The major cyber story of the week is the long-awaited release of Australia’s Cyber Security Strategy ^[1], the first document of its kind since 2009 ^[2]. The Strategy outlines $230 million of funding ^[3] for enhanced cyber security efforts over four years, with a focus on five key themes ^[4]. Specifically, significant investment will be funnelled into improving ^[5] the cyber capabilities of the AFP, Crime Commission, Australian Signals Directorate and Australia’s Computer Emergency Response Team (CERT Australia).

The Strategy’s overarching principle of public–private sector partnership ^[6] informs the establishment of a Cyber Security Growth Centre and Joint Cyber Threat centres in capital cities. The government will also relocate Australia’s Cyber Security Centre ^[3] from the highly classified ASIO building to allow greater private-sector access.

The Strategy establishes new positions ^[7]: a Minister Assisting the Prime Minister on Cyber Security, a Special Advisor on Cyber Security (to be filled by Alastair MacGibbon), and a Cyber Ambassador to be appointed by Julie Bishop. Further, the development of a sustainable cyber-savvy workforce will be encouraged through investment in STEM education and the creation of academic centres of excellence ^[8] in universities.

Notably, the Strategy explicitly refers to Australia’s offensive cyber capabilities—a first in Australia’s rhetoric ^[9] surrounding cyber security. At the launch, Turnbull stated ^[10] than an ‘offensive cyber capability, housed in the Australian Signals Directorate, provides another option for the Government to respond’.

The Strategy has been hailed as ‘the most important and innovative government strategy yet written ^[11]’. However, there has been criticism of the document’s language not addressing the seriousness of contemporary cyber threats strongly or directly enough ^[12]. Others are concerned that this underestimation is reflected in the funding on offer, which falls short in comparison ^[13] to the billions being spent by Australia’s peers. Last year, the UK announced plans to invest £1.9 billion ^[14] (A$3 billion) in cybersecurity, while the US has recently upped its spending by US$5 billion to a total of US$19 billion ^[15] (A$24.8 billion). Check out some in-depth analysis of the new Strategy from the ICPC team here ^[16], here ^[17] and here ^[18].

In the US, tech firms have banded together ^[19] to oppose a bill that would effectively outlaw end-to-end encryption ^[20] and require companies to help the government decrypt customer data. A coalition of companies—including Apple, Facebook, Google, Netflix, Microsoft and Twitter—wrote an open letter ^[21] to the sponsors of the new bill ^[22], Senators Richard Burr and Dianne Feinstein. The tech giants warn against ^[23] the ‘unworkable policies around encryption that would weaken the very defences we need to protect us from people who want to cause economic and physical harm’.

In an amusing concurrent development, popular instant messaging service Viber just announced ^[24] it will make end-to-end encryption the default for its 700 million users. The company stated ^[25] that it’s ‘proud that our users can confidently use Viber without war of their messages being intercepted’. This comes only a few weeks after WhatsApp ^[26] made the same transition.

This week also brought an exciting development in Artificial Intelligence (AI) technology. Scientists from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL ^[27]), in partnership with machine learning start-up PatternEx ^[28], have developed a hybrid machine ^[29] that can learn how to identify 85% of cyber attacks. The findings, which merge state-of-the-art AI and analyst intuition, were published in a paper titled AI2: Training a big data machine to defend ^[30]. The initiative works on an active learning system, where artificial intelligence network assessments are verified by an analyst, and any corrections are integrated back into the machine as a feedback loop ^[31] that continues to improve its detection accuracy. The system can reportedly reduce false positives ^[32] by a factor of five and is about three times more accurate than comparable technologies—a major development in the potential of AI for cybersecurity.

Staying stateside, a Bloomberg report ^[33] has revealed that a US$12 billion tactical mobile Internet network used by the US Army suffers significant cyber security vulnerabilities. The Warfighter Information Network-Tactical Increment 2 ^[34], or WIN-T, uses satellite and radio technology to offer secure voice, video and data communications to troops on the move. The network is deployed ^[35] to 11 of the Army’s combat brigades and is already in use in Iraq and Afghanistan. However, an assessment conducted by Johns Hopkins University and the Army Research Laboratory recommended ^[36] ‘improvement to user training techniques and hardware and software enhancements to harden against the cyberthreat’. In light of those findings, the US Army and General Dynamics are undertaking efforts to upgrade systems already in use and line-up improvements that will be deployed through 2028.

Notwithstanding its apparently flawed military cyber defences, the US has been having fun with its offensive cyber rhetoric this week. Check out this piece from The New York Times ^[37] to understand what US Deputy Defense Secretary Roger Work really means when he says the US is dropping ‘cyberbombs’ on ISIS.