1
00:00:00,000 --> 00:00:04,840
Good afternoon, everyone. My name is Maurice. I'm going to be your host, which means that I

2
00:00:04,840 --> 00:00:08,360
just get to go over a few of the ground rules and then let you get here for what you really

3
00:00:08,360 --> 00:00:14,000
wanted to hear about, which is international policy 101. Like I said, we're going to start

4
00:00:14,000 --> 00:00:19,780
this off by letting you know that this is going to be on the record. So that is going to be

5
00:00:19,780 --> 00:00:25,800
streamed out and make sure that if you don't want to be on camera, you take note of the

6
00:00:25,800 --> 00:00:34,720
camera behind you. As we're going to be hearing from our panelists today, they're going to go

7
00:00:34,720 --> 00:00:38,940
through, introduce themselves, and then we'll have some Q&A at the end. Also, at the end of

8
00:00:38,940 --> 00:00:42,560
the session, there is going to be a feedback slide, so you can go ahead and scan the QR code,

9
00:00:42,720 --> 00:00:46,360
let us know what you thought about it. During the session, please keep in mind, if you have

10
00:00:46,360 --> 00:00:51,960
anything that beeps, makes any fun noises, put that on silence, so that way we don't all hear

11
00:00:51,960 --> 00:00:55,780
it. And then lastly, as a reminder, if you have any questions, feel free to reach out to us.

12
00:00:55,780 --> 00:01:00,700
If you are standing up, please try to find a seat. If not, keep the hallways clear as best we

13
00:01:00,700 --> 00:01:04,040
can. And with that, let's go ahead and start. Thank you.

14
00:01:04,600 --> 00:01:10,460
Thank you very much, Maurice. And thank you all for coming. Welcome to DEF CON. It's

15
00:01:10,460 --> 00:01:14,440
fantastic to be here. Great opportunity to share. We've got a wonderful panel to talk through

16
00:01:14,440 --> 00:01:21,200
international cybersecurity policy work. Just a few things from our side. We have allocated

17
00:01:21,660 --> 00:01:25,760
about one hour, 20 minutes for the kind of component of it, the on the record, and then the

18
00:01:25,780 --> 00:01:29,540
record component. And the intention will be that that will enable people to come and ask

19
00:01:29,540 --> 00:01:33,960
questions afterwards and have a kind of one-on-one conversation, if that's helpful. Of course, happy

20
00:01:33,960 --> 00:01:39,560
and flexible, make the most of time, but also that's the intention. So what we're going to do is

21
00:01:39,560 --> 00:01:44,440
just start with a few personal instructions. You know, really excited to be here. So my name is

22
00:01:44,440 --> 00:01:52,320
Peter Stevens, and I'm at the OECD, which is, thank you. That wasn't expected, but greatly

23
00:01:52,320 --> 00:01:55,760
appreciated. So it's an international organization. It's an international organization that's

24
00:01:55,780 --> 00:02:02,080
based in Paris, which supports 30 member state countries on a range of policy issues. As you can

25
00:02:02,080 --> 00:02:06,340
maybe tell from my accent, previously I was based in the United Kingdom, where I worked in the

26
00:02:06,340 --> 00:02:10,540
Department of Digital, Culture, Media, and Sport. And I led the Secure Biodesign Policy Initiative,

27
00:02:10,700 --> 00:02:15,660
so the work on IT security was my area. So it's great to be here. And what I'll do is just pass

28
00:02:15,660 --> 00:02:20,660
down, and then we can, we'll have a start-up conversation. Hi all. My name's Adam DeBell. I work

29
00:02:20,660 --> 00:02:25,580
for the Australian government at the embassy in D.C., and my job is to engage with the U.S. government

30
00:02:25,780 --> 00:02:34,820
and the industry on cybersecurity policy. Hi there. Peter Brown. I work for the European Parliament.

31
00:02:34,940 --> 00:02:40,840
I'm a career civil servant there since 1990, although I did take 10 years sabbatical working in the

32
00:02:40,840 --> 00:02:48,460
private sector. I lead on tech policy for the, what I call the Eat Your Own Dog food service, which is

33
00:02:48,460 --> 00:02:55,500
where we examine within the parliament how policy that we're adopting politically actually will have an impact

34
00:02:55,780 --> 00:03:00,700
within the IT services in the parliament. So we're sort of stuck between policy and operations.

35
00:03:01,620 --> 00:03:07,080
Hi everyone. It's great to be here. My name is Bryony Crown, and I lead on all things cyber policy in the embassy

36
00:03:07,080 --> 00:03:12,320
in D.C. for the British government. But similar to Adam, also lead on all things cyber policy with the U.S.

37
00:03:12,320 --> 00:03:22,280
and industry. I'm Ari Schwartz. I'm managing director of cybersecurity services at Venable. I also run the

38
00:03:22,280 --> 00:03:24,640
Center for Cybersecurity Policy and Law.

39
00:03:25,900 --> 00:03:29,180
Previously in the Obama administration, I was in the National Security Council.

40
00:03:30,300 --> 00:03:34,160
Thank you so much. And we're really hoping to have an interactive session as well.

41
00:03:34,900 --> 00:03:41,560
So please do feel free to continue to ask questions. As I said, there will be an opportunity at the end for off-the-record conversations as well.

42
00:03:41,640 --> 00:03:44,680
But if you want to raise questions, then please feel free to do so.

43
00:03:46,520 --> 00:03:52,540
So, you know, what I'd also like the intention from this session is that everyone leaves with an understanding of what the key priorities are,

44
00:03:52,960 --> 00:03:55,300
what people at different countries are working on.

45
00:03:55,780 --> 00:04:00,580
And how we can make sure that we continue to inform one another of our work as it progresses.

46
00:04:01,180 --> 00:04:09,360
So, you know, the way that we were thinking about framing this conversation was to kind of think through the various challenges that cybersecurity policymakers have been facing.

47
00:04:09,400 --> 00:04:14,080
First of all, in creating their own identity, you know, it's had to be generated very quickly.

48
00:04:14,560 --> 00:04:25,000
And then how that has translated into challenges of sort of securing existing technologies and then moving into challenges that have been, you know, how we can learn from that experiences,

49
00:04:25,000 --> 00:04:28,600
to make sure that we're more resilient, became more capable of addressing these issues.

50
00:04:28,760 --> 00:04:36,560
And then in the future, also for touching upon cyber workforce and cybersecurity, so skills agenda as well as an area of interest.

51
00:04:37,000 --> 00:04:44,600
So I think for me, one area that I'm particularly interested in is how we can be helping to like play catch up.

52
00:04:44,680 --> 00:04:52,500
I think an area that in my experience in DCMS that we had was particularly in light of the Mirai botnet attack was thinking about,

53
00:04:52,560 --> 00:04:54,760
OK, now I've got so many of these IoT devices.

54
00:04:55,000 --> 00:04:59,800
They're being used by businesses and by individuals across the United Kingdom and across the world.

55
00:05:00,220 --> 00:05:04,320
And we had to kind of retrofit security into those forms of technology.

56
00:05:04,600 --> 00:05:11,700
And that was a real challenge of how we can create this approach where working in policy is a particular way of operating,

57
00:05:11,920 --> 00:05:18,540
which often relies on lengthy consultation processes, long engagement with various stakeholders,

58
00:05:18,800 --> 00:05:23,260
and lots of ministerial engagement or lots of hierarchical processes.

59
00:05:23,340 --> 00:05:24,980
It can be often confusing.

60
00:05:25,000 --> 00:05:29,100
I mean, we can all agree, not as fast as the private sector in terms of how it can operate.

61
00:05:29,420 --> 00:05:36,200
But then there's been a question of how we can learn quickly to try and make the best impact we can within those areas of technologies.

62
00:05:37,260 --> 00:05:42,100
So, you know, I think that that comes into this secure by design approach that often gets referred to.

63
00:05:42,640 --> 00:05:46,900
So I suppose what I'd love to really talk about is maybe start with Bryony,

64
00:05:47,320 --> 00:05:50,980
understanding a bit more about some of the work that's been taking on in the UK.

65
00:05:51,180 --> 00:05:54,920
And also she can talk through both on the PSTI bill,

66
00:05:55,000 --> 00:05:57,860
but also a bit more on the Telco.

67
00:05:58,420 --> 00:05:59,640
Thank you very much.

68
00:05:59,880 --> 00:06:02,320
So just to start a bit about secure by design,

69
00:06:02,480 --> 00:06:06,540
because I feel like in UK government we've talked about secure by design for quite a long time now.

70
00:06:06,700 --> 00:06:13,900
So talking about what that actually means is about how we want to secure technology and data sharing systems

71
00:06:14,720 --> 00:06:17,180
on a secure by default basis,

72
00:06:17,300 --> 00:06:21,580
which basically means that we're not retrofitting and we're not doing security as an add-on.

73
00:06:22,160 --> 00:06:24,900
I'm sure a lot of you have heard about the analogies we talk about.

74
00:06:24,980 --> 00:06:29,560
Having seatbelts in cars, making sure that as you know, if we have seatbelts, there's less deaths.

75
00:06:30,100 --> 00:06:35,020
I'm sure people have also heard about if we have with aeroplanes that we used to have square windows,

76
00:06:35,320 --> 00:06:38,540
which meant there was pressure on the corners, which led to many more deaths.

77
00:06:38,920 --> 00:06:43,680
Now we have circular windows, which means that there's secure by default and it's much more safe.

78
00:06:44,780 --> 00:06:49,480
So that's something that we think that's how we need to think about.

79
00:06:49,720 --> 00:06:53,520
I'm sure we're going to talk more about AI and how we need to approach that.

80
00:06:54,980 --> 00:06:59,280
But what we recognize is that we can talk a lot about that, but it's actually that's really difficult for industry.

81
00:06:59,480 --> 00:07:01,980
It costs money. It costs time. You want to go quick to market.

82
00:07:02,120 --> 00:07:03,220
It's really, really difficult.

83
00:07:03,340 --> 00:07:09,700
So actually how we work together to make that as enforceable and easy as possible is how we can actually achieve that.

84
00:07:10,240 --> 00:07:17,980
So in April, we issued some guidance with a lot of countries, with Australia, with the US and a number of other partners.

85
00:07:18,280 --> 00:07:21,780
A bit of a roadmap of how you can act, how companies can do that.

86
00:07:21,920 --> 00:07:24,960
And that's meant to be some really easy, enforceable.

87
00:07:24,980 --> 00:07:26,980
Steps. This isn't rocket science.

88
00:07:27,100 --> 00:07:29,360
What we're talking about is about not having default passwords.

89
00:07:29,580 --> 00:07:31,960
This is about things that should be being done by practice.

90
00:07:32,800 --> 00:07:38,700
But sometimes that's really difficult when people are not thinking about security as you know, because you want to go quickly into the market.

91
00:07:39,940 --> 00:07:42,880
So we're doing that via a variety of initiatives.

92
00:07:43,060 --> 00:07:48,040
And I know there's a listening session with CISA later to go through some of that guidance line by line and get some feedback.

93
00:07:48,960 --> 00:07:54,860
But some of the things that we're doing in the UK to enforce that is with our product security.

94
00:07:54,980 --> 00:08:01,220
Act, which was brought into force into the last year and will be made law by April next year.

95
00:08:01,400 --> 00:08:04,100
And that's about consumer devices.

96
00:08:04,560 --> 00:08:08,140
And what we've done is take this much a very evidence based approach.

97
00:08:08,380 --> 00:08:15,880
So this was taking evidence from our National Cyber Security Center to look at where do we see the most threat and where can we do things that make the most impact?

98
00:08:16,240 --> 00:08:17,640
And that's via three steps.

99
00:08:17,840 --> 00:08:19,640
So one is not having default passwords.

100
00:08:19,960 --> 00:08:22,440
One is having a mechanism to report vulnerabilities.

101
00:08:22,440 --> 00:08:30,240
And the third one is the manufacturer to be transparent about how long that device will be updated for.

102
00:08:31,200 --> 00:08:33,960
The really great thing about this legislation is that it can be updated.

103
00:08:34,200 --> 00:08:36,700
This is very much seen as the initial raising of that resilience.

104
00:08:37,520 --> 00:08:41,260
But it was something that we can potentially look to build upon in the years to come.

