Tag Archive for: Critical & Emerging Technology

Engineering global consent: The Chinese Communist Party’s data-driven power expansion

The Chinese party-state engages in data collection on a massive scale as a means of generating information to enhance state security—and, crucially, the political security of the Chinese Communist Party (CCP)—across multiple domains. The party-state intends to shape, manage and control its global operating environment so that public sentiment is favourable to its own interests. The party’s interests are prioritised over simply the Chinese state’s interests or simply the Chinese people’s interests. The effort requires continuous expansion of the party’s power overseas because, according to its own articulation of its threat perceptions, external risks to its power are just as likely—if not more likely—to emerge from outside the People’s Republic of China’s (PRC) borders as from within.

This report explains how the party-state’s tech-enhanced authoritarianism is expanding globally. The effort doesn’t always involve distinctly coercive and overtly invasive technology, such as surveillance cameras. In fact, it often relies on technologies that provide useful services. Those services are designed to bring efficiency to everyday governance and convenience to everyday life. The problem is that it’s not only the customer deploying these technologies—notably those associated with ‘smart cities’, such as ‘internet of things’ (IoT) devices—that derives benefit from their use. Whoever has the opportunity to access the data a product generates and collects can derive value from the data. How the data is processed, and then used, depends on the intent of the actor processing it.

Tweeting through the Great Firewall

Preliminary Analysis of PRC-linked Information Operations on the Hong Kong Protests

Introduction

On August 19th 2019, Twitter released data on a network of accounts which it has identified as being involved in an information operation directed against the protests in Hong Kong. After a tip-off from Twitter, Facebook also dismantled a smaller information network operating on its platform. This network has been identified as being linked to the Chinese government. 

Researchers from the International Cyber Policy Centre (ICPC) at the Australian Strategic Policy Institute have conducted a preliminary analysis of the dataset. Our research indicates that the information operation targeted at the protests appears to have been a relatively small and hastily assembled operation rather than a sophisticated information campaign planned well in advance.

However, our research has also found that the accounts included in the information operation identified by Twitter were active in earlier information operations targeting political opponents of the Chinese government, including an exiled billionaire, a human rights lawyer, a bookseller and protestors in mainland China. The earliest of these operations date back to April 2017.

This is significant because—if the attribution to state-backed actors made by Twitter is correct—it indicates that actors linked to the Chinese government may have been running covert information operations on Western social media platforms for at least two years. 

Methodology

This analysis used a mixed-methods approach combining quantitative analysis of bulk Twitter data with qualitative analysis of tweet content.

The dataset for quantitative analysis was the tweets and accounts identified by Twitter as being associated with a state-backed information operation targeting Hong Kong and is available here.

This dataset consisted of 

  • account information about the 940 accounts Twitter suspended from their service
    • The oldest account was created in December 2007, although half of accounts were created after August 2017 
  • 3.6 million tweets from these accounts, ranging from December 2007 to May 2019

The R statistics package was used for quantitative analysis, which informed phases of social network analysis (using Gephi) and qualitative content analysis.

Research limitations: ICPC does not have access to the relevant data to independently verify that these accounts are linked to the Chinese government; this research proceeds on the assumption that Twitter’s attribution is correct. It is also important to note that Twitter has not released the methodology by which this dataset was selected, and the dataset may not represent a complete picture of Chinese state-linked information operations on Twitter.

Information operation against Hong Kong protests

Indications of a hastily constructed campaign

Carefully crafted, long-running influence operations on social media will have tight network clusters that delineate target audiences. We explored the retweet patterns across the Twitter take-down data from June 2019 – as the network was mobilising to target the Hong Kong protests – and did not find a network that suggested sophisticated coordination. Topics of interest to the PRC emerge in the dataset from mid-2017 but there is little attempt to target online communities with any degree of psychological sophistication.

There have been suggestions that Taiwanese social media, during recent gubernatorial elections, had been manipulated by suspicious public relations contractors operating as proxies for the Chinese government. It is notable that the network targeting the Hong Kong protests was not cultivated to influence targeted communities; it too acted like a marketing spam network. These accounts did not attempt to behave in ways that would have integrated them into – and positioned them to influence – online communities. This lack of coordination was reflected in the messaging. Audiences were not steered into self-contained disinformation ecosystems external to Twitter, nor were hashtags used to build audience, then drive the amplification of specific political positions. As this network was mobilising against the Hong Kong protests, several nodes in the time-sliced retweet data (see Figure 1) were accounts to promote the sex industry, accounts that would have gained attention because of the nature of their content. These central nodes were not accounts that had invested in cultivating engagement with target audiences (beyond their previous marketing function). These accounts spammed retweets at others outside the network in attempts to get engagement rather than working together to drive amplification of a consistent message.

Figure 1: Retweet network from June 2019, derived from Twitter’s take-down data, showing the significant presence of likely pornography-related accounts within the coordinated network that targeted the Hong Kong protests.

This was a blunt–force influence operation, using spam accounts to disseminate messaging, leveraging an influence-for-hire network. The predominant use of Chinese language suggests that the target audiences were Hong Kongers and the overseas diaspora.

This operation is in stark contrast to the efforts of Russia’s Internet Research Agency (IRA) to target US political discourse, particularly through 2015-2017.

The Russian effort displayed well-planned coordination. Analysis of IRA account data has shown that networks of influence activity cluster around identity or issue-based online communities. IRA accounts disseminated messaging that inflamed both sides of the debates around controversial issues in order to further the divide between protagonist communities. High-value and long-running personas cultivated influence within US political discourse. These accounts were retweeted by political figures, and quoted by media outlets.

The IRA sent four staff to the US to undertake ‘market research’ as the IRA geared up its election meddling campaign. The IRA campaign displayed clear understanding of audience segmentation, colloquial language, and the ways in which online communities framed their identities and political stances.

In contrast, this PRC-linked operation is clumsily re-purposed and reactive. Freedom of expression on China’s domestic internet is framed by a combination of top-down technocratic control managed by the Cyberspace Administration of China and devolved, crowdsourced content regulation by government entities, industry and Chinese netizens. Researchers have suggested that Chinese government efforts to shape sentiment on the domestic internet go beyond these approaches. One study estimated that the Chinese government pays for as many as 448 million inauthentic social media posts and comments a year. The aim is to distract the population from social mobilisation and collective forms of protest action. This approach to manipulating China’s domestic internet appears to be much less effective on Western social media platforms that are not bounded by state control.

Yet, the CCP continues to use blunt efforts to grow the reach, impact and influence of its narratives abroad. Elements of the party propaganda apparatus – including the foreign media wing of the United Front Work Department – have issued (as recently as 16 August) tenders for contracts to grow their international influence on Twitter, with specific targets for numbers of followers in particular countries.

In the longer term, China’s investments in AI may lift its capacity to target and manipulate international social media audiences. However, this operation lacks the sophistication of those deployed by other significant state proponents of cyber-enabled influence operations; particularly Iran and Russia, who have demonstrated the capacity to operate with some degree of subtlety across linguistic and cultural boundaries.

This was the quintessential authoritarian approach to influence – one-way floods of messaging, primarily at Hong Kongers.

Use of repurposed spam accounts

Many of the accounts included in the Twitter dataset are repurposed spam or marketing accounts. Such accounts are readily and cheaply available for purchase from resellers, often for a few dollars or less. Accounts in the dataset have tweeted in a variety of languages including Indonesian, Arabic, English, Korean, Japanese and Russian, and on topics ranging from British football to Indonesian tech support, Korean boy bands and pornography.

This graph shows the language used in tweets over time, (although Twitter did not automatically detect language in tweets prior to 2013). The dataset includes accounts tweeting in a variety of languages over a long period of time. Chinese language tweets appear more often after mid-2017.

This map shows the self-reported locations of the accounts suspended by twitter, color-coded for the language they tweeted in. These locations do not reliably indicate the true location of the account-holder, but in this data set there is a discrepancy between language and location. The self-reported locations are likely to reflect the former nature of the accounts as spam and marketing bots – i.e., they report their locations in developed markets where the consumers they are targeting are located in order to make the accounts appear more credible, even if the true operators of the account are based somewhere else entirely.

Evidence of reselling is clearly present in the dataset. Over 630 tweets within the dataset contain phrases like ‘test new owner’, ‘test’, ‘new own’, etc. As an example, the account @SamanthxBerg tweeted in Indonesian on the 2nd of October 2016, ‘lelang acc f/t 14k/135k via duit. minat? rep aja’ – meaning that the @SamanthxBerg account with 14,000 followers and following 135,000 users, was up for auction. The next tweet on 6th October 2016 reads ‘i just become the new owner, wanna be my friend?.’

  • tweetid: 782380635990200320
  • Time stamp: 2016-10-02 00:44:00 UTC
  • userid: 769790067183190016
  • User display name: 阿丽木琴
  • User screen name: SamanthxBerg
  • Tweet text: PLAYMFS: #ptl lelang acc f/t 14k/135k via duit. minat? rep aja

Use of these kinds of accounts suggests that the operators behind the information operation did not have time to establish the kinds of credible digital assets used in the Russian campaign targeting the US 2016 elections. Building that kind of ‘influence infrastructure’ takes time and the situation in Hong Kong was evolving too rapidly, so it appears that the actors behind this campaign effectively took a short-cut by buying established accounts with many followers.

 

Timeline of activity

The amount of content directly targeting the Hong Kong protests makes up only a relatively small fraction of the total dataset released by Twitter, comprising just 112 accounts and approximately 1600 tweets, of which the vast majority are in Chinese with a much smaller number in English.

Content relevant to the current crisis in Hong Kong appears to have begun on 14 April 2019, when the account @HKpoliticalnew (profile description: Love Hong Kong, love China. We should pay attention to current policies and people’s livelihood. 愛港、愛國,關注時政、民生。) tweeted about the planned amendments to the extradition bill. Tweets in the released dataset mentioning Hong Kong continued at the pace of a few tweets every few days, steadily increasing over April and May, until a significant spike on 14 June, the day of a huge protest in which over a million Hong Kongers (1 in 7) marched in protest against the extradition bill.

Hong Kong related tweets per day from 14 April 2019 to 25 July 2019.

Thereafter, spikes in activity correlate with significant developments in the protests. A major spike occurred on 1 July, the day when protestors stormed the Legislative Council building. This is also the start of the English-language tweets, presumably in response to the growing international interest in the Hong Kong protests. Relevant tweets then appear to have tapered off in this dataset, ending on 25 July.

It is worthwhile noting that the tapering off in this dataset may not reflect the tapering off of the operation itself – instead, it is possible that it reflects a move away from this hastily-constructed information operation to more fully developed digital assets which have not been captured in this data.

Lack of targeted messaging and narratives

One of the features of well-planned information operations is the ability to subtly target specific audiences. By contrast, the information operation targeting the Hong Kong protests is relatively blunt.

Three main narratives emerge:

  • Condemnation of the protestors
  • Support for the Hong Kong police and ‘rule of law’
  • Conspiracy theories about Western involvement in the protests

Support for ‘rule of law’:

  • tweetid: 1139524030371733504
  • Time stamp: 2019-06-14 13:24:00 UTC
  • userid: r+QLQEgpn4eFuN1qhvccxtPRmBJk3+rfO3k9wmPZTQI=
  • User display name: r+QLQEgpn4eFuN1qhvccxtPRmBJk3+rfO3k9wmPZTQI=
  • User screen name: r+QLQEgpn4eFuN1qhvccxtPRmBJk3+rfO3k9wmPZTQI=
  • Tweet text: @uallaoeea 《逃犯条例》的修改,只会让香港的法制更加完备,毕竟法律是维护社会公平正义的基石。不能默认法律的漏洞用来让犯罪分子逃避法律制裁而不管。 – 14 June 2019

Translated: ‘The amendment to the Fugitive Offenders Ordinance will only make Hong Kong’s legal system more complete. After all, the law is the cornerstone for safeguarding fairness and justice in society. We can’t allow loopholes in the legal system to allow criminals to escape the arm of the law.’

Conspiracy theories:

  • tweetid: 1142349485906919424
  • Time stamp: 2019-06-22 08:31:00 UTC
  • Userid: 2156741893
  • User display name: 披荆斩棘
  • User screen name: saydullos1d
  • Tweet text: 香港特區警察總部受到包圍和攻擊, 黑衣人嘅真實身份係咩? 係受西方反華勢力指使,然後係背後操縱, 目的明確, 唆使他人參與包圍同遊行示威。把香港特區搞亂, 目的就係非法政治目的, 破環社會秩序。  – 22 June 2019

Translated: ‘Hong Kong SAR police headquarters were surrounded and attacked. Who were the people wearing black? They were acting under the direction of western anti-China forces. They’re manipulating things behind the scenes, with a clear purpose to instigate others to participate in the demonstration and the encirclement. They’re bringing chaos to Hong Kong SAR with an illegal political goal and disrupting the social order.’

[NB: Important to note that this was written in traditional Chinese characters and switches between Standard Chinese and Cantonese, suggesting that the author was a native mandarin speaker but their target audience was Cantonese speakers in Hong Kong.]

  • tweetid: 1147398800786382848
  • Time stamp: 2019-07-06 06:56:00 UTC
  • Userid: 886933306599776257
  • User display name: lingmoms
  • User screen name: lingmoms
  • Tweet text: 無底線的自由,絕不是幸事;不講法治的民主,只能帶來禍亂。香港雖有不錯的家底,但經不起折騰,經不起內耗,惡意製造對立對抗,只會斷送香港前途。法治是香港的核心價值,嚴懲違法行為,是對法治最好的維護,認為太平山下應享太平。 – 6 July 2019

Translated: ‘Freedom without a bottom line is by no means a blessing; democracy without the rule of law can only bring disaster and chaos. Although Hong Kong has a good financial background, it can’t afford to vacillate. It can’t take all of this internal friction and maliciously created agitation, which will only ruin Hong Kong’s future. The rule of law is the core value of Hong Kong. Severe punishment for illegal acts is the best safeguard for the rule of law. Peace should be enjoyed at the foot of The Peak.’’

[NB: This Tweet is also written in Standard Chinese using traditional Chinese characters. The original text says ‘at the foot of Taiping mountain’, meaning Victoria Peak, but is more commonly referred to in Hong Kong as “The Peak” (山頂). However, the use of Taiping mountain instead of ‘The Peak’ to refer to the feature is a deliberate pun, because Taiping means ‘great peace’]

  • tweetid: 1152024329325957120
  • Time stamp: 2019-07-19 01:16:00 UTC
  • Userid: 58615166
  • User display name: 流金岁月
  • User screen name: Licuwangxiaoyua
  • Tweet text: #HongKong #HK #香港 #逃犯条例 #游行 古话说的好,听其言而观其行。看看那些反对派和港独分子,除了煽动上街游行、暴力冲击、袭警、扰乱香港社会秩序之外,就没做过什么实质性有利于香港发展的事情。反对派和港独孕育的“变态游行”这个怪胎,在暴力宣泄这条邪路上愈演愈烈。 – 19 July 2019

Translated: ‘#HongKong #HK #HongKong #FugitiveOffendersOrdinance #Protests The old Chinese saying put it well: ‘Judge a person by their words, as well as their actions’. Take a look at those in the opposition parties and the Hong Kong independence extremists. Apart from instigating street demonstrations, violent attacks, assaulting police officers and disturbing the social order in Hong Kong, they have done nothing that is actually conducive to the development of Hong Kong. This abnormal fetus of a “freak demonstration” that the opposition parties and Hong Kong independence people gave birth to is becoming more violent as it heads down this evil road.’

This approach of vilifying opponents, emphasising the need for law and order as a justification for authoritarian behaviour is consistent with the narrative approaches adopted in earlier information operations contained within the dataset (see below).

Earlier information operations against political opponents

Our research has uncovered evidence that the accounts identified by Twitter were also engaged in earlier information campaigns targeting opponents of the Chinese government.

It appears likely that these information operations were intended to influence the opinions of overseas Chinese diasporas, perhaps in an attempt to undermine critical coverage in Western media of issues of interest to the Chinese government. This is supported by a notice released by China News Service, a Chinese-language media company owned by the United Front Work Department that targets the Chinese diaspora, requesting tenders to expand its Twitter reach.

Campaign against Guo Wengui

The most significant and sustained of these earlier information operations targets Guo Wengui, an exiled Chinese businessman who now resides in the United States. The campaign directed at Guo is by far the most extensive campaign in the dataset and is significantly larger than the activity directed at the Hong Kong protests. This is the earliest activity the report authors have identified that aligns with PRC interests.

Graph showing activity in an information operation targeting Guo from 2017 to the end of the dataset in July 2019

Guo, also known as Miles Kwok, fled to the United States in 2017 following the arrest of one of his associates, former Ministry of State Security vice minister Ma Jian. Guo has made highly public allegations of corruption against senior members of the Chinese government. The Chinese government in turn accused Guo of corruption, prompting an Interpol red notice for his arrest and return to China. Guo has become a vocal opponent of the Chinese government, despite having himself been accused of spying on their behalf in July 2019.

Within the Twitter Hong Kong dataset, the online information campaign targeting Guo began on 24 April 2017, five days after the Interpol red notice was issued at the request of the Chinese government, and continued until the end of July 2019. Guo continues to be targeted on Twitter, although it is unclear if the PRC government is directly involved in the ongoing effort.

Tweets mentioning Guo Wengui over time from 23 April 2017 to 4 May 2017: Graph showing activity in tweet volume by day. Activity appears to take place during the working week (except Wednesdays), suggesting that this activity may be professional rather than authentic personal social media use.

In total, our research identified at least 38,732 tweets from 618 accounts in the dataset which directly targeted Guo. These tweets consist largely of vitriolic attacks on his character, ranging from highly personal criticisms to accusations of criminality, treachery against China and criticisms of his relationship with controversial US political figure Steve Bannon. 

  • tweetid: 1123765841919660032
  • Time stamp: 2019-05-02 01:47:00 UTC
  • Userid: 4752742142
  • User display name: 漂泊一生
  • User screen name: futuretopic
  • Tweet text: “郭文贵用钱收买班农,一方面想找靠山,一方面想继续为自己的骗子生涯增加点砝码,其实班农只是爱财并非真想和郭文贵做什么, 很快双方会发现对方都 是在欺骗自己,那时必将反目成 仇.” – 2 May 2019

Translated: “Guo Wengui used his money to buy Bannon. On the one hand, he needed his backing. On the other hand, he wanted to continue to add weight to his career as a swindler. In fact, Bannon just loves money and doesn’t really want to do anything with Guo Wengui. Soon both sides will find out that they’re both deceiving the other, and then they’ll turn into enemies.”

  • tweetid: 1153122108655861760
  • Time stamp: 2019-07-22 01:58:00 UTC
  • Userid: 1368044863
  • User display name: asdwyzkexa
  • User screen name: asdwyzkexa
  • Tweet text: ‘近日的郭文贵继续自己自欺欺人的把戏,疯狂的直播,疯狂的欺骗,疯狂鼓动煽风点火,疯狂的鼓吹自己所谓的民主,鼓吹自己的“爆料革命”。但其越是疯狂,越是难掩日暮西山之态,无论其吹的再如何天花乱坠,也终要为自己的过往负责,亲自画上句点.’ – 22 July 2019

Translated: ‘Lately, Guo Wengui has continued to use his cheap trick of deceiving himself and others with a crazy live-stream where he lied like crazy, incited and fanned the flames like crazy, and agitated for his so-called democracy like crazy—enthusiastically promoting his “Expose Revolution”. But the crazier he gets the harder it is to hide the fact that the sun has already set on him. It doesn’t matter how much he embellishes things; eventually, he will have to take responsibility and put an end to all of this himself.’

Spikes in activity in this campaign appear to correspond with significant developments in the timeline of Guo’s falling out with the Chinese government. For example, a spike around 23 April 2018 (see below chart) correlates with the publishing of a report by the New York Times exposing a complex plan to pull Guo back to China with the assistance of the United Arab Emirates and Trump fundraiser Elliott Broidy. 

  • tweetid: 988088232075083776
  • Time stamp: 2018-04-22 16:12:00 UTC
  • Userid: 908589031944081408
  • User display name: 如果
  • User screen name: bagaudinzhigj
  • Tweet text: ‘‘谎言说一千遍仍是谎言,郭文贵纵有巧舌如簧的口才,也有录制性爱视频等污蔑他人的手段,更有给人设套录制音频威胁他人的前科,还有诈骗他人钱财的146项民事诉讼和19项刑事犯罪指控,但您在美国再卖力的表演也掩盖不了事实.’ – 22nd April 2018

Translated: ‘Even if a lie is repeated a thousand times, it’s still a lie. Guo Wengui is an eloquent smooth talker and uses sex tapes and other methods to slander people. He also has a criminal record for trying to threaten and set people up with recorded audio. He has 146 civil lawsuits and 19 criminal charges for swindling other people’s money. No matter how much effort you put in in the United States, you still can’t hide the truth.’

This tweet was repeated 41 times by this user from 7 November 2017 to 15 June 2018, at varying hours of the day, but at only 12 or 42 minutes past the hour, suggesting an automated or pre-scheduled process:

Volume of tweets mentioning Guo Wengui over time from 14 April 2019 to 29 April 2019.

Like the information operation targeting the Hong Kong protests, the campaign targeting Guo is primarily in Chinese language. There are approximately 133 tweets in English, many of which are retweets or duplicates. On 5th November 2017, for example, 27 accounts in the dataset tweeted or retweeted: ‘#郭文贵 #RepatriateKwok、#Antiasylumabused、 sooner or later, your fake mask will be revealed.’

As the Hong Kong protests began to increase in size and significance, the information operations against Guo and the protests began to cross over, with some accounts directing tweets at both Guo and the protests.

  • tweetid: 1148407166920876032
  • Time stamp: 2019-07-09 01:42:00 UTC
  • Userid: 886933306599776257
  • User display name: lingmoms
  • User screen name: lingmoms
  • Tweet text: ‘唯恐天下不乱、企图颠覆香港的郭文贵不仅暗中支持香港占中分子搞暴力破坏,还公开支持暴力游行示威,难道这一小撮入狱的暴民就是文贵口中的“香港人”?’– 9 July 2019

Translated: ‘Guo Wengui, who fears only a world not in chaos and schemes to toppleHong Kong, is not only secretly supporting the violent and destructive Occupy extremists in Hong Kong, he’s also openly supporting violent demonstrations.  Is this small mob of criminals the “Hong Kong people” Guo Wengui keeps talking about?’ 

The dataset provided by Twitter ends in late July 2019, but all indications suggest that the information campaign targeting Guo will continue.
 

Campaign against Gui Minhai

Although the campaign targeting Guo Wengui is by far the most extensive in the dataset, other individuals have also been targeted.

One is Gui Minhai, a Chinese-born Swedish citizen. Gui is one of a number of Hong Kong-based publishers specialising in books about China’s political elite who disappeared under mysterious circumstances in 2015. It was later revealed that he had been taken into Chinese police custody. The official reason for his detention is his role in a fatal traffic accident in 2003 in which a schoolgirl was killed. Gui has been in and out of detention since 2015, and has made a number of televised confessions which many human rights advocates believe to have been forced by the Chinese government.

The information operation targeting Gui Minhai is relatively small, involving 193 accounts and at least 350 tweets. With some exceptions, the accounts used in the activity directed against Gui appear to be primarily ‘clean’ accounts created specifically for use in information operations, unlike the repurposed spam accounts utilised by the activity targeted at Hong Kong.

The campaign runs for one month, from 23 January to 23 February 2018. The preciseness of the timing is indicative of an organised campaign rather than authentic social media activity. The posting activity also largely corresponds with the working week, with breaks for weekends and holidays like Chinese New Year.

A graph showing campaign activity in tweets per day. Weekends and public holidays are indicated by grey shading.

The campaign started on 23 January 2018, the day on which news broke that Chinese police had seized Gui off a Beijing-bound train while he was travelling with Swedish diplomats to their embassy. The campaign then continued at a slower pace across several weeks, ending on 23 February 2018. The tweets are entirely in Chinese language and emphasise Gui’s role in the traffic accident, painting him as a coward for attempting to leave the country and blaming Western media for interfering in the Chinese criminal justice process. Some also used Gui’s name as a hashtag.

  • tweetid: 956700365289807872
  • Time stamp: 2018-01-26 01:28:00 UTC
  • Userid: 930592773668945920
  • User display name: 赵祥
  • User screen name: JonesJones4780
  • Tweet text: ‘#桂民海 因为自己一次醉驾,让一个幸福家庭瞬间支离破碎,这令桂敏海痛悔不已。但是,他更担心自己真的因此入狱服刑。于是,在法院判决后不久、民事赔偿还未全部执行完的时候,桂敏海做出了另一个错误选择.’ – 26 January 2018

Translation: ‘#GuiMinhai deeply regrets that a happy family was shattered because of his drunk driving. However, he’s even more worried that he’s actually going to have to serve a prison sentence for it. Therefore, not long after the court’s decision and before any civil compensation was paid out, Gui Minhai made another bad choice’

  • tweetid: 956411588386279424
  • Time stamp: 2018-01-25 06:21:00 UTC
  • Userid: 1454274516
  • User display name: 熏君
  • User screen name: nkisomekusua
  • Tweet data: ‘#桂敏海 西方舆论力量仍想运用它们的话语霸权和双重标准,控制有关中国各种敏感信息的价值判断,延续对中国政治体制的舆论攻击,不过西方媒体这样的炒作都只是自导自演,自娱自乐.’ – 25 January 2018

Translation: ‘#GuiMinhai Western public opinion forces still want to use their discourse hegemony and double standards to control value judgments of all kinds of sensitive information about China and are continuing their public opinion attacks on the Chinese political system. However, this kind of hype in the Western media is just a performance they’re doing for themselves for their own personal entertainment.’

Others amplify the messages of Gui’s “confession”, claiming that he chose to hand himself in to police of his own volition due to his sense of guilt.

  • tweetid: 959276160038289408
  • Time stamp: 2018-02-02 04:03:00 UTC
  • Userid: 898580789952118784
  • User display name: 雪芙
  • User screen name: Ryy7v3wQkXnsGO8
  • Tweet text: ‘#桂敏海     父亲去世他不能奔丧这件事情,对桂敏海触动很大。他的母亲也80多岁了,已经是风烛残年,更让他百般思念、日夜煎熬,心里总是有一种很强烈的愧疚不安。所以他选择回国自首.’ – 2 February 2018

Translation: The death of #GuiMinhai’s father and the fact he couldn’t return home for the funeral greatly affected him. His mother is also over 80 years old and is already in her twilight years, causing him to suffer day and night in every possible way. There was always a strong sense of guilt and uneasiness in his heart. So he chose to return to China and give himself up.’

It seems likely that this was a short-term campaign intended to influence the opinions of overseas Chinese who might see reports of Gui’s case in international media.
 

Campaign against Yu Wensheng

On precisely the same day as the information operation against Gui started, another mini-campaign appears to have been launched. This one was aimed against human rights lawyer and prominent CCP-critic Yu Wensheng.

Yu was arrested by Chinese police whilst walking his son to school on 19 January 2018. Only hours before, Yu had tweeted an open letter critical of the Chinese government, and called for open elections and constitutional reform. Shortly after, an apparently doctored video was released, raising questions about whether Chinese authorities were attempting to launch a smear campaign against Yu.

