Page 42 - Australian Defence Magazine May 2019

CYBER
ECOSYSTEM
Defence is just part of the cyber ecosystem of government.
“That’s not to say we won’t talk to indus- try but there’s some aspects here where we’ll back ourselves,” MAJGEN Thompson said to ADM. “One of the biggest issues in cyber comes down to trust; who do you trust and how much? The basics of the prisoner’s di- lemma come into play.
“For the first time, we can start talking in more detail about what our staff do, what kind of skills they have, and why you might want to come and work with us,” Burgess said in a March 27 speech to the Lowy In- stitute. “Why is that important? Transpar- ency informs, helping dispel myths and most importantly helps with our value proposition to prospective employees.”
And this is where the bogeyman comes out to play; what’s real and what’s a myth? Books like Ghost Fleet by Peter Singer and August Cole are a good example of what this blend looks like. But government leadership is actively trying to explain what they can given the restrictions they operate under.
“When we talk about ‘offensive cyber’ at ASD, we’re referring to a broad range of ac- tivities designed to disrupt, degrade or deny our adversaries,” Burgess explained. “And to be clear, all our activities are focused offshore. We do this by using specialised tools and techniques to disrupt their communications or interfere with the way they operate online.
“In my experience, when people think of offensive cyber – they focus on the high- end of the spectrum involving computer network attack operations to destroy an ad- versary’s communication device. Yes, this is something that ASD does, but in very spe- cific circumstances, and within a strict legal framework. But it’s just one of the ways we can disrupt our target’s behaviour online.
“Many of our operations are carefully designed to achieve the objective in a much more subtle and sophisticated way. And to be honest, that is far more exciting than smok- ing computers or devices in cyberspace. For example, our targets may find their commu- nications don’t work at a critical moment – rather than being destroyed completely.
“Or they don’t work in the way they are ex- pecting. Or they might find themselves not able to access their information or accounts precisely when they need to. These kinds of operations are actually more representative of what offensive cyber looks like – highly targeted and proportionate actions, timed to precision. Whatever the technique, our ob- jective is to use our offensive cyber capabili- ties to keep Australia and Australians safe.
“It is also important to remember that we are a foreign intelligence agency. Our op-
military advantage that we need to prevail in contemporary conflict.”
Perhaps most startlingly, MAJGEN Thompson and his counterpart at the Aus- tralian Signals Directorate (ASD) Mike Burgess have been open in their respective need for both defensive and offensive ca- pabilities with support from industry since the Prime Minister confirmed their exis- tence two years ago.
Burgess has been moving his organisation ‘out of the shadows’, with the agency running an internal competition for its first foray into the Twittersphere on Oct 28, 2018. It chose an admirable winner; “Hi Internet, ASD here. Long time listener, first time caller.”
Industry engagement
In terms of how these not so secret squir- rels engage with the wider cyber ecosystem, there are a few avenues open to other players.
“I’m open to all avenues of entry and there’s a couple of specifics, that are situation dependent,” MAJGEN Thompson said. “In the satellite communications program un-
der JP9102 we’ve deliberately reached out to seek industry advice on what is the art of the possible and what might it cost as we are developing our own plans and submissions for government. We are hosting an industry engagement day with ADIESA.
“It’s not quite the revolving door here in my office, but where I’ve got the time indus- try come in and talk to me personally, or they’re in talking to my team or my team are out talking with them. It’s certainly not a one size fits all and so we’ve always engaged with industry, I’d say to your readers, as I said at MilCIS, I’m open to all good ideas. I’m not necessarily open to every idea but I’m certainly open to all good ideas.”
It’s also important to note that there are some cyber capabilities where the exper- tise is resident within the Commonwealth, with Defence and ASD being the first line of Defence and the relevant subject matter expert. There are government to govern- ment channels that industry simply do not have access to for reasons of sovereignty and security.
42 | May 2019 | www.australiandefence.com.au
GETTY