In part 1 of this series, we talked about Australia’s rapidly changing strategic environment. In this follow-up, we focus on ways that Australia’s foreign policy funding models should adapt to accommodate to this new environment.

Research commissioned to inform decision-makers must be empirical, data-driven and policy-relevant.

But there’s been a widespread trend across think tanks globally to focus on opinion and analysis rather than original and comprehensive research. Academic foreign-policy-focused research brings different challenges because, globally, the sector is encouraged to publish in formats (journal articles, academic books) that aren’t timely, easily accessible or regularly read by policymakers.

Original empirical research that is policy-relevant ishard and costly to conduct but is infinitely more useful to policymakers as it is grounded in facts and new datasets that help inform policy recommendations, rather than abstract analysis.

The Australian government should provide incentives for grant recipients to conduct policy research in teams for a more rounded approach.

Many foreign policy challenges now cut across so many different areas (security, technology, economics, human rights, and so on) and are so complex that it can be impossible for any individual to grapple with them alone. Teams with wide expertise allow for a much richer range of approaches to empirical research and a more holistic view of policy problems.

We have built our research output at ASPI’s International Cyber Policy Centre by developing agile teams that constantly change and evolve to suit the topic. This enables us to weave in diverse expertise such as multiple languages or deep country or thematic knowledge, in addition to unique open-source intelligence skills such as working with geospatial information and big data and using information operation investigative techniques.

Government departments tend to fund research using very small buckets of ad hoc money—though exceptions include Defence’s annual strategic policy grants program and long-term funding arrangements that some departments, including Foreign Affairs and Trade, have with Australian universities.

This small-bucket approach encourages production of reports based on short-term, and shallower, research efforts. These reports are cheaper to produce, and prioritise analysis and opinion over original data-driven work. They are a less considered and robust contribution to policymaking.

To overcome this, departments should pool some of their multiple small grants into a smaller number of bigger grants and/or increase grant sizes.

They should offer grants with less restrictive bidding parameters. Our centre secures most of its grants by identifying empirical research gaps and then pitching projects to likely funders to address them. But government departments commonly request proposals that fit within narrow bands and meet short-term objectives. They are drafted in such restrictive ways that they limit opportunities for innovative solutions.

Governments may have genuine questions they need help answering, and there’s clearly a legitimate market for such grants, but the best think-tank contribution is often empirical research that grapples with policy questions just ahead of public servants’ immediate concerns.

For departments and agencies that fund research, the challenge is the natural tendency to focus on the current issues of concern, not those about to be encountered. With the lead times involved in bidding for grants, awarding them and then delivering the research, policymakers often commission research that addresses yesterday’s issues and fails to help them with the challenges they face.

All funders would like to have a say over any research they’re paying for, and without funders no research would take place at universities, think tanks or elsewhere. However, to deliver high-quality, independent research, it’s not tenable to give funders influence over research products.

Having worked in multiple think tanks that zealously protect their independence while taking funding from multiple sources, it’s clear to us that true research independence is certainly achievable.

There are risks, especially when creating new entities. A think tank funded by a government department without a charter that guarantees independence (like ASPI’s does) would quickly become captured by the department and would struggle to deliver anything of value. Similarly, placing think tanks inside institutions like universities can also be tricky, because the new think tank can easily be captured by the priorities and views of the host.

The government should provide a pool of grants for untied research that tackles sensitive topics.

The best research think tanks produce is often work no one will fund. If it breaks new ground it’s often difficult to convince potential funders of its merit.

If it’s on topics that government departments consider sensitive—such as foreign interference or most matters associated with China, besides economics—policymakers will actively avoid funding it, no matter how much they need it.

Awarding some large grants can enable breakthrough research initiatives.

The university and think-tank models haven’t innovated much over the past century, but advances in technology and changes to the information ecosystem have made the policy-relevant research space ripe for new approaches.

Supporting new and technology-heavy infrastructure requires substantial funding that short-term grants won’t cover. Given the likely rewards for policymakers, capital investments could help research institutes build such infrastructure.

A pool of grants should also be established for quick and timely research. From time to time, opportunities arise for timely research that current funding models don’t accommodate.