In this dataset, tweets targeting Yu Wensheng begin on 23 January 2018—the same day as the campaign against Gui Minhai—and continue through until 31 January (only four tweets take place after this, the latest on 10 February 2018). This was a small campaign, consisting of roughly 218 tweets from 80 accounts, many of which were the same content amplified across these accounts. As with Gui, Yu’s name was often used as a hashtag.

This graph shows campaign activity in tweets per day over time. Selected weekends are highlighted in grey.

The content shared by the campaign was primarily condemning Yu for his alleged violence against the police as shown by the doctored video.

  • tweetid: 956707469677359104
  • Time stamp: 2018-01-26 01:56:00
  • Userid: 0jFZp2sQdCYj8hUveyN4Llxe2UvFbQgTqxaymZihMM0
  • User display name: 0jFZp2sQdCYj8hUveyN4Llxe2UvFbQgTqxaymZihMM0
  • User screen name: 0jFZp2sQdCYj8hUveyN4Llxe2UvFbQgTqxaymZihMM0
  • Tweet text: ‘#余文生 1月19日,一余姓男子在接受公安机关依法传唤时暴力袭警致民警受伤,被公安机关依法以妨害公务罪刑事拘留。澎湃新闻从北京市公安机关获悉,涉案男子系在被警方强制传唤时,先后打伤、咬伤两名民警.’ – 26 January 2018.

Translation: ‘#YuWensheng On January 19, a man surnamed Yu violently assaulted a police officer while receiving a legal summons from the public security bureau, and was arrested for obstructing government administration. Beijing Public Security Bureau told The Paper [a Chinese publication] that the man involved in the case wounded the officers repeatedly by biting them when he was being forcibly summoned by the police.’

As with the other campaigns, however, accusations of supposed Western influence were also notable: 

  • tweetid: 956742165845090304
  • Time stamp: 2018-01-26 04:14:00 UTC
  • Userid: 2l1eDka0eiClBUYoDXlwYaKcUaeelnz44aDM9OJRM
  • User display name: 2l1eDka0eiClBUYoDXlwYaKcUaeelnz44aDM9OJRM
  • User screen name: 2l1eDka0eiClBUYoDXlwYaKcUaeelnz44aDM9OJRM
  • Tweet text: ‘#余文生  在中国,有一批人自称维权律师,他们自诩通过行政及法律诉讼来维护公共利益、宪法及公民权利,并鼓吹西方民主、自由,攻击中国黑暗、专制、暴力执法、缺乏法治精神,视频主人公余文生律师也正是其中的一员.’ – 26 January 2018

Translation: ‘#YuWensheng  It can be seen from Yu Wensheng’s past activities that he is one of the so-called rights lawyers in China. Yu Wensheng thinks that with the support of foreign media and rights lawyers, he can become a hero and that naturally, some people will cheer for him. Little did he know that this time the police were wearing a law enforcement recording device that they used to record an overview of the incident and quickly published it to the world. Yu’s ugly face was undoubtedly revealed to the public.’

  • tweetid: 958222061972832256
  • Time stamp: 2018-01-30 06:15:00 UTC
  • Userid: Kmto+XqJ6hcowk0GvAGVEasNxHUW11beLphANrm3uhE=
  • User display name: Kmto+XqJ6hcowk0GvAGVEasNxHUW11beLphANrm3uhE=
  • User screen name: Kmto+XqJ6hcowk0GvAGVEasNxHUW11beLphANrm3uhE=
  • Tweet text: ‘#余文生 从余文生过去的活动中可以看到,他是国内所谓维权律师中的一员。余文生认为身后有国外媒体以及维权律师群体的支持,他就能成为英雄,自然有人为他摇旗呐喊。殊不知这次警察佩戴了执法记录仪,录下了事件的概况,并迅速公布于世,余的丑陋嘴脸在公众暴露无疑.’ – 30 January 2018.

Translation: ‘#YuWensheng In China, a group of people claim to be rights defenders. They claim to protect the public interest, constitution and civil rights through administrative and legal proceedings. They advocate for Western democracy and freedom and attack China’s darkness, autocracy, violent law enforcement and the lack of the rule of law. Lawyer Yu Wensheng, the star of the video, is also one of them.’

As with the other campaigns seen in this dataset, it seems probable that the motivation behind this effort was to convince overseas Chinese to believe the Chinese Communist Party’s version of events, bolstering the doctored video of Yu and amplifying the smear campaign.

Campaign against protesting PLA veterans

Another information campaign aimed at influencing public opinion appears to have taken place in response to the arrest of ten Chinese army veterans over protests in the eastern province of Shandong.

The protests took place in October 2018, when around 300 people demonstrated in Pingdu city to demand unpaid retirement benefits for veterans of the People’s Liberation Army (PLA). The protests allegedly turned violent, leading to injuries and damage to police vehicles. On 9 December 2018, Chinese state media announced that ten veterans had been arrested for their role in the protest. China Digital Times, which publishes leaked censorship instructions, reported that state media had been instructed to adopt a “unified line” on the arrests.

On the same day, a small but structured information operation appears to have kicked into gear. Beginning at 8:43am Beijing time, accounts in the dataset began tweeting about the arrests. This continued with tweets spaced out every few minutes (a total of 683) until 3:52pm Beijing time. At 9:52pm Beijing time the tweets started up again, this time continuing until 11:49pm.

This graph shows campaign activity over the day by hour of the day adjusted for Beijing UTC+8 time.

Activity by the accounts in the dataset included tweets as well as retweeting and responding to one another’s tweets, creating the appearance of authentic conversation. There was significant repetition within and across accounts, however, with many accounts tweeting a phrase and then tweeting the exact same phrase repeatedly in replies to the tweets of other accounts.

The content of the tweets supported and reinforced the message being promoted by state media, in condemning the protestors as violent criminals and calling for them to be punished.

  • tweetid: 1071589476495835136
  • Time stamp: 2018-12-09 02:16:00 UTC
  • Userid: 53022020
  • User display name: sergentxgner
  • User screen name: sergentxgner
  • Tweet text: ‘中国是社会主义法治国家,绝对没有法外之地和法外之人,法律面前人人平等。自觉遵守国家法律、依法合理表达诉求、维护社会正常秩序,是每一位公民的义务和责任。对任何违法犯罪行为,公安机关都将坚决依法予以打击,为中国公安点赞,严厉惩治无视法律法规之人,全力保障人民群众生命、财产安全.’ – 9 December 2018

Translated: ‘China is a socialist country ruled by law. There’s no place and no people in it that are above the law. All people are equal before the law. It is the duty and responsibility of every citizen to consciously abide by the laws of the state, to express their demands reasonably and according to the law, and to maintain the normal social order. Public security organs will resolutely crack down on any illegal or criminal acts in accordance with the law. Like [this post] for China’s public security, severely punish those who ignore laws and regulations, and fully protect the lives and property of the people.’

  • tweetid: 1071614920846786560
  • Time stamp: 2018-12-09 03:58:00 UTC
  • Userid: 4249759479
  • User display name: 林深见鹿
  • User screen name: HcqcPapleyAshle
  • Tweet text: ‘这些人的行为严重造成人民群众的生命财产安全,就应该雷霆出击,绝不手软.’ – 9 December 2018

Translated: ‘The behaviour of these people has seriously caused [harm to] the safety of the lives and property of the people. They should strike out like a thunderclap and not relent.’

[NB: This tweet may have been typed incorrectly and missed out a character or two. It should probably say that the behaviour endangered the lives and property of these people.]

Again, it appears likely that the motivation behind this campaign was to influence the opinions of overseas Chinese against critical international reporting (although international coverage of the arrests appears to have been minimal, which perhaps helps to explain the short-lived nature of the campaign) and videos of the event being circulated on WeChat that contradicted the official narrative.

Dormant accounts and Chinese language tweets

The information operation against Guo Wengui appeared to begin on 24 April 2017. Our research also tried to determine whether earlier PRC-related information operations had taken place. 

Chinese language tweets.

One measure we examined was the percentage of Chinese language tweets per day in the dataset. Twitter assigns a ‘tweet_language’ value to tweets, and manual examination of a sample of tweets showed that this was approximately 90% accurate.

Figure 11: Percent Chinese language tweets per day from Jan 2017 onwards.

Figure 11 shows that prior to April 2017 there was no significant volume of Chinese language tweets in the network of accounts that Twitter identified. A noticeable increase is seen by July 2017, and a significant volume of the tweets are identified as Chinese from then on, with a peak at over 80% in October 2017.

This measure does not support the existence of significant PRC-related operations prior to April 2017, unless their initial operations occurred in languages other than Chinese.

Account creation and tweet language

A second measure examined when accounts were created and the language they tweeted in.

Figure 12: Account creation day by percent Chinese tweets and follower size from 2008 to July 2019.

Figure 12 shows when accounts were created with time on the x-axis, compared to percent Chinese tweets over the lifetime of the account y-axis, with size of point reflecting follower numbers.

Figure 13: Account creation day by percent Chinese tweets and follower size from April 2016 to July 2019.

Figure 13 is the same data from April 2016 to July 2019.

In Figure 12 and Figure 13 we can see a vertical stripe in July 2016, and more in August through October 2017. These stripes indicate many accounts being created at close to the same time. From July 2017 new accounts tweet mostly in Chinese.

These data indicate that accounts were systematically created to be involved in this network. Accounts created after October 2017 tweet mostly in Chinese, with just a couple of exceptions. There are also a group of accounts that were created in July 2016 that were involved in the network that were created close to simultaneously.

Sleeper Accounts

The dataset contained 233 accounts that had greater than year-long breaks between tweets. These sleeper accounts were created as early as December 2007, and had breaks as long as ten years between tweets.

Figure 14: Tweets over time as represented as dots coloured by tweet language for accounts with a greater than one-year gap between tweets. More than year-long gaps between tweets are represented by grey lines.

Figure 14 shows the pattern of tweets for these accounts over time. These accounts tweeted in a variety of languages including Portugese, Spanish and English, but not Chinese prior to their break in activity. After they resumed tweeting there is a significant volume of Chinese language tweets.  

The bulk of these sleeper accounts begin to tweet again from late 2017 onwards. These data support the hypothesis that PRC-related groups began recruiting dormant accounts into their network from mid- to late-2017 and onwards. 

Figure 15: Tweets over time as represented as dots coloured by tweet language for accounts with a greater than one-year gap between tweets that were created between June and August 2016.

Figure 15 shows the tweeting pattern of accounts created in June and August 2016. These accounts can be seen as a vertical stripe in Figure 13.

The presence of long gaps in tweets immediately after account creation before reactivation and tweeting mostly in Chinese from early 2018 does not support the hypothesis that PRC-related elements were engaged in active information operations before April 2017. It is possible that these accounts were created by PRC-related entities expressly for use in subsequent information operations, but our assessment is that it is more likely that these inactive accounts were created en masse for other purposes and then acquired by PRC-related groups.

This research did not identify any evidence for other PRC-related information operations earlier than April 2017.

Conclusion

The ICPC’s preliminary research indicates that the information operation targeting the Hong Kong protests, as reflected in this dataset, was relatively small hastily constructed, and relatively unsophisticated. This suggests that the operation, which Twitter has identified as linked to state-backed actors, is likely to have been a rapid response to the unanticipated size and power of the Hong Kong protests rather than a campaign planned well in advance. The unsophisticated nature of the campaign suggests a crude understanding of information operations and rudimentary tradecraft that is a long way from the skill level demonstrated by other state actors. This may be because the campaigns were outsourced to a contractor, or may reflect a lack of familiarity on the part of Chinese state-backed actors when it comes to information operations on open social media platforms such as Twitter, as opposed to the highly proficient levels of control demonstrated by the Chinese government over heavily censored platforms such as WeChat or Weibo.

Our research has also uncovered evidence that these accounts had previously engaged in multiple information operations targeting political opponents of the Chinese government. Activity in these campaigns show clear signs of coordinated inauthentic behaviour, for example patterns of posting which correspond to working days and hours in Beijing. These information operations were likely aimed at overseas Chinese audiences. 

This research is intended to add to the knowledge-base available to researchers, governments and policymakers about the nature of Chinese state-linked information operations and coordinated inauthentic activity on Twitter. 

Notes

The authors would like to acknowledge the assistance of ICPC colleagues Fergus RyanAlex Joske and Nathan Ruser

Twitter did not provide any funding for this research. It has provided support for a separate ICPC project.


What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.


It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. ASPI is grateful to the US State Department for providing funding for this research project.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

Capabilities, competition and communication

Why the West needs a strategy for technology

Introduction

At the conclusion of his time as a Distinguished Visiting Fellow with ASPI’s International Cyber Policy Centre, Admiral Rogers shares five factors that government and policymakers should consider as they prepare for the next wave of disruptive technologies.

Seeing technology as a capability, not a product

Technology is going to be a core aspect of the future for us, and it’s not just cyber technology. It’s going to be technology writ large. I believe that we can assimilate this. Game-changing technologies with social implications have been a part of human history during our entire existence as a species. We tend to think that the time we’re living in is the most different or somehow the toughest, but it’s not.

There have been game-changing technologies with potential negative second- and third-order effects throughout the history of humanity. We’ve dealt with this before. I believe we can deal with it now. But we’ve got to be willing to sit down and think about this. And we really need to ask ourselves what’s the way forward.

One of my concerns as I left government was, quite frankly, that I didn’t think we fully understood the implications of technology in national security. I thought that in many ways we were still organised and focused along very industrial lines, that we tended to think of ‘technology’ through the prism of something that’s produced. It might be a particular good. It might be a particular service. It might be a particular product. On the other hand, the idea of technology as an underpinning that powers a broader set of activities—I didn’t think we were working our way through this enough.

What’s the right answer for the implementation of a technology that will be a fundamental building block for a nation’s economic competitiveness in this digital world that we’re living in?

I would argue 5G is emblematic of this, because 5G is not just about, ‘Well, I’m going to get a better phone service,’ right? That’s not the heart of it. 5G is going to enable us to address latency issues. We’re going to be able to move massive, increased amounts of data at incredible, stable rates that will turn our handheld digital devices into the kinds of capabilities and functionality that we take for granted today in our laptops and our mainframes.

5G is going to underpin all of that, and it’s only one of many foundational technologies that are being developed right now. As I used to say about 5G in our system, ‘Hey, it’s just the wolf closest to the sled.’ It’s emblematic of a broader set of challenges that we’re going to have to deal with over time.

Rethinking technological competition

In the US, our theory had always been that the edge for us is the innovative power of our private sector. And as long as the government largely stayed out of that, we could compete head to head, and compete very well.

I would argue that for 1G, 2G, 3G, 4G, that worked perfectly. But the dynamics we’re seeing now with 5G are prompting the question of how that strategy works when the competition isn’t a single foreign company. The competition now is an integrated national strategy in which that foreign company is just one component. How does a single private company compete against the integrated efforts and resources of an entire nation-state?

I think we have to be asking ourselves how we need to change our model, because if we think it’s bad now with 5G, I would argue it’ll be even worse when 6G comes along in about three years. It’ll be even worse with artificial intelligence, quantum computing and other new technologies coming down the pipeline right now. We’re going to have a series of technological changes coming up. They’re going to be so foundational that if we don’t change the dynamic, we’re going to have this conversation over and over again.

This is not about stopping any particular nation. This is not about contesting a particular company. This is about ensuring our own and our partners’ competitive ability in the 21st-century digital age. Because, again, you’re going to have to deal with this with other countries and other companies over time. Right now, that happens to be China, Huawei and 5G, but it’ll be something different in the future.

To me, China is not an enemy. They aren’t an adversary. They’re a competitor, and we need to ask ourselves, ‘How do we compete with them?’

Let’s not waste our time trying to figure out how we stop the growth of China, how we contain China. My view is that is a losing strategy. I think a much smarter strategy is that, given that growth, given that rise, how can we work together collaboratively to ensure that the growth is done in a way in which it becomes a part of the greater, broader world order? And that it’s done in a way that optimises outcomes both for China and for its neighbours, including the US.

We shouldn’t approach this as a zero-sum game; I never believe that. I think that for Australia and the US our respective relationships with China are going to be fundamental to our competitiveness and our economic performance in this century. You can’t pretend otherwise.

I think the goal is to make sure that the playing field is level. Once we have a level playing field, then it’s up to our private sector. But the challenge right now is that the playing field is not level, and it’s really difficult for the West’s firms to compete. And I just don’t think it’s realistic to expect them to do this on their own. Levelling the playing field is going to take work. It’s also about ensuring agreements are adhered to and there are consequences for clear breaches.

Developing a strategy

In the end, to me it’s all about developing a strategy. I’m watching other nations develop strategies, and I’m saying to myself, ‘Where’s ours? How did we get ourselves into this situation? And what are we going to do so that we can compete?’

So, let’s think about the strategy we’re going to develop. Let’s think about how we’re going to compete.

Let’s think about how we’re going to ensure our continued strong economic performance, our strong technological edge. How are we are going to retain that? And at the same time as we’re retaining that, how are we going to retain the values of the societies that we’re a part of?

Our number one competitive advantage, I argue, is our values: the idea of freedom, the idea of the choice of the individual, the idea of the private sector’s ability to compete without the constraint of the government. I also argue that the power of innovation is one of our competitive edges, and we should be doing more to support and protect that innovative edge. So I think, again, if we can get to a level playing field, then our inherent advantages—that structure, those values, that ability to innovate—will enable us to compete with anybody.

I think we have to acknowledge that our structures and our processes aren’t really optimised for this world. I also think we have to acknowledge that it all starts from recognition and acknowledgment of the problems, so we’ve got to be willing to do that. You can’t fix anything if you don’t acknowledge that you have an issue.

I think there’s an element of changing structures and changing process in the way we do things. Part of that model which needs to change, at least in the US, is the kind of wall we build between the functions of the government and the private sector. We really need to step back and ask ourselves—given this world of technological change, given technology’s impact on national security and economic competitiveness, given the speed with which this is happening, given the geopolitical applications of some of this technology—some really fundamental questions like, ‘So, what’s the role of the private sector in this world? What’s the role of the government in this world? Are there ways they could team together?’

It doesn’t mean control. A lot of times I hear people say, ‘You’re just arguing that the government should control everything.’ That isn’t what I’m saying. That hasn’t tended to work out so well in many areas, and it’s not a model that I would default to. On the other end, I think there are some things we can do in partnership with each other. I just think we have to be open to the fundamental idea that in this digital age we’ve got to be willing to look at very different approaches to how we do things.

Strengthening our alliances

I think if we’re honest with ourselves, we have tended to take the US–Australia relationship for granted for some time, and that just isn’t going to work for us anymore. We’ve been together in every major conflict in the past century. In the post-9/11 environment, we’ve worked and fought together. Everywhere I’ve been, on the battlefields in Afghanistan and Iraq, in my professional career, I’ve loved hearing the sound of an Australian accent in the middle of nowhere. In some really tough circumstances, hearing that cheery, ‘G’day, mate,’—I just really like that. I think there’s something really powerful about that. But we can’t take this relationship for granted.

The ability to bring like-minded nations together to work on tough problems is a great thing. Five like-minded nations with a broadly common set of values and a willingness to address not only their own national interests but to support others in the execution of theirs, all with the view of ensuring that we’re helping to make the world a better place: that’s a pretty powerful fundamental idea.

I think that’s still very relevant. It doesn’t pretend for one minute that we don’t have national interests and that those interests never differ. It doesn’t pretend that we don’t have respective national interests that we want to make sure are addressed. But I still think that within that framework we can do powerful things together.

One of my concerns is that, if we don’t get this right, if we don’t think about national security, economic competitiveness and the implications of technology, then we’re individually going to make decisions that potentially increase the risk for other partners in the Five Eyes, or which potentially force other members of the Five Eyes to make some really tough choices that might not be in the interest of all five. If we’re not careful, we could start to go down the road where Five Eyes starts to splinter. If that happens, it should be a conscious decision, not something that kind of happens as an afterthought of other choices. We have to work at maintaining those alliances, and we have to be able to articulate their value. The Five Eyes structure is so important, and one of its strengths has been that we’re willing to have a discussion with each other on those kinds of issues.

Communicating with broader audiences about cyber strategy

As policymakers and as leaders, we’ve got to think about how to articulate the challenge of technology in a way that non-technical people can understand and relate to. I don’t think we’re particularly effective at this at times. One point I would make is, ‘Hey, look, we got to articulate these important topics in ways that non-technical people can understand.’

The second point I would make is this. We need to try to provide meaningful, concrete, specific examples, not an apocalyptic, cyber-could-destroy-the-world-around-us story, because what happens with that is you cry wolf too many times and people just tune you out. Instead, we should be trying to break these big, complex problems down into smaller, more understandable, more digestible components that enable us to build a comprehensive strategy.

Speaking only for the US, we have publicly started talking about how cyber is a tool within the toolkit which we will consider using in an appropriate manner, with a legal basis, for various measurable and proportionate responses to other activity.

For example, you saw us acknowledge in congressional testimony that for the November 2018 election cycle in the US, the US Government authorised and executed a strategy designed to preclude the Russians’ ability to do some of the things against US election infrastructure which they did in 2016. That’s significant: firstly, the fact that we did it; secondly, the fact that we’re willing to publicly talk about it.

What this indicates to me is a kind of evolution in strategy and policy which says, ‘Look, we need to acknowledge that being passive and responding quietly has not really gotten us to where we want to be or where we feel we need to be. Therefore, we need to try to do something different.’

The difference is that we need to start publicly talking about cyber as a tool: the fact that we have capabilities, the fact that we’re willing to use them, and then showing our willingness to use them — again, for very specific purposes, under a very specific legal regime and with a very specific sense of proportionality.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.

It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

Protecting critical national infrastructure in an era of IT and OT convergence

ASPI Policy Brief 18/2019

What’s the problem?

Today, we’re seeing an increasing convergence between the digital and the physical worlds. This is sometimes referred to as the convergence of IT (information technology) and OT (operational technology)—devices that monitor physical effects, control them, or both. More and more devices are becoming interconnected to create the ‘internet of things’ (IoT).

While this brings many benefits, it also brings new types of risks to be managed—a cyberattack on OT systems can have consequences in the physical world and, in the context of a critical national infrastructure provider, those physical consequences can have a potentially major impact on society.

Insecure OT systems can also be a back door to allow attackers to penetrate IT systems that were otherwise thought to be well secured.

Among Australian critical national infrastructure providers, the level of maturity and understanding of the specific risks of OT systems lags behind that of IT systems. There’s a shortage of people with OT security skills, commercial solutions are less readily available, and boards lack specialist knowledge and experience. Mandating or recommending standards could help boards understand what’s expected of them, but it isn’t clear which standards are appropriate for managing these risks.

What’s the solution?

A lesson learned from IT security over the past decade is that impacts are severe unless security is considered up front and threats are managed proactively rather than reactively. As the convergence of IT and OT gathers pace in our critical national infrastructure, urgent action on a range of fronts is needed to address risks introduced by the IT–OT convergence.

Concerted effort is needed to ensure that boards of critical infrastructure organisations are mandated and enabled to decide, communicate and monitor their OT cyber risk appetite; that the right skills and tools are available to address the problems; and that there’s effective sharing of threat intelligence and best practice. Achieving this will require the prioritisation of resources to appropriate parts of government to support these actions.

This paper looks at critical infrastructure policy in Australia, the convergence of cyber and physical systems, and the risk and threat environment applicable to those systems. It then looks at the current state of maturity and how this could be improved, concluding with policy recommendations.

What are OT, ICS and SCADA?

OT refers to operational technology. Gartner defines it as ‘hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events’.1

Other terms commonly used in discussions of this area are ICSs (industrial control systems), which are a key sector in OT, and often a key area of concern since, as the name suggests, they’re used to control major industrial processes such as power plants. ICSs are often managed via SCADA (supervisory control and data acquisition) systems, so SCADA cybersecurity is a key focus, as the compromise of the SCADA system allows full control of the industrial process.

This report uses the term OT throughout, as this refers to the full range of cyber–physical systems that should be considered in developing policy approaches to securing critical infrastructure.

Convergence creates risk

IT and OT systems have traditionally been separate but have converged in recent years, as OT devices that monitor and control ‘real-world’ physical systems are increasingly connected to the internet or wider communication networks, in particular in our critical national infrastructure providers.

For example, managers may be provided with a dashboard of the performance of a power plant, allowing operational changes (such as changing load generation) and commercial decisions (such as the execution and pricing of electricity sale contracts) to be made in real time.

Although this brings clear benefits, it also brings new risks. OT systems are no longer isolated and stand-alone, so a cyberattack on the internet-connected combined IT–OT system can have direct physical consequences. When the organisation is part of our critical national infrastructure, such an attack can have a potentially major impact on national security.

Research and survey methodology

This study examined the understanding and management of the risks of IT–OT convergence in critical national infrastructure, particularly the telecommunications, energy, water and transport sectors. These areas are considered the most critical to the security of Australia and are the focus of government legislation. Many of the issues of IT–OT convergence identified here occur in other sectors of the economy and society, although exploring the implications outside of critical infrastructure is beyond the scope of this paper.

This paper drew on desktop research; interviews with key stakeholders in major Australian critical infrastructure providers, generally targeting the senior risk owners, government officials and subject-matter experts; and a survey of a limited sample of critical infrastructure operators (a dozen organisations in the four priority sectors). The survey explored approaches to IT–OT convergence, the level of understanding of the risks, and approaches to managing the risks.

Critical national infrastructure in Australia

In Australia, the federal, state and territory governments have defined critical infrastructure as:

those physical facilities, supply chains, information technologies and communication networks which, if destroyed, degraded or rendered unavailable for an extended period, would significantly impact the social or economic wellbeing of the nation or affect Australia’s ability to conduct national defence and ensure national security.2

Examples include the systems providing food, water, energy, transport, communications and health care.

Critical infrastructure providers in Australia cover a broad range of organisation types—some are government agencies or government-owned corporations, but a large proportion are run by commercial organisations, which may be privately owned companies, public corporations or part of multinational organisations. Government-owned providers may be at the federal, state or local government level, with differing access to resources and security expertise.

The policy for critical infrastructure resilience was launched by then Attorney-General George Brandis in 2015, and is now the responsibility of the Department of Home Affairs. Australian policy sets out two key objectives: to improve the management of reasonably foreseeable risks, and to improve resilience to unforeseen events. Much of our critical infrastructure is owned and operated by commercial organisations and the strategy recognises that, so implementation is intended to be through a broadly non-regulatory business–government partnership.

The Critical Infrastructure Centre was established in January 2017 with a mandate to work across all levels of government and with owners and operators to identify and manage the risks to Australia’s critical infrastructure. It aims to bring together expertise from across the Australian Government to manage complex and evolving national security risks to critical infrastructure from espionage, sabotage and foreign interference. Although other forums, such as the Trusted Information Sharing Network (TISN), look across a broader range of critical infrastructure sectors and threats, budget constraints mean that the Critical Infrastructure Centre has focused on a more limited range of sectors that pose the greatest potential threat to national security if attacked. Therefore, the initial work has focused on understanding potential foreign ownership and control risks, enabled by the Security of Critical Infrastructure Act 2018, which mandates obligations for a range of assets that meet specified thresholds in the electricity, gas, water and ports sectors (currently estimated to number around 165).

