Proactive stance beats election cyber hackers

A new policy of transparency from the government helped thwart any would-be malicious hackers or nation states from disrupting the 2020 US electoral process.

Australia ‘needs to be more attuned to the scale and sophistication’ of cyber threats currently facing the nation.

The US learned important lessons from its compromised 2016 election and managed to successfully ward off cyber interference this time around, The Australian’s Strategic Forum has heard.

Speaking on Wednesday at the forum, the Australian Strategic Policy Institute’s Tom Uren said a new policy of transparency from the government helped thwart any would-be malicious hackers or nation states from disrupting the 2020 electoral process.

“The US government was a lot more transparent from the get go,” he said.

“In the last election, there were a lot of operations that went on that were never transparently discussed until after the election. The Obama administration knew things were happening, but they were in two minds as to whether they should say anything. Clearly this time, they’ve decided if we discover something, we’ll immediately talk about it, and that took the heat out of it.

“Iranians were trying to influence voters in Florida, and … there was a disinformation website pumping out information all the time. But you’ve got to find it, and then be transparent about it straight away.”

Alana Maurushat, Professor of Cybersecurity and Behaviour at Western Sydney University, said postal votes were inherently more secure than electronic voting, and that internet service providers, social media companies and media outlets had all taken a more proactive stance against interference.

“There were actively blocking and removing fake news,” she said. “They were not technology neutral during this election, and I think they’re beginning to realise that they have a role to start addressing these issues. Because they’re the conduits, they can’t just sit back and not do things. There was loads [of fake news] that was being blocked, without people knowing, and removed really quickly and effectively.”

Professor Maurushat added that Australia needs to be more attuned to the scale and sophistication of cyber threats currently facing the nation.

“I do special advising work to a number of private firms who do cybercrime and cybersecurity incident management and investigation. We have two undercover agents right now in the Ukraine in India. And they‘re going through what’s known as the University of Fraud, it’s set up as a university, and it trains criminals in cybersecurity and cybercrime,” she said.

“They are putting through 100 students per week at these institutions. So think about that, in terms of the amount of people heading into this field to make their money.

“People are clueless as to what’s happening on that front. And so what I’ve seen in the COVID space is that whenever there’s a problem, whether it be a bushfires or something, criminals will take advantage of that. And so ransomware has gone off the table in the last six months. These firms used to get one incident a week, they’re now getting five a day, five coming in. It really has heightened things, and I think we need to find ways to make Australians less vulnerable.”

In August the federal government unveiled a $1.7bn cyber security strategy, with funding targeted towards the Australian Federal Police and the Australian Signals Directorate.

Australian National University professor Lesley Seebeck described the strategy as an ‘everyman document’ and described the strategy as lacking vision.

“The cyber strategy didn’t hit the mark. It didn’t give you a means of prioritising. One of the reasons we tend to be more gullible is because we don’t actually own the data, we don’t have a means of doing things, and we don’t have agency in this,” Professor Seebeck said.

“In an interconnected world that we have, where everything is essentially broken … We actually have to make sure that individuals, small businesses and organisations are able to protect themselves. But without that organising principle, we will continue producing documents that are everything to every man. It doesn‘t give you direction because there is no prioritisation mechanisms, no organising principles. We need a strategy where the organising principles around resilience … trust, and things like capacity building, education, R&D.”