EXCLUSIVE
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
Prime Minister Tony Abbott announced a tougher stance on national security and foreshadowed a wide-ranging package of tougher measures on Sunday, but a revamp of Australia's cyber security is not one of them.
The cyber security review designed to "assess the risk of cyber attacks in the public and private sectors with a view to making our online systems more resilient to attack" will not deliver its full findings until the end of the year, six months after the deadline announced in November.
The panel of cyber security and policy experts, led by the office of Prime Minister and Cabinet, includes Business Council of Australia chief executive Jennifer Westacott, Cisco Systems chief security and trust officer John Stewart, Telstra chief information security officer Mike Burgess, and the Australian Strategic Policy Institute's (ASPI) Tobias Feakin.
It will meet face to face for the first time in April, according to John Stewart. He said the panel has spent the past five months working independently and having an "email dialogue" on what it considers to be key issues facing Australia's cyber security strategy.
"At the current schedule, there is a section of work that is due in June and there is another section that is due at the end of the year," Stewart, who has consulted on cyber security policy for the United States, British and Swedishgovernments, and worked with Australia's military, intelligence community, public service, and police protection teams, told Fairfax Media.
"The schedule of this is not mine, it is [the] Prime Minister and Cabinet's, obviously. We are going as fast or as 'correctly sped' to do a diligent job, narrow down the areas that we can get done in a certain period of time, and nail those. Cyber to me is never done. New things are consistently emerging."
In an emailed statement on Monday, the department insisted the review "will report to government in mid-2015".
"Subject to government's consideration, it is anticipated a public document will be released thereafter," the spokeswoman said.
Last week, Jessica Woodall, an analyst at the ASPI, joined a chorus of experts questioning the review's progress.
The announcement was "very encouraging but there has been no indication from the government that the classified review will lead to a public-facing strategy, as the 2008 review did in laying the foundations for the 2009 strategy," she said.
Greg Austin, visiting professor at the Australian Centre for Cyber Security at the University of NSW, where Abbott launched the review, said the country had "an imagination deficit in policy".
Stewart said he believed the main thrust of the review should identify cyber security as being an economic issue. The internet, he added, should be considered critical national infrastructure and updating laws related to the internet should also be part of the review.
"This should be an economic discussion," he said. "That is coming through loud and clear. The discussion should be how the economy of Australia and how the people of Australia benefit from [the internet] and what are the risks being created by it that could erode any of that benefit.
"All of it is an economic conversation not a technology conversation - which is too oftentimes what cyber is brought to be."
In November, Abbott said in addition to making systems more resilient, the review would also examine "how the government and industry can better work together to reduce the risk of cyber attacks; assess how the government protects its networks and information; and work to ensure Australia is one step ahead of the threats to government networks and critical infrastructure".
Stewart outlined challenges facing government and private enterprise battling cyber attacks, especially in the shadow of the infamous Sony hack attributed by the FBI to the North Korean government.
"If a well-resourced, well-structured, capable country comes after a company then the company doesn't stand a very good chance," Stewart said.
"Yet at the same time, if a crime ring that uses very basic techniques comes after you then they might get lucky. That is another problem in cyber and, frankly, any sport. You can't beat lucky."
