0
00:00:10,000 --> 00:00:11,000
Jen Ellis:

1
00:00:10,000 --> 00:00:11,000
We are going to get started then. Thank you for joining us. This session is called Moving Regulation Upstream, an Increasing Focus on the Role of Digital Service Providers. And the gist basically is that we have, for those of us who have worked in or collaborated with cyber policy makers over recent years, there's been a lot of focus on what end user organizations should and should not do. And I think more recently, as two things have happened, one, there's been a sort of rise in supply chain attacks and, two, there's been a greater level of acknowledgement of how hard it is to reach SMBs and those that operate below the security poverty line. And for those who are not familiar with that term, it's fairly self explanatory, organizations that don't have the resources or capability to really build a mature and maturing security program. So as there's been an acknowledgement of those two things, I think policy makers around the world have started looking at the role of digital service providers.

2
00:00:10,000 --> 00:00:11,000
And then in the past two years, I don't know if you guys know, but a thing happened a couple of years ago. There was this pandemic thing and so,... This is terrible. And so we all suddenly really quickly moved to remote. That happened very, very quickly. There was huge adoption of cloud, it accelerated massively. And so all of a sudden that role of third party digital service providers, particularly in the cloud, became even more important. So I think it's accelerated the way that some governments are thinking about this problem.

3
00:00:10,000 --> 00:00:11,000
And we've seen things, like in the network and information systems directive in the EU, there has been an acknowledgement of the role and importance of cloud service providers to essential organizations for a while. But the EU is currently updating this, and is looking at really strengthening those pieces around the expectations of digital service providers. The UK has also been looking at that role in their update to NIS, and so we thought that we would come together today and talk about this issue, because I think it is something that policy makers are thinking about today. So it's your ability as the DEF CON community to help influence those policy conversations.

4
00:00:10,000 --> 00:00:11,000
And so I have brought two tame live policy makers with me. So I'm joined today by Adam Dobell from the Australian government, and I'm going to let him introduce himself properly in a second. And also Irfan Hemani, is that right? How badly am I slaughtering your name? It's okay. From the UK government. So I'll hand it off to Adam, to just quickly introduce himself, and we'll move on.

5
00:00:10,000 --> 00:00:11,000
Adam Dobell:

6
00:00:10,000 --> 00:00:11,000
Thanks, Jen. Hi, all. And it feels quite odd to be speaking at a conference here in the USA without a representative from the US government, but we'll make do. I'm Adam Dobell, I'm from the Department of Home Affairs, which is the principal agency in Australia responsible for cyber security policy and strategy. I'm based out of the embassy in Washington DC, so primarily engaging with US government agencies, Homeland Security, NSC, Department of Justice and the like.

7
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

8
00:00:10,000 --> 00:00:11,000
Hi, I'm Irfan Hemani. I'm from the UK's Department for Digital Culture, Media and Sport, the digital bit, not the culture, media and sport bit. I'm not here to talk about the Commonwealth Games and all of those other fun things that are happening in that department at the moment. I've, over the last year and a half, worked with various countries, businesses, individuals, organizations, to look at what we need to do to adapt UK government policy and UK legislation to address these challenges. So I'm very, very happy to be hearing from people here. I'm exceptionally excited to be hearing criticisms of what we've all been doing, and how we've all got things wrong because we hear a lot of-

9
00:00:10,000 --> 00:00:11,000
Jen Ellis:

10
00:00:10,000 --> 00:00:11,000
Careful what you wish for.

11
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

12
00:00:10,000 --> 00:00:11,000
Well, we get a lot of encouragement, and I think that's partly because not much is done in this space. So I think anything is good, in some senses, but we're not going to do this well unless we have real challenge. And that's why we were quite keen to come to DEF CON, and talk about it. Because if there's anywhere that people hate policy makers and government, it's DEF CON.

13
00:00:10,000 --> 00:00:11,000
Jen Ellis:

14
00:00:10,000 --> 00:00:11,000
I think that's more law enforcement than policy makers, but sure. And of course I realized that I've done a terrible job at introducing myself. So I'm Jen Ellis, I'm Rapid7's VP of... See, this is why I don't do it, because I don't know my title. VP of Community and Public Affairs. So thank you for joining us.

15
00:00:10,000 --> 00:00:11,000
So to just kick us off, I want to ask the guys some questions, but I do want to keep the conversation as interactive as possible and give everyone a chance to in. So what I'll do, if it's okay with everyone here, is I'll ask a couple of foundational questions just to get us started with the guys, and then if people have questions or comments they want to make, and they are a follow-up, can you do a two finger, and I'll try and keep track of it and call on people? Two fingers like this is also fine, whatever works best for you. Thank you so much.

16
00:00:10,000 --> 00:00:11,000
And then, if it's a new point, just a single finger again, it can be this, I don't really care. Just one finger is good. Awesome. So we are talking a lot here about resilience, and I think that's a word that we bandy around quite a lot. What do we actually mean when we say resilience? And one of the questions I'm always interested in is how prescriptive can or should governments be on the topic of resilience?

17
00:00:10,000 --> 00:00:11,000
Fight.

18
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

19
00:00:10,000 --> 00:00:11,000
Fight for it.

20
00:00:10,000 --> 00:00:11,000
I'll take the first bit, and then maybe go on from there.

21
00:00:10,000 --> 00:00:11,000
Jen Ellis:

22
00:00:10,000 --> 00:00:11,000
So you'll leave the harder bit of course Adam.

23
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

24
00:00:10,000 --> 00:00:11,000
Absolutely. So resilience, really broad topic being talked about well outside of cyber policy, particularly at the moment with geopolitical tensions. But cyber resilience, so the UK's talked a lot about and the US even, Chris was talking about this morning, cyber power, which is often talked about in the context of offensive or destructive capability. But actually, certainly to me and to many in the UK government, it's around everything else around what we're doing around cyber. And a lot of that is around cyber resilience. And so I think often when we talk about cyber power, we're thinking of the national security side of things, whereas actually, there's a massive economic angle to this, an economic prosperity angle to this. And I think getting cyber resilience right means that all of the great things that happen around digital technologies can happen well, and with risk minimized, and people getting the most that they can out of them.

25
00:00:10,000 --> 00:00:11,000
And so for me, getting cyber resilience right actually means getting a country to take advantage of its digital capabilities and actually building it as a cyber power. And it's really impossible to do that now without thinking about digital supply chains. There are very few things that we rely on as much as digital supply chains. I think making sure that we've got the right balance of encouraging them to grow, encouraging people to take them on, to use them, and making sure that they are well protected, is really important. So for me, when we talk about resilience, this not just a national security issue, this is an economic prosperity issue.

26
00:00:10,000 --> 00:00:11,000
Speaker 1:

27
00:00:10,000 --> 00:00:11,000
I don't want [inaudible 00:08:03] immediately, but the UK was, if rather thorough, also rather late in looking at the Huawei issue. And it seems hard to reconcile the idea of looking at cyber power and cyber supply chain risks without fundamentally trying to reorient how we deal with China. I just wanted to immediately throw some balls at you, just get some stuff going.

28
00:00:10,000 --> 00:00:11,000
Jen Ellis:

29
00:00:10,000 --> 00:00:11,000
Meet Dave.

30
00:00:10,000 --> 00:00:11,000
Adam Dobell:

31
00:00:10,000 --> 00:00:11,000
I'm happy to jump in and provide a bit of cover for the moment, because.

32
00:00:10,000 --> 00:00:11,000
Jen Ellis:

33
00:00:10,000 --> 00:00:11,000
This is [inaudible 00:08:35] relationship. It's beautiful.

34
00:00:10,000 --> 00:00:11,000
Adam Dobell:

35
00:00:10,000 --> 00:00:11,000
Australia was quite an early mover on that front, I think because we did recognize that-

36
00:00:10,000 --> 00:00:11,000
Jen Ellis:

37
00:00:10,000 --> 00:00:11,000
Wait, was he providing cover, or was he digging in him?

38
00:00:10,000 --> 00:00:11,000
Adam Dobell:

39
00:00:10,000 --> 00:00:11,000
I'll let Irfan collect his thoughts. Just on the fact that we were concerned about the transparency of particular high risk vendors, and their autonomy that they would have from any government. And I think that drove the decision back in, well back to 2013 when we made our decision about our national broadband rollout, through to 2018 when we made the decision on 5G. And if you read the legislation that was put in place is, it's agnostic in which country or supply, it just wants our telco providers to offer assurances to government of the continuity of their services. So that has formed a larger discussion in Australia about our national resilience, and what kind of approach we want to take to tech, writ large. And that's underpinned by a few different things. It's the security by design, it's transparency of suppliers, and it's also about the autonomy piece which goes back to the 5G decision, because we want to know that providers in Australia aren't going to be subject to undue influence from outside parties. And we don't want to be prescriptive in that space, we'd rather take a principles-based approach.

40
00:00:10,000 --> 00:00:11,000
Jen Ellis:

41
00:00:10,000 --> 00:00:11,000
Do you want to jump in or should we carry on going?

42
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

43
00:00:10,000 --> 00:00:11,000
I feel like China will come up a few times, so-

44
00:00:10,000 --> 00:00:11,000
Jen Ellis:

45
00:00:10,000 --> 00:00:11,000
And I will say, from my point of view, no government's just doing one thing. And so what we are talking about here specifically is the idea of moving regulation for cyber resilience upstream and looking at digital service providers. The matter of China also needs to be addressed, but it's not the same thing, and they will be handled separately, and are being handled separately. So, that's my take on it. So then I think we got as far as-

46
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

47
00:00:10,000 --> 00:00:11,000
Resilience.

48
00:00:10,000 --> 00:00:11,000
Jen Ellis:

49
00:00:10,000 --> 00:00:11,000
... why resilience matters, but not how prescriptive government should be.

50
00:00:10,000 --> 00:00:11,000
Adam Dobell:

51
00:00:10,000 --> 00:00:11,000
I think, like I said, we in Australia want to take a principles-based approach, which involves businesses taking decisions on relevant governance and technical standards in their sectorial context, and reviewing their cyber posture regularly. Having understanding of their supply chains also is paramount in our view. And we've done some reviews of the cybersecurity framework in Australia, and recognize there's a plethora of different legislation that existed across... We're a federal system so we have both federal legislation and regulation, as well as state regulation. And across the board, there's about 51 different touch points for cybersecurity entities in Australia. So we don't want to make that environment even more complex. So we really want to ensure that we are harmonizing with international partners those cyber security frameworks. So for instance, we've introduced some security of critical infrastructure legislation which expands out to 10 different sectors a broad range of requirements, one of which is to put in place risk management plans that are holistic in nature. So, physical risk, supply chain risk and cyber risk.

52
00:00:10,000 --> 00:00:11,000
And within that, we were looking at do we want to have really prescriptive cybersecurity requirements in each sector. And the feedback from industry was that, "Can you harmonize as much as possible?" So we've basically said, "Pick one of five international standards, and the NIS framework is one of those. If your board is happy to at attest to the risk that's within your risk management plan that's underpinned by the NIS framework, for example, then we're happy. And we'll engage with you, we'll have a discussion to inform that risk management plan. But we're not going to be very prescriptive about what it looks like."

53
00:00:10,000 --> 00:00:11,000
Jen Ellis:

54
00:00:10,000 --> 00:00:11,000
Awesome. You sound like you want to jump in.

55
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

56
00:00:10,000 --> 00:00:11,000
I absolutely want to jump in. So I think it's quite hard to be proportionate if you're being prescriptive. I think the way we've approached policy in the UK in this area is that you are looking at cyber risk in a balance of risks. And it's very difficult for government to say every different industry is facing the same risk and therefore must do the same things. And so the approach we've taken on this in the UK is a sector by sector approach. So the financial services regulator will make the decisions on what exactly it is that companies in that sector need to do. And likewise for energy, water and the others.

57
00:00:10,000 --> 00:00:11,000
So not a big fan of the prescription approach, and we've gone for a principles-based approach, but at the same time, you can't have 13 different sets of regulations for 13 different companies. Because actually all of those sectors will have similar needs and will need to respond in a similar way to a changing cyber threat landscape.

58
00:00:10,000 --> 00:00:11,000
And so what the NIS framework does is it says, "There are a number of things that you need to achieve as a..." It gives regulators a set of powers, and requires companies to adhere to a set of, I think, 14 principles, that number might be wrong, under the cyber assessment framework, which is put together by the National Cyber Security Center, and work towards achieving those. And that framework doesn't actually say, "You must do this," it says, "You must achieve this." And then it's up to the company, and working with the regulator, and getting advice from technical experts and the NCSC, to understand what needs to be done that's effective to get to that answer, avoiding a checklist approach to saying, "Yeah, we've done good cyber security," tick.

59
00:00:10,000 --> 00:00:11,000
Jen Ellis:

60
00:00:10,000 --> 00:00:11,000
Thank you. Sorry. Yeah?

61
00:00:10,000 --> 00:00:11,000
Speaker 2:

62
00:00:10,000 --> 00:00:11,000
[inaudible 00:14:44].

63
00:00:10,000 --> 00:00:11,000
Jen Ellis:

64
00:00:10,000 --> 00:00:11,000
No, you've got a two-finger, go for it.

65
00:00:10,000 --> 00:00:11,000
Speaker 2:

66
00:00:10,000 --> 00:00:11,000
[inaudible 00:14:49] vendors or highly dependent providers, is that something specific that's you've come up with? So there's three big providers and one of them's completely wiped out by something.

67
00:00:10,000 --> 00:00:11,000
Jen Ellis:

68
00:00:10,000 --> 00:00:11,000
Sorry, can you talk more into the mic?

69
00:00:10,000 --> 00:00:11,000
Speaker 2:

70
00:00:10,000 --> 00:00:11,000
Sure. In considering resilience, how does monoculture, or not quite full monopoly, but limited number of-

71
00:00:10,000 --> 00:00:11,000
Jen Ellis:

72
00:00:10,000 --> 00:00:11,000
Move down on the question.

