Appearing in Financial Review, Defence feature, 22 June 2017
Cyberspace is the emerging battlefield but there are many questions as to how to conflicts there will be fought – and are already being fought – and how cyber-warfare intersects with boots-on-the-ground soldiering.
“It is here whether we like it or not,” says Professor Greg Austin of the Australian Centre for Cyber Security at the University of New South Wales in Canberra. “The bad news is that Australia is lagging behind many other countries. If the US, widely recognised as the global leader in this, was rated as a five then Australia would be between one and two. A lot of other countries are at the same level, but there are others, including some we might see as potential adversaries, who are more advanced.
“The good news is that we are moving ahead, with funding being allocated and cyber-warfare being increasingly incorporated into strategic planning, such as in the 2016 Defence White Paper. The current Prime Minister and some of his Cabinet colleagues see the importance of this, although I cannot say that that understanding is shared across the political spectrum.”
One aspect of change is the establishment of new unit dedicated to cyber-warfare, which will begin operations next month. It will be headed by a Major-General, giving it a voice at the senior levels of the ADF and the government. The aim is to consolidate and improve cyber-warfare capabilities while working across the ADF to bolster recognition of the importance of the area.
Cyber-warfare could take place at a number of levels. As part of actual combat it could be used to attack command-and-control systems, surveillance systems and logistics. Communications systems could either be shut down or fake information could be planted.
Another aspect could be to attack frontline weapons systems, everything from aircraft flight systems to missile batteries. Even communications equipment used by troops in the field could be disrupted.
“If it’s got a chip in it, it’s a target,” Professor Austin says. “Which means practically everything.”
At another level, a country’s infrastructure facilities could also be attacked as part of a conflict, to hamper the organising of military forces, to create economic damage, and to cause panic. Professor Austin identifies electricity infrastructure as especially vulnerable, because of its distributed nature and its technological architecture.
Protecting systems is itself a huge task but the other side of the cyber-battlefield is offensive capacity. While the extent of the ADF’s offensive capacity is classified it certainly exists, ranging from the development of malware that could be inserted into an enemy’s systems to finding pathways that would allow covert monitoring of communications.
A critical problem with cyber-attacks is that the identity of the enemy might not be clear. But Professor Austin believes that the idea that cyber-warfare could be conducted by a collection of malcontents in a basement is not really credible.
“There is certainly the possibility of attacks from small groups or even individuals but to do it on a large scale, and to get past the defences, requires the resources of a state,” he says. “It is likely that a cyber-conflict would happen, if it does, in the context of a larger conflict over territory or another issue. So the enemy would be known, more or less. But the nature of the technology means that a weaker party can generate a disproportionate effect against a stronger adversary.”
Within the senior levels of the ADF, the formation of the new cyber-warfare unit is seen as a critical step forward. One of its longstanding advocates, Brigadier Marcus Thompson (who holds a PhD in cyber security issues) emphasised the need to find the best people in a recent article for the Australian Defence Force Journal.
“Given the specialist nature of cyber operations, personnel employed in such roles should be selected based on their attributes and aptitude, rather than their technical skills,” he says. “Technically-qualified personnel will certainly have a critical role to play but intelligence and targeting functions are equally important to successful cyber operations.
“While the required workforce is likely to be drawn from the Royal Australian Corps of Signals in the first instance, any member of the Australian Army with the attributes required to successfully execute cyber operations can be trained to be a cyber warrior, regardless of their rank, trade, Corps or gender.”
He believes that the ADF might also need to reconsider its recruiting model, physical entry standards, pay rates, and structures to attract people with the appropriate attributes to cyber-related positions.
Professor Austin agrees. “Ultimately, we will probably see fewer people on the ground and more warriors who fight in front of a computer screen,” he says. “The soldier with a gun, and their naval and air force counterparts, will never be redundant but we are already seeing some countries move personnel resources into cyber-warfare. It’s a new age, and we’re just seeing the start of it.”