SAVUNDRA, Mr Chris, Executive Director, Enforcement and Compliance, Australian Securities and Investments Commission [by video link] ZELLER, Ms Amanda, Senior Executive Leader, Market Integrity, Australian Securities and Investments Commission [by video link] [12:13] CHAIR: Welcome. I understand that information on parliamentary privilege and the protection of witnesses giving evidence to Senate committees has been provided to you. Would either of you like to make an opening statement? Mr Savundra : ASIC made a written submission to this inquiry in December 2023, and we appeared in October 2024. Since that time there have been significant changes. We're seeing a clear shift in the threat environment driven by scale, speed and technological change—particularly through the rapid evolution of frontier artificial intelligence models, which have the potential to lower barriers to sophisticated cyberactivity and increase the impact of attacks. Our response is deliberately system-wide, coordinated and forward looking. Our focus is twofold: firstly, strengthening cyber-resilience across our regulated entities; and, secondly, working closely with law enforcement and partner agencies to respond to the increasingly sophisticated threats. We are happy to take your questions. CHAIR: Thank you for the work you do in this area, for your submission and for giving us your time today. ASIC last gave evidence to this inquiry in 2023 and 2024. Are there any key developments like we've heard from other witnesses? The e-Commissioner, for instance, talked about the significant change over the last couple of years. Could you inform the committee as to what you've seen in this area? Mr Savundra : I might hand to my colleague to talk about and unpack the change in the landscape and the work that we're doing there. I'm then also happy to talk about some of the enforcement action that we've taken, particularly focused on cyber-resilience. Ms Zeller : As Chris alluded to in his opening comments, the rapid evolution of frontier AI intelligence models is a significant shift. We know that this is an area of focus for the Australian Signals Directorate. It has put out communications, and Home Affairs and the Australian National Cyber Security Coordinator have been undertaking significant work in this regard. ASIC has taken the step of issuing an open letter to our regulated population about what we're seeing and what we think this means for our regulated stakeholders. We're doing that very much in conjunction with the ASD, the Cyber Security Coordinator and Home Affairs, making sure we are working together as team Australia to tackle this step change in technology that is evolving very rapidly and can be used as a tool to improve the resilience of our regulated entities but, on the other side, also pose a threat to them. We work very much with our Council of Financial Regulators colleagues—APRA, the Reserve Bank, and Treasury—to be consistent in our approach and we're undertaking quite significant industry engagement in the next little while in relation to understanding how our regulated entities are approaching this threat and what steps they're taking to improve their resilience. Our open letter has received quite a lot of interest from industry. In our first week, we estimate that in the order of a million people were reached by the media coverage. We've written to 30,000 entities and directly shared the letter with them. We've had 20,000 people view our LinkedIn profile, which is well above the benchmark for ASIC's LinkedIn posts—34 per cent above the benchmark average. It gives one a sense of how interested our stakeholders are in terms of what to do—what we have to say in relation to the steps they should be taking to improve their resilience and also in terms of those practical pointers to ASD and the tools it provides. There is a lot of discussion in relation to risk and governance. We've had some of our regular industry engagement with different CISOs as part of our ongoing discussions with industry. They've flagged how useful our letter has been to escalate these issues with the boards of Australian financial services and financial markets companies here in Australia, to get that conversation happening at the board level. I table that as the most significant change that we have seen in the near term for how this can be chained together to really expedite risks very quickly throughout supply chains and decrease the risk of contagion. We know that financial services and financial markets are key interest areas for foreign threat actors. That's been called out by ASD in its annual report and threat assessments. We're doing our bit to try to build resilience across the population—not just with the big end but all the way down into the long tail of small businesses that we have. We've been really encouraged by big business stepping up and saying, 'Let us take the lead and be involved in some conversations with small business to give them some practical tips to boost their resilience.' That's something we're looking at taking forward, too, in the near term. Mr Savundra : I'm happy to talk about some of the more recent enforcement work that we've been doing. When I last appeared before the inquiry, we referred to the RI Advice case. Since then, we've had two court based actions to hold regulated entities to account for poor cyber-risk management. The first was FIIG Securities, an Australian fixed-income specialist. It was ordered to pay a $2.5 million pecuniary penalty after ASIC brought a case against the firm for failure to protect thousands of clients from cybersecurity threats for more than four years. FIIG admitted that it failed