Cyber Catastrophe: Australia needs a National Assessment

On 1 June 2025. the Australian government made a major change to its planning for national cyber emergencies by introducing a new contingency of "nationally catastrophic cyber incident". Dr Gary Waters and Professor Greg Austin have called on the government to follow up on what that means in practice. The ideas are laid out in a new paper released by the Social Cyber Institute.

“Australian cyber emergency policy reform is moving at a fast pace with key government statements in June from the National Office of Cyber Security and the Chief of the Defence Force”, said report co-author Dr Gary Waters. “The new category of nationally catastrophic cyber emergency now needs to be accompanied by detailed and comprehensive preparedness planning based on lessons from the inquiry into the Covid pandemic”.

“We would expect the government to produce in the near future further analysis of what these preparedness plans might look like”, said Professor Greg Austin, also a report co-author. “They would need to include not only roadmaps for technical response inside cyber systems to the catastrophic incident but also action plans for consequence management in key economic sectors, delivery of essential services and mobilisation of the citizenry behind inevitably unpopular government decisions”.

Professor Glenn Withers, Director of the Social Cyber Institute, and one of Australia’s most eminent economists, said “It is time to recognise the economic impacts of national emergencies far more expertly in framing national emergency response. That is now accepted wisdom after Covid-19 but we now need to see the government’s ‘economic toolkit’ for dealing with extreme cyber emergencies.”

This paper outlines considerations to support Australia stakeholders in developing this new paradigm. The paper explains cyber civil preparedness, the need for a national cyber civil preparedness strategy, and associated but separate implementing frameworks. It discusses critical infrastructure challenges and organisational resilience, as a distinct but entangled element of national preparedness.

The paper makes five recommendations: conducting a national assessment of cyber civil preparedness and resilience, establishing a dedicated office of cyber threat intelligence focused on the economy and society, submitting triennial national assessments to Parliament, building a national cyber catastrophe readiness framework, and developing a new doctrine and legal authorities for a national civil preparedness program.

Dr Gary Waters is a Distinguished Fellow with the Social Cyber Institute. Gary served for just over 33 years in the Royal Australian Air Force (retiring early as an Air Commodore); served as a senior public servant in Defence for a further four years; and worked in the private sector as Head of Strategy for Jacobs Australia for seven years. He retired in 2013 and now works on a casual basis as an independent strategy consultant. He has written over twenty books or papers on diverse topics, including aerospace; logistics; intelligence, surveillance and reconnaissance; information superiority; cyber security; and cyber warfare. Gary continues to pursue his interests in strategy and high-level policy, and in emergent and disruptive technologies, including those associated with digital transformation and cyber security. He is a Fellow of the Royal Melbourne Institute of Technology (graduating with majors in accounting and economics); a graduate of the United Kingdom’s Royal Air Force Staff College; a graduate of the University of New South Wales, with an MA (Hons) in history; a graduate of the Australian Institute of Company Directors; and a graduate of the Australian National University with a PhD in political science and international relations. He is currently a founding director (since 2018) of the Integrated Institute for Economic Research – Australia. He is also the strategic advisor (since 2022) to the CEO and Chairman of the Board of the Critical Infrastructure Information Sharing and Analysis Centre – Australia.

Professor Greg Austin has diverse international experience in cyber policy research and international security policy: Senior Fellow and head of the Program on Cyber Power and Future Conflict with the International Institute for Strategic Studies (IISS) and Professor of Cyber Security, Strategy and Diplomacy with the University of New South Wales Canberra. His academic career, including a Senior Visiting Fellowship in the Department of War Studies at Kings College London, has included twelve books on international security, as author or editor, and leadership of several international research projects. He is currently an adjunct professor in the Australia China Relations Institute at the University of Technology Sydney. His service as a research leader for prominent global NGOs, such as the International Crisis Group and the EastWest Institute, has seen him work from Brussels and London with leading governments at Ministerial level (Russia, China, UK, India, United States, Turkey, Australia), major international organisations at leadership level (United Nations, International Atomic Energy Agency, R20 for Climate Action), and leading corporations (AT&T, BT, Perot Systems). He has consulted for the UK Cabinet Office, the UK Ministry of Defence, the Foreign and Commonwealth Office, the European Commission, and the Australian Department of Foreign Affairs and Trade. He began his career in Australian public service roles, including posts in Canberra and Hong Kong, parliamentary committees, and ministerial staff.  Austin has a Ph D in international relations and a Master of International Law, both from the Australian National University.