Australian government agencies and enterprises have failed to take information protection seriously, a founding member of the Australian IT Security Forum, Chris Joscelyne said this week.

Claiming organizations have neglected their responsibility to take a leadership role with policies, process and procedures to protect intellectual property (IP), Joscelyne said Australia lags behind the rest of the world.

"Information is viewed as a highly prized asset in Europe and the US yet it appears to be undervalued in Australian companies," he said.

Speaking at a Security-Assesment.com breakfast briefing in Sydney yesterday, Joscelyne said lack of IP protection falls squarely on the shoulders of business executives.

He said the most negative views his company encounters come from companies that keep pushing their fiduciary duties out to technical staff.

"Quite frankly it is naive, stupid and quite unfair," Joscelyne said, adding that this is an opportunity for CIOs to step in and lead.

"Who is the responsible party? Is it up to the technical people to keep pushing new information upstairs, or is it the responsibility of the people upstairs to take far greater interest in the knowledge capital of the enterprise?" Answering his own question, Joscelyne said it is definitely in the non-technical area where far greater interest needs to be taken.

"One of the problems we face is a clear enterprise goal. We find that most have good intentions, but in terms of turning them into a practical goal, the task is often set aside as something we need to do but do not intend to and this lack of urgency is a matter of concern."

As an example of the slow response rate to such matters, Joscelyne said that, in a move to clarify the framework around the December 2001 Privacy legislation, he contacted the Privacy Commission which said that organizations should take "reasonable steps to secure information and ensure privacy is maintained". The then Privacy Commissioner, Malcolm Crompton said as a basic minimum, companies should fully encrypt laptops that contains important data.

But it was late 2004, Joscelyne said, before the private sector began addressing this issue. In the public sector there are still thousands of government laptops that do not comply, he said.

"Our colleagues in the US and Europe express dismay at how slow Australia has been, and continues to be, in adopting what they believe are fair and reasonable security protections of data," Joscelyne said.

A spokesperson from the Australian Government Information Management Office (AGIMO) said there is currently no direct connection between the Privacy Act and any requirement to encrypt data on laptops used by government employees; however, there is a legal obligation placed on the government under the Privacy Act to protect information relating to individuals or business.

"Government agencies are required to take reasonable steps to protect such information, which may include encrypting information on laptops," the spokesperson said.

"Individual public servants are also obliged to protect information in their keeping, including private and personal information. Agencies should have procedures on what must be done to protect information, but it is the responsibility of the CEO under the Financial Management and Accountability Act."