Australia’s Hack-Back Plan Against Cyberattackers Raises Familiar Concerns

The Australian government’s defiant proclamation recently that it would hack back against hackers that sought to target organizations in the country represents a break from the usual cautious manner in which nations have approached international cyber threats.

How effective the country’s newly announced “joint standing operation against cybercriminal syndicates” will be remains an open question, as does the issue of whether other nations will follow suit. Also unclear is how far exactly law enforcement is willing to go to neutralize infrastructure that it perceives as being used in cyberattacks against Australian entities.

Pressure for Hack-Back Legislation May Be Mounting

“As it becomes more obvious that the majority of organizations are poorly prepared to defend themselves, I think it is justifiable for well-resourced governments to step in,” says Richard Stiennon, chief research analyst at IT-Harvest. “I fully expect hack-back legislation to pass in response to some devastating attack that is visible to lots of voters. But I do not expect it to have teeth or change the landscape much.”

Australian prime minister Anthony Albanese’s government on Nov. 12 announced a joint initiative between the Australian Federal Police and the Australian Signals Directorate to “investigate, target and disrupt cybercriminal syndicates with a priority on ransomware threat groups.”

The government launched the initiative following two major cyberattacks — one on telecommunications company Optus and the other on health insurer Medibank — that together exposed personally identifiable information (PII) and other sensitive information belonging to more than one-third of Australia’s total population of some 26 million people.

The cyberattacks were among the largest in scope in the country’s history and sparked considerable outrage and concern, especially after attackers began publicly leaking medical records (including abortion records) following Medibank’s refusal to pay a demanded $10 million ransom. Some security researchers have pinned the blame for the ransomware attack on Medibank on Russia’s notorious REvil threat group.

The Australian counter-hacking operation will prioritize cyber threats…