In managing broader security risks from potential foreign or domestic actors attacking our critical infrastructure, the Critical Infrastructure Centre also administers the telecommunications sector security reforms, which are based on the Telecommunications and Other Legislation Amendment Act 2017, which came into force on 18 September 2018. The reforms place obligations on providers in the telecommunications sector to ensure the security of their networks and to notify government of changes with potential security impacts, and enable government to obtain information to monitor compliance and to direct providers to do ‘a specified thing that is reasonably necessary to protect networks and facilities from national security risks’.

Cyber–physical convergence

Critical national infrastructure providers are typically significant users of OT in order to automate the services that they provide. They’re under pressure to deliver services more efficiently and at lower cost, due to market competition, technological change, reduced government funding and price regulation.

To achieve this, organisations have sought to automate and integrate more and more of their IT and OT systems. Research for this report showed that, although most organisations hadn’t seen much change in their degree of IT–OT convergence over the past two years, in the next two years they expect a rapid increase in convergence. Most providers interviewed for this report expect a high degree of convergence and extensive two-way connectivity.

Another convergence driver is the proliferation of interconnected devices, often referred to as the ‘industrial internet of things’ (IIoT). This has been helped by the development of open standards, low-powered sensors and electronic controllers, and short-range communication networks.

In the past, an organisation might have had a ‘stovepiped’ system provided by a single vendor communicating using proprietary protocols, with a single gateway into the back-office IT system.

Today, it’s more likely that there will be a range of different vendor systems communicating with each other in a complex mesh network, and the concept of a clear boundary between IT and OT domains is less relevant. A Kaspersky study of 320 worldwide professional OT security decision-makers showed that 53% saw implementing these types of IIoT solutions as one of their top priorities.3

As the volume of data grows due to the exponential increase in connected sensors, the data can be mined to monitor operational performance, scheduling and utilisation, faults and anomalies, compliance and so on. It can, in turn, be used to identify actions to improve effectiveness, often in real time. However, to implement effective machine learning and artificial intelligence algorithms, it is often easiest to connect to today’s public cloud services, which can provide flexible and easy-to-use processing power. This results in a more porous border between corporate IT systems and public networks, and effectively interconnects OT networks with public networks. Although the use of cloud services can bring security opportunities, unless managed appropriately it can bring new vulnerabilities by making formerly separate corporate systems accessible through the wider internet.

Some commentators have noted that getting full value from this sort of data analysis requires close partnership between the users and manufacturers of OT systems. Gartner predicts that, by 2020, 50% of OT service providers will create key partnerships with IT-centric providers for IoT offerings.4 Another report suggests that 95% of organisations using the IoT have some form of partnership with another organisation to implement their IoT solutions, so it’s likely that even for the other 50% of providers many will still have features and services that expect the OT devices to be connected to the internet.5

Communications technologies are also improving: 5G network rollouts by Telstra and Optus are expected to enable better latency and availability for remote applications. This means we’re likely to see more interconnectedness between IT and OT systems not only within organisations but between organisations and supply chains, further increasing complexity and the potential cyberattack surface.

Challenges of OT cybersecurity

The key principles may be similar, but IT cybersecurity is considered much more mature and advanced than OT cybersecurity. This is because IT systems are much more prevalent, the risks are well recognised and there are enough case studies of real-life attacks to ensure focus and understanding of how to address the risks. Historically, OT systems were physically isolated, and cybersecurity was not a priority until the recent convergence trend drove it up the agenda.

There are significant overlaps and similarities, and OT cybersecurity can learn much from IT cybersecurity. Probably 80% of the threats are the same as for IT systems, but it’s with the other 20% where the biggest challenges lie. Some of the key differences are as follows:

  • The risk calculus is different. A successful OT attack can cause major physical damage or even loss of life, which can make a significant difference to the risk appetite.
  • For OT systems, the availability of service is often more important than confidentiality, whereas in IT that priority is often reversed. Shutting down a system to stop an attack might not be an option for an OT system, and even applying updates to fix known vulnerabilities may not always be feasible. Integrity is also more important, given the potential safety-critical impact of changes to data.
  • The operational lifetime of OT systems is typically much longer than that of IT systems. Plant and machinery can last 20–50 years, whereas IT systems may be replaced every 3–5 years. Older systems might not be built to withstand modern threats, and support and security patches might not be available.
  • The threat and attack models are different. Typically, the design of firewalls and security monitoring tools is based on characteristic indicators of IT attacks, meaning that OT attacks could pass through undetected.

The risk and threat environment

A cyberattack on an OT system is not just theoretical—there have already been many publicly reported attacks. As long ago as 2001, a disgruntled subcontractor used remote radio access to release sewage into town water, parks and other areas in Australia.6

More recent examples include suspected nation-state-motivated attacks on Saudi Arabian industry. In 2012, Saudi Aramco, the Saudi national oil company, was hit by a major attack that disabled 35,000 computers, halting all its operations, even though OT systems were not directly attacked.7 In August 2017, attackers breached the safety control systems at a Saudi petrochemical plant, intending to sabotage them and cause an explosion. Fortunately, it appears that a coding error meant they were unsuccessful.8

Other energy companies have also been targeted. In December 2015, a Ukrainian electricity distribution company’s control systems were breached in an attack subsequently attributed to Russia.9 The operator had to switch to manual mode, and approximately 225,000 customers lost power in what was the first publicly acknowledged cyber incident to result in power outages.10

In March 2018, the US Government issued an alert that Russian Government actors were remotely targeting US Government energy, nuclear, water and other critical infrastructure sectors, carrying out reconnaissance as a potential precursor to targeted attacks.11 Interestingly, it appeared to be a multi-stage campaign in which the attackers first targeted small commercial facilities’ networks and then used those systems as a bridge to move into the networks of larger, more critical organisations— an example of exploiting the type of supply-chain connectivity mentioned above.

So far, reported attacks have affected the availability of services, which can still have major impacts on society, but through good design, good fortune, or both, major direct physical impacts have been avoided. However, if the aim of an adversary is to cause significant physical damage and potentially loss of life, it is conceivable that they could compromise the integrity of the systems not only by sabotaging control systems but by modifying monitoring systems to override fail-safe mechanisms and alarms. Fortunately, we haven’t seen any such incidents to date, at least from publicly available information, but the Saudi petrochemical company attack showed this intent, making it a very real possibility that policymakers need to address.

Another class of threat is the potential use of unsecured OT systems as an entry point for penetration of a connected IT system that may otherwise be well protected. Examples of exploitation of unsecured consumer IoT devices have recently been seen; for example, the Mirai botnet ‘weaponised’ devices such as CCTV cameras with default credentials to launch a massive distributed denial-of-service attack.12

The current state of maturity: survey results

At a high level, there’s clear awareness of the threat from IT–OT convergence. The Kaspersky study mentioned above showed that 77% of companies ranked cybersecurity as a major priority, 66% saw targeted attacks as a major concern, and 77% believed that they were likely to be the target of an OT cybersecurity incident.13 Two-thirds saw the advent of the IIoT as bringing even more significant OT security risks.

In all discussions with Australian providers for this report, cyber risks were recognised from board level all the way down through the organisation. While only one organisation of the 12 interviewed had a clear directive on its OT risk appetite, most providers were cautious, stating that their OT risk tolerance was lower than for IT systems, and an assessment of benefits versus risks was made before interconnecting systems. OT cyber risk is reported at least quarterly to the board in two-thirds of the organisations, although it’s normally combined with IT risk rather than reported as a stand-alone item.

It was encouraging that in seven out of 12 cases there was at least one director at board level with some expertise in the area. Over 80% of respondents said they had participated at least occasionally in the sharing of lessons learned and best practice for both IT and OT security across their sector, which perhaps reflects the active engagement of the TISN and other organisations.

However, many organisations clearly felt there was scope to do better. Half said there was room for improvement in their understanding of the degree of convergence in their systems and in ensuring that they had a comprehensive view of the risks and vulnerabilities. Less than half were able to confirm that vulnerability testing of their OT systems was carried out at least annually. Although 11 out of 12 had an approved incident response plan that had been tested within the past 12 months, in a third of cases the OT security incident response plan was considered to be the same as the IT security incident response plan. The different approaches for isolating and recovering from OT attacks, and the focus on availability in OT, mean that recycling the IT response plan for this sort of incident is unlikely to be effective. This probably explains why two-thirds of organisations felt they were only partially prepared or underprepared to respond to a real incident.

An approach for managing the risks—and some of the challenges in doing so

Research for this report suggests several approaches to improve security as a result of IT–OT convergence.

Setting expectations

Effective security starts with leadership. Boards need to provide strong awareness and sponsorship, setting and communicating their risk appetite in a way that drives their approach to IT–OT convergence. Given the lack of board members with specific expertise, the key will be to encourage and enable boards to be more inquisitive—creating a culture in which they can ask questions and explore issues in an open and transparent manner. This shift in board understanding and engagement is what has occurred in recent years with ‘traditional’ cybersecurity.

Critical infrastructure providers have to deal with conflicting pressures, such as maintaining service quality, reducing costs, regulating prices and more. It’s important that government recognises the threats and mandates that providers face to ensure the security of their systems. For government organisations, the recent NSW cyber strategy is a good example that sets a clear mandate for all government agencies to ensure that there are ‘no gaps in cyber security’ related to physical systems.14

A different approach may be needed for commercial providers—not all of them recognise the commercial risk of a security incident and act accordingly, and hence some compulsion and enforcement are probably required. For regulated industries, licence conditions are often used to place clear obligations on providers, although as this is typically done at the state or local level there may be variability across the nation. The telecommunications sector security reform regulations place more specific obligations on telecommunications providers, such as reporting planned changes and potential direction powers; the operation and applicability of this framework should be reviewed to see whether a modified approach would be appropriate for other sectors.

Of course, just mandating or setting a vision is not sufficient; action is needed to see it realised. The right tools need to be made available to enable providers to embed a culture of security throughout the organisation, and the right governance to ensure that this is happening.

Risk identification and management

No single control will eliminate the risk of a cyberattack; hence, given the potentially catastrophic impacts if an incident occurs, providers need to be very clear about their risk appetite as they potentially converge IT and OT. They must build a clear understanding of the various systems—physical systems, networks, software, computers and other devices—and their interdependencies and connectivity. This should allow analysis of potential threat vectors and allow a risk register to be developed and maintained.

Idaho National Lab has proposed a step-by-step approach for mission-critical systems, called ‘consequence-driven, cyber-informed engineering’, to identify the functions whose failure could have catastrophic consequences.15 It proposes that for the ‘crown jewels’ the approach should be to minimise any internet connectivity, and put in analogue monitoring and fail-safes to protect against the risk of failure or sabotage of digital systems. This has already been implemented as a year-long pilot at Florida Power & Light, one of the largest electric utilities in the US. The case for such an approach might not be proven in all cases, but discussion using this sort of framework may help to drive a better definition of risk appetite.

Where the decision is made to converge systems, a ‘defence-in-depth’ approach should be used to reduce the risks. This could include appropriate network segregation, physical security measures, gateways, system and device configurations, user access controls and so on. These need to be backed up by regular monitoring of systems and networks to identify anomalous patterns of behaviour and to investigate them in real time. The costs of defence in depth will clearly need to be factored into decision-making about the efficiency and benefits of specific IT–OT convergence plans.

Given the differences between IT and OT security, the right tools need to be chosen: an IT firewall might not protect an OT network from malicious traffic, and a standard IT security monitoring solution might not detect OT attacks, as the characteristics of hostile activity will be different. Critical infrastructure providers have commented on the lack of mature commercially available solutions to assist with this, although other industry experts consulted suggested the problem may in some areas be overlapping, competing solutions along with unrealistic marketing claims. An appropriate framework would help to assess these claims and identify any gaps in the market where government intervention may be appropriate, whether this is investment to help accelerate development or certifications for products to help buyers assess their efficacy for solving their problems.

Standards and guidance

Standards are always an emotive subject, especially when it comes to security. The right standards can work well in setting a baseline, provided they’re implemented as part of an overall strategy and not as a blind tick-the-box exercise. However, inappropriate standards will at best give a misleading picture and at worst may drive insecure behaviours.

The limited survey conducted for this report asked about some common standards and found that, while the information security standard ISO27001 and the risk management standard ISO31000 were used by 58% and 33% of respondents, respectively, the business continuity standard ISO22301 and the US Department of Energy’s Cybersecurity Capability Maturity Model (ES-C2M2) cyber maturity framework hardly seem to be used at all. However, over 80% were either actively using or considering other OT-specific security standards.

While the research for this report was underway, the Australian Energy Market Operator published the inaugural report into the cyber maturity of energy operators. This was based on self-assessments against a framework developed specifically for this purpose but drawing on a number of international standards as well as Australian Signals Directorate guidance and Australian legislation. The companies voluntarily completed 67 self-assessments, the details of which have not been released, but the conclusion of the report was that the responses ‘identified opportunities to improve cyber security maturity across the sector’.16

Standards should be reviewed on a sector-by-sector basis—for example, using a guiding council of experts in a given sector—in order to identify which standards should be recommended as suitable for organisations to adopt and regularly audit against. 

Education

The general shortage of cybersecurity skills in the workforce has been well documented and discussed,17 but a recurring theme from interviews for this report was an even more acute challenge involving the availability of suitably skilled OT security professionals.

Education will be the key to addressing this gap. This should start with broad user education, as part of building the right culture across an organisation, supplemented by the right policies and processes. This can help avoid some of the most common weaknesses. For example, it’s thought that some of the attacks described above were facilitated by a well-meaning employee inserting an unknown USB stick into a computer to check who it belonged to, and a study by Honeywell18 found that 44% of USB devices present at surveyed industrial facilities had a security issue. Common resources should be created for use in general user education and executive awareness.

The Academic Centres of Cyber Security Excellence program19 should include specific provision for OT security courses to be created, either as stand-alone courses or as part of broader curriculums.

Courses should be available both for those entering the workforce and as ongoing education and professional development for those in the industry. Formal education can be supplemented by other approaches, such as a program of secondments between IT and OT security teams. In any case, while an OT security team needs to be specialised and focused on this area, it will need to work closely with IT security professionals to share expertise and also to identify and stop threats that cross the domains.

Sharing threat information

In cybersecurity, we’re stronger together, and OT security is no exception. Given the relative lack of maturity and the potential risks, it’s vital that there are effective mechanisms for sharing threat information and lessons learned. There seems to be a divide in the availability of sector-specific OT threat intelligence—two-thirds of organisations surveyed for this report received it regularly, but one-third said they received it rarely or not at all. The sharing of OT security information seems to be noticeably less common than for IT security; the reasons cited included resources, contact details and security clearances being focused on IT security.

Several organisations within government can help with building cross-sector threat intelligence information and disseminating it, including the TISN, the Australian Cyber Security Centre and the Business and Government Liaison Unit in the Australian Security Intelligence Organisation. However, there need to be clear leadership and ownership to make this happen, not just by top-down information flow from government but by facilitating sharing between peers in each sector.

This should also be accessible to a broad range of geographically dispersed stakeholders—tier 1 major companies can attend summits in Canberra, but local councils running transport or water companies won’t have the resources for extensive travel. It’s possible that the Critical Infrastructure Centre’s TISN could take on this leadership role, but it would require a significant boost in resources and a change in its operating model to be able to do so.

Incident response readiness

Organisations need to ensure that they have clear response and recovery plans for attacks. The plans need to go beyond theoretical documents that are dusted off and read only when something goes wrong. As noted, there’s room for improvement in testing incident response plans, but organisations need to go one step further with active war-gaming exercises that bring together boards, executives and business continuity teams to work through scenarios, and technical red-team testing that simulates the potential activity of an attacker to test detection and response capabilities.

The Australian Cyber Security Centre runs a national program for the owners and operators of Australia’s critical infrastructure that uses exercises and other readiness activities that target strategic decision-making, operational and technical capabilities, strategic engagement and communications. Additional resources could be provided to ensure that this is extended to cover OT security incident scenarios and is accessible across the spectrum of critical infrastructure providers.

Conclusions and recommendations

Given the potential impact to society and our national security from the accelerating convergence of IT and OT systems, it’s important that this issue is prioritised and managed effectively. Research for this report has shown a general lack of focus, mature understanding and effective solutions. Some of the measures outlined above are already being implemented, but may still need accelerating or boosting, and some are more critical than others. The top three recommendations are as follows:

  1. Boards of critical infrastructure providers need to explicitly set their OT cyber risk tolerance and monitor their organisation’s performance against it. This requires a combination of regulatory mandate and enforcement (building on existing regulatory models, learning from the experience in implementing the telecommunications sector security regulations, and enabling boards to manage risk); for example, through recommended standards and approaches tailored to each sector. Considering ‘worst-case’ outcomes may lead to a list of critical assets that by default should not be connected to external systems unless there are a compelling benefit and robust measures to manage the security risks arising from the connection. The Critical Infrastructure Centre would appear to be best placed to coordinate and drive this across Australia to ensure a common best-practice approach.
  2. Better education and information are needed at all levels to improve the understanding and management of risks, from both a business and a technical point of view. Key areas for action are:
  • General awareness and training. Specialised skills will be in short supply, but boards can be enabled to be curious to ask the right questions to understand and measure the risks and build the right culture, and all users should be educated in threat awareness and basic ‘hygiene’ to remove some of the easy targets for attackers.
  • Specialist courses. The creation and delivery of specific OT security courses should be included in plans for university, TAFE and other institutional programs. 
  • Better threat information sharing. Clarity should be provided on the current range of government agencies that can help with threat intelligence sharing, providing clear leadership and ownership of this responsibility for the critical infrastructure sector.
  • Technical information sharing. There appears to be a perception that there’s a lack of appropriate commercial solutions for protecting OT systems, but globally the market can appear crowded. The maturity of commercial solutions specifically to address OT security requirements should be reviewed. This information could be shared with providers and also used to identify whether there’s a gap that may merit government investment to help accelerate the development of the capabilities needed.

The Australian Cyber Security Centre could lead this activity, aligned with its existing programs of work.

  1. Resources need to be prioritised to ensure that the appropriate organisations are able to implement all of the required actions at the required pace. The longer that action is delayed, the more of a head start malicious actors will have, the more convergence will have taken place without security being at the core, and the greater will be the threat.

Address by author Rajiv Shah at launch event.


Acknowledgements

The author would like to thank Aakriti Bachhawat for her assistance in running the survey, and all those who took the time to respond. Thanks also to those respondents and other government and industry experts who made themselves available for discussions that provided valuable input to this paper.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society. It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. This research was made possible thanks to the generous support of Thales.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. Gartner, Inc., ‘Operational technology (OT)’, IT glossary, no date, online. ↩︎
  2. Australian Government, Critical Infrastructure Resilience Strategy, 2010, online. ↩︎
  3. Wolfgang Schwab, Mathieu Poujal, The state of industrial cybersecurity 2018, CXP Group, June 2018, online. ↩︎
  4. Christy Petty, ‘When IT and operational technology converge’, Smarter with Gartner, 13 January 2017, online. ↩︎
  5. Gemalto, The state of IoT security, 2018, online. ↩︎
  6. Michael Crawford, ‘Utility attack led to security overhaul’, Computerworld Australia, 16 February 2006, online. ↩︎
  7. Jose Pagliery, ‘The inside story of the biggest hack in history’, CNN Money, 5 August 2015, online. ↩︎
  8. Nicole Perlroth, Clifford Krauss, ‘A cyberattack in Saudi Arabia had a deadly goal. Experts fear another try’, New York Times, 15 March 2018, online. ↩︎
  9. John Hultquist, ‘Threat research: Sandworm team and the Ukrainian power company attacks’, FireEye, 7 January 2016, online. ↩︎
  10. Electricity Information Sharing and Analysis Center, Analysis of the cyber attack on the Ukrainian power grid: defense use case, 18 March 2016, online. ↩︎
  11. US Department of Homeland Security, ‘Alert (TA18‑074A): Russian Government cyber activity targeting energy and other critical infrastructure sectors’, US Government, 16 March 2018, online. ↩︎
  12. Josh Fruhlinger, ‘The Mirai botnet explained: how teen scammers and CCTV cameras almost brought down the internet’, CSO, 9 March 2018, online. ↩︎
  13. Schwab & Poujal, The state of industrial cybersecurity 2018. ↩︎
  14. Digital NSW, NSW Government policy: cyber security policy, NSW Government, February 2019, online. ↩︎
  15. Office of Scientific and Technical Information, Consequence-driven cyber-informed engineering (CCE), US Department of Energy, 18 October 2018, online. ↩︎
  16. Australian Energy Market Operator, 2018 summary report into the cyber security preparedness of the national and WA wholesale electricity markets, December 2018, online. ↩︎
  17. AustCyber, Australia’s cyber security sector competitiveness plan, Australian Cyber Security Growth Network, 2018, online. ↩︎
  18. Honeywell, Honeywell industrial USB threat report: universal serial bus (USB) threat vector trends and implications for industrial operators, 2019, online. ↩︎
  19. Department of Education and Training, ACCSE program guidelines, Australian Government, 13 February 2017, online. ↩︎

Mapping China’s Tech Giants

This report accompanies the Mapping China’s Tech Giants website.

This is our first report on the topic – updated reports are also available; 

Executive summary

Chinese technology companies are becoming increasingly important and dynamic actors on the world stage. They’re making important contributions in a range of areas, from cutting-edge research to connectivity for developing countries, but their growing influence also brings a range of strategic considerations. The close relationship between these companies and the Chinese Communist Party (CCP) raises concerns about whether they may be being used to further the CCP’s strategic and geopolitical interests.

The CCP has made no secret about its intentions to export its vision for the global internet. Officials from the Cyber Administration of China have written about the need to develop controls so that ‘the party’s ideas always become the strongest voice in cyberspace.’1 This includes enhancing the ‘global influence of internet companies like Alibaba, Tencent, Baidu [and] Huawei’ and striving ‘to push China’s proposition of internet governance toward becoming an international consensus’.

Given the explicitly stated goals of the CCP, and given that China’s internet and technology companies have been reported to have the highest proportion of internal CCP party committees within the business sector,2 it’s clear these companies are not purely commercial actors.

ASPI’s International Cyber Policy Centre has created a public database to map the global expansion of 12 key Chinese technology companies. The aim is to promote a more informed debate about the growth of China’s tech giants and to highlight areas where this expansion is leading to political and geostrategic dilemmas. It’s a tool for journalists, researchers, policymakers and others to use to understand the enormous scale and complexity of China’s tech companies’ global reach.

The dataset is inevitably incomplete, and we invite interested users to help make it more comprehensive by submitting new data through the online platform.

Our research maps and tracks:

  • 17,000+ data points that have helped to geo-locate 1700+ points of overseas presence for these 12 companies;
  • 404 University and research partnerships including 195+ Huawei Seeds for the Future university partnerships;
  • 75 ‘Smart City’ or ‘Public Security Solution’ projects, most of which are in Europe, South America and Africa;
  • 52 5G initiatives, across 34 countries;
  • 119 R&D labs, the greatest concentration of which are in Europe;
  • 56 undersea cables, 31 leased cable and 17 terrestrial cables;
  • 202 data centres and 305 telecommunications & ICT projects spread across the world.

Introduction

China’s technology, internet and telecommunications companies are among the world’s largest and most innovative. They’re highly competitive, and many are leaders in research and development.

They’ve played a central role in bringing the benefits of modern technology to hundreds of millions of people, particularly in the developing world.

As a function of their increasingly global scale and scope, China’s tech giants can exert increasing levels of influence over industries and governments around the world. The close relationship between Chinese companies and the Chinese Communist Party (CCP) means that the expansion of China’s tech giants is about more than commerce.

A key research question includes: What are the geostrategic, political and human rights implications of this expansion? By mapping the global expansion of 12 of China’s largest and most influential technology companies, across a range of sectors, this project contributes new data and analysis to help answer such questions.

All Chinese companies are subject to China’s increasingly stringent security, intelligence, counter-espionage and cybersecurity laws.3 That includes, for example, requirements in the CCP constitution4 for any enterprise with three or more full party members to host internal party committees, a clause in the Company Law5 that requires companies to provide for party activity to take place, and a requirement in the National Intelligence Law to cooperate in and conceal involvement in intelligence work.6

Several of the companies included in this research are also directly complicit in human rights abuses in China, including the reported detention of up to 1.5 million Uyghur Muslims in Xinjiang.7 From communications monitoring to facial recognition that enables precise and pervasive surveillance, advanced technology – from these and other companies – is crucial to the increasingly inescapable surveillance net that the CCP has created for some Chinese citizens.

Every year since 2015, China has ranked last in the annual Freedom on the Net Index.8 The CCP has made no secret of its desire to export its concepts of internet and information ‘sovereignty’,9 as well as cyber censorship,10 around the world.11 Consistent with that directive, this research shows that Chinese companies are playing a role in aiding surveillance and providing sophisticated public security technologies and expertise to authoritarian regimes and developing countries that face challenges to their political stability, governance and rule of law.

In conducting this research, ASPI’s International Cyber Policy Centre (ICPC) has used open-source information in English and Chinese to track the international operations and investments of12 major Chinese technology companies: Huawei, ZTE, Tencent, Baidu, China Electronics Technology Group Corporation (CETC), Alibaba, China Mobile, China Telecom, China Unicom, Wuxi, Hikvision and BGI.

This research has been compiled in an online database that ICPC is making freely accessible to the public. While it contains more than 1,700 projects and more than 17,000 data points, it’s not exhaustive. We welcome and encourage members of the public to help us make this dataset more complete by submitting data via the website.

The database

Throughout 2018, ICPC received frequent questions from media and stakeholders about the international activities of Chinese technology companies; for example, about Huawei’s operations in particular regions or how widespread the use of Baidu or WeChat is outside of China.

These were always difficult questions to answer, as there’s a lack of publicly available quantitative and qualitative data, and some of these companies disclose little in the way of policies that affect data, security, privacy, freedom of expression and censorship. What information is available is spread across a wide range of sources and hasn’t been compiled. In-depth analysis of the available sources also requires Chinese-language capabilities, an understanding of Chinese state financing structures, and the use of internet archiving services as web pages are moved, altered or even deleted.

A further impediment to transparency is that Chinese media are under increasing control from the CCP and publish few investigative reports, which severely limits the available pool of media sources. The global expansion and influence of US internet companies, particularly Facebook, for example, has rightly received substantial attention and scrutiny over the past few years. Much of that scrutiny has come from, and will continue to come from, independent media, academia and civil society.

However, the same scrutiny is often lacking when it comes to Chinese tech and social media companies. The sheer capacity of China’s giant tech companies, their reach and influence, and the unique party-state environment that shapes, limits and drives their global behaviour set them apart from other large technology companies expanding around the world.

This project seeks to:

  1. Analyse the global expansion of a key sample of China’s tech giants by mapping their major points of overseas presence.
  2. Provide the public with an analysis of the governance structures and party-state politics from which those companies have emerged and with which they’re deeply entwined.

The data and map is available here: https://chinatechmap.aspi.org.au/

Methodology

To fill this research gap, ICPC sought to create an interactive global database to provide policymakers, academics, journalists, government officials and other interested readers with a more holistic picture of the increasingly global reach of China’s tech giants.

