Australia's Cyber Security Strategy 2020

Australia's Cyber Security Strategy 2020
Name	Australia's Cyber Security Strategy 2020
Date adopted	2020
Jurisdiction	Australia
Responsible ministry	Department of Home Affairs
Related documents	2016 Cyber Security Strategy

Australia's Cyber Security Strategy 2020 The 2020 national cyber security policy outlines measures to strengthen Australia's resilience against digital threats through investment, capability building, and international cooperation. It was developed amid rising incidents affecting critical infrastructure and supply chains, and reflects priorities in contemporary debates involving Scott Morrison, Marise Payne, and agencies such as the Australian Signals Directorate, Australian Security Intelligence Organisation, and Attorney-General's Department. The Strategy builds on prior frameworks like the 2016 Cyber Security Strategy and interacts with legislation including the Security of Critical Infrastructure Act 2018 and proposals related to the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018.

Background and Development

The Strategy was announced by Scott Morrison's administration following high-profile incidents involving actors attributed to states such as China in controversies overlapping with investigations by the Australian Federal Police and operational assessments from the Australian Cyber Security Centre. Development drew input from departments including the Department of Defence, Department of Home Affairs, and advisory bodies like the Cyber Security Cooperative Research Centre and industry stakeholders including the Australian Information Industry Association and the Council of Small Business Organisations Australia. International influences included doctrines from the United States Department of Homeland Security, norms discussed at the United Nations Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, and partnership models from the Five Eyes intelligence alliance.

Objectives and Strategic Priorities

The Strategy sets objectives to protect critical infrastructure operators such as Ausgrid and Transgrid, secure supply chains involving firms like Huawei Technologies and Cisco Systems, and bolster incident response capacities practiced by the Australian Cyber Security Centre and the CERT Australia function. Priorities include improving resilience in sectors regulated by the Australian Prudential Regulation Authority, safeguarding electoral integrity after concerns involving Cambridge Analytica, and enhancing workforce capability through collaboration with universities like the University of New South Wales, Australian National University, and vocational training providers such as TAFE NSW. It emphasizes deterrence measures consistent with doctrines of the Department of Defence and legal tools used by the Attorney-General's Department.

Key Initiatives and Programs

Major initiatives include a $1.67 billion investment to expand the Australian Signals Directorate's offensive and defensive cyber capabilities, grant programs supporting small and medium enterprises via organisations like the Australian Cyber Security Growth Network, and the creation of regional hubs coordinated with state agencies such as the New South Wales Government and Victorian Government. Programs also target research via funding for entities including the Defence Science and Technology Group and the CSIRO, and procurement reforms to harden supply chains involving vendors like Microsoft and Amazon Web Services. The Strategy expands public-private collaboration through forums modelled on World Economic Forum cyber initiatives and standards alignment with the International Organization for Standardization and International Electrotechnical Commission.

Governance and Implementation Framework

Implementation responsibilities are distributed across portfolios including the Department of Home Affairs, Australian Signals Directorate, Australian Cyber Security Centre, and the Department of Defence, under oversight mechanisms involving the Parliament of Australia and ministerial offices such as that of the Attorney-General of Australia. Accountability involves reporting cycles to parliamentary committees like the Joint Parliamentary Committee on Intelligence and Security and engagement with state counterparts including the Queensland Government and Western Australian Government. The framework references legal instruments including the Privacy Act 1988 and sector-specific regulations enforced by bodies like the Australian Communications and Media Authority and the Australian Securities and Investments Commission.

Funding and Resource Allocation

The Strategy committed approximately AUD 1.67 billion over ten years, directing funds to capabilities at the Australian Signals Directorate, grants for SMEs coordinated by the Department of Industry, Science and Resources, and investments in research at the Cyber Security Cooperative Research Centre and tertiary institutions such as Monash University and University of Melbourne. Allocation also channels resources to state-level initiatives in partnership with agencies like SafeWork NSW and to procurement reforms affecting suppliers including Telstra and international cloud providers. Budgetary oversight involves the Department of Finance and reporting to the Parliamentary Budget Office.

International Collaboration and Partnerships

The Strategy underscores alliances with the United States, United Kingdom, Canada, New Zealand (the Five Eyes), and partners in the Quad framework, and it seeks interoperability with standards from organisations such as the North Atlantic Treaty Organization and the Asia-Pacific Economic Cooperation. It advances bilateral cooperation with regional partners including Indonesia, Papua New Guinea, and Singapore, and engages multilateral fora such as the International Telecommunication Union and ASEAN Regional Forum to pursue norms discussed at the United Nations General Assembly cyber debates.

Impact, Reception, and Criticism

Reception among stakeholders was mixed: industry groups like the Australian Information Industry Association acknowledged increased investment while civil society organisations including the Australian Council of Social Service and digital rights advocates such as Electronic Frontiers Australia raised concerns about privacy implications and powers in the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018. Academic critiques from scholars at Australian National University and University of Sydney questioned operational transparency for capabilities expanded at the Australian Signals Directorate and potential effects on international trust involving suppliers such as Huawei Technologies. Parliamentary scrutiny by the Joint Parliamentary Committee on Intelligence and Security and commentary in outlets like The Australian Financial Review and The Sydney Morning Herald focused on resource sufficiency, workforce shortages, and legislative safeguards.

Category:Cybersecurity in Australia