The consequences of August’s #censusfail ^[1] continue to reverberate in Canberra, and two reports released last week—one by the PM’s Special Adviser on Cyber Security ^[2], Alastair MacGibbon; the other by the Senate’s Economics Committee ^[3]—pull no punches. Both reports are highly critical ^[4] of the Australian Bureau of Statistics and IBM for the planning, management and response to the census debacle. MacGibbon’s report noted that the ABS had no ‘clearly identified and tested cyber security incident response processes’, resulting in ad-hoc decision-making, and that the government’s Cyber Incident Management Arrangements were similarly inadequate.

MacGibbon’s report also recommends that a ‘Cyber Bootcamp’ ^[5] for senior government executives and Ministers should be instituted to educate them on cyber risks and crisis communications. IBM was called out ^[6] for its failure to plan for and test its response to foreseeable incidents such as a DDoS, and both reports criticised the single-source tender approach by the ABS to the procurement of IBM’s services. The government has reached a settlement with IBM ^[7] for an unspecified amount.

In a speech at the National Press Club ^[8] last week, the Minister Assisting the PM for Cybersecurity, Dan Tehan, warned that Australia remains vulnerable to a ‘cyberstorm’ ^[9], an attack that could knock out power, telecommunications, emergency services and financial networks. Tehan admitted that the government had much to do to protect Australia from cyber threats, and that implementation of the Cyber Security Strategy should be accelerated. His focus is on making government departments accountable for their own security, greater transparency from government on cyber security incidents, fighting cybercrime, and protecting critical infrastructure. Tehan also announced that he’ll initiate quarterly meetings with business leaders to discuss cyber security, starting in December.

Prime Minister Malcolm Turnbull has announced that Australia is conducting offensive cyber operations ^[10] against the Islamic State. The PM wouldn’t be drawn on exactly what was being done ^[11], but was careful to note that Australia’s offensive cyber operations against IS are subject to the same Rules of Engagement, legal oversight and consistency with international law as Australia’s kinetic military capabilities in the Middle East. The nature of offensive cyber operations is usually obscured for operational security reasons, but ICPC fellow Jim Lewis’ publication ‘Cyberspace and armed forces’ ^[12] gives some insight. Lewis notes that ‘most cyberattacks will produce intangible effects. Expanding the ‘fog of war’ creates indecision and slows opponents’ reactions in ways that confer military advantage.’

The PM also announced last week that Julie Inman Grant will be Australia’s new eSafety Commissioner ^[13], filling the post left vacant by Alastair MacGibbon. Inman Grant will be responsible for implementing the new online reporting tool for revenge pornography ^[14] announced by government in October as part of the National Plan to Reduce Violence against Women ^[15].

There have been several hacking incidents across the world this week. The Japan Times has reported ^[16] that Japan’s Ministry of Defense and Self Defense Force’s internal network, the Defense Information Infrastructure, was breached in September by a ‘sophisticated cyberattack.’ It’s believed that the hackers gained access to the National Defense Academy network ^[17] and then used it to hop across to the Ministry’s network and exfiltrate an unknown quantity of data. The Ministry has declined to comment ^[18], but it’s been reported that internal internet use has been temporarily banned.

A ransomware infection on the San Francisco Municipal Transportation Agency (known as Muni) has been a boon for commuters, who were able to travel for free last weekend ^[19] when ticketing machines were taken offline. The hackers have demanded 100 bitcoins, about US$73,000 ^[20] to provide the encryption keys to unlock just over 2,000 infected terminals. The hackers have also threatened to release 30 gigabytes ^[21] of data including customer information if the ransom isn’t paid. Muni was able to restore its system ^[22] using backups and didn’t pay the ransom.

In Germany, Deutsche Telekom has hinted that hackers were the cause of a network outage that affected 900,000 people ^[23] over the weekend. The outage has only affected customers using routers with ‘certain software’, indicating that the issue was caused by hackers and not a broader network issue. The company’s IT security chief ^[24] has told newspaper Das Tagesspiel that it was likely the result of a botched attempt to use the routers as part of a botnet and Kaspersky researchers ^[25] have identified ‘Mirai-related’ activity on affected routers. Deutsche Telekom is currently rolling out firmware upgrades ^[26] on routers from Taiwanese company Arcadyn Technology ^[27] to address the issue.

And finally closer to home, the head of Telecom Fiji ^[28] has said that the country’s Standing Committee on Foreign Affairs and Defence that his company’s firewalls block more than 1,000 cyber threats a day. He encouraged the Fijian Government to do more to address cyber threats, and suggested they focus on insider threats and cybercriminals.