For example, social media companies periodically make available large datasets of state actor disinformation operations to research institutes. The window for timely analysis is anywhere from a few days to a week. Other empirical research opportunities arise in times of crisis, such as during the Covid-19 pandemic. To enable research that seizes on these opportunities, consideration could be given to making small and medium rapid-release grants for timely, policy-relevant projects.

It’s possible to raise new funding and grow the pool for public policy research, but it’s not easy. With a few exceptions, such as the Lowy family that funds the Lowy Institute, there’s not a tradition of non-government funding, including business, foundation and civil-society funding, for public policy research in Australia.

The government could encourage that practice through greater public recognition, public–private partnerships and tax concessions to increase the pool of non-government research funding.

The underlying message from the G8 universities’ submission to this inquiry appears to point to a concern that high-quality, highly relevant think-tank research threatens to take attention and funding from university research. It would be unfortunate to view research in this field in such zero-sum terms. We need more high-quality, policy-relevant research from both universities and think tanks.

Australia’s foreign policy community, unlike those of the United States or Europe, suffers from a lack of movement between government, think tanks and the business community. This partially reflects the small size and relative immaturity of the Australian think-tank sector, but it’s also deeply cultural.

Most public servants in this sector have never worked outside government, and sometimes never outside their department or agency. The public service makes this movement difficult and, culturally, many departments and agencies haven’t valued outside experience and expertise.

We’re aware of many examples where high-performing think-tankers and others in the business community have sought to return to the government department they started their career in only to be told they’d have to return to the APS level they left the department at. Giving no recognition to the five to 10 years of non-government experience they’ve acquired (including new skills, perspectives and networks) makes the transition back to government untenable.

This narrow and culturally entrenched outlook is slowly changing, but encouraging a flow of people between foreign-policy-focused government and non-government roles would help.

Mixed backgrounds also need to be valued more in government recruitment and promotion processes. Departments need more senior executives who have worked outside them and who bring a more three-dimensional view of Australia’s place in the world, including looking at our foreign policy challenges from different angles, rather than having experienced a view from one department. APS staff should be guaranteed unpaid leave when they seek to take up certain foreign-policy-relevant roles outside government. And the numbers of secondments from government into policy-focused think tanks (currently minimal) should be significantly increased.

Data has been referred to as the ‘new oil’ or ‘new gold’, but it’s more than that. Most organisations can’t function without it. That applies equally to governments.

Australian government data creation, collection, storage and analysis has grown and continues to grow, as does government reliance on it. With continued government policy directions promoting increased outsourcing of data storage, processing and cloud storage, the value and protection that disaggregation and diversification generate may be lost in the absence of appropriate oversight.

Our new ASPI report, Devolved data centre decisions: opportunities for reform?, launched today, looks at the unintended consequences of the government’s procurement arrangements for data centre services. It is aimed at shaping a better conversation on issues, challenges and factors to consider in the management of outsourced data centre arrangements.

Despite the intent of the Digital Transformation Agency’s Data Centre Facilities Supplies Panel, current arrangements place a high level of onus on individual agencies to identify and mitigate risks in the absence of whole-of-government oversight. This limits the opportunity to respond in a coordinated manner to wider interests of government, including those relating to concerns about supply chains and concentrated data holdings.

Established in 2010 as part of the Australian Government Data Centre Strategy 2010–2025 and following Peter Gershon’s 2008 review of the government’s use of information and communication technology, the panel aimed to address the high cost of ICT procurement through a coordinated approach.

The business case was based on analysis suggesting that an estimated $1 billion could be saved over 15 years through a data centre strategy that included a supplier panel.

But the panel has resulted in aggregation of government data holdings, raising the risk of single points of failure, where one breakdown could prevent the government from delivering its services. Aggregation also fosters a lack of diversification in providers, which could reduce innovation.

The high cost associated with moving to alternate data centre providers has created barriers to exit, which in turn stifles opportunity and reduces market flexibility. This in essence establishes a conflict with competition policy outcomes. The cost of transitioning to a different provider may also be higher due to increased contract lengths and extensions. That’s both a symptom and a driver of a level of market capture.

