On 25 March, the US and Britain attributed malicious cyber activity to a China-based hacking group backed by the Chinese government. They issued indictments and sanctions.

The hacking was aimed at influencing opinion, at suppressing criticism of China and at stealing intellectual property. China also sought to strike at the heart of liberal democracies by attacking electoral processes, democratic institutions and political officials. In the attack on Britain, China stole the names and addresses of 40 million voters. 

The British and US responses are weak, in the sense that the consequences for China are virtually nil. Britain sanctioned two people and one front company, while the US charged seven individual hackers. The UK attacks were in 2021, and critics have complained about the lack of urgency. The US attacks took place over the past 14 years. 

Are these reprisals too little, too late? It might be easy to think so, but it must be acknowledged that attributing an attack to a particular country is bureaucratically and technically difficult and politically hazardous. Sanctions and indictments add more layers of complexity. Some countries are still developing the processes and legislative tools required. New Zealand, for example, has yet to develop an autonomous sanctions regime.  

Cyber attributions, sanctions and indictments are largely strategic communication exercises—but can shift actors’ behaviour in the right circumstances. We must maximise the power of these communications by choosing the right message, at the right time, augmented by the right partners. China is conducting hundreds of cyber attacks against Australia, the US, Britain and likeminded Asian partners like Japan every day. Putting out hundreds of attributions would only dilute the strength of our statements. We must pick our moments. 

The US and Britain have taken steps in the right direction. And despite the challenges, Australia and its partners are getting better and faster at these attributions and associated punitive measures, such as sanctions. Supportive statements have come from Australian Foreign Affairs Minister Penny Wong and Home Affairs Minister Clare O’Neil. And New Zealand is accusing China of cyber hacks against its parliament in 2021. 

There is a growing appetite for calling out China, Russia and others for their bad behaviour. In 2018, the US indicted 12 Russians for interference in the 2016 US elections. There was a series of major joint attributions by the Five Eyes and others in 2023, including of Chinese cyber campaign Volt Typhoon and the Russian snake malware. In January this year, Australia sanctioned Russian citizen Aleksandr Ermakov over a 2022 cyber attack on the Medibank health fund. Australia was soon joined by the US and Britain with their own additional sanctions.  

To repay the favour and show solidarity, Australia should now join the US and Britain in sanctioning Chinese hackers. 

Further action should also include the US, Britain, Australia and its partners sanctioning the Chinese government decisionmakers authorising these cyber operations. In the most recent case, we should target Tu Hongjian, the director of the Hubei State Security Department, who probably authorised the hacking activity. 

Democracies should signal that if China’s cyber operations continue then the sanctions regime will escalate to target CCP elites, such as Chen Yixin, China’s minister of state security, or Chen Wenqing, the secretary of the Chinese Communist Party’s Central Political and Legal Affairs Commission, who oversees China’s state security system. 

The cyber attacks described by the US and Britain did not impact Australia, but they represent a trend in Chinese cyber activity of increasingly targeting democratic institutions, social cohesion and critical infrastructure. At the same time, China continues to target Australia with cyber espionage and as part of the global effort that ASIO director Mike Burgess called in October last year “the largest theft of intellectual property in human history”. 

Australia should expect greater interference with our next elections, especially with generative AI and deepfakes. A fake, AI-generated voice from President Joe Biden has already targeted US voters this year.  

The rapid growth of generative AI capabilities will make this even easier and cheaper for any malicious actor. That’s why there have been major international efforts to combat this, including the Tech Accord to Combat Deceptive Use of AI in 2024 Elections, announced at the Munich Security Conference in February this year and signed by 20 major tech companies. 

AI-augmented information operations will be aimed at producing wide-scale fear, uncertainty and doubt about elections, along with hyper-targeting of individuals with sophisticated fake media. Australia needs to understand that this is a threat to our way of life. We can’t allow this to become normalised. It is not normal. 

Democracies run on trusted information. China’s targeting of our electoral systems are attempts to poison the well and create distrust and chaos, weakening our social cohesion. These grey zone cyber attacks may fall short of outright conflict, but they are pushing close up against it. Targeting electoral systems strikes at the heart of our liberal democratic societies, and we cannot stand idly by. 

So how can we respond? Ignoring China’s current reality won’t help. Australia, alongside its partners, needs a clear-eyed strategy. We face a China in 2024 defined by its authoritarian rule, territorial ambitions and sophisticated, industrial-scale foreign interference tactics. This China bullies both weak and strong nations, aiming to reshape the global order in its favour. 

Australia should maintain a focus on cyber sanctions and indictments, enhance international cooperation across public and private sectors and build strong coalitions to counter China’s cyber and information operations, especially those aimed at our electoral systems and social cohesion. When electoral systems are targeted, Australia has a moral imperative to respond. This approach should be deployed in the context of increasing our national cyber resilience, a never-ending job that includes better technical shields and more informed human behaviour.  

We are not at war with China, but we are not really at peace, either. These grey zone activities fall short of conventional conflict but we must take them for what they are: state-on-state attacks. 

The rapidly changing strategic environment is prompting reassessments of Australia’s defence posture and capability. Rather than simply reviewing equipment purchases and stepping up training schedules, there’s cause for a deeper re-evaluation of the strategic logic that underpins power, the posture of nations and how they interact.

