Is cybercrime a national security issue?
Put simply, cyber security involves protecting the integrity and security of computer systems connected to the Internet. Different entities like Government, organisations and individuals across Australia depend on these connections to the internet.
Consequently, if Australian computer systems were compromised, such impairment could endanger Australia’s national security in a variety of ways, for example:
- A malicious actor who gains unauthorised access to secret commercial information by exploiting vulnerabilities in an entity’s or individual’s computer system could undermine confidence in Australia’s digital environment and economy
- Cyber-attacks on telecommunications systems that affect lines of communication across sea and air routes could inhibit Australia’s international trade and access to externally sourced resources such as petroleum
- Technologically advanced computer tools used to target the Australian Defence Force’s (ADF) information networks (such as ballistic missile defence systems and communications satellites) would also increase the risk of harm to the Australian population
Cyber security laws
Parliament has enacted a raft of legislation dealing with the issue of Cyber Security.
Cybercrime offences
In 2013, the Government legislated for several computer offences in accordance with its international obligations under the Council of Europe Convention on Cybercrime. These offences appear under part 10.7 of the Criminal Code Act 1995 (Cth). The computer offences include:
- Causing unauthorised access, modification or impairment with intent to commit a serious offence;
- Causing unauthorised modification of data to cause impairment;
- Causing unauthorised impairment of electronic communication;
- Causing unauthorised access to, or modification of, restricted data;
- Unauthorised impairment of data held on a computer disk etc.;
- Possessing or controlling data with intent to commit a computer offence; and
- Producing, supplying or obtaining data with intent to commit a computer offence.
Data Retention
In April 2017, the Government’s data retention scheme came into effect. Part 5‑1A of the Telecommunications (Interception and Access) Act 1979 (Cth) requires telecommunications companies to retain certain telecommunications data for at least two years and permits listed Australian Agencies (i.e. ASIO) to access this data.
The retained data includes:
- phone numbers, call duration and location of a phone when a call was made (but not what was said);
- email address and when an email was sent (but not the subject line or content of an email).
Telecommunications companies are not obliged to keep your internet browsing history.
The purpose of establishing a data retention regime is to increase law enforcement’s investigative capabilities in relation to serious national security matters including cybercrime.
New data breach notification laws
To address concerns regarding the data retention scheme’s vulnerability to potential hacks, identity theft and other cybercrime, the Government introduced a mandatory data breach notification scheme under the Privacy Act 1988 (Cth). Listed entities have an obligation to report ‘eligible data breaches’ to the Office of the Australian Information Commissioner and to persons who might be affected by a data breach.
A failure to report an eligible data breach is considered an interference with the privacy of an individual. As a result, there is a significant civil penalty (i.e. 2000 penalty units) for ‘serious or repeated interferences with the privacy of an individual’.
What else is Australia doing to enhance cyber security?
In the 2016 Defence White Paper, Cyber Security was highlighted as one of Australia’s national security priorities particularly given the increase of malicious state and non-state actors attempting to thwart the integrity of Australia’s information systems. Accordingly, the Government has sought to improve digital safety by implementing the goals contained in the 2016 Australian Cyber Security Strategy:
- A national cyber partnership – Governments, businesses and the research community coming together to advance Australia’s cyber security
- Strong cyber defences – build networks and systems that are hard to compromise and resilient to cyber-attacks
- Global responsibility and influence – promote an open, free and secure cyberspace
- Growth and innovation – help Australian businesses grow and prosper through cyber security innovation
- A cyber smart nation – ensure Australians have the cyber security skills and knowledge to thrive in the digital age
Since the inception of the Australian Cyber Security Strategy, a number of achievements have been made:
- Through increased recruitment, the Australian Criminal Intelligence Commission has enhanced its ability to link online cybercrime personas with real world identities
- The Establishment of the Joint Cyber Security Centre
- Release of Australia’s first international cyber engagement strategy; and
- The commencement of comprehensive training for Australian Federal Police to better tackle contemporary cybercrime.
In conclusion, new and complex threats in cyberspace highlight cyber security as a current and pertinent consideration for Australian national security.
