Australia’s ability to defend against aggressive cyber campaigns is being considered as part of the Department of Defence’s review into mobilisation, recently released documents show.

Revealed under freedom of information laws last week, Defence’s ‘Mobilisation Review’ cites concerns that Australia’s strategic advantage as an isolated island continent has been “noticeably reduced” by the advent of cyber warfare.

“The nature of unconventional warfare has changed significantly and needs to be better understood within Defence,” the report says.

Among the data included in Defence’s ‘Mobilisation Review’ was the summary of a cyber war workshop conducted by the Australian National University National (ANU) Security College Futures Hub in late 2018.

That considered different ways cyber warfare could be used to intimidate Australia, distract from other military objectives, coerce the Australian public, or even gain control of policy and public opinion.

As well as outlining cyber attacks on critical infrastructure targets – like electrical grids – the scenarios outline information campaigns that aim to create social divisions and sow distrust in the government’s ability manage the unfolding war-like situation.

“Adversary strategies have significantly improved with advances in information technology, big data and artificial intelligence,” the report says.

“These developments allow groups and even individuals to be targeted for active manipulation.

“Three broad adversary strategy types are discernible: those that aim to: create societal disruption, manipulate existing grievances or try to change people’s minds”.

The private ANU workshop described cyber war as “a qualitatively different type of emergency” that Australia is “not set up to deal with” partly because of uncertainty around the very nature of cyber war.

“We will struggle to identify when [a cyber war] starts, how long it will last, and what will be affected next.”

Whole-of-nation response

If and when a cyber war has been identified, the Defence documents say that defensive mobilisation would be a “whole-of-nation endeavour” – not one confined to government resources.

“This is because first, many of the targets will be civilian businesses and individuals,” the review says.

“Second, the resources needed to respond will be mostly privately held. Third, the centre of gravity is likely to be popular will and resilience.

“As a result, contingency planning and preparedness cannot just occur inside defence or government silos.

“When it comes to mobilising for cyber war, a future government’s role may be predominantly about coordinating and communicating, rather than directing or controlling.”

Shadow Assistant Minister for Communications and Cybersecurity, Tim Watts, recently renewed calls for Australia to develop a kind of civilian cyber corps – professionally-led, volunteer groups that would aim to improve the community’s overall cyber security posture.

He said we are now seeing “almost weekly reminders about Australia’s lack of preparedness for a major cyber attack” and that the released Defence review is a wake-up call.

“This review shows why in an interconnected and interdependent world, we need to get serious about building National Cyber Resilience beyond our intelligence and defence communities and throughout the broader Australian community.”

Are we already in a cyber war?

There has been a recent spate of cyber incidents on Australian organisations including logistics company Toll Group, mining firm BlueScope Steel, government arm Service NSW, and an attempted infiltration of the WA Premier’s office.

When asked by ABC Radio if these latest attacks paint the picture of cyber war, former head of the Australian Cyber Security Centre, Alastair MacGibbon, was cautious.

“We don’t know enough [to say] there’s an uptick,” MacGibbon said.

“We certainly know that Australian businesses are targeted by criminal groups. We know they’re also targeted by nation states.”

MacGibbon mentioned China, Russia, North Korea, and Iran as the “four countries that come up consistently” in conversations about cyber warfare, though he wasn’t willing to point the finger solely at them.

“Cyber is one of those tools that is asymmetric and other nations – middle-powers, can use cyber as an extension of their nation in a way that they can’t with their traditional intelligence or military efforts.”

As for whether or not Australia is prepared for cyber conflicts, MacGibbon said Australia’s cyber defenses have improved but there is still a long way to go.

“I think we’re getting better,” he said. “The question is whether the curve we’re chasing is moving faster than our improvement.”