Peter Dutton has confirmed the government’s $1.6bn cyberstrategy will include capability for the Australian Signals Directorate to help law enforcement agencies identify and disrupt serious criminal activity – including in Australia.
By rendering support to the Australian federal police and the Australian Criminal Intelligence Commission, the cybersecurity and intelligence agency would for the first time be able to target Australians, although Dutton maintains ASD won’t be able to do so directly.
Dutton said law enforcement agencies would target terrorists, paedophiles and drug traffickers operating in the dark web – promising proposed new powers will apply “to those people and those people only”.
Details of the new powers – which will require legislation – are not contained in the strategy, which says only that the government will “ensure law enforcement agencies have appropriate legislative powers and technical capabilities to deter, disrupt and defeat the criminal exploitation of anonymising technology and the dark web”.
ASD powers have been a source of controversy for the government, after the AFP raided News Corp journalist Annika Smethurst’s home in June 2019 over a news report suggesting the home affairs department was seeking power for ASD to spy on Australians. Dutton had claimed the story was nonsense despite publicly confirming its substance.
On Thursday, Dutton told reporters in Canberra ASD has “a very unique set of powers” and is “the very best in the business” in operations such as stopping terrorist attacks.
More recently ASD had disrupted scam attacks seeking passwords and other information targeting Australians financially during the Covid-19 pandemic, he said.
“We could have developed that capacity in the Australian federal police. The decision we took was that would be a duplication of that effort.
“It would take years to ramp up, and the threat from these cyber actors is here and now.
“What we’re proposing here is that the Australian federal police, with the ACIC, with a warrant from the court, knowing that somebody operating a server, whether it’s in Seattle or Sydney, if they’re targeting Australian citizens … [the agencies] would be able to target that paedophile network, regardless of where they are in the world.”
Dutton said target servers and syndicates were mostly offshore but it was “appropriate” for ASD to help protect Australians. Law enforcement agencies would be able to “tap into” ASD’s capabilities but “the power only applies to … the Australian federal police and ACIC, not the ASD,” he said.
The Australian has reported the ASD will be prevented from collecting information but will be able to provide technical capability advice to assist police execute computer access warrants to identify suspects and disrupt criminal activity.
Dutton will also reportedly gain powers to direct the ASD to protect infrastructure from cyber attacks. The home affairs minister did not confirm or deny these aspects of the legislative package when asked on Thursday.
Dutton said the new capabilities would be exercised only in relation to people “alleged to be committing very serious offences”.
“If you’re a paedophile you should be worried about these powers, if you’re a terrorist … if you’re committing serious offence in relation to trafficking of drugs, of ice, for example, that’s being pedalled to children, you should be worried about these powers as well.
“The reality is people are trying their best to groom kids online and … people are trading gun parts on the dark web and it cannot be a lawless space. This law applies to those people and those people only.”
The prime minister, Scott Morrison, confirmed that the $1.6bn for the cyber strategy was mostly made up of the $1.3bn announced but not all allocated in June.
The package includes $470m to expand Australia’s cybersecurity workforce with 500 new jobs created within the ASD, and $125m to double the AFP’s cyber enforcement capacity by 100 officers and expand the remit of the ACIC.
On Thursday the shadow home affairs minister, Kristina Keneally, and shadow assistant cybersecurity minister, Tim Watts, said Labor would “consider the detail of the government’s strategy, including any legislative proposals” but chose to attack the Coalition’s track record rather than the policy.
“The Morrison government needs to get their own house in order, too – 70% of commonwealth agencies have failed to implement basic cybersecurity measures according to the auditor-general,” they said.
