Cyber defence targets on criminal networks

Australia’s cyber intelligence agency can now use cyber-warfare operations to destroy foreign criminal networks.

Dan Tehan, the minister assisting the Prime Minister on cyber security, has confirmed that the ASD had been instructed to broaden its capabilities.

An unprecedented legal directive has been issued to Australia’s cyber intelligence agency giving the green light for the use of ­offensive military cyber-warfare operations to shut down and ­destroy foreign criminal networks, including those responsible for recent global ransomware attacks.

The Australian understands the Turnbull government will ­announce today it has given legal authority for the Australian ­Signals Directorate to expand ­offensive operations from a milit­ary role to civilian criminal ­targets offshore.

The move — extraordinary not just for its purpose but for the public acknowledgment of what are normally clandestine operations — signals an aggressive ­footing from Australia in defending the country from state-­sanctioned and criminal cyber-attacks. It would be the first time a Western power has acknowledged it was preparing to use military capabilities for offensive measures against non-state cyber criminals.

The Australian understands a warrant system would be established for the Defence Minister to approve operations. They would be legally covered under the ­Intelligence Service Act 2001, which governs the conduct of the Australian Secret Intelligence Service, and by the sections of the Criminal Code of 1995.

An intelligence source said the directive was not in response to this week’s global ransomware ­attack originating in Spain, which shut down a Cadbury’s factory in Tasmania, but addressed concerns­ about an increasing number of similar attempts in the past six months.

Since the end of 2014, there have been more than 114,000 ­reports of cyber crime registered with the Australian Cybercrime Online Reporting Network. More than 23,700 of these have been reported over the past six months.

Dan Tehan, the minister assisting the Prime Minister on cyber security, confirmed that the ASD had been instructed to broaden its capabilities — regarded as being highly sophisticated on a world ranking — from military to criminal ­offensive operations.

“Given the growing cost of cyber crime to the Australian economy, the government has directed the Australian Signals Directorate to use its offensive cyber capabilities to disrupt, degrade, deny and deter, offshore cyber-criminal networks,” he said.

The expansion of operations is also in response to a growing link between state actors and criminal networks responsible for attacks.

An intelligence source said any offensive operations designed to deter attacks or bring systems down would be carried out under internationally established rules that did not necessarily require a country to be notified that a ­criminal network was being targeted. “We are not sitting back passively … this not only gives us the ability to defend ourselves but to deter them from targeting Australia,” the source said. “This is expanding a military capability and moving to criminal activity.”

Last year Malcolm Turnbull confirmed the ASD, a military ­intelligence arm of the Defence Department, was conducting offensive cyber operations to degrade and disrupt terrorist activities in Syria and Iraq.

“Our response to criminal cyber threats should not just be defensive. We must take the fight to the criminals,” the Prime Minister told The Australian last night.

“The use of offensive cyber capabilities will add to the government’s crime-fighting arsenal and form part of our broader strategy to prevent and shut down safe havens for offshore cyber criminals.”

A significant global ransomware attack named Eternal Blue, the second in as many months following the wannaCry virus, this week shut down a Cadbury’s factory in Tasmania and affected banks and multinational firms across Europe and Russia.