Threats from rogue states and crims rising: Australian Signals Directorate head Rachel Noble

Nation states and criminal gangs are ramping up attacks on infrastructure, health and food distribution, says Australian Signals Directorate director-general Rachel Noble.

Rachel Noble says cyber warfare between Russia and Ukraine is a ‘horrendous case study’ to justify why Australia must dramatically increase its offensive and defensive capacity. Picture: Ben Appleton

Australia’s top cyber spy, Rachel Noble, has warned that domestic threats are accelerating as nation states and criminal gangs ramp up the “severity” of attacks targeting critical infrastructure, health and food distribution providers.

The Australian Signals Directorate director-general, who is leading the $9.9bn Project REDSPICE announced in Tuesday’s budget, said nation states were engaging in espionage and pre-positioning to disrupt services.

Ms Noble said the Five Eyes security alliance, of which the ASD is a founding member, had never been more important in repelling cyber attacks in a “deteriorating Indo-Pacific environment”.

The record ASD investment will double the Defence agency’s workforce, with more than 1900 new jobs, and move 40 per cent of staff outside of Canberra by 2027.

Defence Minister Peter Dutton on Thursday will announce three new ASD facilities will be built for 1800 cyber spies in Melbourne, Brisbane and Perth.

Mr Dutton will meet with senior Defence officials to discuss how advanced artificial intelligence and quantum computing will give Australia the capability to “protect ourselves and strike back at a scale and speed to give us a competitive advantage in the lead-up to, and during, conflict – making them more powerful than missiles”.

Visiting the new state-of-the-art ASD headquarters in Canberra, Mr Dutton will be briefed on the upgraded Defence posture amid unprecedented cyber warfare between Russia and Ukraine.

Offensive ASD cyber operators previously supported ground forces in retaking key Islamic State terror positions by cutting internet connection to stop IS commanders communicating.

In 2016, ASD cyber soldiers helped lock IS fighters out from their servers and destroyed propaganda material to stop them spreading hate and recruiting new members.

Ms Noble said threat levels were “picking up”, with the ASD receiving cyber incident reports every eight minutes.

“I think what’s worrying is that 25 per cent of those (incidents) are against our critical infrastructure or people providing essential services like health and food distribution. We’ve also seen an increase in the severity of those incidents,” Ms Noble said.

“Nearly 50 per cent of all of those incidents we’ve categorised as significant. A lot of that change is around two big buckets of actors – one state, the other criminals. We’ve seen a 15 per cent increase in ransomware activity over the last year, which was building on a more than 60 per cent increase the year before.”

Ms Noble said cyber warfare between Russia and Ukraine was a “horrendous case study” to justify why Australia must dramatically increase its offensive and defensive capacity.

While the risk of a direct cyber attack on Australia by Russia was assessed as low, there are concerns cyber gangs backing Vladimir Putin could cause “incidental harm to Australia”.

“In a more conventional military sense, the doctrine is that you have 100,000 soldiers, I have 100,000 soldiers, you have that many bombs, I have that many bombs. In cyber, that cuts both ways – it’s asymmetric in the sense that we don’t have to have the same number of people as our adversaries to generate a significant effect if we need to,” she said.

“This REDSPICE investment means we’ll have three times as many cyber offensive options for the government than we have now. It gets us into that strategic doctrine of deterrence.

“We have the capability and we are willing to use it and thus your adversaries’ calculation is … is the gain worth the risk that retaliation will be in kind or worse? It’s that theory of deterrence we hope will work and will mean that we never have to use it in anger.”

Ms Noble said REDSPICE would allow the ASD to “quadruple our number of people integrated” with Five Eyes partners. “I believe it’s the alliance of those five nations that places Australia in a very strong security position, particularly in a deteriorating Indo-Pacific environment.

“We have people embedded in each other’s organisation working in an entirely integrated way that is helping with each other’s work and learning from the best that each agency can bring in terms of capability,” she said.

The ASD last year used offensive measures to shut down organised criminals, believed to be in eastern Europe, who were preying on Australians receiving Covid-19 payments.

Ms Noble said gathering intelligence before deploying offensive measures was critical in helping “understand what your target is doing (and) how it works”.

“We launched a cyber offensive against them and using technical means basically pulled down the technical infrastructure they were using to organise themselves and generate affiliates or partners in crime to attack more victims, and we destroyed it from the inside and then discredited their reputation in forums that mattered to them.”

With tech companies offering big money, the ASD this week launched a recruitment drive ahead of its 75th anniversary on Friday.

After the agency received 9000 applications last year, Ms Noble said “we can’t hold on too tight when we see some of our people move to private sector jobs… a surprising number of them come back. The reason they come back is that our value proposition is different.”

She said ASD in-house training provided staff with skills, including hacking, that was “otherwise illegal … Our values proposition is very different from the private sectors and in the end growing Aussies with these skills is a net good for the country.”

The ASD, which opened its new HQ last week, has eased ­security clearance requirements to hire more staff.