Tim Watts (Gellibrand, Australian Labor Party, Shadow Assistant Minister for Communications) Share this | Hansard source

I've spoken before in this chamber about how proud I am to have the Australian Islamic Centre in Newport in my electorate. It's an architectural landmark, a place of worship and a community hub for thousands of people in Melbourne's west. It was in a similar place of worship in Christchurch in a country so much like our own that 51 men, women and children were massacred by an Australian terrorist earlier this year. The member for Maribyrnong and I visited the Newport mosque immediately after this atrocity and spent hours with community members, united in mourning and in fear.

The fact that one of our own could commit such an act has been a cause for much reflection. His vile acts do not reflect our values as Australians. In particular, they do not reflect the values of Melbourne's west, my community. Despite that, this atrocity should be a wake-up call that forces us to confront some hard truths. Firstly, we must confront the reality that radical right-wing extremism is growing around the world. White nationalist extremists were responsible for at least 50 murders in the US in 2018, a 26 per cent increase on the previous year. According to the Center for Strategic and International Studies, the situation may be even worse in Europe, where attacks by right-wing groups increased by 43 per cent between 2016 and 2017.

I've previously spoken in this chamber about the fact that white nationalists have murdered politicians in recent times in the United Kingdom, Germany and Poland. If the Christchurch attacker weren't evidence enough, ASIO recognised in its 2019 annual report that the threat from extreme right-wing terrorism in Australia has increased in recent years and will remain 'an enduring threat'. We must also confront the fact that these attacks are connected by a global ideology. They aren't random, unconnected tragedies. These right-wing terrorists are part of an online community that uses the internet to spread their ideology and to radicalise the marginalised and vulnerable. Atrocities like Christchurch turbocharge the power of their message in these networks. That's why the Christchurch terrorist posted his manifesto online before the attack and it's why it was suffused with symbolic call-backs to the atrocities of previous white nationalist terrorists. It's also why a series of subsequent terrorists, inspired by the Christchurch atrocity, have used similar codes and symbols in the online content that they have produced before and after their attacks.

The growing nature of the threat of right-wing extremist terrorism and the way that this ideology and these attacks perpetuate themselves online mean that we need to take action if we want to ensure that an atrocity like Christchurch never happens again. We need to act to stop an Australian from ever again committing an atrocity like the Christchurch attack. The best way of doing this is through the Christchurch Call to Action. New Zealand Prime Minister Jacinda Ardern's Christchurch Call was a compact between governments and technology companies that included commitments for action by both groups to break the online radicalisation engine that led to the Christchurch terrorist attack.

I'm pleased to say that, since the signing of the Christchurch Call, online service providers have finally begun to act and implement their commitments. The Global Internet Forum to Counter Terrorism, a consortium of tech companies that includes Facebook, YouTube and Google, released a nine-point plan that members will implement to address the abuse of technology to spread terrorist content. Facebook banned white nationalist content from its platforms, imposed new restrictions on the use of Facebook Live and expanded the use of automated techniques to identify and remove terrorist content. And the web-hosting company Cloudflare finally ceased providing hosting services to the 8chan website that had become ground zero for white nationalist radicalisation and the celebration of these terrorist attacks.

These are welcome developments, but there's still more work to do. For example, recent reporting from VICE News has shown how these white nationalists have moved their activities to more tolerant social media platforms. Analysis of 150 public-facing far-right channels on the Telegram Messenger service found that more than two-thirds of these channels were created in the first eight months of 2019. Not only do white nationalists have a much more robust presence on smaller online platforms like Telegram than they did two years ago, their channels have grown more sophisticated, violent and terroristic over time. These smaller platforms should follow the lead of the GIFCT and take responsibility for breaking the radicalisation engine and shutting down channels like this.

