Victoria Wants to Unmask Online Abusers. A Cyber Safety Expert Says the Tools Already Exist.

The Victorian government announced in 2025 that it intends to draft legislation giving the Victorian Civil and Administrative Tribunal the power to compel social media companies to hand over the real identities of anonymous users who breach the state's anti-vilification laws.

What the Allan Government Is Actually Proposing

Premier Jacinta Allan said the reforms would reach parliament before the November state election. The centrepiece is a new class of civil order, which the government is calling a 'demasking order.' A complainant would apply to VCAT, the tribunal that hears civil disputes in Victoria, and the tribunal could then direct a platform to identify the account holder behind abusive posts that incite hatred or serious contempt on grounds such as race or religion.

A second plank targets parents suing social media and artificial intelligence companies over psychiatric harm to children. Under current law, a parent must demonstrate that a child has suffered a permanent impairment of at least ten percent before courts will even hear the case. The government wants that threshold reduced, though it has not yet specified the new figure.

Premier Allan framed both measures as filling gaps left by inaction at the federal level. She did not detail how either rule would apply to users based outside Australia or to anyone routing their connection through a VPN.

'There Is No Such Thing as an Anonymous Social Media Account'

Susan McLean, a former Victoria Police officer who now consults professionally on cyber safety, pushed back on the premise of the proposal. Speaking publicly on the record, McLean stated plainly: 'There is no such thing as an anonymous social media account.'

Her reasoning is practical. Every major platform, she explained, already operates a dedicated law enforcement portal, a secure channel through which police can formally submit requests for account data. McLean pointed to recent cases involving AFL footballers who received serious online abuse. In those cases, police used the existing portals, obtained the offenders' real details, and made arrests. No new legislation was required.

Her sharper criticism is about victim behaviour, not legal architecture. Most people who receive serious online abuse never file a police report. Routing cases through a civil tribunal, McLean argues, adds procedural complexity without solving that core problem. The question is not whether a mechanism to identify abusers exists. It does. The question is whether victims know to report, and actually do it.

The 2021 Precedent Nobody Wants to Repeat

Victoria's proposal is not the first of its kind. The Morrison federal government introduced a strikingly similar bill in 2021, designed to unmask anonymous online abusers. It never passed parliament. Legal commentators at the time pointed out that even if a victim successfully identified an abuser, the cost of then pursuing litigation against a major technology company was effectively out of reach for most ordinary Australians.

The Victorian plan faces the same structural question. Knowing who sent an abusive message and being able to hold them accountable in any meaningful legal sense are two very different things. The government has offered no answer to the funding gap, nor to the international jurisdictional problem: a significant share of online abuse originates from accounts registered overseas or masked behind VPN services, which substitute a foreign IP address for the user's real one.

The Victorian opposition said it broadly supported the policy direction. The shadow attorney-general did, however, question whether the bill would realistically reach a vote given only four sitting weeks remain before the election.

The Control Failures This Debate Exposes

From a security-awareness perspective, the Victorian debate reveals something worth examining carefully. The friction here is not primarily a legal or technical failure. It is a reporting and awareness failure. McLean's point cuts directly to a pattern that security practitioners see across entirely different contexts: the tools and channels to respond to a threat exist, but people do not use them because they do not know the process, do not believe it will work, or find it too difficult to initiate.

This is, in structure, identical to what happens inside organisations when employees encounter phishing emails, credential theft, or abusive internal communications and simply absorb the harm silently. Awareness that a reporting mechanism exists, combined with genuine confidence that using it will produce a result, is the variable that determines whether a threat gets addressed or ignored. The 2024 Verizon Data Breach Investigations Report found that the human element remains a factor in the overwhelming majority of breaches, not because people are careless, but because they lack clear, practiced responses to specific threat scenarios.

Building that muscle, whether the threat is an online troll or a spear-phishing email, requires repeated, contextualised training. That is precisely where programs like those offered at Train2Secure map awareness to the specific behaviours that reduce real-world harm.

What Defenders and Ordinary Users Should Take Away

The policy ambition behind Victoria's proposal is legitimate. Persistent online abuse causes genuine psychiatric harm, and platforms have historically been slow to act without formal pressure. But good policy intent does not substitute for usable process.

For individuals experiencing serious online abuse right now, McLean's advice is the actionable takeaway: go to police directly. Law enforcement portals exist, they work, and investigators use them routinely. Waiting for new legislation to pass, assuming it passes at all, is not a strategy.

For organisations thinking about the broader principle, the lesson is the same one that applies to every incident response framework. A control that exists but is never activated provides no protection. Regular drills, clear escalation paths, and an organisational culture that normalises reporting are the practical differences between a threat that gets contained and one that compounds.

Anyone wanting to benchmark their current training coverage against real-world policy and compliance requirements can review available frameworks at Train2Secure.