A complete mapping of all Chinese technology companies globally would be impossible within the confines of our research. ICPC has therefore selected 12 companies from across China’s telecommunications, technology, internet and biotech sectors:

  • Alibaba
  • Baidu
  • BGI
  • China Electronics Technology Group (CETC)
  • China Mobile
  • China Telecom
  • China Unicom
  • Hikvision (a subsidiary of CETC)
  • Huawei
  • Tencent
  • Wuxi
  • ZTE

This dataset will continue to be updated during 2019. This research relied on open-source information in English and Chinese. This has included company websites, corporate information, tenders, media reporting, databases and other public sources.

The size and complexity of these companies, and the speed at which they’re expanding, means this dataset will inevitably be incomplete. For that reason, we encourage researchers, journalists, experts and members of the public to contribute and submit data via the online platform in order to help make the dataset more complete over time.

China’s tech firms & the CCP

The CCP’s influence and reach into private companies has increased sharply over the past decade.

In 2006, 178,000 party committees had been established in private firms.12 By 2016, that number had increased sevenfold to approximately 1.3 million.13 Today, whether the companies, their leadership, and their employees like it or not, the CCP is present in private and public enterprise. Often the activity of party committees and party-building activity is linked to the CCP’s version of the concept of ‘corporate social responsibility’14—a concept that the party has explicitly politicised. For instance, in the publishing industry, corporate social responsibility includes political responsibility15 and protecting state security.16 Internet and technology companies are believed to have the highest proportion of CCP party committees in the private sector.17

This expanding influence and reach also extends to foreign companies. For example, by the end of 2016, the CCP’s Organisation Department claimed that 70% of China’s 100,000 foreign enterprises possessed party organisations.18 Expanding the party’s reach and role inside private enterprises appears to have been a priority since party chief Jiang Zemin’s ‘Three Represents’ policy, which opened party membership to businesspeople, became CCP doctrine in 2002.

All the companies mapped as a part of this project have party committees, party branches and party secretaries. For example, Alibaba has around 200 party branches;19 in 2017 it was reported that Tencent had 89 party branches;20 and Huawei has more than 300.21

Sometimes, the relevance and significance of the CCP’s presence within technology companies is dismissed or trivialised as merely equivalent to the presence of government relations or human resources departments in Western corporations. However, the CCP’s expectations of these committees is clear.22 The CCP’s constitution states that a party organisation ‘shall be formed in any enterprise … and any other primary-level work unit where there are three or more full party members’.23 Article 32 outlines their responsibilities, which include encouraging everyone in the company to ‘consciously resist unacceptable practices and resolutely fight against all violations of party discipline or state law’. Article 33 states that party committees inside state-owned enterprises are expected to ‘play a leadership role, set the right direction, keep in mind the big picture, ensure the implementation of party policies and principles, and discuss and decide on major issues of their enterprise in accordance with regulations’.24

The establishment and expansion of party committees in private enterprises appears to be one of the ways in which Beijing is trying to reduce financial risks and exercise control over the economy. Because entities ‘cannot be without the party’s voice’ and ‘must safeguard the state-owned assets and interests from damage’,25 the party committees are expected to weigh in on major decisions and policies, including the appointment and dismissal of important cadres, major project investment decisions and large-scale capital expenditures.26 

Although this guidance is longstanding practice in state-owned enterprises, it also appears to be taking root in private enterprises. Conducting a review of corporate disclosures in 2017, the Nikkei Asian Review identified 288 companies listed in China that ‘changed their articles of association to ensure management policy that reflects the party’s will’.27 In 2018, 26 publicly listed Chinese banks revised their articles of association to support party committees and the establishment of subordinate discipline inspection committees. Many of the revised articles reportedly include language requiring party consultation before major decisions are made.28

This control mechanism is explicit in the party’s vetting of business leaders. For example, although he’s not a party member, Baidu CEO Robin Li is a member of the Chinese People’s Political Consultative Conference, the country’s primary ‘united front’ body.29 The party conducts a comprehensive assessment of any of the business executives brought into official advisory bodies managed by the United Front Work Department, the Chinese People’s Political Consultative Conference and the National People’s Congress. Two of the four criteria – which relates to a business person’s political inclinations – include, their ‘ideological status and political performance’, as well as their fulfillment of social responsibilities. And second, their personal compliance with laws and regulations.30

Enabling & exporting digital authoritarianism

The crown jewel of Chinese foreign policy under Xi Jinping is the Belt and Road Initiative (BRI), which is to be a vast global network of infrastructure intended to enable the flow of trade, people and ideas between China and the rest of the world.31 Technology, under the banner of the Digital Silk Road, is a key component of this project.

China’s ambitions to influence the international development of technological norms and standards are openly acknowledged.32 The CCP recognises the threat posed by an open internet to its grip on power—and, conversely, the opportunities that dominance over global cyberspace could offer by extending that control.33

In a 2017 article published in one of the most important CCP journals, officials from the Cyber Administration of China (the top Chinese internet regulator) wrote about the need to develop controls so that ‘the party’s ideas always become the strongest voice in cyberspace.’34 This includes enhancing the ‘global influence of internet companies like Alibaba, Tencent, Baidu [and] Huawei’ and striving ‘to push China’s proposition of internet governance toward becoming an international consensus’.

Officials from the Cyberspace Administration of China have written that ‘cyberspace has become a new field of competition for global governance, and we must comprehensively strengthen international exchanges and cooperation in cyberspace, to push China’s proposition of Internet governance toward becoming an international consensus.’35 China’s technology companies are specifically referenced as a part of this effort: ‘The global influence of Internet companies like Alibaba, Tencent, Baidu, Huawei and others is on the rise.’36

Western technology firms have attracted heated criticism for making compromises in order to engage in the Chinese market, which often involves constraining free speech or potentially abetting human rights abuses.37 This attention is warranted and should continue. However, strangely, global consumers have so far been less critical of the Chinese firms that have developed and deployed sophisticated technologies that now underpin the CCP’s ability to control and suppress segments of China’s population38 and which can be exported to enable similar control of other populations.

The ‘China model’ of digitally enabled authoritarianism is spreading well beyond China’s borders. Increasingly, the use of technology for repression, censorship, internet shutdowns and the targeting of bloggers, journalists and human rights activists are becoming standard practices for non-democratic regimes around the world. 

In its 2018 Freedom on the net report, Freedom House singled out China as the worst abuser of human rights on the internet. The report also found that the Chinese Government is actively seeking to export its moral and ethical norms, expertise and repressive capabilities to other nations. In addition to the Chinese Government’s efforts, Freedom House specifically called out the role of the Chinese tech sector in facilitating the spread of digital repression. It found that Chinese companies:

have supplied telecommunications hardware, advanced facial-recognition technology, and data analytics tools to a variety of governments with poor human rights records, which could benefit Chinese intelligence services as well as repressive local authorities. Digital authoritarianism is being promoted as a way for governments to control their citizens through technology, inverting the concept of the internet as an engine of human liberation.39

Reporters Without Borders has also sounded the alarm over the involvement of Chinese technology companies in repressing free speech and undermining journalism. As part of an extensive report on the Chinese Government’s attempts to reshape the world’s media in its own image, it concluded that:

From consumer software apps to surveillance systems for governments, the products that China’s hi-tech companies try to export provide the regime with significant censorship and surveillance tools … In May 2018, the companies were enlisted into the China Federation of Internet Societies (CFIS), which is openly designed to promote the Chinese Communist Party’s presence within them. Chinese hi-tech has provided the regime with an exceptional influence and control tool, which it is now trying to extend beyond China’s borders.40

Pushing back against both the practices of digital authoritarianism and the norms and values that underpin such practices requires a clear-eyed understanding of the way they’re being spread. For example, a study of the BRI has found that the ways in which some BRI projects, including digital projects, are structured create serious concerns about the erosion of sovereignty for host nations, such as when a recipient government doesn’t have full control of the operations, management, digital infrastructure or data being generated through those projects.41

Sovereign governments are, of course, ultimately responsible for their actions. For some, particularly Western governments, this includes being transparent and accountable in their use of technology for surveillance and information control. And, if they aren’t, the media, civil society and the public have avenues to hold them to account. However, companies also have responsibilities in this space, which is why many sensitive and dual-use technologies are subject to export controls. The need for companies to be held accountable for how new technologies are used is particularly acute in developing countries, where the state may be less able or less willing to do so because of challenges arising from governance, legislative and regulatory capacity, transparency and corruption.

The following case studies have been selected as illustrations of the ways in which Chinese technology companies, often with funding from the Chinese Government, are aiding authoritarian regimes, undermining human rights and exerting political influence in regions around the world.

Surveillance cities: Huawei’s ‘smart cities’ projects

An important and understudied part of the global expansion of Chinese tech companies involves the proliferation of sophisticated surveillance technologies and ‘public security solutions’.42 Huawei is particularly dominant in this space, including in developing countries where advanced surveillance technologies are being introduced for the first time.

Through this research and as of April 2019, we have mapped 75 Smart City-Public Security projects, most of which involve Huawei.43 Those projects—which are often euphemistically referred to as ‘safe city’ projects—include the provision of surveillance cameras, command and control centres, facial and licence plate recognition technologies, data labs, intelligence fusion capabilities and portable rapid deployment systems for use in emergencies.

The growth of Huawei’s ‘public security solution’ projects has been rapid. For example, the company’s ‘Hisilicon’ chips reportedly make up 60% of chips used in the global security industry.44 In 2017, Huawei listed 40 countries where its smart-city technologies had been introduced;45 in 2018, that reach had reportedly more than doubled to 90 countries (including 230 cities). Because of a lack of detail or possible differences in definition, this project currently covers 43 countries.46

This research has found that, in many developing countries, exponential growth is being driven by loans provided by China Exim Bank (which is wholly owned by the Chinese Government).47 The loans, which must be paid back by recipients,48 are provided to foreign governments, and it’s been reported in academia and the media that the contractors used must be Chinese companies.49 In many of the examples examined, Huawei was awarded the primary contract; in some cases, the contract was managed by a Chinese state-owned enterprise and Huawei played a ‘sub-awardee’ role as a provider of surveillance equipment and services.50

Smart-city technologies can impart substantial benefits to states using them. For example, in Singapore, increased access to digital services and the use of technology that exploits the ‘internet of things’ (for traffic control, health care and video surveillance) has led to increased citizen mobility and productivity gains.51

However, in many cases, Huawei’s safe-city solutions focus on the introduction of new public security capabilities, including in countries such as Ecuador, Pakistan, the Philippines, Venezuela, Bolivia and Serbia. Many of those countries rank poorly, some very poorly, on measures of governance and stability, including the World Bank’s governance indicators of political stability, the absence of violence, the control of corruption and the rule of law.52

Of course, the introduction of new public security technologies may have made cities ‘safer’ from a crime prevention perspective, but, unsurprisingly, in some countries it’s created a range of political and capacity problems, including alleged corruption; missing money and opaque deals;53 operational and ongoing maintenance problems;54 and alleged national security concerns.55

Censorship and suppression: aiding authoritarianism in Zimbabwe

The example set by the Chinese state is increasingly being looked to by non-democratic regimes—and even some democratic governments—as proof that a free and open internet is neither necessary nor desirable for development. ‘If China could become a world power without a free Internet, why do African countries need a free internet?’ one unnamed African leader reportedly asked interviewers from the Department of Media Studies at the University of Witwatersrand.56 

The business dealings of Chinese technology companies in Zimbabwe, for example, are closely entwined with the CCP’s support for the country’s authoritarian regime. China is Zimbabwe’s largest source of foreign investment, partly as a result of sanctions imposed by Western countries over human rights violations by the regime. Zimbabwean President Emmerson Mnangagwa’s first visit outside of Africa after his election was to China, where he thanked President Xi Jinping and China for supporting Zimbabwe against Western sanctions and called for even deeper economic and technical cooperation between the two nations.57

Chinese companies play a central role in Zimbabwe’s telecommunications sector. Huawei has won numerous multimillion-dollar contracts with state-owned cellular network NetOne, some of which have been the subject of corruption allegations.58 Several of Huawei’s Zimbabwe projects have been financed through Chinese Government loans.59

ZTE also has a significant footprint in the country (and has also been the subject of corruption allegations).60 This has included a $500 million loan, in partnership with China Development Bank, to Zimbabwe’s largest telco, Econet, in 2015.61 ZTE has previously provided equipment, including radio base stations, for Econet’s 3G network.62 Zimbabwean telecommunications providers currently owe millions of dollars to Huawei and ZTE, as well as Ericsson, which reportedly led to network disruptions in March 2019.63

The CCP and Chinese companies haven’t just helped to cushion Zimbabwe’s leaders against the impact of sanctions. They’re also providing both a model and means for the regime’s authoritarian practices to be brought forward into the digital age, both online and offline.

The Zimbabwean Government has been considering draconian new laws to restrict social media since at least 2016, when the official regulator issued an ominous warning to internet users against ‘generating, passing on or sharing such abusive and subversive materials’.64 In the same year, a law was passed to allow authorities to seize devices in order to prevent people using social media.65

In early 2019, the government blocked social media and imposed internet shutdowns in response to protests against fuel price increases. Information Minister Energy Mutodi stated that ‘social media was used by criminals to organize themselves … this is why the government had to … block [the] internet,’ as he announced plans for forthcoming cybercrime laws to criminalise the use of social media to spread ‘falsehoods’.66

The government has openly been looking to China as a model for controlling social media,67 including by creating a cybersecurity ministry, which a spokesperson described as ‘like a trap used to catch rats’.68

Parts of this ‘trap’ reportedly come from China. In 2018, it was reported that China, alongside Russia and Iran, had been helping Zimbabwe to set up a facility to house a ‘sophisticated surveillance system’ sold to the government by ‘one of the largest telecommunications companies’ in China.69 Given the description and context, it seems plausible that this company may be Huawei or ZTE.

‘We have our means of seeing things these days, we just see things through our system. So no one can hide from us, in this country,’ said former Intelligence Minister Didymus Mutasa.70 

The government is increasingly looking to expand its surveillance from the online space into the real world. It’s signed multiple agreements with Chinese companies for physical surveillance systems, including a highly controversial planned national facial recognition system with Chinese company CloudWalk.71

It’s also interested in developing its own indigenous facial recognition technology, and is working with CETC subsidiary Hikvision to do it.72 Hikvision is already supplying surveillance cameras for police and traffic control systems.73 In 2018, Zimbabwean authorities signed a memorandum of understanding with the company to implement a ‘smart city’ program in Mutare. This included the donation of facial recognition terminals equipped with deep-learning artificial intelligence (AI) systems.

In a media statement, the government stated: 

The software is meant to be integrated with the facial recognition hardware which will be made locally by local developers in line with the government’s drive to grow the local ICT sector making Zimbabwe to be the number one country in Africa to spearhead the facial recognition surveillance and AI system nationwide in Zimbabwe.74

National ID programs: Venezuela’s ‘Fatherland Card’

Chinese tech companies are involved in national identity programs around the world. One of the most concerning examples is playing out amid the political and humanitarian crisis in Venezuela. A Reuters investigation in 2018 uncovered the central role played by ZTE in inspiring and implementing the Maduro regime’s ‘Fatherland Card’ program.75 The Fatherland Card (Carnet de la Patria) records the holder’s personal data, such as their birthday, family information, employment, income, property owned, medical history, state benefits received, presence on social media, membership of a political party and history of voting.

Although the card is technically voluntary, without it Venezuelans can be denied access to government-subsidised food, medication or gasoline.76 In the midst of Venezuela’s political crisis, registering for a ‘voluntary’ card is no choice at all for many. In fact, people in Caracas are queuing for hours to get hold of one, despite the risks of handing over personal data to the increasingly unstable and repressive Maduro regime.77

According to Reuters, ZTE was contracted by the government to build the underlying database and accompanying mobile payment system. A team of ZTE employees was embedded with Cantv, the Venezuelan state telecommunications company that manages the database, to help secure and monitor the system. ZTE has also helped to build a centralised government video surveillance system.

There are concerns that the card program is being used as a tool to interfere in the democratic process. During the 2018 elections, observers reported kiosks being set up near or even inside voting centres, where voters were encouraged to scan their cards to register for a ‘fatherland prize’.78 Those who did so later received text messages thanking them for voting for Maduro (although they never did get the promised prize).

Authorities claim that the cards record whether a person voted, but not whom they voted for. However, an organiser interviewed by Reuters claimed to have been instructed by government managers to tell voters that their votes could be tracked. Regardless of the truth of the matter, even the rumours that the government may be watching who votes for it—or, perhaps more pertinently, against it—could be expected to influence the way people vote.

In the context of the current crisis, this technologically enabled population control takes on an even sharper edge. Cyberspace has emerged as a key battleground in the struggle between the Maduro regime and the Venezuelan opposition led by Juan Guaidó.

In addition to selective social media blocks79 and total internet shutdowns,80 there’s also evidence of more insidious attacks. For example, a website set up by the opposition to coordinate humanitarian aid delivery was subject to a DNS hijacking attack, including the theft of the personal data of potentially thousands of pro-opposition volunteers.81

Cantv, Venezuela’s government-run telecommunications company, is reportedly ‘dependent on agreements with ZTE and Huawei to supply equipment and staff and … Cantv sends its employees to China to receive training.’82 These deals are financed through the Venezuela China Joint Fund. China is known as something of an international leader in DNS blocking and manipulation, and the Chinese Government is strongly supporting the Maduro regime, including by targeting social media users in China who post or share content critical of Maduro.83

Shaping politics and policy in Belarus

In some parts of the world, Chinese technology companies are helping shape the politics and policy of new technologies through the development of high-level relationships with national governments. This is particularly concerning in the case of non-democratic countries.

Often referred to as ‘Europe’s last dictatorship’, Belarus has been under the control of authoritarian strongman Aleksandr Lukashenko since 1994.84 In recent years, ties with China have come to play an increasingly significant role not only in Belarus’s delicate diplomatic relations with its powerful neighbours, but also in its very indelicate domestic policies of violent repression. This has included the use of digital technologies for mass surveillance and the targeted persecution of activists, journalists and political opponents.85

Huawei has been supplying video surveillance and analysis systems to the Lukashenko regime since 2011 and border monitoring equipment since at least 2014.86 Also in 2014, Huawei’s local subsidiary, Bel Huawei Technologies, launched two research labs for ‘intellectual remote surveillance systems’. Through the labs, Huawei provides ‘laboratory-based training … for the specialists of Promsvyaz, Beltelekom, HSCC and other organisations’.87

Over the past several years, collaboration between the Belarusian Government and Chinese technology companies has expanded rapidly, in line with Belarus’s engagement with the BRI and with deepening diplomatic and economic ties between Lukashenko’s regime and the CCP.88

In March 2019, Belarus unveiled a draft information security law. ‘It is purely our own product. We didn’t borrow it from anyone,’ State Secretary of the Security Council Stanislav Zas told Belarusian state media.89

A day later, China’s ambassador to Belarus spoke to the same outlet about how ‘Belarusian and Chinese companies [have] managed to establish intensive cooperation in the area of cyber and information security’, and about the desire of both countries to ‘expand cooperation in the sphere of cybersecurity’.90

‘Both countries have good practice in this field. We are going to even deeper cooperate [sic] and share experience,’ the Chinese ambassador said. 

Huawei has played an especially prominent role in this process at multiple levels. It has continued and expanded the training it provides to Belarusians, including sending students to study in China and signing an agreement with the Belarusian State Academy of Communications for a joint training centre.91

Huawei is also exerting political and policy influence. In May 2018, the company released its National ICT priorities for the Republic of Belarus.92 The proposal includes recommendations for ‘public safety’ technologies, such as video surveillance and drones, and a citizen status identification system.

‘Belarus has not yet widely deployed integrated police systems, and thus can refer to the solution adopted in Shenzhen,’ the document notes. This is likely to be a reference to the facial recognition program implemented by Shenzhen police to ‘crack down on jaywalking’.93

During a meeting with the chairman of Huawei’s board, Guo Ping, for the launch of the plan, then Belarusian Prime Minister Andrei Kobyakov expressed his hope that: the accumulated experience and prospects of cooperation will play an important role in the development of information and communication technologies in Belarus and in making friendship between our countries stronger. The Belarusian government counts on further effective interaction and professional cooperation.94

Controlling information flows—WeChat and the future of social messaging

Launched in 2011, WeChat quickly became China’s dominant social network but has largely struggled to build up a significant user base overseas. Still, of the social media super-app’s 1.08 billion monthly active users,95 an estimated 100–200 million are outside China.96

Southeast Asia provides the most fertile ground for WeChat outside of China: the app has 20 million users in Malaysia; 17% of the population of Thailand use it;97 and it’s the second most popular messaging app in Bhutan and Mongolia.98

The potential for WeChat to substantially grow its user base overseas remains, particularly as it hits a wall in user growth in China99 and overseas expansion becomes more of an imperative. To the extent that it’s being used outside of mainland China, WeChat poses significant risks as a channel for the dissemination of propaganda and as a tool of influence among the Chinese diaspora.

WeChat is increasingly used by politicians in liberal democracies to communicate with their ethnic Chinese voters, which necessarily means that communication is subject to CCP censorship by default.100

In one instance, in September 2017 Canadian parliamentarian Jenny Kwan posted a WeChat message of support for Hong Kong’s Umbrella Movement – a series of pro-democracy protests that took place in 2014 – only to have it censored by WeChat.101

In 2018, Canadian police received complaints about alleged vote buying taking place on WeChat.102 A group called the Canada Wenzhou Friendship Society was reportedly using the app to offer voters a $20 ‘transportation fee’ if they went to the polls and encouraging them to vote for specific candidates.

Because WeChat is one of the main conduits for Chinese-language news, censorship controls help Beijing to ensure that news sources using the app for distribution report only news that serves the CCP’s strategic objectives.103

WeChat is not only a significant influence and censorship tool for the CCP, but also has the potential to facilitate surveillance. An Amnesty International study ranking global instant messaging apps on how well they use encryption to protect online privacy gave WeChat a score of 0 out of 100.104 Content that passes through WeChat’s servers in China is accessible to the Chinese authorities by law.105

Enabling human rights abuses in China: Uyghurs in Xinjiang

Many of the repressive techniques and technologies that Chinese companies are implementing abroad have for a long time been used on Chinese citizens. In particular, the regions of Tibet and Xinjiang are often at the bleeding edge of China’s technological innovation.

The complicity of China’s tech giants in perpetrating or enabling human rights abuses—including the detention of an estimated 1.5 million Chinese citizens106 and foreign citizens107—foreshadows the values, expertise and capabilities that these companies are taking with them out into global markets. 

From the phones in people’s pockets to the tracking of 2.5 million people using facial recognition technology108 to the ‘re-education’ detention centres,109 Chinese technology companies—including several of the companies in our dataset—are deeply implicated in the ongoing surveillance, repression and persecution of Uyghurs and other Muslim ethnic minority communities in Xinjiang.

Many of the companies covered in this report collaborate with foreign universities on the same kinds of technologies they’re using to support surveillance and human rights abuses in China. For example, CETC—which has research partnerships with the University of Technology Sydney,110 the University of Manchester111 and the Graz Technical University in Austria112—and its subsidiary Hikvision are deeply implicated in the crackdown on Uyghurs in Xinjiang. CETC has been providing police in Xinjiang with a centralised policing system that draws in data from a vast array of sources, such as facial recognition cameras and databases of personal information. The data is used to support a ‘predictive policing’ program, which according to Human Rights Watch is being used as a pretext to arbitrarily detain innocent people.113 CETC has also reportedly implemented a facial recognition project that alerts authorities when villagers from Muslim-dominated regions move outside of prescribed areas, effectively confining them to their homes and workplaces.114

Huawei provides the Xinjiang Public Security Bureau with technical support and training.115 At the same time, it has funded more than 1,200 university research projects and built close ties to many of the world’s top research institutions.116 The company’s work with Xinjiang’s public security apparatus also includes providing a modular data centre for the Public Security Bureau of Aksu Prefecture in Xinjiang and a public security cloud solution in Karamay. In early 2018, the company launched an ‘intelligent security’ innovation lab in collaboration with the Public Security Bureau in Urumqi.117

According to reporting, Huawei is providing Xinjiang’s police with technical expertise, support and digital services to ensure ‘Xinjiang’s social stability and long-term security’. 

Hikvision took on hundreds of millions of dollars worth of security-related contracts in Xinjiang in 2017 alone, including a ‘social prevention and control system’ and a program implementing facial-recognition surveillance on mosques.118 Under the contract, the company is providing 35,000 cameras to monitor streets, schools and 967 mosques, including video conferencing systems that are being used to ‘ensure that imams stick to a “unified” government script’.119 

Most concerningly of all, Hikvision is also providing equipment and services directly to re-education camps. It has won contracts with at least two counties (Moyu120 and Pishan121) to provide panoramic cameras and surveillance systems within camps.

Future strategic implications

The degree to which nations and communities around the world are coming to rely on Chinese technology companies for critical services and infrastructure, from laying cables to governing their cities, has significant strategic implications both now and for many years into the future:

  • Undermining democracy: Perhaps the greatest long-term strategic concern is the role of Chinese technology companies – and technology companies from other countries that aid or engage in similar behaviour – in enabling authoritarianism in the digital age, from supplying surveillance technologies to automating mass censorship and the targeting of political dissidents, journalists, human rights advocates and marginalised minorities. The most challenging issue is the continued export around the world of the model of vicious, ubiquitous surveillance and repression being refined now in Xinjiang.
  • Espionage and intellectual property theft: The espionage risks associated with Chinese companies are clearly laid out in Chinese law, and the Chinese state has a well-established track record of stealing intellectual property.122 This risk is only likely to increase as ‘smart’ technology becomes ever more pervasive in private and public spaces. From city-wide surveillance to the phones in the pockets of political leaders (or, in a few years, the microphones in their TVs and refrigerators), governments, the private sector and civil society alike need to seriously consider how to better protect their information from malicious cyber actors.
  • Developing technologies: Chinese companies are leading the field in research and development into a range of innovative, and strategically sensitive, emerging technologies. Their global expansion provides them with key resources, such as huge and diverse datasets and access to the world’s best research institutions and universities.123 Fair competition between leading international companies to develop these crucial technologies is only to be expected, and Chinese tech companies have made enormous positive contributions to the sum total of human knowledge and innovation. However, the strategic, political and ideological goals of the CCP—which has directed and funded much of this research—can’t be ignored. From AI to quantum computing to biotechnology, the nations that dominate those technologies will exercise significant influence over how the technologies develop, such as by shaping the ethical norms and values that are built into AI systems, or how the field of human genetic modification progresses. Dominance in these fields will give nations a major strategic edge in everything from economic competition to military conflict.
  • Military competition: In cases of military competition with China, the Chinese Government would of course seek to leverage, to its own advantage, its influence over Chinese companies providing equipment and services to its enemies. This should be a serious strategic consideration for nations when they choose whether to allow Chinese companies to be involved in the build-out of critical infrastructure such as 5G networks, especially given the CCP’s increasing assertiveness and coercion globally.

