Spare the costs, spoil the bad state actor: Deterrence in cyberspace requires consequences
Foreword
In the past three years, barely a week has gone by without a report of a critical cyberattack on a business or government institution. We are constantly bombarded by revelations of new ransomware strains, new botnets executing denial of service attacks, and the rapidly expanding use of social media as a disinformation and propaganda platform.
Perhaps most alarmingly, a great many of these attacks have their origin in the governments of nation states.
In the past decade we have moved well beyond business as usual signals intelligence operations. Some of the largest malware outbreaks in recent years, such as NotPetya and WannaCry, had their origins in state-run skunkworks.
Cyberattacks initiated by nation states have become the new normal, and countries including Australia have struggled with the challenge of how to respond to them. Far too often they’re considered a low priority and met with a shrug of the shoulders and a “What can you do?”
In this paper, Chris Painter offers us a way forward. Chris presents a reasonable framework for deterrence, a way that we as a nation can help limit the deployment of cyberwarfare tools.
His recommendations are designed to properly punish bad actors in a way that discourages future bad behaviour. They’re modelled on actions that have worked in the past, and serve, if not as a final solution, at least as a starting point for us to scale back on the increasing number of state-sponsored cyber attacks.
Most importantly, these actions aren’t just to the benefit of the state—they will allow us to better protect private citizens and companies that all too often get caught in the cyberwarfare crossfire. To put it simply, if we can ensure there are costs and consequences for those who wrongly use these tools to wreak damage, bad actors might start thinking twice before engaging in this destructive behaviour.
Yohan Ramasundara President, Australian Computer Society
What’s the problem?
Over the past few years, there’s been a substantial increase in state attacks on, and intrusions into, critical information systems around the globe—some causing widespread financial and other damage.1 They have included:
attacks by North Korea on Sony Pictures in 2014
widespread Chinese theft of trade secrets and intellectual property
Russian state-sponsored interference in the US elections
North Korea’s sponsorship of the WannaCry ransomware worm that caused, among other things, a meltdown of the UK’s National Health System
the Russian-sponsored NotPetya worm that caused tens of millions of dollars of damage and disruption around the world.
The pace and severity of these attacks show no sign of declining. Indeed, because there have usually been little or no consequences or costs imposed on the states that have taken these actions, they and others have little reason not to engage in such acts in the future.
The US, Australia and many other countries have spent years advancing a framework for global stability in cyberspace. This framework comprises:
the application of international law to cyberspace
acceptance of certain voluntary norms of state behaviour in cyberspace (essentially, voluntary rules of the road)
the adoption of confidence and transparency building measures.
Although much progress has been achieved in advancing this framework, the tenets of international law and norms of state behaviour mean little if there are no consequences for those states that violate them. This is as true in the cyber world as in the physical one. Inaction creates its own norm, or at least an expectation on the part of bad state actors that their activity is acceptable because there are no costs for their actions and no likely costs for future bad acts.
Individually as countries and as a global community, we haven’t done a very effective job of punishing and thereby deterring bad state actors in cyberspace. Part of an effective deterrence strategy is a timely and a credible response that has the effect of changing the behaviour of an adversary who commits unacceptable actions.
Although there are some recent signs of change, in the vast majority of cases the response to malicious state actions has been neither timely nor particularly effective. This serves only to embolden bad actors, not deter them. We must do better if we’re to achieve a more stable and safe cyber environment.
What’s the solution?
It is a well-worn and almost axiomatic expression that deterrence is hard in cyberspace. Some even assert that deterrence in this realm is impossible.
Although I don’t agree with that fatalistic outlook, it’s true that deterrence in cyberspace is a complex issue. Among other things, an effective deterrence framework involves strengthening defences (deterrence by denial); building and expanding the consensus for expectations of appropriate state behaviour in cyberspace (norms and the application of international law); crafting and communicating—to potential adversaries, like-minded partners and the public—a strong declaratory policy; timely consequences, or the credible threat thereof, for transgressors; and building partnerships to enable flexible collective action against those transgressors.
Although I’ll touch on a couple of those issues, I’ll focus here on imposing timely and credible consequences.
The challenge of attribution
One of the most widely cited reasons for the lack of action is the actual and perceived difficulty in attributing malicious cyber activity.
Unlike in the physical world, there are no launch plumes to give warning or the location of the origin of a cyberattack, and sophisticated nation-states are adept at hiding their digital trail by using proxies and routing their attacks through often innocent third parties. But, as recent events illustrate, attribution, though a challenge, is not impossible. Moreover, attribution involves more than following the digital footprints; other forms of intelligence, motive and other factors all contribute to attribution. And, ultimately, attribution of state conduct is a political decision. There’s no accepted standard for when a state may attribute a cyberattack, although, as a practical, political and prudential matter, they’re unlikely to do so unless they have a relatively high degree of confidence. Importantly, this is also true of physical world attacks. Certainly, a state doesn’t require 100% certainty before attribution can be made or action taken (as some states have suggested). Whether in the physical or the cyber world, such a standard would practically result in attribution never being made and response actions never being taken.
Although attribution is often achievable, even if difficult, it still seems to take far too long—at least for public announcements of state attribution. Announcing blame, even if coupled with some responsive actions, six months to a year after the event isn’t particularly timely. Often by that point the impact of the original event has faded from public consciousness and so, too, has the will to impose consequences.
Part of this delay is likely to be due to technical difficulties in gathering and assembling the requisite evidence and the natural desire to be on solid ground; part is likely to be due to balancing public attribution against the possible compromise of sources and methods used to observe or detect future malicious activity; but part of it’s probably due to the need to summon the political will to announce blame and take action—particularly when more than one country is joining in the attribution. All of these cycles need to be shortened.
Naming and shaming
Public attribution of state conduct is one tool of deterrence and also helps legitimise concurrent or later responses.
The US, the UK, Australia and other countries came together recently to attribute the damaging NotPetya worm to Russia and, a few months ago, publicly attributed the WannaCry ransomware to North Korea. This recent trend to attribute unacceptable state conduct is a welcome development and should be applauded.2 It helps cut through the myth that attribution is impossible and that bad state actors can hide behind the internet’s seeming anonymity.
However, public attribution has its limits. Naming and shaming has little effect on states that don’t care if they’re publicly outed and has the opposite effect if the actor thinks their power is enhanced by having actions attributed to them. In the above two cases, it’s doubtful that naming and shaming alone will change either North Korea’s or Russia’s conduct. Public attribution in these cases, however, still serves as a valuable first step to taking further action. Indeed, in both cases, further actions were promised when public attribution was made.
That raises a couple of issues. First, those actions need to happen and they need to be effective. President Obama stated after the public attribution to North Korea in relation to the Sony Pictures attack that some of the response actions ‘would be seen and others unseen’. A fair point, but at least some need to be seen to reinforce a deterrent message with the adversary, other potential adversaries and the public at large.
The other issue is timing. The public attribution of both WannaCry and NotPetya came six months after the respective attacks. That delay may well have been necessary either for technical reasons or because of the work required to build a coalition of countries to announce the same conclusion, but attribution that long after the cyber event should be coupled with declared consequences—not just the promise that they’re to come. Some action did in fact come in the NotPetya case about a month after public attribution, when the US sanctioned several Russian actors for election interference, NotPetya and other matters. That was a very good start but would be even more effective in the future if done when the public attribution occurs.
Action speaks louder than attribution alone, and they must be closely coupled to be effective.
Action speaks louder than attribution alone, and they must be closely coupled to be effective.
General considerations
A few general considerations apply to any contemplated response action to a cyber event.
First, when measures are taken against bad actors, they can’t just be symbolic but must have the potential to change that actor’s behaviour. That means that one size does not fit all. Different regimes hold different things dear and will respond only if something they prioritise or care about is affected. Tailored deterrence strategies are therefore required for different states.3
For example, many have opined that Russia is more likely to respond if sanctions are targeted at Putin’s financial infrastructure and that of his close elites than if simply levied in a more general way.
Second, the best response to a cyberattack is seldom a cyber response. Developing cybertools and having those tools as one arrow in the quiver is important, but other responses will often be more effective.
Third, the response to a cyber event shouldn’t be approached in a cyber silo but take into account and leverage the overall relationship with the country involved. The agreement that the US reached with China that neither should use cyber means to steal the trade secrets and intellectual property of the other to benefit its commercial sectors wouldn’t have come about if widespread cyber-enabled intellectual property theft was seen only as a cyber issue. Only when this problem was seen as a core national and economic security issue, and only when President Obama said that the US was willing to bear friction in the overall US–China relationship, was progress really possible.
Fourth, a responsive action and accompanying messaging needs to be appropriately sustained and not a one-off that can be easily ignored. Fifth, potential escalation needs to be considered. This is a particularly difficult issue when escalation paths aren’t well defined for an event that originates in cyberspace, whether the response is a cyber or a physical one, and the chance of misperception is high. And finally, any response should comport with international law.
Collective action
Collective action against a bad actor is almost always more effective than a response by just one state and garners more legitimacy on the world stage.
Of course, if the ‘fiery ball of cyber death’ is hurtling towards you, every country has the right to act to defend itself, but, if possible, acting together, with each country leveraging its capabilities as appropriate, is better. Collective action doesn’t require any particular organised group or even the same countries acting together in each instance.
Flexibility is the key here and will lead to swifter results. The recent attribution of NotPetya by a number of countries is a good example of collective action to a point. It will be interesting to see, following the US sanctioning of Russia, whether other states join in imposing collective consequences.
One challenge for both collective attribution and collective action is information sharing. Naturally, every state will want to satisfy itself before taking the political step of public attribution, and that’s even more the case if it’s taking further action against another transgressing state. Sharing sensitive attribution information among states with different levels of capability and ability to protect that information is a tough issue even in the best of times. But, if collective action is to happen, and happen on anything approaching a quick timeline, enhancing and even rethinking information sharing among partner countries is foundational.
Using and expanding the tools in the toolkit
The current tools that can be used in any instance to impose consequences are diplomatic, economic (including sanctions), law enforcement, cyber responses and kinetic responses.
Some of them have been used in the past to varying degrees and with varying levels of effectiveness but not in a consistent and strategic way. Some, like kinetic responses, are highly unlikely to be used unless a cyber event causes death and physical injury similarly to a physical attack. Others admittedly take a while to develop and deploy, but we have to have the political willingness to use them decisively in the appropriate circumstances and in a timely manner. For example, the US has had a cyber-specific sanctions order available since April 2015 and, before its recent use against Russian actors in March, it had only been used once in December 2017 against Russian actors for election interference. For the threat of sanctions to be taken seriously, they must be used in a more regular and timely manner, and their targets should be chosen to have a real effect on the violating state’s decision-making.
Our standard tools are somewhat limited, so we must also work to creatively expand the tool set so that we can better affect the unique interests of each adversarial state actor (identified in a tailored deterrence strategy), so that they’ll change course or think twice before committing additional malicious acts in the future. That is likely to need collaboration not just within governments but between them and the private sector, academia, civil society and other stakeholders in order to identify and develop new tools.
Recommendations
Of course, foundational work on the application of international law and norms of voluntary state behaviour should continue. That work helps set the expectation of what conduct is permissible. In addition, states should articulate and communicate strong declaratory policies. Declaratory statements put potential adversaries on notice about what’s unacceptable 4 and can contain some detail about potential responses. In addition, a number of other things can aid in creating an environment where the threat of consequences is credible:
1. Shorten the attribution cycle.
Making progress on speeding technical attribution will take time, but delays caused by equity reviews, inter-agency coordination, political willingness, and securing agreement among several countries to share in making attribution are all areas that can be streamlined. Often the best way to streamline these kinds of processes is to simply exercise them by doing more public attribution while building a stronger political commitment to call bad actors out. The WannaCry and NotPetya public attributions are a great foundation for exercising the process, identifying impediments and speeding the process in the future. Even when attribution is done privately, practice can help shorten inter-agency delays and equity reviews.
2. If attribution can’t be made or announced in a fairly brief period, couple any later public attribution with at least one visible responsive action.
Attribution six months or a year after the fact with the vague promise of future consequences will often ring hollow, particularly given the poor track record of imposing consequences in the past. When attribution can be made quickly, the promise of a future response is understandable, but delaying the announcement until it can be married with a response may be more effective.
3. Mainstream and treat cybersecurity as a core national and economic security concern and not a boutique technical issue.
If cyberattacks really pose a significant threat, governments need to start thinking of them like they think of other incidents in the physical world. It is telling that Prime Minister Theresa May made public attribution of the Salisbury poisonings in a matter of days and followed up with consequences shortly thereafter. Her decisive action also helped galvanise an international coalition in a very short time frame. Obviously that was a serious matter that required a speedy response, but the speed was also possible because government leaders are more used to dealing with physical world incidents. They still don’t understand the impact or importance of cyber events or have established processes to deal with them. Mainstreaming also expands and makes existing response options more effective. As noted above, a prime reason for the US–China accord on intellectual property theft was the fact that it was considered a core economic and national security issue that was worth creating friction in the overall US–China relationship.
4. Build flexible alliances of like-minded countries to impose costs on bad actors.
A foundational element of this is improving information sharing, both in speed and substance, to enable better collective attribution and action. Given classification and trust issues, improving tactical information sharing is a difficult issue in any domain. However, a first step is to discuss with partners what information is required well in advance of any particular incident and to create the right channels to quickly share that information when needed. It may also require a re-evaluation of what information must absolutely be classified and restricted and what can be shared through appropriately sensitive channels. If there’s greater joint attribution and action, this practice will presumably also help build mechanisms to share information and build trust and confidence in the future with a greater number of partners.
5. Improve diplomatic messaging to both partners and adversaries.
Improved messaging allows for better coordinated action and serves to link consequences to the actions to which they’re meant to respond. Messaging and communication with the bad actor while consequences are being imposed can also help with escalation control. Of course, effective messaging must be high-level, sustained and consistent if the bad actor is to take it seriously. Sending mixed messages only serves to undercut any responsive actions that are taken.
6. Collaborate to expand the toolkit.
Work with like-minded states and other stakeholders to expand the toolkit of potential consequences that states can use, or threaten to use, to change and deter bad state actors.
7. Work out potential adversary-specific deterrence strategies.
Actual or threatened responsive actions are effective only if the target of those actions is something that matters to the state in question, and that target will differ according to the particular state involved. Of course, potential responses should be in accord with international law.
8. Most importantly, use the tools we already have to respond to serious malicious cyber activity by states in a timely manner.
Imposing consequences for bad action not only addresses whatever the current bad actions may be but creates a credible threat that those consequences (or others) will be imposed in the future.
None of this is easy or will be accomplished overnight, and there are certainly complexities in escalation, proportionality and other difficult issues, but a lot comes down to a willingness to act—and the current situation isn’t sustainable. The recent US imposition of sanctions is a step in the right direction, but imposing tailored costs when appropriate needs to be part of a practice, not an aberration, and it must be accompanied by high-level messaging that supports rather than undercuts its use.
The 2017 US National Security Strategy promises ‘swift and costly consequences’ for those who target the US with cyberattacks. Australia’s International Cyber Engagement Strategy states that ‘[h]aving established a firm foundation of international law and norms, the international community must now ensure there are effective consequences for those who act contrary to this consensus.’ On the other hand, Admiral Rogers, the head of US Cyber Command and the National Security Agency, recently told US lawmakers that President Putin has clearly come to the conclusion that there’s ‘little price to pay here’ for Russia’s hacking provocations, and Putin has therefore concluded that he ‘can continue this activity’.
We must change the calculus of those who believe this is a costless enterprise. Imposing effective and timely consequences for state-sponsored cyberattacks is a key part of that change.