Governments, too, need to act to implement the Christchurch Call. Shamefully, despite our special responsibility as the nation that produced the Christchurch terrorist, the Australian government's implementation of the Christchurch Call has been piecemeal and slow. The Morrison government has loudly trumpeted its new laws to establish a content-blocking framework for crisis events, and this is welcome. Seeking to stop the sharing of footage of terrorist attacks is certainly welcome. This is absolutely a part of the online radicalisation process that we've seen playing out in recent times, but it's just one part of the problem. Indeed, the very first commitment in the Christchurch Call commits governments to:

Counter the drivers of terrorism and violent extremism by strengthening the resilience and inclusiveness of our societies to enable them to resist terrorist and violent extremist ideologies, including through education, building media literacy to help counter distorted terrorist and violent extremist narratives, and the fight against inequality.

This is a much broader task than stopping the sharing of footage of the terrorist attacks themselves. But since the Christchurch attack, the Morrison government has not provided any additional funding to community based, countering violent extremism programs. Indeed, it's not clear whether any of the very small amount of Commonwealth funding that is currently being spent on CVE in Australia is tailored to the threat of right-wing radicalisation, is tailored towards the vulnerable and marginalised individuals in our community who may be beguiled by the messages of these white nationalists. Where is the Commonwealth funding for programs like that developed by the NGO All Together Now, the community action for preventing extremism project, formerly known as Exit White Power, which aims to break the radicalisation engine by planting seeds of doubt in the minds of young people who may be attracted to white nationalism and white supremacy. Where are the new nationwide anti-racism and anti-religious bigotry programs in response to the increased threat we see in the wake of the Christchurch attacks?

The second commitment of the Christchurch call commits government to:

Ensure effective enforcement of applicable laws that prohibit the production or dissemination of terrorist and violent extremist content, in a manner consistent with the rule of law and international human rights law, including freedom of expression.

This commitment isn't about searching for a technology silver bullet to break the radicalisation engine. It's about providing extra law enforcement resources for the old-fashioned policing necessary to infiltrate white nationalist terrorist networks, who are increasingly using encrypted communications like Telegram, and breaking them up from the inside. We saw a very good example of this just this month with the FBI's arrest of Jarrett Smith, a far-right extremist who was allegedly using the Telegram platform to discuss the bombing of a US news outlet. Again, this doesn't just seem to be a resourcing priority for the Morrison government. We haven't seen the additional funds being allocated to Australian law enforcement agencies in order to tackle what we know is a proliferation of these extremist views online.

There's a stark contrast with Australia's approach and other nation's response to the growing threat of white nationalism after the Christchurch attacks. The US Department of Homeland Security has formally recognised white nationalism as a serious national security threat and unveiled a new counterterrorism strategy to combat it. The US Congress has held seven hearings on radical right-wing extremism since April. In the UK, extreme right-wing terrorist threats are being included in official threat-level warnings alongside the Islamist threat. Canada has funded research into far Right extremism, to better understand the threat and to learn how to combat it in the context of that country. In New Zealand, the government has invested in its Department of Internal Affairs, to double not only its investigative work but also its preventative programs. Further reforms are yet to come from the New Zealand royal commission into the attack. I believe that there will be lessons for Australia—about the activities of the murderer in Australia on the online white supremacist forums in this country—coming from the evidence heard by the royal commission in New Zealand.

In Australia, though, not only have we failed to follow through on our commitments under the Christchurch Call; the Department of Home Affairs doesn't seem to even officially recognise white nationalism as a serious national security threat. As my colleague the member for Chifley has noted, in its annual report ASIO discusses the international threats of Islamist terrorism from Europe, Asia and the Middle East, but there's no mention of the threat of US or European based far Right extremists and the attacks that they could pursue in Australia.

Last month, former FBI agent Ali Soufan gave evidence to the US Congress that 17,000 people, including US white nationalists, had travelled to Ukraine in recent years to gain paramilitary skills in the conflict there before returning home. Are Australians doing the same? How many? How do we know? Who's monitoring them? There is much more that we need to be doing in this space to address this threat.

