24 April 2024
Mike Burgess, Director-General of Security
Thank you Tom and thanks to the Press Club for hosting us today. It is great to be here.
Let me start by acknowledging the Traditional Custodians of the lands on which we meet, and pay respect to their Elders past, present and emerging.
I'd like to acknowledge the Attorney-General, the Hon Mark Dreyfus KC, Director-General of National Intelligence Andrew Shearer, CEO of the Australian Criminal Intelligence Commission Heather Cook, and Secretary of Attorney-General's Katherine Jones. And also, I've spied the Minister for Police and Emergency Services, Mick Gentleman from the ACT.
Distinguished guests, ladies and gentlemen.
I'd also like to take this opportunity to quickly acknowledge the men and women of the Australian Federal Police and my organisation, the Australian Security Intelligence Organisation, for the tireless, hard work that they do to protect all of us. So thank you team. You're doing a great job.
The internet is a transformative information source… and the world’s most potent incubator of extremism.
The smart phone is a brilliant communication tool… and an all-in-one surveillance device, listening when you’re not on the phone, tracking your movements and recording your browsing.
Social media is a convenient way to connect with family, friends and the world… and a convenient way for scammers, criminals and spies to connect with you.
Encryption protects our privacy and enables our economy… and creates safe spaces for violent extremists to operate, network and recruit.
Depending on who you speak to, at one extreme, artificial intelligence will save humanity… and at the other extreme, it will destroy it.
ASIO’s been protecting Australia and Australians for 75 years.
Over that time, we’ve constantly sought to understand the upsides of new technologies – and the potential downsides.
Terrorists and spies don’t do BAU. They are early adopters and adapters of technology, always looking for ways to exploit vulnerabilities, and we need to stay ahead of them.
Today Reece and I will tease out some of the dynamic tensions between security and technology. We want to ensure individuals and industries are more resistant and resilient targets, and we will ask the tech companies to assist us with our vital mission.
Perhaps the best place to start is the tech de jour – artificial intelligence.
The way I see it, AI is HOT: equal parts Hype, Opportunity and Threat.
‘Hype’ because there’s a yawning chasm between current reality and what’s being claimed by tech-evangelists and marketing gurus. A lot of what they call AI isn’t.
‘Opportunity’ because, stripping away the hype, it’s likely AI will deliver dividends to every part of society, from the economy to health care.
‘Threat’ because the productivity benefits of AI also extend to those who could use it to threaten Australia’s security.
ASIO assesses that artificial intelligence will allow a step change in adversary capability.
We are aware of offshore extremists already asking a commercially available AI program for advice on building weapons and attack planning. If the programs refuse to provide the requested information, the extremists try to bypass the ethical handbrakes.
As I mentioned at the outset, the internet is the most potent incubator of extremism. AI is likely to make radicalisation easier and faster.
We also anticipate artificial intelligence will increase the volume of espionage. Not only will AI improve espionage capabilities, nation states will be more motivated to harvest personal data to assist their own programming and more motivated to steal information about rival AI technologies.
In this year’s Annual Threat Assessment, I talked about a foreign intelligence service grooming Australians on a professional networking platform. The team used a cookie-cutter, one-size-fits-all pitch in its online approaches. AI will likely empower much more bespoke, personalised social engineering.
Adversaries will have a powerful tool to exploit big data sets, enhancing their ability to target vulnerabilities – vulnerabilities in people, vulnerabilities in software, vulnerabilities in critical infrastructure.
AI will facilitate foreign interference by allowing foreign intelligence services to conduct more prolific, more credible and more effective disinformation campaigns.
ASIO is tracking and monitoring all these likelihoods and their implications for Australia’s security.
Of course, the most obvious and possibly best defence against adversary use of AI is AI itself.
I can confirm that ASIO’s been using artificial intelligence for a number of years now.
It is not replacing our people – it is augmenting and assisting them. As one example, the vast amounts of data being produced every day means that finding a critical piece of intelligence is less like looking for a needle in a haystack than looking for a needle in a field of haystacks. AI makes that process easier and faster; it can identify worrying patterns and relationships in minutes and hours rather than weeks and months.
Unlike our adversaries, ASIO’s use of AI is governed by strict ethical controls.
We put humans at the centre of our decision-making. While a process might be data-driven and technology-enabled, it will always be human-led.
AI is a case study in the inherent tension between technology and security. While new technologies can deliver rich dividends, they can also be exploited. As I said earlier, terrorists and spies are early adopters.
We see the same thing with end-to-end encryption.
In recent years, tech companies have significantly expanded and extended their use of encryption. And from what the industry is saying, they plan expanding its use even further.
Encryption is clearly a good thing, a positive for our democracy and our economy. It protects privacy, it enables communications and transactions.
But at the same time it also protects terrorists, spies, saboteurs and the abhorrent criminals Reece will talk about.
Even ASIO’s most unsophisticated targets routinely use secure messaging apps and virtual private networks to avoid detection and hide their activities.
In 2021, I revealed that encryption damages intelligence coverage in 97 per cent of our priority counter-terrorism cases.
The impact is now worse.
It is virtually 100% in our priority counter-terrorism and counter-espionage cases.
There is a very clear and well established legal framework that allows ASIO to seek warrants to access communications. The process is subject to strict safeguards and is overseen for legality and propriety by the Inspector-General of Intelligence and Security, who has powers akin to a Royal Commission.