Of course, there are an ever-increasing number of attacks and intrusions by criminals, including transnational criminal groups, as well. Deterring this activity is a little more straightforward—the consequences for criminals are prosecution and punishment and, in particular, a heightened expectation that they’ll be caught and brought to justice. I don’t address deterring criminal actors in this paper, although there have been advances in ensuring that countries have the laws and capacity to tackle these crimes and there have been a number of high-profile prosecutions, including transnational cases. Much more needs to be done to deter these actors, however, as many cybercriminals still view the possibility that they’ll be caught and punished as minimal. ↩︎
One downside of a practice of publicly attributing state conduct is that it creates an expectation that victim states will do this in every case and leads to the perception that when they don’t it means they don’t know who is responsible—even if they do. For that reason, states, including the US, have often said in the past that they’ll make public attribution when it serves their deterrent or other interests. There are also cases in which a state or states may want to privately challenge a transgressor state to change its behaviour or in which calling out bad conduct publicly risks sources and methods that may have a greater value in thwarting future malicious conduct. Nevertheless, the seeming trend to more cases of public attribution is a good one, and these concerns and expectations can be mitigated in a state’s public messaging or by delaying public attribution when necessary. ↩︎
Defence Sciences Board, Task Force on Cyber Deterrence, February 2017. ↩︎
Such statements should be relatively specific but need not be over-precise about exact ‘red lines’, which might encourage an adversary to act just below that red line to escape a response. ↩︎
ASPI International Cyber Policy Centre
The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.
It seeks to improve debate, policy and understanding on cyber issues by:
conducting applied, original empirical research
linking government, business and civil society
leading debates and influencing policy in Australia and the Asia–Pacific.
We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors but special mention in this case should go to the Australian Computer Society (ACS), which has supported this research.
Chris Painter’s distinguished visiting fellowship at ASPI’s International Cyber Policy Centre was made possible through the generous support of DFAT through its Special Visits Program. All views expressed in this policy brief are the authors.
Important disclaimer
This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/03/12154826/Cyber-Deterrence-static-banner-v2.jpg4501350nathanhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngnathan2018-06-01 06:00:242025-03-12 16:02:04Deterrence in cyberspace
Since its inception in 2009, Sina Weibo – China’s souped-up version of Twitter – has provided a rare foothold for foreign governments in the PRC’s tightly-controlled media environment.
Yet while the PRC is allowed free reign to push its messages in Western media and social media platforms, Beijing’s censors have been hampering the legitimate digital diplomacy efforts of foreign embassies.
This ASPI ICPC report provides an in-depth look at the increasingly sophisticated censorship methods being used on foreign embassies on Weibo and provides a series of recommendations for foreign governments, including Australia, to address these policy challenges.
What’s the problem?
As the Chinese Communist Party (CCP)-led state extends its reach into other nations, it’s actively limiting the ability of other countries to do the same in the People’s Republic of China. Seeing itself in an ideological confrontation with ‘the West’,1 the CCP under Xi Jinping is determined to ensure ideological conformity in its own information space.
A key battleground is Weibo, the Chinese micro-blogging service most closely analogous to Twitter. Since Weibo’s inception, embassies have maintained a presence on it—a rare foothold for foreign governments in China’s tightly controlled information space.
While some governments, particularly those of Western countries, have occasionally spoken outside the CCP’s frame of acceptable public discourse, most do not. As Weibo continues to introduce new and subtle methods of direct censorship, foreign embassies are both self-censoring their messaging and failing to speak up when their content is being censored.
In Australia’s case, this lack of transparency and cycle of self-censorship sits oddly with the description of Australia as ‘a determined advocate of liberal institutions, universal values and human rights’ in the 2017 Foreign Policy White Paper.2
What’s the solution?
To not be seen as agreeing to the CCP’s ideological agenda, like-minded governments, in coordination with each other, should commit to publishing transparency reports to reveal the extent to which their legitimate online public diplomacy efforts are being curtailed in China.
Foreign governments should establish and publish clear terms of use for their social media accounts in China so that they don’t fall into the trap of self-censoring their policy messages and advocacy. They should use uncensored social media platforms such as Twitter—which, despite being blocked in China, still has an estimated 10 million active users in the country.3
Embassies could cross-post all of their content there so that audiences are both aware of any incidences of censorship and have alternative avenues to access their full content. The Australian Government should establish Weibo accounts for the positions of Prime Minister and Foreign Minister.
‘Orwellian nonsense’
In early May 2018, the US Embassy in China put Weibo censors in a delicate bind when it issued a provocative slapdown of Beijing’s censorship overreach.
‘President Donald J Trump ran against political correctness in the United States’, read the White House statement, which had been translated into Mandarin.4 ‘He will stand up for Americans resisting efforts by the Chinese Communist Party to impose Chinese political correctness on American companies and citizens.’
The statement was put out in response to the Chinese Civil Aviation Administration’s call on 36 foreign airlines, asking them to come into line with Beijing’s preferred terms of reference for Taiwan, Hong Kong and Macau as ‘Chinese territories’.
The statement continued: ‘This is Orwellian nonsense and part of a growing trend by the Chinese Communist Party to impose its political views on American citizens and private companies.’ It went further still: ‘China’s internal Internet repression is world-famous. China’s efforts to export its censorship and political correctness to Americans and the rest of the free world will be resisted.’
The post, most likely penned by White House press secretary Sarah Huckabee Sanders, was a deliberate poke in the eye for Beijing and it promptly caused a firestorm on the platform.
In the short history of Weibo diplomacy, sometimes referred to as ‘Weiplomacy’, it was the most direct challenge to China’s censorship regime yet. Having shone a mirror on their own activities, Sina Weibo’s censors were put on the spot.
‘Only folks with strong connections (like you) can avoid getting censored’ read the most upvoted comment in the hour immediately after the post went out (Figure 1). ‘I can imagine the censorship department scratching their heads over this,’ read another comment.5
Notably, Hu Xijin, the chief editor of Global Times, the nationalist newspaper owned by the CCP, took to his own Weibo account to call on ‘Weibo management’ to refrain from intervening.6
Instead, in the ensuing few hours, Sina Weibo’s censors used every tool at their disposal short of deleting the post to ensure that the missive had as little impact as possible. Not only was the sharing function for the post switched off, but the comments section under the post was carefully manicured to remove liberal voices and replace them with CCP-approved sentiment (Figure 2).
Figure 1: The comments section under the US Embassy post less than an hour after it was published included users directly challenging the censorship regime.
Translation
Only folks with strong connections (like you) can avoid getting censored. [2,656 Likes]
I’m also against political correctness or imposing your ideology on others but respecting the sovereignty and territorial integrity of other countries should not be mixed up with ideology. [2,077 Likes]
If we were exercising extreme oppression on the domestic Internet, do you think you’d still be talking shit here? [1,277 Likes]
Hahahahaha seeing in my living years the US opposing China’s political correctness.. [1,027 Likes]
How does our press freedom rank in the world again, one hundred and something right? [634 Likes]
I sincerely hope the Indians can claim back their land and establish their own country, while Hawaii could become an independent country. [814 Likes]
If you don’t want to do business here, then f&#% off. If you do want to do business here, respect our laws. [497 Likes]
[I] support President Trump’s thinking, the world belongs to the people, not a certain party. [378 Likes]
Leave your name here before the post gets deleted. [321 Likes]
Figure 2: The comments section under the US Embassy post (now seen in mobile view) around 2 hours after it was published and after censors removed posts that didn’t toe the party line.
Translation
If you don’t want to do business here, then f&#% off. If you do want to do business here, respect our laws. [110,000 Likes]
When China and the US established diplomatic relations in 1972, Nixon openly accepted China’s political correctness during his trip here. Are you now denying the establishment of diplomatic relations? [7,854 Likes]
Independence for Hawaii Independence for Alaska Independence for California Independence for Texas Independence for New Mexico [7,108 Likes]
1. This is not political correctness, this is the one-China principle.
2. Please abide by the terms of the Sino-US joint communique, if you choose to unilaterally go against them, it will be seen as a violation of the agreement. [6,560 Likes]
The incident was an object lesson in how sophisticated the PRC censorship apparatus has become and how precisely it can be deployed. It may be ‘Orwellian nonsense’, but it does largely work. While some Western media reports 7 took care to note that more varied opinions were expressed by Weibo users under the post before the censors swooped in, most reports didn’t.8
What remained after the censors had done their work was nothing more than a Potemkin post, with the comments under it carefully selected to give the impression of a uniformly nationalistic online Chinese public. Such an impression has led previous scholarship on ‘Weiplomacy’ to conclude that the power of Weibo to further the goals of public diplomacy might have been overestimated.9
But a closer examination of the comment section under the post revealed a plethora of viewpoints that the censors failed to expunge. Even though the censors had cherrypicked CCP-approved comments to feature as the most upvoted comments, many of the comments under those comments weren’t toeing the party line (Figure 3). Peeling back the curtain on the Potemkin post reveals the raucous marketplace of ideas that still exists on Weibo, if one takes the time to seek it out.
Figure 3: The comments under the cherrypicked nationalist comments reveal sentiment from opposing ideological clusters.
Translation
If you don’t want to do business here, then f&#% off. If you do want to do business here, respect our laws. [12,076 Likes]
‘Little pink’ maggots [a derogatory term for young nationalists] are really disgusting [4,879 Likes]
So ZTE deserved to be prosecuted in the US because it didn’t obey their laws. [3,319 Likes]
‘War Wolves’ [a reference to patriotic hit Chinese film Wolf Warrior] always think the rest of the world couldn’t survive without China. [3,302 Likes]
Saying it like this is a bit extreme. China and the US affect each other mutually. Chinese airlines need to fly to the US and US airlines need to fly to China. It’s not possible for only one side to depend on the other for business. [3,091 Likes]
[The commenter] is obviously a slave but one who talks with the tone of a master. [1,970 Likes]
Weibo and foreign governments: a history of censorship and self-censorship
Three years after the UK Embassy became the first foreign embassy to open an account on Sina Weibo, Jonas Parello-Plesner warned that diplomats should be wary of creeping self-censorship.
‘Embassies shouldn’t accept self-censorship by only posting innocuous tweet[s] that can pass through the censors,’ Parello-Plesner wrote in The Diplomat in 2012.10 ‘Instead they should give the full spectrum of views including on values—even if it means more deleted postings.’
In the intervening years, some foreign embassies took up the challenge, showing a willingness to push the envelope even at the risk of having their content censored. At times, the envelope pushing has been inspired. Doing this required them to be quite creative, because being predictable means being easily blocked.
On 30 May 2012, the US Embassy tapped into Michael Jackson’s popularity in China to give a boost to a politically sensitive interview with then ambassador Gary Locke.11
‘Michael Jackson has an album called Thriller, one of the best selling records in the history of music. The story we’re telling today is also a Thriller. Click to read,’ read the post, which also included a picture of the famous album (Figure 4).
The link led to a Newsweek interview titled ‘Ambassador to China Gary Locke talks Chen, Drama in China’,12 which included details about the attempt by former Chongqing police chief Wang Lijun to get political asylum from the US, as well as the dramatic story of activist Chen Guangcheng’s successful bid for political asylum.
Figure 4: The censored 2012 Weibo post from the US Embassy, which used Michael Jackson’s celebrity as a smokescreen for a politically sensitive interview with then ambassador Gary Locke. The post was archived on FreeWeibo.com.
In 2014, the UK Embassy posted a 2013 human rights report to Weibo using ‘Martian’, a coded language based on Chinese characters (Figure 5).13
Figure 5: The 2014 Weibo post from the UK Embassy, which used coded language in an attempt to evade censorship.
If the post had gone out using standard Chinese, keywords deemed sensitive by the party-state, such as ‘human rights’, would have been flagged automatically. But by using the ‘Martian’ coded language, the longevity of the post was prolonged before the censors became aware of it.14
In other instances, embassies have posted ‘sensitive’ content on Weibo in order to address what they have perceived as unfair treatment by China’s state-controlled media.
On 3 August 2011, the Canadian Embassy was censored for the first time after it posted about Chinese fugitive Lai Changxing. The post included a full federal court decision that resulted in his deportation to China. It included mentions of Liu Xiaobo and Falun Gong and was deleted almost immediately.15
At other times, foreign embassies have tested the boundaries of what is deemed acceptable discourse by Beijing’s censors. In 2016, the US consulate in Shanghai sent out a Weibo post asking for virtual private network (VPN) supplier recommendations. The post was deleted within an hour of its appearance.16
On 1 February 2017, the British Embassy posted an EU statement calling for the investigation of allegations of torture of detained human rights lawyers.17 According to Citizen Lab, Weibo users weren’t able to forward or comment on the post.18 The post was subsequently deleted. And on 3 June 2014, a day before the 25th anniversary of the massacre at Tiananmen Square, the Canadian Embassy posted a photo of Ambassador Guy Saint-Jacques posing with his wife at the site (Figure 6). The low comments-to-shares ratio on the provocative post would suggest some form of censorship, with comments either being deleted or not allowed at all.
Figure 6: Canadian Ambassador and his wife at Tiananmen Square, 2014
The text reads:
‘On June 1, ambassador Guy Saint-Jacques and wife Sylvie Cameron took a tour around the Chairman Mao Memorial on their bikes. A visit to the place they once saw reminded of various past events associated with the square, including the once more cordial and relaxed atmosphere there.’
Despite being shared 917 times, the post only displays a few comments—a telltale sign that censors had throttled engagement with it.
One share of the post added the comment: ‘There are only a few comments on this post, and you can’t see any of the shares of it.’
At times, the act of censorship happens not because an embassy has made a decision to push the envelope, but because it’s made a diplomatic faux pas. On 26 March 2014, the Russian Embassy Weibo account made what Foreign Policy called a ‘large digital diplomacy gaffe’ when it made mention of the Tiananmen incident. The embassy argued that ‘Russia’s current situation’, following Western sanctions after Russia’s annexation of Crimea, ‘somewhat resembles what China suffered after the Tiananmen incident.19
More recently, however, the instances of blatant censorship—in which posts and even the accounts themselves are deleted—appear to have dropped off. Instead, as this report shows, the invisible hand of Beijing’s censors is, for the most part, eschewing heavy-handed censorship for more surreptitious forms. At the same time, it appears that foreign embassies on Weibo are pulling their punches and accepting ‘the sliding slope of red lines and self-censorship inside the Chinese system’ that Parello-Plesner warned about.20 The combination results in the suppression of ideas that are different from the CCP’s ‘correct line’.
Websites FreeWeibo and Weiboscope have been extremely useful for uncovering examples of blatant censorship, including deletions of posts and keyword blocking. However, less obvious forms of censorship are more difficult to detect. Some of those methods include disabling the comments section under posts and switching off their sharing functionality.
The disabling of comments has been one of many levers that Sina Weibo’s censors have been able to pull from as early as 2012, when, rather heavy-handedly, all comments on all posts were switched off after rumours of a coup spread on the platform.21
Similar forms of surreptitious censorship include ‘shadow-banning’, in which users are under the impression that their posts are being seen when in fact they’re being hidden from other users. The practice is known to be used, if only anecdotally, on Sina Weibo, but has been proven to be in use on China’s dominant chat application, WeChat. 22
These stealthier forms of censorship are less noticeable to the user and therefore less likely to provoke any unwanted backlash.23 As Lawrence Lessig observed in 1999, it’s the underlying code that determines ‘whether access to information is general or whether information is zoned’.24 Or to rework the old aphorism, ‘If a message is posted on social media, but the algorithm doesn’t prioritise it, does it really make a sound?’
How censorship on Weibo works
An analysis of three months’ worth of Weibo posts between November 2017 and January 2018 from the top 10 foreign embassies in China (measured by follower numbers) found 51 instances of censored posts, mostly on the US Embassy account (Figure 7).25
Figure 7: Three months of Weibo posts from November 2017 to January 2018 resulted in 51 instances of censorship.
The US Embassy account had 28 instances of censorship in total, and a variety of methods were used to reduce or erase the impact of its posts. Those methods ranged from the blunt to the subtle:
Six posts were deleted—some immediately, some weeks after the fact.
Fifteen posts had their comments sections disabled immediately.
Three posts had comments sections disabled immediately and then re-enabled weeks later.
Two posts had their comments sections allowed, then disabled and hidden at some later stage.
In two posts, Weibo notified users that comments were being accepted but asked that they wait patiently for a ‘server synchronisation’. The user comments never made it through.
A range of censorship methods were used on US Embassy posts, ranging from the blunt to the subtle (Figure 8).
Figure 8: Censorship methods used on the US Embassy Weibo account
In a blatant act of censorship, a post sent out by the US Embassy on 7 November 2017 showing the first leg of President Trump’s Asian tour, in Japan, was immediately deleted. The deleted post—captured and archived by FreeWeibo.com 26—was also tweeted from the US Embassy Twitter account,27 helping to make its absence on Weibo more noticeable (Figure 9).
