NSW audit finds gaps in state, local government cyber protections
State government agencies only met 31 per cent of mandatory requirements to protect public data, according to a report released by the Audit Office of NSW last week.
In total, 27 of these agencies reported 152 "significant, high, and extreme" cybersecurity threats in 2024.
According to the report, 28 of the threats had remedies "that were either largely or completely ineffective".
Additionally, 60 risks lacked specified timelines to reduce them to an acceptable level.
Professor of cybercrime at the University of NSW Richard Buckland said the report's findings showed entities were increasingly at risk.
He said that if effective, a cyber attack could "paralyse a section of society or the government".
"This has been a pattern, a worrying pattern," he said.
The report found a blind spot was the use of external contractors for some cybersecurity measures, for which the NSW government has no way of measuring if they were up-to-scratch.
Professor Buckland said he understood the desire to outsource but warned it came with its own risks.
"It's harder to monitor, to control, so external people helping you is a double-edged sword, especially if you don't have external capability to jump in when something goes wrong."
It comes after Qantas reported a major cyber attack in which it said a "significant" portion of its six million customers' data was stolen and that a "potential cyber criminal" had made contact with the airline.
In 2020, the personal information of more than 180,000 people was compromised by hackers who managed to access information held by Service NSW.
Responding to the attack cost the state government more than $30 million, the audit office reported.
Professor Buckland said the report pointed out the "same problem" every year and government agencies were "just not adequately defended".
"They [the audit office] must be tearing their hair out wondering what they can do to bring about change."
The report also found local councils were lagging in their defence against nefarious online actors, with only 69 per cent training staff in cyber awareness.
It said one council suffered a ransomware attack that targeted local government records, employee financial data and systems responsible for monitoring water quality.
Councils in NSW are not mandated to implement Cyber Security NSW's policies, but the agency recommends they adopt safeguards.
"We've seen worldwide a big rise in targeted attacks against municipalities — the equivalent of councils in America — against libraries, schools, smaller and less well-funded data-rich organisations."
Reacting to the report, Premier Chris Minns on Monday said the government had to find $90 million to 'plug gaps' in cybersecurity funding.
'It is a concern. I'm going to be honest, I would like to see us meet all the criteria immediately that the auditor-general identified,' he said.
'That's not possible though; most of the funding for cybersecurity in NSW had been cut or put on a funding cliff by the previous government.'
He warned it will cost a lot more to make all government agencies safe.
"Some of these organised crime gangs, usually located offshore, are pretty sophisticated, and we obviously have to be on our guard," the premier said.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
SBS Australia
7 hours ago
- SBS Australia
One third of Australia's young workers report wage theft
One third of Australia's young workers report wage theft Published 15 July 2025, 8:53 am A new report has found a third of young workers in Australia is being paid less than fifteen dollars an hour - almost ten dollars below the minimum hourly wage. The Melbourne Law School survey of 15- to 30-year-olds has identified widespread breaches of labour laws. Those from non-English speaking backgrounds are the worst treated in the workplace.
News.com.au
8 hours ago
- News.com.au
Victim's genitalia ‘deliberately' sprayed by police, court hears
A mentally ill woman had a graze on her back pepper-sprayed like 'graffiti on a wall' by police with the aim of inflicting 'gratuitous pain', a court has heard. Former senior constables Timothy Trautsch and Nathan Black faced Penrith District Court on Wednesday after pleading guilty to a series of assault charges over a 'welfare check' involving a 49-year-old woman in January 2023. The woman, who has chosen not to name, was in a 'state of psychosis' when she had her genitalia pepper-sprayed and received multiple kicks to the head after she ran away from the officers naked through the streets of Emu Plains in Sydney's west. The interaction was caught on bodyworn footage and CCTV. Ahead of their sentencing, crown prosecutor Nicholas Marney argued the men needed to be jailed for their actions, saying they had 'a complete disregard' for the woman's 'wellbeing and welfare as a human being'. Mr Marney pointed out that during the interaction, the victim was dragged across the ground by her hair causing a graze to her back. The graze was then pepper-sprayed by one of the officers. Judge Graham Turnbull SC told the court it looked like the officer was a 'graffiti artist spraying something on a wall'. 'It struck me, the particular aspect of the spray to the graze on the back,' Judge Graham Turnbull SC said. 'I struggle to understand what possible reason there could be for that other than an intention to inflict gratuitous pain.' The court also heard how the two officers charged the woman with two counts of assault after the interaction. The charges were withdrawn after nurses and paramedics reported their concern over the nature of the woman's injuries. Rewatching the CCTV on Wednesday, Judge Campbell said he believed that the victim's genitalia were 'deliberately' sprayed. 'I see things with my own eyes. The video has the potential to speak for itself. It's hard to watch,' Judge Campbell said. Mr Marney told the court a 'clear statement' needed to be made to the community as to not undermine their trust in police. 'They resorted to violence when there were other options. This wasn't two officers who snapped, this is two offenders that couldn't be bothered to do the right thing,' Mr Marney said. '[The victim] deserved to be treated respectfully and compassionately … or at the very least, lawfully.' Mr Marney also told the court Black appeared to be 'bizarrely proud of what he had done' after sending a 17-second bodyworn footage of the interaction to a colleague. 'Both OC cans emptied on her. Was f**ked,' he wrote. 'She was f**ked the whole body worn is so good shows her being f**ked. Nurses are lodging a complaint [senior officer] is investigating because we caved her, but she had a hold of the cuffs and we had no other options.' Judge Campbell said it appeared Black's motivation in sending the message was 'emotional satisfaction' and 'gloating'. The victim has since died from unrelated causes. The men's lawyer argued the former officers were acting in self defence as the victim posed a threat and was 'kicking out' at them. Speaking about Black, his lawyer labelled his client a 'frustrated offender' who had been 'pooped on'. 'He hasn't dealt with the situation well but he is not here to inflict cruelty,' he said. 'They are hyper focused on getting her into this ambulance.'
