Australia and Malaysia are stepping up their collaboration to counter escalating cybersecurity risks, from artificial intelligence (AI)-powered attacks to ransomware targeting critical systems, as Southeast Asia deepens its digital integration.

Brendan Dowling, the Australian Ambassador for Cyber Affairs and Critical Technology, tells DigitalEdge that both countries are confronting similar challenges as digital transformation accelerates across the region, with shared learning and policy exchanges becoming key to defence.

“We are in probably the most dangerous time for cybersecurity ever. I think countries all through this region are digitalising, undergoing digital transformation at a really rapid pace,” says Dowling.

“What that means is everything is connected. So whether it's our households, consumer smart devices, government services being delivered online, critical infrastructure like power, water, telecommunications, all of these are being connected to the internet, which also means vulnerabilities are spreading.”

One example he highlights is how malicious actors are using AI to conduct more sophisticated attacks. Australia and Malaysia’s governments are currently sharing their findings and expertise to gain a deeper understanding of tackling AI.

“Something affecting Malaysia today might hit Australia tomorrow. So that communication and information sharing are a meaningful benefit to our ability to protect both our nations,” says Dowling, who attended the inaugural Asean-Australia Biennial Dialogue in July.

“[At the dialogue], we committed to sharing more information about our legislative frameworks and how they work to drive up cybersecurity in both of our nations, and we committed to sharing more about how we're dealing with the emerging technology threat,” he says. 

This biennial dialogue between Australia and Asean nations originally started back in 2018, at the Asean-Australia Special Summit, with the Biennial Dialogue designed to be a permanent forum for Australia to collaborate with Asean players.

Dowling notes that many commitments made seven years ago were reaffirmed this year, with Malaysia’s Asean chairmanship providing an opportunity to renew past partnerships, particularly on cybersecurity.

“There are companies that are operating in Malaysia that are operating with Australia and vice versa. So there's an expectation that if we are to have a fruitful trade and investment relationship, we need to know that our companies operating in Malaysia are protected and part of a secure environment,” he says.

Likewise, Malaysian companies need to know that when they operate in Australia, they are also part of a secure environment.

Dowling commends Malaysia as a prominent voice in UN discussions on AI-powered cyber threats, encouraging other nations to uphold international norms and laws in cyberspace.

“Malaysia's digital transformation is very interesting to watch. [Malaysia has] accessible digital payment systems and advanced digital identity work. As Malaysia pursued these digital transformations, it has also worked to prioritise the security of that information. I actually think Australia has a lot to learn from Malaysia,” he adds.

He acknowledges that, by comparison, Australia is not as advanced on the policy front and that both countries can mutually benefit from sharing experiences and frameworks.

“We've had expert exchanges with Australian universities, working with Malaysian government agencies on developing policy frameworks for cybersecurity… Of course, there is the flipside that we are very different countries. What worked in one place is not always going to work in the other,” Dowling says.

This has made Malaysia a strong partner for Australia in digital adoption and cybersecurity, especially given the Malaysian government’s sustained investment in these areas.

An example of the information exchange that occurs thanks to this partnership is if Australia is facing a new threat that may be harmful. And should the bad actors target Malaysia, the Australian government will openly share all information that could help Malaysia prepare for the potential threat.

Currently, both nations are exploring ways to enhance workforce preparedness and training in response to rising cyber threats, particularly in the context of AI integration.

“Both Malaysia and Australia are looking at what regulatory settings we should put in place around AI to see that we get the benefits from it, but also mitigate some of the downside risks in misuse of AI or using AI in settings which expose our people to risk,” says Dowling.

Part of realising the benefits of AI technology is through increased connectivity. This includes reaping the benefits of fast, secure and trusted 5G network connectivity. In this vein, he notes that many Australian companies are investing in data centres in Malaysia.

The discussions at the Biennial Dialogue extend beyond bilateral issues, touching on the wider Asean region.

“What we're seeing is that cybercrime is getting worse in the region, with ransomware targeting government agencies. In Australia, the national airline was hit by a cyberattack, while a private health insurance service was hit by a ransomware attack,” says Dowling.

“In smaller Pacific islands, ransomware groups are targeting health systems, hospitals, and schools… It is getting worse.”

He does not foresee this trend easing soon, noting that ransomware remains lucrative, with many perpetrators profiting from scams and fraud, particularly where people are new to online banking or e-commerce.

Additionally, cyber threats are not restricted to these scammers and fraudsters. He adds that other countries are looking into using cyber tools to access the sensitive information of other governments.

“We’re also worried about states willingly using technology as tools of coercion, interfering in political systems and democratic processes,” says Dowling.

To tackle these risks, Dowling calls for stronger connectivity among national agencies and regulators, citing Malaysia’s National Cyber Security Agency (NACSA) and the Malaysian Communications and Multimedia Commission (MCMC) as examples of local capability.

“In all our conversations, there’s a level of respect for each other’s capabilities, but with a recognition that we can do better at sharing information about our respective understanding of threats and their responses will improve their overall effectiveness.”

Dowling highlights findings from the Australian Strategic Policy Institute, which traced many scams to criminal centres operating out of Myanmar, where trafficked individuals are forced to carry out cybercrime across the region.

To counter this, he says, regional federal police forces must work with regional law enforcement to understand the operations of these criminal syndicates to create proper strategies to disrupt their operations.

“The next step is to go from prioritising cybersecurity politically, talking about how we better protect our government agencies, to what we need to do to better protect our critical infrastructure. Governments can't do that alone and there has to be a partnership between government and private sector operators.”

Dowling adds that many businesses, healthcare systems and schools have underinvested in cybersecurity. The focus, he says, should be on raising protection standards across all critical infrastructure and embedding cybersecurity into everyday operations.

“It's going to be hard, because if you run a hospital, your priority is treating patients, not investing in the security of your computer networks, but that’s what you need to do to better protect your patients. And it doesn’t just mean buying more cybersecurity services, it also means producing more secure products,” says Dowling.