Australia’s latest Defence White Paper isn’t doing enough to address the innovation that is cyber warfare. Wars are won by innovators; be that innovation in strategy, technology or both. Innovations that have transformed our modern world like jet engines and the internet are the product of war or ‘defence’ programs.
The wonder we know as Silicon Valley grew strong on the back of heavy US military spending. Even the innovation of container transportation benefitted from defence expenditure, namely the US Interstate highway system more correctly called the “National System of Interstate and Defense Highways.”
US strategic adviser Philip Bobbitt (The Shield of Achilles) describes the history of “western” society from the start of the 16th century as a series of constitutional orders that was each brought to primacy by an “epochal war.” The dominance of each order is brought about by best exploiting the strategic and institutions of its era.
The last epochal war ran from 1914 to 1990 and was the war between authoritarian/totalitarian regimes and liberal democracy. The innovations of this war were weapons of mass destruction (primarily nuclear), rapid computation and international communication.
We know that ‘non-state actors’, an identified threat in the White Paper, use all these tools; the latter for recruitment. We also know that warfare isn’t just about killing armies, it uses an array of techniques including bombing and blockades to damage an economy.
The Defence White Paper (para 2.50) says that “Cyber attacks are a direct threat to the ADF’s warfighting ability given its reliance on information networks.” It continues (para 2.51 ) “Cyber threats also have impacts well beyond Defence, with the potential to attack other Australian government agencies, all sectors of Australia’s economy and critical infrastructure and, in the case of state actors, conduct state-based espionage including against Australian defence industry.”
But having identified the risk the White Paper is incredibly thin on detail. Indeed despite noting that “The Australian Signals Directorate detected over 1,200 cyber security incidents in 2015, including attacks on government agencies and non-government sectors,” the paper later on focuses most on the cyber threats to defence’s own capability.
In discussing resources the response to cyber threats is merely bundled with the other areas including intelligence and space.
Back in December 2014 the then Prime Minister gave us the expectation of much more. In a visit to the Australian Cyber Security Centre Mr Abbott announced a review into cyber security. According to the ABC it was the first of its kind in six years, and would feed into the Defence White Paper that was also underway.
In January this year a report by the Australian Centre for Cyber Security warned Australia is not adequately prepared for cyber war, with the nation “badly lagging” behind overseas counterparts and the Defence Force also at risk.
That theme of lagging overseas counterparts features highly in the commentary by the Australian Strategic Policy Institute of the White Paper’s approach to cyber, saying “A cursory glance at the American, British, Chinese, French and Dutch defence-related strategies, for example, reveal a great deal more about how those nations deal with cyber both offensively and defensively.”
The ASPI comment criticises the vagueness of the White Paper’s cyber commitment including the vagaries of a workforce increase of 800 new Defence jobs and 900 ADF positions to be created for ‘enhancements to intelligence, space and cyber security capabilities.’
But these extra positions are spread over a wide range supporting information requirements of the Joint Strike Fighter, surveillance aircraft and navy ships as well as supporting Special Forces and cyber security.
The ASPI paper notes “When increased spending and developments in cyber capability are placed within a framework that is at once exceedingly clear, measured and explanatory, it lowers suspicion and the potential confrontation in cyberspace.” Despite malicious threats in cyberspace being a key theme in the launch and messaging of the White Paper, this detail was lacking.
Nowhere was this more evident than at the press conference where the PM was asked “Are you confident that your focus on cyber and space warfare is in-depth enough to be able to combat what is a growing and evolving area of threat?”
The answer was a classic example of Mr Turnbull’s “never you worry your head about that” approach:
“Now turning to cyber, yes, this is a very substantial increased investment in cyber capability. It is a rapidly developing and dynamic area.
“We face adversaries, both state-sponsored and not and individuals, organisations, terrorist groups, it’s an area where you need to have the smartest people that you can secure, that you can employ working for you using the latest technologies.
“And I have to say, while we naturally are more circumspect about this area than we are even about other areas, can I say that the work and the professionalism, the technological ingenuity of our cyber specialists, there is no better in the world.
“I won’t claim they’re the best in the world but there is no-one better in the world than them and they are recognised for that expertise and we will be building on that.”
What is particularly telling about the APSI criticism is that its author, Tobias Feakin, was a member of the five-person Panel of Experts appointed to assist the cyber security review by Prime Minister Abbott.
I can assure you, it is in very sharp focus and it’s an area I’m not, as you know given my own background in government and elsewhere, an area I’m not entirely unfamiliar with.
When Darwin was attacked in 1942 by the Japanese, the city’s major defences were the same as they were for all Australian cities. Big fixed guns were positioned to defend the city against assault from the sea.
There were anti-aircraft batteries. But the gunners had never actually fired the weapons for fear of disturbing the citizenry. When they were fired they were useless because they had not been sent ammunition rated for the tropical climate, which meant the explosive force was greater and hence all the aiming calibration to allow for projectile motion was wrong.
It might be reasonable for government to be “more circumspect” about cyber; but Darwin tells us what happens when you take that too far.
Do you know more? Contact James Riley via Email.