Figure 9: The US Embassy tweet, the Weibo equivalent of which was deleted by Chinese censors.
Translation: President Trump and First Lady Melania Trump were welcomed by the Emperor and Queen of Japan on the second day of their Japan visit. They also met with the families of North Korean abductees. President Trump held bilateral talks with Abe, and met with Japanese and American business leaders, while the First Lady had a joyous meeting with some Japanese primary school students. #POTUSinAsia
Two days later, on 9 November 2017—the second day of President Trump’s first state visit to the PRC—a post sent out by the US Embassy linking to a transcript of a press briefing by Secretary of State Rex Tillerson (Figure 10)28 had its comments section immediately disabled.
The post contained a statement from Secretary Tillerson that presented President Trump and President Xi as being on a joint ticket in regard to denuclearisation of the Korean Peninsula, and quickly became that week’s most shared post from the embassy, with 523 shares and 441 ‘Likes’.
Figure 10: The tweet about Rex Tillerson, the Weibo equivalent of which was deleted by Chinese censors.
Translation: President Trump and President Xi confirmed their determination in realising the complete, verifiable and ever lasting denuclearisation of the Korean peninsula. President Trump and President Xi won’t accept a North Korea that is armed with nuclear weapons. We thank China’s cooperation. Secretary of State Rex Tillerson at Beijing Press Conference. Read the brief.
On 17 November, another post quoted a different part of Secretary Tillerson’s earlier press briefing:
The key topic of discussion was our continued joint effort to increase pressure on North Korea, to convince them to abandon their nuclear and missile program. President Trump and President Xi affirmed their commitment to achieve a complete, verifiable, and permanent denuclearization of the Korean Peninsula. President Trump and President Xi will not accept a nuclear-armed North Korea.
On 24 November, another post quoted President Trump from his joint press conference with President Xi two weeks earlier: 29
All responsible nations must join together to stop arming and financing, and even trading with the murderous North Korean regime. Together we have in our power to finally liberate this region and the world from this very serious nuclear menace. But it will require collective action, collective strength, and collective devotion to winning the peace.
And on 30 November 2017, a US Embassy Weibo post announced a call between President Trump and President Xi after Pyongyang tested a missile reportedly capable of reaching the US mainland (Figure 11).30 A copy of the post remains on the US mission’s Twitter account.31
Figure 11: The tweet about Trump’s phone call with Xi, the Weibo equivalent of which was deleted by Chinese censors on Weibo.
Translation: President Trump spoke with President Xi to discuss North Korea’s latest missile test. President Trump stressed America’s determination to defend itself and its allies from the growing threat posed by the North Korean regime. November 29, 2017, the White House President Trump and President Xi call briefing.
Six months after these four posts were published, they no longer exist. It’s unclear when exactly the censors deleted them. This method of delayed censorship avoids detection on FreeWeibo.com, where there are no records of the posts being censored. With the North Korea nuclear crisis still a live issue, the deletions suggest that Beijing is trying to regain control of the narrative inside its own information space.
On 27 December 2017, the US Embassy was censored again after it sent out a post linking to a US– German embassy joint statement about the sentencing of activist Wu Gan and his lawyer, Xie Yang:
We see lawyers and defenders of rights as aiding the strengthening of the Chinese society via developing governance by law. Click the link here to view the recent cases.
The post was captured on FreeWeibo.com after being censored on Weibo.32
Aside from these six instances of deleted posts, all other instances of censorship captured in this report involved the disabling of the comments section under posts. This softer, less noticeable form of censorship is what’s more generally applied to posts from foreign embassies, resulting in suspiciously low levels of reported engagement from users. Engagement levels are artificially deflated when comments are disabled.
In a response to a list of questions asked by ASPI’s International Cyber Policy Centre (ICPC), three governments—the US, Australian and Japanese—confirmed that their embassies in Beijing never disable the comment sections under their Weibo posts.33
‘We don’t delete our own posts,’ a US Embassy spokesperson told ASPI ICPC via email. ‘The US Embassy faces regular and routine blocking of social media posts in China.’ 34
‘We don’t disable the comments section ourselves,’ a Japanese Embassy spokesperson told an ASPI ICPC researcher over the phone. ‘When comments are closed for posts it’s always done by Sina. They will always disable comments for posts mentioning the names of Chinese political leaders, for example.’
In fact, in the data covered in this report, 75% of the time censorship appears to have been meted out because a top Chinese official (living or dead) was mentioned by name or was in a photo in the post.
The sensitivity around senior Chinese officials isn’t surprising. In his 2013 book, Blocked on Weibo, Jason Q Ng found that the largest share of blocked words he discovered through his research were names of people, mostly CCP members.
‘[P]rotection from criticism on Weibo seems to be a perk for rising up the ranks—while dissidents and people caught up in scandals or crimes make up the rest of the names,’ Ng wrote.35
A post by the Cuban Embassy on 25 January 2018 mentions Song Tao (宋涛) , the head of the CCP’s International Department. The post described Song as ‘Secretary Xi Jinping’s Special Envoy’, which was probably the reason for the censorship that followed (Figure 12).
Figure 12: A Cuban Embassy post runs into trouble
Translation of error message: Sorry, you cannot proceed with your attempt as the content contains information that has violated relevant laws and regulations or Weibo community guidelines.
Even when posts mentioning Xi Jinping are positive, they still attract the attention of censors. In October 2017, former Australian Prime Minister Kevin Rudd posted a photo of himself ‘studying’ Xi’s report to the 19th CPC National Congress (Figure 13). ‘China has entered a new age,’ he wrote. According to Rudd, comments under the post were disabled by Weibo. 36
Figure 13: Comments were disabled after Kevin Rudd posted on Weibo
A Sina spokesperson confirmed to ASPI’s ICPC that government-affiliated Weibo accounts with a blue verified badge have the ability to disable the comment sections on their own posts.37 However, in the dataset collected for this report, only one instance of a foreign embassy disabling its own comments was found, on the South Korean embassy’s Weibo account (Figure 14).
Figure 14: The error message reads ‘Due to this user’s settings, you’re unable to comment.’ The South Korean embassy did not respond to ASPI ICPC’s enquiries.
Occasionally, there are exceptions to the censorship rules. An uncensored post from Canadian Prime Minister Justin Trudeau sent on 6 December 2017 included Chinese Premier Li Keqiang’s name in the text, as well as Li’s image in a photo.38
The outsized success of a selfie taken by Indian Prime Minister Narendra Modi and Chinese Premier Li Keqiang and posted to Weibo in July 2015 is another exception to the rule (Figure 15). 39 The virality of the post was due not only to the rare inclusion of a top Chinese leader, but also due to the content, in which Modi wishes Li a happy birthday. Premier Li’s exact birthday hadn’t been publicly disclosed before.40
Figure 15: Indian Prime Minister Narendra Modi and Chinese Premier Li Keqiang post a selfie
In a rare case during the 2017 G20 summit in Germany, any mention of Russian President Vladimir Putin was blocked on Weibo, according to the Financial Times.41
The move was interpreted by the paper as ‘giving Russia’s president an immunity from public criticism usually reserved for China’s Communist Party elite.’ In that instance, any mention of Putin on the accounts of Weibo users with more than 1,000 followers triggered the message: ‘This post does not allow commenting.’
Out of 51 instances of suspected censorship over the three-month study period, only 13 were posts that didn’t mention any top Chinese leaders.
One particularly notable instance of censorship was of a 13 November 2017 post from the US Embassy Weibo account, which included a video of President Donald Trump emphasising the US as a country whose ‘home’ is ‘on the Pacific’ (Figure 16).
Figure 16: Comments are disabled on US Embassy’s post of President Trump speaking about the US and the Pacific.
Translation of error message: Sorry, you cannot proceed with your attempt as the content contains information that has violated relevant laws and regulations or Weibo community guidelines.
Other, more personal, attempts at cross-cultural communication were also hamstrung by the censors. On the final day of President Trump’s state visit to the PRC, a video of Trump’s 6-year-old granddaughter Arabella Kushner that Trump had personally shown President Xi and his wife Peng Liyuan was published on the US Embassy account and immediately had the comments section on it disabled (Figure 17).
Figure 17: Screenshot of the US embassy’s post of Arabella Kushner singing in Chinese. Comments on the post were immediately disabled.
On the same day, a Weibo post written in the first person by President Trump at the end of his state visit to the PRC appeared:
I’m now leaving China for Vietnam for the APEC meeting #APEC2017#. First Lady Melania will stay here to visit the zoo, and of course, the Great Wall of China. Then she will go to Alaska to greet our amazing troops.
The post prompted some users to ask in comments whether Trump had taken over control of the US Embassy account.
After 39 comments were made, any subsequent attempt to comment resulted in an error message reading: ‘Posted successfully. Please be patient about 1–2 minutes delay due to server synchronization, thank you’ (Figure 18).
Figure 18: The Trump post at the end of his China visit.
Translation of error message: Posted successfully. Please be patient about 1–2 minutes delay due to server synchronization, thank you.
Two other posts by the US Embassy probably drew the ire of Weibo’s censors by providing an opportunity for Chinese netizens to draw comparisons between conditions in the US and China.
One such post answered a question posed to the US Embassy Weibo account about whether American officials were provided with special food supplies (Figure 19).42 Chinese news reports in 2011 revealed that Chinese Government officials have exclusive suppliers of organic food.43 Given that the post didn’t include any sensitive words that might cross a censorship fault line, it managed to garner at least 88 comments before commenting was disabled by the censors.
Figure 19: One of only 13 censored posts that didn’t refer to a senior Chinese leader, this post seemed to invite a comparison of US officials to Chinese officials, and comments were disabled.
Weibo accounts run by the US Government have been suspended and even completely deleted in the past. The US Shanghai consulate’s Weibo account was shut down on 14 July 2012, while the US Embassy account was suspended briefly on 5 May 2016, according to China Digital Times, which is a website following social and political developments in China and run by the University of California.44
At times, it’s less clear why a decision to disable comments was made. When the US Embassy posted that it wouldn’t be able to continue posting to Weibo and WeChat during a government shutdown on 22 January 2018, the post went viral (Figure 20).45 It was the second most shared of all posts gathered during the three-month reporting period for this report.
Figure 20: A post by the US Embassy, explaining that it wouldn’t be posting during a government shutdown, was picked up by the Chinese media.
Translation: Due to an unresolved issue with funding, the US embassy’s social media account will cease its regular updates. While the funding issue remains unresolved, all regular and emergency consular, citizen and immigration services will continue as usual. Those seeking visa or citizen services who have secured an appointment in advance should attend as scheduled. In the exception of emergency security and safety information, the embassy website will not continue its regular updates before full resumption of operations.
However, after the post garnered 1,893 comments, further comments were disabled, despite the Global Times’ gleeful reporting on the incident.46
For China’s overzealous censors, even posts that could be used to show the apparent weaknesses of liberal democracies, such as the US Embassy’s government shutdown post, need to be censored—presumably for fear that discussion of the US Government will prompt users to draw comparisons to their own government. Clearly, the censors, of which Sina Weibo employs an estimated 13,000,47 are highly sensitive to any content that falls outside the boundaries of acceptable CCP-approved discourse.
It follows that a country such as Australia, which claims to be ‘a determined advocate of liberal institutions, universal values and human rights’,48 should expect such advocacy to attract the attention of China’s censors. If it didn’t, something would be odd. However, the Australian Embassy Weibo account doesn’t appear to be attracting much CCP censorship. In the three months of data collected for this report, the embassy’s Weibo account was censored only three times, all for mentioning Xi Jinping. Whether this lack of censorship reflects savvy account management, the CCP’s disinterest in the embassy Weibo account or self-censorship by the Australian Government is the important question.
Rising nationalism
Rising Chinese nationalism online has been allowed to foment amid recent social media campaigns against companies such as South Korean conglomerate Lotte Group, German carmaker Daimler’s Mercedes-Benz brand and Marriott International. The campaigns have received support from both state-run media and the Chinese Government.49
On 17 November 2017, an innocuous post by the German Embassy explaining the meaning of the German word Lückenbüßer (stopgap)50, became a place for nationalists to congregate and protest after pro-Tibetan independence flags were sighted at a soccer match in Germany involving Chinese players (Figure 21).
Figure 21: The German Embassy Weibo post and angry responses from nationalists.
Translation: Luther invented the word Lückenbüßer while translating the Old Testament. The word is about holes and cracks needing to be mended in the Holy Wall in Jerusalem. This is the origin of the word. Today, it refers to a person who acts as a replacement for the one missing from the original plan, although the plan does not work out in the end. No one wants to be a measure of expediency, but we often cannot do without one. During a period of transition when changes are about to happen, or when a final choice has yet to be made, it usually connects the world together.
Translation of comments:
You want freedom of speech? Sure! Next time you Germans want to come to China for any games, we will bombard with swastika flags and photos of Hitler, and salute and chant the name of Hilter throughout, and belt out Nazi songs! Then you’d be happy, be content! A nation that cannot retain its roots is really pathetic, of course, they will treat the territorial integrity of other nations as bullshit!
You deserve terrorist attacks in Europe, it’s all your own making!
Can we perform Nazi rituals and bear Nazi flags when the German team comes to China?
Since some people purposely provoked aggression with flags for Tibetan independence during a China–Germany soccer match, while you brushed it aside with the excuse of freedom of speech, I think it would not be an issue to paste around your embassy all with flags of east Germany!
What is freedom of speech? If the separation of China can be counted as freedom of speech, then we sincerely hope that you would again divide Germany into two countries.
The prevalence of such deep nationalism, both real and manufactured, has prompted some, like Adelaide University scholar Ying Jiang, in her pioneering research into ‘Weiplomacy’ efforts, to suggest that the power of Weibo to further the goals of public diplomacy might have been overestimated.51 It’s easy to see how that could be the case. While liberal voices face extra scrutiny from the censors, nationalist voices are allowed to flourish. Even foreigners on Weibo have been tapping into Chinese nationalism as a fast track to viral fame on the platform.
David Gulasi, a China-based Australian English teacher, attracted attention on the platform with funny videos, but saw it skyrocket when he started aping nationalistic views. State media outlet Xinhua has noted that videos uploaded by Gulasi include one in which he ‘professed his love for China and denounced foreigners who did not share his passion for the country’.52
In 2016, when thousands of China-based trolls attacked Australian Olympic swimmer Mack Horton and his supporters after Horton called his Chinese rival Sun Yang a ‘drug cheat’, Gulasi joined in on Weibo (Figure 22).53
Figure 22: Joining a Chinese nationalist pile-on on Australian Olympian Mack Horton helped David Gulasi achieve viral fame on Weibo.
In another video, Gulasi complains about the slow pace of life in Australia and tells his audience he has come to China to pursue his ‘Chinese Dream’ 54 —a populist slogan introduced by Xi Jinping in 2013. Astoundingly, Gulasi was chosen by the Australian Embassy to feature in its 45 Years, 45 Stories campaign to commemorate the 45th anniversary of Australia–China diplomatic relations.55
Foreign embassies and even national leaders such as India’s Narendra Modi have had their Weibo accounts deluged with angry nationalistic messages.56 But in an increasingly censored and controlled online media environment, foreign embassy accounts can also be a channel for netizens to protest about their own government.
In early February 2018, the comments section on posts sent out by multiple foreign embassies, including the US, Japanese and UK embassies, as well as the United Nations, spontaneously became a space for Weibo users to protest the China Securities Regulatory Commission and its head, Liu Shiyu (Figure 23).57
Figure 23: A screenshot of the US embassy Weibo account from 9 February 2018. The screenshot was censored on Weibo but retrieved by FreeWeibo.com, a censorship monitoring site. Source: 科学自然 ‘科学自然:激动的中国股民涌到美国驻…’, FreeWeibo.com, 10 February 2018, online
Translation:
Since the China Securities Regulatory Commission Weibo has banned hundreds of millions of investors from protesting, all we can do is voice our fury here and strongly demand Liu Shiyu to step down.
Please have your American reporters go to the CSRC to interview Liu Shiyu, [and ask him] why is the Chinese stock market so unable to take a hit?
As our official platform has been censored, I just want to borrow this space to call for Liu Shiyu to step down. The stock market has crashed five times in two years, slaughtering hundreds of millions of investors
‘641’ (a homonym for Liu Shiyu) must step down immediately, you’ve already seriously hurt hundreds of millions of families.
