Australian Signals Directorate head Rachel Noble has asserted that the foreign cyber-intelligence agency cannot conduct mass surveillance on Australians, in response to concerns over the entity’s powers.
In an address to the Australian National University’s National Security College on Tuesday, Noble argued that the ASD’s role has been “laid bare on the face of legislation” for more than 20 years, and made the case for its “very intrusive” powers.
“Transparency is not a new feature of our story. Some people may have just forgotten what has already been said over many years. And I’m sorry if this is news to you, but not all Australians are the good guys,” she said.
“Some Australians are agents of a foreign power. Some Australians are terrorists. Some Australians take up weapons and point them at us and our military. Some Australians are spies who are cultivated by foreign powers and are not on our side.”
Since the Intelligence Services Bill was passed in 2001, the ASD has been permitted — with ministerial authorisation — to collect information on Australian criminals based overseas, and to assist federal and state authorities with issues concerning the “security and integrity of information and in relation to cryptography and communications technologies”.
However, Noble maintained that the agency “cannot, under law, conduct mass surveillance on Australians”.
In March, the director-general confirmed that while the ASD was not permitted to produce intelligence on Australians, it had done so in the previous 12 months because of “rare circumstances”, under the authority of a ministerial authorisation.
Politicians have final say on bolstering spy powers
In regards to expanding the ASD’s powers, Noble said agencies “must [have] and do have carefully considered conversations about how to manage contemporary threats, including whether the management of such threats might ultimately involve legislative change”.
“And after doing so, agencies will provide advice to government about their options.”
However, she noted that politicians — not public servants — have the final say on how to approach new risks.
The government has been considering allowing the ASD to spy on criminals based in Australia for years. While the new 2020 Cyber Security Strategy has not directly confirmed that the ASD would be permitted to do so, it said that the government would “ensure law enforcement agencies have appropriate legislative powers and technical capabilities to deter, disrupt and defeat the criminal exploitation of anonymising technology and the dark web”.
The strategy also argued that law enforcement agencies across Australia would need to work together to fight criminals.
Home affairs minister Peter Dutton recently stated that the Australian Federal Police would be able to utilise the ASD’s capabilities to disrupt serious criminal activity.
His department also recently proposed new national security laws which would allow agencies to “take direct action to protect a critical infrastructure entity or system in the national interest” if an immediate and serious cyber threat to Australia’s economy, security or sovereignty was detected. Like the cyber security, the proposal didn’t name agencies directly.
During question time, Noble touched on the cyber security strategy, the ASD’s “great relationship” with Home Affairs, and the “struggle” that some people have with separating policy from operations in regards to the two entities’ functions.
“So the first point I’d say is it’s the Department of Home Affairs’ job to set out the best cyber security policy for the country. And of course we engaged very closely with them in the development of that, and they have, through the government, expressed that in the recently announced Cyber Security Strategy 2020, which actually does set out the intent of many government departments but importantly including ASD as the government’s tech agency or main operational agency in this regard,” she said.
“So setting out that strategy, that’s really their job. And sure, we’ll absolutely help to explain it to people but we operationalise that and try to turn that into real activity where we will increasingly improve our understanding about the cyber threats posed to Australia and increase our ability to share that threat intelligence information with anyone in Australia who needs to know it and needs to take action in response to it.
“And we have been funded by the government to develop the capability to do that at machine speed, and that’s the way that we will really uplift Australia’s defences against many cyber actors that are out there.”
ASD ‘rethinking’ how it employs people
Noble said the ASD’s “edge” was its people, not its technology, and valuing diversity was an important part of employing staff.
“One of our most extraordinary cyber offensive operators didn’t finish year 12 and was a hairdresser. We are open to every kind of person with any background and it’s the imagination that makes the difference,” she said.
“Whilst people with tech skills are of course highly valuable to us … we equally have people with different languages of course, arts degrees, meteorologists like myself, all sorts of backgrounds and I think part of me coming out and talking about the organisation is actually to help people understand what we do and the sort of skills we’re looking for.”
She admitted that she disliked her first ASD role as a code breaker in the late 1980s.
“I didn’t like that job at all. I’ll tell you about that in a different speech, and about what we hope we’ve learned from how we have historically failed to engage women in STEM,” she said.
“Here’s my spoiler alert: don’t starve them of human contact and make them sit alone with a computer all day.”
When Noble got her first job at the ASD, it took nine months before she received a clearance and was actually able to move to Canberra to start in the position. She noted that agency has been trying to “rethink and recreate” itself so that not everyone working at the ASD would need a top secret clearance.
“We’re now restyling ourselves as a multi-classification employer. We have buildings where people can join our workforce with only a protected clearance or a secret clearance and of course a top secret clearance. So we’re now much better postured to manage that and that also helps us an employer get people in the door. That delay used to be a really big problem for us,” she said.
“So those days are gone for us, we’re really rethinking how we employ people and how quickly we can get them to join our organisation.”
Noble said the ASD has also been partnering with Australian industry and the private sector to increase understanding of their perspectives and concerns, and has encouraged staff to be seconded to these companies.