The Lowy Institute International Cyber Engagement Q and A

  • Transcript, E&OE
11 March 2019

Michael Fullilove:

Well, Minister, thank you very much for that stocktake and I'm sure everybody here would associate ourselves with the goal that you've set of a secure, open and free internet. And welcome also, Toby Feakin.

Perhaps, Minister, with your permission, I might go first to the Ambassador as he hadn't had a chance yet to speak. Toby, the Minister put on record the achievements of the strategy, but she also alluded to the fact that things are not necessarily going in a positive direction, as I think. Emperor Hirohito said towards the end of the Second World War.

You're at the coalface of the cyberwars, if you like, does it noticeably feel that it is getting hotter and more lethal? Because just as an observer, a reader of the newspaper, without any sort of security clearance, that's how it feels to me.

Ambassador Feakin:

Thank you. Let me talk about that from a diplomatic point of view. Absolutely, it's getting warmer and they're the conversations that we have to have with partners who have a different view of how the internet should look and feel in the future. There is no doubt that we're in a hotly-contested area and I think the Minister mentioned that in her speech, these various different bodies that are being set up through the UN where these conversations are going to be progressed and moved forward.

But we have these conversations through so many different organisations as well, be they ICANN, where the future of the internet is been grappled with. And yes, there are countries that have a very space-centric view of how these things should be done; with a different view of how human rights is interpreted in the online space and to be frank, how our societies would function as a consequence of that.

So I think we do live in an incredibly contested moment, and you allude to the fact that there is also a change, if you like, in the cyber environment in terms of what's going on technically. Part of that is down to the fact that we are more transparent and we are more open in terms of saying what's going on because we feel some of these behaviours do have to stop. But part of it is also that increased numbers of countries now have these capabilities and don't utilise them with the similar kind of framework that Mike Burgess will no doubt talk about when he makes his speech in the coming weeks.

Michael Fullilove:

Let me ask you, just to follow up, on this question of attribution that the Minister talked about. It's a very interesting development. And as the Minister alluded in December, for example, we, along with a number of other countries attributed a campaign of cyber-enabled commercial intellectual property theft to a group acting on behalf of the Chinese Ministry of State Security. Can you talk us through, Toby, how does the attribution process work? What are the basis on which we make a decision to attribute? Does Australia ever attribute by itself? Does it only ever attribute with other partners? Tell us how that process works, if you would.

Ambassador Feakin:

Yeah. Absolutely. It'd be interesting to get a number of hands. I mean, who would guess in the audience that attribution was done just by technical means? Hands up. Well, that's good. That's a good starting point. Then we're certainly changing the discussion because often there is this sense that you need 100 per cent absolute information from a technical point of view because we are dealing with computers essentially, and that isn't actually the case. When we're looking at attribution, we look across all the different equities that that decision requires.

So of course, we'll want an intelligence assessment of certainty. If we're attributing with another country, what degree of damage or harm has that caused Australia, the Australian economy, the Australian Government; what kind of policy environment are we in. And then, we essentially meet across all of those equities and all of those different government partners and then make a decision based from that point. And obviously, the Foreign Minister plays an incredibly important role within that because obviously a lot of these issues then boil down to sensitivities with a bilateral relationship.

Michael Fullilove:

And Minister, you mentioned the attack on Australia's democratic institutions but I think that, if I'm correct, the Prime Minister referred to the culprit in that case as a sophisticated state actor. He didn't attribute it to a particular country. So why haven't we attributed that attack yet?

Minister Payne:

I think, as I said, when I was speaking Michael, that it is still being examined because it is so complex and has significant technical elements. So, that is work that I don't think a Government would ever want to rush, nor would intelligence agencies or technical specialists and professionals. So that is still being considered.

But from a government's point of view, we've taken that very seriously, briefed the political parties appropriately to make sure that they are all informed and aware of potential vulnerabilities and able to address those.

Michael Fullilove:

Does that mean when the investigation is complete, we will attribute that attack?

Minister Payne:

Well, I think, as we were saying earlier, each of these circumstances is very different and this is different again. So, assessments are made based on the nature of the circumstances and I wouldn't like to say, at this point in time, whether that will ultimately be the case or not. That will ultimately be a decision for government.

Michael Fullilove:

Let me ask you one or two questions about 5G, if I may. I know it's not what you discussed today but it's obviously a closely related issue.

