Foreign interference concerns have been well documented in Australia in recent years with regular reports of intimidation of diaspora communities, monitoring of university students and the tracking of political donations.
However, last month, Australia’s Minister for Home Affairs Clare O’Neil and the Australian Security Intelligence Organisation’s Director-General of Security Mike Burgess both gave unprecedently frank speeches about this rising danger. O’Neil declared foreign interference “relentless and…insidious” and a major threat to Australian democracy. Burgess went further, revealing espionage and foreign interference is now Australia’s principal security concern, akin to “hand to hand combat.”
Burgess’s speech attracted a lot of attention. Yet O’Neil’s offered an interesting takeaway that largely slipped under the radar. As part of its efforts to counter rising foreign interference, the Australian government appears to be taking lessons from cyberspace.
O’Neil – who is also minister for cybersecurity – revealed Australia will begin to “name and shame” perpetrators by developing an attribution framework:
We don’t want to just … disrupt these operations, but we want to deter future ones by imposing costs on their sponsors by outing them, where it is possible to do so. I would like us to see Australia … do this more and more, because we have to stop this from happening in the shadows. We have to bring it into the light.
An attribution framework is normally a process for identifying the party responsible for a cyberattack or other malicious activity in cyberspace and determining appropriate courses of action (or inaction) in response. Technical attribution involves analysing and examining the technical details of an attack or incident to determine who the actor or group behind it was and what their capabilities, tactics and methods were as well as their motivations.
After a technical attribution has been made, an appropriate diplomatic, political or operational response is determined. This could include making a public attribution statement to identify the party responsible for an incident, which is intended to serve as a deterrent to that party and other potential attackers that such behaviour won’t be tolerated.
In some cases, it may be valuable for strategic or diplomatic reasons to make an attribution privately or not make one at all. The decision to make an attribution is often based on factors such as the severity of the attack, the target, and the potential consequences of making such information public.
Australia’s decision to apply an attribution framework to foreign interference is interesting. The government clearly recognises foreign interference activities will continue and it needs a new form of deterrence. The use of an attribution framework will also provide a standardised and (relatively) transparent approach to identifying and responding to these activities, increasing the legitimacy of any future attribution statement made.
However, while O’Neil has said Australia will always speak up against foreign interference, an attribution – whether public or made in private – is ultimately a political and diplomatic act.
While the scale of China’s interference operations is the very reason Australia has foreign interference protections in the first place, with expectations Prime Minister Anthony Albanese could visit Beijing later this year, it’s unlikely any attributions to China will fit into Australia’s current foreign policy priorities.
Aside from questions about where attribution fits into Australia’s political and foreign policy calculations, there’s also the perennial question about whether attribution in cyberspace even works. As malicious cyber incidents continue to rise around the world, authorities increasingly agree that attribution by itself is not enough to deter perpetrators. Attribution must be followed by broader responses to ensure there are appropriate costs inflicted on those responsible.
Fortunately, Australia’s attribution framework for foreign interference fits in with broader measures it is taking to build resilience. The government has announced a new drive by federal law enforcement to raise awareness among multicultural communities and provide increased support services to assist those at risk. O’Neil has also revealed the Home Affairs department will play a more active role in building social cohesion and democratic resilience to counter foreign interference.
While plenty of questions remain about what an attribution framework for foreign interference will look like – including what the broad process behind the framework will be, when is an act significant enough to be called out, and what happens after an attribution is made – the announcement of the framework is a welcome escalation of Australia’s efforts to counter foreign interference.
With interference continuing to rise in other countries, no doubt there will be global interest in Australia’s experience to see whether this approach of naming and shaming perpetrators helps deter meddling in the domestic affairs and democratic processes of other nations. Indeed, Australia’s efforts to develop such a framework could well set a precedent for other countries facing this challenge.