Australia is at war with her allies, and will have to defend herself from the military might of the world's most powerful nations. But no shots will be fired, nor blood shed, as the third incantation of the international online war game Cyber Storm kicked off today.
Cyber Storm I (Credit: US Department of Homeland Security)
Private sector companies holding the keys to Australia's critical infrastructure, like water, electricity, food, transport and telecommunications, will assist the government to defend itself from four days of cyber assaults.
This year's games will target the trust mechanisms of networking, according to US defence commentators, but further detail is not known.
Twelve countries will participate — Australia, Canada, France, Germany, Hungary, Japan, Italy, the Netherlands, New Zealand, Sweden, Switzerland and the United Kingdom — up from four in the last game in 2008.
Telstra, Woolworths and Microsoft are returning as some of the 50 organisations that will test their critical infrastructure against cyber attacks. Optus will be an observer of the games.
Games I and II, spaced by two years, were based on scenarios of cyber terrorism. In the first tabletop exercise, anti-globalisation activists had attacked US critical infrastructure, while money and power-hungry attackers launched similar assaults in the second event.
Attackers will use "known and credible technical capabilities of adversaries" and exploit "real cyber-infrastructure vulnerabilities, resulting in a range of potential consequences including loss of life and the crippling of critical government and private sector functions", according to the US Department of Homeland Security, which spearheads the games. More than 1500 "injections of data" will be used in the games.
Federal Attorney-General Robert McClelland, who will head-up Australia's effort, said Cyber Storm III will test relationships between government and the private sector, as well as across the nation's burgeoning cyber defence chain, which includes the the Computer Emergency Response Team and Cyber Security Operations Centre in the Defence Signals Directorate.
"The government will do what [it] can to prevent damage from the assault, respond and bounce back as quickly and as effectively with a minimum of disruption," McClelland told parliament.
"The majority of Australia's IT systems and hardware are owned and operated by the private sector, which is why Cyber Storm III will actively test and strengthen relationships between business, government and international partners in order to effectively respond to possible cyber attacks."
Telstra network and information technology operations director Craig Hancock said its incident response methods will be tested.
"Exercises like Cyber Storm III are a great opportunity to test the veracity of these network protection measures, in addition to communications and decision-making processes which underpin any technical response to a cyber event. By actively testing our response processes we can then evaluate and improve our effectiveness in managing and responding to cyber security incidents," Hancock said in a statement.
Officials overseeing the games within the Federal Attorney-General's Department would not comment on the theme of the event, but confirmed they will be participating in the games.
However, US Defence officials offered media a peek at the secretive event, even allowing photos of the control centre.
US director of the Cyber Storm event Brett Lambo told told Federal News Radio that the exercise will test the destruction of critical infrastructure.
"We wanted to take that up a level … we can look at what happens when the infrastructure is unavailable," Lambo said.
"In Cyber Storm I, we attacked the internet, in Cyber Storm II, we used the internet as the weapon, in Cyber Storm III, we're using the internet to attack itself."
A report on Cyber Storm II found improvements across inter-agency coordination, training and in common frameworks for response. The event did not identify specific vulnerabilities in Australia's computer systems.
A rundown on the first event is available here (PDF).