In February 2019, three weeks before the Australian federal election, the Australian Signals Directorate disclosed that the Parliament House network had been breached by a sophisticated state actor. This report examines the threat context, the ITGC implications for government networks, and the broader challenge of defending democratic institutions from nation-state espionage.
Marco Cavani
Cybersecurity Analyst
On 18 February 2019, the Australian Prime Minister Scott Morrison disclosed that the Australian Parliament House computer network had been compromised by a “sophisticated state actor.” The breach was detected by the Australian Signals Directorate (ASD), Australia’s national cybersecurity and signals intelligence agency. The disclosure occurred approximately three weeks before the 2019 Australian federal election.
The Prime Minister’s statement did not name the responsible state. Australian media, citing intelligence officials, subsequently reported that the attack was attributed to China’s Ministry of State Security. The Chinese government denied involvement.
The breach is significant beyond Australia’s borders as a case study in the persistent threat to democratic institutions from state-sponsored actors seeking political intelligence before elections. The timing, scale, and sophistication of the attack reflect a pattern observed in multiple Western democracies: the targeting of legislative networks, political party systems, and electoral infrastructure in the period before significant votes.
Date disclosed: 18 February 2019
Target: Parliament House network, Canberra, Australia
Threat actor: Sophisticated state actor (China attributed in media reporting; not confirmed by Australian government)
Timing: Three weeks before the 18 May 2019 Australian federal election
Data accessed: Not publicly confirmed; likely communications, strategy documents, and personnel data of parliamentarians, staff, and political parties
Systems affected: Parliament House IT network; also believed to include systems used by the Liberal, Labor, and National parties
Attribution: Not formally stated by the Australian government; China attributed in media reports citing intelligence sources
The Australian government provided limited technical detail about the Parliament House breach in its public communications. Based on the ASD’s public guidance issued in relation to the breach, the following can be assessed:
Entry vector: State-sponsored actors targeting political institutions most commonly use spear-phishing emails targeting individual parliamentarians, advisers, and staff. The Parliament House network, which spans a large number of users with varying technical literacy, presents a substantial phishing attack surface.
Lateral movement and persistence: Sophisticated state actors do not typically deploy ransomware or wiper malware against political targets. Their objective is intelligence collection: they seek to establish persistent, undetected access to systems and exfiltrate documents, communications, and strategic planning materials. This requires lateral movement from the initial compromise point to the systems holding the most valuable information.
Scope of access: The fact that the breach was detected and disclosed suggests that ASD’s monitoring of the Parliament House network identified the intrusion. The data accessed was not publicly confirmed, but the targeting logic for a political intelligence collection operation would focus on communications between politicians and their advisers, policy development documents, and potentially political party strategic planning materials.
Political party systems: Media reporting subsequent to the Prime Minister’s announcement indicated that the computer systems of the three major political parties (Liberal, Labor, and National) had also been accessed. Party systems typically have weaker security postures than government networks.
The Parliament House breach is one of several publicly disclosed attacks on democratic institutions in the five years prior to its occurrence:
2016 Democratic National Committee (US): GRU hackers accessed the DNC’s email systems and exfiltrated communications that were subsequently released through WikiLeaks in an operation assessed by US intelligence to be aimed at influencing the 2016 presidential election.
2017 Emmanuel Macron campaign (France): A dump of Macron campaign documents was released 44 hours before the French presidential election runoff, attributed to APT28 (GRU).
2017 Bundestag (Germany): APT28 maintained access to the Bundestag network for an extended period, exfiltrating parliamentary documents and communications.
2019 Parliament House (Australia): The pattern of pre-election targeting of legislative and political infrastructure.
The consistency of this pattern across Western democracies reflects a deliberate strategic approach: democratic institutions hold communications, strategy documents, and personnel data whose compromise and selective release can influence electoral outcomes without ever reaching the headline of “election result was manipulated.”
The Parliament House breach illustrates control challenges specific to government and parliamentary networks:
Phishing resilience across a diverse user population: A parliament has hundreds of users ranging from technology-literate staff to older members with limited technical training. Deploying consistent phishing defences across this population, including MFA for all accounts and email authentication controls (DMARC, DKIM, SPF), is more complex than in a corporate environment with a more homogeneous user base.
