A flurry of activity on the cyber-policy front has accompanied the one year anniversary of Australia’s Cyber Security Strategy ^[1], which was launched by Prime Minister Malcolm Turnbull on 21 April 2016.

The Australian Cyber Security Growth Network ^[2], the industry-led, not-for-profit company tasked with boosting Australia’s cyber industry, released its first Cyber Security Sector Competitiveness Plan ^[3] in Sydney last Thursday. The report, developed in conjunction with AlphaBeta ^[4] is intended to help Australia’s cybersecurity industry ‘reach its full potential ^[5]’ by identifying and overcoming ^[6] roadblocks to small business, commercialisation of research and a cyber skilled workforce.

The Minister Assisting the Prime Minister on Cyber Security, Dan Tehan, recently launched the ASX100 Cyber Health Check Report ^[7], another key deliverable of the Cyber Security Strategy. The report, which reveals how Australia’s biggest businesses approach cybersecurity, was developed ^[5] by Australian Securities Exchange, the Australian Securities and Investments Commission, the Department of the Prime Minister and Cabinet, Deloitte, EY, KPMG and PwC. One of the report’s many findings ^[8] is that only 11% of companies have a clear idea of what data is shared with third parties, or have initiatives designed to reassure investors and customers of their cybersecurity.

The Minister’s been busy, also publishing an op-ed ^[9] calling for a ‘step change’ from passive to ‘active cyberdefence’ to combat cybercrime in Australia. The article advocates ^[10] for telcos and ISPs to take more responsibility for the dangerous content they inadvertently propagate and that users should be able to opt into services that provide a filtered and more secure version of the internet. While the Minister assured readers that he knows that ‘laws must be respected’, he said the government will ‘investigate existing legislation and, where appropriate, remove any roadblocks’ that may prevent this type of active defence from being possible. The controversial article has been described as a ‘radical plan’ ^[11] and has been criticised ^[12] for its poor understanding of the existing services and limited powers of telcos.

Australia took some strides on the international cyber stage this week when it hosted the inaugural Australia–China High-Level Security Dialogue ^[13] in the wake of Premier Li Keqiang’s March visit ^[14]. At the meeting Prime Minister Turnbull, Foreign Minister Julie Bishop and Secretary of the Chinese Communist Party’s Central Commission for Political and Legal Affairs Meng Jianzhu reached the significant agreement ^[15] that ‘neither country would conduct or support cyber-enabled theft of intellectual property, trade secrets or confidential business information with the intent of obtaining competitive advantage’. The pact reflects the principle of the September 2015 agreement between China and the US ^[16], which reportedly correlated with a decrease ^[17] of Chinese commercial espionage. Fingers crossed for similar success Down Under.

Stateside, the CIA and FBI ^[18] have launched a joint investigation to identify those responsible for leaking the contents of the Wikileaks’ multi-tranche ‘Vault 7’ ^[19] disclosures. Wikileaks has claimed that the documents, purporting to detail CIA cyber tools for hacking smartphones, televisions and computer systems, come from a former US intelligence contractor ^[20]. Unsurprisingly, the CIA is staying tight-lipped on the investigation into the source of the leak.

Looking at the date, it appears that the Trump administration’s much-anticipated cybersecurity plan is now officially late ^[21]. As President-elect, Trump promised ^[22] to deliver a fresh federal cyber plan ‘within 90 days of taking office’. We’re now past 90 days and the administration still has nothing to show other than a false start ^[23] and two leaked ^[24] drafts ^[25]. Unsurprisingly, assurances have surfaced ^[26] that Trump will sign a version of the long-awaited Executive Order this week, but we won’t be holding our breath.

French presidential candidate Emmanuel Macron appears to have been targeted ^[27] by the same Russian operatives behind the 2016 hack of the Democratic National Committee (DNC). A series ^[28] of phishing attempts and web assaults sought to obtain the email passwords of individuals working on the Macron campaign and gain access to confidential correspondence. New research by cybersecurity firm Trend Micro has compared ^[29] the digital fingerprints on the Macron system to those found after the DNC hack, finding that they were also from APT28—though the research stops short of saying who’s behind the malicious group. Not that they needed to, with US intelligence agencies having already explicitly attributed ^[30] the work of APT28 to Russian intelligence services. While the efforts against the Macron campaign were reportedly unsuccessful, Macron’s digital director Mounir Mahjoubi noted ^[27] ‘there was talent behind it and time went into it: talent, money experience, time and will’.

And finally, in a development unlikely to boost international confidence in democratic security, a Russian government think tank reportedly ^[31] outlined a plan to influence the US election in June 2016. US officials have anonymously disclosed that the US government is in possession of a Russian strategy paper written by the Russian Institute for Strategic Studies ^[32] and circulated to the highest levels of the Russian government last year. Hold on to your votes, people!