Concerns about the government’s ICT procurement arrangements are well documented. The 2017 DTA Report of the ICT Procurement Taskforce identified impediments to improving ICT procurement across government, including a lack of centralised policies, coordination, reporting, oversight and accountability. The report attributed this to more than 20 years of devolved agency decision-making; the limited capability and risk-adverse nature of the Australian public service with a focus on compliance; a fear of failure; poor collaboration; and industry engagement.

However, the taskforce’s recommendations and the government’s response failed to address data centre procurement, which also includes issues related to the ability and maturity of small to medium-sized agencies to adequately respond to tenders. Such difficulties may be amplified in agencies that are inconsistent in their preparation and assessment of tenders, lack transparency and consistency in decision-making, and have a poor understanding of the costing models used in the data centre market.

What is needed over a five-year horizon, given this changing environment, is a clearer conversation and greater confidence in controlled ownership.

While the unintended consequences of current arrangements have been discussed in some detail, aspects relating to sovereignty, critical infrastructure and 5G network ownership are flagged as areas needing further consideration in the context of outsourced data centre services.

Our report highlights critical issues for consideration and resolution, including the lack of a whole-of-government overview and the fragmentation of management of data security. The absence of a single entity accountable for whole-of-government data centre outcomes results in increased data risk, the perpetuation of market distortions and reduced market flexibility. Accountability has been pushed down to the departmental level. Given the limited resources of small and medium-sized agencies, this drives the selection of convenient options, which in turn establishes barriers to taking advantage of market flexibility and efficiency. While the mandate of the DTA is to provide policies, standards and guidance, it lacks resources and the authority to drive whole-of-government ICT outcomes.

In addressing these challenges, it will be important to respond at two levels. The risk that’s caused and amplified by the aggregation of data centres must be mitigated.

There’s also the need to establish oversight and accountability, including a strategy for managing of government information and data assets, going beyond the current agency-by-agency approach. An authority set up to manage this would have objectives relating to data security and management of overall data risks as well as promotion of market flexibility and efficiency.

On 1 September the director-general of the Australian Signals Directorate, Rachel Noble, gave a well-publicised speech titled ‘Long histories—short memories: the transparently secret ASD in 2020’. The themes were that the agency would be as transparent as an inherently secret agency could be about its role and the legal constraints upon it, and a pride at how it had evolved from the primitive Defence Signals Bureau in 1947 to the highly capable and technologically advanced organisation of today.

Many listeners probably expected a proud reference to ASD’s official history, commissioned by Noble’s predecessor Mike Burgess in 2019 and scheduled for publication in 2022. Instead, there was silence on this project, followed a few days later by the revelation that the history, on which work was already well advanced, had been decommissioned.

The decision was both regrettable and surprising. The reasons for the disappointment were underlined shortly afterwards when the UK’s GCHQ, ASD’s senior partner in the Five Eyes network, published its own authorised history. In a foreword the head of GCHQ said that explaining the agency’s past, and being open about its successes and failures, was an essential basis for ‘maintaining our licence to operate’. Just as GCHQ was following MI5 and MI6 in publishing official histories, so ASD had appeared to be following the tradition established by ASIO, which had recently published a three-volume official history. ASD’s choice of John Blaxland as its official historian was based on his substantial contribution to the ASIO history.

Both the British and Australian agencies have evidently decided that such histories contribute to developing the public trust that is essential for secret agencies to operate effectively. Moreover, the GCHQ history includes substantial coverage of the origins of signals intelligence and cryptanalysis in Britain. Noble told a Senate estimates committee that her decision was based on Blaxland’s extensive coverage of the early history of sigint in Australia.

The ASD decision was surprising in the context of recent developments affecting Australia’s intelligence and security agencies, since Malcolm Turnbull’s government announced two decisions in 2017. By accepting the recommendations of the independent intelligence review by Michael L’Estrange and Stephen Merchant, the government endorsed the upgrading of the Office of National Assessments to the Office of National Intelligence, with the broad remit of coordinating the work of the entire intelligence community.

