March 7, 2023
Australian universities are unwittingly training Chinese hackers through teaching collaborations with universities in China, cyber security experts have warned.
As universities cash in on partnerships with Chinese institutions to teach information technology courses, industry specialists fear they are “sabotaging’’ efforts to shield Australian banks and infrastructure from offshore cyber attacks.
And the federal opposition is demanding more accountability and transparency of joint teaching ventures with Chinese universities.
Cyber security and automation expert Val Wats, who has consulted to Services Australia and the Australian Taxation Office, on Monday warned against teaching students in China the sophisticated hacking techniques to attack power networks, banking systems and government agencies.
Mr Wats said security clearances should be required for all students studying high-level cyber security tactics – including those in Australia.
“It’s a big problem, and a scary one,’’ he said.
“There needs to be regulation of what information is given to foreigners that can be used against us. If you give them the knowledge and understanding to bring down systems, you literally sabotage yourself, and that is what is happening.’’
Federal opposition cyber security spokesman James Paterson called for controls over what universities were allowed to teach in China.
“We should not be teaching students from foreign authoritarian regimes how to engage in cyber attacks, including against civilian infrastructure,’’ Senator Paterson said.
“The cyber security challenges we face as a nation are hard enough already without training our potential adversaries how to do us harm.’’
Senator Paterson said while there were also risks relating to onshore education, “which need to be carefully considered, mass online education offshore is of much greater concern because of its potential scale and the inability of Australian universities and authorities to exercise any meaningful supervision or oversight of students overseas”.
“This risk is particularly acute with partner institutions who lack institutional autonomy and are closely linked to authoritarian states,” he said.
Senator Paterson is a member of the Parliamentary Joint Committee on Intelligence and Security, and chaired its recent inquiry into national security risks affecting the higher education and research sector. Cyber Security Minister Clare O’Neil has supported the committee’s recommendation that universities “exercise greater caution with international partnerships, PhD students and cybersecurity’’.
Monash University has teamed up with Suzhou University in China to offer a joint masters degree in IT, and with Southeast University China to teach cyber security and machine learning.
Southern Cross University teaches cyber security – including host, data and application security – to Chinese students at Guangxi University of Science and Technology.
The Australian has viewed course notes used by Australian lecturers to teach students in China, with step-by-step technical instructions for the “exploitation of operating systems’’.
“A buffer overflow exploit takes advantage of software coding mistakes that allow an attacker to gain access to a target system,’’ the notes state, before teaching a technique that was used to bring down Ukraine’s power grid in 2015.
Dimitrios Christis, chief operating officer of facial recognition company VixVizion, called for clarity on what universities are teaching offshore.
“We put a lot of time and effort into building technology locally to keep data safe within the country,’’ Mr Christis said.
“Australia is constantly under cyber attack from various countries so why are we contributing to that by teaching overseas people?
“Why would we be training people who could potentially use what we’ve taught against us?’’
Mr Christis said that hackers could also learn skills from the internet, “but it doesn’t mean we need to be helping that effort – should we be actually training people?’’.
Professor Toby Walsh, chief scientist at the University of NSW’s AI Institute, called for tighter visa controls on international PhD students collaborating with Australian research s.
“I would be much less worried about what we are teaching students than what we’re researching with international students,’’ Professor Walsh said.
“What we teach in Australia is no different to what is taught in universities around the planet.
“But when we’re doing research and bringing a PhD student from China, they have possibly unique skills and knowledge they’ll acquire that could be used against Australia.
“We should be worried about that.’’
Professor Walsh, a Laureate fellow and Scientia professor of artificial intelligence who is part of the Kingston Group of 14 top AI experts, said Australia has safeguards on exporting sensitive technological hardware.
“There’s very little safeguards over what we export in the heads of people … we’ve trained up,’’ he said.
“We should be much more careful with people coming from places like China who may use it against us.
“Don’t give visas to people who are intimately connected with a regime we find distasteful, to work on sensitive projects with the potential for misuses.’’
One IT lecturer, who wished to remain anonymous, said he and some colleagues were self-censoring lesson plans shared with Chinese universities.
He said Australian universities were potential teaching many more students through Chinese university collaborations than onshore.
“Many of my cyber security colleagues have not always been entirely comfortable teaching some aspects of offensive cyber techniques into an overtly adversarial nation’s universities,’’ the IT lecturer told The Australian.
“I have self-modified content and techniques that I would teach into nations that are overtly adversarial to Australia.
“As taxpayer-funded institutions, I think there is the need to debate if teaching some techniques into adversarial nations, upskilling an adversary and potentially training entire waves of their cyber security force, is appropriate.’’
The University of Sydney has research or teaching partnerships with eight mainland Chinese universities, including the Chinese Academy of Science and at Fudan University, where researchers are co-operating on the “ethical implications of AI’’.
A University of Sydney spokeswoman said cyber security content is available to all students enrolled in the subject.
“We don’t discriminate on the grounds of race or nationality in the provision of coursework,’’ the spokeswoman said.
“We educate students enrolled in our IT, computer science and cybersecurity courses on the latest social and political issues as well as the technical capabilities needed to tackle cyber security matters and recognise that security risks are real and increasingly sophisticated.
“We support and encourage our researchers to collaborate with international partners in line with all applicable Australian and international laws and government guidelines, and with the university’s objectives, values and policies.’’
A University of NSW spokeswoman said the university has “extensive teaching partnerships with foreign universities from many countries, including China’’.
“UNSW regularly works with DFAT (the Department of Foreign Affairs and Trade) and Home Affairs to ensure these partnerships remain in the national interest,’’ the spokeswoman said.
“The teaching of cybersecurity to international students, both onshore and offshore, and domestic students is identical.’’
The University of Queensland would not name the Chinese universities it collaborates with in teaching or research, but said its international partnership agreements had been “disclosed under the foreign arrangements scheme”.
The University of Melbourne repeatedly ignored questions about whether it taught cyber security tactics to students in China.
“The university has many academic partnerships with organisations around the world, all of which undergo rigorous due diligence processes before being finalised,’’ a spokesman said.
The University of Melbourne website states that it closed its “Melbourne China Study Hubs’’ in Nanjing and Shenzhen last month, but retains hubs in Nanjing and Shanghai.
“The University of Melbourne offers a curriculum designed by academics aligned with industry to allow students to explore the latest advancements in AI and cyber security,” the website says.
