In January, Canadian Prime Minister Mark Carney told the World Economic Forum something that Western democracies have long known but rarely said in public. The rules-based international order, he observed, was always a pleasant fiction. The strongest exempted themselves when convenient. Trade rules were enforced asymmetrically. International law applied with varying rigour depending on who was accused and who was the victim.
The speech received a standing ovation. It deserved one.
The contest is already underway. State actors have quietly acquired agricultural land near Australian defence facilities, seeded our universities with research partnerships that migrate intellectual property, and used economic coercion – most visibly in trade restrictions targeting our barley, wine and coal – to demonstrate that the instruments of statecraft now precede the instruments of war.
Russian disinformation has colonised the same digital infrastructure we built for democratic participation. The grey zone is not a category of future threat; it is the operating environment we are already inside, poorly mapped and barely understood. Australia’s response has been earnest, technically serious and conceptually misaligned. This isn’t because of policy negligence – many of the vulnerabilities were the intended outcomes of good policy. Rather, it’s because we keep designing answers for a fight our adversaries are not fighting.
But for those of us who have spent careers at the intersection of information warfare and national security, Carney’s honesty prompted a harder question, one that his speech approached but didn’t answer. If we always knew the story was partially false, why have we built our entire grey-zone response architecture on the assumption that it was true?
The first miscalculation: we designed a response for an adversary that doesn’t exist
Australia has invested significantly in understanding and responding to grey-zone threats. The analytical community is sharp. The institutional awareness within Defence is more sophisticated than the public debate reflects. And yet we keep getting it wrong in the same way.
We label adversary behaviour as unconventional, asymmetric and hybrid. We treat it as cheating – as a violation of a framework that we designed and invited ourselves into, and that we are perpetually surprised to find others don’t observe.
We are, to put it plainly, the child who sets the playground rules and cries when the other children don’t comply. The other children were never at the meeting where the rules were agreed. They have no obligation to feel they’re breaking them.
This is not merely an analytical problem; it is a structural one. Our grey-zone response architecture was designed for a threat that behaves like a rule-breaking state: one that understands our framework, has chosen to violate it, and can therefore be deterred, attributed and countered within that framework’s logic.
The actual threat operates from entirely different assumptions about what the world is and how power functions within it. They are not cheating. We are just labouring under a false premise.
Japan understood this long before Australia did. It has been formally developing grey-zone doctrine since 2010, 15 years before the concept entered mainstream Australian strategic discourse.
That is not a coincidence but rather the product of living under persistent sub-threshold pressure without the luxury of treating it as a future problem. Japan’s neighbourhood has never included the comfortable fiction of a reliably enforced rules-based order. Its immediate strategic environment has always featured actors who operate from different assumptions about sovereignty, coercion, and what constitutes an act of aggression. Japan didn’t get to be surprised when the rules weren’t followed. It built doctrine, operational experience and technology for the world as it actually is.
That accumulated knowledge, hard won over decades of operating under persistent pressure without the luxury of strategic surprise, is perhaps the most underutilised asset in the Australia–Japan partnership.
We talk extensively about what Japan’s industrial capability can contribute to our defence. We talk far less about what Japan’s operational and conceptual experience can contribute to how we think. The bilateral relationship that produced the Mogami-class frigate selection should also produce a genuine transfer of strategic epistemology of how Japan understands the grey-zone contest, not just how it equips for it.
The second miscalculation: our greatest strength is also our greatest vulnerability
Australia’s grey-zone vulnerability is, in significant part, self-inflicted. We have spent three decades building exactly the kind of society that makes grey-zone exploitation easy: open, digitally integrated, data-rich, institutionally transparent and economically interdependent with the very states whose grey-zone activity we’re now trying to counter. These are not shortcomings of policy, but rather are, in most cases, the intended outcome of good policy: a prosperous, connected, democratic society. But they also form a near-perfect attack surface.
Carney’s observation is directly applicable here. Great powers have learned to use economic integration as a weapon; supply chains as vulnerabilities; financial infrastructure as coercion; and data flows as intelligence. Australia has been building its grey-zone response as though the attack surface were primarily military. The actual attack surface is the entire fabric of our open society.