105
00:08:41,440 --> 00:08:43,320
And I'm sure we'll go talk a bit more about the CRA.

106
00:08:43,780 --> 00:08:52,420
But there's something we see as something that is very much in partnership and something that we will see to be that we will continue to assess and see how both those bits of legislation work.

107
00:08:52,440 --> 00:09:00,740
The second bit of legislation which came into force almost two years ago now is the Telecoms Security Act.

108
00:09:02,320 --> 00:09:08,520
This is really to recognize that telecoms and networks are the backbone of how we manage our everyday lives.

109
00:09:08,800 --> 00:09:12,920
And we talk a lot about in the UK about making the UK the safest place to live and work online.

110
00:09:13,200 --> 00:09:15,280
And this is seen as the backbone of how we do that.

111
00:09:15,400 --> 00:09:20,300
And there's a ton of work that went into inform that work about we had diversification strategy.

112
00:09:20,580 --> 00:09:21,900
We had what we're looking at.

113
00:09:21,900 --> 00:09:22,420
There is the data.

114
00:09:22,440 --> 00:09:22,660
We have a network.

115
00:09:23,080 --> 00:09:25,060
We're most vulnerable to threat.

116
00:09:25,280 --> 00:09:27,800
And so this is, like I say, a very evidence-based approach.

117
00:09:28,060 --> 00:09:36,220
And the aim of that legislation is to raise the resilience of networks and to make sure that they are the most threat, are resilient as much as possible.

118
00:09:36,480 --> 00:09:39,120
So that's something we're really proud of in the UK.

119
00:09:39,380 --> 00:09:40,440
We've still got a long way to go.

120
00:09:40,540 --> 00:09:41,340
We haven't fixed everything.

121
00:09:41,680 --> 00:09:48,840
But it's something that to us, those two areas, is a real key of how we can raise the overall security of the UK and indeed the world.

122
00:09:49,440 --> 00:09:51,820
I think that's amazing to hear about.

123
00:09:51,820 --> 00:10:00,620
And I think something that may be interesting for participants who may be not familiar with the intricacies of UK parliamentary law is there's sort of there's the distinction between primary legislation and secondary legislation.

124
00:10:00,920 --> 00:10:11,820
And in both cases, those bills are what we call primary legislation, which means it's on the statute book as an independent piece of legislation, which takes a long time to get implemented because there's a lot of parliamentary time that goes into that process.

125
00:10:12,000 --> 00:10:21,800
So the competition internally to secure a spot in the Queen's speech, which generates the kind of which way all of the what bills will be implemented.

126
00:10:23,040 --> 00:10:24,520
That is very competitive.

127
00:10:24,740 --> 00:10:28,300
But once you're on that statute book, it becomes much easier to add regulation.

128
00:10:28,580 --> 00:10:34,820
So actually, in terms of creating the capacity to be more adaptable, there is a distinction between primary and secondary.

129
00:10:35,100 --> 00:10:37,100
And that's I'm sure that maybe in other countries as well.

130
00:10:37,180 --> 00:10:42,320
But I think that's a really important part for both the PSTI and the Telco Security Bill is an important distinction.

131
00:10:42,460 --> 00:10:48,360
And I think helpfully, as you know, a big challenge that I think legislation faces is how can it make.

132
00:10:49,060 --> 00:10:50,980
How do you avoid it becoming obsolete?

133
00:10:51,160 --> 00:10:51,780
But as soon as it becomes obsolete.

134
00:10:51,800 --> 00:10:56,020
As soon as you become implemented, because as technology moves so quickly, that's very difficult.

135
00:10:56,240 --> 00:11:04,340
So my hope is that by having that process and that engagement with industry and that engagement with security communities, you're able to make sure you're fit for purpose in that way.

136
00:11:04,520 --> 00:11:06,260
So, yeah, that's an important point.

137
00:11:07,900 --> 00:11:11,940
Adam, do you want to talk a bit more about some of the things that are going on in Australia on that side?

138
00:11:12,120 --> 00:11:12,320
Sure.

139
00:11:12,480 --> 00:11:18,720
And I'll start by outlining Australia's position in our region.

140
00:11:19,540 --> 00:11:43,620
In 2017, in recognition of the deteriorated geostrategic environment we found ourselves in, the Australian government made the decision to introduce legislation which would require our telecommunications companies to not have vendor equipment in their networks that came from countries which were subject to extradition, territorial direction.

141
00:11:44,520 --> 00:11:48,700
Then we went on a journey over the next few years to outline the situation.

142
00:11:48,700 --> 00:11:52,400
Then we went on a journey over the next few years to outline what we consider to be critical infrastructure assets.

143
00:11:53,000 --> 00:12:02,200
And so we have required through legislation that was introduced in 2018, and we've defined 11 sectors.

144
00:12:02,540 --> 00:12:04,780
Within that, there's 22 asset classes.

145
00:12:05,720 --> 00:12:13,020
And those assets are required to report to the Australian government their asset holdings, their ownership structure.

146
00:12:13,240 --> 00:12:18,680
So we get an understanding of which countries have the ability to direct their assets.

147
00:12:18,680 --> 00:12:20,520
And then we look at the country's operations in Australia, critical infrastructure.

148
00:12:21,400 --> 00:12:31,860
They're also required to manage or report cyber incidents in the same way that the US is developing CERCEA, going through a rule making process for CERCEA.

149
00:12:31,980 --> 00:12:35,980
It's a very similar mandatory reporting obligation.

150
00:12:36,260 --> 00:12:38,940
The time frames are very much aligned.

151
00:12:39,520 --> 00:12:45,040
The next element of that is a requirement to develop a risk management plan.

152
00:12:45,380 --> 00:12:48,660
And as part of that risk management plan, cyber security is a very important part of that.

153
00:12:48,660 --> 00:12:49,900
Cyber security is a critical element.

154
00:12:50,140 --> 00:12:57,040
And we are requiring entities to develop a plan that uses an internationally recognised framework.

155
00:12:57,260 --> 00:13:01,340
So NIST is one of those frameworks that we allow our asset providers to use.

156
00:13:02,760 --> 00:13:08,360
We also have designated some assets to be systems of national significance.

157
00:13:09,220 --> 00:13:16,740
So you might have heard in the US, there has been consideration of introducing legislation that would designate systems

158
00:13:18,760 --> 00:13:21,580
SICCI or systems of critical importance.

159
00:13:22,700 --> 00:13:26,180
And so we have done that for 82 different asset classes.

160
00:13:26,560 --> 00:13:35,400
So we've outlined 950 assets that we consider to be critical infrastructure and a subset of that which we consider to be systems of national significance.

161
00:13:35,660 --> 00:13:36,900
There's 82 of those.

162
00:13:37,100 --> 00:13:44,040
So we are working with those assets, those operators, to put in place incident response plans.

163
00:13:44,040 --> 00:13:49,080
They will also exercise with relevant agencies including our Australian Cyber Security Centre.

164
00:13:49,560 --> 00:13:53,540
They will be required to provide systems information where necessary.

165
00:13:54,180 --> 00:14:01,780
We also have another obligation under the legislation which allows for government assistance measures.

166
00:14:02,040 --> 00:14:06,960
So that would allow our government to direct an asset to do a certain thing.

167
00:14:07,100 --> 00:14:12,540
Or in extremis, in a case of a near wartime environment,

168
00:14:12,540 --> 00:14:18,240
we would direct an asset to do something and potentially take on responsibility of their system.

169
00:14:18,600 --> 00:14:23,660
So we've seen the situation in our region deteriorate.

170
00:14:23,720 --> 00:14:26,540
We understand that there's significant risk to them.

171
00:14:26,660 --> 00:14:30,520
And we're on this journey to build the resilience of our critical infrastructure.

172
00:14:31,580 --> 00:14:36,180
In its infancy, just this month, we'll be introducing the risk management plan.

173
00:14:36,360 --> 00:14:42,520
So we're yet to do a full analysis of what it looks like and how it has improved the resilience of our critical infrastructure.

174
00:14:42,540 --> 00:14:47,520
Thank you very much.

175
00:14:47,700 --> 00:14:52,400
And I know that there's a lot of different frameworks that are taking place and under consultation as well.

176
00:14:53,480 --> 00:14:57,300
And Peter, I know that there's been a lot of work that's been going on in the European Union,

177
00:14:57,460 --> 00:15:03,340
the Parliament, the Cyber Resilience Act, and also other pieces, big piece of legislation there.

178
00:15:03,940 --> 00:15:09,720
It would be great to hear your views, particularly on that process of catching up on those existing technologies.

179
00:15:10,800 --> 00:15:11,220
Sure.

180
00:15:12,800 --> 00:15:22,000
Yeah, so firstly, just as a preliminary remark, it's important to understand the way the European Union is established.

181
00:15:22,400 --> 00:15:30,780
It legislates in areas where individual member states within the European Union have given it authority to work together on behalf of all of the member states.

182
00:15:32,480 --> 00:15:39,600
Technically, there is no reference in any of the EU treaties to cybersecurity being a policy area that the EU is allowed to work on.

183
00:15:39,700 --> 00:15:40,780
So there's been some sort of...

184
00:15:41,220 --> 00:15:46,440
delicate footwork over the last 10 years to try and identify areas where the European Union can act.

185
00:15:46,960 --> 00:15:56,400
We've had NIS and NIS2, the two cybersecurity acts, which established and improved the European Agency for Cybersecurity, ANISA.

186
00:15:56,980 --> 00:16:09,020
And there's also with the Cyber Resilience Act, particularly, given a basis for legislating on issues regarding a sort of common approach across the European Union

187
00:16:09,020 --> 00:16:10,320
for market in...

188
00:16:10,320 --> 00:16:11,200
for the market in...

189
00:16:11,220 --> 00:16:19,220
the market of sale and availability of goods which have cybersecurity implications.

190
00:16:20,020 --> 00:16:27,580
The reason I mention that is because a lot of things like critical infrastructure, for example, are exclusively national competencies,

191
00:16:27,620 --> 00:16:35,180
of which the European Union doesn't itself have any competence except for on a coordination basis.

192
00:16:35,560 --> 00:16:38,860
I think in terms of the substance of legislative work,

193
00:16:38,860 --> 00:16:41,600
we've taken what we call a sort of ecosystem approach,

194
00:16:41,880 --> 00:16:53,300
recognizing that this increasingly complex ecosystem of devices, services, interfaces between digital systems and the real world,

195
00:16:53,460 --> 00:16:57,540
the data that's driving and feeding those systems,

196
00:16:57,820 --> 00:17:00,980
the software, the algorithms, the learning models and everything else,

197
00:17:01,080 --> 00:17:03,640
together represent a...

198
00:17:03,640 --> 00:17:06,760
both an opportunity and a threat

199
00:17:06,760 --> 00:17:08,840
and a risk to...

200
00:17:09,540 --> 00:17:15,820
having real world impacts either to citizens, to infrastructure, to people and services in the real world.

201
00:17:16,020 --> 00:17:22,840
And that sort of ecosystem approach underpins the work that's being put forward in the Cyber Resilience Act,

202
00:17:23,040 --> 00:17:29,820
which itself is one piece of legislation alongside others that have gone through this current legislature of the Parliament,

203
00:17:30,040 --> 00:17:34,000
including NIST 2, the EIDAS,

204
00:17:34,940 --> 00:17:38,020
which is the European E-Identity,

205
00:17:38,740 --> 00:17:39,260
Scheme,

206
00:17:39,280 --> 00:17:41,260
the AI Act,

207
00:17:41,520 --> 00:17:42,240
the Data Act,

208
00:17:42,440 --> 00:17:43,720
the Data Governance Act,

209
00:17:43,940 --> 00:17:48,380
and various other pieces of primary legislation coming out of the EU.

210
00:17:48,700 --> 00:17:51,140
I won't go into all of those because it's just a vast area,

211
00:17:51,300 --> 00:17:56,740
but just pick out a few points of relevance, I think, on the Cyber Resilience Act.

212
00:17:57,180 --> 00:17:58,360
Despite its name,

213
00:17:59,800 --> 00:18:04,380
it's really looking at that domain of connected devices.

