Shutterstock/AAP/The ConversartionWhen Prime Minister Scott Morrison announced this week that a “sophisticated state actor” had targeted the big Australian political parties in a major cyber attack, the revelation threw up more questions than answers. Who did it and how? What data did they get their hands on? How vulnerable is our data – and our democracy? Read more: We’ve been hacked – so will the data be weaponised to influence election 2019? Here’s what to look for To make sense of it all, we’re hearing today from Nigel Phair, the director of UNSW Canberra Cyber and an expert on the intersection of crime, technology and society. He said that while hacks like these should be seen as “the new normal” there was good reason to be concerned. “Just merely having a breach is quite a big deal. Secondly, you look at the information that they hold. Political parties have information on donors – who they are and how much they give and what they want for it. They have information on the electorate, they have information on their own party politics and tactics for Senate Estimates for Question Time, those sorts of things,” he said. “So that’s a lot of rich data that you could then use as a nation state to infiltrate other areas to perhaps change voter outcomes.” The hackers may have used social engineering techniques such as phishing to gain access to the data, he said. “They are quite unsophisticated attacks. It’s often spoofing an organisation or a person and getting someone, an end user, to reveal login credentials. And because we share passwords across multiple logins, that’s how you gain access to a trophy asset,” he said, adding that the hack served as a reminder to use a password manager and ensure all passwords are long and strong. “I think we should be very concerned. We’ve got a great case study from the US. We’re very allied to the US and when you look at how nation states have disrupted that election I think it’s a given that there are many out there that’ll disrupt ours.” You can read an edited transcript of the interview below. Read more: A state actor has targeted Australian political parties – but that shouldn’t surprise us New to podcasts? Podcasts are often best enjoyed using a podcast app. All iPhones come with the Apple Podcasts app already installed, or you may want to listen and subscribe on another app such as Pocket Casts (click here to listen to Trust Me, I’m An Expert on Pocket Casts). You can also hear us on Stitcher, Spotify or any of the apps below. Just pick a service from one of those listed below and click on the icon to find Trust Me, I’m An Expert. Additional audio editing by Wes Mountain, production assistance from Bageshri Savyasachi. Additional audio Kindergarten by Unkle Ho, from Elefant Traks ABC news report Image: AAP (Various)/Shutterstock/The Conversation Transcript SUNANDA CREAGH: And so what’s the main concern? Why was everybody so worried about this, particularly earlier this week? NIGEL PHAIR: I think when you look at the history with the attack in the US on the DNC (Democratic National Committee), and a lot that’s been reported in the US about nation states trying to infiltrate the election process over there and change people’s voting habits and we’re some weeks/months from an election here – it strikes at the heart of what could be our dear beloved democracy, when you have nation state actors trying to influence voting outcomes. SUNANDA CREAGH: And what do you think this week’s events tell us about the cyber security weaknesses here in Australia? NIGEL PHAIR: It tells us that no organisation is immune. It tells us that cyber is another vector for people trying to win the hearts and minds of people. SUNANDA CREAGH: If I was a sophisticated nation state using this as a strategy to achieve that goal, how might this sort of hack help me achieve that goal? What do you think they were actually trying to do here? NIGEL PHAIR: There’s a number of things that they’ve achieved. Firstly, is the goal of doing the hack. When we look at parliament house, we look at the political parties, when we think about it, they’re revered from a democratic perspective. Just merely having a breach is quite a big deal. Secondly, you look at the information that they hold. Political parties have information on donors – who they are and how much they give and what they want for it. They have information on the electorate, they have information on their own party politics and tactics for Senate Estimates for Question Time, those sorts of things. So a lot of rich data that you could then use as a nation state to infiltrate other areas to perhaps change voter outcomes. SUNANDA CREAGH: China has strongly denied that it was involved but a lot of speculation has focused on that country, as opposed to Russia or another state actor that’s been linked to this kind of behaviour in other contexts. In Australia, why do you think speculation has focused on China as a potential perpetrator? NIGEL PHAIR: Basically because they’re a near neighbour to ours, they’re in our arc of instability. They’re well known for their theft of intellectual property online. They’re well known for not adhering to the international norms of cyberspace. Add that all up and that’s why people keep pointing the finger at them. SUNANDA CREAGH: And I believe there’s news reports that China was linked to other previous hacks of universities and parliament and other key pieces of computer infrastructure around Australia. Is that right? NIGEL PHAIR: That’s right. They’ve been well known to do a range of cyber attacks on a range of different organisations – government, non-government, commercial etc. SUNANDA CREAGH: So in the context of concerns that Australians have about the government’s capacity to keep our personal information safe – and I’m thinking here about the talk around My Health Record, the census – what does this hack tell us, if anything, about how capable the government and people in power are at guarding our private details? NIGEL PHAIR: I think we need to go back a couple of steps before we start to think about this. Government, what they haven’t done is take the citizenry of Australia on a journey. They haven’t explained to them what it means to participate in a digital economy. What it means to be a good online citizen and transact with government and social media, commercially, e-commerce. If we had that narrative from the outset then people could understand that the internet is just another public place where they act ethically and lawfully and responsibly to what they do in the real world, then I think we wouldn’t be having this discussion. Because people would be able to have an informed decision about what it means to participate with My Health Record, or participate in an online census or other government instruments. But at the moment we just never had that background and people don’t have the certainty and because of that they make knee-jerk reactions. SUNANDA CREAGH: Where do you land on this issue, do you think the government is capable of keeping that data safe? NIGEL PHAIR: I think the government is capable of keeping it safe. The systems around My Health Record for example are really quite secure and there’s a lot of technologies, a lot of process and a lot of policy to ensure. But the reality is if there is going to be a breach of my health record, it’ll probably happen at a doctor’s surgery where there’s an unpatched or unprotected computer, or a user not using a good password, or accidentally emailing the wrong patient records to someone. It will be the end user compromise which we’ll see will be the failure. And that’s what the government isn’t investing in. It’s great to say they have a great secure system themselves but again we need to wind the clock back several years and start telling people this is what it means. SUNANDA CREAGH: Just on this hack, how might it have been actually perpetrated? Can you just explain that to me in really basic terms? NIGEL PHAIR: We don’t know yet until the forensic examination is done about how it occurred. Invariably, it was most probably some sort of social engineering attack against someone on the network. Most probably a phishing attack or something similar, where a person is targeted rather than the network itself is targeted. But again, until we know the forensics, we’re just speculating. SUNANDA CREAGH: And those phishing and social engineering attacks, am I right in thinking they mainly focus on trying to get somebody to reveal their password or their login details to another person who is perhaps impersonating somebody else or impersonating an official password reset type email. Is that the sort of thing you mean there about the social engineering? NIGEL PHAIR: Invariably, they are quite unsophisticated attacks. It’s spoofing an organisation or a person. Getting someone, an end user, to reveal login credentials and because we share passwords across multiple logins, that’s how you gain access to a trophy asset. SUNANDA CREAGH: So the lesson there for all of us really is never reuse your password details and get a password manager. Am I right? NIGEL PHAIR: You are right. SUNANDA CREAGH: We’ve heard some commentators saying that this is the new normal, that this type of attack really should be expected in this day and age. What do you think about that? NIGEL PHAIR: It’s been the new normal for quite some time. The reality is, most organisations get hacked just don’t know they’ve been hacked. This is all of a sudden a trophy matter, it’s come at the time where parliament is sitting, so it’s really got some attention in so