In April 2018, Weibo reversed a ban on content ‘related to’ homosexuality after an unusually fierce backlash from internet users.58
Both incidents reveal the diversity of views and ideological groupings that continue to exist online in China despite the party-state’s efforts to promote nationalism. Research by the Mercator Institute for China Studies (MERICS) demonstrates how those widely differing views coexist on Chinese social media, even after extensive efforts by the CCP to repress liberal voices on the platform.59
Its research shows that ,while party-state propaganda plays a dominant role, a number of other distinct ideological clusters exist on Chinese social media sites such as Sina Weibo. Among the groupings they identify are ‘Market Lovers’, ‘Democratizers’, ‘Humanists’ and ‘US Lovers’.
Furthermore, a survey conducted by MERICS for the report shows that Chinese nationalism isn’t necessarily anti-Western. While 62% of respondents in the online survey said China should be more assertive internationally, 75% also supported the ‘spread of Western values’. As the paper points out, ‘the CCP’s strategy of denouncing so-called Western values has repeatedly backfired when netizens pointed out the lack of better Chinese alternatives.’ Western embassies’ public diplomacy efforts seem to have some fertile ground, despite the censorship.
Israel, the Weibo stand-out
The ICPC’s analysis of three months of posts from the top 10 foreign embassies on Weibo shows that a failure to cut through can’t be blamed only on censorship. Many foreign embassies simply aren’t putting enough resources into ensuring that their content is engaging enough to succeed in a highly competitive online media environment, or creative enough to not be easily spotted by censors.
The Israeli Embassy is a stand-out exception: it has a highly successful content strategy that has proved highly popular on the platform. In her own research into ‘Weiplomacy’ efforts, Adelaide University scholar Ying Jiang captured 2015 data from the top 10 embassies on Weibo, and Israel didn’t make the list. Just a year later, research by Manya Koetse, editor-in-chief of the Chinese social trend tracking website What’s on Weibo, showed that the Israeli Embassy had come out of nowhere to take the top spot (Table 1).
Table 1: The top 10 foreign embassies on Weibo, 2015 to 2017
(Table-1)
Sources:
a) Ying Jiang, ‘Weibo as a public diplomacy platform’, Social Media and e-Diplomacy in China, 10 August 2017, online.
b) Manya Koetse, ‘Digital diplomacy: these foreign embassies are most (un)popular on Weibo’, What’s On Weibo, 20 December 2016, online.
c) Data collected by Fergus Ryan, December 2017.
Of course, a successful digital public diplomacy effort on Weibo should not only be judged by how many posts are censored; it should also be pragmatic. Above all, any digital diplomacy, or ‘e-diplomacy’, effort is fundamentally about the use of the internet and new information and communications technologies to help achieve diplomatic objectives.60
Drawing on data from late 2017, this report has Israel maintaining its lead at number 1 (despite losing followers), while the US and Canada continue to vie for second and third place. The UK has recovered from its loss of two places to regain the number 6 slot, while Australia has managed to re-enter the top 10.
However, follower counts can be a somewhat crude metric, as they can be easily gamed.
A 2014 investigation by The Globe and Mail found that large chunks of those followers were fake. According to the online tool used by the paper, 45.8% of the US Embassy’s followers, 39.9% of the UK’s and 51.2% of Japan’s were real. Only 12.9% of the Canadian Embassy’s 1.1 million followers were determined to be real.61
Another more meaningful metric is to examine the number of shares, likes and comments that each post gets on average to arrive at an idea of how ‘influential’ each embassy is (Figure 24).
Figure 24: Top 10 foreign embassies, by shares and likes per post
Using these engagement metrics, the Japanese, UK, US, Israeli and Canadian embassies are the top 5 leading the pack.
Central to the success of the top 5 accounts is a tendency to not just promote the image of their own countries, but to engage with and leverage Chinese culture, particularly pop culture. Weibo’s audience skews young (88% of Weibo users are under 33 years of age) and, after its most vocal liberal voices were purged, is now largely dominated by entertainment.62
If the aim of foreign embassies on Weibo is to enhance soft power and to shift public opinion around to supporting their foreign policy positions, the Israeli Embassy Weibo account is exemplary. Shimi Azar, who worked as social media manager at the embassy from late 2014 to early 2016, says the country received a lot of exposure through state visits by Israel’s leaders to China.
‘The first visit of Israel’s Prime Minister Netanyahu to China in 2013 and the visit of the late president Shimon Peres in 2014 created a big buzz in the media,’ Azar told the Global Times.
‘So the embassy took advantage of this buzz and created a Sina Weibo account for Shimon Peres, which was very successful and soon attracted half a million followers.’63
But the outsized success of the Israeli Embassy Weibo account also occurred in the context of a number of deadly terrorist attacks by jihadist-inspired separatist groups in Xinjiang Province.64 As Peter Cai noted in 2014, the majority of comments under an Israeli Embassy Weibo post that likened Hamas to the Islamic State terrorist group were supportive of Israeli attacks on Hamas.
‘Israel, you must control the population in Gaza, otherwise it’s impossible for you to win. You should ditch your humanitarian principles and the only hope for you is to fight evil with evil,’ read one representative comment under the post.
Chinese netizen support for Israeli foreign policy, which goes against the official Beijing position, is still ongoing. Nine sentences sent out by the Israeli Embassy following US President Trump’s decision to recognise Jerusalem as the capital of Israel was the most shared piece of embassy content (the item was shared 2,298 times) in the three-month period covered in this report (Figure 25).65
Figure 25: The most shared piece of embassy content—on the US recognition of Jerusalem as Israel’s capital
The post, which outlines the official Israeli view of the history of Jerusalem, was positively received by Weibo users. ‘The world will rest assured and the people will be satisfied when Jerusalem is given to you,’ reads the most liked comment underneath the post.
‘Put the boot into the cancer of humanity’, the second most liked comment reads—a sentiment typical of a growing anti-Muslim sentiment online that has gone unchecked by Beijing’s censors. Islamophobia has been given a wide berth online in China as authorities continue to crack down in its restive region of Xinjiang. Frequent anti-Muslim comments under many Israeli embassy posts suggest that there’s a perception in their audience that the Israeli Embassy Weibo account is itself anti-Muslim.
A lack of coordination and transparency
But the efficacy of even the most well-resourced and strategic use of Chinese social media platforms such as Weibo is ultimately limited by the party-state. On his second official visit to China in December 2017, Canadian Prime Minister Justin Trudeau sought to parlay his image as a ‘Weibo addict’ into a public diplomacy coup when he made his first stop a visit to Sina Weibo headquarters in Beijing.
Promotional material released before Trudeau’s visit to Weibo claimed the Q&A with the Canadian Prime Minister would be broadcast live, via video stream onto Weibo (Figure 16). But instead of seeing a live-stream of the proceedings, Weibo users at first saw only a delayed 36-second clip of the PM. It was only hours later that more of his appearance was made available.66 As the Canadian Government intended the event to be live-streamed, a reasonable conclusion is that the abrupt cancellation was due to Weibo censors.
Figure 26: A Sina Weibo poster advertising Canadian Prime Minister Justin Trudeau’s video live-stream from Sina Weibo HQ. The poster refers to Trudeau as a ‘Weibo addict’.
Chinese officials, when questioned about the practice of censoring the comments section on foreign embassy Weibo accounts, pass the buck back to Sina Weibo. An exchange between a foreign journalist and an official at a recent Foreign Ministry press conference provides an illustrative example:
Q: Some Chinese investors were angry about the decline in the domestic stock market last week, and they used the US Embassy’s Weibo account to vent, posting comments to that account. On Saturday, we saw these comments have been blocked. Can you tell us your understanding as to what happened there? Does China see that the US is doing anything incorrect in this matter?
A: You might as well ask the US Embassy in China, whose staff is responsible for the maintenance of their own account.
Follow-up: It appears from our report that they did not take actions to block anything. That may have been the Weibo that blocked them.
A: I have not heard about what you mentioned. As I understand, you need to ask them if there are problems with their Weibo account. If the problem cannot be solved, they may contact relevant competent authorities. 67
Conclusion and policy recommendations
It’s estimated that Beijing spends US$10 billion a year on external propaganda, an order of magnitude higher than the US, which spent US$666 million on public diplomacy in 2014.68 Content from Chinese state media has featured in major Western outlets such as The Sydney Morning Herald, The Washington Post, the UK’s Daily Telegraph and Le Figaro as well as on the social media platforms Twitter and Facebook.
The reverse would be unthinkable in the PRC’s tightly controlled media environment. This is despite the fact that the PRC backed a landmark resolution in July 2012 at the UN Human Rights Council, which affirmed that ‘the same rights that people have offline must also be protected online, in particular freedom of expression, which is applicable regardless of frontiers and through any media of one’s choice.’69
Insisting that the PRC uphold the rights of its citizens to engage freely with the legitimate online public diplomacy efforts of foreign embassies isn’t a boutique concern. It’s a parallel issue to seeking reciprocity from the Chinese state for numerous other things, such as intellectual property regimes and market access. The PRC’s online censorship regime cloisters its netizens in an information environment that’s cut off from the rest of the world and primed with a nationalistic ideology. The more the Chinese party-state controls the media to promote its own narrative, the more it limits its own options for how it can resolve international conflicts.70
While CCP statements at the UN are reassuring, the trendlines for censorship in China are moving in the opposite direction. Under Xi’s rule, China has increasingly tightened its grip on the internet, concerned about the erosion of its ideology and policy by a vibrant online culture and the spectre of so-called ‘hostile foreign forces’. As this paper shows, Beijing’s censors aim to use almost imperceptible amounts of censorship to throttle discussion on Weibo that they deem falls outside the frame of discourse acceptable to the CCP party-state. For foreign governments, the temptation to self-censor is increasing.
Foreign governments should demand that Beijing refrain from censoring their legitimate and overt digital diplomacy efforts. Short of that, and probably more powerful for the netizen community, like-minded governments, in coordination with each other, should commit to publishing transparency reports, both to reveal the level of censorship that they’re receiving on Weibo and to demonstrate their commitment to presenting Western political norms and values to Chinese civil society. This can be very influential public diplomacy. It’s important that embassy Weibo accounts speak to China’s diverse netizen groups. Publishing a transparency report about CCP censorship will also inform those groups of their own government’s actions.
The continued meaningful presence of foreign embassy accounts—which occasionally speak outside the bounds of the CCP’s frame of acceptable discourse—will demonstrate those countries’ commitment to presenting Western political norms and values to Chinese civil society.
These accounts can also help reduce misunderstandings between foreign governments and the population of one of the world’s most powerful countries. Changes need to be made to the way governments engage online in China. Those changes need to include preventive measures to stop governments falling into a cycle of self-censorship. This paper makes the following recommendations:
Governments need to become more assertive and more creative in their messaging on Chinese social media platforms. Of course, some content should be tailored for local audiences. But foreign governments must ensure that they’re communicating the same policy and political messages to the Chinese public as they are to other publics around the world. They are likely to be censored for this.
Foreign governments should use uncensored social media platforms such as Twitter—which, despite being blocked in China, still has an estimated 10 million active users in the country 71 — to cross-post all of their content. That way, incidences of censorship will be transparent and available to global audiences. Cross-posting content elsewhere also gives Chinese netizens an alternative avenue to access and engage with uncensored content. The US Embassy’s Twitter account—which as 738,000 followers—provides other countries with a good model.72
When governments have their official content censored on Chinese online platforms, they should raise this censorship directly with their Chinese Government counterparts. Those countries 73 which allow the Chinese Communist Party an open media and cyber environment to communicate all of its official messages should request reciprocity.
The Australian Government needs more avenues to engage the Chinese public and to put different messages forward. Dedicated official accounts for the positions of Prime Minister and Foreign Minister should be established immediately.
Acknowledgements
The author would like to thank Amber Ziye Wang for her help researching this paper. He’d also like to thank Richard McGregor, Peter Cai and Alex Joske for their comments, which greatly improved the final product. He’s also immensely grateful to my colleagues at ASPI, Danielle Cave, Fergus Hanson and Michael Shoebridge, for their crucial assistance.
ASPI International Cyber Policy Centre
The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.
It seeks to improve debate, policy and understanding on cyber issues by:
conducting applied, original empirical research
linking government, business and civil society
leading debates and influencing policy in Australia and the Asia–Pacific.
We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors.
Important disclaimer
This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.
Mareike Ohlberg, Boosting the party voice: China’s quest for global ideological dominance, Mercator Institute for China Studies, 2016, online. ↩︎
Australian Government, 2017 Foreign Policy White Paper, 2017, online. ↩︎
Jon Russell, ‘Twitter estimates that it has 10 million users in China’, TechCrunch, 5 July 2016, online. ↩︎
Jiayun Feng, ‘US Embassy bashes Chinese “political correctness” on Weibo, sending the Chinese internet into a frenzy’, SupChina, 7 May 2018, online. ↩︎
Jiayun Feng, ‘US Embassy bashes Chinese “political correctness” on Weibo, sending the Chinese internet into a frenzy’. ↩︎
Sidney Leng, Jane Li, ‘US, China in fresh row as Beijing tells foreign airlines they will be punished for failing to respect territorial claims, report says’ South China Morning Post, 7 May 2018, online. ↩︎
Ying Jiang, ‘Weibo as a public diplomacy platform’, Social Media and e-Diplomacy in China, 10 August 2017, online. ↩︎
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/03/24160024/weibo-banner.jpg6381914nathanhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngnathan2018-05-29 06:00:002025-03-24 16:02:00Weibo diplomacy and censorship in China
The reality of the world we live in today is one in which cyber operations are now the norm. Battlefields no longer exist solely as physical theatres of operation, but now also as virtual ones. Soldiers today can be armed not just with weapons, but also with keyboards. That in the modern world we have woven digital technology so intricately into our businesses, our infrastructure and our lives makes it possible for a nation-state to launch a cyberattack against another and cause immense damage — without ever firing a shot.
ACS’s aim in participating in this policy brief is to improve clarity of communication in this area. For Australia, both defensive and offensive cyber capabilities are now an essential component of our nation’s military arsenal, and a necessary step to ensure that we keep up with global players. The cyber arms race moves fast, so continued investment in cyber capability is pivotal to keep ahead of and defend against the latest threats, while being able to deploy our own capabilities when and where we choose.
So, too, is ensuring that we have the skills and the talent to drive cyber capabilities in Australia. This means attracting and keeping the brightest young minds, the sharpest skilled local talent and the most experienced technology veterans to drive and grow a pipeline of cyber specialists, and in turn help protect and serve Australia’s military and economic interests.
Yohan Ramasundara President, Australian Computer Society
What’s the problem?
In April 2016, Prime Minister Turnbull confirmed that Australia has an offensive cyber capability. A series of official disclosures have provided further detail, including that Australia will use this capability against offshore cybercriminals.
This was the first time any state has announced such a policy.
However, this commendably transparent approach to telegraphing our capability and intentions hasn’t been without challenges. In some cases, these communications have created confusion and misperceptions. There’s a disconnect between popular perceptions, typified by phrases like ‘cyber Pearl Harbor’, and the reality of offensive cyber operations, and reporting has at times misrepresented how these tools will be used. Public disclosures and the release of the report of the Independent Intelligence Review have also raised questions about how Australia will build and maintain this capability.
What’s the solution?
To reduce the risk of misunderstanding and misperception and to ensure a more informed debate, this policy brief seeks to further clarify the nature of Australia’s offensive cyber capability. It recommends improving communications, using innovative staff recruitment and retention options, deepening industry engagement and reviewing classification levels in some areas. Looking forward, the government could consider increasing its investment in our offensive capability to create an asymmetric capability; that is, a capability that won’t easily be countered by many militaries in our region.
