronic Warfare Centre and it will be
 10 Special Report

important to work through Australia’s own Critical Infrastructure

cyber warfare concepts, to understand the
less-than-surgical nature of such activities, to With the pervasiveness of information
understand what collateral damage may be and communications technologies across
inflicted, and to determine what thresholds industries, it is logical that an increasing
of attack justify responses, as well as dealing amount of Australia’s critical infrastructure
with the issues raised in the US National is either directly or indirectly supported by
Research Council report. those technologies. Critical areas include
food production and supply, electricity, water,
transport, telecommunications and banking.
Terrorist use of the internet
Of course many federal and state government
Terrorist groups increasingly use the systems are essential too, like the police and
internet for communications, propaganda, emergency services.
recruitment and radicalisation. As a previous
Security vulnerabilities in these systems could
ASPI publication has noted, the problem in
be exploited to subvert or impair networks,
Southeast Asia is growing.18
although there have been very few open
The online motivations and methods of source references to such actions.
terrorist groups are similar to those of other
In the area of critical information protection,
criminals: they benefit from the relative
the Australian Government, via its Trusted
anonymity of online transactions, including
Information Sharing Network, has done
establishing websites and peer-to-peer
a good job in sharing threat information,
channels for communications. They benefit
and engaging private sector partners. This
from the ease of conducting online fraud and
capacity will expand with CERT Australia and
there have been publicised examples where
the insights available from the Cyber Security
terrorist groups have raised funds through
Operations Centre.
internet fraud.19
And Australia continues to participate in
The internet has allowed terrorists and
global exercises with our allies to simulate
other issue-motivated groups to get their
attacks on this type of infrastructure.
message—uncensored—to the world in
However, there is a diminishing ability to
a real-time way. This is possibly where the
distinguish between a critical infrastructure
internet has been of greatest benefit to them.
network and end users, whether businesses or
Those messages are then often re-broadcast
households. In fact, to focus on one without
by mainstream media. While serving to erode
the other is to address only half the problem.
public confidence in Western government
actions and to influence public debate, the
biggest danger is that potential recruits A problem without borders
and sympathisers may find succour in the The inherently multi-jurisdictional nature
message, and be emboldened to greater of the internet hampers efforts to fight
radicalism and violence. its abuse. The law enforcement, domestic
It is worth noting that cyber terrorism— intelligence and regulatory agencies of nation
whereby terrorists conduct computer network states are jurisdictionally bound, and criminals
attacks—has largely failed to materialise. exploit the inefficiencies of jurisdiction to
This is most likely explained by the greater their own advantage. Even where there
publicity and impact derived from traditional are good intentions for mutual assistance
physical attacks. between countries, mechanisms designed
 Cyber security: threats and responses in the information age 11

for offline cooperation are not suited to the Should the onus be on victims to know the
online environment. And there remain many bureaucratic processes of government, or the
countries where legal regimes are weak, or physical location of their internet attacker to
where there is a lack of will to impose the rule report an incident? On the whole, businesses
of law on criminal actors operating online. and consumers have been left to protect
themselves and to clean up the mess when
The 2008 e-Security Review recommended
things go wrong.
enhancing Australia’s international efforts.
Current efforts should be commended, but
they can go further. Just as the Australian A national response:
Federal Police have deployed liaison officers establishing an internet crime
to international drug crime hubs, and other reporting and analysis centre
locations to take the counter terrorism
Australia needs an internet crime reporting
fight offshore, appropriately skilled officers
and analysis centre for homes and businesses.
need to be deployed to internet crime
The relevant federal law enforcement and
troublespots: East Africa, Russia, and some
consumer protection agencies are not
of the more active former Soviet republics
constituted, staffed, or able to deal with the
at the least. They should also seek to have
often small and seemingly inconsequential
officers embedded in allied high-tech crime
incidents of fraud, spam, scams, data loss,
investigative agencies, particularly in the
inappropriate content, or sometimes IT
United Kingdom, Canada and the United
security incidents. We need an internet
States, to assist in information sharing and
‘shopfront’ approach. A place for people to
joint operations.
report matters, and to seek advice: a single,
Additionally, the efforts of AusAID need to be consumer-orientated destination, scaled
harnessed to build cyber crime fighting and for the internet, which takes a national
cyber security capacity in weaker regional whole‑of‑government approach.
states to reduce their ability to provide safe
This would not just bring Australia into
harbour for network abuse.
line with the UK, which has announced the
The small nature of many individual online formation of the National Fraud Reporting
incidents means that much of the time they Centre to tackle all fraud and online crime
go unnoticed even if reported. One individual complaints, but would go to the next logical
act may be spread across many jurisdictions step of delivering services covering safety and
and be replayed against thousands of security for the end user in one place.
victims, all of whom have a small loss that
An internet crime reporting and analysis
combined becomes something of much
centre would be most successful as a
greater magnitude. The fragmented and
public-private-partnership which could allow
often opaque nature of incident reporting
real-time information flow between the
prevents law enforcement, regulatory and
government’s CERT Australia and the Cyber
security agencies from seeing a true picture.
Security Operations Centre, giving Australia
Often it is unclear if there is a logical place for
a more holistic view of Australia’s internet
reports to be made; agencies accept reports
health, and improving our ability to respond
only when they fall into (sometimes narrow)
to threats and rebound.
interpretations of jurisdiction, reducing the
likelihood of successful intervention and
identification of perpetrators.
 12 Special Report

