2. Promote access to trusted support after an incident Information provided to Government in the early stages of a cyber incident is critical to effective incident response. We will encourage open engagement with Government during an incident by co-designing options to legislate a limited use obligation for ASD and the Cyber Coordinator. This obligation would aim to limit how information that industry shares with ASD and the Coordinator can be used by other Australian Government entities, including regulators. A limited use obligation would not impact regulatory or law enforcement actions, or provide an immunity from legal liability. As an immediate step, we will start by developing an interim approach for ASD. The Government also seeks to provide business and community leaders with greater confidence when they engage cyber security professionals. This will include co-designing an industry code of practice for incident response providers. This code will clearly define the service quality and professional standards that are expected from third-party cyber incident response providers. This code will be co-designed with industry to ensure that cyber security firms provide fit-forpurpose services consistent with public expectations. 7 Secure our identities and provide better support to victims of identity theft The problem we face Our identities are one of the most sensitive and valuable types of personal data. Cybercriminals go to great lengths to steal identities of Australian citizens, including through large-scale breaches of business customer data. Personal data, including identity information, is bought and sold on the dark web for a high price. Identity theft can have devastating consequences for individuals. Recent high-profile cyber incidents have demonstrated the enduring harms experienced by Australians if their identities are stolen. Victims of identity theft may spend days or weeks trying to reclaim their stolen identities, facing significant financial loss. Currently, victims need to navigate a complex web of services and are often left to shoulder the emotional and financial burdens alone. Diverse communities can be more vulnerable to cyber incidents and face additional barriers in seeking assistance. Culturally and linguistically diverse groups may face language barriers when seeking support. People who are hard of hearing may find it challenging to access support services if capacity constraints restrict in-person support. Other groups – including First Nations communities and seniors – face significant challenges if their identities are lost. Beyond the personal toll on victims, identity theft has a substantial collective impact on society at large. The most recent survey in 2019 indicated that identity theft has cost Australia more than $3.1 billion6 and has affected 20 per cent of Australians.7 If identities can be easily stolen or defrauded, our communities may lose trust in our public institutions. Essential services that rely on digital identity verification – such as our financial and banking systems – could be at risk of severe disruption. 6. Australian Institute of Criminology (AIC) (2021). Identity crime and misuse in Australia: Results of the 2021 online survey. 7. AIC (2023). Cybercrime in Australia 2023. 26 2023–2030 Australian Cyber Security Strategy