Security intelligence: countering espionage in the 21st century
ASIO has warned that espionage, including the area of IT and information security is alive and well in the new millennium. National Affairs Editor Ernie Davitt has the story.
The head of ASIO, Paul O'Sullivan has told government and business leaders they needed to manage risks and focus on potentially vulnerable areas to ensure the availability and confidentiality of official information was not compromised.
Priority areas included:
* protective security measures securing the work environment
* information technology systems
* partnerships with the non-government sector
* people management policy and procedures.
Suitable measures needed to be carefully considered, implemented, and tested regularly for their effectiveness Mr O'Sullivan said.
Addressing the Defence Industry Conference in Adelaide late last year, he urged organisations to appoint a full-time, professional security officer, if they didn't already have one.
Risk management plans needed to address, for instance, the physical integrity of, and access to premises; the internal security of work areas; and appropriate protocols for the classification, registration and removal of sensitive information and materials.
He said that while much of Australia's national security effort had focused on terrorism since 9/11, those working in the defence industry needed to remain mindful of other threats to national security, including espionage.
The definition of security included the protection of the Commonwealth, and its people, from "espionage" and "foreign interference".
Era of post 9/11 terrorism
In the era of post-9/11 terrorism, he said, it had never been ASIO's judgment that espionage had ceased as a threat to national security; “or, for that matter, that it would not continue to evolve and place demands on our efforts."
“Indeed, in the early twenty-first century, ASIO's counter-espionage role continues to represent a serious and challenging responsibility,” Mr O'Sullivan said.
“We have boosted the level of resources devoted to this function, and plan to further build capability through to 2010-11.”
Serious geopolitical uncertainties and instabilities - shifting power balances; existing and emerging strategic rivalries; and volatilities driven by military, political and economic competition - would continue to shape our national security outlook, he said.
While it was logical to infer from this situation that States had an interest in knowing one another's intentions and capability; it was a different proposition to say that:
* such an interest necessarily will take the form of espionage
* State-driven espionage is the only form this threat to national security can take.
Mr O'Sullivan said it was often a challenge to discern the line between legitimate and illegitimate foreign collection activities.
Information revolution
The information revolution was changing the environment in which security intelligence agencies now worked, and conducted business.
Globalisation was exposing States, industries, businesses, and, indeed, whole peoples to competitive forces.
“In this environment, private businesses are susceptible to espionage activities targeting sensitive commercial information,” he warned.
“And as the incentives to undertake espionage activities continue to evolve, so too do the types of actor prepared to undertake them.
“Non-state actors - individuals, businesses, front companies, networks, terrorist groups - may seek to gain access to sensitive information via a variety of more or less sophisticated avenues.
“They may or may not be working with States. Or, in a sellers' market, they may work indifferently with any particular State.”
He said risks were not simply changing; they were compounding and included possible compromise associated with the digital environment.
“The security of IT systems is critical, both from external attack, and from internal misuse,” the ASIO chief said.
Risks from electronic devices
He warned of risks from an array of increasingly sophisticated electronic devices that have become part of the everyday environment, including:
* mobile phones and digital entertainment devices (MP3 players, etc) with significant image
* sound recording capability
* digital thumb drives
* computers
* hand-held personal organisers with functions so complex as to require user manuals of encyclopaedic proportions.
“Yet razor-wire perimeter fences, security guards, the handling of classified materials, and the screening of electronic devices, only go so far,” he said.
“The effective management of security risk calls for a combination of measures, particularly good staff vetting procedures and effective people management systems.
“In today's competitive labour market, it is important to maintain high standards, and, where positions will involve access to classified information, to carry out vetting processes consonant with the proposed level of access.
“This applies, too, to the burgeoning world of contract work, and the use of public-private partnerships - an area with which Defence has had considerable experience.
“More people are working under the national security tent, and it is important to know who they are, where they come from, and what, if any, are their potential vulnerabilities.”
About the author: Ernie Davitt is the National Affairs Editor for Australian Security Magazine.