Australian Government Considers Outlawing Ransom Payments to Hackers

Minister for Home Affairs and Minister for Cyber Security Clare O'Neil speaks to media in Melbourne, Australia, on Oct. 20, 2022. AAP Image/James Ross

Australia may soon introduce new laws that ban local companies from paying ransom to hackers if they fall victim to data breaches.

Speaking to the Australian Broadcasting Corporation’s Insiders program on Nov. 13, Home Affairs Minister Clare O'Neil said the federal government was considering whether it was necessary to make ransom payments illegal following the high-profile cyber attacks on Medibank and Optus.

The minister said while short-term successes were needed in cyber security reform in the wake of the data breaches, the government was examining other long-term outcomes, including a ban on ransom payments.

“There are some really big policy questions that we’re going to need to think about and consult on, and we’re going to do that in the context of the cyber security strategy,” she said.

“We'll have a look at [making ransom payments illegal].”

People walk past a shop front for Medibank in Sydney, Australia, on Nov. 11, 2022. Muhammad Farooq/AFP via Getty Images

O'Neil also approved of Medibank’s rejection of paying the ransom demanded by the hackers amid the threat of further sensitive data release, saying it was the right move.

“I have never seen people that lack a moral code so clearly than the hackers who are releasing data about Australians online,” she said.

“The idea we’re going to trust these people to delete data they have taken off and may have copied a million times is just, frankly, silly ... we don’t want to fuel the ransomware business model.”

Earlier, the Australian Federal Police (AFP) said they believed a group of “loosely affiliated” cyber criminals based in Russia were behind the massive hack at Medibank.

Australian Government Sets up Policing Operation Targeting Hackers

Turning to another topic, O'Neil said the government was setting up a high-tech task force composed of the best cyber experts to proactively go after hackers targeting Australians.

Regarding the rationale behind the move, the minister said Australia needed to improve its response to cyber offences due to their number.

To illustrate, she said the National Australia Bank was subject to 50 million attacks a month, while the Australian Taxation Office got three million.

“I don’t think anyone can promise cyber attacks are going to go away, and one of the things people need to understand is really how relentless this is,” she said.

In addition, O'Neil said there was a need for a mechanism ensuring companies only retained customer data when it was useful and that the government was reviewing the privacy law in this regard.

Meanwhile, Nationals leader David Littleproud said he wanted to work closely with the government to fast-track the introduction of new legislation ensuring better cyber security protection for Australians.

“Let’s work together and get this right because this is people’s private data being shared on the dark web for reasons that shouldn’t be put out there,” he told the Nine Network.

“There’s an opportunity to actually expedite it. It comes down to action, and action is not about words.”