Luke Gosling (Solomon, Australian Labor Party) Share this | Hansard source

Before I make some remarks on the Security Legislation Amendment (Critical Infrastructure) Bill 2020, I want to acknowledge the work being done right now by our warfare counter-cyberoperatives, Australians who are right now defending our country and our economy at the ASD and obviously at other agencies and in other organisations and businesses. They're in the fight on the front line right now.

As we've heard from several speakers, every eight minutes or so there's a cyberattack on our country. That's an attack on our economy, on our way of life and on our sovereignty, so this is very important legislation. Whilst I agree with some of the comments made by the speakers on our side about the delays and the misunderstandings that have been consistent in getting us to this point today, I nonetheless want to acknowledge the government in finally introducing these new laws to ensure the resilience and safeguarding of Australia's critical infrastructure, which most definitely has our support.

The government is introducing these new laws to ensure the resilience and safeguarding of Australia's critical infrastructure. There are many threats, ranging from natural hazards such as weather events to more direct, human induced threats, including interference, cyberattacks, espionage, or chemical or oil spills, to give some examples, as well as attacks by insiders. They all have the opportunity and the potential to significantly disrupt our critical infrastructure.

Pervasive threat of cyberenabled attacks and manipulation of critical infrastructure assets is very serious and considerable, as we heard and as we read almost daily. The scope and impact is significant, and there is an increasing, unprecedented rate of these cyberattacks. If at the start of my contribution there was a cyberattack and those Australians were fighting against it, trying to stop it and mitigate the damage, by the end of this contribution there will have been another one and Australians will again be at the fore of protecting our nation. So we are critical of the delays but on the same ticket in terms of the intent of this bill, because we are facing increasing cybersecurity threats to our essential services, to our businesses and to all levels of government, as we have experienced in our own federal Parliament House. The Commonwealth's parliament's IT systems have come under attack, as we're all well aware.

In the past two years, cyberattacks have also hit networks in the health and food sectors, media and, as all listeners will understand, our universities, where there's not only disruption of the work at our universities but the theft of our brilliant, internationally-acclaimed intellectual property from our brilliant academics and researchers.

Internationally, cyberattacks have disrupted critical sectors, including water and fuel supplies in the United States. In this threat environment, it's crucial that Australia's technical authority, the Australian Signals Directorate, is empowered to assist entities in responding to significant cybersecurity threats and incidents to secure our critical infrastructure assets.

Now, as speakers have already mentioned, these are last-resort powers and affected entities will undoubtedly retain their reservations and their right to keep a keen eye on all bills policies that federal governments have. In supporting this legislation, we are relying on the intention stated in the bill, as given by the department and agency heads, that these powers will only be used as a last resort. With this in mind, it is very important to emphasise that the PJCIS, the Parliamentary Joint Committee on Intelligence and Security, will be notified and briefed each time the government enacts this power and will conduct a full review of the legislation when additional critical infrastructure reforms are introduced by the government. In evidence provided to the committee, witnesses overwhelmingly indicated their willingness to cooperate with ASD. Government assistance powers would only be needed in the event that an affected entity is unwilling or unable to respond appropriately. Thus, these measures should only be needed rarely, if ever. In the instance that there is disagreement between an entity and ASD, in the best course of action the bill does incorporate the committee's recommendation to include safeguards that require the minister to consider multiple impacts and current responses to any actions under this legislation.

The government itself has conceded that more work needs to be done in communicating, consulting and responding to concerns regarding its proposed positive security obligations for critical infrastructure sectors. These are important initiatives, and they need to be done properly. As the member for Gellibrand said, government agencies and the federal government itself need to engage with industry more. They need to build a deeper level of understanding and build a deeper level of trust and together build a deeper level of expertise to meet the threats that are increasing, that are significant and that could do great harm to our nation and, obviously, great harm to the economy. We need to build that resilience together. The member himself has a great deal of experience in this industry, and I hope that the federal government takes his contribution and looks at it very seriously indeed, because there is bipartisan support for this bill and bipartisan support for securing our nation from all threats. Cyber is becoming a domain and already is a domain where significant threats can materialise.

As I said, by now, those Australians working at ASD and in other agencies are combatting yet another cyberattack. This is real. It's happening every day, every eight minutes, so it's good that this legislation has finally arrived. Cyberspace is such an important domain and it's a place where threats to our nation can arise and are continually arising. It is such a crucial domain and it's one that I, having a responsibility as a federal representative, have been seeking to understand at a deeper level so that I am able to support, to the best of my ability, those Australians who right now are countering these threats. I recently, with the member for Bean, spent some time on an ADF parliamentary program focused on cyber: cyberwarfare, cyberdefence, cyberoffence. We visited a number of organisations that are providing cyber and information warfare capabilities to Defence and the whole of the Australian government. I was incredibly impressed by the intelligence and adaptability of these mostly young, some not so young, Australians who are operating in this domain, defending our sovereignty and defending our economy, so I want to give a shout out to all of those. Obviously I won't give your names, but I want to acknowledge the importance of the ADF Parliamentary Program that gives the opportunity for elected federal members to spend time with the ADF to understand the seriousness of the work you do and the need for proper resourcing. I acknowledge Lieutenant Colonel Andy Martin and also the host for that event from the Navy. They are exceptional Australians doing fantastic work.

In the time remaining, I will do something that I think we should all do more often, and that is provide some contextual information to Australians who are tuning in today about this domain of cyberspace and the incredibly important work that ASD and some of our ADF defence agencies are doing. Cyberspace is a global domain within the information environment, consisting of an interdependent network of information technology infrastructure including the internet, telecommunications networks, computer systems and embedded processes and controllers. The resident data is used to store, modify, exchange, process and collaborate on information. Cyberspace is unbound by physical location or international boundaries. It is like the matrix; it's everywhere. Cyberspace provides users with unprecedented access to information, audiences and critical targets across vast distances, and this is why it is so important. On a day-to-day basis you are in this domain and you are potentially the subject of some sort of attack or even monitoring. That's why it needs the vigilance of the operators in this environment and the interest, concern and resourcing of government to work closely with industry to make sure that Australians are protected as much as possible.

There can be conflict within cyberspace, and we learnt more about what we can do and where we're under-resourced in this area during that parliamentary program. Conflict in cyberspace can be conducted across large geographic distances, and it can have significant effects. We visited and spent time with the Information Warfare Division, which was formed only recently, in 2017, in the Department of Defence. It's formation was part of an initiative by the Australian government to combat threats to Australia's national interests in the information environment. I acknowledge Major General Susan Coyle, CSC, DSM, who is the Head of Information Warfare—this fifth-domain warfare for the defence of our nation. It's incredibly important work. She is a very impressive person who I've known for some time, and I really wish that division all the very best in its important work, as I do the Australian Signals Directorate for their important work.

There are great Australians doing work every day to protect our nation, our sovereignty and our prosperity by protecting our economy, and they're unsung heroes. They are not out on the front line in another country. They are here defending, in the cyberspace domain, our people, our country and our way of life. It is incredibly important work. So even though you are necessarily anonymous in the work that you do, I reconfirm from federal Labor—and, I'm sure, all parliamentarians—our thanks to you for the important work that you do and our support for this legislation that will be used as a last resort, should it be needed in this essential business that we are in of defending the Australian people with every resource that we have at our disposal.

See this speech in context