We're seeing a divergent response from likeminded countries, at least that's the way it seems to me, in the sense that Australia, New Zealand and the United States have said that Huawei cannot participate in building our domestic 5G networks. But we at least have seen reporting in the FT, I think, and elsewhere that some in the British intelligence establishment are not necessarily sold on the idea that Huawei should be excluded. So, can I ask you, Minister, again – because this is one of these questions that if you don't have access to security classifications, it's hard sometimes to make a judgment – why should a company like Huawei be ruled out of providing that 5G technology in a country like Australia?

Minister Payne:

So I think what we have been very careful to emphasise, Michael, is that we have taken the strongest advice from intelligence agencies in this country, the strongest technical advice, as to the best way to protect Australia's national interests in the establishment of a 5G network here. As a member of the National Security Committee, that's the advice upon which I rely. We took a long time to consider the implications and to come to that decision.

And we have, where appropriate and possible, been prepared to share that information, in appropriate circumstances - not publicly, in intelligence terms. So we are resolved on the position that Australia has taken. Other countries will make their own decisions. But for us to protect Australia's national security, to ensure that the priorities of any business involved in our communications network to place first Australia's protection and Australia's national security, that is the decision we've made.

Michael Fullilove:

You may well have seen the tweet by President Trump in late February where he – it's a bit hard to read it but he seemed to offer an olive branch to Beijing in relation to Huawei. And he said this, "I want the United States to win through competition not by blocking out currently more advanced technologies."

Obviously, that would be extremely awkward if the United States were to change its policy on 5G after we've made our decision. How did you read that communication from the president?

Minister Payne:

I think the engagement between our intelligence agencies has been very important in our decision making process and we'll continue to prioritise that. I think it's important though also to recognise that every country will make a sovereign decision. They'll make their own decisions based on their own national interests. The one Australia has made is not directed at any one company, or two companies, or five companies, or eight companies. It's directed at protecting our national interest.

Michael Fullilove:

Yes, Toby.

Ambassador Feakin:

[indistinct] On the 5G question, because I think it's something that obsesses a lot of time now in this position and between countries bilaterally. I'm sure, Minister, you've been asked this question more times than you can care to remember. And again, I think let's put into context - a lot of people probably imagine it just means another number on your phone. So instead of four, you see five; it's not the case. It's a comprehensive infrastructure change in the way that we do business and the way that our societies will function.

So it's not just that extra number, it's about how all of your IT devices will communicate with each other, how any driverless car will function in the future. So it's one of the most fundamentally important infrastructure decisions a country will make. And so the decision that Australia has made, as the Minister absolutely rightly said, it's not about a particular company, it's about making decisions around that technology and what you're comfortable with. And as a country, we decided we couldn't take a decision where you could separate out parts of that infrastructure and take a risk mitigation approach.

For national security reasons and for the security of that infrastructure in the future, it was important to show that we could make a decision around where companies linkages led back to, what kind of policies they held that were in close association with a given country where they were based.

So, the decisions around it were more about accountability and transparency, again, which is something which is so, so important. We need to be able to trust that infrastructure and all the things that we then go forward to deliver on the back of it.

So whilst yes, we sit and watch sovereign decisions – which they all are – I think Australia's decision has been admired around the world. And certainly, frequent request through my position – and I'm sure through yours, Minister – is well, how did you meet that decision and what's some of that information, and we've been quite comfortable sharing that.

Michael Fullilove:

Toby, you may have seen a speech by the former Prime Minister Malcolm Turnbull last week, I think, where he's talking about some of these questions and explaining it to a British audience. One point I thought he made that was very interesting was that he noted the fact that there is no- given the historic the historic advances that countries like the UK and Australia, and the United States have made in Wi-Fi technology and so on, how unfortunate is that that none of none of these like-minded countries have a carrier that seems to be able to provide the 5G technology that we're all going to need.

Why is that? Am I right that the two- there's only four companies, I think Malcolm was saying, that are in a position to provide it; two are European continent, and two are from China. Why do you think it is that none of these very innovative countries in the Anglophone world have succeeded in this realm?

Ambassador Feakin:

Interesting. I was chuckling because there's a fair few conversations that I've been involved in when the prime minister was the prime minister on that front.