214
00:18:04,740 --> 00:18:08,000
The lawyers deliberately didn't want to talk specifically about it,

215
00:18:08,020 --> 00:18:08,640
specifically about IoT.

216
00:18:09,800 --> 00:18:10,580
But it's the...

217
00:18:10,580 --> 00:18:17,040
Again, it's that sort of part of that broader ecosystem of the interfaces with the real world

218
00:18:17,040 --> 00:18:25,340
and the services and systems and software behind those that directly interact with those actuator sensors and IoT devices.

219
00:18:26,760 --> 00:18:32,620
The general approach, which I think Bryony mentioned as well from the UK Government's approach,

220
00:18:32,920 --> 00:18:35,640
is largely a risk-based one,

221
00:18:35,640 --> 00:18:43,140
where we've classified different products and services on the market according to an initial evaluation of what the risk levels are.

222
00:18:43,520 --> 00:18:50,060
The lowest risk being you're good with your product as it is at the moment.

223
00:18:50,220 --> 00:18:52,540
We then have sort of two regulated classes,

224
00:18:52,800 --> 00:18:54,880
the Class 1 products and services,

225
00:18:55,060 --> 00:18:58,880
which are those which are considered lower risk but nonetheless present a risk,

226
00:18:59,060 --> 00:19:04,920
which is where we are looking for what will be called the European Union Declaration of Conformity,

227
00:19:04,920 --> 00:19:07,880
so similar to the SDOC that you see in a number of other countries.

228
00:19:08,060 --> 00:19:10,520
And then the Class 2, which is the higher risk,

229
00:19:10,640 --> 00:19:18,200
which requires a third-party certified conformity assessment to be done.

230
00:19:19,520 --> 00:19:25,220
The Act itself is broken down into areas covering the security requirements,

231
00:19:25,540 --> 00:19:27,760
sort of minimum security requirements,

232
00:19:27,900 --> 00:19:34,080
and I think they're very, very similar to the UK Government's approach there.

233
00:19:35,140 --> 00:19:41,140
Requiring that products come on the market are secure and patchable

234
00:19:41,140 --> 00:19:45,300
and patched through the declared life cycle of the product.

235
00:19:45,440 --> 00:19:48,980
So if someone says, we think this product's going to be on the market for 10 years,

236
00:19:49,120 --> 00:19:57,380
they've got to assess, attest to and have an assessment that their products are indeed being maintained,

237
00:19:57,600 --> 00:20:01,520
patched, updated, whatever, for the entirety of that life cycle.

238
00:20:02,760 --> 00:20:04,060
That no product comes on the market,

239
00:20:04,060 --> 00:20:09,040
it comes on to the, I have to say this with a straight face in this audience and in this event,

240
00:20:09,240 --> 00:20:13,800
but it does come on to the market with no exploitable vulnerabilities.

241
00:20:16,000 --> 00:20:18,760
Good luck with enforcing that one.

242
00:20:20,420 --> 00:20:23,540
Exploitable vulnerabilities, not known exploited vulnerabilities.

243
00:20:24,020 --> 00:20:29,020
But as a political statement, it's a good starting point to come from.

244
00:20:30,440 --> 00:20:33,080
Interestingly, and I think this is where there's a bit of a difference

245
00:20:33,080 --> 00:20:36,960
when we move ahead of legislatures elsewhere in the world,

246
00:20:37,100 --> 00:20:39,940
is two things about updates and patching.

247
00:20:40,160 --> 00:20:45,260
One is requiring manufacturers to have two paths for updates,

248
00:20:45,420 --> 00:20:47,540
one for security updates and one for functional updates.

249
00:20:48,860 --> 00:20:54,940
Allowing, and actually by default, ensuring that security updates are on by default

250
00:20:54,940 --> 00:20:58,940
and don't require user consent, whereas functional updates should be separated out

251
00:20:58,940 --> 00:21:02,500
and have a possibility for the user of the device or service

252
00:21:02,500 --> 00:21:06,740
to determine whether or not to update the functionality,

253
00:21:07,220 --> 00:21:08,300
but to separate the two out.

254
00:21:08,380 --> 00:21:10,320
And I think that's an interesting element.

255
00:21:10,580 --> 00:21:16,620
Again, whether it'll hold to the test of time, we will see.

256
00:21:17,380 --> 00:21:23,880
The second one is the idea of, and I think many of us have seen that in operational environments,

257
00:21:24,060 --> 00:21:27,440
where you want to sort of default back to a factory reset.

258
00:21:27,540 --> 00:21:30,560
You're not sure about the vulnerability of something,

259
00:21:30,560 --> 00:21:32,940
so you want to go back to a starting point,

260
00:21:34,500 --> 00:21:37,520
but requiring that you can do a factory reset

261
00:21:37,520 --> 00:21:42,900
together with all of the security updates that have been implemented up to date.

262
00:21:43,040 --> 00:21:48,840
So you may be able to have a situation where a product has been securely and safely updated

263
00:21:48,840 --> 00:21:51,640
and those updates are, that the security updates are maintained,

264
00:21:51,940 --> 00:21:56,760
but you want to default back to the original settings for many of the other aspects.

265
00:21:57,280 --> 00:22:00,540
And I think that was another interesting aspect.

266
00:22:00,560 --> 00:22:05,440
The other thing is, unlike in cybersecurity legislation elsewhere,

267
00:22:05,620 --> 00:22:09,020
and because of that bigger ecosystem that I talked about,

268
00:22:09,780 --> 00:22:18,100
the Cyber Resilience Act also covers issues about confidentiality, integrity and availability of the data

269
00:22:18,100 --> 00:22:22,160
and requirements that data, particularly personal data,

270
00:22:22,260 --> 00:22:26,520
is compliant with the more well-known GDPR,

271
00:22:26,580 --> 00:22:29,760
the data protection regulation of the EU.

272
00:22:29,760 --> 00:22:35,180
But also a number of rules governing the use of data

273
00:22:37,260 --> 00:22:40,960
by those devices and by the services around those devices.

274
00:22:41,660 --> 00:22:43,380
I think I'll leave it there at this stage.

275
00:22:43,600 --> 00:22:45,300
I'll leave it for a broader conversation.

276
00:22:45,460 --> 00:22:49,760
So one thing for me that's interesting is the relationship just on the IoT side

277
00:22:49,760 --> 00:22:52,660
versus the role of standards and how they face the EU.

278
00:22:52,680 --> 00:22:53,000
Right.

279
00:22:53,040 --> 00:22:54,300
Yeah, indeed.

280
00:22:54,480 --> 00:22:57,220
So when I mentioned about the Class 1 and Class 2 products,

281
00:22:57,300 --> 00:22:59,060
the Class 2 products are the ones which require

282
00:22:59,760 --> 00:23:00,160
the conformity assessment.

283
00:23:00,300 --> 00:23:01,940
And to do the conformity assessment,

284
00:23:02,060 --> 00:23:05,440
you need to have standards against which you're making an assessment

285
00:23:05,440 --> 00:23:06,360
and doing a certification.

286
00:23:08,000 --> 00:23:09,560
The problem we have there,

287
00:23:09,740 --> 00:23:12,800
and it's both a sort of geopolitical battle

288
00:23:12,800 --> 00:23:16,960
as well as a purely standards technical battle,

289
00:23:17,080 --> 00:23:20,940
is there isn't really a lot that in the standards world

290
00:23:20,940 --> 00:23:24,020
that we can base ourselves on as a starting point.

291
00:23:24,220 --> 00:23:25,900
And what they've taken is,

292
00:23:25,940 --> 00:23:27,240
OK, there is a European standard,

293
00:23:27,240 --> 00:23:29,720
the ETSI 303645,

294
00:23:30,140 --> 00:23:31,440
which I think other people have referenced.

295
00:23:31,740 --> 00:23:32,660
But beyond that,

296
00:23:32,780 --> 00:23:38,980
and this isn't an issue limited to the Cyber Resilience Act,

297
00:23:39,100 --> 00:23:43,080
it's more a general principle about EU legislation,

298
00:23:43,380 --> 00:23:46,120
that when standards and conformity assessment are required,

299
00:23:46,440 --> 00:23:53,540
there is a very laborious and Eurocentric approach to standardisation,

300
00:23:53,760 --> 00:23:56,820
which requires firstly that the European standards bodies

301
00:23:56,820 --> 00:24:00,420
are given instructions to do a sort of survey

302
00:24:00,420 --> 00:24:03,260
of what standards may be in place and available to,

303
00:24:03,380 --> 00:24:06,140
that conform with or that align with the requirements

304
00:24:06,140 --> 00:24:07,540
of a particular piece of legislation,

305
00:24:08,180 --> 00:24:11,620
only then determining whether there are international standards

306
00:24:11,620 --> 00:24:13,920
through ISO, IC, ITU,

307
00:24:14,840 --> 00:24:17,680
that fulfill the requirements of the legislation.

308
00:24:18,440 --> 00:24:19,920
But more often than not,

309
00:24:20,760 --> 00:24:23,280
we see, and it's a practice that the European Parliament

310
00:24:23,280 --> 00:24:24,740
has been trying to push back a bit on,

311
00:24:24,840 --> 00:24:26,260
which is the European Commission,

312
00:24:26,260 --> 00:24:27,400
as our executive branch,

313
00:24:27,540 --> 00:24:28,960
sort of defaults,

314
00:24:28,960 --> 00:24:31,600
its immediate reaction is,

315
00:24:31,660 --> 00:24:32,340
if we need standards,

316
00:24:32,380 --> 00:24:34,220
we go immediately to the European standards body

317
00:24:34,220 --> 00:24:35,480
and create something new,

318
00:24:35,580 --> 00:24:39,080
which may already have been created or established elsewhere.

319
00:24:39,340 --> 00:24:40,800
So there are some, let's say,

320
00:24:40,840 --> 00:24:42,220
some geopolitics involved in that.

321
00:24:42,320 --> 00:24:44,100
It's not just purely technical issues.

322
00:24:44,360 --> 00:24:46,700
I think it's really interesting on the standards bodies,

323
00:24:46,820 --> 00:24:47,640
because that's something that, again,

324
00:24:47,720 --> 00:24:48,440
that the UK government,

325
00:24:48,640 --> 00:24:51,440
when it was helping to deliver the Product Security Act

326
00:24:51,440 --> 00:24:52,600
and the UK Infrastructure Act,

327
00:24:52,780 --> 00:24:56,240
was helping to think about how it can recognize and refer to

328
00:24:56,260 --> 00:24:57,320
existing technical standards

329
00:24:57,320 --> 00:25:00,100
and make sure that they are embedded

330
00:25:00,100 --> 00:25:02,880
or referred to in the way that regulation is drafted.

331
00:25:03,140 --> 00:25:05,120
And of course, to make sure those have been updatable,

332
00:25:05,280 --> 00:25:07,680
because to try and resolve an issue

333
00:25:07,680 --> 00:25:09,640
where you just refer to something which has become obsolete.

334
00:25:09,940 --> 00:25:11,840
And I think within the standards body,

335
00:25:11,940 --> 00:25:14,820
something that I've seen on IoT specifically,

336
00:25:15,100 --> 00:25:17,560
is a lot of organizations are starting to map out

337
00:25:17,560 --> 00:25:19,380
the relationship between the existing standard bodies

338
00:25:19,380 --> 00:25:21,560
and the outcome and the terms within it.

339
00:25:21,660 --> 00:25:24,360
So to try and defuse some of that geopolitical issue

340
00:25:24,360 --> 00:25:25,800
where people feel like,

341
00:25:25,800 --> 00:25:26,860
okay, we have to go with this one

342
00:25:26,860 --> 00:25:29,640
because it has this particular association,

343
00:25:30,360 --> 00:25:31,680
and actually try to move and say,

344
00:25:31,740 --> 00:25:33,840
well, actually, there's kind of universal consensus

345
00:25:33,840 --> 00:25:35,200
around these particular points.

346
00:25:35,740 --> 00:25:38,920
And that, I think, is something that is a view

347
00:25:38,920 --> 00:25:40,040
that we're looking to aim towards

348
00:25:40,040 --> 00:25:41,840
and sort of helping on that front.

349
00:25:42,040 --> 00:25:42,200
Yeah.

