How ready is Australia for threats the Australian Signals Directorate sees coming? – Abi Bradshaw

[00:00:00]What's the single biggest gap between the threats the Australian Signals Directorate sees coming in and the public's readiness to deal with them?

[00:00:08]Today, I'm thrilled to be joined by the Director General of the Australian Signals Directorate, Abigail Bradshaw.

[00:00:14]I'm Charles Edel, senior advisor in Australia chair here at CSIS, and this is Pacific Policy Pulse.

[00:00:24]>> [music] >> Director Bradshaw, thanks so much for coming in to CSIS.

[00:00:31]>> No, Charles, it's a pleasure to be here.

[00:00:34]>> So, tell us, what brings you to Washington?

[00:00:36]>> Uh well, love coming to Washington, especially in the heat.

[00:00:38]>> Uh lucky us.

[00:00:40]>> Yeah, it could be a better time.

[00:00:41]Um actually, the backbone of my visit this time round is the Australia-America Leadership Dialogue, um >> [clears throat] >> which was great, especially the panel that we did together. I thought you were awesome at moderating, by the way.

[00:00:54]>> You were awesome at answering the questions.

[00:00:57]>> Uh so, I've been going to the AALD now for about 5 years. It's been going for 34 years.

[00:01:04]Um it's just a terrific place place to meet counterparts um from across industry leaders, political leaders, and the odd uh government official um thrown in as well. I think we were talking about the fact that tech has kind of been a sideline conversation. Um what's terrific um this time round is tech is increasingly becoming actually the central theme >> That's right.

[00:01:31]>> uh and the integrating factor for all of the conversations, particularly as we talk national security. You really can't divide um technology at this point in time. And of course, in terms of people-to-people links, um you know, 4 years ago, I think I was at an AALD in Hawaii and met there uh my now US counterpart, General Josh Rudd.

[00:01:53]So, um and then of course, now he is Director NSA, then he was deputy Indo-Pacom, so it's fantastic place to meet people also.

[00:02:02]>> Yeah, it's great series of meetings.

[00:02:03]>> Yeah.

[00:02:04]>> Uh look, a a little bit more substantively, threats like state-sponsored cyber intrusions, AI-enabled attacks are proliferating, are accelerating, so much so that organizations, let alone individuals, can barely keep up with them these days. Uh from where you sit, what's the biggest gap between what you're seeing and what the public's prepared for?

[00:02:26]>> Yeah, it's a it's a great question. I think um you know, the scale and the persistence at the moment, it's hard to find words to describe that year-on-year in terms of the uptick.

[00:02:39]Um and it's why the Five Eyes Alliance and in in particular the Five Eyes SIGINT Alliance um that joins very much um cybersecurity and SIGINT now um together gives us a real advantage in terms of keeping a global watch on those trends and trying to get ahead.

[00:02:59]Um but I would say that the biggest gap is really it's everything everywhere all at once at the moment.

[00:03:06]Uh uh so it's scale, but it's also speed. Uh you've got a number of of um really sophisticated actors both in the cyber crime space.

[00:03:18]>> Mhm.

[00:03:18]>> [clears throat] >> So we would call them Russian-speaking um Eastern European cybercriminals that are highly organized and professional uh on the one hand, and they have have um done a really great job of commoditizing everything from access brokers, >> Yeah.

[00:03:37]>> which means one thing in real life, right? But an access broker on the dark web is someone whose whose sole role is simply to obtain access to a network and then to sell that on in a really sophisticated supply chain. Uh so so there is that. And then, of course, there are the sophisticated state-based actors.

[00:03:57]Um you know, we see a lot in from the Australian um context, um PRC, um uh Russia, um uh on Australian networks. And I think we really have um the number of attributions which we've made over the last few years has been significant. The diversification of the tech stack >> Yeah.

[00:04:20]>> continues to give us so many different options in terms of um how to obtain access, everything from credentials, so your username and your and your password, um through to sophisticated uh exploits.

[00:04:36]Uh and so, it is um you know, that speed and scale and trying to for from for us from a sort of central perspective to get those um threats, but more importantly, what are the big moves >> Mhm.