Michael Fullilove:

So, you've got a good answer?

[Laughter]

Ambassador Feakin:

Well, yeah, no, I'll have to duck some of those conversations.

Minister Payne:

I'm not entirely sure he can share it all, but…

Ambassador Feakin:

Yeah, exactly. So I'll allude to it but not share; if that's okay. That's not very transparent, is it?

[Laughter]

So, I think one of the biggest questions…

Minister Payne: [indistinct] limiting otherwise.

Toby Feakin:

Exactly, I've got to be super careful now. So one of the interesting things, one of the questions that's often asked is about price point, okay? And the fact that some of our- some of the companies in China have taken decisions to make huge investments in this area of technology. And I guess for the policy wonks out there, go and read any of the kind of policy documents that the Chinese Government puts around us, and you start seeing why. It's about being technologically at the front of every single curve.

However, price point is one issue. It could be cheap to begin with, but the thing is with the other companies – and I have to be careful, because I'm not working for those companies and I can't advocate for them – but actually, the through -life cost of the kind off, if you like, assurance and trust that that brings, actually lowers itself out in the longer term.

So you're right, there are some, particularly Scandinavian countries, who have capability in this area and they are making rapid advancements in terms of promoting their proposition globally now. And we're certainly seeing that shift dramatically, from even six to 12 months ago, that race is proceeding at pace.

Michael Fullilove:

Let me ask one more question, then I want to go to the audience and give them an opportunity to ask a question to either Minister or the Ambassador.

Minister, you mentioned also the undersea internet cable that's being built between Australia, PNG, and the Solomons. The history of that, of course, is that in late 2016, the Solomons Government signed a deal with Huawei to lay a cable to Australia. And subsequently, the Australian Government agreed with Honiara to take over and, I think, fund about two-thirds, from memory, of the project and also to connect it to PNG. Why did Australia make that decision?

Minister Payne:

Well, I think we've been very clear in recent years particularly, and the Pacific Step Up which the Prime Minister announced and built on at the end of last year is reflective of that, that we want to be the security partner of choice in the region, that we have capacity to support our regional neighbours, our Pacific family, particularly in infrastructure development.

And the natural progression of that, from this investment to now, is the announcement of the Australia Infrastructure Financing Facility for the Pacific, which we announced also at the end of last year.

As I said in my remarks, being in Honiara to actually be at the sod turn for the landing site of the cable was really a tangible reminder of what a difference that this will make for communities across our region, whether it's in Papua New Guinea or in the Solomon Islands.

So, Australia has the capacity to assist; we've been working extremely closely with these countries over many, many years. I personally visited the Solomon Islands a number of times during the RAMSI period – a different form of support and engagement - but I think this is a reflection of the maturity of the relationship, and also a contribution, a really important infrastructure contribution that we can make in the region.

The most excited of all of the people I think that I met were young Solomon Islanders who are so much looking forward to being able to work and to study in a different way that we completely take for granted. It's also timely in terms of this discussion to contemplate how, for example, the Solomon Islands Electoral Commission will run their election at the beginning of April. They will have something like 1200 polling places across the islands of the Solomon Islands nation. We will send some observers to that, but we can't even scratch the surface really in the process of observing an election like that with an IT capacity that will be changed completely by this cable. Their election after this will be a totally different ballgame.

So I think they are tangible manifestations of how Australia can engage and support. We have the Australian Electoral Commission there now working with the Solomon Islands Electoral Commission in the delivery of this upcoming ballot. But by the time we get to the one beyond this, it will be a completely different world and that is real change, real advancement and real development.

Michael Fullilove:

Alright. Thank you Minister. So let me- there's a number of hands that are up. I'll go first, I saw Jamie Tarabay from The New York Times, in the second row and I saw the lady in front of her.

Question:

Good morning, thank you- well, good afternoon, sorry. I'm a little jetlagged. I have-

Minister Payne:

It's a permanent state.

Question:

Sorry, sorry?

Minister Payne:

Permanent state.

Question:

I apologise. I have two questions and separately I have a million questions about Syria but we can talk about that another time.

Two questions - so regarding 5G and Huawei, Australia's made this decision which is [indistinct], how do you then marry your national security interests when you are dealing with countries that have these agreements like PNG, to allow Huawei to set up their 5G network. How do you enforce security barriers to maintain the integrity of the Australian communications network?

