Proof Committee Hansard

More documents

Recommendations

Info

Page 2 House of Representatives Friday, 10 February 2017 In addition to the growth, there is also the issue that the Ben Chifley Building is at the higher security classifications. That makes it extremely difficult, if not impossible, for people without those higher security classifications, to get into the Ben Chifley Building. That actually provides limitations to the Cyber Security Centre in relation to their potential interactions with other agencies that make up the Cyber Security Centre and, more importantly, people from industry and academia who may not hold those high-level security classifications. Senator GALLACHER: And the space you leave behind? Brig. Beutel: I am advised that there is also growth in ASIO, so the space left by the 300 people from the Cyber Security Centre will be filled by the Australian Security and intelligence Organisation. So there is no waste. Those facilities will not be left vacant. They will be used. The cost that we put into the fit-out of the Ben Chifley Building to support the Cyber Security Centre two years ago are sunk costs, but they are not wasted costs, because those facilities will be reused. Do you have anything to add, Mr Scotton? Mr Scotton: I think Noel has covered it very well. The only other thing I would mention that is the nature of the work done at the centre does not always require that top-secret level of classification. By comparison, for instance, our partners in the UK have recently established a National Cyber Security Centre in London which operates primarily at the unclassified level. What we are doing is very much in keeping with that. Senator GALLACHER: The obvious question is, couldn't you have foreseen this two years ago? Mr Scotton: I do not think we could have foreseen the government's decision to invest so much in cybersecurity and provide the level of growth that they have done over the next four years. Senator GALLACHER: Fair enough. Going out to Brindabella, are there any incentives on offer there for value for money for the taxpayer? Brig. Beutel: For this particular centre, in relation to the proposed fit-out that is under consideration by the committee, there are no incentives as part of this deal in relation to the fit-out costs. Within the Department of Defence, as you are aware, there are a number of other leased facilities for other Defence agencies and there are certain incentives within Defence for other leased facilities at Brindabella Park. However, no incentives are being used as part of this cost. Senator GALLACHER: A part of the whole-of-government approach to be Brindabella Park is that some areas are getting incentives, but this particular project is not? Brig. Beutel: Correct. Senator GALLACHER: It is at the high end of our expectations in terms of the fit-out, if we have parameters of $1,200 to $1,800 per square metre Can you walk us through the reasons for that or place them on the public record? Brig. Beutel: I can, but I would ask, in relation to commercial-in-confidence, noting that we have not at the moment— Senator GALLACHER: You can put the need on the public record. You do not have to put the value on record. Brig. Beutel: I am more than happy to provide committee with those details in the in camera hearing. Mr Collins: Not talking about square metre rates, more about the requirements? Senator GALLACHER: The build-up—the need for extra security that contributes to the higher costs. Not the costs. Mr Collins: In terms of the contribution to the higher costs, it is considerably between two major areas, which are security works and communication works. The security works are primarily due to the additional physical security, typically for zones 3, 4 and 5, against the PSPF. Brig. Beutel: Could you explain zones 3, 4 and 5 and PSPF for the committee? Mr Collins: Zones 3, 4 and 5 are to do with the Protective Security Policy Framework. Zone 3 typically aligns with protected, zone 4 with secret and zone 5 with top secret. One of our buildings is going to be accredited for zone 5 capability. It will be on the higher end of costs and it will contribute to a significant amount to our cost estimates. In terms of the communications services, the communications cabling, predominantly the passive cabling—given the amount of networks and the number of agencies in here which operate different networks and potentially different types of networks, a combination of different cabling will have to be installed at each workstation to allow flexibility for the ACSC to move its staff around to allow for that collaboration between all the different agencies and the different zones and classifications. PUBLIC WORKS COMMITTEE