73
00:00:10,000 --> 00:00:11,000
Speaker 2:

74
00:00:10,000 --> 00:00:11,000
My God. Can you see my lips move? I'm concerned about monoculture, still, it's maybe not as bad as it once was on the internet, but we have customers and suppliers, there's aggregation at the very least. Does that, or how does that play into your resilience concerns? How about that? I'm asking if that's a piece of the resilience problem, and it can be a Chinese supplier, or it can be a Western supplier or provider. Concentrated risk, single point of potential disaster. What if Apple's walled garden is completely compromised?

75
00:00:10,000 --> 00:00:11,000
Jen Ellis:

76
00:00:10,000 --> 00:00:11,000
I think what you're asking is, what are we building resilience for or against?

77
00:00:10,000 --> 00:00:11,000
Speaker 2:

78
00:00:10,000 --> 00:00:11,000
Possibly. Maybe I'm assuming a different resilience than you all are.

79
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

80
00:00:10,000 --> 00:00:11,000
Are you looking at the risk that one of the major providers goes down and actually how do we deal with that? Is that basically-

81
00:00:10,000 --> 00:00:11,000
Speaker 2:

82
00:00:10,000 --> 00:00:11,000
Sure. Or it could be a supplier's completely compromised and it's a major linchpin supplier.

83
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

84
00:00:10,000 --> 00:00:11,000
So I think it's a risk that I don't think we've quite got right yet. And I don't know how you get it right, because a lot of what you can do now with cloud services, as an example, and what we saw before on telecoms, as an example, is scale provides opportunity. The market for telecoms could only accommodate, for that kind of scale, a few providers, and actually that meant that a lot of companies dropped out as a result because of that. And we're seeing a similar thing with cloud, scale provides competitiveness. I think making sure that those companies are-

85
00:00:10,000 --> 00:00:11,000
Jen Ellis:

86
00:00:10,000 --> 00:00:11,000
Can you speak more into the mic?

87
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

88
00:00:10,000 --> 00:00:11,000
Sorry. Can everyone hear me?

89
00:00:10,000 --> 00:00:11,000
Speaker X:

90
00:00:10,000 --> 00:00:11,000
I can't hear you.

91
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

92
00:00:10,000 --> 00:00:11,000
Making sure that those companies... Is that better? I can actually hear myself now. That's terrible.

93
00:00:10,000 --> 00:00:11,000
Speaker X:

94
00:00:10,000 --> 00:00:11,000
[inaudible 00:17:39].

95
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

96
00:00:10,000 --> 00:00:11,000
Making sure that those companies are doing what they need to for resilience is important. So the way we've tried to approach this with our new set of regulations is, if you are an important digital service provider, you must adhere to a certain set of principles and achieve cyber resilience. The other thing that's important is, even if you are not one of those big providers, if you are a important provider across critical national infrastructure, in discrete parts, you supply a bit of the water network, a bit of the electricity network, you might not be individually important but on aggregate you might be, you must also then be in that. So I think there's a scope question on how do we make sure we're getting the right companies-

97
00:00:10,000 --> 00:00:11,000
Jen Ellis:

98
00:00:10,000 --> 00:00:11,000
Which actually was exactly where I wanted to go, but I also want to add just a quick clarification, because... Delightful. Whoa. Because I think that, regardless of which government we're talking about, when it comes to cyber security, there are going to be parts of the government that set policy, and then there are going to be parts of the government are operational. And in an ideal world, they work together, I think they do for these two governments. And so the policy makers are going to be looking at what are the general rules that you set, and how do you make sure that they're adapted to the right people in the right ways, and who are we trying to target? The operational folks are going to be building the redundancy and resilience plans to say...

99
00:00:10,000 --> 00:00:11,000
We've got the policy makers and they're proposing policy to make sure that all digital service providers that meet X requirements are covered by these baseline things that they should be doing, but then the operational folks are going to be like, "But if AWS goes down, what happens? What does that mean for the UK and how do we respond to it?" And so I think what you want is for them to be working together in lockstep, and thinking about those things. But I think the question that you are asking almost orients more towards that operational piece than that policy making piece. But I do think one of the things that we should talk about is the term "digital service providers" is extremely broad. And so what does it actually mean? What are we trying to get at here? Is it everybody? Is it specific groups of digital service providers? Specific profiles? What is it?

100
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

101
00:00:10,000 --> 00:00:11,000
Yeah, sorry.

102
00:00:10,000 --> 00:00:11,000
Speaker 2:

103
00:00:10,000 --> 00:00:11,000
Thank you, Jen. If I could be very specific for a moment, as an example, I may have a policy that mandates you must have independent service providers, and two of them, and they may not. Or maybe I have an antitrust, anti monopoly policy, possibly intentionally, and not to say that the principles aren't good, and a certain criteria of provider must meet them, they could still completely fail. So, that kind of redundancy over... Thanks. Okay. I'm sorry, go ahead, please.

104
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

105
00:00:10,000 --> 00:00:11,000
I think just on finishing that, I think we also need to be looking at that risk diagram on impact and frequency. How likely is it that that's going to happen, and actually what are we worried about? Are we worried about a company that has built its business model on being resilient, and therefore providing resilience to others? Or are we worried about the 10-person operation that's done phenomenally well, is serving eight different parts of critical national infrastructure, and government hasn't quite picked up how critical they are, and hasn't quite got its firewall fixed, fitted out properly. So I think we just need to worry about what risks we are trying to address, and also what are the service providers. So I think, under UK law, there's the cloud services, Amazon, not Amazon online marketplaces, and online search-

106
00:00:10,000 --> 00:00:11,000
Jen Ellis:

107
00:00:10,000 --> 00:00:11,000
Infrastructure as a service, right?

108
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

109
00:00:10,000 --> 00:00:11,000
Yeah. So those are included.

110
00:00:10,000 --> 00:00:11,000
Jen Ellis:

111
00:00:10,000 --> 00:00:11,000
Even the term "cloud service provider" is super big. Do we mean Netflix or do we... And if anyone's here from any of the companies I'm mentioning, I'm not trying to victimize you in any way, I just want to get at every company is doing something in the cloud now. Actually, quick show of hands, how many people here work for a company that they think is a digital service provider in some way? Really? Only that many.

112
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

113
00:00:10,000 --> 00:00:11,000
Can government count?

114
00:00:10,000 --> 00:00:11,000
Jen Ellis:

115
00:00:10,000 --> 00:00:11,000
I was going to say, how many people here work for the government? I see you over there.

116
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

117
00:00:10,000 --> 00:00:11,000
So, our cyber breaches survey, which we released earlier this year, said 62% of companies think that they use a digital service provider. And I think that's a massive underestimate.

118
00:00:10,000 --> 00:00:11,000
Jen Ellis:

119
00:00:10,000 --> 00:00:11,000
I think it's a massive underestimate as well.

120
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

121
00:00:10,000 --> 00:00:11,000
And I think this is the problem. I don't think people realize how dependent they are on-

122
00:00:10,000 --> 00:00:11,000
Jen Ellis:

123
00:00:10,000 --> 00:00:11,000
Because that would suggest that, what, 38% don't have email?

124
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

125
00:00:10,000 --> 00:00:11,000
Well exactly.

126
00:00:10,000 --> 00:00:11,000
Jen Ellis:

127
00:00:10,000 --> 00:00:11,000
Or a website. So when we say "cloud service providers" we mean infrastructure as service or more?

128
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

129
00:00:10,000 --> 00:00:11,000
Infrastructure as a service, parts of software as a service. Not yet quite managed service providers though, which will actually use cloud services as well. So you have the compound effect of those.

130
00:00:10,000 --> 00:00:11,000
Jen Ellis:

131
00:00:10,000 --> 00:00:11,000
And a lot of managed service providers are in themselves small to medium businesses, which is a challenge. What about MSSPs?

132
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

133
00:00:10,000 --> 00:00:11,000
Not yet included.

134
00:00:10,000 --> 00:00:11,000
Sorry.

135
00:00:10,000 --> 00:00:11,000
Jen Ellis:

136
00:00:10,000 --> 00:00:11,000
Interesting.

137
00:00:10,000 --> 00:00:11,000
Speaker X:

138
00:00:10,000 --> 00:00:11,000
[inaudible 00:23:17].

139
00:00:10,000 --> 00:00:11,000
Jen Ellis:

140
00:00:10,000 --> 00:00:11,000
Sorry, is that Gabe? Gabe are you trying to say something?

141
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

142
00:00:10,000 --> 00:00:11,000
We need to speak louder.

143
00:00:10,000 --> 00:00:11,000
Speaker X:

144
00:00:10,000 --> 00:00:11,000
[inaudible 00:23:24].

145
00:00:10,000 --> 00:00:11,000
Jen Ellis:

146
00:00:10,000 --> 00:00:11,000
He can't hear. So we're talking about the kinds of cloud service providers. Hello. I'm very scared of this microphone now.

147
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

148
00:00:10,000 --> 00:00:11,000
There was a question.

149
00:00:10,000 --> 00:00:11,000
Jen Ellis:

150
00:00:10,000 --> 00:00:11,000
Brilliant. Yes, please.

151
00:00:10,000 --> 00:00:11,000
Speaker 3:

152
00:00:10,000 --> 00:00:11,000
[inaudible 00:23:47].

153
00:00:10,000 --> 00:00:11,000
Jen Ellis:

154
00:00:10,000 --> 00:00:11,000
Sorry.

155
00:00:10,000 --> 00:00:11,000
Speaker 3:

156
00:00:10,000 --> 00:00:11,000
[inaudible 00:23:52].

157
00:00:10,000 --> 00:00:11,000
Jen Ellis:

158
00:00:10,000 --> 00:00:11,000
I've heard of them.

159
00:00:10,000 --> 00:00:11,000
Speaker 3:

160
00:00:10,000 --> 00:00:11,000
[inaudible 00:23:54] so with that said, [inaudible 00:24:00] looking at distributed ledger technology as well, and I know this is emerging tech, so the governments may not be looking quite yet at policy around it [inaudible 00:24:06]. But I guess my question is around how are governments thinking about DLT right now? Because a lot of that, even though they're trying to decentralize, a lot of that infrastructure for [inaudible 00:24:06] services or whatnot, is [inaudible 00:24:06] companies around the world. So, it ends up recentralized. Is that [inaudible 00:24:06] decentralization even the thing that's on the radar of governments? I'm seeing, with DLT, that governments like Australia or Singapore are already going into creating policy around crypto, and stuff like that, or wanting to-

161
00:00:10,000 --> 00:00:11,000
Jen Ellis:

162
00:00:10,000 --> 00:00:11,000
I did tell you it would come up.

163
00:00:10,000 --> 00:00:11,000
Speaker 3:

164
00:00:10,000 --> 00:00:11,000
... incorporate things like, in terms of outcomes, allowing us to control our own data. So things like self-sovereign identity, or decentralized identity, whatnot. So to what degree is these emerging technologies that if there's actual... What's the word I'm looking... If people start using them, they're not just ideas anymore, but they become... What's the word I'm looking for? They're picked up and everyone uses them. My brain is...

165
00:00:10,000 --> 00:00:11,000
Speaker X:

166
00:00:10,000 --> 00:00:11,000
Adoption.

167
00:00:10,000 --> 00:00:11,000
Speaker 3:

168
00:00:10,000 --> 00:00:11,000
Adoption, thank you. If they're widely adopted, then the outcome could be that, as a policy measure, that we're saying that companies shouldn't be managing our identities. If we do, we get both security, privacy, we manage our own data, we don't have leaks, there's no central point of failure. All of these great things that we advocate for companies to do. I'm curious what governments... Do they want to give up control of managing our own data, and I hope we're not diverging from your topic.

169
00:00:10,000 --> 00:00:11,000
Jen Ellis:

170
00:00:10,000 --> 00:00:11,000
Yes, because I think that's a privacy regs thing, not a security regs thing. But I do think it's a great question.

171
00:00:10,000 --> 00:00:11,000
Speaker 3:

172
00:00:10,000 --> 00:00:11,000
It's integrity.

173
00:00:10,000 --> 00:00:11,000
Jen Ellis:

174
00:00:10,000 --> 00:00:11,000
It is. Because you can't have one without the other. But I think the way the governments think about it, it's a regulation that tends to stem from the privacy side of the house. I don't know, you guys tell me-

175
00:00:10,000 --> 00:00:11,000
Speaker 3:

176
00:00:10,000 --> 00:00:11,000
Cryptography.

177
00:00:10,000 --> 00:00:11,000
Jen Ellis:

178
00:00:10,000 --> 00:00:11,000
Are you guys looking at-

179
00:00:10,000 --> 00:00:11,000
Speaker 3:

180
00:00:10,000 --> 00:00:11,000
[inaudible 00:26:11] groups, you know?

181
00:00:10,000 --> 00:00:11,000
Jen Ellis:

182
00:00:10,000 --> 00:00:11,000
Is this something you guys are looking at?

183
00:00:10,000 --> 00:00:11,000
Adam Dobell:

184
00:00:10,000 --> 00:00:11,000
Yeah, I think a perennial problem for governments is that we are struggling to keep up with the pace of change here. But there's efforts underway in Australia, a review of the Privacy Act, for example. We're pulling together a national data security action plan, and we're working with the UK and the US on harmonization there, on data security issues. But frankly, it's an area where, even for a pretty agile government like Australia, in which we have a joined up legislature and executive branch, we can pass legislation quite quickly, we still are struggling with.

185
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

186
00:00:10,000 --> 00:00:11,000
I think we try to focus on cyber security, which is a really hard line to draw, because I think there are times when you can't separate cyber security from privacy, and you can't separate cybersecurity from other things. So the Chinese tech question that came up was partly a cyber security issue, was mostly not a cyber security issue, but falls into a similar kind of bracket. I think the other thing about what we try to do in government is, at the moment, we are trying to reduce at scale cybersecurity risk in the economy. And that means things like regulating, putting in policy for technologies to reduce that at scale, and then looking at how we make sure companies are doing the right thing to manage residual risk after that.

