Federal Labor has called on the government to launch a national ransomware strategy to make Australia a less attractive target for cyberattacks.
Shadow assistant minister for cybersecurity Tim Watts released a discussion paper detailing potential policies, including increased law enforcement, targeted international sanctions, offensive cyber actions and regulating the payment of ransoms.
The Australian Cyber Security Centre has said that ransomware is the “highest threat” facing Australian businesses and government in the cyber domain, with a total cost of about $1 billion per year. These forms of cyberattacks increased significantly in the last year and have become more sophisticated and more targeted.
The federal government must play a leading role in making Australia a less attractive target for these ransomware groups, Mr Watts said.
“The rapidly growing costs of successful attacks on targeted entities – in downtime, remediation, ransoms and supply chains interruptions – combined with the growing costs to all organisations of defending themselves against these attacks is an unsustainable burden on the nation,” Mr Watts said.
“Ransomware is a jobs and investment destroyer at a time when the nation can least afford it. We need a new approach. It’s past time the Morrison government developed a comprehensive national ransomware strategy.”
The increasing sophistication and targeting of ransomware presents an opportunity for the government to shift focus away from Australian entities, Mr Watts said.
“The evolution of ransomware gangs into sophisticated, well-resourced organised crime groups presents both a challenge and an opportunity. The challenge of the emergence of so-called ‘big game hunting’ ransomware gangs that carefully research and select their targets to maximise their returns from attacks has increased the potential costs of these attacks,” he said.
“But it has also created the potential for new strategies aimed at deterring these attacks. The threat of ransomware isn’t going anywhere soon, and the government cannot just leave it to Australian organisations to confront this challenge alone. It is time the Morrison government actively tackled this threat and developed a national ransomware strategy.”
The Labor discussion paper proposes policies that could lower the return on investment for ransomware groups going after Australia, and increase their costs for them.
On the costs side, more effort could be made on law enforcement action against ransomware groups, starting with measuring with current performance and pushing for greater international cooperation to arrest and charge individuals.
The federal government should also “aggressively” participate in joint international law enforcement operations and cooperate in the region to prevent the emergence of new groups.
“An activist approach to fighting ransomware would see the Australian government building coalitions of nations to pressure recalcitrant governments to stop ignoring and harbouring transnational ransomware groups, and to develop mutual law enforcement assistance agreements with these states,” the discussion paper said.
When law enforcement is not possible, the government should look at engaging with like-minded countries to impose travel and asset sanctions on the ransomware gangs and enabling countries, the Opposition said.
To reduce returns for these groups, the government should look at imposing controls on ransomware payments, crack down on rogue bitcoin exchanges and improve the cybersecurity of public and private organisations, the paper said.
The Opposition said the government should actively engage with the US Treasury which has already proposed some regulatory actions around ransomware payments made through bitcoin exchanges.
“If Australian organisations can develop a reputation for being less likely to pay ransoms than targets in other jurisdictions, the return on investment for targeting Australian organisations will fall and so too will targeted ransomware attacks against Australian organisations,” they said.
More work needs to be done to lift the overall cyber resilience of public and private companies to combat these attacks, the paper said.
And such a strategy needs to be communicated publicly, with Labor calling on Home Affairs minister Peter Dutton to make a ministerial statement in Parliament about it and for the government to appoint a dedicated member of the executive responsible for cybersecurity.
“This is an important signal to adversaries indicating that the Australian government takes cybersecurity seriously,” the Labor discussion paper said.
“Unfortunately, despite the growing threat of ransomware to the nation, Peter Dutton has never used the word ‘ransomware’ in the Parliament.”
Mr Watts released another discussion paper last year, calling for a rethink of cybersecurity policy in Australia with a focus on national resilience and community-based efforts.
The federal government unveiled the $1.7 billion 2020 Cyber Security Strategy in August, with initiatives including new laws to protect critical infrastructure, additional powers for authorities to combat crime on the dark web, and some efforts to improve the cyber resilience of small business.
Do you know more? Contact James Riley via Email.