This issue is particularly acute for countries already experiencing tensions over China’s territorial claims in regions such as the South China Sea. For example, in 2016, after a ruling by a UN-backed tribunal dismissed Chinese claims, suspected Chinese hackers attacked announcement and communications systems in two of Vietnam’s major airports, including a ‘display of profanity and offensive messages in English against Vietnam and the Philippines’.124 A simultaneous hack on a Vietnamese airline led to the loss of more than 400,000 passengers’ data. Vietnam’s Information and Communications Minister said that the government was ‘reviewing Chinese technology and devices’ in the wake of the attack.125 Cybersecurity firm FireEye says that it’s observed persistent targeting of both government and corporate targets in Vietnam that’s suspected to be linked to the South China Sea dispute.126

5G infrastructure build outs should be an area of particular concern. An article in the China National Defence Report in March 2019127 discusses the military applications for China of 5G in the move to ‘intelligentised’ warfare. ‘[A]s military activities accelerate towards extending into the domain of intelligentization, air combat platforms, precision-guided munitions, etc. will be transformed from ‘accurate’ to ‘intelligentized.’ 5G-based AI technology will definitely have important implications for these domains,’ write the authors, who appear to be researchers affiliated with Xidian University and the PLA’s Army Command Academy.

Conclusion

Chinese companies have unquestionably made important and valuable contributions to the technology industry globally, from contributing to cutting edge research and pushing the boundaries of developing technologies, to enabling access to affordable, good quality devices and services for people around the world. They are not going anywhere, and they are going to continue to play a vital role in the ways in which governments, companies and citizens around the world connect with one another.

At the same time, however, it is important to recognise that the activities of these companies are not purely commercial, and in some circumstances risk mitigation is needed. The CCP’s own policies and official statements make it clear that it perceives the expansion of Chinese technology companies as a crucial component of its wider project of ideological and geopolitical expansion. The CCP committees embedded within the tech companies and the close ties (whether through direct ownership, legal obligations or financing agreements including loans and lucrative contracts) between the companies and the Chinese government make it difficult for them to be politically neutral actors, as much as some of the companies might prefer this. There is also a legitimate question about whether global consumers should demand greater scrutiny of Chinese technology firms that facilitate human rights abuses in China and elsewhere.

Governments around the world are struggling with the political and security implications of working with Chinese corporations, particularly in areas such as critical infrastructure, for example in 5G, and in collaborative research partnerships that might involve sensitive or dual-use technologies. Part of this struggle is due to a lack of in-depth understanding of the unique party-state environment that shapes, limits and drives the global behaviour of Chinese companies. This research project aims to help plug that gap so that policymakers, industry and civil society can make more informed decisions when engaging China’s tech giants.


What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.


It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. ASPI is grateful to the US State Department for providing funding for this research project.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. Sarah Cook, ‘China’s cyber superpower strategy: implementation, internet freedom implications, and US responses’, written testimony to House Committee on Oversight and Government Reform, Freedom House, 28 September 2018; Kania et al., ‘China’s strategic thinking on building power in cyberspace: a top party journal’s timely explanation translated’, online. ↩︎
  2. , online. ↩︎
  3. Samantha Hoffman, Elsa Kania, ‘Huawei and the ambiguity of China’s intelligence and counter-espionage laws’, The Strategist, 13 September 2018, online. ↩︎
  4. Constitution of the Communist Party of China, revised and adopted on 24 October 2017, online. ↩︎
  5. People’s Republic of China Company Law, online. ↩︎
  6. Hoffman & Kania, ‘Huawei and the ambiguity of China’s intelligence and counter-espionage laws’. ↩︎
  7. Chris Buckley, Amy Qin, ‘Muslim detention camps are like “boarding schools,” Chinese official says’, New York Times, 12 March 2019, online; Fergus Ryan, Danielle Cave, Nathan Ruser, Mapping Xinjiang’s ‘re-education’ camps, ASPI, Canberra, 1 November 2018, online. ↩︎
  8. ‘China: not free: 88/100’, Freedom on the net 2018, Freedom House, Washington DC, 2018, online. ↩︎
  9. Jun Mai, ‘Xi Jinping renews “cyber sovereignty” call at China’s top meeting of internet minds’, South China Morning Post, 3 December 2017, online. ↩︎
  10. Josh Rogin, ‘White House calls China’s threats to airlines “Orwellian nonsense”’, Washington Post, 5 May 2018, online. ↩︎
  11. Samantha Hoffman, Social credit: technology-enhanced authoritarian control with global consequences, ASPI, Canberra, 28 June 2018, online. ↩︎
  12. Wu Jiao, ‘Party membership up in private firms’, China Daily, 17 July 2007, online. ↩︎

Identity of a nation

Protecting the digital evidence of who we are

Foreword

By far the greatest part of Australia’s discourse on cybersecurity is focused on the protection of systems: the software, the hardware and the communications networks that provide the access, storage and carriage of sensitive information. Without doubt, this is vitally important. After all, it is within the systems of information management that cyber vulnerabilities exist, and it is through understanding the capabilities of adversaries and vulnerabilities of systems that security can be strengthened.

But the thorough analysis of security threats requires more than just ‘capability’. We also need to assess ‘intent’. And more often than not, the intent that motivates a cyberattack is access to data. It’s the data that needs to be protected from exfiltration, manipulation or destruction, because it’s the data that holds information critical to Australia’s agency and success as a sovereign nation. To date, however, there has been very little serious analysis of Australia’s critical data assets or the national policy settings required for the proper recognition and management of this important national resource.

This ASPI report fills that gap, and comes at a crucial time as all Australian Government agencies continue on the path of digital transformation. Anne Lyons has reminded us all that our national identity assets form the heart of who we are as a nation, and her recommendations provide a sharply focused action plan for a whole-of-government policy framework that looks beyond the temporary, technology-driven threats and vulnerabilities affecting the current generation of government ICT and addresses instead the very foundation of Australia’s digital future—the precious data that defines us.

David Fricker
Director-General National Archives of Australia,
President International Council on Archives

2 minute highlights! Anne Lyons discusses her report.

Impact

Throughout history, warfare has damaged and destroyed assets vital to nations’ cultural heritage and national identity. While physical damage is often clear and immediate, cyberattacks targeting a nation’s identity—its way of life, history, culture and memory— wouldn’t have the same physical visibility, but have the potential to cause more enduring and potentially irreparable harm.

In our increasingly digital world, it isn’t difficult to imagine the types of cyberattacks we’ll be likely to face and the degree of impact on irreplaceable national identity assets.

Consider the following:

  • The discovery that digital reference legal documents had been altered could bring the court system to a halt while the integrity of the entire system is reviewed.
  • The deletion, encryption or corruption of information relating to landholdings or births, deaths and marriages would cause widespread societal disruption, stopping everything from property sales to weddings.
  • A synchronised attack on half a dozen key historical archives—such as our entire newspaper archives, historical photo databases, war records and Indigenous archives—would cause an irreplaceable loss that would be likely to cause public outrage and a great collective sense of loss.
  • Because we haven’t anticipated sophisticated attacks against the organisations holding these assets and because they’re generally undervalued, the protections in place are inadequate. And it isn’t just nation-states, but cybercriminals and hacktivists who may cause serious damage.

This isn’t just an Australian problem. Institutions and governments internationally face the same issue as truth becomes a victim of information warfare, fabricated news, and increasing and evolving cyberattacks.

Our national identity assets are the evidence of who we are as a nation—our resources, our people, our culture, our way of life, our land, our freedom, our democracy. What if we had no evidence of who we are, what we own, who governs us, where we have come from?

What’s the problem?

Like other countries, Australia is focused on protecting its critical infrastructure from cyber threats; however, there’s a serious gap in how we approach the protection of our valuable digital national identity assets.

A cyberattack targeting national identity assets has the potential to cause major disruption and collective psychological damage. Such an attack would almost certainly lead to the further erosion of public trust in Australia’s democratic institutions and our reputation internationally. Our vitally important national identity assets aren’t adequately protected, and a long-term plan to protect them is lacking. The damage that their loss would cause makes them a tempting target for the next wave of cyber-enabled political and foreign interference.1

What’s the solution?

Gaps in our protection of national infrastructure and information security need to be addressed.

Australian governments—state and federal—need to begin a systematic effort to identify and value national identity data. A closer alignment between the professional fields of digital preservation and information security is required, and a stronger focus on information governance. Australian governments need to ensure that our critical government-held national identity assets are protected and that memory institutions charged with their care are adequately funded to do so.

Until these issues are addressed, this increasingly ‘invisible’ vulnerability means that the potential loss of the digital evidence of who we are as a nation remains a sleeping, but urgent, national security priority.

Introduction

Imagine this. You wake up in 2022 to discover that the Australian financial system’s in crisis. Digital land titles have been altered, and it’s impossible for people and companies to prove ownership of their assets. The stock market moves into freefall as confidence in the financial sector evaporates when the essential underpinning of Australia’s multitrillion-dollar housing market—ownership—is thrown into question. There’s a rush to try to prove ownership, but nowhere to turn. Banks cease all property lending and business lending that has property as collateral. The real estate market, insurance market and ancillary industries come to a halt. The economy begins to lurch.

At the same time, a judge’s clerk notices an error in an online reference version of an Act. It quickly emerges that a foreign actor has cleverly tampered with the text, but it’s unclear what other parts of the Act have changed or whether other laws have been altered. The whole court system is shut down as the entire legal code is checked against hardcopy and other records and digital forensics continue. Meanwhile, a ransomware attack has locked up the digital archives of Australia’s major media organisations and parallel archival institutions. Over 200 years of stories about the nation are suddenly inaccessible and potentially lost.

As the Australian public and media are demanding answers, the government is struggling to deal with the crisis. Hard paper copies of many key documents simply don’t exist.
National identity assets are the evidence of who we are as a nation—from our electronic land titles and biometric immigration data, to the outcomes of our courts and electoral processes and the digital images, stories and national conversations we’re having right now.

Increasingly, our national footprint and interactions are digital only, including both digitally born and digitalised material, all of which is increasingly being relied on as a primary source of truth—the legal and historical evidence we rely on now and into the future.

As companies, governments and individuals scramble to protect important data and critical systems such as telecommunications and power supplies from cyber threats, we overlook datasets that are perhaps even more valuable. They’re a prime and obvious target for adversaries looking to destabilise and corrode public trust in Australia.

With 47,000 cyber incidents occurring in Australia each year2 and a permissive global environment for cyber adversaries, information manipulation and grey-zone cyber conflict aimed at disrupting nations and in particular Western democracies, the threat to our national identity assets is real. Both state and non-state adversaries have the capabilities to disrupt, distort and expropriate national identity data. What’s been lacking to date is the intent to use them this way, and intent can change fast.

Keeping national identity assets safe and accessible is vital not only for chronicling Australia’s past, but for supporting government transparency, accountability, the rights and entitlements of all Australians and our engagement with the rest of the world.

This report explores the value of Australia’s digital national identity assets and the consequences of not protecting them. The need to protect them from theft, manipulation, destruction or unlawful action may seem a given, but this review has found that our vitally important sovereign national identity data and information isn’t being adequately protected and lacks a long-term protection or preservation strategy.

Report methodology

Many national data assets are held in government digital holdings, and those assets are the main focus of this report.

More than 20 organisations across government, academia and the corporate sector were consulted and surveyed as a part of this research. In addition, 70 experts on critical infrastructure, information security, cybersecurity, digital preservation, risk management, information governance, archives and data management were interviewed. Roundtable discussions were held to explore national identity data as critical infrastructure and the international experience, as well as two workshops exploring possible scenarios and consequences.

National Identity

Defining national identity

Australia’s national identity is difficult to define. It’s a complex, ever-changing, dynamic collective of Australians and our environment, history, geography, culture and outlook.

For some, it’s the feeling shared with a group of people about a nation, expressed through patriotism, national pride and a positive emotion of love for one’s country.3 It’s a construct of common points—national symbols, language, images, history, culture, music, cuisine, radio, television, landforms—and it’s expanding. It’s the collective experience of who we are as a nation, and, while it crosses public, private and personal information, this report primarily focuses on national identity assets in government digital holdings as a key ingredient in identity and in the functioning of our nation.

Digital national identity assets are the evidence of our national identity

National identity assets are the evidence of who we are, how we see ourselves and how we relate to the rest of the world. They include high-value personal, social, legal, democratic and historical data, such as records of births, deaths and marriages; immigration records; land titles; the decisions of our courts and parliaments; and the many stories told on our screens and airwaves through social and electronic media.

Digital assets include data, digital information, multimedia, imagery and sound. They’re both digitally born (created digitally) and digitalised (analogue material digitised and available electronically). It’s our digital heritage, being created now, that defines our unique Australian identity and is essential for the functioning of our democracy, our society, our culture and our legal system.4

This report doesn’t set out to define or describe all of Australia’s national identity data and digital information, but it does recommend developing a way of identifying and valuing those assets to enable appropriate protection.

Some examples of digital national identity assets include:

  • Digitally born identity assets
    • Hansard (Department of Parliamentary Services, Parliamentary Library)
    • Indigenous War Service Project (Australian National University, Australian Institute of Aboriginal and Torres Strait Islander Studies)
    • evidence and findings from royal commissions (National Archives of Australia)
    • Australian Web Archive (National Library of Australia)
    • ABC Digital Library
    • Lindt Café siege social media collection (State Library of NSW)
    • passport biometrics and passenger arrivals (Department of Foreign Affairs and Trade, Department of Home Affairs, Border Force).
  • Digitalised assets
    • convict records (NSW and Tasmanian archives)
    • Australian Institute of Aboriginal and Torres Strait Islander Studies photographic collection
    • newspaper collections (National Library of Australia and state libraries)
    • World War I records (National Archives, Australian War Memorial, NSW State Library)
  • Hybrid analogue/digital assets
    • Fairfax photographic collection (Fairfax Media)
    • High Court decisions (High Court of Australia)
    • births, deaths and marriages records (state and territory government agencies and archives)
    • parliamentary papers and decisions (federal, state and territory parliamentary departments
    • immigration records (Department of Home Affairs, National Archives of Australia)
    • property ownership records (state and territory government agencies and archives)

Failure to protect national identity assets

Yesterday, the Australian Electoral Commission, the Department of Home Affairs and the NSW Lands Department discovered discrepancies in their election results databases, the public electoral roll, electronic land title registrations and citizenship data. Investigations haven’t identified when the problems occurred. The discrepancies make it difficult to rely on the validity of their data holdings. 

At the same time, the Department of Parliamentary Services received an anonymous report that over the past 12 months changes have been made to Hansard report proofs online. They have five days to remedy the issue before the source goes public, while public complaints, mainly through social media, have already started about digital images and material previously on the website that’s no longer available, particularly Hansard reports of new parliamentarians’ maiden speeches in the Senate and House of Representatives.

A few days ago, the daughter of a World War II veteran was interviewed on ABC Radio’s morning program in the Northern Territory. She had written to the Attorney-General complaining that her father’s war service record is no longer available. An investigation by the National Archives of Australia found that all the digitised service records for World War II on its website have been removed from the database holding and displaying them, and been replaced with images of Donald Trump, Xi Jinping, Angela Merkel and other world leaders.

Today, a major story was leaked to The Australian newspaper that implicated Australian companies involved in the 2006 royal commission into the Iraq oil-for-food program. The leaked documents were released to the public by Wikileaks. Those records are held by the National Archives. Wikileaks also announces that it will shortly be following up the leak with a release of the 2016 Census, which is supposed to be held by the National Archives and not released until 2115.

This is a fictional scenario created by the author.

Issues

A sleeping giant

The increasing vulnerability, invisibility and online exposure of our digital identity is an underappreciated national security issue.

In a global environment of increasing cyberattacks, capable state and non-state actors, information espionage and grey-zone cyber conflict aimed at disrupting nations, the threat to our national identity assets is real.

States such as Russia have demonstrated their intention to disrupt and undermine Western democracies,5 and obvious future targets for such attacks are national identity assets that are poorly protected and offer high-impact results if disrupted, corrupted or destroyed. With more than 30 countries known to possess offensive cyber capabilities,6 and cyber capabilities being in reach of non-state actors from individuals to cybercrime organisations, the number of potential adversaries able to target our national identity assets is significant and increasing.

We’ve bought into the fiction that all of the information we could possibly want to access is there, all of the time—and for all time. But the truth is that the access of future generations to our recent history is more precarious than ever.

—Kylie Walker, Chair, Australian National Commission for UNESCO

Because we’re a liberal democracy, Australian society relies at its deepest level on the trust of the citizen in the state.7

National and state government archives play the role of ‘impartial witnesses’, identifying and holding this information and holding the government to account under the rule of law and in the ‘court’ of history. Many other institutions have additional holdings that collectively form our national identity assets. We need to trust that these impartial witnesses can identify, keep and preserve this evidence. This is a matter of national security and is at the heart of our society.

Previously, victors rewrote history. Now, in the digital age, our adversaries could rewrite our present. If we aren’t vigilant, we run the risk that adversaries could destroy or manipulate our national identity assets, compromising the digital pillars of our society and culture.

If our land titles or our citizenship records were altered, what would be the result? If we lost our immigration and births, deaths and marriages data, how could you prove your citizenship? And what if that information were compromised and unreliable? What would be the authoritative source of information about Australians and their citizenship?

Public trust and perceptions

If you can’t trust the truth holders, then who can you trust?

—Rachel Botsman8

The biggest impact from an attack on national identity assets would be the resulting corrosion of trust in public institutions. As Russian interference in other countries’ elections has demonstrated, the erosion of trust is more corrosive to democracy than the win or loss of any particular candidate. Attacks on truth and trust affect individuals and nations and, while just one breach can erode trust, a concerted campaign can do much more. As US academic and commentator Zeynep Tufekci so accurately describes, ‘we are in an era where misinformation thrives and even true information can confuse and paralyse rather than inform and illuminate.’9

When more than 600 fake Facebook accounts were uncovered, linked to Russian and Iranian influence campaigns, a false and disingenuous dialogue and history were created.10 We’ve already seen the manipulation of video become a reality,11 and, as Peter Singer describes in his latest book, Like war, propaganda has been weaponised en masse and is now threatening democracies.12 Fraud and fakery aren’t new—they’re just happening in a new hi-tech domain, with the potential to do much greater damage at scale. It’s inevitable that they’ll expand into historical data and information. 

For example, in 2008 a British historian added 29 fake documents over five years to write a fake history of members of the British royal family collaborating with the Nazis during World War II.13 Closer to home, between 2007 and 2015 the Western Australian Registrar of Births, Deaths and Marriages removed vital information about Aboriginality and illegitimacy from birth certificates because the registrar deemed it too distressing for people.14 While not fraud, or an external attack, it was an intentional changing of evidence that could have major repercussions personally, socially and historically.

Cybercriminals have already taken individuals’ and organisations’ data ‘hostage’ by encrypting it and demanding ransom to decrypt it. The good news is that this has yet to happen to national identity holdings.

As the physical world meets the digital world, protecting and securing authentic data has become an ongoing challenge. So, who will hold the source of truth, and how will people know whether they can trust the source?

Vulnerability and invisibility

Recent studies by the University of NSW and University of Canberra identified examples of Russian targeting of Australian voters in 2017.15 Our universities, businesses and governments are under a constant attack in which 400 Australian companies were targeted in 2017.16 Countries such as Israel,17 Iran,18 North Korea, China19 and the US20 are also known to have publicly used malicious cyber actions against other nations, including Australia.21

A future frontier for these attacks is likely to be national identity assets, but despite this there’s a lack of engagement and awareness in government and the community about the safety and security of those assets and the government institutions that hold them, and a lack of care about data and information security more generally.22

Our critical infrastructure, defence, border security, privacy, personal information and economic assets attract the headlines, the attention and ultimately the dollars. There’s no strong narrative about the need to protect holdings of digital national identity assets nationally or internationally. Many memory institutions find it difficult to be heard and secure funding, except when the need involves Australia’s military history, or when a tragedy occurs, such as this year’s devastating fire at Brazil’s National Museum.23

The ravages of time

Digital assets aren’t as resilient as most analogue or paper forms and decay over time, including through degradation, obsolescence or the breakdown of computerised information. All digital material is prone to some sort of decay (sometimes known as ‘data rot’).24 This doesn’t take long, particularly with the current speed of technological change and growth in the quantity of data.

All organisations need to be aware of potential decay that can make their information and data unusable.

Resourcing and capability of institutions

Australia’s ultimate information and data custodians— the memory institutions, such as national and state archives, records organisations, libraries and other cultural institutions—struggle to keep even their basic services afloat, let alone to protect and preserve digital heritage and national identity data.

The current parliamentary review of national institutions in Canberra is evidence of that.25

The committee has received numerous submissions and testimonials from the heads of cultural institutions decrying the consequences of continued funding cuts.26 Although a handful of agencies have recently received one-off funding for digital initiatives, the National Archives of Australia, which holds some of the government’s most valuable and sensitive information, unsuccessfully sought funding to build a secure digital archive five times over the past 10 years. Recently, it received an adverse finding in the Australian National Audit Office’s latest cyber resilience audit for not meeting all essential information security requirements.27

Fair funding

A great deal of effort, funding and focus is placed on protecting critical infrastructure such as roads, communications and ports, as well as classified and sensitive information, but the same can’t be said of our national identity data, or of the national and state institutions that protect and provide access to those digital assets.

Digitalisation of information is only going to increase; most Australian governments are committed to being fully digital within the next few years. As custodians of the bulk of national identity data, government agencies have a responsibility to protect it from birth over its life. And, with the creation and retention of fewer paper traces, accessing and preserving this information is becoming more complicated.

Of the 20 government agencies and universities surveyed as part of this project, the rate of change, scale, complexity and resourcing were identified as the biggest problems facing them in their quest to protect our digital information and assets.

Figure 1: Some survey results

A crowded ungoverned space

The plethora of information, data, cyber and security protocols, strategies, policies, frameworks, legislation and agencies involved at the federal and state levels in Australia is confusing and inconsistent. At least 20 organisations are involved in information and data policy, protection and management in the Australian Government space alone. 

In 2015, when it released its Digital Continuity 2020 policy,28 the National Archives of Australia had already recognised the urgent need for information governance, and this was reiterated in the Open Data Initiative as part of Australia’s first Open Government Partnership National Action Plan in 2016.29 The Digital Continuity 2020 policy required agencies to have information governance frameworks and information governance committees in place by June 2016. By September 2017, only 64% of Australian Government agencies had achieved the latter.30

This policy needs to be extended to include governance and coordination at the whole-of-government level to ensure the robust and reliable management of national identity data.

The way forward

Include national identity assets within the critical infrastructure framework

Government archive material, must be considered as equivalent to any critical national infrastructure, given its value to national identity, values, history.

—David Irvine, Chair, Foreign Investment Review Board

Critical infrastructure is firmly in the sights of those conducting cyberwarfare and industrial sabotage.31 Cyberweapons can turn off power grids, derail trains, cause offshore oil rigs to list, turn petrochemical plants into bombs and shut down factories.32

Attacks are increasingly common and becoming more sophisticated. Ukraine’s energy sector was the target of a Russian cyberattack in 2015 that caused power outages that affected more than 200,000 citizens,33 and in 2017 there was an alleged Russian state hack of US electricity companies.34 Both Iran and Russia have been linked to an attack on a petrochemical plant in Saudi Arabia in 2017 that was described as a new kind of cyber assault designed to trigger an explosion.35

Like other countries, Australia is focused on protecting its critical infrastructure. However, there’s a serious gap in our approach, which currently doesn’t include the protection of national identity assets.

Digital national identity assets underpin our democracy

Australia’s Critical Infrastructure Centre describes critical infrastructure as underpinning the functioning of Australia’s society and economy and integral to the prosperity of the nation.36 National identity assets do all that and more—they also underpin our democracy—and should be considered as part of the nation’s critical infrastructure.

Attacks on governments show that we must recognise the threat posed by cyberattacks not only to critical infrastructure services, but also to democratic functioning and government continuity.37

Data and information don’t fit within the traditional conception of critical infrastructure. In Australia, ‘critical infrastructure’ is taken to mean the supply chains, information technologies and communication networks, the destruction, degradation or lengthy unavailability of which would significantly damage the social or economic wellbeing of the nation or affect our ability to conduct national defence and ensure national security.38

Australia has eight critical infrastructure sectors: banking and finance; the Australian Government; communications; energy; food and groceries; health; transport; and water.

There’s an argument that, if national identity assets were included, the existence of digital and analogue information would require differing control measures and consequential tighter controls, making it harder to access, or measures to replicate data holdings so that disruption and manipulation can be dealt with by turning to authoritative alternative holdings. Also, if whole systems—hardware, software, personnel, data and information—are considered critical, that could lessen the meaning and idea of ‘critical’.39

While defining the strict parameters of national identity assets might be problematic, that can be broadly overcome by focusing instead on the organisations that create, keep and preserve them. The intrinsic value of Australian Government national identity assets, such as those held by the National Archives and National Library, should be recognised as part of the Australian Government critical infrastructure sector. Consideration should also be given to how similar assets of state governments should be protected.

Estonia, a country recognised for e-government, has acknowledged the vulnerability of its data and information and is replicating its critical government data in Luxembourg in what’s been called a ‘virtual embassy’ to protect it and ensure that government and services will be uninterrupted in the case of an attack on Estonia.40

The closest Australia has come to officially considering data and digital information as critical infrastructure was the 2017 public consultation on the Security of Critical Infrastructure Bill, which asked whether data centre assets should be included.41 They weren’t. 

Increased focus on data security

Despite this, during 2018 there’s been an increased focus on data security and engagement by the Australian Critical Infrastructure Centre, which is working with the Australian Cyber Security Centre and the Digital Transformation Agency on whole-of-government infrastructure.42 But this isn’t just about systems, security and services. We need to go one step further and consider the data held within them. 

The Australian Productivity Commission’s 2017 Data availability and use report noted that data is an asset, and that there are plenty of datasets and collections the degradation or unavailability of which ‘would significantly impact the social or economic wellbeing’ of Australia.43 

Australia’s electoral roll and Census data are two such cases. The latter not only guides the allocation of much government funding, but also helps to determine electoral boundaries—a key component of our democratic process. As noted by the Productivity Commission, if it were to be compromised that would jeopardise public trust.

There’s valid evidence of a pressing need to review what critical national identity assets are and to include national identity and high-value data within Australia’s critical infrastructure framework.44 We also need to investigate a legislative response to how they should be managed and evaluated nationally, supported by the Australian Trusted Information Sharing Network and focusing on those assets in the critical infrastructure sectors and the states and territories.

We protect what we value

If Australia were a person, and her digital house was on fire, what would she grab and load in her car to save? What would be ready and in a convenient location, so that she could pick it up and run?

Sometimes it takes a disaster before a new or upgraded system is funded.

There’s a disconnect between how we value and how we protect our data and digital information. Currently, more focus and value are placed on the security of classified, national security and personally identifiable information. As a result, the systems that hold and manage that information are prioritised.

The volume of digital information and data is increasing at a rapid rate, and the percentage that needs to be kept for business, legal, evidentiary and archival purposes is also growing.45

Valuing digital identity assets

There’s also no standard, guidance or formula for valuing digital information and data, or any requirement to report data assets in financial reports. In the case of digital national identity assets, there’s no long-term view on their value or their protection, although many memory institutions do include them in financial reporting.

While there’s an accounting standard for valuing cultural and scientific collections, that’s primarily for physical collections. Valuing digital assets is proving more difficult. The valuation industry has developed varied approaches and methodologies and, depending on the volume and complexity, such valuations can come at a significant cost.

What’s being done

The NSW Government is currently valuing its digital collections, and the Australian Bureau of Statistics is valuing its Census data. In 2014, the New Zealand Bureau of Statistics valued its 2013 census data at $1 billion,46 and in 2016 the Australian Bureau of Communications Research estimated that Australia’s open data was worth $25 billion per year, or 1.5% of Australia’s GDP.47

We need to do more about standardising the way we value our national identity assets.

