In late March, the Australian Parliament suffered an IT disruption that resulted in MPs and senators losing access to email over the weekend, with some complaining into the week that their access was “patchy”.
Facing Senators during an Estimates spill-over hearing on Wednesday, Australian Security Intelligence Organisation (ASIO) Director-General Mike Burgess was asked about the incident and whether or not his agency has received a briefing on it.
“No, we wouldn’t typically receive a briefing on the outage,” he replied. “But of course, we are charged with looking at threats to security, including potential espionage and foreign interference, so we do pay attention to activities, and we do have an understanding of what happened there.”
He said the incident wasn’t for him to comment on, suggesting senators direct their questions to others.
He did say he was not concerned directly by that outage.
“Of course, it’s a useful time to highlight that espionage, including cyber espionage, is alive and well,” he said. “And there’ll be people who have cracks at networks and mobile devices, but that’s not [just] nation states, that could be criminals or individuals acting alone.
“There’s a range of reasons networks can be disrupted, but it may not be for cyber adversary or criminal means, it could actually be just an action network operators take that cause of disruption.”
Rejecting the characterisation it was an “attack”, Burgess reiterated his position.
“As the director of security, I’m not concerned, by what I’ve seen,” he repeated.
“From my point of view of, ‘is espionage or cyber espionage being occurred?’ I’m not concerned by that incident.
“Of course, in the broad, any network connected to the internet is subject to that frequently and the levels of cyber espionage attempts in this country are pretty high, so I remain concerned about that and through the actions of others, the [Australian Cyber Security Centre] that is dealing with the terms of that outage, I am not concerned.”
Burgess was also asked to provide his opinion on the status of the Department of Parliamentary Services networks.
“We do not concern ourselves with cybersecurity details,” he said.
“We’re more focused on actually the threats coming at this country, including the Department of Parliamentary Services networks, how they do that as a matter for this Parliament and the Department of Parliamentary Services, and in terms of technical advice they receive, they take that from the Australian Signals Directorate’s Cyber Security Centre.”
Burgess said ASIO would approach the department if it had security concerns around espionage, foreign interference, sabotage, or any security concerns that it cares about.
“We would get involved if there was activities occurring, which caused us to choose to investigate, to make sure that a human or some espionage or cyber espionage was occurring or had occurred — we would investigate such matters and we do that in concert with the people we needed to,” he added.
The parliamentary network and Australia’s political parties were not successfully defended during an attack in February 2019.
For eight days, the attacker described as a state actor was able to remain on the network, affecting everyone with an Australian Parliament House email address, including politicians and all of their staff.