[00:04:50]>> um that CEOs can make to communicate those, not just at a tech level, but at sort of a CEO um agency head sort of level, so that those moves can uh can be made. I think what we're really looking at now is focusing on legacy technology, um and particularly things that can't be patched as AI frontier models generate new risks, uh post-quantum um crypt. So, really trying to get people into PQC um before uh 2030, supply chain, um and really increasing visibility. And we're really focusing in on those four big moves, as well as trying to get people as quickly as possible to embed tools from an AI perspective that are going to assist them to counter criminals and state-based actors that will eventually use AI against them.

[00:05:44]>> Yeah, let me stay right on that last one because we were just talking about the threats, the challenges that you see, but I want to flip this and look at the opportunities that AI is presenting. So, when you look at AI and what it's bringing towards Australia, what do you see as the real upsides and the opportunities for Australia in this space?

[00:06:01]>> Yeah. So, I really I have to be an optimist in in in this space because otherwise well, we just wouldn't get out of bed in the mornings and and switch a computer on.

[00:06:12]I think the opportunity in the next 12 to 24 months is really enormous.

[00:06:20]I think no matter what happens, we are going to see massive change in the cyber threat landscape.

[00:06:27]And that is because many of the models at the frontier in particular which are being released at the moment have a particular focus on cyber.

[00:06:37]So, the models we're seeing released are really good at reasoning, planning, and coding.

[00:06:43]And that means they are really good at locating with superhuman speed vulnerabilities which have always been there, but have not been discernable to human effort.

[00:06:55]And if you can locate those vulnerabilities, then you can also code patches.

[00:07:01]And so, you know, for example, I saw um you know, public publications in the last few weeks saying that products um uh uh you know, in one patch can can literally get to tens if not hundreds of vulnerabilities in the in a single patch cycle. So, uh what that means in the future is over the next 12 to 24 months as we see all the patching cycles roll out informed by all that analysis is hopefully we'll end up in a scenario where systems are patched um and really uplifted. And everything from hardware to software um uh has has really been hardened. And so the the mad race for patching that we see at the moment well hopefully that will be a a thing of the past.

[00:07:56]The one butt to that >> Yeah.

[00:07:59]>> is is the possibility that we have we have private entities that are super important and have a range of interdependencies that perhaps we miss or we don't get to. And that's why that public partnership is is so important.

[00:08:14]It's so important that we get out and we encourage the use of these AI tools so that it can be a rising tide that lifts all boats.

[00:08:25]>> Yeah, really interesting. I mean both more secure perspective from where we might be in 18 to 24 months but only if we make sure that as many companies get them as possible to make sure that they're protected as well.

[00:08:36]>> Okay, now the really important question.

[00:08:39]>> Okay.

[00:08:39]>> I know that you are a incredible reader because you've given me like many homework assignments over the years.

[00:08:46]Great reading list. What are you reading right now?

[00:08:49]>> Right. And you are an incredible reader as well because as fast as I can give you the titles you get through them. Um >> Lots of plane flights Abby.

[00:08:57]>> [laughter] >> So I am reading anything on AI except not big books and that is because AI is moving way too fast for me. Maybe maybe you could get through the big books not me. So here's a few tips. Stop the world which is actually an ABC podcast. That's pretty good.

[00:09:19]Nvidia Nvidia have a podcast on AI.

[00:09:24]That's pretty good as well. Most of the labs will have a blog. And and they're they're pretty good to follow as well. I mean this stuff is just turning around so so quickly.

[00:09:34]Full stack spies of course I'm that. Um, my favorite topic, the intersection of cyber espionage and statecraft. And here's another Australian writer for you. I am reading a book called The Good Wife of Bath.

[00:09:48]Which is a retelling of The Canterbury Tales. And um, and a different take on the the women of Canterbury. So, that that's another interest of mine for another podcast.

[00:09:59]>> Uh, pretty good uh, mixture there. But, thanks so much for joining us Director General of ASIO, Mike Burgess. And thanks everyone for tuning in for another episode of Pacific Policy Pulse.

[00:10:13]>> [music]