We engaged the Security Research Centre at Edith Cowan University (ECU) to conduct the external
‘Attacks’. We did not provide ECU with any information on agency networks. They were required to seek our approval before attacking any specific IP addresses they identified at agencies. This enabled us to guide ECU in their testing to ensure they did not attack computers that hosted key services.