Introduction
Governments routinely engage in a wide spectrum of cyber operations, and researchers have identified more than 100 states with military and intelligence cyber units.1
The cyber units range considerably in both their capability and their compliance with international law. Leaks have highlighted the US unit’s advanced capability, and public documents reveal its size. US Cyber Command’s action arm, the Cyber Mission Force, is building to 6,200 military and civilian personnel, or about 10% of the ADF, and for the 2018 financial year requested a US$647 million budget allocation.2 China has been widely accused of stealing enormous quantities of intellectual property. North Korea has used cyber tools to steal money, including in a US$81 million heist on the Bangladesh central bank. Russia is accused of using a range of online methods to influence the 2016 US presidential election and has engaged in a wide spectrum of actions against its neighbours, such as turning off power stations in Ukraine and bringing down government websites in Georgia and Estonia. Israel is suspected of using a cyber operation in conjunction with its bombing raid on a Syrian nuclear reactor in 2007 by temporarily ‘tricking’ a part of Syria’s air defence system to allow its fighter jets to enter Syria undetected.3
In Australia, the government has been remarkably transparent in declaring the existence of its offensive cyber capability and its applications: to respond to serious cyberattacks, to support military operations, and to counter offshore cybercriminals. It has also established robust structures to ensure its compliance with international law. Three additional disclosures about Australia’s offensive cyber capability have followed the Prime Minister’s initial April 2016 announcement. In November 2016, he announced that the capability was being used to target Islamic State,4 and on 30 June 2017 Australia became the first country to openly admit that its cyber offensive capabilities would be directed at ‘organised offshore cyber criminals’.5 The same day, the then Minister Assisting the Prime Minister for Cyber Security, Dan Tehan, announced the formation of an Information Warfare Division within the ADF.
While these disclosures have raised awareness of Australia’s offensive cyber capability, the limited accompanying detail has meant that the ensuing public debate has often been inaccurate or misleading. One major news site, for example, led a report with the title ‘Australia launches new military information unit to target criminal hackers’.6 Using the ADF to target criminals would have been a radical departure from established protocols.
This policy brief seeks to clarify some of the misunderstandings arising from sensationalist reporting.
The report has the following parts: 1. What’s an offensive cyber operation? 2. Organisation, command and approvals 3. Operations against declared targets 4. Risks 5. Checks, balances and compliance with international law 6. Strengths and weaknesses 7. Future challenges and recommendations.
Tom Uren and Fergus Hanson on Offensive Cyber
1. What’s an offensive cyber operation?
For the purposes of this policy brief, we use a draft definition that’s being developed as part of the Department of the Prime Minister and Cabinet’s Cyber Lexicon project. It defines offensive cyber operations as ‘activities in cyberspace that manipulate, deny, disrupt, degrade or destroy targeted computers, information systems, or networks’.7 Given the range of countries with varying capabilities and using examples from open sources, offensive cyber operations could range from the subtle to the destructive: removing computer accounts or changing passwords; altering databases either subtly or destructively; defacing web pages; encrypting or deleting data; or even attacks that affect critical infrastructure, such as electricity networks.
Even though it may use the same tools and techniques, cyber espionage, by contrast, is explicitly designed to gather intelligence without having an effect—ideally without detection. The Global Commission on the Stability of Cyberspace has commissioned ASPI’s International Cyber Policy Centre to do further work on defining offensive cyber capabilities.
2. Organisation, Command and Approvals
Australia’s offensive cyber capability resides within the Australian Signals Directorate (ASD).8 It can be employed directly in military operations, in support of Australian law enforcement activities, or to deter and respond to serious cyber incidents against Australian networks. While physically housed within ASD, the military and law enforcement applications have different chains of command and approvals processes.
MILITARY
The Information Warfare Division within the Department of Defence was formed in July 2017 and is headed by the Deputy Chief Information Warfare, Major General Marcus Thompson.
Major General Thompson has presented the ADF approach to cyber capabilities as two distinct functions: cybersecurity (consisting of self-defence and passive defence 9), and cyber operations (consisting of active defence and offence 10).
The Australian Government’s offensive cyber capability sits within ASD and works closely with each of the three services, which embed staff assigned to ASD from the ADF’s Joint Cyber Unit. Offensive cyber in support of military operations is a civil–military partnership. The workforce to conduct offensive cyber operations resides within ASD and is largely civilian. Advice from Defence is that the laws of armed conflict are considered during the development and execution of operations, and that ASD personnel will act in accordance with legally approved instructions. There’s no reason to doubt that, and the Inspector-General of Intelligence and Security has noted in the context of cyber operations in support of the ADF operations in Iraq and Syria that ‘guidance in place at the time was appropriate and followed by staff, and no issues of legality or propriety were noted’.
The ability to conduct an operational planning process that takes into account the desired outcome, situational awareness and the possible range of effects is a military discipline that resides in the ADF. This arrangement is expected to continue under proposals from the 2017 Intelligence Review to make ASD a statutory authority within the Defence portfolio.
As clarified in Australia’s International Cyber Engagement Strategy, ‘Offensive cyber operations in support of [ADF] operations are planned and executed by ASD and Joint Operations Command under direction of the Chief of Joint Operations.’11 Targeting for offensive cyber operations occurs in the same manner as for kinetic ADF operations. Any offensive cyber operation in support of the ADF is planned and executed under the direction of the Chief of Joint Operations and, as with any other military capability, is governed by ADF rules of engagement.
The announcement that Australia would be using its offensive cyber capability against offshore cybercriminals created considerable confusion. Public messaging was one contributing factor: the announcement about the ADF’s Information Warfare Division bled into the same-day announcement that the government would also be using its offensive cyber capability to deter offshore cybercriminals, making them appear one and the same thing.14
While some media outlets characterised the announcement as Australia potentially attacking the whole suite of ‘organised offshore criminals’, the announcement focused only on offshore actors who commit cybercrimes affecting Australia.
Decisions on which cybercriminal networks to target follow a similar process to those for military operations, including that particularly sensitive operations could require additional approvals, although the exact processes haven’t been disclosed. Again, these operations would have to comply with domestic law and be consistent with Australia’s obligations under international law.
3. Operations against declared targets
Australia has declared that it will use its offensive cyber capabilities to deter and respond to serious cyber incidents against Australian networks; to support military operations, including coalition operations against Daesh in Iraq and Syria; and to counter offshore cybercriminals. Given ASD’s role in intelligence gathering, operations can integrate intelligence with cyber operations—a mission critical element.
…will use its offensive cyber capabilities to deter and respond to serious cyber incidents against Australian networks…
4. Risks
Offensive cyber operations carry several risks that need to be carefully considered. For cyber operations in support of the ADF, as with conventional capabilities, the commander must weigh up the potential for achieving operational goals against the risk of collateral effects and damage.
When offensive cyber capabilities are used, there’s a high chance that future effectiveness might be compromised. Unlike defending against kinetic weapons, an information system might be protected from cyberattack through relatively simple measures, such as upgrades, patches or configuration changes.
Another risk is that, despite extensive efforts to disguise the origin of the attack, the Australian Government could lose plausible deniability or be identified (including contextually) as the source and face embarrassment or retaliation.
5. Checks, balances and compliance with international law
When the first public disclosure of Australia’s offensive cyber capability was made, the Prime Minister emphasised Australia’s compliance with international law: ‘The use of such a capability is subject to stringent legal oversight and is consistent with our support for the international rules-based order and our obligations under international law.’15
Interviews for this policy brief suggest that the users of the capability take compliance with domestic and international law extremely seriously. The core principles are as follows:
Necessity: ensuring the operation is necessary to accomplish a legitimate military / law enforcement purpose.
Specificity: ensuring the operation is not indiscriminate in who and what it targets.
Proportionality: ensuring the operation is proportionate to the advantage gained.
Harm: considering whether an act causes greater harm than is required to achieve the legitimate military objective.
These capabilities are subject to ASD’s existing legislative and oversight framework, including independent oversight by the Inspector-General of Intelligence and Security. However, there seems to be room for updating these provisions to account for technological developments. Section 7(e) of the Intelligence Services Act 2001, for example, authorises ASD ‘to provide assistance to Commonwealth and State authorities in relation to … (ii) other specialised technologies’—a foundation that could be strengthened for 21st-century technological applications.
When seeking approval for operations from the Minister for Defence, ASD seeks legal, foreign policy and national security advice from sources external to Defence. Every offensive cyber operation is planned and conducted in accordance with domestic law and is consistent with Australia’s obligations under international law
6. Strengths and weaknesses
Offensive cyber capabilities have both strengths and weaknesses.
STRENGTHS
For military tasks, they can be integrated with ADF operations, adding a new capability and creating a force multiplier.
They can engage targets that can’t be reached with conventional capabilities without causing unacceptable collateral damage or overt acknowledgement.
They provide global reach.
They provide an asymmetric advantage against an adversary for a relatively modest cost.
They can be overt or clandestine, depending on the intended effect.
WEAKNESSES
Capabilities need to be highly tailored to be effective (such as the Stuxnet worm that targeted Iran’s nuclear centrifuges), meaning that they can be expensive to develop and lack flexibility.
When used in isolation, they are unlikely to be decisive.
Major, blunt attacks (such as Wannacry or NotPetya) are relatively cheap and easy, but are unusable by responsible state actors such as Australia. Achieving the appropriate specificity and proportionality requires investment of time and effort.
The capability requires constant, costly investment as cybersecurity evolves.
Government must compete for top-tier talent with private industry.
For operations short of ‘cyber attacks’,16 the effects can be relatively short-lasting and limited.
Capability can’t be showcased as a deterrent in the same way that conventional capability can, because revealing specific capability renders it redundant as defences are repaired.
Target development can require intensive intelligence support and can take a very long time.
7. Future challenges and recommendations
Offensive cyber operations are relatively new and developing in a fast-moving environment. Below are issues and recommendations stemming from research for this report.
RECOMMENDATION 1: CAREFULLY STRUCTURE COMMUNICATIONS TO REASSURE NATION-STATES AND ENFORCE NORMS
As Australia’s offensive cyber capability has only recently been publicly acknowledged and is subject to sensationalist reporting, careful communication is required. When he first acknowledged the capability, the Prime Minister said doing so ‘adds to our credibility as we promote norms of good behaviour on the international stage’.17 Poor communications, however, can have the opposite effect. The limited detail and mixed reporting of the announcement that Australia would use offensive cyber capability against offshore cybercriminals inadvertently sent the message that it was acceptable for states to launch cyberattacks against people overseas whom they considered to be criminals. This might encourage some states to use crime as a pretext to launch cyber operations against individuals in Australia.
To address this, the Australian Government should be careful when publicly discussing the offensive capability, particularly to distinguish the military and law enforcement roles. One option to do this would be to have the Attorney-General, the Minister for Justice or the new Home Affairs Minister discuss operations related to law enforcement aspects of the capability and to have the Minister for Defence discuss those related to military capabilities.
RECOMMENDATION 2: USE INNOVATIVE STAFF RECRUITMENT AND RETENTION OPTIONS
Recruiting and retaining Australia’s top technical talent is a major hurdle. In the medium term, ASD will have to continue to invest heavily in training, raise salaries (ASD becoming a statutory authority will help it address this) and develop an alumni network and culture that allow former staff to return in new roles after a stint in private industry. A pool of alumni working as cleared reservists could also be used as an additional workforce without the significant investment required in conducting entirely new clearances.
RECOMMENDATION 3: DEEPEN INDUSTRY ENGAGEMENT
ASD capability being deployed against cybercriminals is likely to generate increased interest from corporate Australia. There’s a policy question about whether or not Australia’s offensive cyber capability should be used in support of Australian corporate interests. Given the finite resources and the tricky situations that could arise, government should consider useful ways industry could engage, clarify the limits of industry engagement and assess how to handle industry requests to use the offensive cyber capability against actors targeting its operations.
RECOMMENDATION 4: CLASSIFY INFORMATION AT LOWER LEVELS
It has long been argued that over-classification of material, such as threat intelligence, by governments prevents easy information exchange with the outside world, including key partners such as industry. The government has recognised this and is positioning ‘Australian Cyber Security Centre (ACSC) 2.0’ to facilitate a more cooperative and informed relationship with the private sector. Similarly, the government should continue to scope the potential benefits from lowering the classification of information associated with offensive cyber operations. In particular, there are benefits in operating at the SECRET level for workforce generation and training, and providing a ‘halfway house’ to usefully employ incoming staff as they wait during vetting procedures. More broadly, excessive classification slows potentially valuable two-way information exchange with the information security community.
RECOMMENDATION 5: INVEST TO CREATE AN ASYMMETRIC CAPABILITY
The 2016 Defence White Paper noted that ‘enhancements in intelligence, space and cyber security will require around 900 ADF positions’.18 Those positions were part of the $400 million 19 in spending announced in the White Paper and will be spread across the ADF. While this is significant, given the limits of what can be achieved with current spending on conventional kit, the Australian Government should consider conducting a cost–benefit analysis on the relative value of substantial further spending on cyber to provide it with an asymmetric capability against future adversaries. This would need to include a considerable investment in training.
RECOMMENDATION 6: CONSIDER UPDATING THE POLICY AND LEGISLATIVE FRAMEWORK
There appears to be sufficient legislation, policy and oversight to ensure that ASD and the ADF work together in a lawful, collaborative and cooperative manner to support military operations. The 2017 Independent Intelligence Review noted that ASD’s support to military operations is indispensable, and will remain so.
While those oversight arrangements may be sufficient for now, the ADF will inevitably need to incorporate offensive cyber on the battlefield as a way to create local effects, including force protection measures and to deliver effects currently generated by electronic warfare (such as jamming communications technology). It should not always be necessary to reach back to the national authorities for clear-cut and time critical battlefield decisions. There appears to be scope to update the existing policy and legislative framework that governs the employment of offensive cyber in deployed operations to support those kinds of activities.
Important disclaimer
This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.
Noah Shachtman, Peter W Singer, The wrong war: the insistence on applying Cold War metaphors to cybersecurity is misplaced and counterproductive, Brookings Institution, Washington DC, 15 August 2011, online. ↩︎
Michael S Rogers, Statement of Admiral Michael S Rogers, Commander, United States Cyber Command, before the House Committee on Armed Services Subcommittee on Emerging Threats and Capabilities, 23 May 2017, p. 1, online; Laura Criste, ‘Where’s the cyber money for fiscal 2018?’, Bloomberg Government, 19 July 2017, online. ↩︎
Thomas Rid, Cyber war will not take place, Oxford University Press, 2013, p. 42. ↩︎
Malcolm Turnbull, ‘Address to parliament: national security update on counter terrorism’, 23 November 2016, transcript, online. ↩︎
Malcolm Turnbull, ‘Offensive cyber capability to fight cyber criminals’, media release, 30 June 2017, online. ↩︎
‘Cyber warfare: Australia launches new military information unit to target criminal hackers’, The Australian, 30 June 2017, online. ↩︎
The Internet of Things (IoT) is the term used to describe the growing number of devices being connected to the internet. Some of the more common IoT devices include home appliances such as Google Home, wearable devices, security cameras and smart meters.It’s been predicted that the number of connected devices was close to 8.4 billion in 2017 and that there will be over 20 billion devices connected by 2020.1 Even though the IoT has been developing since the rise of the internet in the early 1990s, there’s no universally accepted definition. Kevin Ashton, who coined the phrase in 1999, says the IoT is much more than just connected appliances and describes it as a ‘ubiquitous sensor network’ in which automation leads to innovation.2 While there are some justifiable cybersecurity concerns about the IoT, there are also many notable advantages to living in a connected world. The IoT is saving lives through advanced healthcare technology, manufacturers are saving time and money through automation and tracking, and a plethora of home devices are adding value to people’s lives by providing a range of different services.
There are many different ways to categorise IoT devices, which makes safeguarding the technology challenging. The IoT can be dissected by industry, such as healthcare, transport, manufacturing and consumer electronics. One major subcategory of the IoT has earned its own acronym: the IIoT, to which control systems belong. Another way of categorising devices is by looking at their individual capabilities. Devices that can take action pose a different threat from devices that simply collect data to report back to the user.
The IoT offers benefits to all industries, but the connectivity of these once isolated things also introduces new vulnerabilities that can affect our homes and industries. As well as promising convenience and efficiency, the IoT is a problem because a vast number of internet connected devices with poor default security create a large attack surface that bad actors could take advantage of for malicious ends. A variety of international organisations and government groups are working on issues pertaining to the IoT, but at present there’s no coordinated vision to implement standards for the IoT on a global scale. Similarly, in Australia, a host of different cyber agencies and industrial groups are working to overcome some of the cybersecurity issues that the IoT presents, but a coordinated strategy detailing how government and industry can collaborate on the IoT is needed.
