It’s time to treat state-sponsored cyber intrusions as attacks – The Strategist | ASPI's analysis and commentary site

It’s time to treat state-sponsored cyber intrusions as attacks  The Strategist | ASPI’s analysis and commentary site

Democracies made a big cybersecurity mistake in the 1990s when they insisted that cyber intrusions were not acts of war. That insistence meant managing a constant barrage of attacks rather than preventing them, teaching Russia, … Democracies made a big cybersecurity mistake in the 1990s when they insisted that cyber intrusions were not acts of war. That insistence meant managing a constant barrage of attacks rather than preventing them, teaching Russia, China, North Korea and Iran that the likely cost of malicious cyber activity was a strongly worded statement, or nothing at all. Hindsight shows a stronger stand was needed then and is needed even more today. The ASD’s Annual Cyber Threat Report 2025-2026, released this week, found that state-sponsored actors target Australian critical infrastructure, businesses and individuals, and are increasingly pre-positioning inside networks for disruption when they choose.

One of the most important changes should be to cease treating cyberattacks as different from physical attacks. This also means treating attacks by governments separately from cybercrime. When a country or its businesses come under cyberattack, they must as a first step name any known attacker, just as they would if struck physically. It may be difficult for governments to name and insist on behavioural change from US frontier AI labs for unintended intrusions, similarly for hacks coming out or supported