Helen Polley (Tasmania, Australian Labor Party) Share this | Hansard source

I rise to speak on the Cyber Security Bill and related bills. This issue is of great importance to our country, our citizens and our economy. As chair of the Joint Standing Committee on Law Enforcement and as a member of the Senate Standing Committee on Legal and Constitutional Affairs, I understand the importance of this issue. It's gripping Australia, and it's gripping the world. Governments around the world must act now if we have any chance of getting ahead of the game of crime syndicates, professional hackers, foreign adversaries and fighting against cybercrime.

I often relay tips to the public about the importance of personal online safety and tools they can implement to try and keep them safe online. There are simple strategies that can boost your cybersecurity, like updating your device regularly, setting up and performing regular backups, learning how to make a copy of your files so that you don't lose that valuable data, turning on multifaceted authentication, setting secure passphrases, recognising and reporting scams, learning how to identify common cyberattacks and defending yourself against cyberattacks. The simplest way you can protect your devices from cybercrime is to turn them off every day.

To get into the practice of doing that, before you get into the shower, turn your mobile phone or your iPad off and, when you get out of the shower, turn it back on. That is a really simple but effective way to help protect yourself.

As a government, since coming to office we have been very committed to meaningful reform. That's why I'd like to acknowledge the Minister for Home Affairs and Minister for Cyber Security, the Hon. Tony Burke, and the previous Minister for Home Affairs, now the Minister for Housing and Minister for Homelessness, the Hon. Clare O'Neil, for the work that they've undertaken. Cybersecurity deserves our attention, and this bill, the Intelligence Services and Other Legislation Amendment (Cyber Security) Bill 2024 and the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Bill 2024 form the cybersecurity legislative reform package of the Albanese Labor government.

As a government, we are committed to strengthening our national cyberdefences and building cyber-resilience across the Australian economy after some very high-profile cyberattacks and data breaches over the last five to 10 years. This suite of legislative reforms will implement key initiatives under the 2023-2030 Australian Cyber Security Strategy, which Minister O'Neil worked tirelessly on, and I acknowledge her contribution. I also acknowledge the department's contributions and submissions to the inquiry of the Intelligence and Security Joint Committee. They were always informed and completely focused on enhancing our cybersecurity intelligence and infrastructure. I know our security and intelligence organisations, and sometimes we take them for granted, but they are so essential to ensuring our national security and our own personal security, so I want to acknowledge them here today.

This is a significant step in achieving the Australian government's vision of becoming a world leader in cybersecurity by 2030. To achieve this vision, Australia needs a clear legislative framework that addresses whole-of-economy cybersecurity issues and positions us to be able to respond to new and emerging threats from wherever they may come. Our country relies on a framework that enables individuals to trust the products that they use every day. We need a framework that enhances our ability to counter ransomware, cyberextortion and end-to-end encryption and to live with cryptocurrency and technological advancements. These are all important things that are part of our world now. We need a framework that enhances protections for victims of cyber incidents and encourages them to engage with government. We need a framework that enables us to learn lessons from significant cybersecurity incidents so that we can be better prepared, because time is of the essence. When a cybercrime has occurred, you have only hours to report that crime to have any hope of being able to track the cybercriminals, which is why we must report these crimes when they occur.

I don't know how many people I've met in the last few months that have actually lost tens of thousands of dollars and been far too trusting. These cybercrimes are real, and they can impact any of us. Sometimes people will say to me, 'You're a high-profile politician, and that's why you're a target.' That's not true, unfortunately. Cybercrime can happen to each and every one of us. So we need a framework that enhances protections for victims of cyber incidents and that, as I said, encourages them engage with the government. We need to ensure that people understand the importance of reporting these crimes as soon as possible.

I know people that have been stung by various scams, and they feel embarrassed.

They really do feel embarrassed and that they should have known better. But the reality is, these criminals are smart, they change the way that they operate all the time. They come from different places as well as from Australia—all these cybercrimes aren't just being perpetrated from people offshore.

The Cyber Security Bill provides a framework to build our cybersecurity as a nation in a globalised and technologically advanced world. The first measure under this bill will ensure that Australians can trust their digital products by enabling the government to establish mandatory security standards for smart devices. Australians are prolific users of smart devices—we love our gadgets—but consumers need to be assured that smart devices are still safe for them to use. To date, smart devices have not been subject to mandatory cybersecurity standards or regulations in Australia. Therefore, this bill will bring our country in line with international best practice and also will provide Australians with peace of mind that the smart devices we've come to rely on almost every day will meet our expectations around security.

The bill will enhance consumer security by prohibiting the use of universal default passwords on a smart device which create backdoors for potential hackers. The bill addresses the ransomware threat that continues to cause large-scale harm to the Australian economy and national security. Businesses are losing millions of dollars every year because of ransomware. We can stop it in its tracks with mandatory reporting of ransomware payments to learn from these attacks. We must prevent future ransomware crises and equip businesses to be able to bounce back following any incident.

The Cyber Security Bill's third measure seeks to support and assure Australian organisations as they respond to cybersecurity incidents. Close cooperation between government and industry is one of our greatest defences against cybercrime, which is malicious. In the wake of cybersecurity incidences, businesses need to know that they can call on government to quickly get the support that they need. The bill affirms the role of the National Cyber Security Coordinator to coordinate whole-of-government cyber-incident responses effectively. It also seeks to increase trust and engagement between business and government during an incident by limiting the circumstances under which the coordinator can use and share information that has been voluntarily provided by an affected entity. With these measures businesses will have a greater comfort to report cyber incidences and gain the assistance they need in order to respond to recover from cyber incidences.

We must remember that cyber crimes can impact businesses and individuals, and it's important that when you have an incident, you report it and reach out and get the support that you need. I thank Minister Burke and Minister O'Neill for their leadership, and I thank those who provided evidence to our committee to investigate this. I recommend the bill to be passed in the Senate today.