This issues paper aims to give a broad overview of IoT issues to increase awareness and public discussion on the IoT.
In December 2017, ASPI’s International Cyber Policy Centre produced a discussion draft asking stakeholders key questions about IoT regulation, governance, market incentives and security standards to help inform this issues paper. We received responses from government, industry representatives, technical experts and academics. While those stakeholders were consulted in the research phase of this paper, the views here are those of the authors.
THREAT TO CRITICAL INFRASTRUCTURE
In 2016, a severe storm disrupted crucial services in South Australia, resulting in a loss of power for 850,000 customers.3 Trains and trams stopped working, as did many traffic lights, creating gridlock on flooded roads. The storm, together with the failure of backup processes, resulted in the death of a number of embryos at a fertility clinic in Flinders Hospital.4 The total cost for South Australian businesses as a result of the blackout was estimated to be $367 million.5
Some have noted that, due to the interconnectedness of infrastructure, this event mirrored the potential effects of a large-scale cyberattack.6
Disrupting utilities that power an entire city could cause more damage than traditional terror tactics and can be done externally and with more anonymity.
Again, severe storms demonstrate that a loss of power can cause more deaths than the physical destruction of infrastructure.
When Hurricane Irma caused the air conditioning at a Florida nursing home to fail, 12 residents died of suspected heat-related causes.7
Digital weapons are being used intentionally by nation-states to inflict physical destruction or compromise essential services. The now infamous attack on Iran’s nuclear program, known as Stuxnet, used infected USB drives to contaminate computer systems with malware,8 which caused physical damage to a number of uranium centrifuges.9 In 2015, hackers used stolen user credentials to attack a Ukrainian power grid, which resulted in loss of power for more than 230,000 people.10 In 2016, the attackers used malware specifically designed to attack Ukraine’s power grid to disrupt the power supply to Kiev. This indicates that malicious actors have both the resources and the intent to develop cyberattack capabilities targeted at essential services.11
The IoT overlaps with critical infrastructure because many control systems are also now connected to the internet. Kaspersky researchers found more than 3,000 industrial control systems in Australia by using Shodan and Censys IoT search engines.12 Studies have also revealed vulnerabilities in control systems made by major vendors, such as Schneider Electric and Siemens.13
In the discussion version of this paper, several respondents expressed the view that a separate cyber organisation focusing specifically on the security of critical assets and services would be unhelpful. However, many acknowledged a need for greater collaboration between those responsible for protecting these assets to help mitigate IoT-related threats.
The Australian Cyber Security Centre (ACSC) could seek to increase coordination between owners and operators of critical assets, helping with the technical aspects of adopting voluntary industry standards for the IoT. The ACSC has the technical expertise to participate in the formation of international standards and could work with policy experts in the Department of Home Affairs to encourage national adoption.
THE CYBER LANDSCAPE IN AUSTRALIA
The cyber landscape in Australia is complex. Government cybersecurity responsibilities have recently been reorganised through the establishment of the Department of Home Affairs and structural changes to the Australian Signals Directorate and ACSC. Getting a clear picture of roles and responsibilities was difficult, and it would be beneficial to identify any gaps in roles and responsibilities after these recent organisational changes have been properly implemented. Industry roles could be identified in an IoT road map that helps industry and government bodies work together to more effectively mitigate IoT threats. Consumers should be educated on cybersecurity and responsible ownership of IoT devices, including patching and updating, building on initiatives such as Stay Safe Online.
The IoT has exacerbated an already confronting problem: the lack of skilled cybersecurity professionals both nationally and globally.
The Australian Cyber Security Growth Network estimates that a further 11,000 skilled experts will be needed in the next decade.14 In January 2018, the network announced that cybersecurity qualifications will be offered at TAFE institutions around Australia, which is a significant step forward.15 However, cybersecurity is a broad domain that requires not only workers with technical skills but also experts in risk management and policymaking, among other areas. Advances in automation and data analytics could help to address the skills shortage, as those technologies will increase the availability of cybersecurity experts, by replacing technical jobs in other areas.
We need to think about IoT security as a holistic system that combines practical skills-based training with industry best practise. The under-representation of women in cybersecurity has been widely noted and overcoming it was listed as a priority in Australia’s Cyber Security Strategy.16 The government has conducted research to better understand the issue and is running workshops to help increase participation.17
SECURITY RATINGS AND CERTIFICATIONS
A number of countries, including Australia, are considering the value of security ratings for IoT devices. In October 2017, Dan Tehan, the then Minister Assisting the Prime Minister on Cybersecurity, suggested in a media interview that such ratings should be created by the private sector, not by the Australian Government.18 The UK Government is also exploring ‘how to encourage the market by providing security ratings for new products’, as outlined in its National Security Strategy.19 Introducing a product security rating for consumer electronics has the potential to improve awareness of cybersecurity issues and to encourage industry to adhere to minimum security standards. But whether the ratings should be initiated by government or industry is only the beginning of the issue, as there are several problems with cybersecurity ratings that need to be addressed.
First, the vulnerability of an IoT device could potentially vary over its lifetime as weaknesses are discovered and then patched. The energy efficiency of a refrigerator or washing machine, by contrast, is relatively fixed, and so energy-efficiency ratings can be trusted over the device’s lifetime. With IoT devices, new vulnerabilities are constantly being exposed. At best, a security rating would reflect the security of a device based on the information available at the time of the security assessment. It would need to be adapted as security standards evolve and new vulnerabilities are discovered.
Second, it’s worth investigating whether a cyber rating could lull consumers into a false sense of security by negating their own role in protecting themselves from attack. Before implementing a security rating system, we need to research whether purchasing a device that claims to be secure could make consumers less likely to install updates or change default passwords.
Third, as mentioned in the introduction of this report, there’s considerable variation in IoT products. A Jeep Cherokee and a baby monitor (both of which have been compromised) present vastly different dangers, but the compromise of either can have serious consequences. While all IoT devices should include baseline security features in the design phase, devices deemed to be high risk should also require commensurately robust security features. Burdening otherwise cheap, low-risk devices with expensive certifications or strict security regulations, however, could make them commercially unviable in Australia. It’s important to recognise that it will be challenging and expensive to come up with a rating that appropriately addresses all the different categories of IoT devices.
In 2018, the IoT Alliance Australia (IoTAA) is prioritising the introduction of an ‘IoT product security certification program’ as a part of its strategic plan.20 Exactly what this will look like remains unknown, but it’s likely to be performed by accredited independent bodies that evaluate products based on security claims. The Australian Information Industry Association recommends an accreditation scheme that would also certify organisations making IoT devices. The authors’ view is that some manufacturers (for example, Samsung) make so many products that this would be ineffective as a stand-alone tactic, but this idea could be used in collaboration with an individual product rating.
REGULATION AND STANDARDS
Regulation and standardisation are at the forefront of the IoT debate, and positions tend to be polarised, as reflected in the responses to our discussion draft. The respondents acknowledged that regulation isn’t always effective and can impose a significant cost, but some also said that there’s potentially room for government to play a more direct role if a device is deemed to provide a critical service to the community. Some industries, such as transport and healthcare, already have safety standards addressing a wide range of security concerns; those standards need to prioritise current and emerging cybersecurity threats.
Multiple IoT-related bills introduced into the US Congress last year exemplified some of the legislative attempts to enforce IoT security by way of law. The Internet of Things (IoT) Cybersecurity Improvement Act of 2017 stresses the importance of built-in security and the provision of security patches,21 while the Cyber Shield Act of 2017 seeks to introduce a voluntary certification process for IoT devices.22
While US lawmakers have proposed some government regulation, some in Australia believe that IoT security would be more effectively regulated by industry.
Legislation takes time to introduce and often struggles to keep pace with the quickly evolving technology it seeks to control.
Taking a market-driven approach to IoT security may mean that imposed standards will more rapidly adapt to the changing security climate.
Some classes of IoT devices, however, present little threat to their owners, but their poor security allows them to be co-opted in ways that can be used to harm other internet users or internet infrastructure. This is similar to a widget-making factory that causes air pollution; the factory owner and widget buyer both benefit from lower costs of production and neither has a strong incentive to do the work needed to reduce air pollution, as that would raise costs. In economics, this is described as a negative externality, and negative externalities can be effectively dealt with through regulation. The authors’ view is that incentives do not exist for effective industry-led standards to develop, especially for consumer IoT devices.
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) are the two major global providers of standards. The ISO and IEC have a joint technical committee focusing on information technology and a subcommittee focusing on the IoT and related technologies. Australia is a member of the subcommittee through Standards Australia. ISO/IEC also has the 27000 series, which is a series of standards that addresses the security of information security management systems.23
The European Union Agency for Network and Information Security released baseline security recommendations for the IoT in late 2017.24 Standards have also been developed in Asia, including a draft policy on the IoT by India25 and a general framework by Japan.26 Other organisations working on IoT standards include the IEEE (Institute of Electrical and Electronics Engineers), The Open Group, and SAE International. While a considerable amount of work on IoT standards has been completed, a draft report on the status of global IoT standards by the National Institute of Standards Technology in the US indicates that there’s a long way to go. The report reveals several gaps in current standards development and implementation, including network security, IT system security evaluation and system security engineering.27 It also highlights the variety of SDOs (standards development organisations) working in this space. There’s currently a need for international consensus on IoT standards and a clear pathway to implementation.
Locally, the IoTAA has drafted multiple versions of IoT security guidelines to help promote secure designs for manufacturers and to support industry in understanding security and privacy issues. The IoTAA has also outlined key focus areas for 2018 in its Strategic Plan to Strengthen IoT Security. Australia also has iotsec, a non-profit start-up that promotes security in IoT devices to help industry and consumers.
While regulation and standardisation are often thought of in a binary way (enforced by either government or industry), the feedback from the discussion draft highlighted the importance of approaching IoT security in a holistic manner, in which government, industry and consumers all play a role. Furthermore, IoT cybersecurity is a problem of global, not national, proportions. Devices sold in Australia are manufactured all over the world. Being only a small proportion of the IoT market, Australia risks becoming a dead-end market if device makers’ security costs outweigh their income from sales. For this reason, any attempt to introduce standards for IoT devices in Australia must be done with a global mindset. The challenge now is to reach international consensus and to encourage manufacturers to adopt the standards. An IoT definition would help to focus global efforts both to secure and to develop the technology and help to articulate its scope.
CONCLUSION
The IoT offers Australia many economic and social advantages and should be embraced and used to benefit all Australians. However, it also introduces new risks and vulnerabilities that our current regulatory systems aren’t necessarily mitigating effectively.
It’s the authors’ view that our current policy and regulatory settings are almost certainly sub-optimal, but effective management of the IoT from a government policymaking perspective requires many difficult trade-offs, and easy answers aren’t immediately apparent. Corruption of traditional ICT devices such as phones and laptops has resulted in the theft of both personal and corporate data. Connecting more devices, such as watches, whitegoods, automobiles and industrial equipment, has intensified this problem and introduced new types of threats. Other incidences of organised crime and terrorism have shown that malicious actors exploit seams in systems, regulation and security.
For this reason, it is imperative that we continue to address gaps in these areas to limit opportunities for the exploitation of IoT devices.
This paper is intended to illuminate some of the issues involved in managing IoT risk so that industry and government can have a robust discussion and work collaboratively to improve the security of IoT devices.
Gartner, ‘Gartner says 8.4 billion connected “things” will be in use in 2017, up 31 percent from 2016’, 2017, Gartner.com, online. ↩︎
Rain RFID Alliance, ‘RAIN Q&A with Kevin Ashton RFID and the internet of things’, 2015, pp. 1–4 ↩︎
IEEE. Sagar Samtani, Shuo Yu, Hongyi Zhu, Mark Patton, Hsinchun Chen, Identifying SCADA vulnerabilities using passive and active vulnerability assessment techniques, University of Arizona, 2016 ↩︎
National Institute Standards Technology, Interagency report on status of international cybersecurity standardization for the internet of things (IoT), 2018, pp. 54–55 ↩︎
Important disclaimer This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.
Acknowledgements We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors but special mention in this case should go to JACOBS, which has supported this research.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/03/12160643/city-at-night-Static.jpg10801920nathanhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngnathan2018-03-19 06:00:192025-03-12 16:32:40The Internet of Insecure Things
Another major government digitisation scheme—digital identity—is set to cause controversy and risk further disempowering Australians in the absence of clearer policy and legislative controls. That’s problematic because digital identity has the potential to power the 21st-century economy, society and government by providing easy, high-confidence verification of identity that will allow millions of offline transactions to move online and enable a string of enhanced services, such as easy delegation of authority (for example, to pick up prescriptions) and verifications (such as proof of age online).
However, the national digital identity program, known as GovPass, faces obstacles on multiple fronts:
Public communication about the scheme and its implications has been wanting, leaving the public largely unaware of the change afoot.
A key biometric enabling service for digital identity, the Face Verification Service (FVS), risks being conflated with the far-reaching law enforcement biometric enabler—the Face Identification Service (FIS)—that’s part of the same national facial biometric matching capability agreed to by Australian Government and state and territory government leaders in October 2017. The FIS lacks adequate safeguards and in its current form is likely to attract public opposition far exceeding that directed towards the My Health Record scheme.
The government is now building two digital identity schemes that will compete against each other. The first, which is already operational, was built by Australia Post at a cost of $30–50 million and is known as Digital iD. The second scheme, GovPass, secured $92.4 million in the 2018–19 Budget to create the infrastructure that will underpin it and fund its initial rollout.
Neither GovPass nor Digital iD is governed by dedicated legislation, beyond existing laws such as the inadequate Privacy Act 1988, leaving Australians vulnerable to having their data misused.
The lack of clarity about how the private sector will and will not be able to use the schemes will turbocharge the ability to gather detailed profiles of individual Australians. Controls are needed to prevent a Western version of China’s ‘social credit’ scheme emerging.
What’s the solution?
National multi-use identity schemes have a poor track record in Australia. To gain public approval for this major reform, the government needs a fresh approach that places the citizen at the centre of the system. To help restore public confidence in digital initiatives after a string of failures, the introduction of this reform needs to be accompanied by an overhaul of citizens’ and consumers’ rights so that they’re fit for purpose in the 21st century.
The government should work with civil society to stimulate and lead a national debate on the benefits of digital identity, including medium- to long-term plans for the scheme. It should emphasise the strengthened protections that the public will gain against the encroachment on citizens’ rights that this and other digital reforms are producing.
Proposed legislation enabling the FVS and FIS should be far more tightly drafted, paring back the applications that the FVS and the FIS can be used for and precisely defining their uses. Dedicated legislation should be introduced to govern both government digital identity schemes.
Opportunities should be explored to avoid duplication between the two schemes. Protections for individuals in the schemes should be strengthened to prevent private-sector actors using the service to build profiles of individual citizens and on-selling those profiles in a for-profit version of China’s social credit scheme. While detailed customer profiles can already be built through methods such as loyalty programs, digital identity will enable a vastly expanded range of activities to be linked to verified identities and so exponentially expand the scope for profile building and ranking if left unchecked.
Introduction
The 2014 Financial System Inquiry recommended that the government ‘develop a national strategy for a federated-style model of trusted digital identities’ that would be accessible for both public and private identity verification.1 The recommendation was subsequently agreed to by government.2 Creating this digital identity is a major micro-economic reform. How it’s deployed, structured, understood and protected will fundamentally shape the sort of Australia we end up with.
On 5 October 2017, the then Prime Minister and state and territory leaders laid the foundation for digital identity when they agreed to establish a ‘national facial biometric matching capability’. This connects national, state and territory photographic databases via an exchange. It has two key components. The FVS will use the exchange to allow digital identity verification. This is a one-to-one image-based verification that matches a person’s photo against an image on one of their government records (such as a passport photo) to help verify their identity. The second component, the FIS, is a one-to-many image-based identification service that matches a photo of an unknown person against multiple government records to help establish their identity and is designed for law enforcement purposes.3
What’s digital identity?
Digital identity is essentially a credential scheme allowing you to quickly confirm your personal details, entitlements and authorisations, such as proving you are over 18 years old or an Australian citizen, online or in person via your phone.
