Liberal Senator James Paterson has called on the Australian government to establish mechanisms for the private sector. This mechanism must encourage private sector information sharing during cyber attack investigations. Speaking at the Australian Cyber Conference 2023, Paterson noted the government’s role in the Optus and Medibank incident response. He emphasized the need for trust. Moreover, psychological safety prevents companies from withholding critical information.
Federal government ministers strongly criticized Optus after the company disclosed its data breach last year.Paterson said.“In the wake of the Optus attack, I met with a number of CISOs.”I heard loud and clear that you were alarmed by the government’s public attacks on Optus in the midst of the crisis,”
“He adds, “Many of you told me that it raised doubts in your mind about whether sharing information with the government about an evolving cyber crisis was safe or in the best interests of your company. You feared it might be used against you while you were busy trying to put out the fire.”
Rather than contacting the Australian Cyber Security Centre (ACSC) as the first option, the private sector would call lawyers instead.
A lawyer informed Paterson that they could not guarantee their clients that sharing information with the government about a cyber attack posed no legal risks.The issue of cooperation with authorities regarding cyber attacks predates the Optus incident, with Toll Group previously criticized, albeit indirectly, over its level of cooperation with authorities following a high-profile ransomware attack in 2020.
Seamless information sharing between the two parties
Senator Paterson called for a closer partnership between the private sector and the government in addressing cybersecurity concerns. He stressed the importance of seamless information sharing between the two parties during a cyber attack. To achieve this, he proposed a safe harbour mechanism that would protect and keep information confidential. Paterson emphasized that the proposed mechanism should not absolve companies of accountability for mishandling of customer data.
Paterson also emphasized the importance of providing credible information to affected customers and the public during an incident. He suggested that the government should consider appointing an authoritative voice to educate the public about cyber security risks. He said, “Information is not only important for incident response but also for keeping customers and the public informed during an incident with credible information.”
