# The Infrastructure Gazette

> News and analysis on cyber security, AI regulation, supply chains and critical infrastructure for Australian technology, risk and compliance leaders.

Editor's briefing First edition · 14 November 2026 The Infrastructure Gazette covers security, technology and the systems Australian organisations run on. This first edition brings together recent analysis from academics writing in The Conversation with our own reporting on Australian industry. One theme runs through almost all of it: dependence. New pieces are added as the news warrants, and every change is logged in the edition notes. One provider, many failures When Microsoft's services failed this week, email and cloud storage stopped for people across the world. Mahmoud Elkhodr of CQUniversity explains what went wrong and argues that organisations relying on a single provider need backup plans they have actually tested, the way they run fire drills. In a companion piece, Narmin Nahidi of the University of Exeter counts the costs of digital dependence , including environmental costs that rarely show up on a balance sheet. Elkhodr's earlier piece on what would happen if the internet went down is a useful primer for anyone writing a continuity plan. The device in the corner Some of the most telling stories this season are about ordinary devices. Vincent Charles and Tatiana Gherman look at the supermarket fridge hack and what it shows about the internet of things: attackers are using physical devices to spread disruption. Dennis Desmond of the University of the Sunshine Coast makes a similar case about connected cars . The Australian Signals Directorate's latest annual threat report says most China-linked state hacking groups now route their operations through compromised office routers and smart devices. That puts the humble network box in the corner of the office firmly inside the threat model. It also raises a question few organisations can answer: is the hardware they bought the hardware the manufacturer made? Our industry desk reports on a new Australian service that inspects it , BoardSafe , and we put five questions to Kunal Miind , whose company built it. The rules arrive On 10 November the Prime Minister announced mandatory AI safety and security protections and a new regulator. Henry Fraser of QUT asks whether the new rules focus on the right risks . Abu Barkat ullah of the University of Canberra warns that AI agents are raising the stakes for legacy government systems , and Bogdan Księżopolski draws lessons from the Binance hack that apply well beyond crypto. For operators, the AI rules sit on top of obligations that already exist. The SOCI risk management program rules require critical infrastructure entities to manage supply chain hazards, and APRA's CPS 230 requires financial entities to manage the risk from their service providers. The common thread is evidence: regulators increasingly want to see how risk is managed, not just read that it is. Infrastructure and its neighbours Finally, Johanna Lim and Olivia Shen of the University of Sydney look at the US voter backlash against data centres and what it means for Australia's AI plans , and Andrew Cullen of the University of Melbourne explains why Nvidia matters so much to the AI industry, and what a scandal at the top could cost. Resilience is a board question now Read together, these pieces describe a shift in who owns technology risk. Outages, hacked devices and compromised suppliers used to be problems for the IT team. Now they show up in prudential standards, critical infrastructure law and, soon, AI legislation, and each of those puts accountability with directors and executives. The practical result is that technology leaders are being asked for evidence they have rarely had to produce before: tested continuity plans, registers of material suppliers, records of what was checked and when. That is a useful lens for every story in this edition. When Elkhodr calls for backup plans that are tested rather than written, he is describing the kind of evidence a regulator now expects. When Fraser asks whether the new AI rules target the right harms, he is asking what organisations will have to prove. And when ASD warns about compromised routers, it raises the question of how anyone would know whether their own were among them. What to watch The AI legislation. The Government has announced the obligations, including incident reporting and published safety frameworks, but the bill and the standards that will carry the detail are still to come. Expect consultation on what counts as a serious incident and how fast it must be reported. Supplier questions in tenders. With 48% of breaches worldwide involving a third party, according to Verizon's 2026 report, buyers are asking suppliers harder questions. Critical infrastructure operators have to cover supply chain hazards in their risk programs, and that pressure flows down to the companies that sell to them. Devices on the network. Routers, phone systems and building controllers rarely get the scrutiny that laptops and servers do. The ASD's warning about compromised office routers and the US counterfeit Cisco case , where fake network gear reached hospitals and military systems, suggest that is starting to change. Data centre approvals. Australia wants to host more AI computing, and that means more large data centres drawing on local power and water. Lim and Shen's account of the US backlash is a preview of the planning fights Australian councils and communities may face, and of the questions investors will ask before they build. The cost of espionage. The Australian Institute of Criminology puts the cost of espionage to the Australian economy at A$12.5 billion in 2023-24 and calls that an underestimate. Expect more boards to ask where their exposure sits. Republished pieces appear unedited, with their authors' names and institutions and a link to the original. Our editorial standards and republishing policy are on the about page . Corrections and tips go to newsroom@infragazette.site .

