Australia’s spy boss says authoritarian nations ready to commit ‘high-impact sabotage’
- Reference: 1762910244
- News link: https://www.theregister.co.uk/2025/11/12/asio_cyber_sabotage_warnings/
- Source link:
In a speech delivered today, Director-General of Security Mike Burgess referred to recent telecoms outages in Australia, one of which is thought to have contributed to [1]three deaths .
I do not think we truly appreciate how disruptive, how devastating, this could be
“That’s one phone network not working for less than one day,” he said. “Imagine the implications if a nation state took down all the networks? Or turned off the power during a heatwave? Or polluted our drinking water? Or crippled our financial system?”
Burgess said those scenarios “are not hypotheticals,” adding “foreign governments have elite teams investigating these possibilities right now.” Some of those governments, he said, have previously had an intent “to commit espionage and foreign interference – to steal and meddle.”
He warned some are now “more likely to pull the trigger on the higher-harm activities.”
[2]
“We expect sabotage, particularly cyber-enabled sabotage, to pose an increasing threat in the next five years – both in terms of adversary capability and adversary intent,” Burgess said, adding that “advances in technology – including artificial intelligence – and a proliferation of capabilities for sale or hire online are making it easier for regimes to obtain the tools and weapons they need to conduct sabotage.”
[3]
[4]
The intelligence boss said ASIO therefore “expects a complex, challenging and changing security environment will become more dynamic, more diverse, and more degraded.”
“Dynamic, because Australia has never faced so many threats… at scale… at once. Diverse, because threats are intersecting and boundaries are blurring. Foreign spies are increasingly using criminal cut-outs to do their dirty work.
[5]
“And degraded, because of the depths authoritarian regimes are more willing to go to. They are behaving more aggressively, more recklessly, more dangerously. More willing to engage in what we call ‘high harm’ activities.”
Burgess mentioned the Salt Typhoon and Volt Typhoon hacking groups to illustrate his points.
“I know many people are confounded by the silly nicknames – so let me decode these further,” he said. “These groups are hackers working for Chinese Government intelligence and their military.”
[6]
The ASIO boss said Salt Typhoon’s intent was espionage, and that the group “have been probing our telecommunication networks here in Australia too.”
“In contrast, Volt Typhoon’s intent was disruptive.
“The hackers compromised American critical infrastructure networks to pre-position for potential sabotage. The penetrations gave China the ability to turn off telecommunications and other critical infrastructure.”
Burgess said ASIO has “seen Chinese hackers probing our critical infrastructure as well. And once access is gained – the network is penetrated – what happens next is a matter of intent not capability.”
“I do not think we – and I mean all of us – truly appreciate how disruptive, how devastating, this could be,” he said.
[7]Top spy says LinkedIn profiles that list defense work 'recklessly invite attention of foreign intelligence services'
[8]Australia’s spies and cops want ‘accountable encryption’ - aka access to backdoors
[9]Swipe left: Snoops use dating apps to hook sources, says Australian Five Eyes boss
[10]Australia to build six 'cyber shields' to defend its shores
Business is botching it
Burgess delivered his remarks at the annual conference staged by Australia’s Securities and Investments Commission, the nation’s financial regulator, and therefore discussed how organisations should act given the heightened threats.
“As a rule, an effective defence against potential espionage and sabotage shares a lot of DNA with an effective defence against other foreseeable corporate challenges – like criminal theft, fraud, workplace accidents and equipment failures,” he said, before asking two questions.
“So why are boards and leadership teams surprised when they are faced with an outage or compromise? And why do they struggle?”
You can’t PowerPoint your way out of this risk
Burgess suggested a combination of complacency and poor governance is to blame.
“Almost every security incident involves a known problem with a known fix and/or a manager who is shocked but not surprised,” he told the event.
“If these threats are foreseeable, and our vulnerabilities are knowable, what are we doing to manage this risk – both at the operational and governance level?” he added, before advising “Boards need to be curious and discerning about the information provided to them. You can’t PowerPoint your way out of this risk. Don’t let management do that to you.”
He recommended leaders develop an understanding of the data, systems, services and people that are particularly important to an organization and its customers, plus their at-risk data, systems, services and people.
“Where are things stored? Who has access? How well are they protected?” he asked. “Once you understand all that, manage the risk in a coherent and connected way. Look across your whole enterprise, recognising that good security is a connected web, not silos of excellence with chasms in between.”
Burgess said those efforts are not optional.
“I cannot be clearer, if the risks are foreseeable and the vulnerabilities are knowable, there is no excuse for not taking all reasonable steps,” he said. “Complexity is not an excuse; it must be dealt with.” ®
Get our [11]Tech Resources
[1] https://www.theregister.com/2025/09/21/optus_emergency_call_incident/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aRQUaFPaq_zTlTfekcw_OwAAAAY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aRQUaFPaq_zTlTfekcw_OwAAAAY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aRQUaFPaq_zTlTfekcw_OwAAAAY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aRQUaFPaq_zTlTfekcw_OwAAAAY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aRQUaFPaq_zTlTfekcw_OwAAAAY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/08/01/asio_espionage_social_media_warning/
[8] https://www.theregister.com/2024/04/25/asio_afp_accountable_encryption/
[9] https://www.theregister.com/2022/02/10/spies_using_dating_apps/
[10] https://www.theregister.com/2023/09/19/australia_six_cyber_shields/
[11] https://whitepapers.theregister.com/
So all the more reason...
...to get off US kit ASAP then
Re: So all the more reason...
The elephant in the room, on multiple levels
Re: So all the more reason...
Not so much critical USA kit, but energy systems are the real issue, especially in AU where so much of the generation is now solar/battery.
Almost all invertors and batteries use and expect an internet connection to a foreign data collection, configuration, and firmware update server.
They are all software controlled. Many have no way to be connected and brought to life without the internet, even if you have a stockpile of new boxed units.
All invertors can be irreparably destroyed by malicious firmware update,
Manufacturer integrated battery units like Tesla and Sigenergy, can probably have the battery set on fire by firmware update.
Where a street has a significant number of the same invertors, you can burn out other consumer electronics (chargers, internet, induction hobs, car chargers), and simple electric motors
You can force branch disconnects at the street transformer level.
You can overheat and damage distribution equipment.
And almost nothing that can be done to defend against it now so much gear is installed.
A major brand stops working after a period without phoning home, ensuring you must let it connect to firmware updates.
Re: So all the more reason...
> A major brand stops working after a period without phoning home, ensuring you must let it connect to firmware updates.
You're AC, so why not name names?
while addressing greedy stooges
until the PHB brigade become personally financially liable for cost cutting on coal face crew numbers, relying on lowest cost outsorcering (sic) nothing will change. As for the spooks, funding has been increasing since the disastrous Howard years. Got to have staff to arrest grannies and grumpy old sods posting memes about groups above criticism. Same behaviour as NSW pollies pretending the peaceful "neoNazi" protest in Sydney was not a false flag operation. Also done to insinuate more intrusive snooping which seems strangely ineffective at stopping gang warfare and murders.
Anon to increase time before door in kicked down
In fact, the Australian spy boss is a shill for the USA and their spy organisations.
Pretty much just spruiking ASIO to get more funds from the government, and build his empire, while trying to scare the public to put pressure on the pollies to do it.