This was consistent with the vision of the principal architect of that community, Justice Robert Marsden Hope, in his two royal commissions in the 1970s and 1980s. Intelligence agencies, he said, should serve the whole of government, and not be dominated by one or two powerful policymaking departments. They should be coordinated by an agency responsible to the prime minister. Policymaking should similarly be a whole-of-government matter, coordinated by ministerial and official committees, with no single department given a predominant role.

On the same day that Turnbull announced the upgrading of ONA to become ONI, he also announced the creation of the Department of Home Affairs. A number of intelligence and law enforcement agencies were placed into a mega-portfolio, with a strong policy mindset of ‘keeping Australians safe’. This ran counter to several of Hope’s fundamental principles, including the separation of intelligence from policymaking, the separation of collection from assessment, and the separation of intelligence from law enforcement.

Since then, a number of events and announcements gave rise to the charge that Peter Dutton as minister and Michael Pezzullo as department head were seeking to turn Home Affairs into an even more wide-ranging ‘Department of National Security’, encroaching on the terrain of other departments.

In recent months, there appears to have been a change of tack, designed to achieve the same strategic goal. The apparent aims have been twofold: to establish the central role of Home Affairs in all matters of national security, and to enable ASD to monitor Australian ‘bad actors’. The tactics have included much greater emphasis on public presentations by the heads of intelligence and security agencies, all emphasising the importance of transparency.

Noble’s speech, for example, was part of a series of presentations at the Australian National University’s National Security College. Mike Burgess has made a number of public presentations, first as ASD head and then as head of ASIO, all emphasising the importance of making secret agencies as transparent as possible about their past, current and likely future activities. Readers of The Strategist will be aware of the series of four interviews with Paul Symon, the head of the Australian Secret Intelligence Service, currently being published.

The Australian malefactors who are in the agencies’ sights are, it is stressed, not only terrorists but also paedophiles, and the work of AUSTRAC on associated money-laundering has had a considerable impact.

These presentations refer frequently to the existence and powers of oversight agencies, including the Inspector-General of Intelligence and Security, the Australian Commission for Law Enforcement Integrity, and the Parliamentary Joint Committee on Intelligence and Security. Noble’s presentation to the National Security College was consistent with this approach, but the decision to decommission the history was in sharp contrast.

While Dutton has kept a lower profile, Pezzullo has continued to argue publicly, in several interviews, that Australia faces an unprecedented number of threats to its security, that his role as secretary of Home Affairs is central to the coordination of Australia’s response, and that the expanded role of ASD is an important element in Australia’s capabilities. It was noteworthy that Pezzullo attended Noble’s presentation at the National Security College, but the outgoing director-general of national intelligence, Nick Warner, did not.

Following these mixed signals comes the government’s appointment of Andrew Shearer as the new head of ONI. As a former deputy director-general of ONA, Shearer is likely to share that organisation’s pride that its assessments are guaranteed by legislation to be independent of ministerial or departmental influence. Having been a senior adviser to Coalition prime ministers and most recently Cabinet secretary, he would be exceptionally well qualified to ensure that ONI fulfils the role envisaged by Hope and reinforced by L’Estrange and Merchant—an agency that will coordinate the entire intelligence network, responsible to the prime minister and providing independent intelligence assessments to policymakers at the highest level, but not dominated by any one department.

The signals from the intelligence community in the coming months and years should be carefully monitored.

Australians have learned severe lessons with the disruption of public health management during the Covid-19 pandemic and its social and economic consequences. Now, the nation has been alerted to serious cyberattacks, which Prime Minister Scott Morrison said were carried out by ‘a sophisticated state-based cyber actor’.

There’s also been an increase in such attacks on individuals and businesses by criminals using the pandemic as cover.

Given these increasing national security threats, we must take very seriously the state of cyber security in Australia. What happens if a key part of our economy is badly unprepared for malicious cyber activity? What impact might a successful attack have on the nation?

Small businesses make up a third of Australia’s economy. They are defined as having an annual turnover of less than $2 million or employing fewer than 20 people. They are inherently diverse, ranging from childcare and healthcare centres, to government and industry suppliers.