I welcome the first steps taken by the Morrison government to tackle online radical right-wing extremism, and the content-blocking regime for terrorist acts that has been implemented, but, if we want to prevent another Christchurch, another terrorist atrocity committed in the name of white nationalism by an Australian, we need to do better. We need to start taking the need for a holistic response to the threat of networked white nationalism seriously.

Earlier this month, hospitals in Victoria were subjected to a targeted ransomware attack by cybercriminals. A ransomware attack is a kind of cyberattack in which hackers hold a target's IT systems hostage until a specific demand—typically the transfer of money in the form of bitcoin—is met. The costs of these attacks, measured in the costs of remediating compromised IT systems and the costs of having these IT systems offline, is enormous and growing. In 2017, the WannaCry ransomware worm had worldwide costs of between $4 billion and $8 billion. Since then, the aggregate dollar value of ransoms paid as a result of these attacks has more than doubled, from around $5 billion in payments in 2017 to around $11.5 billion in 2019. This is no small risk.

Luckily the Victorian hospitals ransomware attack seen this month was relatively low impact, shutting down booking systems across multiple hospitals and delaying dozens of surgeries across the state. Unfortunately for Australia, though, this is very likely just the beginning. The United States has been subject to a tidal wave of targeted ransomware attacks this year, targeting, in the first instance, hospitals and then quickly moving on to schools and local governments. At least 170 local and state governments in the United States have been subject to ransomware attacks, including 45 law enforcement offices. This year alone, over 500 schools in the US have been subject to ransomware attacks.

These attacks are enormously disruptive and costly. Louisiana was forced to declare a statewide emergency in response to ransomware attacks on its school districts. In Baltimore city, a ransomware attack cost the city $10 million in lost revenue and in remediation costs for its IT systems. It's only a matter of time before Australian schools and local governments join our hospitals on the ransomware radar of these international crime syndicates. The Victorian hospitals attack is an early warning that government needs to fundamentally rethink its approach to helping these organisations to protect their systems and our citizens' information.

The Morrison government's approach to cybersecurity to date has been too top-heavy in this respect. It's reasonably good at sharing details of cybersecurity threats with large, sophisticated private sector entities who are already focused on the importance of cybersecurity, but the mechanisms that it uses to reach the disengaged are less effective. The Morrison government currently lacks a mechanism for communicating an imminent widespread threat like that posed by the current wave of targeted ransomware attacks.

To meaningfully communicate the current targeted ransomware threat, we need to start thinking about cybersecurity as though it were a public health issue. This means identifying at-risk communities and developing tailored harm-minimisation interventions. During the height of the HIV epidemic, public health practitioners in Australia identified at-risk communities—communities like intravenous drug users, sex workers and gay men—and provided tailored interventions to these groups. These interventions were designed to minimise the potential for harm in these groups—for example, by setting up needle exchanges and creating targeted, culturally appropriate sexual health awareness programs and by distributing free condoms. Australia's response to the HIV epidemic is widely considered to be a textbook example of responding to a public health crisis. We need to do the equivalent today in cybersecurity.

We need to recognise that Australia's 9,500 schools, 700 public hospitals and 537 local governments are at-risk groups during the current wave of targeted ransomware attacks and we need to design tailored risk minimisation interventions in order to get the message out to them and to help them to protect themselves—interventions like lifting awareness and implementation of basic security postures, like the Australian Signals Directorate's Essential Eight risk mitigation measures. In the specific instance of these ransomware attacks, it also means ensuring that these groups have back-up systems in place that are effectively partitioned from a ransomware attack on an organisation's core IT systems. It means ensuring that these at-risk communities, these at-risk organisations, have war-gamed out what their response would be if they were to be subject to a ransomware attack, that they've thought this through, that they know how to respond to an incident and get back on their feet quickly. This takes preparation. The time to act is now.

We know that this threat is imminent. We've seen it playing out in the United States over the preceding months. If the Morrison government fails to act to get the word out on this issue now, then the consequences of these attacks in Australia for our nation will be on its head.

See this speech in context