‘Strong possibility’ Kremlin inspired Medibank hackers, cybersecurity expert John Davis says

A former US adviser in the Pentagon says Australia should at least be ‘suspicious’ given Russia often facilitates third-party attacks on adversaries.

A former US army major general says Australia should be “suspicious” of the idea cyber criminals responsible for the Medibank attack are not at all connected to the Russian government and that there is a “strong possibility” they were at least “inspired” by the Kremlin.

The retired major general, John Davis, served as the first senior military cyber adviser in the Pentagon before moving to cybersecurity firm Palo Alto Networks and said Russia often facilitated “third actors” carrying out attacks on its adversaries.

General Davis said countries such as Russia “turned a blind eye” or even “covertly provided resources” to third-party actors and criminals while being able to “avoid accountability and deny responsibility for direct involvement”.

“In this way, our adversaries have been able to frustrate targeted countries’ responses,” he told the National Press Club.

Australian Federal Police Commissioner Reece Kershaw says meetings will be held with Russian law enforcement about bringing cyber criminals to justice. Picture: NCA NewsWire

When asked if such a tactic was likely used in the Medibank attack, General Davis said there was a “strong possibility” there was a connection.

“If it sees what is happening from a criminal entity in the best interest of pursuing objectives that are favourable to that country, then they may well just let it happen,” he said.

“(We need) to be very suspicious about all of these various non-state actors in today's world and how strong the connection is or isn’t to state organisations and state objectives.”

Australian Federal Police Commissioner Reece Kershaw last week said intelligence and policing agencies knew the identity of the hackers who had conducted “significant breaches” in the past and urged Russia to help bring them to justice.

“These cyber criminals are operating like a business with affiliates and associates who are supporting the business,” he said in the AFP headquarters Canberra on Friday.

“We’ll be holding talks with Russian law enforcement about these individuals.”

But the Russian Embassy said in a statement the AFP had not engaged with respective Russian law enforcement. It added that “fighting cybercrime that adversely affects people’s lives and damages businesses demands a cooperative, non-politicised and responsible approach from all members of the world community”.

Following the attack of the Colonial Pipeline in the US in January, about 14 individuals were arrested by Russia. But after the West’s strong condemnation of the attack on Ukraine in February, it is widely understood that they were released.

On the question of whether the Australian government should enforce sanctions on Russia or even dismiss the ambassador, General Davis said there was “no silver bullet”.

“You need an approach that focuses on deterrence, disruption, better preparedness and more effective response and those aren’t separate lanes,” he said.

“But I think that the approach that I would advocate is – use whatever tools in the toolkit will enable you to be most effective at reducing the overall problem.”

General Davis said it was critical countries across the world worked together and agreed upon rules of engagement in the cyber sphere going forward.

He said that the AUKUS agreement, which includes Australia, the UK and US, also needed to have a focus on cyber and information sharing on the best cyber defences.

General Davis echoed the comments of former defence minister Kim Beazley in cautioning against AUKUS being expanded beyond the three countries currently captured under the deal that would see Australia equipped with nuclear submarines.

“AUKUS is an opportunity, but the more participation in it, the more complex it gets,” he said.

“I believe that … by limiting it to Australia, UK and the US, I think that it allows an organisation to go a little quicker, to streamline things and to make positive movement in terms of whatever the objectives are to accomplish.”

It follows Japan raising the possibility of participating in AUKUS for “certain projects”, including the suggestion it be used to base Australia’s nuclear submarines as needed.