350
00:25:42,360 --> 00:25:44,320
And I think, just to round out that,

351
00:25:46,940 --> 00:25:49,300
I'm speaking purely in a personal capacity here

352
00:25:49,300 --> 00:25:51,540
as someone who's been working in standards work as well

353
00:25:51,540 --> 00:25:52,480
about the last 30 years.

354
00:25:53,940 --> 00:25:55,540
Standards are not a,

355
00:25:55,800 --> 00:25:56,960
they're not a tool for regulation.

356
00:25:57,320 --> 00:25:59,320
They can help underpin it.

357
00:26:00,140 --> 00:26:03,480
But neither are they an alternative to regulation.

358
00:26:03,820 --> 00:26:05,640
For me, I've always seen sort of standards

359
00:26:05,640 --> 00:26:06,840
being a sort of bedrock foundation

360
00:26:06,840 --> 00:26:08,140
in which regulation,

361
00:26:09,240 --> 00:26:10,820
business-to-business agreements,

362
00:26:10,940 --> 00:26:13,300
and other sorts of deals can be done

363
00:26:13,300 --> 00:26:16,380
where you're agreeing a common basis to do that.

364
00:26:16,580 --> 00:26:19,200
What we have seen historically

365
00:26:19,200 --> 00:26:20,940
is for a lot of areas of legislation

366
00:26:20,940 --> 00:26:22,180
in the European Union,

367
00:26:23,040 --> 00:26:24,440
standards have been developed

368
00:26:24,440 --> 00:26:26,220
as a tool to implement legislation

369
00:26:27,060 --> 00:26:28,380
rather than being seen,

370
00:26:28,520 --> 00:26:30,760
rather than looking at the sort of panoply

371
00:26:30,760 --> 00:26:32,460
of standards available and say,

372
00:26:32,580 --> 00:26:35,300
well, actually, the requirements in this standard

373
00:26:35,300 --> 00:26:38,540
or this standard meet 90% of our requirements,

374
00:26:38,580 --> 00:26:40,160
so we don't need to go out and build something new.

375
00:26:40,280 --> 00:26:41,860
And for the 10% that's missing,

376
00:26:41,940 --> 00:26:44,260
we will do whatever's necessary to build that up.

377
00:26:44,380 --> 00:26:45,680
And trying to get into that mindset

378
00:26:45,680 --> 00:26:48,580
of using and reusing existing standards

379
00:26:48,580 --> 00:26:50,600
is becoming increasingly important

380
00:26:51,400 --> 00:26:53,200
in that international cooperation.

381
00:26:53,200 --> 00:26:54,940
I haven't mentioned about it,

382
00:26:55,000 --> 00:26:57,500
but the Trade and Technology Council,

383
00:26:57,720 --> 00:26:59,200
which is a big political cooperation

384
00:26:59,200 --> 00:27:00,760
between the EU and the US,

385
00:27:01,120 --> 00:27:03,740
one of the streams of that work,

386
00:27:03,920 --> 00:27:04,720
and we've seen that elsewhere

387
00:27:04,720 --> 00:27:06,560
in Quad Alliance, in APEC,

388
00:27:06,680 --> 00:27:12,620
in the India-EU Trade and Technology

389
00:27:13,200 --> 00:27:14,360
environment and others,

390
00:27:14,540 --> 00:27:17,620
is recognizing that if you're going to trade

391
00:27:17,620 --> 00:27:21,440
and improve the markets

392
00:27:21,900 --> 00:27:23,180
across those generations,

393
00:27:23,200 --> 00:27:24,120
which are geopolitical boundaries,

394
00:27:24,540 --> 00:27:26,460
it's easy to do that if you're working

395
00:27:26,460 --> 00:27:29,380
on the basis of conforming to agreed

396
00:27:29,380 --> 00:27:30,300
and common standards,

397
00:27:30,400 --> 00:27:31,240
which everybody's used.

398
00:27:32,180 --> 00:27:34,160
I think there's another thing just on that point,

399
00:27:34,260 --> 00:27:36,060
and we will move on, I promise,

400
00:27:36,200 --> 00:27:40,380
but just on the role of recommendations

401
00:27:40,380 --> 00:27:41,760
from international organizations.

402
00:27:42,240 --> 00:27:43,960
So I know this is something which, again,

403
00:27:44,100 --> 00:27:45,620
it's not just the role of technical standards,

404
00:27:45,820 --> 00:27:47,920
and there's also, particularly for countries

405
00:27:47,920 --> 00:27:48,720
not for the United Kingdom

406
00:27:48,720 --> 00:27:49,580
but for others as well,

407
00:27:49,700 --> 00:27:52,300
is how can we,

408
00:27:52,300 --> 00:27:54,180
how can international organizations play a role

409
00:27:54,180 --> 00:27:56,940
to help share good practice recommendations

410
00:27:56,940 --> 00:27:58,400
that can then be used by countries

411
00:27:58,400 --> 00:28:00,440
that don't have necessarily the same level

412
00:28:00,440 --> 00:28:01,060
of cyber capacity.

413
00:28:01,500 --> 00:28:03,560
So the OECD recently published

414
00:28:03,560 --> 00:28:04,860
a series of recommendations around

415
00:28:04,860 --> 00:28:05,480
management vulnerabilities

416
00:28:06,040 --> 00:28:08,280
and also management of product security.

417
00:28:09,400 --> 00:28:11,340
So those have been helpful in terms of

418
00:28:11,340 --> 00:28:12,480
they've gone through a process

419
00:28:12,480 --> 00:28:13,220
where they've been ratified

420
00:28:13,220 --> 00:28:14,200
by the 38 member states,

421
00:28:14,440 --> 00:28:16,780
and of course they don't go into technical detail

422
00:28:16,780 --> 00:28:18,560
that you would expect in a technical standard,

423
00:28:18,800 --> 00:28:20,800
but it is a helpful starting point

424
00:28:20,800 --> 00:28:22,080
and a helpful tool to share

425
00:28:22,300 --> 00:28:24,020
in terms of that capacity building for countries

426
00:28:24,020 --> 00:28:26,360
maybe where you don't have the level of resource

427
00:28:26,360 --> 00:28:27,200
that you would have from, say,

428
00:28:27,320 --> 00:28:28,880
the United Kingdom or the European Union

429
00:28:28,880 --> 00:28:30,100
or the United States or Australia.

430
00:28:31,040 --> 00:28:33,000
And I know that Ari has done a huge amount of work

431
00:28:33,000 --> 00:28:36,420
as well in his role with Latin American countries.

432
00:28:36,540 --> 00:28:39,000
We know, of course, Costa Rica had a devastating attack

433
00:28:39,000 --> 00:28:40,760
in the not too distant past,

434
00:28:41,860 --> 00:28:43,500
and it would be really helpful, Ari,

435
00:28:43,580 --> 00:28:45,260
if you could share some of your insights

436
00:28:45,880 --> 00:28:47,140
working in Latin America

437
00:28:47,140 --> 00:28:48,960
and then also you were saying that in Kenya

438
00:28:48,960 --> 00:28:49,820
and Africa as well.

439
00:28:49,860 --> 00:28:51,380
It would be fantastic to hear from you as well.

440
00:28:51,380 --> 00:28:54,740
Yeah, I first want to comment on this point

441
00:28:54,740 --> 00:28:56,280
that you used this term,

442
00:28:56,320 --> 00:29:00,220
countries that have less capacity,

443
00:29:00,460 --> 00:29:02,120
and I think it's important to point out

444
00:29:02,120 --> 00:29:04,980
that that's not always just Latin America

445
00:29:04,980 --> 00:29:06,000
or African countries.

446
00:29:06,120 --> 00:29:07,860
I mean, when I was in government,

447
00:29:08,020 --> 00:29:10,920
we met with the Norwegian military

448
00:29:10,920 --> 00:29:15,220
and one of the lead civilians there said,

449
00:29:15,520 --> 00:29:17,460
you know, I don't think you guys realize

450
00:29:17,460 --> 00:29:19,680
how much impact you guys actually have

451
00:29:20,200 --> 00:29:22,780
on the rest of the world when you put out a new policy.

452
00:29:23,160 --> 00:29:25,060
And I said, yeah, no, we really think about

453
00:29:25,060 --> 00:29:27,320
what issues we want to lead on and how we do it.

454
00:29:27,380 --> 00:29:28,660
She said, no, Ari, you really,

455
00:29:28,800 --> 00:29:31,120
when you put out a policy,

456
00:29:32,780 --> 00:29:35,900
we translate that policy directly into Norwegian,

457
00:29:36,820 --> 00:29:38,700
and then we take the cover page off

458
00:29:38,700 --> 00:29:40,680
and we put our cover page on

459
00:29:40,680 --> 00:29:43,800
and that's our policy, right?

460
00:29:44,140 --> 00:29:45,540
And I think that that, I mean,

461
00:29:45,920 --> 00:29:48,340
I think the UK has some of that impact as well

462
00:29:48,340 --> 00:29:49,660
and Australia probably regionally,

463
00:29:49,680 --> 00:29:52,680
that's what the EU wants, right?

464
00:29:52,780 --> 00:29:54,280
That's the kind of impact the EU wants,

465
00:29:54,420 --> 00:29:55,760
and that's part of the standards,

466
00:29:55,880 --> 00:30:00,360
the geopolitical kind of overview here.

467
00:30:00,800 --> 00:30:03,580
I mean, US is usually standardizing before

468
00:30:04,160 --> 00:30:06,680
and then bringing it to the international arena

469
00:30:06,680 --> 00:30:09,560
and then pointing to an international standard

470
00:30:09,560 --> 00:30:10,540
in most cases,

471
00:30:11,920 --> 00:30:14,580
which is one of the reasons the EU wants to work around it,

472
00:30:14,620 --> 00:30:16,840
but we can go into some of that more later on,

473
00:30:16,920 --> 00:30:19,380
but I think that that's, you know,

474
00:30:19,380 --> 00:30:20,300
some of the idea here,

475
00:30:20,360 --> 00:30:21,600
but that's Norway, right?

476
00:30:21,640 --> 00:30:23,040
Norway's a very wealthy country.

477
00:30:23,820 --> 00:30:25,700
They just don't have the capacity

478
00:30:26,440 --> 00:30:29,680
to have the kind of policies that the UK,

479
00:30:29,880 --> 00:30:31,020
the US, Australia do,

480
00:30:31,140 --> 00:30:33,520
and maybe Germany, France,

481
00:30:33,940 --> 00:30:35,580
some of the EU countries do,

482
00:30:37,220 --> 00:30:39,220
which is interesting in that way.

483
00:30:39,360 --> 00:30:42,960
I think that we have seen Latin America

484
00:30:42,960 --> 00:30:44,980
basically take a similar approach

485
00:30:44,980 --> 00:30:46,000
to some of these things,

486
00:30:46,040 --> 00:30:47,140
especially as it relates to

487
00:30:47,140 --> 00:30:49,260
what they tell their agencies to do,

488
00:30:49,380 --> 00:30:50,760
but then the agencies themselves

489
00:30:50,760 --> 00:30:53,020
don't have the ability to follow those policies

490
00:30:53,020 --> 00:30:54,260
that US agencies do.

491
00:30:54,420 --> 00:30:55,880
So they have these policies like,

492
00:30:55,940 --> 00:30:58,340
you know, Mexico put together its,

493
00:30:58,440 --> 00:31:00,360
and Brazil both put together

494
00:31:01,100 --> 00:31:02,860
cyber strategies over the years

495
00:31:02,860 --> 00:31:03,900
and they're very detailed

496
00:31:03,900 --> 00:31:07,220
and they look a lot like the US strategies do,

497
00:31:07,420 --> 00:31:10,340
but do they have the ability to implement them?

498
00:31:10,520 --> 00:31:12,380
And so we've seen these countries do that.

499
00:31:12,780 --> 00:31:16,620
Usually, and this is kind of the big trend in the region,

500
00:31:16,800 --> 00:31:18,820
is usually cybersecurity has been run

501
00:31:18,820 --> 00:31:21,740
out of the ICT unit,

502
00:31:22,540 --> 00:31:26,020
which might do regulation and internal controls,

503
00:31:26,180 --> 00:31:28,060
or the CIO's office,

504
00:31:28,320 --> 00:31:31,880
you know, a federal CIO for federal agencies,

505
00:31:32,100 --> 00:31:33,740
and that's who runs it.

