{"id":38404,"date":"2018-04-10T06:00:38","date_gmt":"2018-04-09T20:00:38","guid":{"rendered":"https:\/\/www.aspistrategist.ru\/?p=38404"},"modified":"2018-04-09T17:17:25","modified_gmt":"2018-04-09T07:17:25","slug":"australias-offensive-cyber-capability","status":"publish","type":"post","link":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/","title":{"rendered":"Australia\u2019s offensive cyber capability"},"content":{"rendered":"
<\/figure>\n

In 2016, the Australian government announced that Australia had an offensive cyber capability and was using it against Islamic State. Last June the government announced the creation of an ADF Information Warfare Division responsible for cyber defence and offence. It also announced that this capability will be used by law enforcement agencies to tackle organised offshore cyber criminals.<\/p>\n

Today\u2019s launch of ASPI\u2019s policy brief, Australia\u2019s offensive cyber capability<\/a><\/em>, marks another step out of the shadows for our cyber warriors. This groundbreaking report builds on official government statements about this new ADF investment and includes more detail on the strengths and weaknesses of offensive cyber power, the risks involved in its use, authorisations, approval mechanisms, and checks and balances.<\/p>\n

The report defines an offensive cyber operation as one intended to manipulate, deny, disrupt, degrade or destroy targeted computers, information systems, or networks. And it explores the types of effects such operations might achieve, such as altering databases, defacing webpages, encrypting or deleting data, or even affecting critical infrastructure.<\/p>\n

We\u2019ve seen states conducting these types of cyber operations, with outcomes that range from the devastating to the disappointing.<\/p>\n

The devastating state-based attacks that we\u2019ve seen have been very poorly targeted and have caused vast collateral damage. The WannaCry worm in May 2017, attributed to North Korea, spread worldwide and seriously affected many industries, notably the UK\u2019s National Health Service<\/a>.<\/p>\n

Similarly, the Russian NotPetya attack, notionally targeted at Ukrainian companies, caused worldwide damage well in excess of US$1\u00a0billion and affected companies as diverse as Merck (US pharmaceuticals), Maersk (Danish shipping), Fedex (US logistics), Saint-Gobain (French construction) and Mondelez International (UK chocolate).<\/p>\n

US offensive cyber efforts against Islamic State, however, reportedly<\/a> received mixed assessments. Former Secretary of Defense Ash Carter \u2018was largely disappointed in Cyber Command\u2019s effectiveness against ISIS<\/a>\u2019.<\/p>\n

Perhaps the first example of a state offensive operation was the Stuxnet worm<\/a> that disrupted Iran\u2019s nuclear weapons program by destroying industrial centrifuges used to enrich uranium fuel. This was a tightly focussed attack, designed to affect specific Iranian centrifuges and avoid other collateral damage.<\/p>\n

Stuxnet probably delayed but didn\u2019t halt Iran\u2019s nuclear program, although assessing the operation\u2019s success is difficult as we don\u2019t know the attacker\u2019s ultimate goals. The operation was less decisive than a destructive physical attack could have been, yet provided a clandestine capability that could be used when a kinetic attack was politically or practically impossible.<\/p>\n

Although the technical capability for offensive cyber operations resides within the Australian Signals Directorate (ASD), operations in support of military operations will be joint civil\u2013military partnerships, with operational plans constructed by the ADF and governed by ADF rules of engagement. Operations in support of law enforcement will have a separate approval and command process and won\u2019t involve the ADF, although the details of these processes haven\u2019t been disclosed.<\/p>\n

The legal principles considered when designing and approving offensive operations are necessity, specificity, proportionality and limiting unnecessary harm. ASD\u2019s legal authority and oversight mechanisms are also spelt out, and one of the policy brief\u2019s recommendations is that thought be given to updating the policy and legislative framework as cyber capabilities develop.<\/p>\n

The brief also describes the strengths and weaknesses of cyber operations from an ADF point of view. Among the advantages, integration with traditional ADF operations could well be a force multiplier and an asymmetric approach that provides new capability. Offensive operations provide global reach, and they can be either overt or clandestine.<\/p>\n

On the negative side, offensive cyber operations are unlikely to be decisive on their own, need to be highly tailored so as not to cause indiscriminate damage, and will require constant effort as the cybersecurity landscape evolves. Crucially, unlike conventional capabilities, cyber capability cannot be demonstrated for the purpose of deterrence because revealing a specific capability allows effective defences to be developed.<\/p>\n

The report concludes with a number of recommendations. Some recognise the challenge of attracting and retaining talented staff and suggest innovative recruitment and retention strategies, use of security-cleared reservists and deepened industry engagement.<\/p>\n

Chief among the recommendations is that leaders carefully structure public statements about cyber capability to reassure regional states and encourage responsible behaviour. The government\u2019s statements in June 2017 are a case in point. Statements about the creation of the ADF\u2019s Information Warfare Division and reports about action against offshore cyber criminals on the same day were conflated in the media in ways that suggested that Australian military forces were going to target cyber criminals. That confusion could have encouraged militaries in the region to launch cyberattacks against individuals in Australia whom they consider cyber criminals.<\/p>\n

