2.1
The Department of Defence (Defence) seeks approval from the Committee to proceed with the proposed relocation of the Australian Cyber Security Centre (ACSC) from the Ben Chifley Building to Brindabella Business Park, both in Canberra.
2.2
The estimated cost of the project is $38.8 million (excluding GST).
2.3
The project was referred to the Committee on 1 December 2016.
Conduct of the inquiry
2.4
Following referral, the inquiry was publicised on the Committee’s website and via media release.
2.5
The Committee received one submission and one confidential submission from Defence. A list of submissions can be found at Appendix A.
2.6
On 10 February 2017, the Committee conducted a public and in camera hearing. A transcript of the public hearing is available on the Committee’s website.
Need for the works
2.7
The ACSC is an initiative by the Australian Government intended to ‘ensure that Australian networks are amongst the hardest in the world to compromise’. It functions as a ‘hub for greater collaboration and information sharing with the private sector, state and territory governments, academia and international partners to combat the full range of cyber threats’.
2.8
Defence elaborated on the agencies involved in the ACSC:
The ACSC brings together the elements of a number of existing cyber security capabilities from Defence, the Australian Security Intelligence Organisation, the Australian Federal Police, the Computer Emergency Response Team and the Australian Criminal Intelligence Commission. These organisations are being brought together in order to enable a more complete understanding of sophisticated cyber threats, as have been described in the Australian Cyber Security Centre 2016 Threat Report, to facilitate faster and more effective responses to significant cyber incidents and to foster better interaction.
2.9
Within Defence, the Australian Signals Directorate (ASD) is the ‘major contributor of personnel’, and is considered lead agency for the ACSC.
2.10
The ACSC was established in November 2014. According to Defence:
It currently houses around 260 personnel from five Australian Government agencies, as well as a number of integrated and embedded personnel from other partner organisations. While most of the current space is operating at close to full occupancy, some areas are underutilised due to the difficulties associated with obtaining the appropriate clearances. This has resulted in some inefficiencies arising from areas unable to be fully collocated due to the nature of the fit-out and the allocation of workspaces.
2.11
The ACSC is currently located in the Ben Chifley Building, but in order to support an expansion in its operations, Defence proposes to relocate the ACSC to two buildings located in the Brindabella Business Park - BP14 and BP16.
2.12
Defence put forward three key justifications for the need to relocate the ACSC:
Expansion of the ACSC. BP14-16 will support up to 650 workstation locations allowing for expansion of the ACSC;
Multiple security levels. The proposed fit-out will support multiple physical security zones which is not possible in the Ben Chifley Building; and
Partnerships. The proposed fit-out will provide accommodation for industry, academia and innovation initiatives which is not possible in the Ben Chifley Building.
2.13
At the public hearing, Defence provided the Committee with more detail on the need to provide for the future expansion of the ACSC:
When the decision was taken to establish the ACSC and to locate it in the then newly completed Ben Chifley Building, the ACSC at that stage was based on approximately 300 people, and the space made available for the ACSC in the Ben Chifley Building at that time was based on 300 people. Since that time, with the release of the Cyber Security Strategy and also other growth initiatives within the Defence White Paper 2016, the ACSC will grow to approximately 700 personnel over the next few years. That growth requirement is the key driver for why a larger premises is required.
2.14
In terms of who would occupy the proposed new facility, Defence told the Committee that there are 260 personnel currently posted to the ACSC. Furthermore, Defence stated:
There is also at the moment approximately 100 personnel located in other facilities. So there are people coming in from other agencies. The anticipated growth based on the Cyber Security and Defence White Paper, which is where the figure comes from, is 200 personnel. We have rounded these figures up. Industry academia internships or graduate programs account for 100. So the existing 300 personnel, the 100 who are already existing but located elsewhere, plus the 200 for the anticipated growth plus the 100 for industry and academia gives us a total of 700 personnel.
2.15
Defence also noted the need for multiple security levels to the requirement for fostering partnerships, stating that government had identified a ‘need for a national partnership involving government – the ACSC in particular – business and the research community working together. However, it noted that the ‘need for private industry partners to obtain security clearances’ and the ‘overheads associated with organising visitor entry for short term visits’ make the achievement of this collaboration difficult.
