Cyber hacking nation’s identity withheld: spy agency

Australia’s cyber spy agency knows which nation hacked the federal parliament but has chosen not to name the country.

Australian Cyber Security Centre head Rachel Noble.

Australia’s cyber spy agency knows “with a very high level of confidence” which nation hacked the federal parliament and the Australian National University, but says the government chose not to name the country after considering the economic costs of doing so.

The Australian Signals Directorate’s Australian Cyber Security Centre told Senate Estimates it was more than 90 per cent certain which nation state was behind the attacks. But ACSC head Rachel Noble said the Department of Foreign Affairs and Trade was the main agency responsible for advising the government on whether to call out the perpetrator.

“The policy actually belongs to the Department of Foreign Affairs,” she said.

“From an Australian Cyber Security Centre perspective, we’re the government techies.

“From a technical point of view we have a very high level of confidence that we know which state actor … was responsible for both of those incidents.”

Ms Noble said the ACSC advised DFAT and the Department of Home Affairs of its findings, which in turn provided advice to their ministers — Foreign Affairs Minister Marise Payne and Home Affairs Minister Peter Dutton. She said both departments, but particularly DFAT, “provide their advice to the government about how to weigh up economic interests, international relations and so forth”.

“And it's on that basis that the government would then make a final decision about whether to attribute publicly a cyber incident to a country,” Ms Noble said.

It’s widely speculated that China — Australia’s number one trading partner — was responsible for both attacks.

Mr Dutton said earlier this month that Australia would “call out” Chinese hacking of government and private sector bodies.

But Defence Minister Linda Reynolds told the Senate’s Foreign Affairs and Defence Committee that it was not always in the national interest to do so.

“Public attribution is just one of the many responses Australia has in its toolkit, and not all of Australia’s responses to cyber incidents will be made public,” she said. “The government publicly attributes when it’s in our nation’s interest to do so. It is very much a case-by-case basis.”

Amid growing concerns by security agencies over foreign interference in the nation’s political system, ASD described the hack of the parliamentary computer as Australia’s first “national cyber crisis”.

Twenty-five government agencies had their cybersecurity systems upgraded after the state-sponsored cyber attack against Parliament House and the three main political parties, ASD said in its annual report.