Most national strategies remain embedded, understandably, in the precepts of conventional warfare. Coercion remains the key dynamic: nations are interested in either persuading other nations to align with their interests or adopt their worldview or applying force to meet demands. That application of force is typically achieved through kinetic means, as is the case in Ukraine. Conventional warfare depends on being able to apply force, backed by logistics and long-term sustainment—and ensuring enough personnel, materiel and political will—at key points. Terms of engagement became codified. There are thresholds between war and peace.

A second strategic logic emerged after World War II, that of nuclear warfare. Under nuclear strategy, outcomes are achieved through the prospective use of nuclear weapons—deterrence is the central dynamic. Nuclear deterrence rests on a believable and apparent commitment to use nuclear weapons, implying possession, capability and intent. In contrast to conventional warfare, nuclear warfare was expected to be massive but short and sharp, implying less need for sustainment tails. The imperatives driving the management of nuclear strategy are risk mitigation and escalation control, which engage civilians to a much greater extent.

The existence of two distinct but interacting, and potentially catastrophic, domains of strategic logic makes the national calculus increasingly difficult. One doesn’t need nuclear weapons to wreak devastation. But the complexity of the strategic calculus rachets up with nuclear weapons.

During the Cold War, mechanisms evolved to make that complexity more manageable. Bipolarity simplified the strategic equation. Extended deterrence dissuaded allies from developing their own nuclear capabilities and assuming the associated costs necessary for meaningful deterrence.

Since the end of the Cold War, a third and markedly different strategic logic has emerged: cyber. Unlike land, sea, air and space, cyber is entirely human made, and human actions in that domain change the operating conditions in the domain. The cyber environment is dynamic, mutable and effectively infinite. Concepts intrinsic to the other domains, including deterrence and coercion, are largely meaningless in the cyber domain.

Yet the cyber environment is of concern because of the ubiquity and embeddedness of digital technologies in every facet of our society, economy, national security apparatus and personal lives. Digital systems now provide the connective tissue and allow the transmission of intent in and to the other two domains. Because of that dependency, and vulnerabilities built into networks, applications and the use of digital systems, cyber is increasingly contested and a means of international positioning and power.

The tools and guiderails that helped structure the Cold War are not fit for purpose in this new environment and in any case have eroded. Bipolarity has given way to multipolarity. The earlier rules-based order is routinely ignored by revanchist, authoritarian powers such as China and Russia—for example, China in the South China Sea and Russia in Ukraine. The rise of populist politicians, supported by conspiracy cults and shaped by active enemy disinformation—most worryingly in the United States—undermines confidence among Western allies, including on extended deterrence. Those uncertainties are exacerbated by the stresses generated through the Covid-19 pandemic, which has weakened economies, exposed the fragility of supply chains and undermined national capability.

Digitalisation has also fuelled both disruption and competition: information technologies are general purpose, enabling ongoing innovation and change across the technological spectrum. The democratisation and dissemination of technology have led to what Audrey Kurth Cronin refers to as a lethal empowerment that further destabilises the international system.

Such tumult offers both threat and opportunity. That’s most evident in the grey zone—competition and confrontation below the level of traditional military conflict—where China and Russia are already engaged. The grey zone offers an immoral or opportunistic actor many means to exert pressure on opponents and achieve both short- and long-term goals: traditional diplomacy, armed harassment, lawfare, intellectual property theft, targeted investment, disinformation campaigns and maskirovka, cyberattacks, the co-option and corruption of officials, foreign influence campaigns and infiltration of expatriate communities.

This is the new realpolitik: grey-zone or hybrid tactics that complicate and confuse decision-makers, heighten uncertainty and increase hesitancy, allowing the aggressor to force change, retain the initiative and achieve their strategic objectives at less cost. Left unchallenged, grey-zone activity raises the stakes while engaging ever riskier behaviour, heightening the prospect of conflagration. The appropriate response is not to avoid the contest; that yields ground in the face of a revanchist aggressor, weakens regional security and prosperity, and undermines national interest.

Instead, a lesson may be drawn from cyber, the youngest of the strategic logics. Grey-zone behaviours are more akin to cyber than conventional or nuclear. In the grey zone, the field of potential action is large, encompassing various combinations of physical, systemic, economic, political, social and personal means of pressure. As in cyber, actions are often pre-emptive, obscured and frequently disowned. Once targets—governments, institutions, systems—have been destabilised and a means of purchase enabled, the strategic logic switches, enabling coercion and deterrence.

The means of responding to the cyber environment is through persistent engagement. In cyber, defending perimeters alone doesn’t provide security; an adaptive, layered defence is necessary. National cyber agencies now present a proactive posture, in constant contact with adversaries: the competitive interaction helps generate restraint rather than spiralling escalation.

Applied to the grey zone, persistent engagement entails the deliberate seeking of opportunities and exploitation of advantages in diplomacy, public debates, finance and industry, in technological development and in institutions across the region. These activities cannot be left to the military alone, which has neither the remit nor the requisite skills; nor are they reducible to the precepts of conventional strategic logic. They will require new institutions, new capabilities, greater civilian capability and engagement, and a re-evaluation of how best to harness the strengths of democratic systems and agency.

The challenge for Australian policymakers is to grapple not simply with a markedly degraded security environment, but with the entanglement of three very different strategic logics. Australia needs to confront grey-zone activity with sustained intent, an appropriate (civilian) capability and societal response. The Australian Defence Force needs to arm up and stock up against the prospect of innovative and adaptive conventional, potentially major-power, war and hard thought needs to be given regarding the prospective erosion of extended deterrence. That’s going to require more than reordering planned purchases in an already outmoded and underpowered force structure.