to comply with its AFSL or its licence obligations and that adequate cybersecurity measures suited to a firm of its size and the sensitivity of client data held would have enabled it to detect and respond to the data breach sooner. It also admitted that complying with its own policies and procedures could have supported earlier detection and prevention of some or all client information being downloaded. The second matter is still before the courts: Fortnum Private Wealth Ltd. ASIC has commenced action in the New South Wales Supreme Court, alleging inadequate cybersecurity governance and controls that exposed the firm, its authorised representatives and its clients to unacceptable cyber-risk. This includes incidents prior to May 2023, one involving a breach of data for more than 9,000 clients. That breach was allegedly published on the dark web. ASIC is seeking declarations and a pecuniary penalty in that matter. It's next before the court on 13 July. CHAIR: Thank you for that update. I'll turn to the mandatory reporting framework. How is that working? Is it working in practice, or does it still need some tweaking to enhance it so that we get more compliance? Mr Savundra : I'm not aware of there being a mandatory reporting obligation into cyberthreats or risks per se. A significant portion of our regulated population is under an obligation to report what are called 'reportable situations' to ASIC. That's where there's a likelihood or there has been a contravention of the law by the relevant entity, but, as far as I'm aware—I'll check with Amanda in a second—where it sees cyber-risks or threats there is no mandatory reporting obligation. However, we—and, obviously, other arms of the Commonwealth—very much encourage entities to report those cyberthreats. Amanda, do you want to add to or respond to that? Ms Zeller : Thanks, Chris. Your assessment is correct in respect of financial services. In relation to financial markets and operators that are covered by the market integrity rules, there is an obligation under those rules to notify ASIC of operational incidents and operational resilience matters, including cyber. They are required to report material incidents to us. It's not a structured framework, such as the reportable situations framework, but I am aware of the development that is proposed under the SOCI legislation for that mandatory reporting portal and the work that is underway there. Certainly, ASIC—and APRA, with the mandatory reporting under their CPS 234 framework—is working very closely with the broader government initiative on the development of that single reporting portal for cyberincident reporting. CHAIR: The submission reported that ASIC has taken down more than 2,500 investment scam and phishing websites since July 2023. How significant is this number against the number of known scam sites? How quickly are those sites typically taken down after they've been identified? How quickly do scammers establish replacement sites? Is the take-down capability keeping pace with the volume of new scam sites being created? Mr Savundra : Chair, they are all very good questions. I'm not sure that I'm in a position to answer all of them, but, certainly, this relates to our scams work. Scams continue to be a strategic priority for ASIC. Our focus is principally on reducing the impact of investment scams. Obviously, we work very closely with the ACCC and the National Anti-Scam Centre, which is the lead agency coordinating scam disruption efforts across the industry. You're correct; since July 2023, we've coordinated the removal, on average, of around 230 investment scams and phishing website scams per week. It's fair to say that some of that will be what we refer to at ASIC as 'whack-a-mole', which is that we close one website down and another one will re-emerge. I'm not sure we have data—I can take it on notice—as to what we see as being the number or extent of scam websites or promotions via digital platforms. It's fair to say that we continue to do what we can in terms of shutting these down, hopefully with a view to deterring those from re-establishing. We work with external partners and the internet service providers that host these platforms and the digital platforms, which, hopefully, through that collaboration and partnership, reduces the amount of recidivism we're seeing, but, obviously, we can't eliminate it. CHAIR: Would the work and the success that you've had in taking down these websites be on par, at an international standard, with the US, England or Canada? Mr Savundra : I believe it is. Again, we get assisted by an external party in relation to these take-downs. A number of these overseas regulators—Canada, obviously, has regional equivalents of ASIC—are utilising the same take-down service. It's an ongoing challenge. The advent of AI has made things quicker and easier. The ability to scrape the web and social media platforms for these is constantly improving across our international peers and, obviously, within Australia, but it's just an ongoing battle. CHAIR: This inquiry is into the capability of law enforcement to deal with cybercrime. Have you any comments in relation to law enforcement from experience of working with them, or areas of concern in which there are gaps? We know the volume is only increasing, but do you have anything to add in relation to law enforcement? Mr Savundra : No. I'll hand to my colleague to talk about how we work with our partners, both Treasury and more broadly. I think that's working well. We share information and intelligence. The challenge for ASIC and other law enforcement agencies is just the speed and rate of change. Frontier AI and other AI will