506
00:31:34,660 --> 00:31:38,040
Costa Rica had this huge breach last year,

507
00:31:38,820 --> 00:31:40,440
which was a ransomware attack,

508
00:31:40,600 --> 00:31:41,360
shut down the government.

509
00:31:42,440 --> 00:31:44,900
It was like right at the time of the presidential election.

510
00:31:45,100 --> 00:31:46,940
It was a total disaster for the country.

511
00:31:47,000 --> 00:31:48,100
They still have not recovered.

512
00:31:48,100 --> 00:31:50,920
There's still, a lot of the agencies are still offline.

513
00:31:51,680 --> 00:31:53,460
The US gave them $25 million

514
00:31:54,100 --> 00:31:57,360
and a plan that came from MITRE and Carnegie Mellon

515
00:31:57,360 --> 00:31:59,540
about how to respond to it

516
00:31:59,540 --> 00:32:02,140
and they're still working their way through that

517
00:32:02,140 --> 00:32:03,320
in Costa Rica right now.

518
00:32:03,980 --> 00:32:06,600
$25 million has turned out not to be enough for them,

519
00:32:06,680 --> 00:32:08,780
even with that, to go forward.

520
00:32:09,000 --> 00:32:10,780
They just don't have the internal expertise

521
00:32:10,780 --> 00:32:12,880
to be able to deal with this kind of situation.

522
00:32:14,260 --> 00:32:17,000
And we're seeing that other places in Latin,

523
00:32:17,040 --> 00:32:17,600
that really,

524
00:32:18,920 --> 00:32:21,660
made, had a big impact in the rest of Latin America.

525
00:32:22,640 --> 00:32:25,560
Mexico also last year had an incident,

526
00:32:25,800 --> 00:32:26,980
what should they call it,

527
00:32:28,040 --> 00:32:28,480
Guacamaya,

528
00:32:29,800 --> 00:32:30,240
breach,

529
00:32:31,460 --> 00:32:34,640
and that led the president there,

530
00:32:34,760 --> 00:32:36,320
basically to say publicly,

531
00:32:37,060 --> 00:32:38,900
we just don't have the expertise in the country,

532
00:32:39,580 --> 00:32:40,960
which is something that a lot of people,

533
00:32:41,200 --> 00:32:43,400
that a lot of us that have worked with Mexico knew,

534
00:32:43,920 --> 00:32:46,260
but they had not been admitted publicly before.

535
00:32:46,260 --> 00:32:49,060
They want to now build a cybersecurity agency there.

536
00:32:49,160 --> 00:32:50,840
We see the same thing in Brazil, as I said,

537
00:32:51,020 --> 00:32:51,700
where they want to,

538
00:32:51,700 --> 00:32:52,800
where there's talk about,

539
00:32:52,800 --> 00:32:54,200
there's legislation to do it,

540
00:32:54,220 --> 00:32:55,940
to have a cybersecurity agency.

541
00:32:58,000 --> 00:32:59,440
Colombia also is talking about building

542
00:32:59,440 --> 00:33:01,780
a new cybersecurity agency in a similar way.

543
00:33:02,420 --> 00:33:03,640
It has not passed yet.

544
00:33:03,720 --> 00:33:04,780
People thought that it was going to

545
00:33:04,780 --> 00:33:07,000
and it did not get to that point.

546
00:33:07,140 --> 00:33:08,400
But Chile seems to be the first

547
00:33:08,400 --> 00:33:09,560
that actually is going to get it through

548
00:33:09,560 --> 00:33:11,760
and move forward with that idea.

549
00:33:12,120 --> 00:33:13,200
Will it work for them?

550
00:33:13,340 --> 00:33:14,720
You know, we hope that it will help them

551
00:33:14,720 --> 00:33:16,060
bring more of a workforce

552
00:33:16,500 --> 00:33:19,240
and a structured approach to it

553
00:33:19,240 --> 00:33:22,340
that's not just a kind of follow on to IT,

554
00:33:22,440 --> 00:33:24,120
IT management, right?

555
00:33:24,260 --> 00:33:25,820
That is, some people are looking at this

556
00:33:25,820 --> 00:33:27,480
from this real true security point of view

557
00:33:27,480 --> 00:33:29,980
and bringing in and building a workforce

558
00:33:30,530 --> 00:33:32,440
that can do the work inside the country.

559
00:33:33,400 --> 00:33:35,680
So I think that's what we're seeing in the region.

560
00:33:35,840 --> 00:33:37,100
There's other trends too,

561
00:33:37,160 --> 00:33:38,100
but I think that's the one that

562
00:33:38,700 --> 00:33:40,260
probably makes the most sense to go over

563
00:33:40,260 --> 00:33:42,560
since we've seen so many different countries

564
00:33:42,560 --> 00:33:44,380
now take that,

565
00:33:44,720 --> 00:33:45,360
take that same path.

566
00:33:46,880 --> 00:33:49,740
Africa is not in the same place.

567
00:33:49,900 --> 00:33:55,460
I mean, that we have seen recently this year,

568
00:33:55,540 --> 00:33:57,680
Kenya had an incident

569
00:33:58,300 --> 00:34:01,240
that they had a lot of trouble recovering from as well.

570
00:34:01,380 --> 00:34:03,740
There's still some signs that they are,

571
00:34:04,720 --> 00:34:06,600
there's some signs that they're past it at this point,

572
00:34:06,680 --> 00:34:08,300
but it took them a long time to get to there.

573
00:34:08,560 --> 00:34:10,320
And they're like the most advanced.

574
00:34:10,940 --> 00:34:12,740
I don't want to say number one,

575
00:34:12,820 --> 00:34:14,700
I don't have a ranking to go by,

576
00:34:14,720 --> 00:34:16,660
I don't have a study here of African countries,

577
00:34:16,760 --> 00:34:17,980
but are the ones that we've worked with,

578
00:34:18,100 --> 00:34:20,220
the one that they're very, very high up,

579
00:34:20,260 --> 00:34:21,980
very and have more of a workforce

580
00:34:21,980 --> 00:34:23,540
than other African countries do.

581
00:34:24,140 --> 00:34:26,700
But yet they haven't been able to respond to this incident

582
00:34:26,700 --> 00:34:28,320
and they were not prepared for it.

583
00:34:29,420 --> 00:34:31,440
Other African countries not prepared at all.

584
00:34:31,920 --> 00:34:34,460
So we're hoping that the kind of the,

585
00:34:35,520 --> 00:34:38,240
you know, silver lining from the Kenyan incident,

586
00:34:38,240 --> 00:34:39,640
similar to what we saw in Costa Rica,

587
00:34:39,800 --> 00:34:43,020
that there can be this kind of public awakening

588
00:34:43,020 --> 00:34:46,240
around this from the politicians on this,

589
00:34:46,320 --> 00:34:49,600
that they need to put more resources around.

590
00:34:49,980 --> 00:34:54,300
And in this case, ask Europe and the U.S.

591
00:34:54,300 --> 00:34:59,360
for resources to be able to help them build cyber defenses

592
00:34:59,360 --> 00:35:03,040
the same way that they ask to build physical defenses.

593
00:35:03,300 --> 00:35:04,960
So that's where we are.

594
00:35:05,120 --> 00:35:05,440
Thanks.

595
00:35:05,680 --> 00:35:07,860
I think you raised really important points

596
00:35:07,860 --> 00:35:10,120
about the importance of workforce strategy

597
00:35:10,120 --> 00:35:12,180
and the importance of workforce issues.

598
00:35:12,180 --> 00:35:14,640
And how important it is for countries

599
00:35:14,640 --> 00:35:16,180
to have that pipeline of expertise

600
00:35:16,760 --> 00:35:18,920
to be able to build resilience in the country.

601
00:35:19,020 --> 00:35:20,780
And I think hopefully we'll get a chance

602
00:35:20,780 --> 00:35:21,720
to talk about that a bit later.

603
00:35:21,920 --> 00:35:24,120
And I think also in terms of your point

604
00:35:24,120 --> 00:35:27,240
about strategies being beautiful and generated

605
00:35:27,240 --> 00:35:28,600
and, you know, a very nice document,

606
00:35:28,760 --> 00:35:31,260
but then in terms of the implementation within that,

607
00:35:31,740 --> 00:35:32,820
difficult to track, again,

608
00:35:32,880 --> 00:35:34,100
which comes back to the expertise point,

609
00:35:34,220 --> 00:35:36,660
but also how do we make sure that, you know,

610
00:35:36,680 --> 00:35:38,880
I think if countries are now getting to a point

611
00:35:38,880 --> 00:35:40,040
of recognizing the important role

612
00:35:40,040 --> 00:35:41,540
of having national cybersecurity strategy,

613
00:35:42,320 --> 00:35:45,900
how can we make sure that they continue to have impact

614
00:35:45,900 --> 00:35:47,740
and don't become a kind of beautiful document

615
00:35:47,740 --> 00:35:48,480
that sits on the shelf?

616
00:35:48,640 --> 00:35:49,820
I mean, one thing that's important,

617
00:35:49,960 --> 00:35:51,660
I think there was a time in 2017

618
00:35:51,660 --> 00:35:54,820
when Mexico had the federal police right there strategy

619
00:35:54,820 --> 00:35:57,020
and it was very, very militaristic.

620
00:35:57,060 --> 00:35:58,680
The first draft was very militaristic

621
00:35:58,680 --> 00:36:01,640
and made a lot of people really uncomfortable

622
00:36:01,640 --> 00:36:02,460
inside the country,

623
00:36:02,520 --> 00:36:03,980
especially because they had had so many problems

624
00:36:03,980 --> 00:36:06,480
with activists and going after activists

625
00:36:06,480 --> 00:36:08,560
and a lot of concern over it.

626
00:36:08,780 --> 00:36:11,300
And they came to give them some credit.

627
00:36:11,380 --> 00:36:11,520
They read it.

628
00:36:11,540 --> 00:36:11,960
They redid it.

629
00:36:12,000 --> 00:36:13,600
And they actually went,

630
00:36:13,640 --> 00:36:15,160
they looked at other strategies around the world

631
00:36:15,160 --> 00:36:16,580
and how they did it and made it

632
00:36:16,580 --> 00:36:18,720
so that it was focused on engaging industry

633
00:36:18,720 --> 00:36:21,220
and did a, there was a study of at the time

634
00:36:21,220 --> 00:36:23,020
that was done looking at industry,

635
00:36:23,040 --> 00:36:24,760
what industry looked like in Mexico

636
00:36:24,760 --> 00:36:26,260
and where they needed to improve.

637
00:36:26,540 --> 00:36:28,020
But I still think that in the end,

638
00:36:28,040 --> 00:36:29,160
that strategy was still something

639
00:36:29,160 --> 00:36:31,160
that was unrealistic for them to implement

640
00:36:31,780 --> 00:36:32,940
given the workforce,

641
00:36:33,200 --> 00:36:34,180
which goes to the point.

642
00:36:35,020 --> 00:36:38,200
And I think, so bringing it back now

643
00:36:38,200 --> 00:36:40,000
to the UK, Australia and Europe,

644
00:36:41,260 --> 00:36:44,320
I think, of course, there's been a lot of work

645
00:36:44,320 --> 00:36:44,940
that's been happening,

646
00:36:45,040 --> 00:36:47,080
a lot of sort of development of these capacity,

647
00:36:47,420 --> 00:36:48,660
a lot of work, you know, creating.

648
00:36:48,880 --> 00:36:50,920
When I joined the cyber team in DCMS,

649
00:36:51,000 --> 00:36:52,000
I think there was sort of 30 people.

650
00:36:52,080 --> 00:36:53,280
And by the time I left, it was about 200.

651
00:36:53,740 --> 00:36:55,280
So, you know, you saw a huge growth

652
00:36:55,280 --> 00:36:57,440
in the level of resource needed

653
00:36:57,440 --> 00:36:58,980
to help work on these different initiatives

654
00:36:58,980 --> 00:36:59,740
that were taking place.