Last updated: 2026-11-14

## Main pages
- [The Infrastructure Gazette: security, technology and infrastructure news and analysis for Australia](https://infragazette.site/): News and analysis on cyber security, AI regulation, supply chains and critical infrastructure for Australian technology, risk and compliance leaders.
- [Microsoft has suffered a global outage. A tech expert explains what went wrong](https://infragazette.site/microsoft-global-outage-what-went-wrong/): Microsoft's outage stopped email and cloud storage worldwide. Mahmoud Elkhodr (CQUniversity) on what went wrong and why organisations need tested backup plans.
- [Could you survive without Microsoft? Inside the costs of digital dependence](https://infragazette.site/could-you-survive-without-microsoft/): Narmin Nahidi (University of Exeter) on the hidden costs of depending on one digital provider, including environmental costs that are rarely counted.
- [Australia will impose mandatory safety rules on AI. Are we focused on the right risks?](https://infragazette.site/australia-mandatory-ai-safety-rules-right-risks/): Australia will impose mandatory safety rules on AI. Henry Fraser (QUT) asks whether the focus is right, or whether known AI harms will stay unaddressed.
- [The supermarket fridge hack exposes the cracks in tech vision of an ‘internet of things’](https://infragazette.site/supermarket-fridge-hack-internet-of-things/): Hackers are exploiting physical devices to spread disruption. Vincent Charles and Tatiana Gherman on what the supermarket fridge hack says about devices.
- [Why is Nvidia so powerful in the AI world, and what could Jensen Huang’s scandal really cost?](https://infragazette.site/why-nvidia-is-so-powerful-in-ai/): A tech CEO's affair with a suspected spy is rocking the AI industry. Andrew Cullen (University of Melbourne) on Nvidia's power and what is at stake.
- [US voters lashed out at data centres. What does that mean for Australia’s AI ambitions?](https://infragazette.site/data-centre-backlash-australia-ai-ambitions/): US voters pushed back against data centres. Johanna Lim and Olivia Shen (University of Sydney) on what that means for Australia's AI ambitions.
- [The Binance hack exploited familiar weaknesses – all organisations should learn from it](https://infragazette.site/binance-hack-familiar-weaknesses-lessons/): Hackers got in through an IT engineer's laptop. Bogdan Księżopolski (Kozminski University) on the familiar weaknesses behind the Binance hack and the lessons.
- [What would happen if the internet went down?](https://infragazette.site/what-would-happen-if-the-internet-went-down/): It is impossible to switch off the whole internet, but large outages happen. Mahmoud Elkhodr (CQUniversity) on what would fail and how to be prepared.
- [Australia’s legacy systems were already a cyber risk. AI agents are raising the stakes](https://infragazette.site/legacy-systems-ai-agents-cyber-risk-australia/): Most Australian government entities run outdated technology. Abu Barkat ullah (University of Canberra) on why AI agents raise the stakes for legacy systems.
- [Worried about your car being hacked? You should be – no matter where it was made](https://infragazette.site/car-hacking-risk-no-matter-where-it-was-made/): Connected vehicles can be hacked, putting safety and privacy at risk. Dennis Desmond (USC) on why that matters wherever cars are made.
- [Spy chips and fake parts: Australian operators start inspecting their hardware](https://infragazette.site/hardware-integrity-checks-australia-boardsafe/): BoardSafe checks phone systems, servers and routers for spy chips, fake parts and altered firmware as regulators push supply chain risk onto suppliers.
- [Five questions for Kunal Miind: why hardware is the blind spot in supply chain security](https://infragazette.site/kunal-miind-interview-hardware-supply-chain-security/): Vedametric founder and CEO Kunal Miind on hardware integrity checks, who is asking for them, SOCI and CPS 230, and where compliance teams should start.

## Sources
- [Prime Minister: new Australian AI safety and security protections](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections)
- [Security of Critical Infrastructure (CIRMP) Rules](https://www.legislation.gov.au/F2023L00112/latest/text)
- [CISC: SOCI regulatory obligations](https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations)
- [APRA: CPS 230 Operational Risk Management](https://www.apra.gov.au/operational-risk-management)
- [ASD Annual Cyber Threat Report 2025-26](https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf)
- [Australian Institute of Criminology: the cost of espionage](https://www.aic.gov.au/sites/default/files/2025-08/the_cost_of_espionage.pdf)
- [GSA OIG: counterfeit Cisco equipment sentencing](https://gsaig.gov/news/leader-massive-scheme-traffic-fraudulent-and-counterfeit-cisco-networking-equipment-sentenced)
- [Verizon 2026 DBIR executive summary](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf)

## Optional
- [Full text of this site as Markdown](https://infragazette.site/llms-full.txt)
- [About](https://infragazette.site/about-the-gazette/)
- [Contact](https://infragazette.site/contact-the-newsroom/)