obviously have the potential for us to utilise it ourselves to combat cybercrime but, equally, the rate of change is something we're all grappling with. Amanda, did you +have any observations or comments to add? Ms Zeller : There's a couple of different angles from which I would tackle this. The first is that, after we've seen a cyber incident, in terms of the level of coordination among different agencies we might have overlapping regulatory frameworks for determining what might be an appropriate course of action going forward if any further action should be taken. On the other side, where we're seeing account takeovers, for example, people's financial trading accounts or their brokerage accounts being infiltrated, there is the way that we might act using our financial market levers and working across international financial markets to act to preserve funds and to escalate with businesses quickly where we are seeing activity that is enabled by cybercrime to access those accounts. That partnership is more occurring with the businesses themselves, and they are very responsive to acting to protect their clients and their customers in that regard. At times, we do need to engage with other agencies overseas and at home as well to partner in that protective aspect. There are always opportunities for enhancement, but I think the connections are growing. CHAIR: Thank you. Deputy Chair. Mr BATT: I know your submission was now a while ago, but it states that your greatest concern was the inadequacy of current information-sharing arrangements. Is that still the case? Again, in your submission you mentioned a case concerning a third-party vendor you couldn't get information on. What constraints prevented that? What needs to change, or has it changed since then? Ms Zeller : In that particular instance, we had been engaging through our Council of Financial Regulator colleagues but also with the Department of Home Affairs. I think we had submitted in our submission into the inquiry in 2023 about the limited use protocol, about information being available and about concerns on how it might be used more broadly in terms of a law enforcement context rather than a 'let's respond to a cyber incident' context. There's work that we always need to do given that ASIC is an agency working to promote resilience and protect consumers, but we also have a law enforcement remit. That is a challenge in terms of navigating some of these waters. Information-sharing arrangements have been enhanced since probably the time that we submitted that paper. However, there are always individual challenges that come up. There are conversations we're still having with different agencies. Obviously, ASD has its remit and Home Affairs has its remit, but we're actively engaged in dialogue looking to reduce those friction points and have an open dialogue for the benefit of team Australia so that we can act with appropriate speed and haste. We've been learning from some of those difficulties in the past. I'm not saying it's always frictionless, but I do think there has been an improvement. Mr BATT: Do you think it's more about a legislative change? If it's going to be among departments on what they think they should be sharing or not, should there be some legislative change to make it black and white as to whether it should or shouldn't happen? Could that help? Ms Zeller : That might be a question better directed to someone other than us. I can understand the tension for an agency such as ASD. It is getting all of the information reported to it and is making those decisions on various different grounds about what can be shared. It has that national intelligence aspect to the decisions it is taking. It is about open information sharing where we're clear on the purposes that we're using it. That is always beneficial, but does that need to be legislation as opposed to other arrangements? My suggestion is that would be a matter for government. Chris, is there anything else you can add? Mr Savundra : No, I don't think I've got much to add to on that. Mr BATT: You mentioned the limited-use obligation that came in in 2024. You had some ideas at the time about consequences from that. Did the government respond to your position at the time? Has a solution been found to that? Are you working through that now that it's come into practice? Ms Zeller : It's part of that ongoing conversation and finding an overarching solution rather than on a case-by-case basis. Mr BATT: Your submission focuses on the financial sector, but are there any other sectors adjacent to yours, such as superannuation, payment platforms or crypto exchanges, which you see a risk in but where you're limited in your regulatory oversight? Ms Zeller : That's a very interesting question that needs a very nuanced response as well. There are those that are very clearly within our regulatory remit. Beyond those entities, there are technology vendors that provide services to vast swathes of our regulated population, for example, maybe the financial advice space or credit brokerage space. Those technology vendors aren't necessarily regulated by us, and that can be a challenge. There are also really big vendors that are international where you have less sway because of the size and control of the market that they have. Yes, there are gaps. I know that it is a matter of ongoing conversation. It is something that Home Affairs is quite alive to, and we're speaking to our Council of Financial Regulator colleagues on that particular issue of critical third-party providers. CHAIR: I thank you for your submission and for your time today. It's been informative and we appreciate your time. Thank you very much..