The inability to access, understand and adequately discriminate between what’s valuable and what isn’t is a key challenge, as is maintaining appropriately skilled people to ensure quality, accuracy and analytics, including privacy and ethics considerations.

In 2016, American historian Abby Rumsey argued that we’re now so far ahead of ourselves in the accumulation of data that we may never catch up or truly understand its significance.48 And data is only valuable if it can be explored and we can get insights and information from it.49 We may have a future in which a generation of history is lost because it doesn’t exist or is inaccessible.

A simple way to identify, assess and value national identity data and information needs to be developed, along with a consequence framework to assess the impact should it or its provenance be lost or damaged.

Security, preservation and governance

We have to value our government data holdings as a national asset and within government we have to adjust our behaviours and our policies accordingly.50

—David Fricker, Director-General, National Archives of Australia, President International Council on Archives

Protection of national identity assets is far more than information and cybersecurity.

Internationally, there’s a large ‘infosec’ industry, which continues to grow. Governments and a swag of organisations and agencies are dealing in cybersecurity, information security, big data, privacy and information policy.

The glaring omissions are digital preservation and governance—not just for digital national identity  assets, but for all business-critical information and data. This includes assets relied upon by the public and business for planning, redundancy and technology that can read the data in 10 or 100 years from now.

This crowded landscape calls for a strategic and coordinated approach and stronger focus to address a major vulnerability that all organisations face—the integrity, reliability, authenticity and accessibility of digital assets now and into future, whether it’s three years, thirty-three or forever, as with national identity assets.

Earlier adoption of digital asset preservation

Digital preservation isn’t widely understood or practised except by organisations with dedicated preservation functions. Even then, digital preservation usually involves work streams and professions separate from information security functions. Digital preservation is essential for digital authenticity, reliability and access over time, and is far more than just creating a backup. It ensures the accurate rendering of authentic content over time, including protection from medium failures and software and hardware obsolescence.51

The 2017 edition of Australian Government’s Information security manual includes no digital preservation requirements, other than backup for business continuity and disaster recovery.52 The 2018 manual will expand backup requirements to ensure that information can’t be manipulated or changed, and the author understands that, based on the recommendations of this report, digital preservation is being considered for inclusion from 2018 onwards to guide those Australian Government agencies with national identity and high-value assets.

Increasingly, blockchain technology is being used by industry and government to assure transactions and services, the most recent such use being the pilot rollout of NSW digital drivers’ licences.53 This should continue to be explored to ensure the integrity of national identity assets. We need to start the conversation about digital preservation earlier, at the beginning and not at the end of digital asset creation. Along with information management, digital preservation must be considered by all organisations before they build or upgrade systems that create, use and keep valuable information and data for any length of time. This is for governance, discovery and access, and to ensure that the evidence remains authentic, can be migrated to and managed by memory institutions into the future, and be accessed and read whenever it’s needed.54

Information security reporting and audits

Currently the ‘confidentiality, integrity and availability’ security model is heavily weighted towards confidentiality. This imbalance is a vulnerability, and, despite improvements in cybersecurity,55 many organisations aren’t meeting this base-level security requirement. A recent audit by the Australian National Audit Office (ANAO) found that, out of three Australian government agencies, only one was cyber resilient.56

While the Australian Cyber Security Centre (ACSC) surveys the status of information security in the public and private sectors,57 it’s difficult to assess just how safe Australian organisations are and what they’re doing to ensure that their systems and data are safe. Further work is needed in this space to audit data authenticity and to check for evidence of manipulation or change. This would require new methodology and practices—possibly drawing on digital preservation skills and approaches—that should eventually become business as usual.

There’s no independent or public reporting of the state of cybersecurity within individual organisations, or a ‘state of the nation’ report on how agencies and businesses are managing and protecting data.

Public self-reporting is needed, and more transparency is one of several recommendations made by the ANAO in its 2018 cyber resilience audit.58 A snapshot or dashboard showing how Australian organisations are performing in cybersecurity should also be developed as part of the ACSC’s annual survey.

Lack of coordination and information governance

Immediate business needs tend to overshadow the way information is governed and managed.

Many government and private-sector organisations are easy prey to cyberattack, not just because of weak cybersecurity, but because of the absence of a comprehensive whole-of-organisation view on how all information and data assets are to be managed and protected.

There’s an urgent need to implement better information governance across the public and private sectors in order to protect Australia’s digital national identity assets.

Policy recommendations

  1. Australia’s national identity and high-value data and information, the destruction or corruption of which would have a serious impact on our sovereignty, should be recognised as part of our critical infrastructure framework.
  2. The Trusted Information Sharing Network should examine existing coverage of vulnerabilities and establish a dedicated forum on that data and information.
  3. The Australian Government should explore a legislative response to managing and evaluating that data on a coherent national basis.
  4. National security agencies should engage with the National Archives of Australia to undertake a risk assessment of the archives’ digital national identity assets and jointly develop proposals to defend them from future attack.
  5. The National Archives of Australia should use its legislated powers to prescribe what government information and data constitutes national identity assets and set mandatory management and governance standards to ensure, protect and maintain their long-term integrity and reliability of those assets.
  6. The Australian Productivity Commission should explore the value of digital national identity assets to Australia, defining the parameters to be considered in identifying and valuing them and the cost should they be destroyed or manipulated, or should trust in their authenticity and reliability be eroded.
  7. The Australian Government, through the Department of Finance, should investigate and provide guidance and standards for agencies to assess the value of their information and data assets.
  8. The Australian Government, through the Department of Finance, should develop a tool to assist organisations to assess the value of their data and digital information, to assist in developing strong business cases for protection.
  9. A new funding model for memory institutions should be explored by Australian governments to help protect digital national identity material.
  10. Digital preservation principles should be built into information security requirements, such as those in the Australian Government’s Information security manual.
  11. The Digital Transformation Agency, in conjunction with CSIRO’s Data 61, should explore the use of blockchain technology to track, record and ensure the provenance of national identity and high-value data.
  12. The ACSC should produce a ‘state of the nation’ report on cybersecurity health and readiness.
  13. All public, private and community sector organisations holding national identity assets should be encouraged to publicly report their annual cyber resilience status.
  14. The ANAO, in conjunction with the ACSC, should explore the creation of an authenticity audit, so that internal and external auditors can assess digital assets on a scheduled, regular basis, employing a standardised methodology.
  15. All Australian governments (federal and state) should better coordinate their information, data and related cyber policy agencies and strengthen information governance as the overarching requirement, incorporating all elements of information management, security, privacy and data management.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

Images: ‘Faces of Australia’ from the National Archives of Australia. Design by Lora Maricic. 
Cover animation by Wes Mountain. ASPI ICPC and Wes Mountain allow this image to be republished under the Creative Commons License Attribution-Share Alike. Users of the image should use this sentence for image attribution: ‘Illustration by Wes Mountain, commissioned by ASPI’s International Cyber Policy Centre’.

  1. Kelsey Munro, ‘Foreign interference in elections “will be repeated”: former US cyber tsar’, SBS News, 22 February 2018, online; ‘Five Country Ministerial 2018’, Department of Home Affairs, 29 August 2018 ↩︎
  2. Dan Tehan, ‘Silent dangers: launch of the Australian Cyber Security Centre’s 2017 threat report’, National Press Club address, 10 October 2017 ↩︎
  3. JC Turner, ‘Some current issues in research on social identity and self-categorization theories’, in N Ellemers, R Spears, B Dossje (eds.), Social identity: context, commitment, content (6–34), Blackwell, Oxford, UK, 1999. ↩︎
  4. Eliza Chapman, ‘Should data be considered critical infrastructure?’, The Strategist, 18 April 2018 ↩︎
  5. Jeremy Herb, Lauren Fox, Manu Raju, ‘Senate committee agrees with intelligence community assessment of election meddling, breaking with GOP House investigation’, CNN, 16 May 2018, online; Culture, Media and Sport Select Committee, Russian influence in political campaigns, UK Parliament, 29 July 2018 ↩︎
  6. Steve Ranger, ‘US intelligence: 30 countries building cyber attack capabilities’, ZDNet, 5 January 2017, online; James R Clapper, Marcel Lettre, Michael S Rogers, ‘Joint statement for the record to the Senate Armed Services Committee: foreign cyber threats to the United States’, 5 January 2017 ↩︎
  7. Tim Gollins, ‘The national archives, big data and security: why dusty documents really matter’, in Jennifer Cole (ed.), Big data for security and resilience: challenges and opportunities for the next generation of policy-makers, proceedings of the Big Data for Security and Resilience Conference, March 2014 ↩︎
  8. Rachel Botsman, Who can you trust? How technology brought us together and why it might drive us apart, Penguin, 2017. ↩︎
  9. Zeynep Tufekci, ‘How social media took us from Tahrir Square to Donald Trump’, MIT Technology Review, 14 August 2018 ↩︎
  10. Sheera Frenkel, Nicholas Fandos, ‘Facebook identifies new influence operations spanning globe’, New York Times, 21 August 2018, Ben Nimmo, Graham Brookie, ‘#TrollTracker: Facebook uncovers active influence operation’, @DFRLab, 31 July 2018 ↩︎
  11. Tim Leslie, Nathan Hoad, Ben Spraggon, ‘Can you tell a fake video from a real one?’, ABC News, 3 October 2018 ↩︎
  12. PW Singer, Emerson T Brooking, Like war: the weaponization of social media, Houghton Mifflin Harcourt, New York, 2018. ↩︎
  13. Paul Lewis, ‘The 29 fakes behind a rewriting of history’, The Guardian, 5 May 2008 ↩︎
  14. Rebecca Turner, ‘“Aboriginal” redacted from birth, death, marriage certificates after being deemed an offensive term’, ABC News, 17 May 2018 ↩︎
  15. Tom Sear, Michael Jensen, ‘Russian trolls targeted Australian voters on Twitter via #auspol and #MH17’, The Conversation, 22 August 2018 ↩︎
  16. Stephanie Borys, ‘Russian hacking: up to 400 Australian companies caught up in cyber attacks blamed on Moscow’, ABC News, 17 April 2018 ↩︎
  17. Ellen Nakashima, Joby Warrick, ‘Stuxnet was work of US and Israeli experts, officials say’, Washington Post, 2 June 2012 ↩︎
  18. Patrick Howell O’Neill, ‘Cobalt Dickens threat group looks to be similar to indicted hackers’, Cyberscoop, 24 August 2018 ↩︎
  19. Jonathan Landay, ‘US intel chief warns of devastating cyber threat to US infrastructure’, Reuters, 14 July 2018 ↩︎
  20. Nakashima & Warrick, ‘Stuxnet was work of US and Israeli experts, officials say’. ↩︎
  21. Nick McKenzie, Angus Grigg, Chris Uhlmann, ‘China uses the cloud to step up spying on Australian business’, Sydney Morning Herald, 20 November 2018 ↩︎
  22. David Donaldson, ‘Password123: public servants risk cyber attacks with weak security’, The Mandarin, 22 August 2018 ↩︎
  23. John McCormack, ‘Think the museum fire in Brazil can’t happen here? Think again’, Los Angeles Times, 9 September 2018 ↩︎
  24. Angela Stringfellow, ‘Digital decay: understanding digital decay, its impacts on modern business, and best practices for preserving digital assets and data’, MerlinOne, 5 March 2018 ↩︎
  25. Joint Standing Committee on the National Capital and External Territories, ‘Inquiry into Canberra’s national institutions’, Australian Parliament, no date. ↩︎
  26. Sally Whyte, ‘More cuts will put national institutions’ “core purposes” at risk’, Canberra Times, 13 May 2018 ↩︎
  27. Australian National Audit Office (ANAO), Cyber resilience, report no. 53 of 2018–18, ANAO, Canberra ↩︎
  28. National Archives of Australia (NAA), Digital Continuity 2020 policy, NAA, Canberra, 5 April 2018 ↩︎
  29. Department of the Prime Minister and Cabinet, Open Government Partnership Australia, ‘3.3—Improve the discoverability and accessibility of government data and information’ ↩︎
  30. NAA, ‘2017 digital continuity statement: whole-of-government snapshot’, NAA, Canberra, 2017 ↩︎
  31. Stephen Cobb, ‘Trends 2018: critical infrastructure attacks on the rise’, WeLiveSecurity, 30 May 2018 ↩︎
  32. Tim Johnson, ‘“Preparing the battlefield”: Hackers implant digital grenades in industrial networks’, McClatchy, 27 June 2018 ↩︎
  33. Donghui Park, Julia Summers, Michael Walstrom, ‘Cyberattack on critical infrastructure: Russia and the Ukrainian power grid attacks’, Henry M Jackson School of International Studies, 11 October 2017 ↩︎
  34. Kanishka Singh, ‘Russian hackers penetrated networks of US electric utilities: WSJ’, Reuters, 24 July 2018, online; US Computer Emergency Readiness Team, ‘Alert (TA18-074A): Russian Government cyber activity targeting energy and other critical infrastructure sectors’, 15 March 2018 ↩︎
  35. Nicole Perlroth, Clifford Krauss, ‘Cyberattack in Saudi Arabia had a deadly goal. Experts fear another try’, New York Times, 15 March 2018, online; David E Sanger, ‘Hack of Saudi petrochemical plant was coordinated from Russian institute’, New York Times, 23 October 2018 ↩︎
  36. ‘What is the Critical Infrastructure Centre’, Department of Home Affairs, no date ↩︎
  37. Dante Disparte, ‘Cities held for ransom: lessons from Atlanta’s cyber extortion’, Forbes, 2 April 2018 ↩︎
  38. Trusted Information Sharing Network, ‘Critical infrastructure’, no date ↩︎
  39. Chapman, ‘Should data be considered critical infrastructure?’. ↩︎
  40. Daniel Cooper, ‘Estonia will back up its government in a “digital embassy”’, engadget, 22 June 2017 ↩︎
  41. Security of Critical Infrastructure Bill 2017, Australian Parliament ↩︎
  42. Asha McLean, ‘Canberra to deliver platform and hosting strategies by November’, ZDNet, 7 May 2018 ↩︎
  43. Productivity Commission, Data availability and use, ‘Overview and recommendations’, report no. 82, 31 March 2017 ↩︎
  44. Chapman, ‘Should data be considered critical infrastructure?’. ↩︎
  45. IDC, The digital universe of opportunities: rich data and the increasing value of the internet of things, ‘Executive summary: Data growth, business opportunities, and the IT imperatives’, April 2014 ↩︎
  46. Statistics New Zealand, Valuing the Census, New Zealand Government, April 2013 ↩︎
  47. Bureau of Communications and Research, ‘Open government and why it matters’, Department of Communications and the Arts, Australian Government, 8 February 2016 ↩︎
  48. Abby Smith Rumsey, When we are no more: how digital memory is shaping our future, Bloomsbury Press, 2015. ↩︎
  49. Susan Bennett, What is information governance and how does it differ from data governance?, Sibenco Legal and Advisory, 2017 ↩︎
  50. David Fricker, ‘Government–citizen engagement in the digital age’, Senate Occasional Lecture, NAA, 28 April 2017 ↩︎
  51. Digital Preservation Coalition, Digital preservation handbook, ‘Glossary’, no date ↩︎
  52. Department of Defence, Australian Government information security manual: controls, Australian Government, 2017 ↩︎
  53. Rohan Pearce, ‘NSW digital licence rollout driven by blockchain’, Computerworld, 10 September 2018 ↩︎
  54. NAA, Digital Continuity 2020 Policy ↩︎
  55. Australian Cyber Security Centre (ACSC), 2017 threat report, Australian Government, 2017 ↩︎
  56. ANAO, Cyber resilience. ↩︎
  57. ACSC, ‘Publications’ ↩︎
  58. Stephen Easton, ‘Auditor-General still waiting on cyber resilience in the Commonwealth’, The Mandarin, 25 July 2018, online; ANAO, Cyber resilience ↩︎

Introducing integrated E-Government in Australia

Foreword

With the 2016 distributed denial of service attack on Australia’s first fully digital Census and Centrelink’s 2017 automated debt-recovery system glitches still fresh in our minds, it would be easy to pause in the pursuit of digitising government services.

The reality, however, is that there are compelling benefits to expediting government digital transformation, and the case for change is not simply one of customer convenience.

Deloitte Access Economics has estimated that the federal and state governments conduct 811 million citizen transactions each year. It calculated that lifting the share of transactions performed digitally from 60% to 80% over a 10-year period would lead to government productivity benefits worth $17.9 billion, plus a further $8.7 billion in benefits to citizens. 

But the benefits of integrated digital government services extend even beyond time and resources saved. Data is the fuel for many new business models and, according to OECD measures, right now Australia performs only moderately well compared to international peers, particularly in relation to the availability of open government data.

The OECD has estimated that adopting more data driven decision-making in government has potential output and productivity benefits of 5% to 6% in the US, while improving data quality and access by 10% could increase labour productivity by an average of 14%. That can have additional flow-on effects across the economy. Almost 2 million people are employed in the three levels of government in Australia, meaning that 16% of the country’s 12.5-million-strong workforce is employed in the public sector.

This represents a strategic capability, enabling knowledge and skills transfer across the broader economy. Based on previous productivity gains from technology take-up, that can have significant benefits for Australia’s output. Further adoption of digital technologies across the economy has the potential to add an extra $66 billion to Australia’s GDP over the next five years alone.

So the case for change is clear; the question is really about how to do it. How do we maximise the opportunities, while best protecting citizens’ data and privacy? This policy brief is intended to start that conversation.

Yohan Ramasundara
President, Australian Computer Society

What’s the problem?

Australia was an early leader in the digitalisation of government services, and some Australian Government departments and state governments have continued to innovate and deliver enhanced services online. However, in the global context, Australia has now fallen behind and has so far failed to adopt an integrated approach to e-government that joins up all government services across all three tiers of government. For citizens, this makes life harder than it needs to be and consumes time that could be spent on other things.

For businesses, it increases transaction costs. Although existing user interfaces are logical and user-friendly, there’s still a limited amount of third-stage e-services enabling two-way interactions between citizens and governmental institutions.1 Critical missing pieces inhibiting the flourishing of e-services are a properly functioning digital identity ecosystem and a digital signature.2

What’s the solution?

The Australian Government should launch a consultation with the states and local governments to develop an integrated approach to e-government that joins up all services from all three tiers of government. The model will need to be customised to Australia’s unique circumstances but should be designed to reduce business transaction costs, allow citizens to engage seamlessly with the federal, state and local governments and prioritise citizens’ control and ownership of their data.

A decentralised architecture should be used to ensure there’s no single point of failure and to allow easy and secure integration with existing digital government platforms. The federal government should provide essential enabling systems: 

  • a digital identity (eID)—one has already been developed by Australia Post, and a second is being built, but significant work is needed to allow eID to take root
  • the legal, organisational and technical preconditions for a digital signature—legislation should ensure that the digital signature has equal legal weight to a traditional handwritten signature
  • secure data exchanges between different government IT systems.

Introduction

Integrated Australian e-government would mean that less of citizens’ and businesses’ time would be wasted engaging with government. A digital signature would make official transactions simple: signing contracts or submitting applications could be done in moments. Mindless hassles when moving between jurisdictions (such as swapping licences from one state to another) would evaporate overnight; there would be no need to conduct 100-point identity checks in person, and time-consuming visits to physical government offices would become a thing of the past. In Estonia, where e-government is a national passion, officials estimate that these efficiencies lift annual GDP by 2%.3

While many government departments already have user-friendly online portals, and some states have begun integrating several services within single online platforms (such as Service NSW and Service Victoria4), Australia has yet to attempt a citizen-centric approach that makes citizen and business engagement with all three tiers of government seamless. It also lacks critical enabling systems. The major building blocks needed to achieve an integrated approach to e-government are an integrated government back office and a simple, easy-to-use and secure eID and digital signature. 

That isn’t to downplay the practical challenges of joining up three tiers of government that have historically resisted cooperation or the attention to detail needed to address cybersecurity challenges. Joined-up e-government is nonetheless essential to a high-functioning 21st-century economy and should be attempted.

E-government in Australia

Australia was initially quick to join the global e-government trend, and even developed an international reputation as an early leader in this area (peaking around 1999).5 However, a joined-up approach to e-government wasn’t achieved.6 The success of some large departments, such as the Australian Taxation Office and Centrelink, has depended more on a joined-up ‘front end’ rather than an integrated back end that allows citizens to engage with government seamlessly.7

A national identification scheme (the Australia Card) was proposed in the 1980s. However, the Australia Card Bill generated significant public concerns about privacy and was defeated in the Senate.8 In 2006, Prime Minister John Howard made another attempt with the Access Card,9 before it too was shut down by the Rudd government in 2007.

The Electronic Transactions Act 1999 meant that when entities were required under federal law to give information in writing, provide a signature or produce a document, they could do it electronically.

However, the Australian Government and state and territory governments exempted a large volume of legislation from the operation of the Act. While the Act was an enabler, it didn’t create a ‘unique and un-forgeable identifier that can be checked by the receiver to verify authenticity and integrity and provide for non-repudiation’.10

At the end of the 1990s, the Department of Communications, Information Technology and the Arts was a central player in the coordination of e-government. Two units were created within the department: the Office for Government Online and the National Office for the Information Economy (NOIE), which provided advice and support to the government on internet-specific matters.11 Some of the functions of the NOIE were subsequently taken over by the Australian Government Information Management Office, which was established in April 2004.

However, government departments and agencies had variable reputations, and innovative cross-government projects usually originated from the biggest departments.12 To an extent, that’s still the case, but with more coordination. In general, the major electronic players (such as the Tax Office and Centrelink) and innovative state governments were leading the field, advising central agencies and driving central initiatives.13

In 2016, the federal government established a new agency to manage the government’s digital and ICT agendas: the Digital Transformation Agency (the successor to the Digital Transformation Office, launched in 2015). The agency aims to integrate digital delivery across the federal government and also enhance the transparency of the government’s ICT and digital projects. It covers strategic and policy leadership on whole-of-government and shared ICT and digital service delivery, including ICT procurement policy.14 The Digital Transformation Agenda, coordinated by the agency, foresees agencies and departments delivering ‘a range of initiatives that will provide benefits to all users and improve their digital experience’, including Single Touch Payroll; My Health Record; health payments; trusted digital authentication and verification; whole-of-government platforms; grants administration; and a streamlined online business registration service.15

The Trusted Digital Identity Framework outlines a consistent approach to digital identity in Australia and will be an important component of any integrated approach to e-government.16 Some $92.4 million in funding was secured in the 2018–19 federal budget17 to create the infrastructure that will underpin an eID (Govpass), and the government is aiming to roll out pilot services to half a million users by the end of June 2019.18 This will largely duplicate an eID recently launched by Australia Post called Digital iD. The challenges to the widespread rollout and adoption of eID in Australia are dealt with in a previous Policy Brief.19

States and local councils also deliver a range of services online. A leading actor is the New South Wales Government, which offers a single sign-on service for secure access to government transactions; more than 1.5 million customers have already signed up.20 Victoria is another leader. In May 2016, it released the Victorian Government Information Technology Strategy, which outlines steps the government is taking to improve the security of information and infrastructure critical to the proper functioning of e-government.

At the local government level, the City of Sydney is contributing to the open data movement by making accessible to the public an ever-growing range of data in a number of formats. The datasets provide information on environmental sustainability, transport, arts and culture, facilities, parks and more.21 Opening up data facilitates the creation and management of open services for the private and community sectors, increases transparency and stimulates the economy. It also decreases the number of information requests and reduces administrative workload.

An integrated approach to e-government in Australia

An integrated approach to e-government in Australia would require detailed consultations across all three tiers of government, and with business and the public. However, several principles derived from the experience of others can help frame the approach. 

The once-only principle

The once-only principle (OOP) is central to joined-up government. The EU addressed this in its eGovernment Action Plan 2016–2020, where the foundations for the EU Digital OOP are laid out.22 The OOP requires that individuals and businesses shouldn’t have to supply the same information more than once to public entities (for example, when notifying a change of address). This requires the existence of public-sector interoperability at different levels: organisational, legal and technical. The conceptual model of the new European Interoperability Framework foresees interoperability levels as integral parts of integrated public service governance, meaning that different public administrations work together to meet citizens’ needs and provide public services in a seamless way.23

A decentralised approach

Facilitating secure data exchanges and interoperability between different government agencies doesn’t require the creation of a single database (a so-called superdatabase) that consolidates all data from other databases. In fact, doing that poses serious security risks. A decentralised approach enables different databases and IT solutions in the three tiers of government to ‘talk’ to each other securely and solves the problem of how to integrate the myriad different government databases and systems that already exist. Four key elements underpin this secure exchange:

  • the identification of both the sender and the receiver of the data
  • the encryption of data exchanged to ensure the data is unreadable in case someone intercepts it
  • the time stamping of data transactions
  • a legal audit trail via archiving and logging of electronic records.

In Estonia, X-Road (Figure 1) is a distributed information exchange platform that makes it possible for different systems to communicate across the entire governmental sector.24

Figure 1: Estonia’s X-Road

A digital identity

Digital identity is central to e-government. It serves two main functions: proving one’s identity in the virtual space and verifying virtual transactions. Given the administrative division of Australia into six states and two territories, specific cross-border solutions promise added efficiencies. The EU has taken steps in the direction of cross-border electronic identification and trust services. Its eIDAS Regulation (no. 910/2014) ensures that people and businesses are able to use their own national eID schemes to access public services in other EU countries where such schemes are available. It also ensures the legal validity of digital interactions; that is, they have the same legal status as traditional paper-based transactions. The EU case highlights the need to provide a predictable regulatory environment to enable secure and seamless electronic interactions between businesses, citizens and public authorities. With Australia Post’s Digital iD and Govpass, Australia is laying the foundation for a national eID, although some major questions remain to be addressed.

Privacy

Addressing privacy concerns through a citizen-driven e-government model is important in winning public support for integrated e-government, especially given the history of the failed Australia Card and scandals such as eCensus. Mutual trust is the key to interactions in which the government collects information about citizens and citizens provide their own data to the government. The principles of confidentiality, integrity and accessibility of data are all critical. Building trust between citizens and authorities is at the core of a working e-government model, so considerable emphasis should be put on communicating with citizens about how and for what reason their data will be processed by the government.

One lesson learned from abroad is the value of placing citizens in the driving seat. In Estonia, for example, every time a citizen’s personal data is accessed by a government agency, the individual user can see that access via a log and contest it if they believe it to be improper. Another example from Estonia is related to the right to choose whether to use digital identity or not. Those who do not want to use their digital identity can still use a physical service centre. Australia is also planning an opt-in approach to its new digital identity; however, it may become de facto compulsory if private-sector organisations are able to insist as a condition of service that it’s used (for example, to use online banking). Were that to eventuate, it would raise concerns about anonymity and the ability to not share information.

A joined-up back office

In order to provide easily accessible e-government services across all tiers of government, a joined-up back office is central. So far, the success of some major agencies, such as the Tax Office and Centrelink, depends more on a joined-up ‘front-end’ (the interface between the user and the back office). As Catherine Garner has noted: ‘Improving Australia’s cross-agency collaboration and integration will provide efficient, dynamic systems with greater personalisation and support Australia on its journey to become an e-government leader’.25

Evaluating outcomes from government-funded services

The ability to evaluate outcomes of publicly funded services is an important means of measuring the effectiveness of the government services being provided to citizens. Applying strict privacy and information security practices, there would be value in evaluating outcomes from government spending at the population level, rather than on a simple agency-by-agency basis. There would be community benefits in having the secure, de-identified evidence base made available for approved service improvement and evaluation of government-funded programs and policies.