An internet crime reporting and analysis networks (by building on the existing
centre would deliver significant benefits, Australian Communications and Media
including an ability to: Authority (ACMA)-managed Australian
• aggregate complaints to better determine Internet Security Initiative). It also highlights
the scope of crime, and to pass on that the role of consumer education.
information to relevant agencies to But because it will be an industry code
investigate those responsible created under the co-regulatory regime of
• gather intelligence and trends on scams, the Broadcasting Services Act 1992, it notes
illegal content, crime, and IT security ‘the measures recommended in the Code
attacks from Australian households should not adversely affect the commercial
and businesses viability of the parties and the services
• provide a single point of education and they make available’.20 Even when the
remediation for Australians code is finally registered with ACMA, and
therefore enforceable, it is unlikely ACMA will
• give a sense of redress to victims, reducing
proactively check for compliance across ISPs:
feelings of helplessness and frustration
all part of industry self-regulation.
• pass on relevant information to other
countries for their action It is time for Australia to consider whether the
current ‘light touch’ approach towards the
• reduce individual victimisation and losses
internet has served its use-by date. It allowed
• provide information back to industry to Australia to develop its internet capacity in a
reduce further victimisation. relatively unfettered and competitive way, but
Importantly, a rationalisation of existing at the cost of safety and security, which may
resources within individual agencies already now be inhibiting future growth.
tasked with such reports should make A final—and more prescriptive—code needs
this a relatively inexpensive exercise, with to be registered with ACMA, and enforced. It
significant upside in terms of output. is inappropriate that backyard ISPs—providing
such essential services to the community—
A time for shared should be allowed to provide limited safety
responsibility and security measures to their customers.

Internet Service Providers (ISPs) play a crucial As the NBN begins to roll out next year
role in connecting Australians to the internet, the government-owned NBN Company
as do others in the internet industry such as will eventually become the dominant
registrars (who issue domain names), and they wholesale broadband ISP for Australia. Proper
could play a much greater role in protecting consideration must be given to policies that
us. But for a long time many of them have enhance the end-point security of users so
argued that as providers of a commercial that computers connecting to the network
service, they are unable to assist. have adequate IT security protection, are
patched, and pose a lesser threat to other
The government-backed draft Internet
internet users and themselves. Even Microsoft
Industry ISP Code of Conduct for e-security is
has realised that it is better for the internet at
a good first step in recognising how ISPs can
large to allow security updates to install even
help reduce e-security threats.
on pirated copies of Windows,21 a marked
The draft code covers issues such as detection change of policy for the company.
and removal of ‘zombie’ computers on
 Cyber security: threats and responses in the information age 13

