3.1
The conduct of political warfare is arguably a field in which western powers have lagged other major powers since the conclusion of the Cold War. Dr Ross Babbage, in his 2019 report: Winning Without Fighting writes:
Political warfare operations have been central to the Chinese and Russian regimes’ international operations and strategic advances for the last two decades. Indeed, they have long featured prominently in Chinese and Russian strategic culture and practice. Both regimes are well-equipped, very experienced, and highly skilled in the conduct of these political warfare campaigns. The West, by contrast, largely abandoned high-level political warfare operations at the end of the Cold War. It has put the United States, its close allies, and its international partners at a disadvantage that needs to be remedied.
3.2
Cyber-warfare (and other ‘grey-zone’ operations) are central to the conduct of political and information warfare. As such, cyber warfare was established as a warfighting ‘domain’ within Defence in 2019.
3.3
Much of the detail surrounding Australia’s defensive and offensive cyber capabilities are classified above the level of that which may be permitted in this report. This report therefore focusses on two major aspects which underpin, and are critical to, Australia’s cyber capabilities:
Cyber training
The challenge
3.4
The Defence Science and Technology Group (DSTG) defines the ‘information warfare’ problem as a whole-of-nation issue which has seen a fundamental change in the way nations, states and non-state actors interact. These interactions are now played out in a three-tier system:
In the industrial age we had a two-tier system comprising people and industrial machines, where the people directly controlled those industrial machines. We’re now in an information age, which is very different to that. It’s a three-tier system. So we still have the people and we still have the industrial machines but we now have the information environments as the interface between the two. The way it works now is pretty much that people issue commands to the information environments, and the information environments actually control the industrial machines.
3.5
The three-tier system is critical because those information environments control physical systems such as water and energy supply, communications and transportation. They also control information systems such as banking and commerce and health records. Being so pervasive, these information environments can, by extension, begin to control the way people think.
3.6
DSTG submitted that a problem of such breadth needs to be addressed holistically, and not as a specific problem. Information warfare should not be considered as three separate issues associated with physical systems, information systems and human systems. Rather, it should be thought of as one problem—information warfare—which combines electronic warfare in the physical space, cyber warfare in the information space and influence operations in the human space.
3.7
The major threat, therefore, is the potential infiltration of those information environments, and the potential seizure by foreign actors of our industrial machines and information systems:
Indeed, they can seize control of the information environment and they can influence people because we are now completely reliant as people on those information environments as well for our news services, our social media; indeed, effectively, what we believe.
3.8
Cyber warfare is a ‘very real threat’ to Australia and that it forms part of broader ‘information warfare’ efforts within Defence’s remit. Cyber warfare is, however:
…not in isolation. It’s the strength of all five domains working together, both kinetic and non-kinetic, as well as our alliance and partnerships that make us capable of being prepared for what may come in the future.
3.9
The Parliamentary Standing Committee on Public Works has approved Defence to develop the Defence Cyber College, which began construction in February 2021 at HMAS Harman. The facility is planned to commence training courses in February 2023. The Cyber College will be a joint venture between Defence and the Australian Signals Directorate which will conduct courses that cover the spectrum of cyber operations.
Cyber workforce
3.10
Defence has a small but highly capable cyber workforce which it needs to expand in the future. Defence submitted that Australians want to join the ADF and work in the cyber environment, as it is an exciting field due to the nature of the operations conducted. Defence describes its cyber workforce as being highly engaged and patriotic:
It is a niche skill. They’re serving Australia, serving their nation above the self, they have this great military culture and family and they have access to authorities to do things in a military context that you wouldn’t be able to do if you were working for a civilian security operation centre.
3.11
Defence submitted that its approach to developing cyber capabilities is ‘absolutely nested hand-in-hand with other government agencies, departments, the intelligence community, industry and academia. Importantly, cyber warfare is not only about technology and capability platforms—more so it relies on recruiting, training and retaining the right people to conduct, for example, psychological operations. The cyber workforce must also be capable of ‘plug and play’ operations with allies and partners.
Recruitment and retention
3.12
Defence accepts that it cannot compete with private industry from a remuneration perspective. Cyber recruits are however, attracted to the important nature and specialised opportunities that cyber operations within Defence offers:
We can’t compete monetarily but what we do compete with is with the purpose and the value of what they’re doing.
3.13
Defence plans to grow the cyber workforce by approximately 230 people in the near term. Defence also sponsors the ADF Cyber Gap Program. As a result of the inaugural Cyber Gap program, 10 of the 46 students that participated are now employed in the cyber environment—either within Defence or other government organisations. The current program (as at June 2021) had over 1000 applicants and eventually saw 271 students selected, ranging from young people through to mature-aged students.
3.14
The Cyber Gap program is a scholarship, sponsorship and work experience program aimed at encouraging people to take up a career in cyber, either within the ADF or the public service. Participants are encouraged to pursue qualifications ranging from a certificate III up to a master’s degree in a particular cyber skill-set. The Committee heard that target recruits are not necessarily typical of traditional Army, Navy or Air Force recruits. Rather the program looks for the particular qualities, skills and attributes in those people, regardless of age or other demographics:
It can be a 15-year-old kid in their bedroom who’s deciding whether they continue at school or the Army’s for them, or it can be someone who is reskilling in their mid-40s.
3.15
Defence’s intent is to employ cyber operatives as ‘Specialist Service Officers’ which allows for an expansion of some of the physical, psychological and aptitude parameters that are typically applied to Defence recruitment. This allows for the broadest possible recruitment pool into what is a highly specialised area of training and operations.
3.16
Retention of the cyber workforce is a challenge. Flexibility to return to Defence or operate in a reserve capacity are means by which the cyber workforce can stay engaged with Defence:
Retention is always going to be a challenge; it’s a challenge for all of us across our different aspects. We care for our people, our veterans, we look after them and we give them valued work. If they do go, we leave the door open for them to come back, or they do Reserve service, so we’re still contributing to national security through that mechanism.
Committee Comment
3.17
The Committee acknowledges the efforts by the Department of Defence and other Australian Government agencies in the development of Australia’s defensive and offensive cyber capabilities. The Committee notes that the biggest challenge faced by Defence and other Government agencies in growing cyber warfare capabilities is in attracting, training and retaining the right workforce.
3.18
Cyber capabilities, as with advanced ISR capabilities as addressed in Chapter 2, should be an area that plays to Australia’s relative strength as a medium power with an advanced economy and world-class STEM and information and communications technology base—in both education and industry sectors. The Government should seek to increasingly leverage cyber, and other high-end ‘niche’ capabilities, to maximise its asymmetric strategic advantage in our region and across the globe.