If the Attorney-General is satisfied that a matter meets a specific security threshold, and our proposed access is sufficiently targeted and proportionate, they can grant a warrant to allow us to lawfully intercept a letter from a suspected terrorist or spy.
Or to lawfully intercept a phone call.
Or to lawfully intercept an email.
But even when the warrant allows us to lawfully intercept an encrypted communication, we cannot actually read it without the assistance of the company that owns and operates the app. The company has to be willing and able to give effect to our warrant.
Today I am asking – urging – the tech companies to work with us to resolve this challenge.
Let me be absolutely clear.
I am not calling for an end to end-to-end encryption.
I am not asking for new laws.
I am not asking for new powers.
I am not asking for more resources.
I am not asking the government to do anything. I am asking the tech companies to do more. I’m asking them to give effect to the existing powers and to uphold existing laws.
Without their help in very limited and strictly controlled circumstances, encryption is unaccountable. In effect, unaccountable encryption is like building a safe room for terrorists and spies, a secure place where they can plot and plan.
Imagine if there was a section of a city where violent extremists could gather with privacy and impunity. Imagine if they used this safe space to discuss terrorism and sabotage, and vilify Muslims, Jews, people of colour and the LGBTQIA+ community. And imagine if the security service and police were stopped from entering that part of town to investigate and respond.
This is not hypothetical. ASIO is investigating a number of Australians who belong to a nationalist and racist extremist network. They use an encrypted chat platform to communicate with offshore extremists, sharing vile propaganda, posting tips about homemade weapons and discussing how to provoke a race war.
The chatroom is encrypted, so ASIO’s ability to investigate is seriously compromised. Obviously, we and our partners will do everything we can to prevent terrorism or sabotage, so we are expending significant resources to monitor the Australians involved. Having lawfully targeted access to extremist communications would be much more effective and efficient. It would give us real time visibility of their activities.
I believe technology should not be above the rule of law. Encryption, the companies implementing it and the individuals using it should be responsible and accountable. Under law, all of us have a right to do many things, up to a point. Privacy is important but not absolute. You lose that privilege if you engage in criminal conduct or threats to our security. In the case of the neo-Nazi chat room – should a nationalist and racist violent extremist’s right to privacy outweigh the community’s right to safety?
In situations where we cannot access communications to resolve security concerns, we must turn to other technical and human capabilities. Some of these capabilities involve physical risk, while others are highly resource intensive, which means we are constrained in the number of threats we can investigate at any one time. Using more overt capabilities also forces us to declare our hand earlier than we would like, tipping off the target and potentially compromising our investigation. And perversely, sometimes unaccountable encryption forces us to use even more invasive powers to investigate a security concern – conducting a physical search of premises for example.
Worse still – we may be faced with having the knowledge of a likely threat, but having no practical way to understand the extent of the concern.
We recently investigated an Australian sharing extremist material online. We suspected he was communicating with overseas ISIL supporters, and feared they were encouraging him to conduct a terrorist attack. But we did not know for sure because he was using encrypted communications.
We used surveillance, human intelligence and other capabilities to determine if the Australian possessed the intent and capability to conduct an attack. The investigation was difficult, dangerous, time-consuming and resource-intensive.
And yes, we eventually learned multiple offshore extremists had encouraged the individual to conduct an act of terrorism.
You might think this case demonstrates we do not need accountable encryption to resolve security concerns but I believe it proves the opposite. If this individual was planning a terrorist attack, quick and targeted access to his communications could have been the difference between life and death.
This is why the gap in ASIO’s ability to lawfully intercept the use of encrypted communications by terrorists and spies is such a concern, particularly in the current security environment.
This is why I am asking the private sector to step up. I’m calling on big tech to establish lawful access solutions that can be applied in very tightly controlled and targeted situations – not to create back doors or systemic weaknesses that break the internet.
If the threat, evidence, safeguards and oversight are strong enough for us to obtain a warrant, then they should be strong enough for the companies to help us give effect to that warrant. To make encryption accountable.
Making encryption accountable would be a natural extension of the role that industry plays in helping Government respond to many other risks on a national level.
Industry partnerships are vital in protecting critical infrastructure.
And industry is stepping up to help better protect the personal data they hold on Australians from being compromised by cyber criminals.
We need them to step up again – and help us protect Australia and Australians from threats to their security. That requires making sure they can offer encryption to their users, while also providing effective and accountable lawful access capabilities.
I started this address by referencing ASIO’s 75th anniversary. The first and second Hope Royal Commissions were key milestones in our history.
Justice Hope concluded that it is the proper role of a security service to deal with special kinds of threats, recognising this requires a security service to exercise investigative methods that may intrude into private lives when justified by the threat.
He did not believe that protecting citizens’ security is inconsistent with protecting citizens’ rights – including their right to privacy. To the contrary, he suggested they are complementary by stating – and I quote – “public safety and individual liberty sustain each other.”
Justice Hope was ahead of his time. ASIO is committed to safeguarding the security of Australians and safeguarding their liberties… protecting from wrongs, while securing their rights.
Our lawful access capabilities help us defend democracy and safeguard sovereignty. They help us detect and defeat threats to life and threats to our way of life.
They help us do what we were founded to do.
Thank you. I look forward to your questions, after Reece's remarks.