Introduction

The Australian federal government released a discussion paper on 27 February 2023 outlining its intention to become “the most cyber secure nation by 2030”. The 2023-2030 Australian Cyber Security Strategy Discussion Paper (Discussion Paper) was put forward by the federal Minister for Home Affairs/Minister for Cyber Security, The Hon. Clare O’Neil MP, following recent high profile cyberbreaches affecting millions of Australians.

The Discussion Paper follows the development of the previous cyber strategies including the major reform and expansion of Australia’s Security of Critical Infrastructure laws [Security of Critical Infrastructure Act 2018 (Cth)]¹ and recent amendment and further review of the national Privacy laws for which public consultation is open until 31 March 2023.

The Discussion Paper notes that the Australian Government is being assisted and advised by an Expert Advisory Board comprising former Telstra CEO Andrew Penn AO, Air Marshal (ret’d) Mel Hupfeld AO DSC and Rachael Falk, the CEO of the Cyber Security Cooperative Research Centre and formerly Telstra’s first General Manager of Cyber Influence. It states that the Australian federal Government and the Expert Advisory Board is also being advised on global best practice by a Global Advisory Panel chaired by Ciaran Martin CB, former CEO of the United Kingdom’s National Cyber Security Centre.

The Discussion Paper mentions that the Australian cyber market contributed approximately $2.4 billion in Gross Value Added (GVA) in 2022, and the sector’s GVA grew by 11% from 2020 to 2022 according to AustCyber's Australia's Cyber Security Sector Competitiveness Plan 2022. However, Australia’s Commonwealth Scientific and Industrial Research Organisation (CSIRO) – the Australian federal Government agency responsible for scientific research, estimates that Australia’s cyber security revenue could reach AUD$6 billion per year in 2026 [CSIRO Futures, Cyber Security A Roadmap to enable growth opportunities for Australia (2018)]² The Discussion Paper comments that, according to the Australian Cyber Security Centre’s (ACSC) 2021-22 Threat Report [ACSC Annual Cyber Threat Report, July 2021 to June 2022]³, an incident is reported on average every 7 minutes in Australia and it is now time for “an integrated whole-of-nation endeavour”.

Key topics canvassed in the Discussion Paper

Key topics covered in the Discussion Paper include the following.

1. Enhancing and harmonising regulatory frameworks: Welcome news is that the paper notes that Australian business owners do not feel their cyber security obligations are clear or easy to follow, both from an operational perspective and as company directors – in part due to the variety of implicit cyber security obligations placed on Australian businesses through the corporations, consumer, critical infrastructure, and privacy legislative and regulatory frameworks. As there is the increasing frequency and severity of major cyber incidents, the authors canvas whether “more explicit specification of obligations, including some form of best practice cyber security standards” is required to increase national cyber resilience. Helpfully the authors note that there may be opportunities to simplify and streamline existing regulatory frameworks – for example, streamlined reporting obligations and response requirements following a major cyber incident. The Discussion Paper notes that implementation proposals may include a “new Cyber Security Act” drawing together cyber-specific legislative obligations and standards across industry and government and further developments to the Security of Critical Infrastructure Act 2018 (Cth), including adding customer data and ‘systems’ in the definition of critical assets regulated under that law.

2. Securing government systems: The Discussion Paper also notes that the Commonwealth Government controls and processes some of Australia’s most sensitive data to deliver essential public services – and that these are a target of persistent cybercrime and espionage by a wide range of criminal and state actors, including foreign intelligence services, seeking information on political, diplomatic, military, and personal data. However the evidence is that many government agencies are yet to implement basic policies and procedures.

3. Improving public-private mechanisms for cyber threat sharing and blocking: The Discussion Paper notes that there is room to enhance cyber security threat sharing and blocking through public-private partnerships but that this requires analysis of feasible technical approaches, which can be deployed sustainably at scale.

4. Investing in the cyber security ecosystem: Comments in the Discussion Paper that will be well received include those that state that protective cyber security technologies have been identified as a critical technology by the Australian federal Government – whereby cyber security is considered essential to the secure development and implementation of a broad range of other critical technologies. The Discussion Paper foreshadows that Australia must put in place mechanisms that attract investment in cyber security and other critical technologies. [See Australian Government, Critical Technologies Policy Coordination Office document Critical Technology Profile]

Next steps

The Australian federal Government is seeking feedback on the Discussion Paper and other matters relevant to developing Australia’s cyber security strategy and consultation is open until 15 April 2023. Dentons' Privacy and Cyber Security teams in Australia can assist you with monitoring legal developments, making submissions and your current compliance regimes.

1. Security of Critical Infrastructure Act 2018 (Cth)
2. CSIRO Research Publications Repository - Publication
3. ACSC Annual Cyber Threat Report, July 2021 to June 2022