iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Sarah Sloan, head of government affairs and public policy in Australia and New Zealand for Palo Alto Networks, has called for greater checks and balances on certain powers in the government’s proposed Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022.
The bill, in its current form, is intended to provide an enhanced regulatory framework designed to uplift security and resilience across Australia’s critical infrastructure assets.
In the words of the bill’s explanatory memorandum, the framework, when combined with better identification and sharing of threats, will ensure that Australia’s critical infrastructure assets are more resilient and secure.
However, Sloan, who appeared to give evidence at a public hearing of the government committee tasked with reviewing the bill on 16 March, has cautioned that some of the measures outlined in the proposed legislation could adversely impact the nation’s critical infrastructure operators.
When speaking about the software powers, Sloan also noted her concern that “there is no independent review process articulated in the bill”, which she believes is contrary to some of the approaches taken in like-minded jurisdictions, which ordinarily would see the granting of a warranty or similar process in order to execute on that power.
Specifically, Sloan called for stronger checks and balances on powers for issuing “System Information Reporting Notices” and recommended the removal of the bill’s software installation power, which would see the government able to deploy third-party software on private entities’ IT systems.
Sloan further explained that “perhaps the most important point is that the provision potentially creates an international precedent, if adopted by other global and regional actors, impacting Australia’s interests and values”.
“As the committee knows, we are in a period of geo-strategic competition that is inherently linked to issues of technology and values, such as the separation of powers, rule of law – including checks and balances on the execution of government power.
“While we understand and appreciate the relevance of system information in detecting and responding to cyber incidents and threats, we would recommend stronger checks and balances on the powers granted by the bill to issue system information reporting notices (both ‘system information periodic reporting’ and ‘system information event-based reporting’),” Sloan said in her opening statement.
“This will ensure that these notices are clear, proportionate, transparent and meet the government’s needs without unduly burdening industry.”
Sloan encouraged the committee to reconsider the maximum time frame – currently at 12 months under the bill – for which a system information periodic reporting notice, or a system information event-based reporting notice, can be enforced.
She also recommended notices be regularly reviewed to see if these are still necessary, proportionate and reasonable, and called for additional detail on the collection of data to be provided to companies likely to be impacted by the legislation, along with other measures to ensure industry is not unduly burdened by the proposed laws.
Additionally, Sloan called for the removal of provisions in the bill that would give the government the ability to install system information software on infrastructure it believed the respective “System of National Significance” (SoNS) entity would not technically be capable of otherwise provisioning itself.
“The installation of what constitutes third-party software has the potential to create vulnerabilities that could adversely impact the security of a SoNS entity as well as, by default, the government’s systems and client systems.” Sloan told the parliamentary joint committee on intelligence and security (PJCIS).
“Entities would need to review this software prior to putting it on their networks and this could take considerable time and effort.”
"It is also unclear who would be responsible for ongoing product support and maintenance – including vulnerability management and patching. Finally, we note that this could expose the Government to liability for any adverse impacts arising from the installation of this software," Sloan concluded.
[Related: CISA, FBI issue advisory against Russian state-sponsored cyber actors]
Nastasha is a Journalist at Momentum Media, she reports extensively across veterans affairs, cyber security and geopolitics in the Indo-Pacific. She is a co-author of a book titled The Stories Women Journalists Tell, published by Penguin Random House. Previously, she was a Content Producer at Verizon Media, a Digital Producer for Yahoo! and Channel 7, a Digital Journalist at Sky News Australia, as well as a Website Manager and Digital Producer at SBS Australia. Nastasha started her career in media as a Video Producer and Digital News Presenter at News Corp Australia.
Be the first to hear the latest developments in the cyber industry.