It requires a one-off verification—for example, by photographing your driver’s licence with your phone (the details of which are then checked against the relevant government database) or, for higher level verification, taking a selfie (which is then checked against a biometric template of your face that the government has collated).4
The selfie is tested against only one image—the document consented to and nominated by the individual.5 Through the FVS, the selfie would be checked separately against a template of the photos that it’s compared against, which would be your driver’s licence photo, a passport photo or a visa/citizenship photo.
Stored on a mobile app, you can use this digital identity to transact with government and companies (for example, by entering your phone number on their websites and then providing permission to undertake the identity check via your digital identity mobile app) or in person, without needing to carry a wallet and identity documents.
Australians make more than 800 million transactions with government annually; 26 million of those transactions involve face-to-face verifications, and more than 300 million require phone or other authentications. Some 750,000 applications for tax file numbers are made each year, requiring in-person verification or the sending of certified copies—a process that can take up to 40 days.6
More broadly, the government operates more than 30 different logins for online services.7 A single government digital identity can simplify this landscape, allowing a single login for each individual across governments—federal, state and territory—and also simplify the 800 million transactions. This can significantly reduce irritation on the part of citizens accessing government services, and if done properly should in fact enhance privacy by tailoring the amount of personal information disclosed to the bare minimum required for the specific transaction. It has many other far-reaching applications, such as improving child safety online, reducing cyberbullying and de-anonymising the online experience.
Decoding the jargon
MyGov: the existing common credential for authenticating to many government departments, but without strong identity verification (generally, you have to prove who you are to each department).
MyGovID: the brand name for the Australian Taxation Office’s (ATO’s) new ‘Commonwealth digital identity provider’ (formerly, AUSid). This is the portal through which people can validate their identity under the GovPass scheme.
GovPass: the overall system name for the federated identity scheme of the Digital Transformation Agency (DTA). MyGovID will be one of the components of GovPass and will allow people to validate their identity. GovPass is a DTA-led multiagency program in which the DTA plays an oversight, integration and delivery role, working in collaboration with the ATO, the Department of Human Services (DHS) and the Department of Home Affairs.
Trusted Digital Identity Framework (TDIF): the standards that describe the GovPass identity federation, which include provision for multiple identity providers, subject to their accreditation (currently Australia Post’s Digital iD and the ATO’s MyGovID).8 This creates consumer choice, but also means that all identity providers need to maintain high security standards if citizens’ data is to be protected. The TDIF defines the requirements to be met by government agencies and organisations in order to achieve TDIF accreditation for their identity services (for example, as an identity provider).
Face Verification Service (FVS): a one-to-one image-based verification service that can match a person’s photo against an image on one of their government records, such as a passport photo, to help verify their identity. Often, these transactions occur with the individual’s consent.9
Face Identification Service (FIS): a one-to-many image-based identification service that can match a photo of an unknown person against multiple government records to help establish their identity. Access to the FIS will be restricted to agencies with law enforcement or national security related functions.10
Boston Consulting Group has estimated that digital identity could save $11 billion annually ‘through reduced cost to serve, cost of fraud and improved customer experience’.11 Deloitte Access Economics has estimated ‘productivity and efficiency savings of $17.9 billion over 10 years (if we reduce the number of transactions completed via non-digital channels from 40 percent to 20 percent)’.12Identity crime is estimated to cost over $2.2 billion annually and affects one in five Australians during their lives.13While the government estimates that it costs $17–20 each time someone tries to prove their identity to access a service, the cost of doing so digitally is somewhere between $0.40 and $2.00.14 Various different schemes are already operational in places such as New Zealand (RealMe), the UK (GOV.UK Verify), India (Aadhaar), Estonia (ID-card), Sweden and Norway (the last two have separate systems, both called BankID).
Digital identity, properly applied, should significantly improve users’ experiences when they deal with the public and private sectors. In 2015, 61% of Australians said they had used the internet for their most recent dealings with local, state or federal government, but only 29% were satisfied with their experience, and 58% encountered some problem with the online service. ‘The most common issue was that the process was long or difficult (21%). 15% had technical difficulties and for 13%, the service they needed was not available online. 11% couldn’t remember their user name or password.’15 Digital identity should help significantly to alleviate these problems.
Meet Digital iD and GovPass
The Australian Government is building two competing digital identity schemes. The first one, known as Digital iD, is already operational. It has been developed by Australia Post, an Australian government-owned corporation, at an estimated cost of $30–50 million.16The second is GovPass, a scheme being developed by the DTA.
Australia Post’s Digital iD now has a product team actively selling access to the private sector. This identity service is already accepted in licensed venues in the Australian Capital Territory, the Northern Territory, Queensland, Tasmania and Victoria, and by companies such as Travelex and Airtasker.17For individual users, the scheme is free of charge.
To function, Digital iD uses Australia Post’s access to government identity databases as well as private-sector databases, such as credit header records, and postal records. Creating a digital identity is quick and is done over the Digital iD app.18It essentially involves verifying your mobile number by entering a code sent to your phone and taking a photo of an identity document (driver’s licence, passport or Medicare card), which is checked against the government databases.
To validate your ID on, say, Airtasker, you click ‘connect’ and input your mobile number, and that sends an alert to your phone (Figure 1). Once you open the app, you’re notified that Airtasker would like to connect and are offered the option of ‘connect’ or ‘cancel’. If you hit ‘connect’, you’re notified that Airtasker is requesting confirmation of your identity plus your date of birth and name, giving you the option to ‘allow’ or ‘cancel’.
Figure 1: Using Digital iD to engage with AirTasker
Parallel to the Australia Post scheme, the Digital Transformation Office (now the DTA) was given the task of developing a second scheme, known as GovPass.19 Underway since 2016 (Australia Post’s foundational research on digital identity was also released in 201620), the scheme was initially intended to start public beta testing in mid-2018, but has been delayed.21 It finally secured $92.4 million in funding in the 2018–19 Budget22 to create the infrastructure that will underpin GovPass and roll out the scheme, initially for grants management, the My Health Record, Youth Allowance, business registration, NewStart, the Unique Student Identifier and tax file numbers. The government aims to roll out pilot services to half a million users by the end of June 2019.23
DHS will operate the exchange or gateway between the services and identity providers, the ATO will be the initial identity service provider,24 and the DTA will oversee the program. DHS will be the scheme administrator and the operator of the interoperability hub that will provide access to verification services run by or on behalf of other government agencies. Australia Post will be seeking accreditation as an identity provider (alongside the ATO), in addition to maintaining its existing Digital iD system. The range of actors involved in GovPass and the complexity of the model will make it difficult to deliver the project on time and without incident.
Digital iD is distinguished from GovPass mainly by the fact that it isn’t a federated model (Australia Post is the only entity through which you can verify your identity for Digital iD). It’s envisaged that multiple entities could provide this service under the GovPass scheme, giving consumers choice about which entity they use to prove their identity.
Some companies, such as Mastercard (and likely others) through its My Digital Life program, are positioning themselves to facilitate access to the rich data pools that the digital identity service will enable by serving as a platform through which third-party attribute vendors can sell data on individual Australians. If poorly regulated, these sorts of schemes could create serious privacy issues involving third-party data access. An indicator of this can be seen in the controversy over Facebook providing personal data to third-party organisations, including Cambridge Analytica. (Australia Post isn’t selling access to personal information; rather, companies that use Digital iD to verify their customers’ identities are being enabled to easily gather related data, such as purchase history, location and so on, and link it to a confirmed individual identity.)
A key enabler for both schemes will be the FVS, which will be vital for higher level identity checks that are required for transactions requiring greater confidence that someone is who they say they are, such as creating tax file numbers (Australia Post’s existing scheme currently performs lower level checks using biographic data). This was made possible by the Intergovernmental Agreement on Identity matching Services.25The agreement essentially enabled the federal, state and territory governments to share access to their databases of government-issued photographic identity documents (such as driver’s licence and passport databases) for a broad range of applications spanning road safety, law enforcement and identity checking. For identity checking, this will simplify the process of confirming identity, and the photos will enable higher levels of identity assurance. The FVS’s creation is enabled by the Identity-matching Services Bill 2018, which at the time of writing is still before the House of Representatives.26
As with the Australia Post scheme, it’s envisaged that the private sector will be able to rely on GovPass for identity checking in future. An example of how this would work is Australia Post’s Digital iD, which is already used by Australia’s largest credit union, CUA, for new members applying for some CUA accounts online or via their mobile devices. This allows accounts to be created in minutes without visiting a branch.27
Challenges
The take-up by individuals of digital identity schemes will require the government to overcome challenges in the areas of communication, rights protection, limit setting, coordination, commercialisation and security.
Communication
In all discussions about GovPass, the Australia Card experience looms large, and GovPass has been designed to deliberately distinguish it from previous efforts. The Australia Card was proposed by Prime Minister Bob Hawke in 1985 and eventually led to a double dissolution election before the proposal was dropped. Other failures also overshadow the rollout of GovPass. In 2006, Prime Minister John Howard made another attempt with the Access Card,28before it too was shut down by the new Rudd government in 2007.
The government’s own polling suggests that it’s right to be fearful of scaring the Australian public.
Sixty-nine per cent of Australians are more concerned about their online privacy than they were five years ago. A majority (58%) of Australians are ‘somewhat concerned’ or ‘very concerned’ about biometric data being used to gain access to a licensed pub, club or hotel (although that percentage is down from 71% in 2013), and 56% are concerned about using biometric information for day-to-day banking and 43% for boarding flights.29 Only a third of Australians are comfortable with the government sharing their personal information with other government agencies, and only 10% are comfortable with businesses sharing their information with other organisations.30 The controversy over police access to the My Health Record and the need to add further privacy protections in that scheme also point to heightened public awareness and concern about digitisation processes, including about losing control of personal information that might be used to cause harm.31
The DTA has issued regular updates on the progress of the GovPass scheme, but, with few exceptions, the updates haven’t been brought to the public’s attention by leaders,32 and there’s been very little discussion of the scheme in the media. When the Council of Australian Governments (COAG) announced the key underlying agreement to share identity information and create a national biometric exchange system, the focus was placed on the counterterrorism potential of the biometric database, not the broad digital identity possibilities for the Australian population. As the then Prime Minister said at the time, ‘Imagine the power of being able to identify, to be looking out for and identify a person suspected of being involved in terrorist activities walking into an airport, walking into a sporting stadium … This is a fundamentally vital piece of technology.’33
Ending the erosion of rights
The shift to a digital world is eroding citizens’ rights. With each new digitisation initiative, people are forced to trade off more of their rights for the convenience offered. Repeatedly, they’re assured that everything’s fine, only to discover that they’ve been hoodwinked. ‘Opt in’ becomes ‘opt out’. ‘Safe and secure’, it’s later discovered, means warrantless police access. Over time, people are being disempowered, but these initiatives could have the opposite effect if properly implemented and communicated.
Instead of thinking about how digital identity can solve a departmental problem and focusing narrowly on users’ experience in that context, a citizen-centric perspective is needed. In a citizen-centred society, the role of government should be as the custodian of citizen data—guaranteeing its security and integrity and the citizen’s inviolable rights to and control of their data.34
For government, this requires an overhaul in approach. What’s needed is a root-and-branch review of how citizen protections can be made fit for purpose in the 21st century and of opportunities to take advantage of digitisation to simplify the web of rules that we created for our paper-based society. Those rules are often needlessly complicated due to misaligned incentives between competing bureaucracies and rent-seekers who have fed off complexity. The Australian Treasury’s ‘consumer data right’35 is a step in the right direction to empower citizens, but a far more holistic approach is needed.
Clearer limits are needed
The creation of the FVS and FIS is enabled by the Identity-matching Services Bill 2018, but loose drafting leaves so much scope for unexpectedly broad use of the FIS (for law enforcement purposes) that it risks public backlash against the FVS (which is critical for identity matching). As the backlash against My Health Record demonstrated, sharing without consent is almost certain without well-crafted policy and legislation that’s accompanied by an effective public communications campaign.
An important provision of the COAG agreement that establishes the national biometric exchange system is that it can only be used for ‘general law enforcement’ purposes when suspected offences carry ‘a maximum penalty of not less than three years imprisonment’.36This key provision is missing from the Identity-matching Services Bill.
In practice, this will mean that for requests between jurisdictions (for example, a NSW agency checking a Victorian’s identity), the three-year-penalty rule agreed by COAG would need to be spelled out in interagency agreements. If NSW police wanted to check a photo of a suspect they would need to log the crime the person was suspected of (carrying at least a three-year prison sentence) and then run the check. It’s also possible that they could still run the check if the crime carried at least a three-year penalty in NSW, but less than a three-year sentence in Victoria.37
For intrastate biometric identity searches (such as NSW police searching NSW databases), it’s up to individual states to set any limits on what state police could use the federally run system for (that is, it could potentially be applied to any petty offence). Without clearer restrictions, the FIS in particular is open to serious misuse, especially given the Bill’s stated purpose of allowing it to be used for ‘preventing’ crime.
The parliamentary reviews of the legislation raised multiple concerns about the Bill that are beyond the scope of this paper but point to the need for far tighter controls.38
Competing government schemes and lack of oversight
It’s unfortunate that Australia has ended up with two taxpayer-funded digital identity systems. How this competition will play out is still to be seen. However, given the differences between the schemes and the groups behind them, it’s possible to foresee how it might evolve.
GovPass may dominate for government-linked identity checks, and Digital iD for private-sector identity checks. Australia Post is far more entrepreneurial than most government agencies, and if its scheme continues to operate without dedicated legislation it will also be more attractive to private-sector clients (the private sector’s ability to verify identity using GovPass is likely to be more restricted). Another potential advantage Australia Post might enjoy is working to achieve some degree of global harmonisation by working with other international postal services’ digital identity systems39 (although the DTA is considering similar international harmonisation for GovPass40).
While the Identity-matching Services Bill governs the use of the biometric FVS, it isn’t specifically focused on regulating the GovPass scheme. It’s yet to be decided whether dedicated legislation to cover GovPass will be developed. Given the sweeping applications of the scheme and open questions on issues such as liability, potential for misuse and privacy concerns, legislation is needed for both GovPass and Digital iD.
Commercial applications
Both digital identity schemes offer significant potential benefits for the private sector. If used, they should reduce identity fraud and theft. Some 69% of Australians are concerned about becoming victims of those crimes,41which cost the Australian economy billions of dollars. The schemes will also make it much easier for consumers to transact with businesses and have the potential to better control and manage personal data.
Digital identity will also allow more limited sharing of personal information. At present, most identity checks involve an over-sharing of personal information. The person selling you a beer doesn’t need to know your name, home address, driver’s licence number, or even your date of birth. They just need a yes/no answer that you are 18 years old or older.
However, without safeguards, digital identity opens up the possibility of serious misuse. With digital identity, the shop assistant selling you alcohol might see less of your personal information but, because they are able to confirm who you are, your purchase information could be on-sold to interested parties, such as your health insurer (affecting your premium) or DHS (affecting your cashless debit card payments). The DTA has advised that it’s currently considering establishing an oversight authority, oversight rules, or both, that would seek to prevent the on-selling of data the gathering of which is facilitated through digital identity verification.42This sort of oversight is critical for both GovPass and Digital iD.
As we move to a world where identity can be confirmed easily and cheaply, it opens up the possibility of building up profiles of individuals. If digital identity becomes the de facto way to buy alcohol, log on to social media, buy tickets, travel and shop, all of the data that those transactions collect (such as where you are, how much you spend, what you buy and what you look at) can be linked to an individual identity and sold (via your agreement in fine-print terms and conditions) to a third-party profile builder.
Commercial operators are already exploring this possibility. Mastercard (and no doubt competitors), for example, is considering using Australia as the first country to test and deploy its My Digital Life program. This will be a platform through which third-party ‘attribute vendors’ can confirm different attributes of individual consumers, many of which will be enabled via digital identity. For example, when you engage with a company you have never dealt with before, the company might request half a dozen attributes about you via the My Digital Life app to improve its confidence that you will be a good customer to engage with or are worth offering a higher level of customer service. This might include confirming that you have a perfect credit score, that you always pay your bills on time, that you never gamble, that you purchase fewer than 20 standard drinks of alcohol each week, that you give at least $1,000 a year to charity and that you volunteer. With your consent, My Digital Life will then request confirmation of those attributes from the third parties who have collected this information to on-sell via platforms such as My Digital Life and will send the results to the requesting company.
