April 14, 2023
The Group of Eight (Go8) welcomes the opportunity to provide this submission to Australia’s Cyber Security Strategy 2023-2030. Please note this submission represents the views of the Go8 network, and member universities may choose to make their own submissions.
Please note that we are happy for this submission to be published and have no wish for any of it to be treated as confidential.
Cyber security is already, and will increasingly become, essential to the prosperity of a modern, competitive and productive Australia.
A digitally driven economy offers many advantages, but its success or otherwise will depend on our ability to create a high level of trust across diverse communities that sensitive data will be kept safe. And that trust will, in turn, rely on strong and effective cyber security.
And this will need to be maintained within an environment in which the risks and challenges are continually evolving. This means that high quality research – to enable both the identification of new approaches and to keep pace with advancements developed elsewhere – must form a foundational part of any successful strategy.
The Go8 therefore commends the Government in recognising the need for a national approach. But it is important to keep in mind the broader context in which cyber security is only one element of a suite of critical technologies on which we will increasingly rely, and which will need to interact and be compatible (cyber security, artificial intelligence and machine learning, for example). High performing research teams able to integrate learnings and advancements across a range of these technologies and interface with industry would be a national asset in helping Australia to manage effectively in this fast-moving area.
The Go8 comprises Australia’s leading research-intensive universities with seven members in the top 100 globally. Go8 universities conduct 70 per cent of Australia’s university-based research as part of an annual investment of approximately $7.2 billion in R&D and have six members ranked in the top 100 in the world for Computer Science.[1] The considerable expertise and capacity housed within our membership places us in an ideal position to advise on the research aspects of this strategy. Our member universities are available to provide advice at a more detailed, technical level.
Summary of Recommendations
- Recommendation 1: That the Government recognise the considerable national asset that is the capacity, capability and connections of its research-intensive universities, that can be leveraged to advance Australia’s sovereign capability across a range of critical technologies and industry and recognise this capability in the Cyber Security strategy.
- Recommendation 2: That the Government consider incorporating best practice models designed to increase engagement between researchers and industry while advancing the stock of knowledge (eg the French CIFRE model). The Go8 would be happy to work with Government on a pilot program to determine how this could best be shaped to suit industry and national need.
- Recommendation 3: That the Government consider partnering with the Go8 to develop new models to facilitate engagement, such as the Lincoln Labs at MIT in the US, or an Advanced Strategic Research Agency based on the DARPA model.
- Recommendation 4: Amending skilled migration settings by introducing a High Potential Individual (HPI) visa targeting the attraction and retention of world leading university researchers and educators as well as fast-tracking international PhD graduates into the Australian workforce.
Discussion Paper Questions
Question 1: What ideas would you like to see included in the Strategy to make Australia the most cyber secure nation in the world by 2030?
As noted in the introduction above, high quality research will be foundational to Australia’s success in cybersecurity, an area which is subject to rapid and continual change.
Achieving the goal of being the “most cyber security nation in the world by 2030” will not be easy. It will require not only the expertise necessary to keep pace with developments occurring elsewhere, but also the capacity to develop our own approaches and advancements.
This will become increasingly critical not only for our own purposes, but also as we move into the era of greater technological collaboration in secure or sensitive areas through agreements such as AUKUS. For AUKUS to be successful, Australia will have to not only assure its own communities of its capabilities in cyber security and related technologies, but those of key allies as well.
Australia is in the fortunate position of having a considerable reservoir of expertise and capability housed within its research-intensive universities. Go8 members are consistently the highest ranked of all Australian universities; have six members featured in the top 100 world-wide QS graduate employability rankings; have over 99 per cent of their research assessed as world class or above; and are proven performers with industry, with one member alone earning over $64 million in commercialisation revenue in 2020, 50 per cent more than the CSIRO.
Through the Go8, Australia punches well above its weight in global research rankings. The Academic Ranking of World Universities (ARWU), often considered the most prestigious research-only global ranking, shows seven Australian universities – all Go8 members – within the Top 100 in the world.[2] Perhaps more remarkably, this is the fourth highest total overall, behind only the US (30), the UK (8) and China (8),[3] all of which have considerably larger populations. That Australia has managed to maintain this level of performance is a national achievement of which we should be proud.
Yet Australia has historically failed to take full advantage of this national asset.
As we noted in our submission to the Defence Strategic Review, harnessing the capabilities of our high performing, research intensive universities is an urgent national strategic imperative. In that submission we made three recommendations which could also serve to underpin Australia’s cyber capability in the coming years, and which could facilitate better integration between researchers, industry and the various related critical technologies which will increasingly underpin national success:
- Recommendation 1: That the Government recognise the considerable national asset that is the capacity, capability and connections of its research-intensive universities, that can be leveraged to advance Australia’s sovereign capability across a range of critical technologies and industry and recognise this capability in the Cyber Security strategy.
- Recommendation 2: That the Government consider incorporating best practice models designed to increase engagement between researchers and industry while advancing the stock of knowledge (eg the French CIFRE model). The Go8 would be happy to work with the Government on a pilot program to determine how this could best be shaped to suit industry and national need.
- Recommendation 3: That the Government consider partnering with the Go8 to develop new models to facilitate engagement. In the cyber space, this could include successful overseas efforts such as the NIST National Cyber Security Centre of Excellence (NCCOE) in the US, the CISPA in Germany or the EPSRC-GCHQ Academic Centre of Excellence in Cyber Security Research in the UK..
