Inquiry calls for 'cyber czar', compulsory anti-virus

Government could require anti-virus on internet-enabled machines.

A parliamentary inquiry into cybercrime has recommended the Government appoint a Cyber Security Coordinator to lead whole-of-Government activities.

In a report presented to the Federal House of Representatives yesterday, the Standing Committee on Communications highlighted a need to consolidate Australian security efforts.

The Committee called for the establishment of an 'Office of Online Security', which would be located in the Department of Prime Minister and Cabinet and headed by the Cyber Security Coordinator.

Working with State and Territory governments, regulators, departments, industry and consumers, the Office would be tasked with bringing together the current "plethora" of Government organisations responsible for tackling cyber crime.

Federal, State and Territory police, the Attorney-General's Department, Australian Communications and Media Authority (ACMA), Australian Privacy Commissioner and Department of Broadband, Communications and the Digital Economy (DBCDE) were among the "plethora" named in the report.

"This highly decentralised approach was regarded by some as an impediment to a nationally coordinated and strategic response to tackling the problem of cyber crime," the Committee wrote.

"A more centralised and genuinely national approach is required to ensure that strategic responses to cyber crime that impact on the broader Australian society are as effective as possible."

The Committee considered advice from Microsoft and the Australian Communications Consumer Action Network (ACCAN) in its Recommendation 3, which called for a Cyber Security Coordinator.

In its submission to the inquiry, Microsoft Australia recommended that Australia consider the US model of a "cyber security czar" within the White House.

ACCAN highlighted the UK Office of Cyber Security in its call for an Australian Office of Online Security to be established within the DBCDE, reporting at Cabinet level and "setting benchmarks for basic pre-installed security features to be provided with the purchase of all computers".

Mandatory anti-virus

The Committee tackled software installation in a separate recommendation to "protect the integrity of the internet".

Under Recommendation 14, the committee called for the current, voluntary e-security code of practice to be extended and registered under the Telecommunications Act 1997.

A Committee spokesperson confirmed that registration under the Act would make it mandatory for ISPs to comply with the code.

The Committee claimed that the current code "sets the bar too low" in its requirements that ISPs notify their subscribers of potential malware infections.

It moved to require ISPs establish contractual obligations that force subscribers to install anti-virus software and firewalls before the internet connection is established, and endeavour to keep this software up to date.

"While many ISPs do provide e-security products, the code itself does not, for example, promote the use of anti-virus software at the point of connection to the Internet or other security advice or software services," the Committee wrote.

"This is a missed opportunity that could provide some benefits to ISPs and make a real contribution to promoting a culture of e-security."

Committee member and Shadow Communications Minister Tony Smith argued against part of the recommendation in his supplementary remarks, attached to the report.

"To dramatically and quickly institute a requirement that ISPs contractually require the subscriber to install anti-virus software and firewalls before connecting to the internet ... opens up a plethora of new liability issues for subscribers," he wrote.

Internet Industry Association (IIA) chief Peter Coroneos provided the Committee with information about the current code of practice, which the IIA developed.

He questioned if the recommended ISP-subscriber obligations would be practical in an interview published in the Sydney Morning Herald today.

"For a start there's a jurisdictional question here. You can't dictate to ISPs what ought to go in their contracts," he told Herald journalists.

"We've put forward what we consider to be workable guidelines for the industry. There's always a balance between the ideal and the practical."

The Committee was chaired by Labor MP Belinda Neal and considered submissions from the Office of the Privacy Commissioner, Interpol, Google, Symantec, Telstra, Sophos and the DBCDE.