ABC News
9 hours ago
- ABC News
Court orders owner of alleged illegal tobacconists to close businesses for six months
A Queensland judge has ordered a business owner to close five of his Wide Bay stores which health officials allege have been selling unlawful smoking products. In June, a significant quantity of illicit cigarettes, loose tobacco and vapes were allegedly seized during raids on multiple retail premises in Hervey Bay. Earlier this month, Queensland Health launched court action against the owner of some of the stores, Mohammed Alfalahi, seeking a permanent injunction under strengthened tobacco laws. While that matter is pending, on Wednesday, Queensland Health sought an interim injunction of the same effect. Lawyer Peter O'Connor told the court the order would restrict Mr Alfalahi from engaging in the alleged illegal conduct and receiving income from it unlawfully. "Until such time that the substantive proceedings can be finalised," he said. Mr O'Connor told the court the "fundamental question" was whether any of Mr Alfalahi's businesses held a licence to supply smoking products. "There's no assertion by [Mr Alfalahi] that in fact he has or did in fact at any stage," he said. "The evidence, in fact, establishes that he has not ever held such a license." Mr O'Connor told the court, Mr Alfalahi is the tenant of the business premise, and the permitted use according to his lease is a tobacconist or tobacco shop. "He can't claim ignorance of the nature of business operating out of the premises that he is leasing," he said "He similarly cannot claim ignorance of the regulatory scheme given the number of interactions that he has had with the authorities over a substantial period of time." The court heard he had previously paid infringement notices for past contraventions under the legislation. Mr Alfalahi's lawyer James Wallace told the court it had been difficult to get in contact with his client as he lived overseas, and had not been adequately instructed on any possible defence to the allegations. However, Mr Wallace said his client "can't possibly be criticised" for not responding in detail, in what he asserts were inadequate time frames for submitting material, and that this was "not a full hearing on the merits" of the allegations. "I'm not conceding the prima facie case," he said. "I have no evidence to rely on to submit sensibly." It was argued that several employees would lose their jobs if the order was granted and Mr Alfalahi could be at risk of breaching the order due to his limited communication and the impracticality of shutting the stores effective immediately. Mr Wallace argued the balance of convenience should be in favour of his client, as there were separate yet related proceedings due to be heard in the magistrates court later this month. "In theory, in 10 days' time a magistrate will determine whether those five stores should be shut down for six months," he said. "Leaving the status quo would allow the matters to proceed as they are in the magistrates court without pre-emptively finalising the matter." The court heard the magistrate court action and the district court action "complement each other" but they served independent purposes. In the lower court proceedings, Queensland Health is seeking not only closure of the stores for six months, but also enforcement against the landlord to ensure no-one else takes over the lease. Judge Ken Barlow KC granted the interim injunction, accepting there was "no real evidence of substance of any defence". "It seems to me there is no doubt a prima facie case," he said. Judge Barlow KC also rejected the submission Mr Alfalahi could not properly instruct his lawyers. "The communication abilities of the modern world, particularly between Australia and Dubai where [Mr Alfalahi] currently lives, are such that I do not accept that the respondent would not have had the opportunity to be sent the material read and discuss it at length with his solicitors," he said. "While I do not go so far as to infer that there is no possible defence... the absence of any skeleton of any defence does not assist [Mr Alfalahi]." Mr Alfalahi will have until Friday to cease operating the five business. He will also be prohibited from running any other companies which involve the sale of tobacco.