Friday, 10 February 2017 JOINT Page 3 Senator GALLACHER: Have you had a security assessment that this is a good place to be for a cybersecurity centre, and we cannot all get shut down from banking or mobile phones taking you out overnight? You are moving out of the ASIO building—presumably that is secure? Brig. Beutel: I am advised that a security risk assessment has been undertaken. Mr Rees may be able to provide some further detail on that. I would also note, though, that we are talking about security and mitigation measures. As a former senior ADF officer for Brindabella Park, I would note that there are standard security management plans in place that are practised quite regularly. That ties in with the overall Canberra Airport group emergency management plan. Mr Rees may be able to provide some more detail about the security assessments that were undertaken. Mr Rees: The security assessments have identified that there is no identified risk to the cyber centre. As such, it is compared to a standard Defence commercial facility, which the precinct currently is. The requirements for Defence facilities are that once we identify that there is a current threat within the area, to the facility and also the surrounding facilities, various security measures will then be enacted. However, they are kept as reserve, in case those kinds of issues arise. However, at this point there is no identified security threat to the Australian Cyber Security Centre going to the Brindabella Park precinct. Brig. Beutel: There will be layered levels of security in Defence with the buildings as part of that. I do not want the committee to get the impression that with the high level of security in the Ben Chifley Building we do not have the appropriate security measures in place for our equivalent top-secret spaces. Again, it is a layered approach because of the different security areas that are required to get that better collaboration, particularly with industry and academia. Senator GALLACHER: So you are saying that the security assessment is based on the fact that there is no threat to the organisation. Is the geography around there safe and dependable? Mr Rees: The threat assessment assesses the site, the precinct and any identified threats that have come through either as a result of security assessments or by identifying them within the public arena. There has been nothing identified. Brig. Beutel: I can confirm that as well, having only just recently handed over the responsibilities for the senior Australian Defence Force officer. Again, our security plans are not based on any recognised threat. That said, we do have procedures in place where if a threat is identified or a threat risk is escalated then, as Alun was saying, we have mechanisms to raise our security awareness. But at the moment there are thousands of Defence Force personnel, including me, who still work out there and go about our daily business out there in uniform without any other precautions in place. That is based on the current risk assessment. Senator GALLACHER: If you are in a very secure, top-secret facility and you move over there I would not want to see the ability to be shut down easily by someone making a threat or you going out there and all of a sudden the cybersecurity division does not operate. You have accounted for all of that, anyway; is that what you are saying? Mr Rees: It is in the threat assessment, yes. Brig. Beutel: The threat assessment is not a once-off. It is an ongoing activity. Daily security risks and threats are advised through various means within Defence. If actions are required to be taken then they are taken. Mr COLEMAN: Obviously this is driven by the need to house a lot more staff because you are going from 260 to 650. It is a very, very large increase. Can you talk us through why that increase is required and, broadly, what those people are going to be doing. Brig. Beutel: I can give you a quick breakdown of the numbers that make up the 700, and then I think Mr Scotton would be far better placed to describe their actual activities. ACTING CHAIR: To add to that, Brigadier, where does the seven per cent growth figure that is identified in the submission come from? Brig. Beutel: The actual approved establishment for the Australian Cyber Security Centre is 300 personnel. At the moment, Michael has only 260 personnel working for him. But that covers the 300 that we have at the moment. There is also at the moment approximately 100 personnel located in other facilities. So there are people coming in from other agencies. The anticipated growth based on the cyber security and defence white paper, which is where the figure comes from, is 200 personnel. We have rounded these figures up. Industry academia internships or graduate programs account for 100. So the 300 existing personnel, the 100 who are already existing but located elsewhere plus the 200 for the anticipated growth plus the 100 for industry academia gives us a total of 700 personnel. PUBLIC WORKS COMMITTEE
Page 1 and 2: COMMONWEALTH OF AUSTRALIA Proof Com
Page 3 and 4: PARLIAMENTARY STANDING COMMITTEE ON
Page 5: Friday, 10 February 2017 JOINT Page
Page 9 and 10: Friday, 10 February 2017 JOINT Page
Page 11: Friday, 10 February 2017 JOINT Page

Proof Committee Hansard

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?