Registrars are those who issue internet And online businesses need to offer safer
addresses (domain names) that we rely upon services, where education, security and
for a healthy internet. We need to have some encryption are built into the product,
comfort that we are visiting the website rather than—sometimes—added as an
we think we are. The registrar business is a afterthought. In fact, any organisation
volume business, not one which spends a which collects information and stores it
great deal of time determining if an applicant electronically has to build security in, as they
for a domain name is who they claim to be. It are not immune from compromise.
is about time that Australia instituted a ‘know
While the Department of Broadband,
your customer’ regime for registrars, just as
Communications and the Digital Economy
we have for financial and other services.
(DBCDE) has the responsibility under
But it isn’t just ISPs and registrars who need ESNA for educating home users and SMEs
to shoulder more of the burden. There is a in e-security, ACMA has funding and
greater role for those whom we entrust with responsibility for online safety education. It
our information: business and government. is time to consolidate these efforts. It is time
They need to have strong incentive to collect to build greater resilience into the Australian
and store less information and better protect internet population through an effective
the information they do collect. Some of ‘public health’ style campaign designed to
this change can be brought about by the change user behaviour.
government acting on the data disclosure
It is time to weave internet citizenship
changes suggested by the Australian Law
education seamlessly into the school system.
Reform Commission in its review of the
Children should not just be taught how to use
Privacy Act 1988. In particular, the need for
technology, they must be taught how to use it
businesses to notify individuals if data is lost,
wisely, safely and securely.
the Privacy Commissioner, and—perhaps—
the proposed new internet crime reporting
and analysis centre. Real cyber security for Key recommendations for
individuals will not be possible without strict government
adherence to these privacy considerations. • Establish an internet crime reporting and
analysis centre for homes and businesses.
End user responsibility • Enact data disclosure changes suggested
by the Australian Law Reform Commission
Individual end users will need to be more
in its review of the Privacy Act 1988.
responsible in reducing their own e-security
risk. We have failed as a society in how we • Consolidate the online safety and
actualise that responsibility. The mantra of security education efforts of DBCDE
end user responsibility has often been taken and ACMA and undertake ‘public health’
as an opportunity for governments and style campaigns designed to change
businesses to play a minimalist role. If nothing user behaviour.
else, it has allowed both to invest very little in • Partner with home users and SMEs to
preventative risk management. help them understand how they can
help themselves.
What is needed is governments and business
partnering with home users to help them • Provide internet citizenship education
understand how they can help themselves. in schools.
 14 Special Report

• Deploy appropriately skilled AFP officers all of whom contain useful information or
to internet crime troublespots as well as may be used as springboards to carry out
embedded in allied nations’ high-tech further attacks.
crime investigative agencies. 2. The pace at which the attacks have
• Build cyber crime fighting capacity in multiplied and evolved in line with
weaker regional states. society’s increased use of technology
• Develop policies that enhance the and bandwidth.
end-point security of users connecting to 3. The jurisdictional conundrum that these
the NBN. activities present to nations, where
• Enforce a ‘know your customer’ regime for criminals and foreign countries can attack
internet registrars. systems using computers from a third, or
even within the target country, and where
• Reduce the discretionary powers of
the perpetrators can reside outside the
individual departmental chief executives
geographic region and reasonable legal
within the Information Security Manual,
reach of the nation.
while increasing the authority of DSD.
4. The problem of identity, which means
• Introduce a mechanism to measure
malicious actions can be passed off as
and report on Australian Government
committed by others.
agencies’ cyber security health.
5. The indivisible link between individual
• Provide a cohesive and comprehensible
vulnerabilities and our national security
set of information assurance policies,
interests: where seemingly trivial
recommendations, and guidelines to
annoyances mix with malignant actions of
Australian businesses to ensure that
nation states.
reasonable best practices are encouraged
in businesses. 6. The pervasiveness of the information
which may be compromised, or misused.
• Increase the scope and frequency of
intelligence briefings to Australian The 2008 recommendations of the E-Security
businesses on the types of activities and Review are logical next steps in capacity
threats they may encounter. building and reflect a recognition that
• Develop cyber warfare doctrine and critical information is spreading further into
concepts for the military. the community.

But the current initiatives lack scale and

Conclusions are—largely—reactive in nature and slow to
develop. They tend not to address the root
It is clear that information and
cause of the problem, primarily because of
communications technologies have brought
the ‘light touch’ regime which has dominated
great benefit to society. It is also clear that
internet regulation up until now.
threats to individual—and national—safety
and security have grown as well due to the Cyber security will be enhanced if the
following factors, which need to be addressed government approaches the problem
in order to improve Australia’s cyber security: from a range of non-traditional angles: the
1. The scale of the problem, with targets safety and security of end users, increasing
ranging from individual home computers, protection from businesses and ISPs,
phones, and mobile devices to corporate enhanced law enforcement, intelligence
networks and government departments,
 Cyber security: threats and responses in the information age 15

and CERT capacities, right through to the 11 http://www.ncix.gov/publications/

development of cyber warfare doctrines. reports/fecie_all/fecie_2008/2008_FECIE_
Blue.pdf
There needs to be a greenfields review to
determine a platform upon which Australia 12 See for example http://www.
can build the cyber security framework for a theregister.co.uk/2009/10/23/
new generation. iphone_voip_sniffing_made_easy/ and
http://www.theregister.co.uk/2009/10/22/
rim_blackberry_bugging_software/
Endnotes
13 http://www.finance.gov.au/e-
1 http://www.pm.gov.au/sites/default/
government/security-and-authentication/
files/file/documents/20081204_national_
docs/Instructions.pdf
security_statement.pdf Transcript
of the Prime Minister’s National 14 See for example http://news.bbc.co.uk/2/
Security Statement, The First National hi/uk_news/england/wear/8350039.
Security Statement to the Australian stm and http://www.abc.net.au/news/
Parliament, p.7 stories/2009/07/16/2628167.htm

