The Case for Unified Information Handling within the Australian Defence Supply Chain

National governments and defence organisations face significant risks when sharing information between parties and must consider export controls to prevent spillage. For the Defence supplier, additional pressures are evident. Defence contractors must manage their information security and that of their supply chain. They know, all too well, that a breach of export control legislation comes at a great cost.

An often-heard complaint worldwide is that the information received from government agencies doesn't arrive sufficiently accurately marked. Therefore, it becomes the responsibility of defence contractors to interpret, or re-interpret, information sensitivity. Contractors incur significant penalties for failing to assess information sensitivity appropriately and if their assessment failures trigger an information spill across the supply chain.

Most governments and defence agencies have well-defined classification schemes backed by detailed documentation clearly describing which labels to apply under what circumstances. When sharing documents across a supply chain, defence organisations and government agencies typically store documents in "secure" document management systems or behind firewalls, so each supply chain party is reasonably comfortable handling sensitive information with due care. Within these secure systems, documents may or may not be visibly marked with a government security classification.

In our 20 years of global experience with labels and classifications, we know that while most organisations classify emails effectively, users frequently share documents across supply chains with no, inconsistent, or insufficient, or barely visible marking.

How current Defence email marking best practices improve a document marking standard.

Since 2005, the Australian government has standardised email protective marking across its departments and agencies. The standard guides staff and personnel on how to apply visual markings consistently and appropriately. Most governments and defence suppliers do something similar.

However, the Australian government's approach to email marking is unique in two significant ways. First, a metadata packet is automatically added to the email whenever a user decides a suitable classification. The metadata mirrors the visible email classification and travels with the email as it moves between users and systems. Secondly, the metadata is not unique to the sending agency but structured so that any government employee, or government gateway, understands the author's intent.

The connection between visible and metadata markings increases compliance and mitigates, mishandling, cybersecurity risk because humans can react to the visible marking to handle the information, while systems such as data loss prevention (DLP), network gateway solutions use the email metadata to efficiently and effectively route information.

The Australian government email protective marking standard effectively uses a single classification "language". The government defined an email marking standard language in 2005 and required all Commonwealth departments and agencies to use. The standard is well-elaborated, vendor-independent, and adaptable (there have been just two significant changes since 2005). The single, consistent lingua franca for email protective marking reduces the complexity and risk inherent of inconsistent marking and therefore mishandling of information. The standard also makes it easier for IT security administration because it is logical, clearly defined and sets a common minimum standard of configuration for policies and controls. This same standard is being rolled into Australian government contractors over the past few years.

The problem statement: Defence and its supply chain don’t share a common document marking “language.”

Generally, people design systems to prevent the egress of ‘their’ information. If you control communications, it is obvious you are in control. Ask your security team about how your environment controls sensitive information, and they will confidently share sound explanations about the controls, platforms, and solutions that protect data.

However, those security teams are usually responsible for information movement inside an organisation, or at least to the boundary. Few are engaged in securing external information sharing and transactions. A typical attitude prevails: if everyone looks after their information, how can there be security problems? And if you must share information with the customer, or a subcontractor, it is their contractual issue if they fail to handle information correctly.

This attitude overlooks the reality that modern manufacturing demands the skills, assets, and intellectual property of many parties inside, across, and beyond any single organisation. It also overlooks the daily practice of different organisations seeking to reduce risk by marking information.

The table below outlines the problem when different, well-intentioned organisations mark information using a non-standard "language."

The uncomfortable realities of inconsistent document marking across Defence supply chains.

The reality is that different agencies, governments, and their supply chain categorise, protect, and share sensitive data inconsistently due to different implementations of the same information handling rules. These inconsistencies expose organisations to multiple risks, including data breaches, security vulnerabilities, compliance failures, inflated project costs, inefficient supply chain operations, and reduced team productivity. Then add an overlay or risk because some parties in the supply chain don’t add any visual markings.Non-standard labels inevitably increase the risks of data mishandling, non-compliance, inefficient operations, and systems glitches as security software solutions stall without the right context to securely route workflows.

The human consequences of inconsistent data schema include mistrust, miscommunication, poorer decision-making, and extensive operational inefficiencies, errors, risk in supply chains.

The case for a standard document marking schema to reduce Defence risk and cost and improve operational efficiencies.

To the casual observer the supply chain and government are aligned in Australia, at least for email visual markings. However, a national document marking "lingua franca", that is, a standardised tag-and-value system based on the government's data classification schema would:

• Establish standard document handling procedures across all supply chain partners.

• Support personnel in managing information accurately and reducing mistakes.

• Deliver clear evidence and audit trails for information handling.

• Lower project costs by defining and standardizing handling methods.

• Support more efficient supply chain operations by removing the need for personnel to interpret information sensitivity.

• Align all systems in the supply chain under a consistent framework.

• Shift the reliance for data handling from visible markings, which are easily edited, to more consistent metadata tagging.

A very simple example in the table below illustrates how different organisations adopting a standard metadata value could exchange information across a supply chain at a similar sensitivity. 

This is simplified for the example. It is easy to add metadata tags to documents and file to gain this 'translation' effect.

The Australian Department of Defence and its suppliers are uniquely positioned to extend the well-established, successful email marking standard to a document marking standard.

Adopting a common document marking language, a lingua franca, to mark and handle documents helps every organisation in the supply chain mitigate risk, reduce project costs, and improve operational efficiency with a low-cost, achievable solution.

Getting started: three steps to introduce standard document marking.

• First, many Defence personnel who use, or manage teams that use, classifications agree that a document marking standard is a good idea. While those personnel don't typically manage marking standards, we (Defence and industry) can agree to adopt a common language as a collective.

• Second, a shared language provides the foundation for reducing operational costs and risk, dual benefits that appeal to all parties.

• Third, this initiative must be strategic in developing a standard that can adapt over time to respond to evolving marking needs and related terminology.