CIFRE is a long running and successful program involving a partnership between the French Government, an industry partner and a host university. Talented PhD candidates, under the supervision of both a research- intensive university (to maintain a high-quality level of research) and an industry partner (to ensure relevance) address an area of known need. The process produces multiple benefits, including: an evidence-based and fully researched solution relevant to the industry partner; a highly qualified employee who is industry ready in an area of skills need; and deeper connections between industry, defence and universities. A small Australian pilot, leveraging existing connections between our leading research universities and defence industry could be run at a modest cost split. If effective, the program could be scaled up.
Recommendation three, to develop facilities modelled on successful overseas initiatives, is likely to require significant investment. However, this is consistent with the critical importance of cyber security measures in the context of recent high-profile incidents at Optus and Medibank, and with the Government’s call for big bold ideas in reforming the higher education sector through the Universities Accord.
Question 4: What opportunities exist for Australia to elevate its existing international bilateral and multilateral partnerships from a cyber security perspective?
Education and research collaborations provide a powerful mechanism for building ongoing relationships and partnerships across the globe.
High quality research universities attract collaborations and partnerships from equally high-quality organisations located overseas. Top researchers in Australia are always looking to engage with the best researchers from elsewhere to advance the frontiers of knowledge. When PhD students are incorporated into these partnerships they forge cross-border professional relationships that are often carried throughout their careers – and become the basis for future and ongoing international collaborations. In this way, ongoing connections can be built that last well beyond the timeline of any individual project or agreement.
High quality research collaborations also act as a global marker of our capability in a particular area. They keep us connected to a global talent base, act as a signal for that talent to study and work in Australia and help us to keep abreast of advancements made elsewhere.
Knowledge transfer is also critical to keeping Australia at the cutting edge of industry practice. As we noted in our submission to the Defence Strategic Review, facilitating greater connectivity between the different parts of the system – industry, government and high-quality university research – is critical to maximizing Australia’s capability.
The Go8 currently has a number of models of engagement that could be used to leverage existing strategic partnerships to advance our cyber security capability:
- Engagement with India: a number of Go8 members have established joint PhD programs with partners in India, whereby high-quality students pursue their candidacy through a bilateral model. Students spend part of their degree in India and part in Australia, working to produce evidence-based solutions to industry-identified problems. The Indian Institute of Technology Bombay (IITB)-Monash Research Academy has now been in operation for nearly 15 years and formed the model for the UQIDAR (University of Queensland – Indian Institute of Delhi) Academy of Research. These collaborations provide a proven model to leverage existing bilateral partnerships to advance developments in areas of key interest. Similar agreements with selected leading partners focused on cyber security could help to boost capacity and facilitate deeper exchanges across partners with solutions ready and available to serve industry needs.
- Five Eyes: the longstanding Five Eyes relationship has established a model for secure exchange between trusted partners. This framework might be able to be leveraged to facilitate greater engagement in sensitive areas such as cyber security. Similarly, the AUKUS agreement presents a prime opportunity to pilot models to advance capability between highly trusted partners. The Go8 has deep and longstanding partnerships with our counterpart organisations in these countries, the Russell Group in the UK and the Association of American Universities in the US, which could be leveraged to national advantage, especially at a PhD or postdoc level.
Questions 11: Does Australia require a tailored approach to uplifting cyber skills beyond the Government’s broader STEM agenda? and Question 12: What more can Government do to support Australia’s cyber security workforce through education, immigration and accreditation?
An effective cyber security strategy will need to include consideration of workforce issues and pipeline. A recent report by cyber security services organisation CyberCX estimates that Australia will face a shortage of 30,000 cyber security professionals as soon as 2026.[4]
This is also likely to mean that relying on broader STEM education agendas to organically boost the workforce pipeline are unlikely to be sufficient to address current and growing skills gaps.
Australia is likely to need a two-pronged strategy to address these needs:
- Maximising domestic supply: this will require dedicated cyber security offerings at undergraduate through to PhD level, supported by foundational skills at primary and secondary levels. This should be supplemented by targeted postgraduate programs to facilitate existing professionals to transition into cyber security related areas, supported by incentives for quality candidates (eg., CGS places; national scholarships; tax incentives); and additional CSPs for undergraduate training in targeted areas.
- International supply: While Australia can and should encourage and develop domestic talent, the reality is that Australia will also need effective partnership with other countries if we are to meet burgeoning cyber security needs. This will mean encouraging talented students to study here – especially at PhD level – and then retaining them through our immigration system. This will need effective and efficient visa processing, as well as targeted immigration settings to give Australia a competitive advantage in an increasingly tight global market. A High Potential Individual (HPI) visa could allow universities to attract and retain world leading researchers, educators and graduates in areas of particular national need, such as cyber security. The Go8 would be happy to work with Government to develop a set of criteria to provide certainty to candidates currently in high global demand.
Recommendation 4: Amending skilled migration settings by introducing a High Potential Individual (HPI) visa targeting the attraction and retention of world leading university researchers and educators as well as fast-tracking international PhD graduates into the Australian workforce.
[1] Times Higher Education World University Rankings 2023 by Subject: Computer Science; and QS World University Rankings 2022 by Subject: Computer Science and Information Systems.
[2] https://www.shanghairanking.com/rankings/arwu/2022
[3] China mainland only.
[4] https://cybercx.com.au/cyber-skills-report/#cyber-skills-report