Beating back cyber criminals

The Morrison government’s new operation to strike back at ransomware attackers operating in Australia and overseas is timely and necessary. A 60 per cent increase in ransomware ­attacks over the past year has reportedly cost the economy $1.4bn. And the collateral damage of temporarily paralysing the computer systems of hospitals, businesses and government agencies is incalculable. The consequences could become deadly and economically crippling if the practice continues to escalate.

Such attacks amount to a form of quasi warfare, albeit one being carried out by mercenaries for profit. Unlike other forms of warfare, fighting back does not require an enormous, powerful army and military equipment. A mid-sized, technologically advanced nation such as Australia can be as effective as far larger nations. But we need to be clever, and collaborate with our Five Eyes allies when necessary.

A multi-agency taskforce, Operation Orcus, led by the Australian Federal Police, will seek out cyber criminals who steal data and demand multimillion-dollar ransoms for its return, associate editor Cameron Stewart reported on Saturday.

Operation Orcus will draw on the expertise of the Australian Cyber Security Centre, the Australian Criminal Intelligence Commission, Austrac, state and territory police as well as industry and other government partners.

Joe Biden has launched a similar agency in the US after a spate of attacks by suspected Russian criminals on a major US oil pipeline and on the world’s largest meat processing company, JBS. At their Geneva summit a month ago, the US President told Russian counterpart Vladimir Putin to do more to deal with such criminals. Many of the same criminals attacking US websites are believed to be ­behind recent attacks on Australian entities such as healthcare provider UnitingCare Queensland, brewing giant Lion and Nine Entertainment. More than 459 Australian entities were hit by ransomware ­attacks in the year to April 2020 compared with at least 291 in the previous 12 months.

Australian authorities, wisely, strongly advise organisations not to pay ransom demands. But a survey late last year by cyber firm CrowdStrike found that one-third of firms hit in ransomware attacks paid an average ransom amount of $1.25m. Home Affairs Minister Karen Andrews, correctly, has made cyber security her top priority. The government needs to consider making the reporting of attacks mandatory. Australians and our businesses can afford nothing less.