187
00:00:10,000 --> 00:00:11,000
I think when a technology hasn't been adopted in a wide scale way, unless we think it's going to form the basis of a future civilization, you probably wouldn't be looking to do anything. And even when technology is being taken up quite broadly, legislation is still the last thing that you go to. There are people in the room that have been involved in the Secured By Design stuff. There's no one I can see. Sorry. The Secure By Design security principles, 13 principles. And the hope was actually that we wouldn't need to legislate for this. The hope was that this would be taken up by manufacturers so that actually government doesn't have to get involved. And then when we saw that actually that risk wasn't reducing, we then went to legislation. And I think that's generally the principle.

188
00:00:10,000 --> 00:00:11,000
Now, cloud services, managed services, I think it would've been wrong to do this too early, because their uptake has provided incredible benefits for businesses. You do not have to have a financial account.... I think back 25 years ago, you'd have a financial accounts and systems department in a-

189
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

190
00:00:10,000 --> 00:00:11,000
Back 25 years ago, you'd have a financial accounts and systems department in a medium sized company, with two or three people managing those ledgers and that kind of thing. You can now run a cloud based finance system. So you do not have to have all of these specific expertise in your company. You can run a business and focus on the bit that's the business. There are risks that we now need to look at. So I think what we saw was, I think it's something like 7% of companies, understand their supply chain risk, or actually actively look at their supply chain risk. And that's not going up. And so that's the point at which we say-

191
00:00:10,000 --> 00:00:11,000
Jen Ellis:

192
00:00:10,000 --> 00:00:11,000
It's just 7%?

193
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

194
00:00:10,000 --> 00:00:11,000
7% of companies in the UK-

195
00:00:10,000 --> 00:00:11,000
Speaker 3:

196
00:00:10,000 --> 00:00:11,000
Well, how could they know it better?

197
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

198
00:00:10,000 --> 00:00:11,000
Sorry?

199
00:00:10,000 --> 00:00:11,000
Speaker 3:

200
00:00:10,000 --> 00:00:11,000
How could... Sorry, this is really loud. How could companies know their risk better, when companies like AWS don't actually say, "Here are the potential risks you might have"? In fact, it's been like, "Here's a shared responsibilities model. You're responsible for whatever you put in the cloud. We're just responsible for the security and the privacy of the cloud." So it's a liability model for contracting that everyone extols as being really good. When, in reality, it tells the companies nothing about how they're supposed to protect data, or anything about their cybersecurity risks. Actually, AWS does a better job with security than privacy, when it comes to educating.

201
00:00:10,000 --> 00:00:11,000
But I guess the big thing I want to say is, education is broken around privacy and security. Security is obviously the topic of the day. So it's broken in that, if we wait 20 years before DLT is regulated, when the goal of DLT is to... Or blockchain and hashgraph or whatever. It is technological regulation without the need for government regulation, it's the whole point. So if we don't have government making sure it's safe now, so many people will be harmed, because they don't understand the risks. Or that the fact that DLT plugs into distributed apps that are riddled with insecure code, because the developers and the... Basically, network effects is what each company wants. That's what AWS wanted, Google Cloud wanted.

202
00:00:10,000 --> 00:00:11,000
Now, each of these layer one networks wants network effects. So they're throwing, hand over fist, millions of dollars to fund developers on their networks to build. Without saying, "Hey, we need the secure coding. We need to teach people how to do this so that it's safe." And so all I'm seeing is just constant breaches and constant not advancing anything forward. Instead, it's making people fearful of using these technologies. And if it was an obligation that the government made that said, "Look, here's a principle, you have to educate your networks on secure coding." Or, "You have to give them tips and tools of what not to do." Otherwise, people lose their keys easily or people... There's a lot of dangers.

203
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

204
00:00:10,000 --> 00:00:11,000
Education awareness, it's incredibly important. The other one that came up was, actually, people don't know who's in their supply chain, that transparency, and that's not just a service. That's something that we're seeing more and more of. I think we've had models built that are actually much more complex. It's quite similar to the software bill of materials conversation. You have this stack and it's great, but you don't know what's inside it. Similarly, you are buying in a service, or you're developing a service and selling it on, people don't necessarily know what's inside it.

205
00:00:10,000 --> 00:00:11,000
Speaker 3:

206
00:00:10,000 --> 00:00:11,000
Is where SBOMs come in. And that's really exciting. The software bill of materials and knowing what's inside.

207
00:00:10,000 --> 00:00:11,000
Jen Ellis:

208
00:00:10,000 --> 00:00:11,000
I sense that we're going to pivot to SBOMs soon.

209
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

210
00:00:10,000 --> 00:00:11,000
I was educated on SBOMs yesterday.

211
00:00:10,000 --> 00:00:11,000
Jen Ellis:

212
00:00:10,000 --> 00:00:11,000
Yeah. Gabe?

213
00:00:10,000 --> 00:00:11,000
Gabe:

214
00:00:10,000 --> 00:00:11,000
Oh, me? Yeah, my question is what are the limits of government responsibility in this space as you see them? And can you give me two examples?

215
00:00:10,000 --> 00:00:11,000
Jen Ellis:

216
00:00:10,000 --> 00:00:11,000
So I think that was, what are the limits of government responsibility in this space? And can you give him some examples? Was that right? Right.

217
00:00:10,000 --> 00:00:11,000
Adam Dobell:

218
00:00:10,000 --> 00:00:11,000
Look, I think I'll go back to the wicked policy question over here about the mono... What was the phrase you used?

219
00:00:10,000 --> 00:00:11,000
Speaker 4:

220
00:00:10,000 --> 00:00:11,000
Monoculture.

221
00:00:10,000 --> 00:00:11,000
Adam Dobell:

222
00:00:10,000 --> 00:00:11,000
Monoculture. And I'll go back to the example of the critical infrastructure reforms that have taken place in Australia. So we wanted to, in 2018 when these reforms were implemented, we wanted to have a good understanding of the owners and operators of entities that existed in the water, ports, gas, and electricity sector. And so we could have an aggregated view of who was operating and what risks existed. We've subsequently decided we needed to expand that out to 10 sectors, which includes data processing and storage. So then we can map, we can have an aggregated view of where, and do some modeling on where risks exist. What we are not going to do is then say to a data storage provider in Australia that, "You need to do X, Y and Z because the area's a supply chain issue that we've identified. And you are spread across X amount of sectors."

223
00:00:10,000 --> 00:00:11,000
So that's where, I think from the Australian government perspective, that's where the limit would go. We're hoping to have a pretty good understanding of the risks across our broad economy, but we're not going to be prescriptive with how you go about rectifying that. Particularly in a market like Australia, which is quite small. And we're a tech taker, not a tech maker.

224
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

225
00:00:10,000 --> 00:00:11,000
Just who asked that question?

226
00:00:10,000 --> 00:00:11,000
Jen Ellis:

227
00:00:10,000 --> 00:00:11,000
Why is the government going to come and get him?

228
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

229
00:00:10,000 --> 00:00:11,000
Well, was the question, isn't it, where does government responsibility end? Is that what you were asking? Or where does it begin?

230
00:00:10,000 --> 00:00:11,000
Gabe:

231
00:00:10,000 --> 00:00:11,000
Yeah, what are the limits as you see them?

232
00:00:10,000 --> 00:00:11,000
Jen Ellis:

233
00:00:10,000 --> 00:00:11,000
What? Mask down.

234
00:00:10,000 --> 00:00:11,000
Gabe:

235
00:00:10,000 --> 00:00:11,000
What are the limits?

236
00:00:10,000 --> 00:00:11,000
Jen Ellis:

237
00:00:10,000 --> 00:00:11,000
What are the limits?

238
00:00:10,000 --> 00:00:11,000
Gabe:

239
00:00:10,000 --> 00:00:11,000
What's an example of where you tried to do something and it didn't work. And you were like, "All right, that didn't work. You can't do that."

240
00:00:10,000 --> 00:00:11,000
Jen Ellis:

241
00:00:10,000 --> 00:00:11,000
Okay, so what have they tried, and what's not worked, is a totally different question. And a very fun question.

242
00:00:10,000 --> 00:00:11,000
Adam Dobell:

243
00:00:10,000 --> 00:00:11,000
Can give half a dozen examples but you go first.

244
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

245
00:00:10,000 --> 00:00:11,000
I was going to answer it slightly differently, in that, this is absolutely the responsibility of organizations. Organizations are responsible for their cyber resilience. And it is a big part of UK government policy to help make companies aware of what to do, what is good. That they are responsible for this. That there is a cost to not doing this well. And to factor that cost into how the board makes decisions about investments and priorities. I think there is a point where it crosses the line of being a business decision, when it starts affecting safety and security and national security. And in areas like critical national infrastructure, there is a responsibility of government to say, "It's not just down to organizations to make this decision." Government must make sure that a minimum is being done in these areas. And I think that's where government responsibility begins.

246
00:00:10,000 --> 00:00:11,000
I think it's really difficult to then say, "Every organization in the economy must adhere to these certain things." Because, actually, companies are best placed to make decisions about their risk. And I think the example I use at the moment is, a lot of companies in the UK are more worried about inflation and what that does to their business than cyber risks. And they're quite right to do that. If we start telling a corner shop that they must protect their point of sale system and worry about that more... And it's what Chris was saying this morning, I don't know if anyone caught his thing about putting cyber in its proper place. That's not saying it's not important, but it's saying it has an importance and you must judge. So I think most of this is, how do we get companies to do the right thing. And give them all the tools so that they can do it.

247
00:00:10,000 --> 00:00:11,000
Adam Dobell:

248
00:00:10,000 --> 00:00:11,000
Yeah, I might jump in here as well. I think one thing we're learning in Australia is that it's government's role to also identify market failures as they're occurring. And in the Australian context, and I don't think it's unique to our economy, it's happening across the board, is we've identified a couple of key market failures. And then we need to understand what policy levers we can pull to address those. So those are really the two key ones that we've identified a negative externalities where the investment in cyber security, there's no incentive to do so. And then that risk is pushed down onto the consumer. And you hear Chris Inglis talk about this all the time, that it's a whole society issue and we need to push the risk upstream. That is one of the key things we've identified.

249
00:00:10,000 --> 00:00:11,000
The other one is what we are calling information asymmetry, where the sellers of products and services have greater understanding of those products. The buyers do not. And we're hearing from small and medium enterprises across the Australian economy that they just don't have the technical wherewithal to make informed decisions. And that's where I think we, as governments, need to step in. Then, you get into a really vexed point of what to do. Because you basically get into a philosophical argument as, do you have government intervention in the market or do you go with the view... And this is borne out in our stakeholder engagements. Do you let the market correct itself because there's attended, I guess, reputational and financial risks that will occur in the marketplace? So that's where we're up to. And then we can probably go into what levers we could potentially pull, but I think that's something that we're learning along-

250
00:00:10,000 --> 00:00:11,000
Jen Ellis:

251
00:00:10,000 --> 00:00:11,000
Yeah. So I love the fails question, but have you got [inaudible 00:39:04].

252
00:00:10,000 --> 00:00:11,000
Speaker 5:

253
00:00:10,000 --> 00:00:11,000
It's kind of one and half now.

254
00:00:10,000 --> 00:00:11,000
Jen Ellis:

255
00:00:10,000 --> 00:00:11,000
Right. So why don't you go and then we're going to come back to fails because I think fails is a great question. You go ahead.

256
00:00:10,000 --> 00:00:11,000
Speaker 5:

257
00:00:10,000 --> 00:00:11,000
So you've already half been getting to the question that I was going to ask, but not quite. I was going to ask, government historically tends to be reluctant to take large risks by adopting technology early, but adoption of technology tends to lead policy. So whose responsibility is it to lead technology adoption? Is there any way to flip government adopting late and then writing policy for business, to government adopting early so that they can develop policy for business? Are you aware of any programs?

258
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

259
00:00:10,000 --> 00:00:11,000
Yeah, I think government has a real... This is one of the things that government can do that businesses can't, is that can make investments and get it wrong. And in the odd event that government gets technology right, it will have set a precedent. I think, actually, certainly from what I've seen in the UK, we're starting to get better in not taking a blind punt on these things anymore. I think it's that when... My reference point at the moment is something around digital identities in the UK, where we are actually looking at enabling that entire market by opening up government data sets and creating that market. But, actually, not doing it in a quick and rash way, but taking time to actually understand what's the security implications? What are the privacy implications? What are the market implications? Are we going to create a market with two or three players, and is that where we want this to go? Or do we want to market with 15 players? Are we focusing on a particular industry? Or is this going to be across the economy?

260
00:00:10,000 --> 00:00:11,000
And I think more and more... And I think part of this is as government has opened up its process to non-government actors. And actually has built into the process of policy, making sure that businesses, civil society, are involved in, not just consultations, but the bit way before the consultation on actually formulating the ideas. What is it that we want to see at the end of this process? That's not going to be true across the board, but I think those models of what do we want from this and how do we get the right answer? Before actually plunging tens of millions or more is quite important and seems to be getting better in some areas.

261
00:00:10,000 --> 00:00:11,000
Jen Ellis:

262
00:00:10,000 --> 00:00:11,000
Okay. All right. I'm going to jump back to fails then, because I think that was a question that both of you were like, "Oo, we've got answers on this." What have you tried that hasn't worked?

263
00:00:10,000 --> 00:00:11,000
Adam Dobell:

264
00:00:10,000 --> 00:00:11,000
The most immediate, I guess, answer to that question lies not necessarily in the pure cybersecurity policy realm, but more when it comes to... And I'm conscious that I'm sitting next to the expert on this in the Australian government, so I might defer to her on this.

265
00:00:10,000 --> 00:00:11,000
Speaker 2:

266
00:00:10,000 --> 00:00:11,000
Thanks for calling me out.

267
00:00:10,000 --> 00:00:11,000
Jen Ellis:

268
00:00:10,000 --> 00:00:11,000
No more incognito for you.

269
00:00:10,000 --> 00:00:11,000
Adam Dobell:

270
00:00:10,000 --> 00:00:11,000
Was lawful access to encrypted data. And there was an area where we tried, and we're still trying. And the framework that we have in place has worked well in terms of voluntary assistance from, particularly, social media companies. But it's an area where, I think, we haven't quite got that right. And we didn't necessarily get it right in the first go round with our legislation. But I'll let Erfan jump in as well.