And my second question, oh my God, it's coming to me. Yeah, on attribution, the attribution was unique in and of itself, with the thought process in coming out and sort of naming a sophisticated state actor and then following on from Michael's question about what you do then, will you name, what will the consequences of that be and are you considering- what kind of responses are you considering? It'd be really nice to sort of get a sense of your thought process there.

Thank you.

Minister Payne:

I don't think I'm going to spit ball that with you. That's a decision for a sovereign government and we'll make that in due course. But in relation to how we interact with our counterparts, neighbours, allies, whatever category they fall into is as we usually do, we manage differences in approach, differences in technologies, differences in platforms all the time across our closest allies and partners, and more broadly, on a daily basis. So we have effective working relationships built over many, many years by posts in country, by Defence, Foreign Affairs and Trade and Home Affairs officials who work carefully between our counterparts. That is business as usual for us.

Ambassador Feakin:

The Minister spoke of these 40 different projects that we're running around the region, a core focus of that is around cyber security awareness, threat awareness. So all these decisions are being made on a sovereign basis. But what we can do is we can assist countries in understanding risks and potential responses for them on a daily basis, underpinning their digital economy futures, understanding the risks that might be posed, assisting them in up-skilling their ability to respond to cyber-criminal activity within their borders as well.

Minister Payne

One of the things I referred to in my remarks was the decision of the Pacific Island Forum to specifically refer to cyber security in the Boe Declaration, security declaration of that meeting. That is a step change in terms of issues under consideration and that I think marries well with the work that Toby does, which goes from cyber boot camps to the most sophisticated technical engagements around the region and more broadly.

Question:

Thank you. My name is Annie Edwards from the Institute for Global Peace and Sustainable Governance. My question is directed to the Minister. What are the connections or implications, if there are any, in the Chinese foreign investment policy and the Australian Foreign Influence Transparency Scheme? I believe there are about nine signatories to this scheme at the moment.

Minister Payne:

Well, again, we took a decision in 2017-18 to make sure that in terms of foreign influence - separate from foreign investment - in terms of foreign influence, we are protecting Australia's national interests. We legislated for that through the parliamentary process and I think that was a message from the Government that for anyone who seeks to interfere in and to intervene in the democratic processes in Australia, that that is not something any elected government in this country is prepared to support, no matter where they come from. And we have certainly seen, as I said in my remarks, a number of examples in recent times internationally, of efforts by state actors and non-state actors to interfere in other countries. We are protecting ourselves and that is what the citizens of Australia expect us to do. It is the first obligation of government to protect our citizens and to protect our country. In terms of foreign investment more broadly, we enthusiastically welcome foreign investment in Australia and have very strong relationships across the international panoply of businesses and countries who have engaged with us over a very long period of time. That continues to be the case. Some of those because of the nature of those investments are assessed, for example, by the Foreign Investment Review Board. You would always expect that to be the case because, again, the role of the Government is to consider our national interests.

Michael Fullilove:

Alright, I'll take a question from this gentleman here and then that lady over there has been trying to get my attention. So, in the second row, please. If you could just state your name and any affiliation [indistinct] question.

Question:

Of course. No worries. Good morning, everyone. I'm Daniel from the Fiji consulate here in Sydney. Thank you, Dr Fullilove, and the Lowy Institute team, for hosting another great event, and for the Minister and Ambassador for their respective remarks. Regrettably, my question is not about the Pacific but rather the role of technology in cyber companies like Google and Facebook in this space. Google, for instance, just announced that they won't be allowing any kind of political ads on their platform in Canada because they simply cannot comply with the now stringent verification process enshrined in Canadian law. So, I'd be curious to hear your thoughts about what the role of these companies will be, particularly given that we have both state and federal elections coming up here in Australia.

Ambassador Feakin:

Happy to take that one, Minister, if you like.

Minister Payne:

I was going to say: I'm sure they'll be only good.

Ambassador Feakin:

We have a really productive relationship with those companies. I mean, it has to be a two-way dialogue continually and has been through election task forces that have been set up through the Government and will continue to be through the electoral cycle. I think we do appreciate- and actually, interestingly, I was just with one of my counterparts in San Francisco who's the Danish tech ambassador, and he's actually based in Silicon Valley to ensure that there is diplomatic representation with the big providers – be they Google, Facebook or whatever that might be – because that conversation does need maturing at the top level and I think wherever you sit, be it in the private sector or in government, there's an acknowledgement of that. But in relation to the conversations that take place: that's a continual, continual cycle.