655
00:37:00,700 --> 00:37:03,200
And I think, you know, that we now have a position

656
00:37:03,200 --> 00:37:04,620
where it is a recognized area

657
00:37:04,620 --> 00:37:06,420
within many government operations.

658
00:37:06,760 --> 00:37:08,140
There's a recognized policy function.

659
00:37:08,820 --> 00:37:10,620
And it has a sort of series of roles

660
00:37:10,620 --> 00:37:11,500
which are being called out

661
00:37:11,500 --> 00:37:12,940
and updated through a series of strategies.

662
00:37:13,760 --> 00:37:15,480
So what I'd love to do is just talk through maybe,

663
00:37:15,600 --> 00:37:16,840
you know, as we stand now,

664
00:37:17,740 --> 00:37:20,260
what we see as the most important policy considerations

665
00:37:20,260 --> 00:37:22,520
for this year and for, you know,

666
00:37:22,560 --> 00:37:24,480
of course, we've got a lot of technologies

667
00:37:24,480 --> 00:37:25,680
that we're probably going to talk about,

668
00:37:27,040 --> 00:37:28,140
including artificial intelligence.

669
00:37:28,400 --> 00:37:30,260
So we'd love to hear your insights on that front.

670
00:37:30,440 --> 00:37:31,940
So, Adam, can I start with you on that one?

671
00:37:32,080 --> 00:37:35,600
Sure, and I might go back a step and just, sorry.

672
00:37:35,880 --> 00:37:37,620
Could I ask you, please, to keep the mic,

673
00:37:37,620 --> 00:37:39,460
to keep the microphones closer to the speakers,

674
00:37:39,580 --> 00:37:41,800
if it's more than about eight inches away from you,

675
00:37:41,860 --> 00:37:44,200
you're in heavy competition every time the door opens

676
00:37:44,200 --> 00:37:44,940
and it's hard to hear.

677
00:37:45,600 --> 00:37:46,840
That's good advice.

678
00:37:47,300 --> 00:37:50,040
So I might just go back and give some context

679
00:37:50,040 --> 00:37:51,700
as to what we've seen in Australia

680
00:37:51,700 --> 00:37:53,840
the last year, year and a half.

681
00:37:55,700 --> 00:37:59,800
We, late last year, suffered two significant data breaches.

682
00:38:00,800 --> 00:38:04,760
The scale which affected the personal data

683
00:38:04,760 --> 00:38:05,880
of about 10 million Australians.

684
00:38:05,880 --> 00:38:08,420
So there were an attack on our second largest

685
00:38:09,320 --> 00:38:10,440
telecommunication company

686
00:38:10,440 --> 00:38:12,860
and our largest healthcare provider.

687
00:38:13,300 --> 00:38:15,280
And that was a seminal moment in the way

688
00:38:15,280 --> 00:38:18,220
that Australians think about cyber and data security

689
00:38:19,080 --> 00:38:22,000
in the same way that I think Colonial Pipeline

690
00:38:22,000 --> 00:38:23,460
was in this country.

691
00:38:23,780 --> 00:38:26,060
It also was politically seismic

692
00:38:26,580 --> 00:38:28,680
and meant that we, for the first time now,

693
00:38:28,740 --> 00:38:32,260
have a cybersecurity minister within our cabinet.

694
00:38:32,740 --> 00:38:34,520
So the highest levels of government.

695
00:38:34,520 --> 00:38:39,100
And we've gone through a review which essentially found

696
00:38:39,100 --> 00:38:42,520
that in Australia, at a macro level,

697
00:38:42,680 --> 00:38:46,240
industry faces a maze of unclear regulation

698
00:38:46,240 --> 00:38:51,660
and government doesn't provide the type of clear directives

699
00:38:51,660 --> 00:38:53,580
as to how to best uplift their cybersecurity,

700
00:38:55,140 --> 00:38:58,200
nor does it clarify obligations on data security

701
00:38:58,200 --> 00:39:02,000
and classify what is considered to be the most sensitive data

702
00:39:02,000 --> 00:39:04,500
that organisations in Australia are.

703
00:39:04,520 --> 00:39:08,480
So that all brings us to the point also where we recognise

704
00:39:08,480 --> 00:39:12,120
that there's not the genuine bi-directional information exchange

705
00:39:12,120 --> 00:39:15,400
that we do need to ensure that industry in Australia

706
00:39:15,400 --> 00:39:18,740
has the right type of visibility of the threat it faces.

707
00:39:19,300 --> 00:39:22,340
That brings us to the point where we now are developing

708
00:39:22,340 --> 00:39:23,380
a new cyber strategy.

709
00:39:23,740 --> 00:39:26,640
To Ari's point, we've been monitoring developments

710
00:39:26,640 --> 00:39:28,200
in the US very closely.

711
00:39:28,440 --> 00:39:31,780
And fundamentally in Australia, we are philosophically aligned

712
00:39:31,780 --> 00:39:33,240
with the new US strategy.

713
00:39:33,240 --> 00:39:36,400
We recognise the status quo cannot endure

714
00:39:36,400 --> 00:39:39,780
and we need to undertake the two fundamental shifts

715
00:39:39,780 --> 00:39:41,320
which are outlined in the US strategy.

716
00:39:41,480 --> 00:39:46,440
So that's moving the burden to those who can best take on the risk

717
00:39:46,440 --> 00:39:49,060
and secondly, incentivising long-term investments.

718
00:39:49,680 --> 00:39:52,420
Unlike other countries, Australia does have the capability

719
00:39:52,420 --> 00:39:54,640
to move quickly on legislation

720
00:39:55,240 --> 00:39:59,880
and also the capability to deliver on our stated goals.

721
00:39:59,940 --> 00:40:01,940
So we are hoping that we can actually go further

722
00:40:01,940 --> 00:40:04,440
in terms of implementation than the US can

723
00:40:04,440 --> 00:40:07,240
by virtue of the legislation that we'll introduce.

724
00:40:07,540 --> 00:40:09,420
But I might stop it there, Bryony.

725
00:40:10,660 --> 00:40:11,280
Thanks, Adam.

726
00:40:12,540 --> 00:40:15,560
So yes, the UK published its cyber security strategy

727
00:40:16,260 --> 00:40:17,640
about a year and a half ago.

728
00:40:17,780 --> 00:40:19,880
So hopefully a useful blueprint for the US and Australia.

729
00:40:21,020 --> 00:40:24,080
But the whole message of that strategy was that this is

730
00:40:24,080 --> 00:40:26,100
a whole-of-society effort.

731
00:40:26,240 --> 00:40:27,480
We can't do it alone in government.

732
00:40:27,580 --> 00:40:28,540
We can't do it alone in industry.

733
00:40:28,820 --> 00:40:29,760
We can't do it alone in academia.

734
00:40:29,760 --> 00:40:31,600
We have to do this all together.

735
00:40:32,420 --> 00:40:35,400
And the tagline that we talk a lot about in the UK

736
00:40:35,400 --> 00:40:38,500
is to make the UK the safest place to live and work online.

737
00:40:39,240 --> 00:40:42,760
What this strategy recognises is that this is not about the UK anymore.

738
00:40:42,860 --> 00:40:43,660
This is about the world.

739
00:40:43,800 --> 00:40:45,680
Because obviously, as everyone knows,

740
00:40:45,900 --> 00:40:48,540
we can't just be bipartisan and just work one part of the UK.

741
00:40:49,720 --> 00:40:53,420
But obviously, a strategy is only, you know, all very well and good,

742
00:40:53,600 --> 00:40:55,820
but it's not worth the paper it's written on unless you actually do it

743
00:40:55,820 --> 00:40:56,820
and actually carry it out.

744
00:40:56,940 --> 00:40:59,420
And so I know the US have done a brilliant implementation plan.

745
00:40:59,420 --> 00:41:00,980
I'm sure Australia will do something similar.

746
00:41:01,700 --> 00:41:04,640
But that is something that we're really actively taking forwards.

747
00:41:07,360 --> 00:41:09,780
We talked a bit about the priorities for the future, Peter.

748
00:41:10,460 --> 00:41:14,160
So for us is the horrible term of emerging technology.

749
00:41:14,500 --> 00:41:16,860
And I won't go into the debate of what's emerged and what's emerging.

750
00:41:17,600 --> 00:41:20,760
But, you know, for us, there are two ball buckets of we have technologies

751
00:41:20,760 --> 00:41:23,340
we need to care about today and then ones that are in the future

752
00:41:23,340 --> 00:41:25,860
that we still need to care about, but we need to think about putting

753
00:41:25,860 --> 00:41:27,740
the security principles in place.

754
00:41:27,740 --> 00:41:32,480
So the ones we're really focused on at the moment in the UK today is AI.

755
00:41:32,740 --> 00:41:35,000
And I'm sure we'll go on to talk about that a bit more in detail.

756
00:41:35,300 --> 00:41:39,260
But also quantum and semiconductors and lots of different areas

757
00:41:39,260 --> 00:41:40,640
I could go on and on about.

758
00:41:42,120 --> 00:41:45,120
But it's something that the way we're taking really seriously

759
00:41:45,120 --> 00:41:47,840
and that's something that's really front and centre of how we implement.

760
00:41:48,120 --> 00:41:50,940
And going back to what I was talking about earlier about secure by default,

761
00:41:51,160 --> 00:41:54,280
is there something that is very much the core of how we're approaching

762
00:41:54,280 --> 00:41:57,480
those technologies and making sure that that security approach,

763
00:41:57,740 --> 00:41:59,040
is embedded right from the start.

764
00:41:59,280 --> 00:42:01,940
And something that we're looking to take how we're going to take forwards.

765
00:42:09,020 --> 00:42:13,680
So I mentioned that the CRA was part of a broader package

766
00:42:13,680 --> 00:42:17,740
of different pieces of legislation, which one advantage we have,

767
00:42:17,820 --> 00:42:23,600
I think, as a national parliament, as a European parliament compared

768
00:42:23,600 --> 00:42:27,320
with others, is that there is an agreed,

769
00:42:27,740 --> 00:42:31,960
sort of legislative programme over a full five-year period

770
00:42:32,620 --> 00:42:35,260
where the European Commission is responsible for drafting

771
00:42:35,260 --> 00:42:39,760
and putting legislation on the conveyor belt

772
00:42:39,760 --> 00:42:43,460
and where parliament together with the member states represented

773
00:42:43,460 --> 00:42:47,900
in the European Council have the final say in that legislation.

774
00:42:48,220 --> 00:42:50,980
So we're coming towards the end of the legislature.

775
00:42:51,340 --> 00:42:53,780
There'll be elections next year and I'll come back to that

776
00:42:53,780 --> 00:42:56,300
because that's another relevant point in a moment.

777
00:42:56,420 --> 00:42:56,680
But...

778
00:42:56,680 --> 00:43:00,300
So in that whole period, we've had the Cyber Resilience Act,

779
00:43:00,380 --> 00:43:05,840
we are pretty far along now with the Artificial Intelligence Act as well,

780
00:43:06,540 --> 00:43:13,240
which has been after, I think it was 7,300 amendments tabled,

781
00:43:14,940 --> 00:43:18,300
discussed and debated within the European Parliament

782
00:43:18,300 --> 00:43:22,700
to get to a compromise where we now have a solid negotiating position.

783
00:43:22,900 --> 00:43:24,580
And even that's not the end of the story

784
00:43:24,580 --> 00:43:25,480
because we...

785
00:43:25,480 --> 00:43:28,360
Parliament has its position, the European Council has its,

786
00:43:28,420 --> 00:43:31,840
and we have to sort of now reconcile those two versions.

787
00:43:32,460 --> 00:43:33,300
But there is...

788
00:43:38,740 --> 00:43:42,360
The legislature's sort of feet are being held to the fire very much

789
00:43:42,360 --> 00:43:46,640
because under EU, our internal rules,

790
00:43:46,960 --> 00:43:51,400
any legislation which isn't passed and adopted by the end of the legislature,

791
00:43:51,680 --> 00:43:55,240
our last legislative session being in May next year, falls away.

792
00:43:55,240 --> 00:43:55,840
So even if...

793
00:43:55,840 --> 00:43:59,520
However advanced the draft is and it's not been written into law,

794
00:44:00,440 --> 00:44:01,880
you go back to...