Other issues

In addition to these guiding principles, Australia will need to resolve a number of other important issues. In summary, they include the need to:

  • ensure secure data exchange and security of data
  • manage the integration process and metadata related to systems and services (a clearly defined and regulated approval process, for example via the Office of the Australian Information Commissioner, is needed for adding new components or new services to ensure smooth integration and the maintenance of security and privacy standards)
  • ensure the right of all citizens using e-government services to easily access information about how government is using their data
  • ensure the right of citizens to decide who can access their data
  • ensure the right of citizens to decide whether or not to use their eID.

Lessons learned from abroad

To implement integrated e-government in Australia, work is needed at several organisational, legislative and technical levels. A few conceptual questions were important when Estonia was developing integrated e-government:

  • The question of how to identify people, businesses and real estate had to be addressed. In order to enable trustable and secure data exchanges between different databases and information systems, some identifiers for people, businesses and cadastral units are needed. In Estonia, ID numbers of people and businesses and also cadastral numbers are regulated by law and implemented in all databases and information systems. This is the precondition for secure and trustable data exchanges between different systems.
  • The digital ID and digital signature are issued by the same process.26 Private keys (for use by the public key infrastructure) are generated by crypto-processor (chip) and aren’t downloadable.27 The eID and digital signature constitute a part of the government-issued and guaranteed infrastructure, which is used by both the private and the public sectors.
  • While an eID is obligatory if a citizen wants to use e-government services, the citizen isn’t obliged to use their digital identity (they can use non-eID-based systems if they prefer).
  • Finally, the citizen is the owner of their own data.28 They can control the use of the data managed by the government. The use of personal data is strictly regulated by law. Everyone can restrict the use of their data by blocking access to it if the law doesn’t specify otherwise.

Another lesson from Estonia concerns back-office integration. Several conceptual agreements underpinned the design of the country’s e-government architecture:

  • Decentralisation: The system is decentralised. There’s no single point of failure, and the central management of the system doesn’t ‘see’ the data, but only whether the system is working.
  • Ease of implementation: The system should be easy to implement. Government institutions shouldn’t need to change their existing systems and processes. Training on the integration of the systems should be offered to all technical experts working in e-government back offices.
  • Neutrality of technology platforms: The integration of systems doesn’t mean that all technical systems use the same platform. Usually, governments use a range of proprietary software platforms as well as open-source solutions and technologies developed by different vendors. Integrated e-government should accommodate those variances.29
  • Security of transactions: Integrity, confidentiality and non-repudiation (the assurance that a party to a contract or a communication can’t deny the authenticity of their signature on a document or the sending of a message that originated from them) should be guaranteed.30
  • Security of data and services: Data and services should be secured so they can be transferred via public networks. The use of the public internet should be enabled, and the development of separate (usually very expensive) government data networks should be avoided.
  • Agile planning and implementation: It’s necessary to avoid large, complex projects and instead develop a comprehensive general architecture that can be divided into small components, while still giving due consideration to security requirements.

Recommendations

We make the following recommendations for the further development of e-government in Australia.

  • Avoid large e-government projects. Agile development can minimise risks, enable faster results and avoid implementation challenges.
  • Establish a properly functioning secure eID and digital signature for each citizen. The eID should be simple and user-friendly, issued by government (similarly to passports) and guaranteed by law. It should be used for both e-government services and business e-services.
  • Back-office integration should be coordinated centrally but done in a decentralised way, enabling secure data exchange between systems connected via the internet. The integration platform should enable the integration of different technical platforms in different locations, in different legal environments and with different organisational set-ups. The integration platform should be as simple as possible and not require changes to existing back-office processes and systems. Process redesign can be done step by step.
  • A citizen-centric model is important to win public support for integrated e-government. It should allow people to control their private data and provide legal guarantees, supported by organisational and technical frameworks. Building trust takes time, so carefully planned communication between the government and citizens is critical, including building up and publicising a track record of competent and secure service delivery. This can be assisted by following basic design concepts and data protection principles when designing the eID and the back-office integration of IT systems.

Integrated e-government offers major benefits to businesses and citizens. It reduces the time and costs associated with transacting with government and with each other and makes life easier. A thoughtful approach to designing integrated e-government (such as decentralisation) will also mean that the risks of a data breach won’t be increased. Australia’s geography and population size don’t present any technical obstacles to rolling out a world-class e-government system.

The move to create digital identities in Australia also suggests growing political momentum to take a more holistic approach to e-government. If it’s citizen-centric, it could help win public support, too.


Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2018
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. The online sophistication ranking assesses service delivery against a five-stage maturity model: information; one-way interaction; two-way interaction; transaction; and targeting/automation. The fourth and fifth stages can be referred to as ‘full online availability’. For more information, see Capgemini, IDC, Rand Europe, Sogeti, DTi, Digitizing public services in Europe: putting ambition into action, 9th benchmark measurement, report for the European Commission, December 2010 ↩︎
  2. The release of the South Australian Government’s digital driver’s licence is a useful case study, highlighting what’s possible, but also the critical missing piece for nationally consistent electronic identity and digital signatures, which inhibits the flourishing of e-services. See Department of Planning, Transport and Infrastructure, South Australian driver’s licences to go digital, South Australian Government, 22 September 2017 ↩︎
  3. Charlemagne, ‘Estonia is trying to convert the EU to its digital creed’, The Economist, 6 July 2017 ↩︎
  4. Along with the Australian Computer Society, both the NSW and Victorian governments contributed funding towards this research and the visit to Australia by Dr Arvo Ott. ↩︎
  5. P Chen, RK Gibson, W Lusoli, SJ Ward, ‘Australian governments and online communication’, in S Young (ed.), Australian government communication, Cambridge University Press, Cambridge, 2007. ↩︎
  6. The Australian Management Advisory Committee’s 2004 Connecting government report defined the concept of whole-of-government in the Australian Public Service as follows: ‘Whole-of-government denotes public services agencies working across portfolio boundaries to achieve a shared goal and an integrated government response to particular issues. Approaches can be formal or informal. They can focus on policy development, program management, and service delivery.’ ↩︎
  7. P Dunleavy, H Margetts, S Bastow, J Tinkler, ‘Australian e-government in comparative perspective’, Australian Journal of Political Science, 2008, 43(1):13–26 ↩︎
  8. G Greenleaf, ‘The Australia Card: towards a national surveillance system’, Law Society Journal, 1987, 25(9), online; R Clarke, ‘Just another piece of plastic for your wallet: the “Australia Card” scheme’, Prometheus, 1987, 5(1):29–45. ↩︎
  9. Office of the Access Card, How will the card benefit you?, Australian Government, no date. ↩︎
  10. Attorney-General’s Department, The Electronic Transactions Act 1999, information sheet, no date. ↩︎
  11. Also, in 1997 the new Liberal–National government launched a major central government outsourcing initiative in order to improve private-sector involvement in government. The aim was to outsource IT across the whole federal government. All departments and agencies were forced to outsource their IT operations to one of the largest international IT corporations with an Australian presence. In 2001, following critical reports from the Australian National Audit Office, the initiative was replaced by more conventional procurement methods. However, the same contractors continued to be important players, consolidating the IT market and leaving little expertise within the government, except for the largest departments. See Dunleavy et al., ‘Australian e-government in comparative perspective’. ↩︎
  12. For instance, the Australian Taxation Office enables individual taxpayers and their agents to use the ‘e-Tax’ electronic tax return lodgement facility to prepopulate their tax returns with data provided through Medicare Australia and Centrelink. Dunleavy et al., ‘Australian e-government in comparative perspective’. ↩︎
  13. Dunleavy et al., ‘Australian e-government in comparative perspective’. ↩︎
  14. Eden Estopace, ‘Australia creates new digital agency to oversee government’s ICT projects’, EGov Innovation, 1 January 2016. ↩︎
  15. Digital Transformation Agency (DTA), ‘Whole-of-government transformation vision’, in Digital Transformation Agenda, Australian Government, no date ↩︎
  16. DTA, ‘Consultation’, in Trusted Digital Identity Framework ↩︎
  17. Australian Government, Budget 2018–19, Budget paper no. 1, 1–22 ↩︎
  18. Michael Keenan, ‘Delivering Australia’s digital future’, transcript, 13 June 2018 ↩︎
  19. Fergus Hanson, Preventing another Australia Card fail: unlocking the potential of digital identity, ASPI ICPC, October 2018 ↩︎
  20. Ping Identity, ‘More than 3 million sign up to NSW’s unified SSO portal’, 2018 ↩︎
  21. City of Sydney, City of Sydney open data portal ↩︎
  22. European Commission, EU-wide digital once-only principle for citizens and businesses: policy options and their impacts, 1 February 2017 ↩︎
  23. European Commission, The new European Interoperability Framework, 13 July 2018, online. The DTA also has a ‘tell us once’ principle; DTA, Digital Transformation Agenda ↩︎
  24. For more information about X-Road in Estonia, see Information System Authority, Data Exchange Layer X-Road, Republic of Estonia, 21 February 2017, online; and ‘X-Road’, Cybernetica, online. One video on e-Estonia is ‘Living in a digital society: e-Estonia’, YouTube, 21 May 2015 ↩︎
  25. Catherine Garner, ‘Can Australia lead the world in e-government?’, The Canberra Times, 27 September 2016 ↩︎
  26. More information on eID in Estonia is accessible at ID, online; and ‘Estonian e-identity corner stone: state issued national ID card’, YouTube, 10 July 2013 ↩︎
  27. Key generation is performed on the user’s card and not by a central facility. ↩︎
  28. Under the Archives Act, all data and information held by the government is owned by the government. Intellectual property may be owned by the originator of the data, but not the object within which it’s contained. Legislative changes are in train to expand the definition so that it isn’t just property based. Legal dilemmas beyond the scope of this paper include whether access approval can be separate from ownership and how far that extends. Another is what happens to and who owns personal data if someone dies. ↩︎
  29. Integrated e-government inherently presents a large and attractive target for attack. To mitigate this, the basic systems participating as servers in this environment must meet ASD EPL levels of security compliance, preferably at EAL4+ and OSLSPP. OSLSPP enables full separation of data and processes with high trust. ↩︎
  30. For some systems, such as those using Windows XP, this wouldn’t be possible to guarantee. ↩︎

Picking flowers, making honey

The Chinese military’s collaboration with foreign universities.

What’s the problem?

China’s People’s Liberation Army (PLA) is expanding its research collaboration with universities outside of China. Since 2007, the PLA has sponsored more than 2,500 military scientists and engineers to study abroad and has developed relationships with researchers and institutions across the globe.1

This collaboration is highest in the Five Eyes countries, Germany and Singapore, and is often unintentionally supported by taxpayer funds.2 Australia has been engaged in the highest level of PLA collaboration among Five Eyes countries per capita, at six times the level in the US. Nearly all PLA scientists sent abroad are Chinese Communist Party (CCP) members who return to China on time.

Dozens of PLA scientists have obscured their military affiliations to travel to Five Eyes countries and the European Union, including at least 17 to Australia, where they work in areas such as hypersonic missiles and navigation technology. Those countries don’t count China as a security ally but rather treat it as one of their main intelligence adversaries.3

The activities discussed in this paper, described by the PLA as a process of ‘picking flowers in foreign lands to make honey in China’ (异国采花,中华酿蜜), risk harming the West’s strategic advantage.4

Helping a rival military develop its expertise and technology isn’t in the national interest, yet it’s not clear that Western universities and governments are fully aware of this phenomenon.5 Some universities have failed to respond to legitimate security concerns in their engagement with China. Current policies by governments and universities have not fully addressed issues like the transfer of knowledge and technology through collaboration with the PLA. Clear government policy towards universities working with the PLA is also lacking.6

What’s the solution?

Understanding and responding to PLA collaboration will require closer engagement between governments and universities. While universities haven’t self-regulated on this issue and haven’t controlled the associated security risks, universities and researchers will not effectively limit the risks of PLA collaboration on their own until governments develop clear policies on it.

Governments need to explore a wider range of tools for limiting technology transfer, including better scrutiny of visa applications by Chinese military scientists and further legislation targeting military end users.

Governments should also consider increasing funding to strategic science and technology fields, while actively limiting problematic foreign investment in those fields. Universities must recognise the risks of such collaboration and seek to learn the extent and nature of their collaboration with the PLA by actively working with government, civil society and security professionals.

Introduction

In 2017, the head of the American Association for the Advancement of Science said that ‘Scientific progress depends on openness, transparency and the free flow of ideas.’7 This collaborative and open spirit, including collaboration with Chinese scientists, has led to some of the great scientific achievements of recent times.8

While countries such as Australia and the US pride themselves on their scientific achievements, their universities and research institutes face limited or declining domestic funding.9 To address these issues, many universities have turned to China—an emerging scientific powerhouse that has sought to build ties to scientific communities around the world.10 This collaboration has generally been a productive and welcome part of the Australia–China relationship. 

The Chinese military has also ridden this wave of research collaboration, sponsoring more than 2,500 scientists to travel to universities in technologically advanced countries such as Australia as students or visiting scholars over the past decade.11 The volume of peer-reviewed literature produced by PLA scientists in collaboration with foreign scientists each year has grown steadily since 2008, following increases in the number of PLA scientists sent abroad (Figure 1).12 Those scientists work in strategic and emerging technology sectors such as quantum physics, signal processing, cryptography, navigation technology and autonomous vehicles.

The PLA’s program of sending scientists abroad is different from standard military exchanges, in which military officers visit each other’s institutions. Those open exchanges build understanding, communication and relationships between militaries.

Figure 1: PLA collaboration, as measured by the number of peer-reviewed articles co-authored by PLA scientists with overseas scientists, 2006 to 2017

In contrast, the PLA National University of Defense Technology (NUDT, 解放军国防科学技术大学) appears to conceive of its military exchanges separately from its international research ties, which are concentrated in foreign universities and not military institutions.13 Scientists sent abroad by the PLA have minimal or no interaction with military personnel in their host countries. Some of those travelling overseas have actively used cover to disguise their military affiliations, claiming to be from non-existent academic institutions.

Around half of those sent abroad are PhD scholars who either complete their doctorates overseas or spend up to two years as visiting PhD scholars and who can usually be identified by searching peer-reviewed literature. While most come from NUDT, the Army Engineering University is another major source.14 The remaining half are sent overseas for short-term trips, spending up to a year as visiting scholars. Few of those scientists have left online traces of their time overseas.

While foreign universities’ ties with the PLA have grown, it isn’t clear that universities have developed an understanding of the PLA and how their collaboration with it differs from familiar forms of scientific collaboration. To date, there’s been no significant public discussion on why universities should be directly contributing to the technology of a non-allied military. Importantly, there’s also little evidence that universities are making any meaningful distinction between collaboration with the Chinese military and the rest of their collaboration with China.

A handful of universities have strongly defended their collaboration with the PLA. Among universities in Five Eyes countries, the University of New South Wales (UNSW) has published the most peer-reviewed literature in collaboration with PLA scientists. After attracting scrutiny for this collaboration, the university’s deputy vice-chancellor wrote, ‘Any fears that our intellectual property or security is undermined through our work with international partners are entirely unfounded.’15

Australia’s Curtin University has described its collaboration with the PLA in similar terms, insisting that work by its scientists with PLA experts on explosions and projectiles doesn’t violate any laws and is civilian research.16

Government research agencies have also engaged in collaboration with the PLA. For example, researchers at the Australian Government’s Commonwealth Scientific and Industrial Research Organisation (CSIRO) have collaborated with NUDT scientists on cloud computing technology.

Those same NUDT scientists were using cloud computing technology for combat simulations.17 Large sums of government funds have been used for collaboration with PLA scientists. One professor at UNSW, for instance, worked with PLA scientists using Australian Research Council grants worth $2.3 million.18 Internationally, defence funding has also been used for research with PLA scientists; for example, a paper written by University of Manchester scientists with a visiting student from NUDT lists US Air Force and Navy grants as funding sources.19

International military–civil fusion

In China, the PLA’s overseas research collaboration is described in frank terms. The PLA Daily uses the saying ‘Picking flowers in foreign lands to make honey in China’ to explain how it seeks to leverage overseas expertise, research and training to develop better military technology.20

This is one aspect of what China calls ‘military–civil fusion’ (军民融合). The term refers to China’s efforts to improve its military’s ability to take advantage of the creativity of the civilian sector and develop its own indigenous military–industrial complex. Described by PLA experts as a ‘cornerstone of PRC national defense reform’, military–civil fusion is helping to drive the modernisation of the PLA.21

So important is military–civil fusion to President Xi Jinping’s military reforms that he described it earlier this year as a prerequisite for building strategic capabilities and a strong military.22

Illustrating the benefits that the PLA obtains from its overseas research collaboration, a publication run by China’s Ministry of Education stated that NUDT’s collaboration with the University of Cambridge to train visiting PLA students will ‘greatly raise the nation’s power in the fields of national defence, communications, anti-jamming for imaging and high-precision navigation’.23 Likewise, before travelling to Sweden for doctoral studies in quantum physics, an NUDT scientist was told by his supervisor, ‘Without breakthroughs in physics, how can there be rapid developments in weaponry?’24

Figure 2: Lieutenant General Yang Xuejun (2nd from right) and Xi Jinping, chairman of the Central Military Commission, in July 2017

Lieutenant-General Yang Xuejun (杨学军, Figure 2), who oversaw a substantial rise in NUDT’s overseas links when he was its president from 2011 to 2017, appears to be one of the key figures behind this phenomenon. NUDT, as the Chinese military’s largest science and technology university, can be seen as representative of broader initiatives in this area. The university is the main source of PLA scientists studying abroad and by 2013 had reportedly sent more than 1,600 scientists overseas as students or visiting scholars, including roughly a third of its PhD scholars.25 An article written by NUDT scholars claims that the university received 300m renminbi ($A60m) from the Chinese government to send 765 graduate students to study abroad.26 According to General Yang, who has implied that NUDT’s overseas ties are a form of military–civil fusion, the university ‘has already reaped great benefits from going down the open university path and the military–civil fusion road’.27

General Yang’s recent promotion to membership of the 205-member 19th CCP Central Committee and to leadership of the Academy of Military Sciences, the PLA’s premier research institution, reflects Xi Jinping’s emphasis on ‘rejuvenating the military with science and technology’.28 It was probably also a recognition of the success with which Yang developed NUDT’s international ties.

Yang, himself a supercomputer expert, has collaborated extensively with UNSW and ran the program to develop the Tianhe-1A supercomputer, once ranked as the world’s fastest supercomputer.29 The NUDT supercomputer program’s role in nuclear weapons testing led to NUDT being placed on the US Government’s Entity List in 2015, meaning that the university faces stricter export controls, yet substantial numbers of NUDT scientists continue to train outside China, including in the US, the UK and Australia.30

The PLA encourages scientists to work on areas of interest to the military while they’re overseas. For example, a 2016 article by NUDT specialists in graduate student education recommends that, in choosing where to study overseas, students’ first priority should be the relevance of the research direction of an overseas institution to their work in China, as they ‘must comprehensively consider the continuity of their research work when in China with that when they are studying overseas’.31 When students are overseas, the report adds, they should ‘fully take advantage of the cutting-edge research conditions and environment abroad’ and ‘map out the arrangements of their overseas research and their plans for research after returning to China’. This alignment of domestic and overseas work indicates that the cases of PLA scientists gaining skills while in Australia that they then use for military projects aren’t outliers; they’re representative examples.32

Sources of and destinations for PLA scientists

PLA scientists come from a wide range of institutions and disciplines within the Chinese military. Analysing peer-reviewed publications co-authored by PLA scientists and overseas scientists indicates that the US, the UK, Canada, Australia and Germany were, in that order, the top five countries engaged in research collaboration with the PLA in 2017 (Figure 3). Those countries appear to be the primary destinations for PLA scientists sent abroad.

Figure 3: The top 10 countries for PLA collaboration, as measured by peer-reviewed literature co-authored by PLA scientists, 2006 to 2017

PLA scientists sent abroad as visiting scholars came from institutions such as:

  • the Northwestern Institute of Nuclear Technology (西北核技术研究所), which works on nuclear and high-power microwave weapons
  • the Chemical Defense Institute of the Academy of Military Sciences (军事科学院防化研究院), which specialises in chemical weapons research and has sent a sarin gas expert overseas
  • the Navy Submarine Academy (海军潜艇学院) in Qingdao
  • the Armored Forces Engineering Academy (装甲兵工程学院) in Beijing, which works on tank technology
  • the China Aerodynamics Research and Development Center (中国空气动力研究与发展中心), which has sent scramjet researchers to study overseas
  • the Rocket Force Engineering University (火箭军工程大学), which conducts research for China’s missile programs
  • the Academy of Equipment Command and Technology (装备指挥技术学院), which in 2007 sent a specialist in antisatellite weaponry to the University of Michigan using civilian cover.33

The volume of peer-reviewed literature co-authored by PLA researchers and overseas researchers is a rough indicator of the level of PLA collaboration at each university. Figure 3 shows that the leading countries for PLA collaboration by this measure for 2017 were, in order, the US, the UK, Canada, Australia and Germany, indicating that they’re likely to be the main destinations for PLA scientists studying abroad. Singapore, Sweden and the Netherlands are other major destinations for PLA scientists. Over the past decade, Australia has been engaged in the highest level of this collaboration among the Five Eyes countries per capita, at six times the level in the US.

It’s also possible to estimate the number of PLA scientists sent to each country since 2007, based on the above findings.34 Approximately 500 Chinese military scientists were sent to each of the UK and the US, roughly 300 each to Australia and Canada and more than 100 each to Germany and Singapore. Hundreds more have been sent to other countries, including the Netherlands, Sweden, Japan and France.

Figure 4, using the same dataset, shows the top 10 universities outside China for PLA collaboration. Nanyang Technological University in Singapore has the highest level of PLA collaboration, followed closely by UNSW in Australia. Other universities in Canada, Australia, the UK and the Netherlands also engage in high levels of collaboration with the PLA.35

Figure 4: The top 10 universities outside of China for PLA collaboration, as measured by the number of peer-reviewed publications, 2006 to 2017

The PLA’s links to universities across the world go beyond student admissions. The Chinese military, through its own universities and research institutions, has worked to build relationships with overseas universities and leading overseas researchers. A 2014 document published by NUDT claimed that the university had recruited 20 foreign nationals as teachers and ‘established academic relationships with over 100 universities and research units in over 50 countries and regions’.36

Scientists from Australia, the UK and the US are listed as potential doctoral supervisors for NUDT students in 2018.37

NUDT has also built ties with overseas universities at the institutional level. For example, NUDT’s Quantum Information Interdisciplinary Talent Training Program cooperates with the University of Cambridge’s Cavendish Laboratory.38 The People’s Daily claimed that, in addition to agreements with Oxford and Cambridge, NUDT has established ‘overseas study bases’ at institutions including Harvard University.39 New Zealand’s Massey University also signed a memorandum of understanding with NUDT in 2008.40

Maintaining loyalty to the CCP

The PLA, as the armed wing of the CCP, insists that all overseas party members strictly abide by ‘external exchange discipline standards’.41 According to the PLA Daily, ‘the openness of internationally expanding talent cultivation does not represent a “relaxation”, and we certainly cannot “let go”.’42 General Yang Xuejun has also specifically warned of the need to carefully manage military secrets while increasing the university’s openness.43

Those permitted to study overseas go through intensive training prior to their departure and are ‘all budding shoots with good grades and strong potential for innovation’.44 Alongside academic credentials, political credentials are also of key importance for military scientists hoping to study abroad. The PLA Daily warns that, if students sent overseas ‘develop issues with their politics and ideology, the consequences would be inconceivable (后果不堪设想)’.45 NUDT therefore appears to sponsor only CCP members for overseas study and works hard to maintain their loyalty to the party and negate ‘all kinds of harmful ideologies’.46 Reportedly, all 200 students and researchers from NUDT who were studying or visiting overseas in 2013 were party members.47

The People’s Daily claimed in 2013 that students sent overseas by NUDT had established eight party branches overseas and organised events for party members, so that ‘personnel studying abroad would keep their convictions rock-solid’ (坚守信念如磐).48 Another report from 2015 claimed that NUDT’s College of Optoelectric Science and Engineering alone had established 10 overseas party branches.49 More recent reports hint that such branches are still being established. For example, party media reported in October 2017 that students from one of NUDT’s colleges had established a WeChat group for the college’s more than 30 students overseas to study the 19th Party Congress.50 ‘Their red hearts,’ the report concluded, ‘look to the party.’

Party branches have also been used to coerce overseas Chinese scholars. An investigation by Foreign Policy found that some visiting students from Chinese universities who formed party branches abroad were asked to report on any subversive opinions held by their classmates.51 It’s probable that similar kinds of pressure are exerted on overseas PLA researchers.

Online communication forms an important part of PLA efforts to maintain discipline among overseas personnel and is complemented by in-person contact. One report stated that students from NUDT’s College of Optoelectric Science and Engineering ‘regularly chat with College leaders by video call and exchange emails with NUDT academic supervisors and student cadres to discuss their thoughts, exchange ideas on academic matters, and clarify points of interest’.52 Regulations on the political education of overseas students by the same NUDT college include provisions for ‘overseas inspection’ and for students to return to China in the middle of their study for ‘remedial education’.

One NUDT professor used a trip to an overseas conference as an opportunity to meet eight NUDT scientists studying in the region to ‘pass on the greetings and requests of party organisations’. The regulations also include provisions for ‘joint education and interaction with families’, which may imply that pressure on the family members of overseas PLA scientists is used to maintain discipline.53

The close watch that the PLA keeps on its overseas scientists helps ensure that all those sent abroad return to the Chinese military. NUDT, for example, requires that those applying to study abroad show their intent to return to ‘serve the construction of the nation, national defence and the military’.54

The PLA Daily claimed in 2013 that all the students whom NUDT had sent abroad in recent years returned on time to ‘become key forces in their work units’.55

Institutes that don’t exist: deception by PLA scientists

While most scientists sent abroad by the PLA appear to be open about which institutions they come from, this report has identified two dozen new cases of PLA scientists travelling abroad using cover to obscure their military affiliations. In at least 17 of these cases, PLA scientists used cover to travel to Australia. These scientists use various kinds of cover, ranging from the use of misleading historical names for their institutions to the use of names of non-existent institutions.

Features of deception by the PLA

An article from 2002 on the website of a Chinese overseas study agency offers insights into the use of cover. In response to a question asking whether having graduated from a military institution would affect one’s ability to get an overseas visa, the company responded: 

Many military colleges and military units externally have common names (民间称呼) that don’t reveal their military characteristics. NUDT, for example, is externally known as Changsha Institute of Technology. This is the best way [to avoid having your visa application rejected].56

The Changsha Institute of Technology was a PLA institution subsumed by NUDT in 1975.57 While the quote above doesn’t come from an official source, it at least indicates how these unsophisticated but nonetheless effective covers are understood as tools for hiding one’s military background.