271
00:00:10,000 --> 00:00:11,000
Jen Ellis:

272
00:00:10,000 --> 00:00:11,000
Can I just say though, I think you're very brave in the DEFCON room to proactively bring up encryption back doors.

273
00:00:10,000 --> 00:00:11,000
Adam Dobell:

274
00:00:10,000 --> 00:00:11,000
And I will say that we're a strong supportive... End-to-end encryption never changed that. But I guess the fundamental issue was about ensuring that service providers, they enforce their terms of services on the networks and work with law enforcement cooperatively. So we're not against the encryption by any means.

275
00:00:10,000 --> 00:00:11,000
Jen Ellis:

276
00:00:10,000 --> 00:00:11,000
I just want to go on the record of saying, we're not against encryption.

277
00:00:10,000 --> 00:00:11,000
Adam Dobell:

278
00:00:10,000 --> 00:00:11,000
Well, this keeps coming up at every conference I go to, so I'll put that marker down.

279
00:00:10,000 --> 00:00:11,000
Jen Ellis:

280
00:00:10,000 --> 00:00:11,000
Thank you.

281
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

282
00:00:10,000 --> 00:00:11,000
In terms of cyber, does anyone across the table want to give an example of when the UK government has put out a policy question and got it completely wrong?

283
00:00:10,000 --> 00:00:11,000
Speaker 2:

284
00:00:10,000 --> 00:00:11,000
This is easy, and I'm only the messenger here, I'm sitting side on this discussion. So first let me credit the UK, I've observed the consultations process. I'm in the US so it doesn't really affect me. But in the US, we have requests for comments and various things as well. But it's great to see governments actually asking their citizens what they think. And there's been a bunch of cyber stuff out of the UK, which I've had some policy friends help me notice that they're happening. Yeah, government certification qualification of cybersecurity professional, which, it's easy. It's a dunk, in a way. I certainly can appreciate the desire for that. We have lots of professional societies where you have a credential and you need to keep it up-to-date and it matters. And I would perhaps suggest that cybersecurity is just too fluid and new for that. So appreciate the effort, but no.

285
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

286
00:00:10,000 --> 00:00:11,000
Yeah, yeah. And I'm glad you didn't say Brexit.

287
00:00:10,000 --> 00:00:11,000
Jen Ellis:

288
00:00:10,000 --> 00:00:11,000
Can I say that word?

289
00:00:10,000 --> 00:00:11,000
Speaker 2:

290
00:00:10,000 --> 00:00:11,000
It's not a cybersecurity topic, is it?

291
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

292
00:00:10,000 --> 00:00:11,000
But, look, we put a consultation out that said, "Should cyber professionals be licensed? Should they have a license to practice?" It's an important question and it's not the last time this question's going to be asked. And in the future, the answer might be different. I think there's a lot of pressure now to get the right people on board to actually understand what's going on. And have some way to make sure that they know what's happening. Licensing professionals was also seen as a way that maybe we could improve the quality of cyber professionals in the UK. We have two issues. One is that it's very difficult to tell what credentials a cyber professional has and how qualified they are. And then, the other one is, we have a gap of 14,000 people, 14,000 cyber professionals a year.

293
00:00:10,000 --> 00:00:11,000
Jen Ellis:

294
00:00:10,000 --> 00:00:11,000
Yeah, so more barriers and roadblocks to them coming into the profession seem like a great idea.

295
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

296
00:00:10,000 --> 00:00:11,000
Well, it solves one and not the other. It can help solve the quality question but not the quantity question. And actually, when we don't know what good looks like in that space... Because we're still developing the frameworks of what's a cyber pathway for the 16 different professionals that have been determined by the UK Cyber Security Council. If we don't know what those pathways look like yet, how do you actually license someone? So it was a question that we asked, looking at what was happening around the world in different places. Some countries do have license requirements for cyber professionals. The answer came back as no. And we scrapped the idea for the moment.

297
00:00:10,000 --> 00:00:11,000
Jen Ellis:

298
00:00:10,000 --> 00:00:11,000
Yeah. And the sounding like I'm being horribly patriotic here, the DCMS did come back with a response that said, "Yep, we heard you and we're going to take it seriously, and we're going to not proceed on this." And similarly, with Secured By Design, you originally were like, "Hey, how about a label?" And people went, "How about not?" And you went, "Yeah, okay." And I think the thing that I would say for people in the room who are interested in public policy and how it develops, and how they can impact it, is that in democratic nations they tend to run these processes. As they're building policy, they tend to have consultations. The US runs them, Australia runs them. And actually, through this amazing thing that we have called the internet, anybody can reply. You don't actually have to be in the country. And the government will take it seriously. They're not going to look at it and be like, "Well, you're not here so we don't really care."

299
00:00:10,000 --> 00:00:11,000
And I would just say the examples that the Erfan's just shared, do highlight why the consultation process is so important, and why you should absolutely get involved with it. The UK government just ran one on app store security and privacy. And I think, as with many of these things, what's typical is you see the people who potentially will get regulated respond a lot. And they all get together and they have trade associations, and so they respond individually and as trade associations. Maybe they create some new trade associations just to really amp up the noise. And they're all like, "No, regulation's a terrible idea. We don't need, it's fine." And actually, the people who care about security are the people who come to these events. And you guys are on the frontlines of why security matters so much, and so your voices... And maybe you don't agree with regulation, maybe you think actually it's government overreach and it shouldn't be regulated. But the fact that you have that perspective from the frontline of security is so important and you can really help shape outcomes.

300
00:00:10,000 --> 00:00:11,000
The other thing I'll say, just last thing on this, while I'm on my soapbox for why you should participate. One thing about DCMS, and I don't know if this is true of every government, is they really, really like to have a survey. And it's because they like to have both a qualitative response but also a quantitative response. And it can be a little annoying, let's be honest. Sorry.

301
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

302
00:00:10,000 --> 00:00:11,000
I'm writing you down.

303
00:00:10,000 --> 00:00:11,000
Jen Ellis:

304
00:00:10,000 --> 00:00:11,000
Right, that's fine. Trust me, I think I've put this in writing already. You don't have to stick with that. There will be somewhere on the website that says, "Here's an email address where you can send us your thoughts." So you can do the survey or not do the survey, depending on what you want to do. You can also just write a letter that says, "Hey, here's what I think. And it doesn't completely conform to your survey questions, but this is my view on what you're suggesting and why I think it matters." And you can email it to them and they will read it. They will consider it and they will take it seriously. So I highly advise you to get involved if you see topics come up that you care about. Amit?

305
00:00:10,000 --> 00:00:11,000
Amit:

306
00:00:10,000 --> 00:00:11,000
Yes, [inaudible 00:49:45].

307
00:00:10,000 --> 00:00:11,000
Jen Ellis:

308
00:00:10,000 --> 00:00:11,000
Oh, can we... Thank you. See, teamwork makes the dream work.

309
00:00:10,000 --> 00:00:11,000
Amit:

310
00:00:10,000 --> 00:00:11,000
Can you hear me? Yeah, I'll be brief. Just quick followup and then award of thanks. I think one of the most amazing things that we have seen, and especially in the UK, Australia, and other jurisdictions as well, is a summary of comments. Where, you will be able, as a community, to also see which comments were in, from what type of entities, how much is individuals, how much is trade associations, from which industries. This is, by the way, also true for the DMCA proceedings that we talked about earlier today. So not only you would get a summary of the consultation and the government response... And these are really illuminating if you look at the connected devices, for example, commentary and how impactful that was to the shaping of the recent legislation, the PSTI.

311
00:00:10,000 --> 00:00:11,000
Not only you are able to access that... And that's a summary of the consultation and can give you ideas of where you want to engage and which questions can most benefit from the tremendous input of this community. You can also read the letters and the comments themself that were submitted. And that is really helpful to understand the shape and the type of arguments that are being made, type of technical argumentation as well. So I just wanted to quickly put that plug. And I would agree, also in the EU as well, we see a lot of surveys that are coming in. And these are very detailed, but there is always an opportunity to engage with... Often, it's a think tank that creates the consultation for the European Commission, and provide them with commentary directly, or comments in the shape of the letter. Thank you, that's it.

312
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

313
00:00:10,000 --> 00:00:11,000
Really interesting because, on that consultation we were talking about before, organizations wanted individuals to have licenses but individuals didn't want to get licensed. So really important that we understand the distinction of who's responding.

314
00:00:10,000 --> 00:00:11,000
Jen Ellis:

315
00:00:10,000 --> 00:00:11,000
Yeah, go ahead, Dave?

316
00:00:10,000 --> 00:00:11,000
Dave:

317
00:00:10,000 --> 00:00:11,000
Just doing a mike check. This room has the worst [inaudible 00:51:50] I've ever seen. So I thought I would throw another fastball at you, basically, just at the UK in this particular case. So you can just chill. We're going to get you a new LinkedIn picture, by the way. It's too spooky right now. You need at least something deep faked. So if we want to talk about failures from the UK in the past 10 years based in cyber policy-

318
00:00:10,000 --> 00:00:11,000
Jen Ellis:

319
00:00:10,000 --> 00:00:11,000
Are we going to talk about Brexit, is that it? Because I'm ready, let's go, Brexit.

320
00:00:10,000 --> 00:00:11,000
Dave:

321
00:00:10,000 --> 00:00:11,000
What are you ready for?

322
00:00:10,000 --> 00:00:11,000
Jen Ellis:

323
00:00:10,000 --> 00:00:11,000
Brexit.

324
00:00:10,000 --> 00:00:11,000
Dave:

325
00:00:10,000 --> 00:00:11,000
No, I was going to talk about export control. So the UK has the biggest and best penetration testing company in the world headquartered in the UK, NCC Group. Did the UK communicate with NCC Group on how export control was going to work? No. They didn't bother to ask Ollie Whitehouse if he wanted this to happen, or if it was a good idea. And even now, it's like they're ignoring his input on whether or not it's working or not working. So I feel like-

326
00:00:10,000 --> 00:00:11,000
Jen Ellis:

327
00:00:10,000 --> 00:00:11,000
One person, how dare you ignore that one person?

328
00:00:10,000 --> 00:00:11,000
Dave:

329
00:00:10,000 --> 00:00:11,000
Right. I just feel like it's like, we did what we want to do and now it's up to industry to deal with the issues. And we're not going to even say if it's working or doing anything.

330
00:00:10,000 --> 00:00:11,000
Jen Ellis:

331
00:00:10,000 --> 00:00:11,000
I'm going to push back on that. And you and I, we've talked about Vasvar at length. I think the UK has actually been pretty receptive to feedback. And actually was supportive of going back to Vasvar and saying, "Hey, we need to look at what the impact is on researchers and looking at the language." So I will push back on that a little bit.

332
00:00:10,000 --> 00:00:11,000
Dave:

333
00:00:10,000 --> 00:00:11,000
Go ahead, sorry, I don't want to halt the catharsis, shall we say?

334
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

335
00:00:10,000 --> 00:00:11,000
No, I think there is a really important broader point on how we do this stuff responsibly. And what is it that we want to put out there in the world? What kind of practices do we want people to be undertaking? And what do we want to proliferate? I think we need to be very careful about how we conduct ourselves in cyberspace. I think it doesn't go unnoticed when we do something. It goes more unnoticed than when the US does something. So US has to be very careful on how they do things, and recognize that when people see something, does give other people a license to do the same thing? I think the UK has to have a set of principles by which it thinks that this is okay and this is not okay. And I think, and I don't know specifically, I think the export control question came under that. What is it okay for a cyber practitioner to do and what is it not? I think Ollie Whitehouse is an incredible individual.

336
00:00:10,000 --> 00:00:11,000
Jen Ellis:

337
00:00:10,000 --> 00:00:11,000
He does actually told to DCMS all the time.

338
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

339
00:00:10,000 --> 00:00:11,000
I really like him. He inputs on pretty much everything we do, along with a number of other people. And it's a shame that this one didn't go that way for him. But I think there's-

340
00:00:10,000 --> 00:00:11,000
Jen Ellis:

341
00:00:10,000 --> 00:00:11,000
And I do think that the UK government was very surprised by the reaction. And my sense, from having talked to a lot of people who are involved in it, is that there were some learnings from the process. But I also think a lot of it, it wasn't driven out of the traditional policymaking units. I think that was part of it.

342
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

343
00:00:10,000 --> 00:00:11,000
It wasn't a DCMS thing, it was a broader, what do we do as the UK and make sure that the wrong things don't get out to the wrong people? I don't think it was a problem to go down that route.

344
00:00:10,000 --> 00:00:11,000
Dave:

345
00:00:10,000 --> 00:00:11,000
So listen to the technical people, when it's convenient, is that-

346
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

347
00:00:10,000 --> 00:00:11,000
No, but I don't think this is a technical question. I think this was a question on principles and on law. I'm not sure that this was a... So for example, the app security code of practice that we put out recently, we had quite a lot of interest from a number of different companies and individuals on what those... We put out six principles. These are the things that app developers and apps stores should adhere to. Similar to the conversation we're having now. How do you reduce cyber risk upstream? What are the interventions we need to do up here so that the person that's downloading apps to their device isn't going to worry about security? Because they don't anyway.

348
00:00:10,000 --> 00:00:11,000
And technical respondents told us things that we weren't necessarily keen on. They told us that we need to be looking at enterprise app stores. We didn't really think that that was going to be... We weren't sure how important that was going to be to start off with. They told us that we can't ask operators to say what good looks like, without actually stating what good looks like. I don't think it's that we listen to technical experts when it's convenient. I think we listen to technical experts when there's a technical answer needed. But not everything in cyber has a technical answer. I think a lot of it is around governance. A lot of it is around international norms. I think a lot of it is around stuff that is way outside of cyber technical expertise.