Michael Fullilove:

Can I ask you, Minister, just a question following on from that: you mentioned the attack on our Parliament and on our political parties; should Australians feel nervous? As the questioner asks: we have a federal election coming up, probably in May; we have state elections in New South Wales and other elections coming up, and of course we've watched with dismay, really, the evidence that emerged of Russia seeking to interfere in the presidential election and in other elections. How confident can Australians feel that our institutions are properly protected from outside interference from other countries?

Minister Payne:

And again, back to the first role of government being to protect Australia's national interests and to protect Australian people and entities from that sort of effort externally. But it's fair to say, and I don't think I would be exaggerating and Toby will correct me if I am; but it requires constant vigilance. It's a full-time job, not just here but globally. So whether those who seek to exploit vulnerabilities in systems are doing it for profit, doing it for disruption, doing it malevolently for other reasons; it is a case of constant vigilance. So our agencies, our intelligence agencies, our technical specialists, companies which have a very important role to play from the corporate side of this, are a key part of making sure that we are taking every step to protect our systems; to protect our processes. We have been fortunate in Australia to date, but that does not mean that we rest on our laurels. So, in in relation to upcoming elections, whether they are being run by state electoral commissions or the Australian Electoral Commission, this is a core part – core part – of everyday business; ensuring those processes are protected from external influence and interference.

And it is, of course, also something that we discuss across the region. There are a lot of elections in the region in the coming year. In fact, I think I've counted- we're almost up to a dozen across the region. So it is a matter of great focus for us. We have expertise in Australia which we can share more broadly, but our first focus is on protecting ourselves.

Michael Fullilove:

Toby, on that subject: what role does deterrence have to play in stopping these adversaries getting their hands dirty in our internal affairs? For example, we know now that during the presidential campaign, of course the Americans became aware of some of the actions of Russia. We know through extensive reporting that President Obama shirt-fronted President Putin – to use a phrase – and told him to stop it; but obviously he didn't stop it. And there have been a lot of criticisms of the weakness of the Obama administration's approach – a lot of analysts saying, for example, that Western countries should have used its information to really impose a cost on President Putin, perhaps a personal cost. And you've seen, there's lots of reporting to the effect that they might have disclosed the fact and the source of various ill-gotten gains that he allegedly holds himself, for example. So, how much- what role does deterrence have? I mean, you can stop- you can put up all the walls, but at a certain point don't you have to say to the people who are interfering with you: if you continue to do this there is going to be a cost that you pay?

Ambassador Feakin:

Yes. And that is an incredibly loud discussion in the international environment right now, and you mentioned, both the Minister and yourself, Michael, mentioned some of the attributions that have taken place, and I think what's notable about them are the number of countries that are now contributing jointly. It's fair to say, I think, if you look back at the history of the US/China discussion if you go back to 2014/15 when the discussions between Xi and Obama took place in California. You know, there was an understanding that there was so much bilaterally they could do, but to actually really reshape behaviour in cyberspace it had to be done jointly. So, one thing that we've done very actively is try to create more of a community of countries who are willing to come along on the journey, and that's not without its complexities of sharing intelligence and information and, you know, making sure that you're all aligned and timed at the right moment. But that, of course, is one step in a process. And there is a very loud discussion, again in the international environment, about what- are there other costs that you can impose on countries to try and squeeze their operating space?

The Americans, obviously, are very forward-leaning in this regard and for many years have looked to actually pinpoint individuals within specific organisations, be they Ministry of State Security; be they the GRU in Russia. And, if you like, reshape that misnomer that attribution is impossible because that still seems to exist in many conversations, and say: well look, you can choose to do these things, but actually, we can pinpoint who you are and we can understand who you are and impose a cost on you as an individual; as you as an organisation; and then you as a nation. It's a process at the moment, though. So, if you like, it's a work in progress and we're working as hard as we can to change what's going on because these UN bodies that are about to meet this year: they have a really focused, important role in stating what – if you like – the rules are around that grey space. Anything below the level of armed conflict; that's where the grey space exists, that's what's being exploited mercilessly by a whole range of countries. But let's be frank, if you go back to the 2013 UNGGE and talk about international law in the entirety of the UN charter, applying in cyberspace, that would include elections.