795
00:44:01,880 --> 00:44:03,240
You go back to square one.

796
00:44:03,440 --> 00:44:07,700
So there's a real push to get all of these pieces of legislation through.

797
00:44:08,120 --> 00:44:10,300
In terms of challenges for the next year then,

798
00:44:10,440 --> 00:44:12,800
I mean, I mentioned the election coming up.

799
00:44:14,380 --> 00:44:17,780
European Union, the European Parliament,

800
00:44:17,840 --> 00:44:19,140
which then is...

801
00:44:20,240 --> 00:44:24,740
Plays an important role in the nomination and final confirmation

802
00:44:24,740 --> 00:44:25,940
of the European Commission.

803
00:44:27,200 --> 00:44:28,440
It's a five-year process.

804
00:44:30,220 --> 00:44:35,020
In the US, you've got a two-year congressional process

805
00:44:35,020 --> 00:44:39,060
for the election of the whole House and a third of the Senate

806
00:44:39,060 --> 00:44:41,060
over a complete six-year period,

807
00:44:41,180 --> 00:44:43,660
and the presidential elections over a four-year period.

808
00:44:43,920 --> 00:44:48,040
So anyone who can do the maths sees that the common denominator there is 20.

809
00:44:48,120 --> 00:44:50,980
So every 20 years, we have the same year,

810
00:44:51,120 --> 00:44:54,120
we have the elections of the European Parliament

811
00:44:54,120 --> 00:44:54,720
at the same time.

812
00:44:54,740 --> 00:44:57,360
We have the same year as the US presidential and congressional elections.

813
00:44:57,520 --> 00:45:00,660
So 2024 is going to be a big year for us

814
00:45:00,660 --> 00:45:05,700
because of the issue of disinformation and election integrity,

815
00:45:05,940 --> 00:45:06,560
election security.

816
00:45:07,400 --> 00:45:11,360
This is requiring already quite a massive mobilisation

817
00:45:11,360 --> 00:45:15,300
both within the institutions in terms of cyber policy,

818
00:45:15,540 --> 00:45:20,140
in terms of policy, operational cyber policy.

819
00:45:21,020 --> 00:45:22,340
We face...

820
00:45:22,340 --> 00:45:24,360
Or we're trying to face that

821
00:45:24,360 --> 00:45:26,160
with a severe skills shortage.

822
00:45:28,060 --> 00:45:30,740
In a situation where budgets are limited,

823
00:45:30,920 --> 00:45:34,940
where it's difficult to get any new staff or any institution,

824
00:45:35,220 --> 00:45:38,760
just to give you a sort of flavour of the importance of it for us,

825
00:45:38,940 --> 00:45:44,540
of the total complement of new posts that can be filled

826
00:45:44,540 --> 00:45:47,340
and have bums on seats and actually doing the work,

827
00:45:48,820 --> 00:45:52,700
something like 55% of all new posts are in the field of cybersecurity

828
00:45:52,700 --> 00:45:54,080
across all the European institutions.

829
00:45:54,820 --> 00:45:58,960
So it's seen as one of the most important growth areas.

830
00:46:00,100 --> 00:46:02,380
However, and I'll be the first to admit this,

831
00:46:03,240 --> 00:46:06,400
the sort of people we want to attract to those jobs,

832
00:46:06,540 --> 00:46:11,740
not that interested in working as career bureaucrats like myself.

833
00:46:12,040 --> 00:46:12,840
Yeah, I'm dressing down.

834
00:46:12,940 --> 00:46:14,100
This is my idea of dressing down.

835
00:46:16,160 --> 00:46:17,540
So we've got to find...

836
00:46:17,540 --> 00:46:21,140
We've got to be realistic to find talent that will work for us

837
00:46:21,140 --> 00:46:23,360
in an environment where they're comfortable.

838
00:46:23,360 --> 00:46:26,120
I mean, the career structure isn't attractive

839
00:46:26,120 --> 00:46:27,580
for people who are involved in cybersecurity.

840
00:46:28,160 --> 00:46:31,300
The salary, at least the initial starting salaries,

841
00:46:31,400 --> 00:46:32,860
may look relatively attractive.

842
00:46:33,260 --> 00:46:37,260
But for people who are used to a high degree of autonomy,

843
00:46:37,520 --> 00:46:42,720
to be driven by clear objectives and wins over short periods of time,

844
00:46:42,900 --> 00:46:47,220
the flexibility of where and how they work off,

845
00:46:47,340 --> 00:46:48,940
you know, from the starting point,

846
00:46:49,820 --> 00:46:52,620
we're not an attractive proposition for people.

847
00:46:53,360 --> 00:46:54,120
We're not an attractive proposition in the field of cybersecurity.

848
00:46:54,340 --> 00:46:55,720
And we recognize that.

849
00:46:55,880 --> 00:47:00,280
And part of the problem we have is where for most posts

850
00:47:00,280 --> 00:47:01,960
that come available for recruitment,

851
00:47:02,140 --> 00:47:07,420
we have a ratio of something like four to 500 candidates per post.

852
00:47:07,820 --> 00:47:12,760
We are down to a situation where we're barely getting the number of candidates

853
00:47:12,760 --> 00:47:16,660
for the number of posts available in the cybersecurity field.

854
00:47:16,760 --> 00:47:17,480
So we've got a problem.

855
00:47:17,620 --> 00:47:19,080
And we recognize it.

856
00:47:19,100 --> 00:47:19,760
We're addressing it.

857
00:47:19,880 --> 00:47:21,340
And at the moment,

858
00:47:21,340 --> 00:47:24,260
the way we're addressing it is through third parties.

859
00:47:24,400 --> 00:47:29,040
So we're using contracted service providers

860
00:47:29,040 --> 00:47:33,020
who themselves can then take people on on a much more flexible basis

861
00:47:33,020 --> 00:47:37,320
and have sort of service level agreements with us

862
00:47:37,320 --> 00:47:38,500
in terms of what they deliver.

863
00:47:38,700 --> 00:47:42,680
And that's proving useful and is patching,

864
00:47:42,680 --> 00:47:45,260
both literally and figuratively,

865
00:47:45,400 --> 00:47:48,600
patching some of the problems we have in terms of capability.

866
00:47:49,920 --> 00:47:51,320
But as a long-term solution,

867
00:47:51,340 --> 00:47:52,700
it doesn't work.

868
00:47:52,880 --> 00:47:57,660
Our public procurement rules are also lengthy and clunky.

869
00:47:57,880 --> 00:48:00,140
And, you know, having contractors on board

870
00:48:00,140 --> 00:48:02,980
and having them recruit people according to certain criteria,

871
00:48:03,180 --> 00:48:05,020
it's a very complex process.

872
00:48:05,340 --> 00:48:08,000
So the appeal there, I think,

873
00:48:08,000 --> 00:48:14,860
is to recognize that it's not a sort of come and serve your country appeal

874
00:48:14,860 --> 00:48:20,660
that the U.S. or other countries can offer to hackers,

875
00:48:20,660 --> 00:48:22,880
analysts and others in the field

876
00:48:22,880 --> 00:48:25,300
that would not normally look at these as career opportunities.

877
00:48:25,680 --> 00:48:30,840
But we are appealing because of the attacks against the parliament,

878
00:48:31,000 --> 00:48:36,080
because it stood up in support of Ukraine against the Russian aggression.

879
00:48:36,320 --> 00:48:39,900
We provided practical support for the Ukrainian parliament

880
00:48:39,900 --> 00:48:43,320
and we're paying the price in terms of an uptick in attacks

881
00:48:43,320 --> 00:48:44,460
against our infrastructure.

882
00:48:45,400 --> 00:48:50,060
We are starting to ramp up this issue about appealing to public conscience,

883
00:48:50,060 --> 00:48:54,560
also saying this is not just about defending a gray, distant bureaucratic institution.

884
00:48:54,760 --> 00:48:57,680
It's about defending the integrity of the democratic process

885
00:48:57,680 --> 00:48:59,520
and of elections generally.

886
00:49:00,120 --> 00:49:01,000
And that's, yeah.

887
00:49:01,180 --> 00:49:03,320
Thank you, Peter.

888
00:49:03,480 --> 00:49:07,840
And I think definitely keen for us to have a conversation about skills

889
00:49:07,840 --> 00:49:10,080
because definitely it's coming through as something which,

890
00:49:10,220 --> 00:49:11,560
as we're facing future challenges,

891
00:49:12,120 --> 00:49:13,840
how are we preparing ourselves for them?

892
00:49:15,060 --> 00:49:17,860
So perhaps, Ari, what I'd love to talk,

893
00:49:17,860 --> 00:49:21,620
you spoke briefly about the effectiveness of Mexico,

894
00:49:21,840 --> 00:49:23,680
adapting its approach in light of feedback

895
00:49:23,680 --> 00:49:25,600
in terms of developing its strategy.

896
00:49:25,940 --> 00:49:28,840
And I think there are lots of tired tropes

897
00:49:28,840 --> 00:49:30,260
about what it's like working in the bureaucracy,

898
00:49:30,460 --> 00:49:31,560
what it's like working in government.

899
00:49:32,480 --> 00:49:34,560
I'd love to say they're all untrue.

900
00:49:34,780 --> 00:49:38,440
You can still watch episodes of Yes Minister and meh.

901
00:49:38,460 --> 00:49:40,900
I think people would agree it's still there.

902
00:49:42,120 --> 00:49:45,880
But I think there has been, I feel,

903
00:49:45,940 --> 00:49:47,420
I have felt like an adaptive approach

904
00:49:47,860 --> 00:49:48,980
in terms of how we can be more outcome focused,

905
00:49:49,140 --> 00:49:52,740
how we can prioritise the areas which make the biggest impact

906
00:49:52,740 --> 00:49:55,340
on the objective, in the UK's case,

907
00:49:55,420 --> 00:49:57,280
to make the UK the safest place to work and be online.

908
00:49:57,580 --> 00:49:58,740
But I'd love your thoughts.

909
00:49:58,880 --> 00:50:01,420
So one thing, I mean, the UK has done a great job.

910
00:50:01,500 --> 00:50:02,780
NCSC, where you used to work,

911
00:50:02,900 --> 00:50:06,120
has done a great job in terms of the consultations.

912
00:50:06,240 --> 00:50:07,940
If anything, let's sort of,

913
00:50:09,440 --> 00:50:12,280
maybe we've been deluged with consultations,

914
00:50:12,300 --> 00:50:15,740
like deluged by transparency from the UK,

915
00:50:15,960 --> 00:50:17,120
which I'd much prefer

916
00:50:17,860 --> 00:50:18,300
to see more of the opposite.

917
00:50:18,440 --> 00:50:20,360
So I don't mean that as a criticism,

918
00:50:20,460 --> 00:50:23,240
but it does get hard if there's five consultations

919
00:50:23,240 --> 00:50:25,300
at the same time for the same people.

920
00:50:25,440 --> 00:50:27,320
Because it's like, even in the US,

921
00:50:27,440 --> 00:50:30,180
it's like we don't have that many cyber policy people,

922
00:50:30,240 --> 00:50:31,880
full-time cyber policy people commenting.

923
00:50:31,980 --> 00:50:35,760
So I think spacing them out is helpful,

924
00:50:36,120 --> 00:50:38,480
but also understand, like, you have politicians

925
00:50:38,480 --> 00:50:39,900
that want to get stuff done now.

926
00:50:40,140 --> 00:50:41,760
So that becomes harder.

927
00:50:41,860 --> 00:50:42,820
We're starting to see that in the US.

928
00:50:42,980 --> 00:50:45,660
We're probably going to have three RFIs in the US

929
00:50:47,620 --> 00:50:48,980
within the next two months.

930
00:50:49,080 --> 00:50:50,620
There's one out now that's going to be extended.

931
00:50:51,640 --> 00:50:53,560
So, you know, I think we're going to,

932
00:50:53,560 --> 00:50:54,900
we're expecting to have three

933
00:50:54,900 --> 00:50:55,840
that we have to comment on there.

934
00:50:55,920 --> 00:50:58,040
So it's a similar situation that,

935
00:50:59,100 --> 00:51:00,320
I think it's great, though,

936
00:51:00,360 --> 00:51:02,720
because the RFI and the consultation process

937
00:51:02,720 --> 00:51:08,620
leads to a much better first draft of a product,

938
00:51:08,660 --> 00:51:09,880
policy product or legislation,

939
00:51:11,300 --> 00:51:13,560
than what we would have otherwise.