349
00:00:10,000 --> 00:00:11,000
Jen Ellis:

350
00:00:10,000 --> 00:00:11,000
Yeah, maybe if we just take a step back and say... Okay, so I'm going to use DCMS as an example, but I think this is actually true of a lot of governments that I've seen. So DCMS has expert advisory groups, which are people from various different communities that are asked to be part of an ongoing advisory group. And they will, basically, bring together a mixture of technical, business, strategic international diplomacy, as you said. And so they're getting all the different points of view and expertise. And they meet regularly and go, "Here's a bunch of stuff we're thinking about, what do you think?" And they get that feedback and then they process it. And they'll then have followups with little working groups, or sub conversations, and that's an ongoing effort.

351
00:00:10,000 --> 00:00:11,000
Then when they get a topic that they're actually pursuing further, that's when you get the open consultations. And anyone can respond to them, that's why they're called open. And then, as they're going through the open consultation process, they'll also proactively try to seek responses from specific communities. So for example, a number of times they've come to me and said, "Hey, you know a bunch of people who work in security, can you help..."

352
00:00:10,000 --> 00:00:11,000
Jen Ellis:

353
00:00:10,000 --> 00:00:11,000
... number of times they've come to me and said, "Hey, you know a bunch of people who work in security. Can you help us talk to them?" And so, while I'll try and plug them into various people who I think are relevant in different ways, like Ollie, and Ollie's... I mean I know you just picked Ollie because he's Ollie, but he's very engaging with lots of these groups. And then, on top of that, they talk to existing associations and groups that have the ear of technical people. And I don't think that's just unique to the UK, I think the US does the same thing, I think Australia does the same thing. So I actually think that there is a huge effort from governments to talk to technical people.

354
00:00:10,000 --> 00:00:11,000
I think the problem is that as with anything, and I am laughing at myself, saying this because we're in this room, it's an echo chamber. And so, your trouble is you only often speak to the people you already know. You run an open consultation and you hope you'll get to meet new people. You come to an event like this. I mean, these guys flew here to come to talk to you guys because they want to meet people who are in the security community and build those relationships and those networks. But you can't force people to participate in the process, and everyone's busy.

355
00:00:10,000 --> 00:00:11,000
And so, if you have an APSEC consultation... I mean the guy, Ed, who has been running the APSEC consultation has done everything he can think of to hear from the technical people in the security community, to the extent where he literally like I introduced him to some people at [inaudible 00:59:28] and he sort of went along to an [inaudible 00:59:30] and with no knowledge of what was going to happen or if he was going to speak or what was anything to expect because he was like, "I just want to hear from security people who care about app security."

356
00:00:10,000 --> 00:00:11,000
And so, I think the desire is really there all the time to keep it going. But one, yes, it has to be tailored to the specific topic. And two, it has to be met on the other side by willingness from the community. And the problem we all have all the time is that we're drowning in noise. Like how do you guys keep up with what governments are working on? Because I have a hard time with it and it's my job. And so, for people who it's not their day job, I think it's really hard to do.

357
00:00:10,000 --> 00:00:11,000
And we actually talked about this, we were like, I said, "DCMS covers digital, culture, media, and sport." Is there a way to do an RSS feed on the website where you just say, "I'm only interested in cybersecurity. I don't want to hear about all the press releases with sport." And you were like, "That's a good idea."

358
00:00:10,000 --> 00:00:11,000
So I think there's a signal to noise problem is part of it. The other thing I'll say is, and this is UK specific, although I think, again in Australia you have the ACSC, but in the UK, DCMS works very closely with ACSC and I will fight anyone, who says that they don't have good technical experts, because they do, it's their job. So I think that you do get quite a lot of technical input. It's just that sometimes things don't go exactly how you thought they would. And [inaudible 01:01:00], I think we can all agree, it was definitely an example of that. Yeah, go ahead.

359
00:00:10,000 --> 00:00:11,000
Speaker 3:

360
00:00:10,000 --> 00:00:11,000
Like technology companies lobbying, playing into this because I look at myself and I work for myself now, but I don't have time to respond to all the potential requests for information and no one's paying me to do so. But yet, I've done public policy at Visa, at other places, not government relations per se, but they have huge teams of people that are responding. And so, how do you get to the people who are paid to do so by a company?

361
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

362
00:00:10,000 --> 00:00:11,000
So this echo chamber that we were talking about, right?

363
00:00:10,000 --> 00:00:11,000
Jen Ellis:

364
00:00:10,000 --> 00:00:11,000
Yeah.

365
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

366
00:00:10,000 --> 00:00:11,000
Generally, when we put out consultations, the response, like I said, I think at the beginning of the session is, "Yes, this is the right thing to do. Go ahead." And a lot of what we get is from the cybersecurity industry and that's great. It's really, really important that the cybersecurity industry is on board with what we are doing.

367
00:00:10,000 --> 00:00:11,000
The other issue is that... Way before stuff goes public, we have been talking to tech groups and particularly big tech on something like app stores. We absolutely have to speak to the people that are running app stores. Otherwise, this code of practice is dead in the water right before it even comes out. I think we have to be very careful about the technical advice that we get from these companies because there's not a particular company I'm thinking about, honestly, because this is across the board. Security has become one of these things that tech companies use as a differentiator in the market.

368
00:00:10,000 --> 00:00:11,000
And when I talked earlier about we have to make sure that cyber risks are placed alongside other risks. What we see now, and the US are doing a lot about this, and the UK is trying to do stuff about this is, we definitely need in certain areas more competition in the tech sector. We need to do a lot more around making sure consumers are protected in the tech sector. Those are economic harms that sit alongside cybersecurity.

369
00:00:10,000 --> 00:00:11,000
Now what we're finding is because I think all tech policy is new, relatively new compared to things like health and safety policy. So on maturity curve we are really right at the beginning and cybersecurity can sometimes be a little bit ahead of other policy issues in the tech space, particularly around competition, for example. And so, what we find is that companies will be jumping on cybersecurity policy questions as a way to say, "Yes, you should do that." And actually, we need to be careful that it doesn't entrench companies in a way that predicates future digital policy questions.

370
00:00:10,000 --> 00:00:11,000
And so, I think we need to listen to the technical side of things. But we need to understand that the answer that comes out isn't necessarily going to solve that technical problem because that technical issue sits in a much bigger landscape of tech policy and we can't do one bit without the other. But we might have been guilty of doing that a little bit in the past.

371
00:00:10,000 --> 00:00:11,000
Speaker 3:

372
00:00:10,000 --> 00:00:11,000
Right. And this isn't a question, it's just to round out up like exactly the points about liability, for instance, or risk, or who bears the brunt of insurance or who... All of those things have nothing to do with cybersecurity. But there are still lobbyists will be pushing for what's going to be the best outcome for the company as opposed to human beings at the end users, whatever you want to call them.

373
00:00:10,000 --> 00:00:11,000
Jen Ellis:

374
00:00:10,000 --> 00:00:11,000
Yeah. I'll jump on in that because I think I sit in a weird space because I work for security vendor, and I talk to governments a lot. And so, I think the way that most people understand the term, lobbyist, I could potentially satisfy that term. Right? And-

375
00:00:10,000 --> 00:00:11,000
Speaker 3:

376
00:00:10,000 --> 00:00:11,000
Yeah, right. It's a neutral term, right?

377
00:00:10,000 --> 00:00:11,000
Jen Ellis:

378
00:00:10,000 --> 00:00:11,000
No-

379
00:00:10,000 --> 00:00:11,000
Speaker 3:

380
00:00:10,000 --> 00:00:11,000
It's just how you use it.

381
00:00:10,000 --> 00:00:11,000
Jen Ellis:

382
00:00:10,000 --> 00:00:11,000
... And actually, yeah. I'm British, so I don't have... It's not as loaded for me as it is for other people. Plus, I'm talking about cybersecurity, not guns, which is good. One of the things that I observe often is that a lot of the conversations I'm in are staffed by policy people, people whose job is to work on government relations and work on public policy.

383
00:00:10,000 --> 00:00:11,000
And the job of a really good policy person is to be a translator, and to go and talk to the experts in their organization, and build a position based on that expertise, and then translate that to the governments, and back again, and keep going back and forth. But there is a time and a place where the governments need to talk to the technical people themselves, exactly as Dave said. And so, one of the things that I've always weighed on, I mean a story that I was telling Adam the other night, and I think I've probably told George before, like I break on [inaudible 01:06:03].

384
00:00:10,000 --> 00:00:11,000
So I started doing policy purely because I got super indignant about the computer fraud and abuse act, and an angry Jen is bad Jen. And I went off to DC to fix it, and here we are, still not fixed. But the DMCA has improvement. But when I went, I met with staffers on the hill and this is going back nine years and they said, "Oh, you are the first person we've ever spoken to from the security community." And I went, "Oh?" Because they were actively legislating on cybersecurity. And so, I was like "How is that possible?" And they said, "Oh, we talk to lobbyists from the defense contractors, and the big banks, and the big tech companies, and we hear from the Chamber of Commerce who don't want anyone to regulated but we never actually talk to people who work in security." and I was horrified.

385
00:00:10,000 --> 00:00:11,000
And so, I made it a mission after that to really try and figure out a way to plug people who are working in security into these conversations which is why I do things like force these nice people who work for governments to come to events like this. And I think those touch points are super, super, super important. I think we have to create the opportunity for that as much as we can. And I also think it works in the other direction.

386
00:00:10,000 --> 00:00:11,000
It's one thing to capture policymakers and then cage them and bring them here. But we also have to look at what the events are that other people have, that have nothing to do with cybersecurity, and think about how do we plug that cybersecurity reference and knowledge into those events, like how do we go to the forum, the fora, that they're already participating in, that we don't know about because all we think about is cybersecurity all day long.

387
00:00:10,000 --> 00:00:11,000
And I actually think this is one of the biggest challenges I think cybersecurity faces, whether you're talking about it from policy point of view or anything to do with adaption is that we live in an echo chamber and we do a shitty job of breaking out of it. And we spent 30 years, basically, saying to people what's really technical, you wouldn't understand. And now, we're like, "Oh, but you should understand."

388
00:00:10,000 --> 00:00:11,000
So actually, I think that's, to an extent, part of why we need to work with governments because we have successfully gone to a point where there's such a level of apathy around cybersecurity, that unless government's intercede in some way, we will not going to see change as quickly as we need to. And so, it sort of falls to us, it behooves us to actually engage governments and have these conversations with them as much as we can. And so, again, I will be on my soapbox and say to you, "Please participate because you're obviously interested, because you've sat here for an hour very patiently." I mean, yeah.

389
00:00:10,000 --> 00:00:11,000
Speaker 6:

390
00:00:10,000 --> 00:00:11,000
It's okay. Just a really quick follow up-

391
00:00:10,000 --> 00:00:11,000
Jen Ellis:

392
00:00:10,000 --> 00:00:11,000
Can you-

393
00:00:10,000 --> 00:00:11,000
Speaker 6:

394
00:00:10,000 --> 00:00:11,000
... just a really quick follow up. I think one of the other opportunities and we've certainly seen in the consultations on one of the devices but also they use Cyber Resilience Act. Most of the deliverables under the executive order is that the nature of cybersecurity regulation is becoming more prescriptive and more reliant than multiple standards, especially as we go into more central regulations that also needs to have that sectorial lens.

395
00:00:10,000 --> 00:00:11,000
And you talked about the critical infrastructure sector and different needs and I think that just merits a lot of deep technical expertise on informing consultations on the actual technical requirements and the standards in place, and that presents a tremendous opportunity for more technical experts to engage, but also underlines the importance of global engagement.

396
00:00:10,000 --> 00:00:11,000
Because again, going to the points of standards, a lot of the connectivity and interoperability is coming from, I think I see standards that are in common to many of the approaches that are underlining different regulations whether it's called vulnerability disclosure, whether it's connected devices. So I'm just joining Jen call to action on getting more technical expertise and information.

397
00:00:10,000 --> 00:00:11,000
Adam Dobell:

398
00:00:10,000 --> 00:00:11,000
Yeah, I mean, I think it's an issue in Australia, where we've struggling to get those, like the data points in place. So we've been running a process for almost three years now, a best practice for cyber regulation task force. And frankly, if you look at the raw numbers, we had 770 stakeholder consultations and 140 submissions. And I guess one of the key things we wanted to get out of it was that consumer viewpoint, particularly on issues like smart devices and the like.

399
00:00:10,000 --> 00:00:11,000
And I will put it a plug-in for the task force report, which is on incentives and possible regulations that should be coming out soon. And then, we'll be engaging again through consultative processes on the action plans for those. So I would keep an ear out for anything that comes out of strike of. Because we're just cognizant, like I said before, a tech taker and that we really need external views, particularly from the US to engage to shape out our policy frameworks.

400
00:00:10,000 --> 00:00:11,000
Jen Ellis:

401
00:00:10,000 --> 00:00:11,000
I mean, we have 50 minutes left and we are very happy to talk about the sort of aspects around digital service providers, but it seems as though perhaps questions in the room are kind of drying up on that.

402
00:00:10,000 --> 00:00:11,000
Adam Dobell:

403
00:00:10,000 --> 00:00:11,000
I mean, I might just get back to... I saw a couple of nods of the head when I was talking about some of the market values in incentivizing cybersecurity. So I'd be keen to just-

404
00:00:10,000 --> 00:00:11,000
Jen Ellis:

405
00:00:10,000 --> 00:00:11,000
Do you want to talk about that a little bit more? That will be good.

406
00:00:10,000 --> 00:00:11,000
Adam Dobell:

407
00:00:10,000 --> 00:00:11,000
... get because we're thinking about health checks for small, medium enterprises, trust markers and the like, and just want to get unadulterated views on those because I think... We've got some hands.

408
00:00:10,000 --> 00:00:11,000
Jen Ellis:

409
00:00:10,000 --> 00:00:11,000
Yeah. Can you say a little bit more about it? And then, we can see if people have feedback for you.

410
00:00:10,000 --> 00:00:11,000
Adam Dobell:

411
00:00:10,000 --> 00:00:11,000
Sure. So I mean, like I said before that the information asymmetries that exist is this small, medium enterprises are coming to us and saying, "If can you put a trust marker in place for MSPs, for example, because we're unsure of who we should go with and where the risks lie." So that's one example. And the other is just on governance standards that can apply across the Australian economy. Do we want to be prescriptive with those or do we want to have a standards? Again just across the board, a standardized approach.