So, we've already agreed to that, yet that is something that's already being- we've seen in the past has been pushed on. So, it's a good question and it's something that is probably one of the most live topics that we're dealing with through this position and across Government.

Minister Payne:

And one of the reasons for that, if I may say, is because each case is absolutely unique. So even in the amount of time that I've been in this role, I've not seen a case which you can say: like equals like. They're completely different – manifest in different ways, they're discovered in different ways, they're prosecuted in different ways and I think that really gives you some idea, or hopefully gives you some idea, of the complexity of the examination that government has to go through before it makes a decision for this.

Michael Fullilove:

Alright. And I'll give the last question, as I said, to the lady there.

Question:

My name is Sarah Pavillard, I'm the CEO of a consultancy called ADROITA. My question is really for the Minister. Given the policy is essentially to maintain a secure, open and free internet, and we've also discussed today that heating up of the threat environment, is there sufficient investment in offensive and defensive cyber capabilities forecast in an integrated investment plan that is being run by Defence? And is that IIP sufficiently agile to meet the potential threat to cyberspace in terms of that open, free and secure environment?

Minister Payne:

If I can just indulgently say I love the fact that you've asked a question about the IIP - the Integrated Investment Program - that underpinned the 2016 Defence white paper to which I'm personally very attached.

[Laughter]

And therefore, it's a very good question. And I think if the person sitting here instead of me was Major General Marcus Thompson, then for example, he would enthusiastically advocate his cause for the work that he and his unit within the ADF are doing, working closely with the Australian Signals Directorate, which of course has been stood up separately as a statutory agency in its own right, with increased independence and staffing to exactly address the sorts of challenges that we are facing going forward. Would all of the components that fit within that space - offensive and defensive cyber - would they all say they want more resources and they want more people? I think the answer is: yes. But we work constantly to review the challenges, to review the shifts and changes in the international environment, to make sure that we are responsive and that we are supporting the professionals in the way that we need to and providing the resourcing that we need to.

Just after ASD stood up separately on 1 July last year, I went to Russell to an all-staff event. That doesn't happen very often in the Australian Signals Directorate. To say that there is a level of commitment and enthusiasm for the task that they do would be an understatement. I wouldn't be selling them strongly enough. They are hugely professional, they are changing and they're working hard to make sure that that change makes them as responsive and capable as they can be. So I'm confident that we review, regularly, that we support the advice and the feedback provided to us by their leaders, people like Mike Burgess, who you will see here very shortly, people like Major Marcus Thompson, people like Alastair MacGibbon at the ACSC. All of those entities, backed in the international context by our own Cyber Ambassador, are part of how we're addressing this challenge and I think that we have a very significant focus.

Michael Fullilove:

Ladies and gentlemen, we're out of time. I apologise that I didn't get to everybody. There was a lot of interest today and- but as Marise says, bide your time. We have other cyber speakers coming. Before I thank my speakers, Let me just mention two forthcoming events. First of all, later this week my colleague Alex Oliver will host a very interesting discussion between Gareth Evans, one of Marise's predecessors as Foreign Minister, and Michael Kirby, the former justice of the High Court, on Australia's role in nuclear proliferation and disarmament. And then, as we've discussed, on 27 March we'll be hosting the head - the DG - of ASD Mike Burgess. There is an enormous amount of interest in that event. So if you are interested in coming to that please register immediately.

Ladies and gentlemen, I'd like to thank Ambassador Toby Feakin and Senator Marise Payne for coming along, for making themselves available on a very interesting topic. It's not an easy one to address publicly. I appreciate the transparency that they've shown in answering my questions and your questions. It's a very interesting topic indeed, and I'd like to thank both of them, and let me thank, in particular, the Minister. She's been here as Minister now a number of times. We always appreciate her presence. One of our questioners complained about jet lag, but of course, no one can beat the Australian Foreign Minister of the day in terms of jet lag. So thank you for coming and for being as articulate as ever, despite any jet lag you might have. So ladies and gentlemen, please join me in thanking them.

Media enquiries

  • Minister's office: (02) 6277 7500
  • DFAT Media Liaison: (02) 6261 1555