2.16
According to Defence:
This would be less of an issue if the work performed by ASD in the ACSC were all, or even mostly, of a classified nature. But increasingly, many of the activities undertaken by ASD to support the evolving cyber security mission do not involve highly classified information, or sensitive tools and techniques, and the fact that they are currently performed in a high security environment is more of a legacy than a current business requirement… Moving a substantial part of ASD’s cyber security mission to a lover security domain will improve the efficiency of many activities and make it easier to share more widely with other government stakeholders, industry and the research and academic community.
2.17
Defence argued that relocation of the ACSC will allow for the staff of these agencies to collaborate more effectively:
The centre is also a hub for greater collaboration and information sharing with the private sector, state and territory governments, academia and international partners to combat the full range of cyber threats.
2.18
An additional justification for the relocation of the ACSC put forward by Defence was related to ASD recruitment needs:
By re-engineering ASD’s business processes to operate in a multi-classification environment, ASD will be able to recruit staff more easily. Cyber security skills are in short supply and high demand, and the need for ACSC staff to obtain a high level security clearance (which can often take two years or more) means that very few people with the requisite skills will be prepared to wait for a role with ASD – particularly when private industry is able to offer very attractive remuneration. This is important not just to meet future growth targets, but to replenish the relatively high level of turnover as experienced cyber security staff are tempted to join the private sector.
2.19
The Committee is satisfied that the need for the works exists.
Scope of the works
2.20
Defence’s submission outlined the project objectives, which are to:
Provide office accommodation and ancillary facilities to accommodate up to 700 personnel (to support the currently identified work force of 650 personnel plus a seven per cent growth factor);
Provide appropriate security zoning to accommodate staff working at various security clearances; and
Provide an environment to support partnerships with industry, academia and innovation initiatives.
2.21
In order to achieve these objectives, Defence proposed to relocate the ACSC from the Ben Chifley Building to BP14-16, on Brindabella Circuit in the Brindabella Business Park, near the Canberra Airport.
2.22
Defence outlined the scope of works required to make BP14-16 fit for purpose:
Base building works. Design and construction of base building works to address:
Physical and operational security requirements;
Structural loading reinforcement of the base building to support required loads, including additional mechanical, electrical and communications plant; and
Specialist services reticulation and redundancies.
Base building integration of services. Design and construction of services to be integrated with the base building works including electrical, mechanical, communications, security, fire and hydraulic services.
Office fit-out. Design and fit-out including:
Functional workspaces comprising workstations which are generally open plan with functional areas appropriately located, segregated and controlled to support operational requirements;
Conference, meeting and briefing facilities;
Laboratories and workshops;
Breakout and collaborative meeting spaces;
Communications/server room;
Conference and training facilities;
Dedicated first aid and carers room;
Security. Design and installation of security controls including security alarm systems, electronic access control and security camera system.
2.23
A key component of the proposed works is the provision of facilities which provide for multiple security classification zones. As such, the proposed scope of works includes provision for security classification zones that fully comply ‘with physical and information and communications technology requirements for that zone’.
2.24
Subject to Parliamentary approval of the project, construction is expected to commence in March 2017 and be completed by December 2017. Defence anticipates that initial operating capability will be achieved in June 2017.
2.25
On the basis of the evidence presented by Defence, the Committee finds that the proposed scope of works is suitable for the works to meet its purpose.
Cost of the works
2.26
The estimated cost of the project is $38.8 million (excluding GST). It includes the cost of construction, relocation, contingencies, cost escalation and associated professional fees.
2.27
The Committee received a confidential supplementary submission detailing the project costs and held an in-camera hearing with Defence on the project costs.
2.28
The Committee is satisfied that the costings for the project provided to it have been adequately assessed by the proponent entity.
Committee comment
2.29
The Committee did not identify any issues of concern with the proposal and is satisfied that the project has merit in terms of need, scope and cost.
2.30
Having regard to its role and responsibilities contained in the Public Works Committee Act 1969, the Committee is of the view that this project signifies value for money for the Commonwealth and constitutes a project which is fit for purpose, having regard to the established need.
2.31
The Committee recommends that the House of Representatives resolve, pursuant to Section 18(7) of the Public Works Committee Act 1969, that it is expedient to carry out the following proposed work: relocation and fit-out of the Australian Cyber Security Centre.
2.32
Proponent entities must notify the Committee of any changes to the project scope, time, cost, function or design. The Committee also requires that a post-implementation report be provided within three months of a project completion. A report template can be found on the Committee’s website.