412
00:00:10,000 --> 00:00:11,000
Jen Ellis:

413
00:00:10,000 --> 00:00:11,000
And bear in mind, because I know probably a lot of people in the room are based in the US, maybe, but bear in mind something that policymakers do strive for is consistency internationally. I mean not to the detriment of their own jurisdictions, priorities, and needs, but certainly to attempt to try and create some alignment internationally, so that it's not creating an overburden of complexity for those who are covered by legislation. So while Adam is asking about stuff that's Australia specific, it could well have an impact for the US in the long run. So it is definitely worth paying attention too. Yeah.

414
00:00:10,000 --> 00:00:11,000
Valerie:

415
00:00:10,000 --> 00:00:11,000
Hi, I'm Valerie. Just to circle back to our talk about bringing more technical into the government consultation process. So your story really ranked true to me. So I run a national security cyber program at a think tank now, but last year in about a decade before, that I was a HillStaffer and I'm deeply, personally painfully aware of how little they know and it's better than it was nine years ago, I would say.

416
00:00:10,000 --> 00:00:11,000
Jen Ellis:

417
00:00:10,000 --> 00:00:11,000
Absolutely. And it was not a criticism of the HillStaffer, right? Resource constrained beyond belief.

418
00:00:10,000 --> 00:00:11,000
Valerie:

419
00:00:10,000 --> 00:00:11,000
Yeah. So one of the reasons why I... one of my goals coming here for the first time was to try to figure out, like who are those people in this community that would be best suited because I have connections to put in front of directly, not just the written back and forth.

420
00:00:10,000 --> 00:00:11,000
Jen Ellis:

421
00:00:10,000 --> 00:00:11,000
Absolutely.

422
00:00:10,000 --> 00:00:11,000
Valerie:

423
00:00:10,000 --> 00:00:11,000
And my current theory is that it's not sufficient just to have the technical expertise but they also need to be fluent enough in the policy world and also really be self-advocates for like they care, they want this outcome for the public good. So if you have any thoughts on who those people might be?

424
00:00:10,000 --> 00:00:11,000
Jen Ellis:

425
00:00:10,000 --> 00:00:11,000
Yeah, I mean we can definitely talk about it after. I think to your point, I think that something that's important to the engagement is you have to recognize that when you come to the table as security expert, your expertise is security. The person on the other side of the table, their expertise is policy. And so you've got to come to the table, yes, with your expertise and your opinions ready to go and ready to talk about it. But you've also got to respect the expertise of the person across the table, who knows a lot more than you do about how policy works and how the law-making process works.

426
00:00:10,000 --> 00:00:11,000
And actually, be willing to collaborate and work with them, not just go, "Well, this is my opinion and if you don't take it, then you suck." It has to be a sort of iterative collaborative process for sure.

427
00:00:10,000 --> 00:00:11,000
Valerie:

428
00:00:10,000 --> 00:00:11,000
Yeah. Can I say they need to have the patience to try to explain the same thing over and over again and fail over and over again. Also, just following up to your point about being a translator, that's funny because that's how I describe my job all the time. I speak congress, right? I'm not a tech expert, but I think I understand enough to explain enough to members of Congress.

429
00:00:10,000 --> 00:00:11,000
Jen Ellis:

430
00:00:10,000 --> 00:00:11,000
John.

431
00:00:10,000 --> 00:00:11,000
John:

432
00:00:10,000 --> 00:00:11,000
Two very quick things. I know we're running short on time. One comment, I think it's important for us to remember too as a community that tech expertise is not a monolithic thing. Not everybody in the tech, in the cybersecurity community, agrees as to what's best. And I think it's important for policymakers to understand that as well. It's just because somebody who has a great reputation is telling them something, that doesn't mean other people might not agree. And so, that gets to the... with more community involvement, it's not just about lobbyists, it's about who has a strong voice who's out there.

433
00:00:10,000 --> 00:00:11,000
So to your point, Adam, when you were talking about MSPs, I think, is where you were sort of leaning. I think more attention needs to be paid to MSPs, 100%. I see it all the time in my risk management job. Small companies finding the right MSP, finding an MSP that understands cybersecurity makes a huge difference.

434
00:00:10,000 --> 00:00:11,000
I think what we need to do is we need to target more of our guidance to MSPs. We got tons of guidance out there around how organizations should secure themselves. I do not think we have enough educating MSPs on how to understand cyber risk for their clients, what are the things that they need to be doing and how for their clients, which is a nuanced to difference from how you go about and doing it yourself.

435
00:00:10,000 --> 00:00:11,000
So I, 100% think that more attention needs to be paid there. There's a lot of discussion about that here in the US trying to figure out what that looks like, not just from a policy perspective but just at the community level, at the risk manager level.

436
00:00:10,000 --> 00:00:11,000
Adam Dobell:

437
00:00:10,000 --> 00:00:11,000
Yeah. I think you get a pretty good indication of the appetite in the government's sphere based on the output in May of this year by the five I's operational agency on security guidance to MSP. So I'd encourage you to have a look at that. It's difficult enough to get the five to publish something and something as vectors to MSP issue was pretty significant, I think. And that was, I'm cognizant on camera, but it was about giving signals to customers that they should be demanding more from MSPs frankly. So I'd encourage you to have a look at that as well.

438
00:00:10,000 --> 00:00:11,000
Jen Ellis:

439
00:00:10,000 --> 00:00:11,000
Becca.

440
00:00:10,000 --> 00:00:11,000
Becca:

441
00:00:10,000 --> 00:00:11,000
Okay. So I have a question [inaudible 01:17:59] small businesses and I'm sure a lot of people has seen a shift to. This microphone isn't great. There you go. A shift towards like micro businesses. So people who are in the service industry especially, and they're very reliant on tech platforms for their following and marketing and they get a lot of business that way. And it seems like we kind of push all of the responsibility for security onto the platforms they're using who might not hand treat them as a business, they treat them as an individual. And I was just wondering if that market in that kind of shift in what business means is something you guys are discussing at all.

442
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

443
00:00:10,000 --> 00:00:11,000
I think it falls into our kind of broader question on how do you get smaller companies to take this stuff seriously. And so, we're trying to... I mean, there's the MSP guidance that was mentioned and there's the kind of MSP best practice for the customer. If you are a two-person operation or a three-person operation, you are filing your taxes, you are doing your accounts, you are paying your payroll, you are opening and closing, you try to find customers.

444
00:00:10,000 --> 00:00:11,000
Throwing in cyber stuff, it doesn't land. And so, that's why we need to... Oh, good title. We need to move this upstream. Because those people are not going to... We put out all the guidance in the world. We actually even have a certification program for small businesses called Cyber Essentials. People won't do it. The uptake is small and it needs to be much bigger. But it's really difficult to get small businesses to do this and quite rightly their time is limited. So the more that we can get those... But then, when you're a slightly bigger business, your risk profile is different.

445
00:00:10,000 --> 00:00:11,000
And it's not just about what those 10 companies that are providing you with services are, it's the 50 companies and how you manage that internally and dealing with your kind of internal environment if you have one. And actually, I think at that point, there's probably more of an appetite to start understanding this and that's where they kind of, how do you drive, good behaviors, good guidance comes into place.

446
00:00:10,000 --> 00:00:11,000
Jen Ellis:

447
00:00:10,000 --> 00:00:11,000
You have a question next to you. Maybe we can just move this out.

448
00:00:10,000 --> 00:00:11,000
Speaker 7:

449
00:00:10,000 --> 00:00:11,000
Sorry. Thank you. Just on the back of that. Yeah. I'm a researcher in Scotland and I did some work for the Scottish government on the back of the Cyber Essentials campaign and trying to get small, medium businesses, but more particular small charities to take up the Cyber Essentials movement, which even with an incentive grant of 1,000 pounds to help upscale them, the charities still didn't have the capacity to submit the grants to actually get the money to make them do it.

450
00:00:10,000 --> 00:00:11,000
And I wonder how do we fit the voices of those types of organizations where ultimately their primary agenda is providing services to their service users as a charity and fitting their sort of everyday routine and the contours of their everyday running into this conversation as well.

451
00:00:10,000 --> 00:00:11,000
Adam Dobell:

452
00:00:10,000 --> 00:00:11,000
Yeah, look, I think that's something we're also considering in Australia. And I mean one of the things... You're right on when it comes to the contours of their daily operations. We want to make it as simple as possible for them. So is it through a vector for information coming through their bank, their financial provider, or their insurer?

453
00:00:10,000 --> 00:00:11,000
There's a cacophony of information out there that they can get access via government websites, but that they're not going hunting for that information. We want to streamline that process and push information out through their trusted networks that they have in the data operation of their business is something we're considering.

454
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

455
00:00:10,000 --> 00:00:11,000
I mean, the thing that people sometimes forget is that charities sometimes deliver critical services, often deliver critical services, care services, end-of-life services, getting people food services, but don't fall under any critical infrastructure laws. And it's a gap, but it's not one that you don't want to stick charities into critical national infrastructure because the things that they would have to do would mean that they would shut down.

456
00:00:10,000 --> 00:00:11,000
And so, it's putting cyber in its place, which means not getting rid of it, but making sure that it sits in there in the right part of the risk register. It's going to be a challenge. It's going to continue to be a challenge.

457
00:00:10,000 --> 00:00:11,000
Jen Ellis:

458
00:00:10,000 --> 00:00:11,000
Yeah. Go ahead.

459
00:00:10,000 --> 00:00:11,000
John:

460
00:00:10,000 --> 00:00:11,000
Sorry, one last quick thing on the MSP that I forgot to mention that's something that I think is an interesting idea. I found one for a client, small company that I work with.

461
00:00:10,000 --> 00:00:11,000
This MSP will not take customers that will not implement multifactor authentication, will not implement certain patch practices. They'll say no. You cannot be a customer if you don't do these things. And so, while it's important that we educate SMBs on the questions to ask, their MSPs, I think it's really important to get the MSPs to start saying, "No, you have to do these things. You have to do these things or you can't be a customer of ours." Now, that seems like tough love in a way.

462
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

463
00:00:10,000 --> 00:00:11,000
But this is a lot of MSPs are worried about customers being the weak point for them, rather than customers worrying the MSPs are the weak spot for them, right? It's a customer with poor cybersecurity actually leading to a breach for other customers. Hugely important.

464
00:00:10,000 --> 00:00:11,000
John:

465
00:00:10,000 --> 00:00:11,000
So not really and that this may not apply to the MSP pieces of the puzzle, but small and medium enterprise micro, half part-time person enterprise business, I think the charity is something I hadn't considered, that could be a large... like the Red Cross is a medium, large organization. I feel pretty strongly that the only option for these classes is the providers and vendors have to do pretty much all of the security for them. And it's great to give them guidance and it's great to give them grants at scale, it's just never going to work.

466
00:00:10,000 --> 00:00:11,000
And that's maybe true of a more mature organization, but obviously, you get a bigger company and they can afford their own internal IT and security and they can select MSPs carefully, that's a little bit of a different beast but... and for consumers as well. I cannot be, where's my phone anyway, I can't be a complete Android security expert and analyze every app that I get. We need the app store and the provider, my service provider and the OS provider to just give me secure stuff, push patches, secure defaults.

467
00:00:10,000 --> 00:00:11,000
So I think that's the only at scale hope, which now gets sort into title of the talk. And this becomes a responsibility, liability issue question. So I think that's where the at scale answer really is for anyone who doesn't have their really own well-funded internal capability.

468
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

469
00:00:10,000 --> 00:00:11,000
I can't remember who it was, if it's Microsoft or Google, but one of them is enforcing two-factor by default now as part of their cloud service. I can't remember which one who have said that they're going to do it. I'd be really interested to understand what impact that has on global cybersecurity because it will have a big one. I am sure. And it's what are those other interventions that we can find that will do those things.

470
00:00:10,000 --> 00:00:11,000
Jen Ellis:

471
00:00:10,000 --> 00:00:11,000
Did you have a thing earlier?

472
00:00:10,000 --> 00:00:11,000
Speaker 8:

473
00:00:10,000 --> 00:00:11,000
I did but it has nothing to do with what we're talking.

474
00:00:10,000 --> 00:00:11,000
Jen Ellis:

475
00:00:10,000 --> 00:00:11,000
Okay. Let me take this one first and then come back to you.

476
00:00:10,000 --> 00:00:11,000
Speaker 8:

477
00:00:10,000 --> 00:00:11,000
Okay. [inaudible 01:25:44].

478
00:00:10,000 --> 00:00:11,000
Speaker 9:

479
00:00:10,000 --> 00:00:11,000
[inaudible 01:25:47]. So I work for US government and one of the policies that is kind of rolling out right now that's affecting a lot of different, or at least in different ways, different agencies and that sort of thing, is called Section 889. I guess it's of the executive order.

480
00:00:10,000 --> 00:00:11,000
It basically prevents federal contractors from obtaining technology services or products from anybody that is affiliated with Huawei or any of their affiliates. And what does that list look like? Who knows? It's hundreds and hundreds and hundreds of companies that if you're a federal contractor, you have to figure out if your supply chain includes all of this.

481
00:00:10,000 --> 00:00:11,000
So anyways, it's just interesting to think about how that level of sophistication is pushed onto companies. And at a certain point, as in a regulatory position, what's your thought in terms of situations where, yes, within the UK or within Australia, you have full control of the situation to some extent? If there's a company that needs to run a separate network, or system, or purchase from a different vendor overseas for their overseas operations, how does that impact them as well? So I don't know, it's kind of a big question.

482
00:00:10,000 --> 00:00:11,000
Adam Dobell:

483
00:00:10,000 --> 00:00:11,000
Look, a huge-

484
00:00:10,000 --> 00:00:11,000
Adam Dobell:

485
00:00:10,000 --> 00:00:11,000
Look a huge, huge question. And look, I think, it goes back to having appreciation of what the risks are in terms of any particular sector. Like I said before, we're not going to be prescribing a certain technical solution in any sector, because we don't have the expertise to do so necessarily. So yeah, vexed. A wicked policy question.