In the relatively new field of military cyber operations, such missteps are bound to happen. With this policy brief we aim to promote greater transparency and a better understanding of this complex topic.<\/p>\n","protected":false},"excerpt":{"rendered":"

In 2016, the Australian government announced that Australia had an offensive cyber capability and was using it against Islamic State. Last June the government announced the creation of an ADF Information Warfare Division responsible for …<\/p>\n","protected":false},"author":618,"featured_media":38405,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[64,1707],"class_list":["post-38404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-civil-military-relations","tag-cyber-capability"],"acf":[],"yoast_head":"\nAustralia\u2019s offensive cyber capability | The Strategist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Australia\u2019s offensive cyber capability | The Strategist\" \/>\n<meta property=\"og:description\" content=\"In 2016, the Australian government announced that Australia had an offensive cyber capability and was using it against Islamic State. Last June the government announced the creation of an ADF Information Warfare Division responsible for ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/\" \/>\n<meta property=\"og:site_name\" content=\"The Strategist\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ASPI.org\" \/>\n<meta property=\"article:published_time\" content=\"2018-04-09T20:00:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-04-09T07:17:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2018\/04\/thecyberatta-e1523257478111.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"315\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Tom Uren\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:site\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tom Uren\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\",\"url\":\"https:\/\/www.aspistrategist.ru\/\",\"name\":\"The Strategist\",\"description\":\"ASPI's analysis and commentary site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.aspistrategist.ru\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-AU\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#primaryimage\",\"url\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2018\/04\/thecyberatta-e1523257478111.jpg\",\"contentUrl\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2018\/04\/thecyberatta-e1523257478111.jpg\",\"width\":640,\"height\":315,\"caption\":\"4.1.1\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/\",\"url\":\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/\",\"name\":\"Australia\u2019s offensive cyber capability | The Strategist\",\"isPartOf\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#primaryimage\"},\"datePublished\":\"2018-04-09T20:00:38+00:00\",\"dateModified\":\"2018-04-09T07:17:25+00:00\",\"author\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b143103fc9b3a4ae0d5e4b22c5eba93a\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.aspistrategist.ru\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Australia\u2019s offensive cyber capability\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b143103fc9b3a4ae0d5e4b22c5eba93a\",\"name\":\"Tom Uren\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/216436cb30ac616a4eacffdffe5ff739?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/216436cb30ac616a4eacffdffe5ff739?s=96&d=mm&r=g\",\"caption\":\"Tom Uren\"},\"url\":\"https:\/\/www.aspistrategist.ru\/author\/thomas-uren\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Australia\u2019s offensive cyber capability | The Strategist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/","og_locale":"en_US","og_type":"article","og_title":"Australia\u2019s offensive cyber capability | The Strategist","og_description":"In 2016, the Australian government announced that Australia had an offensive cyber capability and was using it against Islamic State. Last June the government announced the creation of an ADF Information Warfare Division responsible for ...","og_url":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/","og_site_name":"The Strategist","article_publisher":"https:\/\/www.facebook.com\/ASPI.org","article_published_time":"2018-04-09T20:00:38+00:00","article_modified_time":"2018-04-09T07:17:25+00:00","og_image":[{"width":640,"height":315,"url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2018\/04\/thecyberatta-e1523257478111.jpg","type":"image\/jpeg"}],"author":"Tom Uren","twitter_card":"summary_large_image","twitter_creator":"@ASPI_org","twitter_site":"@ASPI_org","twitter_misc":{"Written by":"Tom Uren","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.aspistrategist.ru\/#website","url":"https:\/\/www.aspistrategist.ru\/","name":"The Strategist","description":"ASPI's analysis and commentary site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.aspistrategist.ru\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-AU"},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#primaryimage","url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2018\/04\/thecyberatta-e1523257478111.jpg","contentUrl":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2018\/04\/thecyberatta-e1523257478111.jpg","width":640,"height":315,"caption":"4.1.1"},{"@type":"WebPage","@id":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/","url":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/","name":"Australia\u2019s offensive cyber capability | The Strategist","isPartOf":{"@id":"https:\/\/www.aspistrategist.ru\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#primaryimage"},"datePublished":"2018-04-09T20:00:38+00:00","dateModified":"2018-04-09T07:17:25+00:00","author":{"@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b143103fc9b3a4ae0d5e4b22c5eba93a"},"breadcrumb":{"@id":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.aspistrategist.ru\/australias-offensive-cyber-capability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.aspistrategist.ru\/"},{"@type":"ListItem","position":2,"name":"Australia\u2019s offensive cyber capability"}]},{"@type":"Person","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b143103fc9b3a4ae0d5e4b22c5eba93a","name":"Tom Uren","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/216436cb30ac616a4eacffdffe5ff739?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/216436cb30ac616a4eacffdffe5ff739?s=96&d=mm&r=g","caption":"Tom Uren"},"url":"https:\/\/www.aspistrategist.ru\/author\/thomas-uren\/"}]}},"_links":{"self":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/38404"}],"collection":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/users\/618"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/comments?post=38404"}],"version-history":[{"count":2,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/38404\/revisions"}],"predecessor-version":[{"id":38408,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/38404\/revisions\/38408"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media\/38405"}],"wp:attachment":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media?parent=38404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/categories?post=38404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/tags?post=38404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}