In the currently attenuated environment of international political\/economic interactions, the threat of foreign stakeholders and their interference in the democratic process and the undermining of critical institutions is an important topic.<\/p>\n
However, tariffs being the current focus in the headlines while Australia is in the midst of a federal election campaign, coverage of this issue is not getting near the attention it deserves despite the threat being more pressing than ever.<\/p>\n
These cyber threats and external actors no longer have their eyes purely on governmental organisations, they are now targeting smaller agencies and businesses within the government ecosystem with increasingly sophisticated attacks.<\/p>\n
The Evolving Cyber Threat Landscape<\/strong><\/p>\n The complexity of these cyber threats have grown into streamlined operations, working to shift public opinion, de-stabilise trust and orchestrate disinformation campaigns. With an objective of sowing doubt into the strength of these processes and feeding into already polarised and \u2018echo-chambered\u2019 communities, these attacks are no longer just about espionage or disruption.<\/p>\n Such campaigns dominated headlines during and after the 2016 U.S. elections, where credible reports exist of foreign actors conducting coordinated misinformation campaigns, leveraging social media platforms to spread false narratives.<\/p>\n Similarly, in recent European elections, cyberattacks targeted political parties, government agencies, and electoral commissions. Australia, is a strategic middle power in the Asia-Pacific region, and with some contentious interactions with key players over the past decade, is already a target for such cyber operations.<\/p>\n Vulnerabilities in Government and Corporate Cybersecurity<\/strong><\/p>\n Australia\u2019s cybersecurity ecosystem, thanks to a number of active government and industry initiatives, has certainly strengthened in recent years. These initiatives include significant investments made by the Australian government through the Australian Cyber Security Centre such as the Critical Infrastructure Uplift Program, Department of Home Affairs\u2019 Hosting Certifications Framework and Security of Critical Infrastructure Regime and Telstra\u2019s Cleaner Pipes program.<\/p>\n However, significant vulnerabilities still remain and are regularly exploited by adversaries. These chinks in the armour, when exposed in the government agencies have a particular effect on erosion of public\u2019s trust.<\/p>\n Australia\u2019s electoral cybersecurity risks are unique. Australian Electoral Commission (AEC) has stood up the Electoral Integrity Assurance Taskforce, which brings together various agencies in the Commonwealth to support AEC to counter disinformation campaigns, foreign interference and cyber intrusions. One of the areas which provides a somewhat \u2018natural barrier\u2019 to cyber threats to our electoral process is that AEC maintains a manual process of voting.<\/p>\n Ballot papers are counted manually by AEC representatives and overseen by scrutineers representing each party. This makes a cyber attack against the process of voting with a view to tampering with the results difficult as there are paper based records which can be fallen back on. However, there are still a lot of avenues during pre-election (voter enrolment), vote counting and tallying and election results release process where technology based risks exist.<\/p>\n Some of the key risks emanate from electoral support systems still relying on legacy IT systems, which are more susceptible to cyberattacks. Voter databases, and government ICT which supports electoral processes must be secured against potential breaches. Government agencies and electoral bodies must invest in modern, secure IT infrastructure with regular penetration testing, multi-factor authentication, and zero-trust security models to reduce vulnerabilities.<\/p>\n Businesses and organisations must also prioritise cybersecurity awareness by training employees on phishing scams, enforcing strong password policies, and implementing end-to-end encryption. Meanwhile, media organisations, social platforms, and regulators must work together to combat disinformation through fact-checking, transparency in political advertising, and content moderation.<\/p>\n This is a complex area and trends on an international scale have evolved – we\u2019ve seen global tech giants such as Meta drop fact checking from their platforms, only to bring it back in the form of crowd sourced \u2018community notes\u2019. The question remains – how do you balance the valid need for \u2018free speech\u2019 while enabling a level of validating accuracy of information?<\/p>\n