486
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

487
00:00:10,000 --> 00:00:11,000
Yeah. I mean, I think we need to understand what risks we're calculating for, right? Are they cyber security risks? Are we worried about privacy? Are we worried about human rights? Yeah. It's a big one, and I don't think we have something similar in that sense. I think we are, in the UK, at the stage of defining what high risk is and why it's high risk, and that will then define who should be using them and who should not be. The UK, I think, didn't say for Huawei it should not be used at all. It said there are instances when it should and it shouldn't be used, and it should make up a certain amount and was trying to correct a market failure issue in that sense as well.

488
00:00:10,000 --> 00:00:11,000
So I think there were a number of different risks. I don't think it was as straightforward as, "That's a company to not use." There will be instances where the UK government might say, "That's a company to not use." And then it will depend on who you are. And I think there are some absolutes.

489
00:00:10,000 --> 00:00:11,000
So, even with the MSP question, for example, when we're talking about small MSPs, we are still trying to figure out the answer of, if you are a small MSP but you supply a critical amount of critical national infrastructure, do we still make the same exemptions to you to not have to undergo certain requirements? And I think the answer is no.

490
00:00:10,000 --> 00:00:11,000
If you are supplying into critical national infrastructure and you're a significant part of that, if you're a small-medium enterprise and you're doing that, I mean, you've done really well, but you have obligations for national security reasons.

491
00:00:10,000 --> 00:00:11,000
Jen Ellis:

492
00:00:10,000 --> 00:00:11,000
[inaudible 01:29:06].

493
00:00:10,000 --> 00:00:11,000
Speaker 10:

494
00:00:10,000 --> 00:00:11,000
So the United States is about to get its first cyber ambassador. What should be number one on his agenda he'll be taking?

495
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

496
00:00:10,000 --> 00:00:11,000
It's the first one we're rushing to the mic for.

497
00:00:10,000 --> 00:00:11,000
Adam Dobell:

498
00:00:10,000 --> 00:00:11,000
I think that the new ambassador has pretty much outlined his full agenda in the CFR paper. I don't know if you've had a look at that. I thought it was a pretty balanced piece of work. I don't know, I didn't catch his... Has he testified yet, before the... Yeah? Okay. I didn't catch it, so I'm sure he outlined it there.

499
00:00:10,000 --> 00:00:11,000
But we're certainly very excited for the position to be in place, and see it as the final piece in the cyber leadership for the US, which I think has been operating quite well. And it will be interesting to see how he slots into the leadership structure that's already in place.

500
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

501
00:00:10,000 --> 00:00:11,000
I don't work for our foreign affairs department, so I'm a bit of a bull in the China shop on this one.

502
00:00:10,000 --> 00:00:11,000
Adam Dobell:

503
00:00:10,000 --> 00:00:11,000
Nor do I.

504
00:00:10,000 --> 00:00:11,000
Jen Ellis:

505
00:00:10,000 --> 00:00:11,000
Oh, so I'll say what they can't. Russia, China. There you go.

506
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

507
00:00:10,000 --> 00:00:11,000
So I would say something really different to that. I think that the thing that the US, the UK, Australia, countries that can do this well, need to promote how countries do cyber resilience well. I think so much of the global conversation on cyber is around this kind of cyber warfare, or around norms and laws and those quite big questions, quite rightly, are at the front of the agenda.

508
00:00:10,000 --> 00:00:11,000
But I don't think we've hit the right answer to them yet. I think a big part of the answer which we don't take advantage of is if you can get... Doing cyber resilience well is expensive for a country, because it's a cost for people and it's cost for companies. And I think a lot of countries actually take this down a slightly different route and say, "Government will do more so companies have to spend less on this."

509
00:00:10,000 --> 00:00:11,000
And I think that is a false economy, because actually it's not cheaper for governments to do it, because companies are still unprotected. And then what you have is a change in the dynamic of who is policing the internet in that country. And so I think the more we can put cyber resilience at the front of the agenda as the answer to how should cyber be governed in the world, the better it'll be for those countries to remain resilient, but actually the global conversation on how cyber is governed. So if the cyber ambassador is listening-

510
00:00:10,000 --> 00:00:11,000
Adam Dobell:

511
00:00:10,000 --> 00:00:11,000
Yeah.

512
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

513
00:00:10,000 --> 00:00:11,000
This is not coming from the UK government. This is coming from-

514
00:00:10,000 --> 00:00:11,000
Adam Dobell:

515
00:00:10,000 --> 00:00:11,000
And I'll just add-

516
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

517
00:00:10,000 --> 00:00:11,000
Me personally.

518
00:00:10,000 --> 00:00:11,000
Adam Dobell:

519
00:00:10,000 --> 00:00:11,000
One more point to that. If you look at the way that certain state [inaudible 01:31:50] enterprises are operating in the Indo-Pacific, in particular Southeast Asia, they're investing a lot of money into training workforce development and essentially undergirding government systems with their enterprises. Their solutions, I should say. And we're very keen for countries like the UK and the US and Australia to lean in in that respect as well, because I think particularly in Southeast Asia, we're seeing certain entities do that quite well, and there's been a bit of a gap in terms of our diplomacy and capacity building and partnership in that region. So that's one other thing I would add.

520
00:00:10,000 --> 00:00:11,000
Jen Ellis:

521
00:00:10,000 --> 00:00:11,000
Mr. Coleman, I see you moving towards the microphone.

522
00:00:10,000 --> 00:00:11,000
Mr. Coleman:

523
00:00:10,000 --> 00:00:11,000
Sorry Emily. To try to add some dimension to this that we spent a lot of time on the last two days of Eastside Las Vegas and a lot of my time at CISA, is whether it's the carrier's opportunity to do things at scale for the things that can be handled at the network that we handle them at the network, and for advice to countries who don't have enough infrastructure or money to do the cybers or cyber resilience well. I think it's not always about adding cyber security. I think it's about removing dependence or proportional dependence.

524
00:00:10,000 --> 00:00:11,000
And I talk a lot about proportionality. There's a great cost to connectivity in most of these critical infrastructure providers who have had cyber attacks in the last two years. They're the target rich, cyber poor. So we can try to give them money in training and staff that we don't have over the next several years, and or we can right size how connected we are proportional to their ability to operate that responsibly.

525
00:00:10,000 --> 00:00:11,000
So in the carrier discussion, I think instead of maybe doing this everywhere for everyone, the MS ISAC in the US during the elections did free malicious domain blocking service for election authorities. They also did protective DNS services.

526
00:00:10,000 --> 00:00:11,000
So these are the kind of things I think could be useful for hospitals.

527
00:00:10,000 --> 00:00:11,000
Jen Ellis:

528
00:00:10,000 --> 00:00:11,000
Right.

529
00:00:10,000 --> 00:00:11,000
Mr. Coleman:

530
00:00:10,000 --> 00:00:11,000
Water treatment facilities, the cyber poor, and would scale quite nicely. Other ones would get quite messy quite fast.

531
00:00:10,000 --> 00:00:11,000
Similarly, one of the first things I said the very first time I went into Fort Mead, one of them knew I was coming from the hacker community and said, "What do the hackers think of our capabilities?" And my answer was, "I assume we're really, really good at offense. We're really, really bad at defense. We probably take comfort in the assumption the same is true for our adversaries, but we forget as the most connected nation we have much, much more to lose."

532
00:00:10,000 --> 00:00:11,000
And that's my big fear here, is it's not so much that we should be helping people defend smart connected water treatment, it's that maybe we should have less smart connected water until a country or a region is capable of operating that in a responsible fashion. So you can add more cybers, yes. Add more dependence and resiliency, yes. Add more S bonds and transparencies, yes. But in the meantime the fastest path to resilience or safety is to disconnect.

533
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

534
00:00:10,000 --> 00:00:11,000
Yeah. So I mean, the extreme of that is we go back to not being connected. The extreme, right? Just as a... I know that's not what you're suggesting at all. And I think this is where you missed my speech on proportionality as well. And it's really important that therefore those decisions get made on a sector by sector basis.

535
00:00:10,000 --> 00:00:11,000
I think there are certain sectors, I'm thinking civil nuclear for example, that it's entire operating model is based on being able to shut down safely, whatever the scenario is. I think what we don't want to do is start putting cyber as a... I mean I'm talking slightly out of my depth here and on some quite critical issues, but actually I think there are things that are already in place to prevent catastrophic incidents happening, whether it's a cyber incident or not. And I think there are things that are changing that calculus by being slightly too connected, which is what you are saying. And actually, it is then up to the industry and government behind it to say there are certain things that you need to do to prevent this. Right?

536
00:00:10,000 --> 00:00:11,000
So as an example, absolutely everything that is connected to a operational environment should be air-gapped. Maybe that's a thing that we go with. But I think there are also industries where that's completely inappropriate, and there's that balance, then, on security versus innovation. We don't know what smart water whatever might do, but actually the benefits might way outweigh the risks.

537
00:00:10,000 --> 00:00:11,000
Mr. Coleman:

538
00:00:10,000 --> 00:00:11,000
And on the air gap part, I mean, most of us know air gaps almost never are, even if you think they are. But more deliberately, if you go to the World Economic Forum or you go to a lot of the digital transformation summits, they're very confidently adding 12, 16, 20 deliberate perforations to that air gap for predictive maintenance and efficiency and data science. And they're doing it because none of us told them the cost of doing that. Doesn't mean they wouldn't still do it, but they have not baked in the true cost of that project. So not only have we had exposures beyond what we thought, we're aggressively and deliberately adding more exposure.

539
00:00:10,000 --> 00:00:11,000
Jen Ellis:

540
00:00:10,000 --> 00:00:11,000
Okay. So we have 25 minutes left of our allotted time. I guess my question to the room is, do people want to spend more time on digital cyber survivors, or we have already kind of been doing this, but do you want to take the last 25 minutes is basically an AMA for the Australian and UK? Go easier. I'm losing my voice now, unfortunately. I mean, we've already gone off topic pretty badly. So are you... Sort of just volunteering you guys for this, but if people have other questions that are relevant to other areas of policy and you want to ask these guys about it, we do have 25 minutes we can use for that. I thought a hand might go up pretty quick then. All right. So Rebecca, maybe you could just move to that microphone. Thanks. Sorry.

541
00:00:10,000 --> 00:00:11,000
Rebecca:

542
00:00:10,000 --> 00:00:11,000
And I apologize if you talked about this before I got here, but I still want to hear the answer. What are your governments thinking about when it comes to spyware and surveillance software?

543
00:00:10,000 --> 00:00:11,000
Jen Ellis:

544
00:00:10,000 --> 00:00:11,000
That's not come up. You're all good. Are you firmly in favor?

545
00:00:10,000 --> 00:00:11,000
Adam Dobell:

546
00:00:10,000 --> 00:00:11,000
Again, another vexed issue I guess. And we're in a position in Australia where not necessarily this huge uptake in terms of entities that are in Australia and their operations as well. We're not to be naive in that respect, we certainly have to monitor that space and we watch what has happened with NSO, for example, with great interest. And certainly interested in the way that the possible acquisition by an American entity was shut down and the way in which that was done so by the administration and the clear signal that sent. So I thought that was somewhat surprising, but keen to hear [inaudible 01:39:36] views.

547
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

548
00:00:10,000 --> 00:00:11,000
Yeah. I think the UK tries to take a leadership role in global cyber governance issues, and it's difficult to do that if we don't kind of have an active voice on the proliferation of cyber tools. We know that these things can go really, really wrong. We know that they are a risk to human rights in many ways. We've seen it, actually. We've seen that be used.

549
00:00:10,000 --> 00:00:11,000
I don't think it's limited to things like spyware, though. I think we need to be very careful about how commercial cyber tools are managed. In fact, this is a question that came up slightly earlier on export controls. How do we manage kind of this stuff?

550
00:00:10,000 --> 00:00:11,000
So I think we need to be very careful about being active and vocal on this, because otherwise we really lose our ability to stand up in front of a crowd and say, "This is wrong." And not just that. Actually, these are the kind of tools that are used against... Actually, I think spyware tools are used against UK government personnel, certainly many government personnel. But I think the UK is one of them. And I think the UK government has been quite vocal on tools used, whether it's in the UK or elsewhere, and that they shouldn't be commercially available.

551
00:00:10,000 --> 00:00:11,000
Adam Dobell:

552
00:00:10,000 --> 00:00:11,000
Yeah. And I think the other point to add there is that we continue, as democratic nations, to articulate the limits that we're prepared to take in cyberspace. The operations that are undertaken by our agencies are obviously very sensitive, but we need to keep articulating where the lines are and what responsible behavior in cyberspace looks like. So we're obviously very mindful of that, and frankly, the need to engage with the UN process on these issues as well.

553
00:00:10,000 --> 00:00:11,000
Jen Ellis:

554
00:00:10,000 --> 00:00:11,000
Any other questions or comments? Feedback?

555
00:00:10,000 --> 00:00:11,000
John:

556
00:00:10,000 --> 00:00:11,000
I wouldn't mind taking it back to the digital service providers for a second.

557
00:00:10,000 --> 00:00:11,000
Jen Ellis:

558
00:00:10,000 --> 00:00:11,000
Yeah, please.

559
00:00:10,000 --> 00:00:11,000
John:

560
00:00:10,000 --> 00:00:11,000
Not bad form.

561
00:00:10,000 --> 00:00:11,000
Jen Ellis:

562
00:00:10,000 --> 00:00:11,000
It was great.

563
00:00:10,000 --> 00:00:11,000
John:

564
00:00:10,000 --> 00:00:11,000
Now kind moved away from it.

565
00:00:10,000 --> 00:00:11,000
Jen Ellis:

566
00:00:10,000 --> 00:00:11,000
That's what we're here for.