The private sector has been a leader in the development of ‘know your customer’ best practices and privacy protections, and some sharing of attributes (such as credit scores, police checks, speciality licences and working with children certificates) may facilitate commerce and community engagement. However, without tighter constraints, the potential applications of Westernised versions of China’s social credit scheme could seriously encroach on basic rights.
Security
It’s difficult to provide detailed cybersecurity risk assessments of GovPass (which is still being designed) and Digital iD (for which detailed architectural designs aren’t available). However, one area where risks are likely is in spoofing the FVS. Researchers in the US have demonstrated that wearing specially designed eyeglass frames ‘can effectively fool state-of-the-art face recognition systems’.43Technical means to overcome these immediate challenges are likely to emerge, but this demonstrates that biometrics won’t be a panacea for identity fraud.
More broadly, this ASPI policy brief has identified several issues of concern, including the security risks presented by having multiple identity providers, each of which will need to maintain rigorous security standards, as well as the potential for the schemes to be used to facilitate vastly more ambitious profile building of Australians. There also appears to be no legislative impediment to the ATO using its existing powers to use the GovPass exchange to request information that would allow for data matching—something likely to attract public concern. Data from the ATO-run MyGovID identity service portal could be used to match a particular user with other government services. The DTA exchange is designed at a technical level to resist an identity provider trying to do this sort of matching but won’t stop an authority with legislative power to demand the data.
A range of other security-related issues remain open. If either or both of the schemes are widely adopted, it’s unclear whether companies could mandate the use of them (for example, for online banking), making them de facto compulsory. It’s also unclear whether companies that have traditionally not required validated identity checks could start to do so. For example, companies such as Facebook that have a real-name policy could adopt mandatory digital identity verification for Australian users to enforce that policy.44
Opportunity ahead
Despite the challenges, digital identity is critical for a 21st-century economy. Done properly, it will allow citizens to enhance their privacy by sharing less personal information and save time by doing more things online with less hassle. If it’s accompanied by an overhaul of citizens’ rights, it could put Australians back in charge of their online lives, allow them to monitor and easily contest inappropriate uses of their data, and remove unnecessary regulatory and legislative complexity as the shift from offline to online proceeds.
Features of GovPass
User-centred design: User-centred design is a key principle for GovPass, and the program is being developed in accordance with the Digital Service Standard, which aims to ensure that digital teams build government services that are simple, clear and fast.45In addition, the TDIF has a component dealing with usability and accessibility requirements that government agencies and organisations need to meet in order to be accredited under the TDIF.
Privacy: The GovPass platform’s conceptual architecture is designed to be consistent with ‘privacy by design’ principles. Personal information that’s essential to provide the requested service will be collected and used with informed consent.46 Govpass has been designed as a federation of identity providers and an exchange using ‘double-blind’ architecture. Having the exchange means the service doesn’t see your identity documents, the identity provider doesn’t know what service you’re accessing, and your identity attributes aren’t stored centrally. The exchange merely passes those attributes on to the service. It doesn’t retain the attributes, but only some logs to record what occurred. The DTA advises that its research suggests that there’s community demand for multiple identity providers so citizens have choice for different transactions (for example, using a government provider for government transactions and a private-sector entity for commercial transactions).
Express consent: The GovPass program has been explicitly designed to be ‘opt in’ for users, although other schemes such as My Health Record have transitioned from ‘opt in’ to ‘opt out’. The exchange will be the vehicle for a user to express consent. Once a user has established their identity through an identity provider, the exchange will ask them to consent for their attributes to be passed to the requesting service (relying party). Unless the user gives explicit consent, the attributes can’t be passed on.
Recommendations
1. Accompany the introduction of digital identity with an overhaul of online citizens’ and consumers’ rights.
In democracies, governments exist to serve the citizenry, so it’s only logical that the citizen be placed at the centre as far-reaching schemes such as digital identity are introduced. Helpfully, this will also provide the most important ingredient needed for the success of digital identity: trust.
The government should conduct a root-and-branch review of how citizen protections can be made fit for purpose in the 21st century and of opportunities to take advantage of digitisation to simplify rules created for our paper-based society. This should include ensuring that minimum security baselines and rules for data use are maintained, regardless of who has custody of the information (government or the private sector).
The review should look at reforms that provide citizens with easy and meaningful control over their data. It should consider providing citizens with an online log every time their personal information is accessed by any arm of government or the private sector, and with a one-click process for contesting any access they believe may be unauthorised. It should allow citizens to decide who can access different components of their data (such as individual records) and provide strong default settings to protect those who don’t bother to adjust their settings.
The Privacy Act should be amended, including to create a principle that all digital identity checks gather only the minimum necessary personal information and where possible in de-identified ways (such as via yes/no answers for proof-of-age verification, rather than date of birth transmission).
2. Communicate with the public about the schemes and the accompanying rights overhaul.
After announcing a review to strengthen online citizen protections, the government should lead a national debate on the benefits of digital identity schemes, including by outlining medium- to long-term plans for the schemes and the strengthened protections that citizens will receive to guard against encroachments on their rights. This should include the production of an issues paper that clearly sets out the major implications and long-term plans for digital identity. The paper should be followed up with traditional consultation mechanisms, such as town hall meetings, industry round-tables and media engagement.
3. Place both Digital iD and GovPass under legislative oversight and protect both schemes from overreach. Expressly prohibit ‘social credit’ schemes that are facilitated by government-enabled digital identity checking.
Given that Digital iD and GovPass rely on government identity databases to operate and have far-reaching applications, both schemes should be brought under dedicated legislative oversight. The legislation should place strict limits on information about individual citizens that can be gathered through the use of digital identity verification and on-sold. The development of social-credit-style schemes should be expressly prohibited.
4. Explore options to join the schemes.
Opportunities should be explored to avoid duplication between the two schemes. This could include reviewing whether Australia Post’s already operational scheme could be adopted as a national scheme (and GovPass scrapped, although keeping the existing FVS), or strengthened sufficiently so that it is suitable by drawing on the TDIF. At a minimum, Australia Post should replace the ATO as the government identity provider under the GovPass scheme. This would be consistent with one of the DTA’s own core procurement principles of avoiding duplication by not building platforms that other agencies have already built.47
5. Apply stricter and clear limits on the use of biometrics at the federal, state and territory levels.
The governance of the FIS is largely beyond the scope of this paper, but is still relevant because current overreach threatens to undermine the digital identity schemes. Parliamentary inquiries into the Identity-matching Services Bill have exposed a litany of shortcomings, including inadequate privacy protections, insufficiently precise drafting, potential for overreach, and the key issue that Australians never consented to having their photographs for government identity documents repurposed for use in the biometric identity matching services now being contemplated.
Identity matching uses a relatively benign one-to-one match of a particular user’s photo against a reference photo via the FVS (although, as this policy brief has outlined, it could still be seriously misused if sufficient controls aren’t in place). The FIS is a one-to-many match of an unknown user against millions of possible matches, which has far-reaching privacy implications and the potential for serious misuse and expansion into many-to-many matching by adjusting the way the FIS works. Specific recommendations to strengthen the Identity-matching Services Bill have been provided in a separate submission to the Parliamentary Joint Committee on Intelligence and Security.48
6. Establish a national taskforce.
Discussions with government agencies working on different applications of face-matching services, which include the FVS and the FIS, suggest that second- and third-order consequences of different aspects of the schemes haven’t been considered because they fall outside specific agency or department remits. Developments at the state and territory level and within the private sector also need to be considered as part of a national approach that puts citizens at the centre. A taskforce (federal, state and territory) that includes key private-sector and civil society actors should be established to ensure that whole-of-nation implications are considered and addressed.49
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission.
Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.
First published October 2018
Cover image: Illustration by Wes Mountain. ASPI ICPC and Wes Mountain allow this image to be republished under the Creative Commons License Attribution-Share Alike. Users of the image should use this sentence for image attribution: ‘Illustration by Wes Mountain, commissioned by ASPI’s International Cyber Policy Centre’.
Michael Keenan, ‘Delivering Australia’s digital future’, address to the Australian Information Industry Association, 13 June 2018. Angus Taylor, ‘National standards to support government digital ID’, media release, 5 October 2017. Sara Howard, Unlocking up to $11 billion of opportunity, Australia Post, 5 December 2016. ↩︎
Angus Taylor, ‘What a Govpass digital ID would look like for Australians’, media release, 17 October 2017 ↩︎
Australia Post, A frictionless future for identity management: a practical solution for Australia’s digital identity challenge, White Paper, December 2016, p. 7 ↩︎
Australia Post, Choice and convenience drive ‘digital first’ success, Insight paper, November 2016, p. 5 ↩︎
One-off versions can also be created on the Australia Post website. ↩︎
Rachel Dixon, ‘Digital identity: early days in the discovery process’, DTA, 8 March 2016 ↩︎
Australia Post, Digital identity white paper: a single digital identity could unlock billions in economic opportunity, no date ↩︎
Taylor, ‘National standards to support government digital ID’. ↩︎
Australian Government, Budget 2018–19: Budget strategy and outlook, Budget paper no. 1, 2018–19, pp. 1–22 ↩︎
Keenan, ‘Delivering Australia’s digital future’. Level 2 identity verifications don’t require biometric verification. Four of the eight services being developed require a Level 2 identity verification and therefore aren’t dependent on the FVS. ↩︎
Keenan, ‘Delivering Australia’s digital future’. ↩︎
OAIC, Australian community attitudes to privacy survey, 2017, p. ii. ↩︎
Dana McCauley, ‘Health Minister backs down on My Health Record’, Sydney Morning Herald, 31 July 2018 ↩︎
Keenan, ‘Delivering Australia’s digital future’. ↩︎
Karen Barlow, ‘Turnbull dismisses privacy concerns in asking for a national facial recognition database’, Huffington Post, 4 October 2017 ↩︎
See David McCabe, ‘Scoop: 20 ways Democrats could crack down on Big Tech’, Axios, 30 July 2018 ↩︎
The Treasury, Consumer data right, Australian Government, 9 May 2018 ↩︎
COAG, Intergovernmental Agreement on Identity Matching Services, p. 12. ↩︎
There’s provision in the COAG agreement to review this after the first 12 months of operation; COAG, Intergovernmental Agreement on Identity Matching Services, section 4.25. ↩︎
Parliament of Australia, Identity-matching Services Bill 2018. ↩︎
Sara Howard, A world without borders, Australia Post, 19 December 2016 ↩︎
Asha McLean, ‘DTA considering international “brokerage” of digital identities’, ZDNet, 9 February 2018 ↩︎
OAIC, Australian community attitudes to privacy survey, 2017, p. 33. ↩︎
The potential oversight authority would have legal authority to enforce operating rules and the TDIF on participants of the identity federation. The operating rules would set out the legal framework for the operation of the identity federation, including the key rights, obligations and liabilities of participants (including relying party services). ↩︎
Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, Michael Reiter, ‘Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition’, CCS 16, 24–28 October 2016, Vienna, p. 12 ↩︎
‘What names are allowed on Facebook?’, Facebook, 2018 ↩︎
DTA, Digital sourcing framework for ICT procurement, Australian Government, no date. ↩︎
Parliamentary Joint Committee on Intelligence and Security, Review of the Identity-matching Services Bill 2018 and the Australian Passports Amendment (Identity-matching Services) Bill 2018, ‘Submissions received by the committee’, submission no. 18↩︎
GovPass has a steering committee that reports to the Digital Leadership Group and is exploring how to broaden the group. ↩︎
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/03/13094523/Preventing-another-Australia-Card-fail_staticbanner.png24803508nathanhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngnathan2018-03-18 06:00:312025-03-13 10:08:41Preventing another Australia Card fail
Media are invited to attend a special event featuring former US top cyber adviser Chris Painter hosted by ASPI’s International Cyber Policy Centre (ICPC) on the future of cyberspace and emerging technologies. Question our panel on some of the world’s pressing global issues including the impact of emerging tech on national security, cyber threats to our election process, the changing nature of cyber-conflict and the rise of censorship and strict information control in the Asia-Pacific.
Panel:
• Chris Painter, former US State Department Coordinator for Cyber Issues and White House Senior Director for Cybersecurity Policy; • Dr Tobias Feakin, Australian Ambassador for Cyber Affairs, Department of Foreign Affairs and Trade • Professor Elanor Huntington, Dean, College of Engineering and Computer Science, Australian National University • Fergus Hanson, Head of the International Cyber Policy Centre (chair)
Date: 28 February 2018 Time: 1630 – 1730 Venue: ASPI, Level 2, 40 Macquarie St Barton Canberra
A canapes and drinks reception will conclude the event. Chris Painter is in Australia as the inaugural distinguished fellow at ASPI’s International Cyber Policy Centre (ICPC). His visit is made possible thanks to the generous support of DFAT’s Cyber Affairs Special Visits Program, Macquarie Telecom Group and ICPC core sponsors
To register your attendance please contact:
Renee Jones, Events and Communications Manager, ASPI
E: reneejones@aspi.org.au
M: 0400 424 323
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2024/04/17135358/v2Artboard-1-copy-scaled.jpg8532560markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2018-02-27 17:36:002024-11-15 17:38:40ASPI Cyber Masterclass ‘In Conversation: The future of cyber and emerging technologies’
Australian Strategic Policy Institute’s International Cyber Policy Centre (ICPC) is pleased to announce Chris Painter – former State Department Coordinator for Cyber issues and former White House Senior Director for Cybersecurity Policy – as its inaugural distinguished cyber fellow for 2018.
Chris has been on the vanguard of US and international cyber issues for over 25 years – first as a leading federal prosecutor of some of the most high-profile cybercrime cases in the country, then as a senior official at the Department of Justice, the FBI, the National Security Council and finally as the world’s first top cyber diplomat at the State Department.
“I am very happy to come back to Australia and spend time with my friends at ASPI’s ICPC and my many friends and colleagues in government, business and civil society. Australia has always been a strong partner on cyber policy and combatting cyber threats. As technical and policy threats increase in cyberspace it is imperative that we work together to promote an open and secure cyberspace, promote stability in cyberspace, and find new ways to deter bad actors,” Chris Painter said.
“Chris has made an extraordinary contribution to the world of cyberspace and national security and we’re delighted to host him at ASPI. Chris’s research at the centre will look at some of the big strategic issues in cyber affairs,” Head of ICPC Fergus Hanson said.
Chris will be in Australia from the 20th Feb until the 10th March. He will participate in a range of meetings, roundtables and events including the ASPI Cyber Masterclass on 28 February. Watch our event page and @ASPI_ICPC for more information. For media enquiries please contact reneejones@aspi.org.au / 0400 424 323
Chris’s visit is made possible thanks to the generous support of DFAT’s Cyber Affairs Special Visits Program, Macquarie Telecom Group and ICPC core sponsors.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2024/04/17135358/v2Artboard-1-copy-scaled.jpg8532560markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2018-02-05 17:43:002024-11-15 17:44:53Top US cyber adviser Chris Painter announced as ASPI distinguished fellow
Danielle Cave, a senior analyst at the Australian Strategic Policy Institute, said that Twitter is playing an increasingly important role in open-source intelligence, the collection of sensitive information from publicly available sources. Researchers from think tanks, nongovernmental organizations and the corporate sector who are at the cutting edge of cybersecurity work gravitate to the platform to exchange information, she said.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2024/04/17135358/v2Artboard-1-copy-scaled.jpg8532560markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2018-01-30 17:59:002024-11-15 18:00:55What He Did on His Summer Break: Exposed a Global Security Flaw – The New York Times
According to Tom Uren, cyber security expert from the Australian Strategic Policy Institute’s ‘International Cyber Policy Centre’, the discovery revealed potentially unknown bases. “It’s one thing to be able to see people walking in and out of offices in Canberra…it’s another thing to know where people run, where they go into buildings, and what buildings are important.” He described the map as piece of a puzzle “bad actors would try and use to further their ends”. “Anything that gives you a pattern of life can be used against you by bad actors. It makes it easier, and when you are making it easier for your opposition, that’s never a great thing.”
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2024/04/17135358/v2Artboard-1-copy-scaled.jpg8532560markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2018-01-30 17:58:002024-11-15 17:59:26US military to review policies after fitness tracker exposes base locations – Channel 9 News