Besides using non-existent institutions with innocuous-sounding names as cover, PLA members also claim to be from real civilian institutions in the same regions as their military units. New Zealand MP Yang Jian, for example, who taught intelligence officers at the PLA Foreign Languages Institute in Luoyang, claimed in his New Zealand residency application to have worked at Luoyang University.58 Before moving to New Zealand in 1999, Yang received an Australian Government aid scholarship to study at the Australian National University, earning a master’s degree and doctorate in international relations. During that period, he interned at the Senate Standing Committee on Foreign Affairs, Defence and Trade, and headed the Canberra Chinese Students and Scholars Association, which retains intimate ties to the Chinese Embassy to this day.59 Yang told media, ‘the system asked me to use the partner university,’ referring to Luoyang University.60

A number of PLA scientists using cover to travel abroad have created LinkedIn profiles using their cover institutions, which may have been used to shore up their claimed affiliations while overseas.61

The use of cover appears to be managed differently by each institution, some of which use cover far more often than others.62 Cover is also not used consistently within each institution. As described below, PLA Information Engineering University (PLAIEU) researchers have both used cover and openly stated their affiliation at the same conferences. It’s unclear whether this indicates that the use of cover is up to the discretion of each researcher or perhaps that it relates to the sensitivity of a researcher’s work or position in the PLA.

NUDT appears to no longer use the ‘Changsha Institute of Technology’ as cover, but it engages in a different kind of deception. A document published by NUDT for students hoping to study abroad advises them that, when providing documentation in their applications to foreign institutions, ‘military and political courses can be excluded’ from their academic records.63 This appears designed to mislead overseas authorities, universities and researchers by downplaying the extent to which NUDT is a military institution and to which these students are military scientists.

The Xi’an Research Institute of High Technology

Scientists from the PLA Rocket Force Engineering University (RFEU, 火箭军工程大学)64, a key research base for the PLA Rocket Force, claim to be from the ‘Xi’an Research Institute of High Technology’ (西安高技术研究所), which appears to only exist on paper.

At least five RFEU scientists claiming to be from the Xi’an Research Institute have travelled overseas as visiting scholars, including one of the PLA’s leading missile experts, Major General Hu Changhua (胡昌华), and three of his close associates at RFEU. General Hu (Figure 5), who heads RFEU’s Missile Testing and Control Simulation Experimental Teaching Centre, visited the University of Duisburg–Essen in Germany for four months in 2008.65 It’s unclear what he worked on in Germany, as he didn’t publish any papers while there, but his work for the PLA focuses on flight control systems and fault diagnosis for missiles.66

Two RFEU scientists who frequently publish with Hu, Zhou Zhijie (周志杰)67 and Wang Zhaoqiang (王兆强),68 were visiting scholars at universities in England; they claim in their English publications to be from the Xi’an Research Institute.69

Figure 5: Major General Hu Changhua, profiled by China Central Television’s military affairs channel in 2016:

‘Right now I’m a professor at RFEU and head of the Military Key Lab on Missile Testing and Control Technology.’ 

Figure 5: Major General Hu Changhua, profiled by China Central Television’s military affairs channel in 2016: ‘Right now I’m a professor at RFEU and head of the Military Key Lab on Missile Testing and Control Technology.’


Source: CCTV, 28 October 2016, YouTube.

Hu Xiaoxiang: a case study

Identifying the Xi’an Research Institute of High Technology as a cover institute helps shed light on the January 2015 expulsion from Norway of a Chinese scientist and his supervisor, a dual citizen of Germany and Iran. The expulsion came after Norwegian authorities determined that the work of the Chinese scientist, later named in court as Hu Xiaoxiang (扈晓翔), could be used to develop hypersonic cruise missiles (Figure 6).70

Figure 6: Hu Xiaoxiang

Hu wrote five papers with his supervisor at the University of Agder, all of which listed the Xi’an Research Institute as his affiliation. The papers focused on air-breathing hypersonic vehicles, which travel at over five times the speed of sound and ‘can carry more payload than ordinary flight vehicles’.71 Hu’s work was supported by a Norwegian Government grant for offshore wind energy research.72

Besides his affiliation with the Xi’an Research Institute, there’s a large body of evidence tying Hu to RFEU. The website of RFEU’s missile research centre states that Hu Xiaoxiang won an award in 2014 for his PhD thesis on hypersonic aircraft, supervised by General Hu Changhua.73 The website also says that in 2014 he received 250,000 renminbi (A$50,000) from the Chinese Government for a three-year research project on hypersonic aircraft (Figure 7).74 In 2016, he was described as a lecturer at the centre, which received 14 awards for missile research between 2010 and 2014.75 In some publications, Hu also listed the Harbin Institute of Technology, a civilian university heavily engaged in military research, as a second affiliation.76

Relations between China and Norway were put on ice when the Nobel Peace Prize was awarded to Chinese democracy activist Liu Xiaobo in 2010, and the Chinese Government was quick to attack Norway for Hu’s expulsion.77 Only in December 2016 did the two countries ‘normalise’ diplomatic relations. Public statements by Norwegian authorities didn’t explain the Chinese scientist’s military affiliation or mention the Xi’an Research Institute, as the information was likely classified.

Figure 7: A paper published by Hu Xiaoxiang shortly after his expulsion from Norway, stating an affiliation with RFEU in the Chinese version of the abstract but the Xi’an Research Institute in the English version.

A few months later, in September 2015, a court overturned the expulsions. Hu’s lawyer stated after the trial that ‘there is no evidence in the case that my client is part of research collaboration on missiles and weapons with China.’78 The University of Agder lauded the decision as a win for academic freedom.

The Norwegian Government later successfully appealed the overturning of Hu’s supervisor’s expulsion. However, it’s unclear whether any appeal was made in Hu’s own case, which hasn’t been made publicly available.79 Neither the Xi’an Research Institute, Hu Changhua nor RFEU was mentioned in the judge’s ruling on the German-Iranian supervisor’s case or any coverage of the expulsions.

The Zhengzhou Institute of Surveying and Mapping

Among the 40 Chinese military scientists listed as presenting papers at the 9th International Symposium on Mobile Mapping Technology, nine claimed to be from an institution with no apparent military affiliation.80 Most of the other 30 military scientists at the conference, hosted by UNSW in December 2015, were openly from NUDT and a research institute of China North Industries Group Corporation (also known as Norinco Group), China’s largest arms manufacturer; the rest came mainly from the PLA Information Engineering University.

The nine claimed to be from the Zhengzhou Institute of Surveying and Mapping. This institute, which was officially known as the PLA Institute of Surveying and Mapping, no longer exists, having been subsumed in 1999 by PLAIEU—itself a major player in cyber operations and a key training ground for signals intelligence officers.81 The Zhengzhou Institute appears to live on as cover for PLA scientists interacting with foreigners. Nearly 300 peer-reviewed papers have been published by authors claiming to be from the institute.82

The use of the Zhengzhou Institute of Surveying and Mapping as cover doesn’t stop at international conferences. Numerous examples of visiting scholars claiming to be from there have been uncovered for this report. They include Zhu Xinhui (朱新慧), a lecturer at PLAIEU specialising in navigation technology, who visited UNSW from 2015 to 2016.83 In numerous journal articles and in the program of the mobile mapping conference mentioned above, however, she is described as being from the Zhengzhou Institute of Surveying and Mapping.84

Guo Jianfeng (郭建锋), an associate professor at PLAIEU, visited Curtin University for a year in 2014. A specialist on navigation system data processing, Guo was described on the website of Curtin University’s Global Navigation Satellite Systems Research Centre as being on ‘sabbatical leave from the Department of Geodesy of the Institute of Surveying and Mapping, Zhengzhou, China’.85

The Zhengzhou Information Science and Technology Institute

Another cover institute, the Zhengzhou Information Science and Technology Institute (ZISTI), which appears to exist only on paper, has also been widely used by PLAIEU scientists to publish research and travel overseas. More than 1,300 pieces of peer-reviewed literature have been authored by individuals claiming to be from ZISTI.86

One paper in a Chinese-language journal by a PLAIEU researcher, which includes an English version of the abstract and author information, clearly shows that ZISTI is a cover institute (Figure 8). The paper’s Chinese text describes the first author as affiliated with PLAIEU, but the English version describes the
same author as affiliated with ZISTI.87 Nearly all of the authors sampled who claimed an affiliation with ZISTI could be shown to be working at PLAIEU.

Figure 8: Chinese and English versions of a paper published by a PLAIEU scientist, demonstrating the use of the Zhengzhou Information Science and Technology Institute as cover.

Scientists claiming to be from ZISTI have attended international conferences both inside and outside China. For example, seven researchers affiliated with ZISTI are listed in the program of a conference on signal processing at the Gold Coast in Australia in 2014. Experts from American, Australian and Korean
defence research agencies were also in attendance.88

As with the Zhengzhou Institute of Surveying and Mapping, ZISTI has been used as cover for PLA scientists travelling overseas as visiting scholars. For example, Zhu Yijun (朱义君) is an associate professor at PLAIEU specialising in signals engineering.89 Claiming to be from ZISTI, in 2011 he visited Canada’s McMaster University, where he worked on wireless communications technology with wide-ranging military applications.90

PLAIEU scientists claiming to be from ZISTI have also travelled to the US as visiting scholars and for conferences.91

Espionage and intellectual property theft

In addition to their overt activities, PLA researchers, especially those who haven’t been forthcoming about their military affiliations, may engage in espionage or steal intellectual property while overseas. The PLA engages in such high levels of espionage that in 2014 the US Government took the unusual step of publicly indicting five Chinese military hackers.92 Military scientists abroad who regularly communicate with superiors in China, receive visits by superiors while overseas and return home in the middle of their time abroad for ‘remedial education’, as described in the examples outlined above, offer safe and convenient channels for Chinese intelligence agencies to access sensitive information from overseas.93

Amateur collectors with STEM expertise have been implicated in a high proportion of intellectual property theft and espionage cases involving China.94 Scientists and engineers involved in military research projects, while they might not have received formal training as spies, are uniquely qualified to identify and exfiltrate valuable information to overcome specific hurdles in the development of new technologies.

Should universities collaborate with the PLA?

Assessing the costs and benefits of research collaboration with the PLA shows that it comes with significant security risks while offering unclear benefits. It isn’t in the national interest of most of the countries examined in this report to help build the capabilities of a rival military. Other forms of cooperation with the Chinese military, such as joint exercises and exchanges that build understanding and communication, are largely beneficial but distinct from the kinds of research collaboration addressed in this report.

The benefits of research collaboration with the Chinese military are difficult to measure, but could include the following:

  • Training PLA scientists and working with them leads to scientific developments and published research while attracting some funding. 
  • A small proportion of collaboration with the PLA appears sufficiently transparent and falls into areas of fundamental research such that the benefits may outweigh security risks. One possible example is cooperation between the American and Chinese governments on the multinational Daya Bay Reactor Neutrino Experiment, which involves NUDT.

A number of benefits usually associated with research collaboration with militaries and foreign countries haven’t been observed in PLA collaboration:

  • PLA collaboration doesn’t lead to long-term improvement in the talent of institutions and countries accepting PLA scientists, as the PLA claims that 100 per cent of scientists sent abroad by NUDT in the years before 2013 returned to China on time.95 
  • The forms of PLA collaboration studied in this report don’t promote understanding and relationships between militaries, as they aren’t military exchanges and often aren’t overt.
  • While overseas, PLA scientists remain under the close watch of the CCP, which works to ensure that they remain loyal and aren’t influenced by their experience living in free societies. 
  • It’s improbable that PLA scientists working with overseas civilian researchers would share with or disclose to those researchers any significant research breakthroughs of military value.

There are many risks and costs associated with current approaches to training and collaborating with PLA scientists:

  • Training PLA scientists improves the scientific talent and knowledge of a military treated by many as a strategic competitor.96
  • PLA scientists often engage in deception in their interactions with foreign institutions and their staff, making it difficult for those collaborating with them to take appropriate security precautions.
  • PLA scientists could gather intelligence and steal technology while they’re overseas, especially if they’re hiding their military affiliations.
  • Failures to address concerns about PLA collaboration and to develop policies differentiating it from wider engagement with China risk tarring all research ties with China with the same brush.
  • Research collaboration with the PLA contributes to technology that may be used against Australia and its partners in a conflict or for intelligence collection.
  • Universities with ties to the PLA risk eroding trust between themselves and funders of research, such as defence research agencies, scientific agencies and industry.
  • Universities risk reputational damage by collaborating with a non-allied military.
  • Public funding worth millions of dollars is being used for collaboration with a non-allied military, with little to no input from taxpayers.

Current policy and legislation are inadequate

Export controls are the primary mechanism by which countries seek to manage the supply of sensitive technology and goods to overseas entities. However, the ability of export control laws to effectively manage the risks posed by PLA research collaboration is limited. In Australia, few cases of research or cooperation contrary to our national interests are believed to have been prevented through the Defence Trade Controls Act 2012.97 The current review of the Act offers an opportunity to address some of these limitations.

There are a few reasons for these difficulties. First, intangible transfer of technology—the primary form of technology transfer taking place through the kinds of collaboration studied in this paper— is extremely difficult to control in practice because it doesn’t involve the export of physical goods.98 Second, the Act doesn’t regulate the supply of controlled technology, which includes instruction and training, to individuals in Australia even if they’re PLA members. Third, some of this collaboration covers emerging technologies, such as quantum physics, that are important but not included in the Defence and Strategic Goods List, as their applications aren’t yet fully known. Export control lists tend to be slow to incorporate emerging technologies, so regulatory power can come well after issues become apparent. Fourth, the Act doesn’t regulate the supply of controlled technology by Australians when they’re outside of Australia, such as training given to PLA members by Australian academics visiting China.
 

Recommendations

The PLA’s collaboration with foreign universities is growing and the expansion of international ties remains one of NUDT’s priorities.99 The developments outlined in this report warrant more attention and different approaches from those currently employed by most governments and universities. Responses to PLA collaboration need to be informed by clear government policies and move beyond export controls, using the full range of tools available to governments and universities. The Australian Government, for example, can do more to work in partnership with our research sector to advance scientific progress while protecting national security and ensuring that relevant research doesn’t advance the Chinese military’s capabilities.

Based on the findings of this report, it is recommended that governments pursue the following measures:

Deepen discussions within government on PLA collaboration to determine how it relates to the national interest

  • Determine what kinds of collaboration with the PLA should be further controlled or even prohibited and establish clear policy on engagement with PLA research organisations and personnel.
  • Foster international discussions on PLA collaboration to develop multilateral responses.
  • Develop interagency responses to PLA collaboration to ensure better integration of efforts by defence and export control agencies, intelligence agencies and immigration agencies.
  • Share information about cases and trends in PLA collaboration, particularly cases of deception by PLA scientists, with partners across the globe.

Increase communication and outreach to universities, companies and publics

  • Establish a committee bringing together members of the national security community and university leaders. This committee could serve as a forum to share key information and foster a more cooperative working environment while also providing a space for the university sector and national security community to better understand each other’s perspectives. The US Federal Bureau of Investigation’s National Security Higher Education Advisory Board is a useful model to emulate.100
  • Ensure that companies funding research at universities are aware of any PLA collaboration and understand future measures to control such collaboration.
  • Politicians and senior public servants should better articulate what’s in the national interest and publicly explain why advancing China’s military capabilities isn’t in the national interest.101

Improve the scrutiny of visa applications by foreign military personnel

  • Enhance and better coordinate efforts by government agencies such as Australia’s Department of Home Affairs, Department of Defence and Australian Security Intelligence Organisation to ensure that military scientists applying for visas are identified and properly vetted.102
  • Create a list of Chinese and other non-allied military and military-linked research institutions, including civilian universities heavily engaged in military research, for use by immigration officials.

Re-examine export controls

  • The Australian Government should consider further controlling technology transfer to certain end users. Transfers of controlled technology to PLA members and civilians heavily engaged in military research should be restricted regardless of their geographical location.
  • The Australian Government should create a list of entities posing national security risks that are subject to special export licence requirements, modelled on the US’s Entity List.
  • The government should help universities train and provide resources for staff with export control compliance duties.
  • Work continuously with experienced scientists in emerging technology fields to determine whether and how emerging technologies should be controlled.
  • Ensure that universities are fully complying with controls relating to the intangible transfer of technology in their collaboration with the PLA.

Regulate scientific training given to foreign military personnel

  • Introduce legislation that draws on the US Code of Federal Regulations’ rules on defence services, which require those offering training to foreign military personnel to first receive a waiver from the US Department of Defense.103 This could take the form of an expansion of the Defence Trade Controls Act that restricts technology transfer to members of certain governments and organisations.

Regulate the use of government resources in collaboration with the Chinese military and other non-allied militaries

  • Update internal policies in government research institutions such as CSIRO to limit or ban collaboration with non-allied militaries, particularly in dual-use areas.
  • Funding bodies such as the Australian Research Council should prohibit funding in some areas from being used in collaboration with non-allied militaries.
  • Carefully evaluate any collaboration with PLA scientists on government-funded projects, particularly defence projects.

Increase government and other funding for research in strategic research areas

  • Fields such as artificial intelligence and quantum physics should receive more government funding to ensure that talent and ideas stay in Australia.
  • Universities working in strategic research areas should be encouraged to collaborate with allied military and defence countries rather than non-allied militaries.

Limit problematic forms of foreign investment in strategic research areas

  • Investment by Chinese defence companies such as China Electronics Technology Group Corporation into strategically important fields should be prohibited.104

Universities should also pursue the following measures:

Build understanding of PLA collaboration

  • Produce credible and thorough assessments of the extent of PLA collaboration on campuses.
  • Develop processes for managing PLA collaboration so that security risks can be identified and resolved

Raise awareness among employees

  • Ensure that those interacting with members of non-allied militaries take appropriate security precautions.

Exercise greater oversight of visiting scholar and student application

Develop internal policies on collaboration with foreign military personnel

  • Require employees to receive approval before collaborating with or training members of non-allied militaries.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

First published October 2018

  1. This estimate has sought to exclude PLA medical scientists and doctors by not counting those affiliated with PLA medical institutions. Media reports, many of which are cited in this report, were one important source for determining the number of PLA scientists sent abroad. Feng Chunmei 冯春梅, Cai Weibin 蔡渭滨, Li Zhi 李治, ‘Guofang keji daxue shixiang weilai zhanzheng de rencai hangmu’ 国防科技大学 驶向未来 战争的人才航母 [NUDT—An aircraft carrier of talent steering towards future wars], Renmin Ribao 人民日报, 8 August 2013, online, claims that NUDT had sent 1,600 scientists overseas as students or visiting scholars ‘in recent years’. Assuming the 1,600 figure describes the number of NUDT scientists sent abroad between 2007, when the PLA substantially increased the number of scientists it sent overseas, and 2013, this gives roughly 230 NUDT scientists sent overseas each year. Conservatively, this indicates that well over 2,000 NUDT scientists have been sent abroad since 2007. Accounting for the fact that NUDT is responsible for approximately 80% of publications written by PLA scientists with overseas scientists and assuming that represents the proportion of PLA scientists overseas who are from NUDT, this means that more than 2,500 PLA scientists have been sent overseas since 2007. This estimate was also supported by a second set of open-source data which, to prevent the information from being removed, has not been revealed. ↩︎
  2. New Zealand is not counted here, despite being a Five Eyes country. It has high levels of PLA collaboration, especially relative to its population, but is not among the top countries for collaboration more generally. ↩︎
  3. C Uhlmann, ‘China an “extreme” threat to Australia: ASIO’, 9 News, 31 January 2018, online; Bill Gertz, ‘FBI director warns China is America’s most significant intelligence threat’, The Washington Free Beacon, 19 July 2018, online; ‘German intelligence unmasks alleged covert Chinese social media profiles’, Reuters, 10 December 2017. For a discussion of the case of Huang Jing in Singapore, see John Garnaut, ‘Australia’s China reset’, The Monthly, August 2018. ↩︎
  4. Wang Wowen 王握文, ‘Zouchu guomen, dang zuzhi shenghuo “bu diaoxian”’, 走出国门,党组织生活’不掉线’ [Exiting the country, they stay connected with the life of party organisations], Jiefangjunbao 解放军报, 1 July 2015, online. ↩︎
  5. One of the only papers to address research collaboration with the PLA is Elsa Kania, Technological entanglement, ASPI, Canberra, 28 June 2018, online. ↩︎
  6. Section 1286 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 offers an important starting point for policies on scientific engagement with China and the PLA, seeking to protect scientists from undue foreign influence, safeguard important information and support the growth of domestic talent. ↩︎
  7. Richard Holt, AAAS statement on White House proclamation on immigration and visas, American Association for the Advancement of Science, 25 September 2017, online. ↩︎
  8. See Yangyang Cheng, ‘The future of particle physics will live and die in China’, Foreign Policy, 2 November 2017, for an eye-opening discussion of the level of political involvement in China’s scientific research, even research into particle physics, online. ↩︎
  9. DJ Howard, FN Laird, ‘The new normal in funding university science’, Issues in Science and Technology, 2013, 30(1), online; M Clarke, ‘Federal government university budget leaves 10,000 places unfunded, Universities Australia says’, ABC News, 18 January 2018, online; N Whigham, ‘Medical and scientific research at a crossroads in Australia as funding stagnates’, News.com.au, 7 November 2016. ↩︎
  10. UNSW, for example, has partnered with the Chinese Government’s Torch Program, attracting tens of millions of dollars in R&D funding from Chinese companies. See ‘UNSW celebrates first anniversary of Torch partnership with China’, UNSW Media, 28 March 2017, online. ↩︎
  11. It appears that most of those sent abroad are PLA ‘civilian cadres’ (文职干部), rather than ranking military officers. While they’re counted as members of the PLA, civilian cadres aren’t combat personnel and often work in technical areas, such as scientific research. See information about civilian cadres at the following link. ↩︎
  12. Peer-reviewed literature is the most accessible but not the only measure of PLA collaboration. Other facets of PLA collaboration include visiting and lecturing at PLA institutions, supervising PLA students and visiting scholars, which are correlated with but distinct from the level of peer-reviewed literature. Findings on peer-reviewed literature by PLA scientists with foreign researchers are based on searches in Scopus, the largest database of peer-reviewed literature, covering 16 PLA institutions and aliases. Hong Kong wasn’t counted together with the PRC mainland. Note that publications by PLA scientists from medical institutions have been excluded. The following institutions and aliases were included in the search: National University of Defense Technology, National Key Laboratory for Parallel and Distributed Processing, PLA University of Science and Technology, PLA Information Engineering University, Zhengzhou Information Science and Technology Institute, Zhengzhou Institute of Surveying and Mapping, Air Force Engineering University, Second Artillery Engineering College, Xi’an Research Institute of High Technology, Academy of Armored Force Engineering, Academy of Equipment Command and Technology, National Digital Switching System Engineering and Technological Research Center, Northwest Institute of Nuclear Technology, China Aerodynamics Research and Development Center, Naval University of Engineering and PLA Electronic Engineering Institute. ↩︎
  13. See the section on international ties, which discusses sending students abroad and building academic ties separately from military exchanges, in Liu Hang (ed.), 2015 National University of Defence Technology admissions guide, online. ↩︎
  14. The Army Engineering University was formed in August 2017 through the merger of the PLA University of Science and Technology and a number of other army colleges. See Anonymous, ‘Lujun gongcheng daxue jiepai, you gongchengbing xueyuan deng 5 suo yuanxiao heping zujian’ 陆军工程大学揭牌,由工程兵学院等5所院校合并组建 [The Army Engineering University is unveiled, formed by the merger of the Engineering College and five other institutions], Pengpai 澎湃, 3 August 2017, online. ↩︎
  15. Brian Boyle, ‘Chinese partnerships are vital for universities and global research’, Financial Review, 29 October 2017, online. ↩︎
  16. Clive Hamilton, Alex Joske, ‘Australian universities are helping China’s military surpass the United States’, Sydney Morning Herald, 24 October 2017, online. ↩︎
  17. Clive Hamilton, Silent Invasion, Hardy Grant Books, 2018, 190–193. ↩︎
  18. Hamilton & Joske, ‘Australian universities are helping China’s military surpass the United States’. ↩︎
  19. Mengjian Zhu, Moshe Ben Shalom, Artem Mishchsenko, Vladimir Falko, Kostya Novoselov, Andre Geim, ‘Supercurrent and multiple Andreev reflections in micrometer-long ballistic graphene Josephson junctions’, Nanoscale, 2018, issue 6, online. ↩︎

Huawei and Australia’s 5G Network

Over the course of 2018, ASPI staff and writers for The Strategist participated in a dynamic public debate about the participation of Chinese telecommunications equipment manufacturer Huawei in Australia’s 5G network.

Australia’s 5G network is critical national infrastructure and this was one of the most important policy decisions the government had to make this year.

ASPI felt it was vital to stimulate and lead a frank and robust public discussion, in Australia and throughout the wider region, which analysed and debated the national security, cybersecurity and international implications of Huawei’s involvement in this infrastructure.

In this report, in chronological order, you’ll read a range of views written up in The Strategist, The Australian and The Financial Times.

These articles tackle a variety of issues surrounding the decision, including the cybersecurity dimension, the broader Australia–China relationship, other states’ experiences with Huawei, the Chinese Government’s approach to cyber espionage and intellectual property theft and, importantly, the Chinese party-state’s view of state security and intelligence work.

When it comes to important national security, cybersecurity and critical infrastructure decisions, ASPI will continue to stimulate Australian public discourse and fill gaps in global debates.

We also encourage the Australian Government to take a more forward-leaning approach to its participation in public discourse so that the public and key stakeholders are as informed as possible when hard and complicated policy decisions like this need to be made.

Anti-Money Laundering. A case study

The Australian Government’s technological monopolies have ended. Technological developments, especially those that have been disruptive, have been driven primarily by private corporations for at least the past 10 years. Meanwhile, legislative responses to those changes, be they disruptive or otherwise, have been increasingly delayed.

Acceleration in the development and use of technology has been matched by changes in the capability of those who would do us harm. In the face of rapid social change, governments have lost more than a technological edge, as the very conceptualisations of sovereignty and geographical jurisdictions are being challenged. Law enforcement agencies’ traditional business models for dealing with organised crime are under significant pressure from threat actors that are able to operate more agile decision-making cycles and exploit seams between jurisdictions and in law enforcement agencies’ capabilities.

In this context, Australian law enforcement agencies face an increasing number of challenges from emergent technologies. A key policy challenge underpinning these issues relates to the limited capacity of law enforcement to introduce innovative strategies in response to disruptive technology. Another is how to make cross-jurisdictional cooperation simpler and easier.

ASPI’s latest Special Report by Dr John Coyne and Ms Amelia Meurant-Tompkinson, explores technological innovation in law enforcement through a specific crime type case study of anti-money laundering (AML) provisions. It analyses the factors that support or restrict technological innovation in federal law enforcement’s AML efforts and argues that the current ecosystem for innovation for AML needs to be enhanced to engage with the dual challenge of disruptive technology, and the integration of existing pockets of AML excellence into a holistic whole-of-government innovation program. The initial steps for responding to this challenge should include an analysis of the central assumptions that underpin innovation, policymaking, strategy and finance in this space.

In this video, Madeleine Nyst discusses the report with John Coyne and Amelia Meurant-Tompkinson.

Tag Archive for: Critical & Emerging Technology

Nothing Found

Sorry, no posts matched your criteria