The pandemic has illustrated the importance of childcare to working parents. Consider the national impact if all of Australia’s childcare centres were suddenly unavailable. A concerted cyber campaign that closed down thousands of centres would have serious consequences for entire communities, with major implications for governments.

Other potential targets for malicious actors could be the health practitioners who have access to the sensitive data of nearly all Australians. The impact if this data were stolen and if the practices were unable to operate could be devastating.

And might poor cyber hygiene in a small business with authorised access to Defence Department networks provide an enticing ‘back door’ to our military secrets?

While large enterprises in Australia have generally enhanced their cybersecurity measures in recent years, small businesses operate in a very different environment. Big firms typically have dedicated IT staff and detailed information-security policies and practices.

In contrast, small businesses often have just enough staff to deliver a particular service, tight budgets and time-poor owners who might also manage the IT despite having a limited understanding of cybersecurity principles.

The reality is that most small businesses are highly vulnerable to malicious cyber activity. The Australian Cyber Security Centre has been warning of this, particularly during the Covid-19 crisis. It has issued advisory alerts outlining the increasing threat posed by criminals using Covid-19 themes and taking advantage of society’s distraction and uncertainty during the pandemic to carry out attacks online against individuals and small businesses.

The inaugural Australian cybersecurity strategy was released in 2016 to help Australian businesses boost their cyber resilience. The strategy noted the importance of the sector to the nation, and its vulnerabilities.

Attempts to turn that intent into tangible outcomes have been disappointing to date, as shown in the findings of the Cyber Security Centre’s recently released small business survey.

The government needs to provide more sophisticated leadership in this domain—to encourage small businesses to enhance their cybersecurity for their own sakes and so that they can strengthen national cyber resilience.

The government has mechanisms it could use to stimulate this outcome. The right policies might encourage the designers of new products and services to place greater emphasis on security and privacy from the start. Technical standards are another area in which the government could insist on improved online security—for example, the domain name system, encrypted certificate standards, and secure email protocols.

The government also has a key lever at its disposal in the myriad supply chains of small business providers. Making enhanced security part of the accreditation process for those suppliers could encourage them to start to increase their own cyber resilience. That would spill over into their private online security, with all the flow-on benefits.

The government could also directly enhance cybersecurity for the nation generally, including small businesses, by developing and testing common cybersecurity ‘toolsets’ across government departments, and then making them available publicly. The UK offers an example of such a strategy, through its ‘active cyber defence’ initiative.

Finally, the government could do more to help small businesses accurately assess their own levels of cyber resilience and understand practical measures they can take. An easy-to-understand cyber maturity model and certification framework that resonates with time-poor, cash-strapped business owners might encourage them to do their part in growing the sector’s cyber resilience.

Improving the cyber resilience of thousands of small businesses is not just about their wellbeing. It’s an important element of strengthening the nation against serious cyber threats.

The roller-coaster nature of Australia’s history with Indonesia—high moments of great optimism, low periods of clash and argument—means that Indonesia’s foreign policy elite is cautious when contemplating the idea of Australia joining ASEAN. But it’s something that Australia’s policy elite might well contemplate.

As one example of Australia’s thinking about Indonesia, note Tony Abbott’s view that it’s ‘in many respects our most important overall relationship’. Heading off to Jakarta on his first overseas trip as PM in 2013, Abbott saw the approach to Indonesia as vital: ‘It’s probably not realistic to think of Australia having the same relationship as it has with New Zealand but that’s the direction you would like it to move in.’

The Oz–Kiwi relationship has a depth of history and culture that we’ll never have with Indonesia. But Abbott is surely right that Indonesia is a central factor in Australia’s regional future. I could offer quotes of a similar tenor from every Australian PM going back to Menzies (although the Menzies embrace of the idea of living with Indonesia forever was deeply coloured by dread).

As another example, see Paul Keating’s 2012 Murdoch lecture, in which he argued that Indonesia will become Australia’s most important strategic partner:

How things go in the Indonesian archipelago, in many respects, so go we. Indonesia remains the place where Australia’s strategic bread is buttered. No country is more important to us—and it is a country which has shown enormous tolerance and goodwill towards us. Focus on this country should be a major imperative driving our foreign policy.