Privileged access monitoring: State actors targeting a parliamentary network seek to escalate from a compromise of a parliamentary staff account to access to communications and systems used by parliamentarians and their advisers. Privileged access monitoring that detects anomalous authentication and access patterns is the control that identifies lateral movement before intelligence collection is complete.
Network segmentation between parliamentary and party systems: The breach appears to have extended to political party systems as well as Parliament House itself. Network boundaries between the Parliament House IT environment and systems operated by political parties, which typically have independent and less mature security environments, represent a control gap.
Classified information handling: Parliamentary communications that contain sensitive policy positions or intelligence briefings should be handled through systems with appropriate classification controls, rather than through standard email or document management systems that share the Parliament House network.
Counterintelligence culture: Technical controls are only as effective as the people operating within them. A parliamentary environment that does not have a culture of security awareness, including recognition of spear-phishing targeting senior staff, is vulnerable to entry vectors that bypass technical controls.
Parliamentary networks have several structural characteristics that make them more difficult to defend than corporate or government agency networks:
Constitutional independence: Parliament is constitutionally independent of the executive. The government’s security agencies (ASD, ASIO) have advisory rather than operational authority over parliamentary systems. The parliamentary administration makes its own security decisions.
Openness imperative: Democratic institutions operate on a principle of openness. Constituents contact their representatives. Media access information. Foreign diplomats and delegations visit. This openness is incompatible with the closed-network approach of classified government systems.
High-value, low-security targets: Political parties and campaign organisations hold extremely high-value intelligence targets (strategy, candidate positions, internal communications) but typically have minimal IT security budgets and expertise.
No-patch culture for political systems: Parliamentary technology systems, particularly email and document management, are often legacy platforms that cannot be rapidly updated without political and administrative complexity.
These structural characteristics mean that parliamentary networks will always be more difficult to defend than comparable corporate or government agency environments. The implication is that detection and response capabilities, rather than prevention controls alone, must be the primary defence framework.
Implement MFA universally, including for the most senior and the least technical users. The political sensitivity of requiring parliamentarians to use hardware security keys is real but manageable. The alternative, which is a parliament where any account can be compromised with a phishing email, is untenable. Hardware MFA on email and key systems should be non-negotiable.
Deploy DMARC enforcement for parliamentary email domains. Phishing that spoofs a parliamentarian’s email address is trivially enabled by the absence of DMARC. DMARC enforcement with reject policy eliminates the spoofing attack vector entirely and is a low-complexity, high-impact control.
Separate sensitive communications from the general parliamentary network. Communications between parliamentarians and intelligence briefers, and between political parties and their campaign strategists, should use systems that are logically or physically separated from the general Parliament House IT environment.
Fund political party cybersecurity as an infrastructure investment. Political parties are high-value intelligence targets with minimal security resources. Government funding for baseline security controls in registered political parties (MFA, endpoint protection, secure communications) is an investment in electoral integrity.
Treat pre-election periods as elevated threat periods with enhanced monitoring. The pattern of pre-election targeting of democratic institutions is well established. Increasing network monitoring, threat hunting activity, and user awareness messaging in the months before a significant election is an appropriate response to the elevated threat environment.
The ITGC controls most directly implicated in this incident map to the following audit testing areas:
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
In November 2023, a cyberattack forced DP World Australia to take its port operations offline for four days, stranding 30,000 containers at four major Australian ports. The incident demonstrated that a single managed logistics provider's security posture could be leveraged to disrupt 40 percent of Australia's container port capacity.
On 12 May 2017, WannaCry ransomware encrypted devices across 80 NHS organisations in England, forcing the cancellation of at least 19,000 appointments and procedures. This report examines how a nation-state-developed exploit became a criminal weapon and what it exposed about patch management and network segmentation in public health infrastructure.
On 5 February 2021, an attacker remotely accessed the control system of the Oldsmar, Florida water treatment plant and raised the sodium hydroxide concentration to 111 times the safe level. An alert operator noticed the cursor moving and reversed the change. This near-miss exposed the open remote access vulnerabilities common in small water utilities across the US.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