2 http://www.whitehouse.gov/blog/ 15 John Markoff and Thom Shanker,

Protecting-yourself-online/ Halted ’03 Iraq Plan Illustrates U.S. Fear
of Cyberwar Risk, New York Times,
3 http://www.whitehouse.gov/assets/
1 August 2009, http://www.nytimes.
documents/Cyberspace_Policy_Review_
com/2009/08/02/us/politics/02cyber.html
final.pdf
16 http://online.wsj.com/public/resources/
4 http://www.cabinetoffice.gov.uk/
documents/chinaspy20091022.pdf p.8
media/216620/css0906.pdf
17 http://books.nap.edu/openbook.
5 http://www.abs.gov.au/AUSSTATS/abs@.
php?record_id=12651&page=R1
nsf/mf/8146.0
18 Countering Internet radicalisation in
6 eSecurity National Agenda Policy
Southeast Asia, ASPI Special Report
Statement, Department of Broadband,
Issue 22, March 2009.
Communications and the Digital Economy,
http://www.dbcde.gov.au/__data/assets/ 19 http://www.washingtonpost.com/
pdf_file/0011/71201/ESNA_Public_Policy_ wp-dyn/content/article/2006/03/25/
Statement.pdf AR2006032500020.html

7 http://www-935.ibm.com/services/us/iss/ 20 http://iia.net.au/images/resources/pdf/
xforce/trendreports/xforce-2008-annual- esecurity_code_consultation_version.pdf
report.pdf p.18
21 http://windowsteamblog.com/blogs/
8 http://www.avertlabs.com/research/blog/ windowssecurity/archive/2009/04/27/
index.php/2009/07/22/malware-is-their- who-gets-windows-security-updates.aspx
businessand-business-is-good/

9 http://www.theregister.co.uk/2009/10/26/
guardian_jobs_data/

10 ASIO Annual Report to Parliament

2008—2009, p.12
 16 Special Report

Acronyms and abbreviations

ACMA Australian Communications and Important disclaimer
Media Authority This publication is designed to provide
accurate and authoritative information
AFP Australian Federal Police in relation to the subject matter covered.
It is provided with the understanding that
AHTCC Australian High Tech Crime Centre the publisher is not engaged in rendering
ASIO Australian Security any form of professional or other advice
or services. No person should rely on
Intelligence Organisation
the contents of this publication without
AusAID Australian Government Overseas first obtaining advice from a qualified
Aid Agency professional person.

CERT Computer Emergency About Special Reports

Response Team
Generally written by ASPI experts,
DBCDE Department of Broadband, Special Reports are intended to deepen
Communications and the understanding on critical questions
facing key strategic decision-makers
Digital Economy
and, where appropriate, provide policy
DDOS distributed denial of service recommendations. In some instances,
material of a more technical nature may
DSD Defence Signals Directorate appear in this series, where it adds to
the understanding of the issue at hand.
ESNA E-Security National Agenda Special Reports reflect the personal
ICT information and communications views of the author(s), and do not in any
way express or reflect the views of the
technologies
Australian Government or represent
ISP Internet Service Provider the formal position of ASPI on any
particular issue.
NBN National Broadband Network
ASPI
NII National Information Infrastructure Tel +61 2 6270 5100
Fax + 61 2 6273 9566
SME small and medium enterprises Email [email protected]
Web www.aspi.org.au
© The Australian Strategic Policy Institute
About the author Limited 2009

Alastair MacGibbon is an internationally This publication is subject to copyright.

Except as permitted under the Copyright
respected authority on high-tech crime
Act 1968, no part of it may in any form
including internet fraud, consumer or by any means (electronic, mechanical,
victimisation and a range of internet security microcopying, photocopying, recording
issues. Now Managing Partner of Surete or otherwise) be reproduced, stored in a
retrieval system or transmitted without
Group and founder of the Internet Safety prior written permission. Enquiries should
Institute, he advises companies on online be addressed to the publishers.
trust, and provides thought leadership on
internet safety issues. Prior to that, Alastair
headed Trust & Safety at eBay Australia and
later eBay Asia Pacific. Previously he was the
founding Director of the Australian High Tech
Crime Centre (AHTCC) and a Federal Agent
with the Australian Federal Police.