This creates a problem that no combination of defence capabilities can fully solve. You cannot classify your way out of an open society. You cannot clear your way out of an interconnected economy. The grey zone is not an intrusion into our system but rather an exploitation of our system as designed.
The implication is significant. Grey-zone resilience requires a whole-of-nation response, not just a whole-of-government one. That conversation has begun but has not escaped the same false premise that corrupts the broader response. Critical infrastructure protection is framed as a compliance problem. Data sovereignty is framed as a technology governance challenge. The whole-of-nation conversation we are having is still organised around the idea that adversaries are breaking rules and that better technical defences will stop them. They won’t. A society cannot defend itself against an adversary it fundamentally misunderstands regardless of how sophisticated its technical response becomes.
The third miscalculation: we treat data as a technology problem when our adversaries treat it as a commodity
The distinction matters more than it appears. When an institution sees data as a technology problem, it responds with governance frameworks, integration architecture, technologies and policy compliance. These are necessary but not sufficient. They are the response of an organisation that understands data needs to be managed better, not one that understands data is a primary strategic asset to be exploited and protected with the same urgency we apply to physical capability.
Consider how the commercial world, specifically the platform and e-commerce economy, approaches data. It is treated as the most valuable commodity that organisations possess. Its protection is not a compliance function but rather an existential priority. Its exploitation is not an IT project; it is the core competitive activity. Entire strategic decisions are made based on data that has been acquired, analysed and weaponised in real time.
Adversaries who operate without our institutional constraints approach data exactly this way. Rather than data governance programs, they are running data exploitation operations. The asymmetry between us is not primarily technical; it is conceptual.
Australia’s defence institutions are still grasping this structural challenge. Investment has grown. Senior appointments signal genuine acknowledgment that data requires dedicated attention. But technology remains the dominant institutional lens: data as something to be integrated, governed and secured. This contrasts with the lens of commodity: data as the primary terrain of the grey-zone contest itself.
The same issue is even more pronounced in industry. Too many technology companies arrive at Defence conversations with a solution looking for a problem – a platform, product or managed service rather than a genuine understanding of the operational environment the customer is navigating. The industry partners who will matter most in Australia’s grey-zone response are not just those with the most advanced technology. They are those who understand the contest deeply enough to know what the technology needs to do and why the current framing of that question is incomplete.
The shift required is not one of investment alone; it is also one of framing. Until both Defence and its industry partners treat data the way a platform economy treats its most valuable asset, as something to be understood, exploited and protected in that order; the governance frameworks and integration programs, however well designed, will remain a sophisticated solution to the wrong problem.
What a genuine response would look like
None of these miscalculations is inevitable. Each has a corrective.
The first requires intellectual honesty about the conceptual framework we use to understand adversary behaviour and a willingness to build a response architecture that starts from the world as it is rather than the world the rules-based order assumed.
Japan is an available and most willing teacher for that lesson. The depth of the bilateral relationship now justifies the depth of that conversation.
The second requires acknowledging that grey-zone resilience is a societal challenge, not a Defence one, and that the conversation we are currently having, while necessary, will not produce material change until it escapes the rules-and-technology frame that limits it. The institutions, regulatory frameworks and cultural practices that govern how Australia manages its data, critical infrastructure and economic dependencies all constitute grey-zone terrain. Treating them as such requires a fundamentally different conversation, one that begins not with what rules are being broken but with what contest is actually being waged.
The third requires industry to do what Defence cannot do alone: bring genuine operational understanding to the technology relationship rather than leading with the product. The companies that will build Australia’s grey-zone capability over the next decade will be the ones that have invested in understanding the contest at the level of concept, not just capability.
Australia is a middle power navigating a fractured order without the comfortable fictions that once made that navigation feel manageable. Carney’s counsel to middle powers was to name reality and act on it. For Australia’s grey-zone response, naming reality means acknowledging that the contest is already underway, that our response architecture was designed for a different fight, and that the corrective requires not more investment in the current model but the intellectual courage to build a different one.
The grey zone is not a horizon. It is the ground we are already standing on.
