National cyber security strategy under-resourced

article-body

Despite improvements across some measures, the federal government’s implementation of its cyber security strategy has been undermined by a lack of coordination, under-resourcing and problems with the design of the agenda, a review by the Australian Strategic Policy Institute has found.

The strategy has seen “significant encouraging progress” in some areas of cyber security since it was launched, such as in collaboration between the public and private sectors to identify threats and the development of the digital economy, says the report.

The one-year-old strategy released in April last year was the first since 2009, a gap which had left departments making changes to the country’s cyber security arrangements without an up-to-date plan to guide priorities. It includes 33 initiatives and is divided into five major themes: strong cyber defences, global responsibility and influence, growth and innovation, a cyber smart nation, and a national cyber partnership.

The energy behind the strategy has meant cyber issues have garnered higher levels of interest and transparency in the past year, the think tank notes. Cyber security special adviser to the Prime Minister Alastair MacGibbon’s active engagement with media “has helped make cybersecurity a front-page issue”, while Minister Assisting the Prime Minister for Cyber Security Dan Tehan has put in lots of work raising awareness about the national partnership between the private and government sectors, an important element of the strategy given the multi-stakeholder nature of the internet.

But progress towards a national partnership “has been undermined by the ad hoc nature of government’s communications and insufficient expectation management with industry partners”, says ASPI.

It suffers from a lack of ministerial focus, as Tehan must balance his cyber security responsibilities with other portfolio areas including veterans, Anzac and defence personnel. Achieving the significant body of work the government has committed to will likely require either a dedicated minister or removing some of these outside obligations, the report argues.

Vague goals, inadequate resourcing hamper progress

Yet the problem goes deeper than just un-coordinated implementation. The very design of the strategy “has been an obstacle to its implementation,” it found.

Part of the problem lies with the vagueness of some of the strategy’s goals. Some outcomes “are not quantifiable, so confidently measuring success is impossible”, ASPI notes. Other outcomes that are practically measurable are framed in terms of a relative change, but lack the baseline information necessary to measure progress. This is made worse by the first annual progress report focusing on actions undertaken, rather than outcomes achieved.

There’s also no clear timeline to assess progress against, despite Tehan’s promise to make “implementation ahead of time” a priority. Publishing a timeline of planned actions and measurable milestones would improve implementation and give greater transparency for both private sector partners and the public.

The national significance of the task at hand is not matched by resourcing, with “precious few” people working on it. The strategy was allocated a funding package of $230 million over four years, but neither the Department of Prime Minister and Cabinet and the Department of Foreign Affairs and Trade were given extra funding to deliver their responsibilities for it.

A coherent and comprehensive narrative on implementation success has also yet to be developed because the government has not yet come up with a communications strategy, the report argues. “This is not surprising, given that the human and financial resources afforded to the Department of the Prime Minister and Cabinet are simply not commensurate with the size and importance of the task.”

When the funding has been compared to the size of the project, “questions have been raised as to whether it’s enough to support the strategy’s ambitions,” notes ASPI.

Notwithstanding these problems, the think tank is confident things are heading in the right direction.

“That said, the confluence of leadership focus, the media spotlight and a mutual desire for public–private partnership means that the scene is set for Australia to learn from these implementation lessons and collectively move forward, committed to building on the successes of the past year.”