An Australian move to join ASEAN would be about the centrality of Southeast Asia to our strategic and economic future. And at the heart of that equation is Indonesia.

A discussion of Australia joining ASEAN is also a way to conceptualise a deeper association with Indonesia. The importance of Indonesia should feed into the understanding of what Australia could do with ASEAN. The bilateral builds towards the regional, just as the regional fosters the bilateral.

The previous Indonesian foreign minister, Marty Natalegawa (2009–2014), rejects Keating’s call for Australia to join ASEAN, arguing that it’d be a distraction for ASEAN and could even inflame tensions inside Australia about our alignment with Asia. Natalegawa’s two big worries are China tearing apart ASEAN and the Jokowi administration musing about a ‘post-ASEAN’ diplomacy.

In both areas, Canberra should argue that a bigger Australian role in ASEAN would be more of an asset than a hindrance. Australia joining ASEAN would help, not hurt, the middle-power game with China.

Natalegawa’s predecessor as foreign minister, Hasan Wirajuda (2001–2009), took a more technocratic approach when I spoke to him about Australia joining ASEAN. Wirajuda pointed to the formal veto—not being part of Southeast Asia —plus an informal rule that a member of ASEAN can’t be part of another regional grouping, as Australia is in the Pacific Islands Forum.

The response to those points is that Australia, as a nation on its own continent, has a series of regions. And formal rules can be changed as circumstances change.

In discussing the Australia-into-ASEAN idea, Wirajuda says he sees it as a replay of the debate within ASEAN about admitting Australia (and New Zealand) to the East Asia Summit: ‘I communicated with my counterparts, early on, especially when Australia was invited to joined the EAS, and said, accelerate the process of integration of Australia into this region, first into ASEAN but then into a larger community-building process.’

Wirajuda says the integration argument succeeded in the EAS, but failed when he was pushing for Australia to be admitted to the Chiang Mai Initiative, the currency swap arrangement between ASEAN, China, Japan and South Korea. He’d strongly supported Australia joining Chiang Mai, but China was even more emphatic in rejecting Australian membership.

Wirajuda’s advice on Australia’s way ahead with ASEAN: ‘I think Australia should make itself more accepted by the region. Speed up your integration—less in a formal process—more in substance.’ He thinks that integration could lead to the moment when ASEAN admits Australia, initially as a half-member with observer status—shifting Australia from the status it has had since 1974 as an ASEAN dialogue partner.

‘I think in the future we should be open, ASEAN should be open to create this special status of observer’, Wirajuda says. ‘So far we work under the ASEAN-plus-one dialogue process, we have a regular dialogue process with Australia. In effect, it would not be much different with observer status, as the ASEAN-plus-one dialogue is done back-to-back with the summit. To me, the margin of difference between dialogue partner and observer is not so much.’

I asked Wirajuda whether reaching for Australian ASEAN membership would be seen as too ambitious, raising too many questions for ASEAN. Ever the diplomat, Wirajuda replied with a meditation on whether Australia would be able to play by the club rules: ‘In the dialogue process, ASEAN-plus-one, our partners can raise anything. But, of course, our partners know how the consensus decision-making process works in ASEAN, which also is perhaps a handicap for our partners.’

Australia’s shift towards ASEAN could happen in step with the broadening and deepening of what Australia seeks to do with Indonesia. That is the perspective of a former head of Singapore’s Ministry of Foreign Affairs, Kishore Mahbubani. Here he is making the yes case for Australia’s ASEAN membership. And here are Mahbubani’s further thoughts on how Australia’s embrace of its strategic and economic future in Southeast Asia would move in step with its central relationship, with Indonesia:

Your relations with Indonesia have got to change. You have to show much greater sensitivity to them, closeness to them. Right now you have a good formal relationship, but it’s all about government-to-government, not a heart-to-heart relationship with Indonesia. Mind you, I don’t expect a big-bang change. I think it will be gradual for Australia.

Australia’s gradual movement towards Indonesia must be closer and deeper, just as it must be with ASEAN.