567
00:00:10,000 --> 00:00:11,000
John:

568
00:00:10,000 --> 00:00:11,000
Good. So I heard you say something earlier, and I want to make sure I heard it correctly and maybe some follow up thoughts on it. There clearly is a balance when we look at regulation versus sort of market forces and letting those things figure themselves out. I think you started to describe at one point there are a lot of good things that are happening with digital service providers where cyber security and doing good security and doing good privacy has become a market differentiator. I'm wondering if we have a sense of where is the threshold where we say, "You know what? These are actually doing pretty good. They're doing it pretty good consistently. So let's just take a step back from regulation. Maybe we don't need to do it because they actually seem to be doing what we want them to do." Any further thoughts on that? And that's open to everybody.

569
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

570
00:00:10,000 --> 00:00:11,000
So we love a survey in DCMS, as Jen said, right? So we have a number of different things that we keep an eye on, and one that we'll be keeping an eye on is how actively organizations monitor or have a grasp on their digital supply chain. I think we'll be looking at how legislation... I mean, legislation hasn't come into place. That hasn't even gone into parliament yet. It's just the proposals that we've kind of consulted on.

571
00:00:10,000 --> 00:00:11,000
We will be looking to see how that changes over the years. If that 7% goes to 97%, we will pull back, because it clearly wouldn't be appropriate for us to legislate if all companies are aware of their cyber security. And sorry, the next bit is, and they're doing it well and it's working and supply chain attacks are reducing. It's really difficult to get that nuance of information.

572
00:00:10,000 --> 00:00:11,000
And then the other thing that we don't have but we should find a way to do this is what are those relative costs? What is the relative cost of poor cyber security in digital supply chains versus the other things that digital poor cyber security and digital service providers versus the positives that actually not allowing those digital sales providers to continue without regulations and grow in the ways that they have been.

573
00:00:10,000 --> 00:00:11,000
We don't have a one number versus another number, because we are quite immature in our policy development for cyber security. But I think as that technology policy space develops, those kinds of valuations should be done and will be done. And it won't just be around cyber security. It will be around costs of data governance, for example. Costs of competition policy and those kinds of things. So I don't know that we have the answer to all of those yet, but some of it will be around breaches, some of it will be around user awareness.

574
00:00:10,000 --> 00:00:11,000
Speaker 12:

575
00:00:10,000 --> 00:00:11,000
[inaudible 01:45:13].

576
00:00:10,000 --> 00:00:11,000
Adam Dobell:

577
00:00:10,000 --> 00:00:11,000
No, we'll just add through the work we're doing and the cyber best practice regulation task force in Australia. I think we got pretty clear feedback that there was areas, particularly on smart devices, where the consensus view that was we need to move on regulation in line with what the UK is seeking to do. And frankly, as we've discussed, we're very careful in the process of consultation, identifying issues and then moving through to legislation. That was probably one of the key areas where I think we're going to potentially move. The rest of it, I think we're still in a process where we need to go back out and consult pretty thoroughly on it.

578
00:00:10,000 --> 00:00:11,000
John:

579
00:00:10,000 --> 00:00:11,000
Do you think that mandatory incident reporting... I know we're not talking about mandatory incident reporting, but I think it dovetails here a little bit. If you're talking about how do we measure, how do we know? Do you think that mandatory incident reporting over time provides some of that insight to say, "Hey, you know what? These digital service providers are now doing these things and we're seeing a decrease in incidents." That may never happen, but it's the potential. So do you see those things working together? Do you think they're useful? And actually, [inaudible 01:46:25] as well.

580
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

581
00:00:10,000 --> 00:00:11,000
So we have mandatory incident reporting for critical national infrastructure.

582
00:00:10,000 --> 00:00:11,000
Adam Dobell:

583
00:00:10,000 --> 00:00:11,000
As does Australia.

584
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

585
00:00:10,000 --> 00:00:11,000
It's difficult to get a head or tail of the data, because they sit with the regulators. And that obligation doesn't currently sit, if I'm right, which I'm is about 50% of the time, doesn't sit with digital service providers at the moment.

586
00:00:10,000 --> 00:00:11,000
Adam Dobell:

587
00:00:10,000 --> 00:00:11,000
Yeah.

588
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

589
00:00:10,000 --> 00:00:11,000
They are regulated in a slightly different way. So I think it's a really interesting tool, but as with a lot of policy, the devil's in the detail.

590
00:00:10,000 --> 00:00:11,000
Adam Dobell:

591
00:00:10,000 --> 00:00:11,000
Yeah. I think one of the interesting facets of the cyber incident reporting regime that was just legislated in this country was the transparency that is included and which I think most people didn't pick up initially, but talking to the staff of the committee pulled together, it was quite deliberate in ensuring that there was transparency of the information, and to get an aggregated view of what incidents look like and whether or not there's a maturation process there.

592
00:00:10,000 --> 00:00:11,000
So I would be very interested to see how that's digested by other countries and whether or not we look at something similar, because it's certainly not something we necessarily thought of in the Australian context, but talking to the folks on the hill who drafted it, they wanted that consistent feedback from CISA as to what they're seeing and the trajectory of things and whether or not it's working and to get, like I said before, aggregate a view of what's happening.

593
00:00:10,000 --> 00:00:11,000
John:

594
00:00:10,000 --> 00:00:11,000
Very interested in how it's going to work out.

595
00:00:10,000 --> 00:00:11,000
Adam Dobell:

596
00:00:10,000 --> 00:00:11,000
Yeah.

597
00:00:10,000 --> 00:00:11,000
John:

598
00:00:10,000 --> 00:00:11,000
[inaudible 01:48:00]. Thank you.

599
00:00:10,000 --> 00:00:11,000
Mr. Coleman:

600
00:00:10,000 --> 00:00:11,000
If I can build up that a little bit, I said this to some of you yesterday. The voluntary only [inaudible 01:48:11] cybersecurity framework was in some ways a stall tactic to not regulate. We didn't want a heavy handed government before we knew more things. And if you were involved in those, one of the promises was with this framework, to stimulate conversation, we could also look at which types of controls are and are not adopted. What the correlation is between these sets of controls and breaches and things like that.

601
00:00:10,000 --> 00:00:11,000
But I had to testify in May about should we make this cyber security framework overlay for healthcare? And I said, "You don't even know who's using it yet." Because there was an office of inspector general report, and I think it was a single digit percentage of the healthcare sectors even attempting to use it 10 years later.

602
00:00:10,000 --> 00:00:11,000
So with this new mandatory breach reporting and transparency, great. But there's three and a half years of rule making before we'll even see it start to kick in. And I continue to argue that the adversaries have set the pace and the tempo, and our very good faith desire to move slowly and judiciously and let's not be rash, let's not overregulate... I would argue we have under-regulated. And even the voluntary thing hasn't had it.

603
00:00:10,000 --> 00:00:11,000
So I've been advocating for things like any sort of safe harbor, any sort of forgiveness is tethered to your ability to have [inaudible 01:49:25] stations of your posture against something like the cybersecurity framework or that you aren't being compromised for something I would consider negligent, like the [inaudible 01:49:35] bad practices. So I think there has to be a middle ground between they're doing good enough, so let's not regulate them, or let's do voluntary for 10 to 15 years. If we really want to be a learning organization or a learning country or learning sector, we should get some baseline performance objectives and measurements and then play with them over time.

604
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

605
00:00:10,000 --> 00:00:11,000
I love that, because as part of the new national cyber strategy, there is a performance framework that sits alongside it. A baseline of what is currently happening and what we would like to see after 1, 2, 3, and five years. And then we will need to measure it. And it's things like are critical national infrastructure companies complying with the cyber assessment framework, which is mandated to them? What is the uptake? Is the rate of uptake in companies going up or is it going down?

606
00:00:10,000 --> 00:00:11,000
Yeah, so there's a question on are we achieving what we set out to achieve, which is improving all of these practices? And actually, is all of that stuff still right? Have we missed something? Do we need to move in a different direction?

607
00:00:10,000 --> 00:00:11,000
In terms of under regulation, the only thing I'd say is in the UK, those regulations for most of critical national infrastructure came in in 2018. So companies have had three, four years now to come to terms with it. We still think that's early. We still think four years is at the beginning, and companies are just starting to get through their kind of first cycle of board membership, board reporting on what's been happening. The next five years will be very interesting and I think after this strategy, this UK strategy which has just been published in December, the next one will very much depend on how successful our initiatives have been. Do we go kind of mandatory on a lot of things, or actually, has this approach worked?

608
00:00:10,000 --> 00:00:11,000
Speaker 13:

609
00:00:10,000 --> 00:00:11,000
[inaudible 01:51:45]?

610
00:00:10,000 --> 00:00:11,000
John:

611
00:00:10,000 --> 00:00:11,000
We can hope.

612
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

613
00:00:10,000 --> 00:00:11,000
Only about 60% of it.

614
00:00:10,000 --> 00:00:11,000
Speaker 15:

615
00:00:10,000 --> 00:00:11,000
Is there something that would need to happen externally? Something really bad. How bad would it need to be to get to where you're saying together?

616
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

617
00:00:10,000 --> 00:00:11,000
Have you watched have the undeclared war in the UK?

618
00:00:10,000 --> 00:00:11,000
Jen Ellis:

619
00:00:10,000 --> 00:00:11,000
I don't think they've had it yet.

620
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

621
00:00:10,000 --> 00:00:11,000
No.

622
00:00:10,000 --> 00:00:11,000
Speaker 15:

623
00:00:10,000 --> 00:00:11,000
But I mean, how... If it's undeclared, I mean...

624
00:00:10,000 --> 00:00:11,000
Mr. Coleman:

625
00:00:10,000 --> 00:00:11,000
Thresholds. We need thresholds.

626
00:00:10,000 --> 00:00:11,000
Speaker 15:

627
00:00:10,000 --> 00:00:11,000
At what point does it get bad enough? Because I don't know, I mean, there are some people who might argue... Some people might say that it's pretty bad right now.

628
00:00:10,000 --> 00:00:11,000
Speaker 14:

629
00:00:10,000 --> 00:00:11,000
Can we make an announcement? If you would like, after the session is over, we have tickets and you can go next door and discuss some more about this for a beer or...

630
00:00:10,000 --> 00:00:11,000
Speaker 11:

631
00:00:10,000 --> 00:00:11,000
I don't think it's for drinks.

632
00:00:10,000 --> 00:00:11,000
Jen Ellis:

633
00:00:10,000 --> 00:00:11,000
What drinks? Sorry.

634
00:00:10,000 --> 00:00:11,000
Speaker 11:

635
00:00:10,000 --> 00:00:11,000
Yeah.

636
00:00:10,000 --> 00:00:11,000
Speaker 14:

637
00:00:10,000 --> 00:00:11,000
That a thing?

638
00:00:10,000 --> 00:00:11,000
Jen Ellis:

639
00:00:10,000 --> 00:00:11,000
Well, so I think we actually have a session next door, don't we?

640
00:00:10,000 --> 00:00:11,000
Speaker 14:

641
00:00:10,000 --> 00:00:11,000
No. She tells me this is going to be the room they put me in.

642
00:00:10,000 --> 00:00:11,000
Jen Ellis:

643
00:00:10,000 --> 00:00:11,000
Oh wait, the Gala [inaudible 01:52:54] in here? I thought it was next door.

644
00:00:10,000 --> 00:00:11,000
Speaker 14:

645
00:00:10,000 --> 00:00:11,000
The tickets are for next door.

646
00:00:10,000 --> 00:00:11,000
Jen Ellis:

647
00:00:10,000 --> 00:00:11,000
Okay.

648
00:00:10,000 --> 00:00:11,000
Speaker 14:

649
00:00:10,000 --> 00:00:11,000
[inaudible 01:53:04].

650
00:00:10,000 --> 00:00:11,000
Jen Ellis:

651
00:00:10,000 --> 00:00:11,000
Sorry. So are the Gala battles in here?

652
00:00:10,000 --> 00:00:11,000
Speaker 11:

653
00:00:10,000 --> 00:00:11,000
[inaudible 01:53:08].

654
00:00:10,000 --> 00:00:11,000
Jen Ellis:

655
00:00:10,000 --> 00:00:11,000
Okay. So yeah, we can wrap up.

656
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

657
00:00:10,000 --> 00:00:11,000
Can I... Just on Michael's, a very quick answer.

658
00:00:10,000 --> 00:00:11,000
Jen Ellis:

659
00:00:10,000 --> 00:00:11,000
Yeah.

660
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

661
00:00:10,000 --> 00:00:11,000
One of the points is going to be public appetite, because it's politicians. In the UK we can say certain things as civil servants, and politicians will drive the legislative agenda. I think a lot of this is how public opinion shifts so that ministers say this is a priority for the next legislative agenda. I don't know what it would take, but I think that public opinion bit, political appetite is that one of the key drivers.

662
00:00:10,000 --> 00:00:11,000
Adam Dobell:

663
00:00:10,000 --> 00:00:11,000
Yeah, I'd agree with that. And also add that the scale, if it tilts in terms of costs for operating in Australia in terms of businesses, I think that's where we're going to have an appetite to really legislate, but we're not there necessarily yet.

664
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

665
00:00:10,000 --> 00:00:11,000
Sorry Jen.

666
00:00:10,000 --> 00:00:11,000
Jen Ellis:

667
00:00:10,000 --> 00:00:11,000
No, you're good. I'm just double checking where it is. Okay. So it seems like it might be in both, which is really weird. So for those who are interested in policy but want something a little lighter than this, from six to seven we have a session called gavel battles. Chaotic Gavel battles, where we will be challenging four security, I want to say, experts. Because one of them's sitting just there. We'll be challenging four security experts to battle it out with micro debates on policy related topics, and the audience will vote on the winner and the losers will drink.

668
00:00:10,000 --> 00:00:11,000
So it's going to be messy. It's going to be ridiculous, and it's possibly next door or in here, but somewhere. The schedule doesn't say. I think it's next door. All right, thanks very much. Thank you to our speakers.

669
00:00:10,000 --> 00:00:11,000
Irfan Hemani:

670
00:00:10,000 --> 00:00:11,000
Thank you everyone.

671
00:00:10,000 --> 00:00:11,000
Jen Ellis:

672
00:00:10,000 --> 00:05:00,000
Thank you.