940
00:51:13,660 --> 00:51:15,640
So obviously, I think,

941
00:51:15,660 --> 00:51:16,620
I prefer them to be spaced out,

942
00:51:16,680 --> 00:51:17,080
but that would be good.

943
00:51:17,180 --> 00:51:19,540
I'd say Australia does a very good job as well.

944
00:51:19,800 --> 00:51:21,820
I mean, Australia has reached out to us,

945
00:51:21,820 --> 00:51:23,720
and I know has reached out to a lot of other people

946
00:51:24,300 --> 00:51:26,540
when they put something out that they feel like

947
00:51:26,540 --> 00:51:28,620
this is something we need to get attention to.

948
00:51:28,880 --> 00:51:30,320
Like, we don't want to surprise anybody

949
00:51:30,320 --> 00:51:31,920
when this is happening.

950
00:51:32,660 --> 00:51:34,400
Adam does a particularly good job of it,

951
00:51:34,460 --> 00:51:36,500
so I can praise him on the panel.

952
00:51:37,340 --> 00:51:39,580
But I think, you know, they've had us testify

953
00:51:40,100 --> 00:51:41,900
and set the time for the testimony

954
00:51:41,900 --> 00:51:43,980
in a way that we could actually testify,

955
00:51:43,980 --> 00:51:47,360
which, like, most countries don't want foreigners to testify,

956
00:51:47,620 --> 00:51:49,400
and they're, like, actually, you know,

957
00:51:49,400 --> 00:51:51,500
purposely seeking it out and asking for it.

958
00:51:51,580 --> 00:51:52,920
So that's really helpful.

959
00:51:53,560 --> 00:51:56,340
The EU, you know, not...

960
00:51:56,340 --> 00:51:59,340
The structure is Byzantine in the first place,

961
00:51:59,400 --> 00:52:00,380
so it's hard to...

962
00:52:00,380 --> 00:52:02,480
Like, if you're not actually in Brussels,

963
00:52:03,940 --> 00:52:06,500
I think it's very difficult to figure out

964
00:52:06,500 --> 00:52:07,420
even where things are,

965
00:52:07,640 --> 00:52:10,900
and the Commission does not reach out that way.

966
00:52:11,240 --> 00:52:12,180
Parliament does.

967
00:52:12,180 --> 00:52:14,360
I mean, members of Parliament come on tours

968
00:52:14,360 --> 00:52:15,280
and they want input.

969
00:52:16,440 --> 00:52:17,620
So that's helpful.

970
00:52:17,740 --> 00:52:21,760
And I'd say even the council member,

971
00:52:21,920 --> 00:52:22,660
the council staff,

972
00:52:23,260 --> 00:52:24,380
when you go visit,

973
00:52:24,520 --> 00:52:27,180
really does, too, want input.

974
00:52:27,460 --> 00:52:29,600
The problem with Parliament is that they have a lot of issues

975
00:52:29,600 --> 00:52:33,040
and the members themselves are not educated at all

976
00:52:33,040 --> 00:52:35,500
on what they're voting on or what they're doing,

977
00:52:35,580 --> 00:52:36,580
and things come through quickly.

978
00:52:36,860 --> 00:52:38,380
And so only...

979
00:52:39,400 --> 00:52:41,980
Yeah, it's sort of equivalent

980
00:52:41,980 --> 00:52:43,040
to Congress, actually.

981
00:52:43,160 --> 00:52:46,540
I'd say the Congressional US Congress staff

982
00:52:47,900 --> 00:52:50,400
now, with, like, the tech fellows and stuff like that,

983
00:52:50,560 --> 00:52:52,320
are probably a little bit better educated

984
00:52:52,320 --> 00:52:55,720
than the elected members' staff,

985
00:52:55,980 --> 00:52:57,760
and then the elected members are about the same,

986
00:52:57,840 --> 00:52:58,780
maybe worse than the US,

987
00:53:00,040 --> 00:53:01,260
depending on who it is.

988
00:53:01,320 --> 00:53:02,560
Because a lot of times you get young people

989
00:53:02,560 --> 00:53:05,560
in European Parliament that are rising stars

990
00:53:05,560 --> 00:53:07,000
and then they know a lot

991
00:53:07,000 --> 00:53:09,740
and they want to engage on these issues,

992
00:53:09,880 --> 00:53:11,440
but it is complicated.

993
00:53:11,980 --> 00:53:14,000
It's just that you have these three places to go to

994
00:53:14,000 --> 00:53:16,960
and the commission sort of puts you off for a little while

995
00:53:16,960 --> 00:53:18,440
and then you have, like, a very short period

996
00:53:18,440 --> 00:53:20,380
to say something, and then they're like,

997
00:53:20,480 --> 00:53:21,640
oh, now we can't make any changes.

998
00:53:22,820 --> 00:53:23,540
So it's...

999
00:53:24,240 --> 00:53:26,960
It is unlike other places and it...

1000
00:53:28,900 --> 00:53:30,660
So that has been difficult, too.

1001
00:53:31,600 --> 00:53:33,140
I don't know if that answered the question,

1002
00:53:33,260 --> 00:53:34,120
but it kind of gives you the...

1003
00:53:34,720 --> 00:53:36,740
I enjoy the reference of deluge by consultation

1004
00:53:36,740 --> 00:53:38,380
because I definitely feel as though

1005
00:53:38,940 --> 00:53:40,980
what's been effective for me has been, like,

1006
00:53:41,980 --> 00:53:43,360
to be able to be transparent with communities

1007
00:53:43,360 --> 00:53:46,100
and say, no, we do read and we do actually engage

1008
00:53:46,100 --> 00:53:47,260
with what you've shared with us.

1009
00:53:47,400 --> 00:53:50,880
And we try to adapt the format to make it not overly burdensome

1010
00:53:50,880 --> 00:53:53,140
so it's not just you have to have a government affairs division

1011
00:53:53,140 --> 00:53:54,420
in order to fill this in,

1012
00:53:54,520 --> 00:53:57,780
but, like, you can contribute your insight on...

1013
00:53:57,780 --> 00:54:00,700
Like, in the US sometimes you'll get something from an agency

1014
00:54:00,700 --> 00:54:03,920
that is, like, a spreadsheet and it has, like,

1015
00:54:03,960 --> 00:54:05,040
oh, you've got to fill in this box

1016
00:54:05,040 --> 00:54:06,400
and it's only 1,000 characters.

1017
00:54:07,660 --> 00:54:08,020
Right?

1018
00:54:08,500 --> 00:54:08,860
And...

1019
00:54:11,980 --> 00:54:14,740
So, in a way, the NCSC is the opposite of that.

1020
00:54:14,880 --> 00:54:15,900
It's like, you know, here's...

1021
00:54:17,380 --> 00:54:19,460
Here is a lot of questions.

1022
00:54:19,540 --> 00:54:20,480
You can fill out whatever you want.

1023
00:54:20,600 --> 00:54:21,820
You can not fill out what you want.

1024
00:54:21,920 --> 00:54:23,440
It can be as long as you want to make it, et cetera.

1025
00:54:23,640 --> 00:54:24,600
Which I think is great.

1026
00:54:24,700 --> 00:54:26,020
It makes it much easier to comment.

1027
00:54:26,280 --> 00:54:26,980
And some of the...

1028
00:54:26,980 --> 00:54:29,720
I'm not saying all US agencies do that.

1029
00:54:29,800 --> 00:54:31,760
Some US agencies have that approach, too.

1030
00:54:32,040 --> 00:54:33,440
But that...

1031
00:54:34,060 --> 00:54:38,760
I'm sure for some engineers that little box is very helpful.

1032
00:54:38,880 --> 00:54:41,880
But for someone that's trying to give a fulsome

1033
00:54:41,980 --> 00:54:43,500
viewpoint and you only care about one issue,

1034
00:54:43,640 --> 00:54:44,540
having 100...

1035
00:54:44,540 --> 00:54:47,000
You know, 1,000 characters is not very helpful.

1036
00:54:47,120 --> 00:54:47,400
So...

1037
00:54:47,400 --> 00:54:50,960
I think it can be challenging to know who the right person to contact is

1038
00:54:50,960 --> 00:54:52,680
and actually to help decipher the complexities

1039
00:54:52,680 --> 00:54:55,640
because I think it can be sort of potentially quite burdensome

1040
00:54:55,640 --> 00:54:58,920
insight about how the hell can I engage with my government?

1041
00:54:59,020 --> 00:55:00,200
How can I share feedback?

1042
00:55:00,340 --> 00:55:02,320
And actually to try and make that process as simple as possible.

1043
00:55:02,560 --> 00:55:03,760
Yeah, I completely agree.

1044
00:55:03,860 --> 00:55:05,400
That's something which there's still more to be done

1045
00:55:05,400 --> 00:55:06,000
and it's inconsistent.

1046
00:55:06,320 --> 00:55:08,600
But I think that's something which I think does help

1047
00:55:08,600 --> 00:55:10,240
in how those things work.

1048
00:55:11,380 --> 00:55:12,980
I'm a bit aware of time.

1049
00:55:13,280 --> 00:55:14,680
And, Bryony, I'd love to...

1050
00:55:14,680 --> 00:55:16,680
You've mentioned the AI work that's taking place in that kingdom.

1051
00:55:16,840 --> 00:55:18,560
I'd love to hear a bit more from that, if that's OK.

1052
00:55:18,780 --> 00:55:19,360
Yeah, of course.

1053
00:55:19,740 --> 00:55:21,680
So I think, you know, obviously we've all heard

1054
00:55:21,680 --> 00:55:24,180
the terrifying, scary stories about AI.

1055
00:55:24,460 --> 00:55:27,000
I think the predominant feeling in the UK

1056
00:55:27,000 --> 00:55:28,500
is that what we've got to remember

1057
00:55:28,500 --> 00:55:30,260
is that there's a lot for good as well.

1058
00:55:31,300 --> 00:55:33,640
Everyone knows here about all the things that you can achieve,

1059
00:55:34,600 --> 00:55:36,380
like coding and drug discovery.

1060
00:55:36,500 --> 00:55:38,760
I mean, in the UK government, we're very, very excited

1061
00:55:38,760 --> 00:55:40,040
that this could solve our expenses.

1062
00:55:40,240 --> 00:55:43,140
Because we have a very long, cumbersome process.

1063
00:55:43,260 --> 00:55:44,820
If that could fix that, that would be great.

1064
00:55:45,740 --> 00:55:49,280
But, yeah, we're obviously very conscious of the risks as well.

1065
00:55:50,180 --> 00:55:53,220
I think what we're feeling is that it's akin

1066
00:55:53,220 --> 00:55:56,380
to a lot of the 90s with the explosion of the internet

1067
00:55:56,380 --> 00:55:58,880
and all the hype and the excitement that was around that

1068
00:55:58,880 --> 00:56:00,060
and obviously went really fast.

1069
00:56:01,260 --> 00:56:04,320
And security wasn't an integral consideration.

1070
00:56:05,820 --> 00:56:08,500
So what we want to do, going back to what I said earlier,

1071
00:56:08,600 --> 00:56:09,780
is, like, let's learn from those lessons,

1072
00:56:10,240 --> 00:56:10,380
let's learn from the past,

1073
00:56:10,700 --> 00:56:12,840
and let's make sure that when we're looking at AI,

1074
00:56:13,140 --> 00:56:14,480
we're doing this looking at security

1075
00:56:14,480 --> 00:56:16,020
and making sure it's embedded now,

1076
00:56:16,240 --> 00:56:18,640
because otherwise it's going to be really, really painful

1077
00:56:18,640 --> 00:56:21,220
if we have to retrofit in a few years' time

1078
00:56:21,220 --> 00:56:23,060
and think about how we want to manage that.

1079
00:56:23,860 --> 00:56:26,680
So that's what we're looking at at the moment in the UK.

1080
00:56:26,920 --> 00:56:28,580
We've published a number of papers

1081
00:56:28,580 --> 00:56:30,860
on potential regulation from DSIT,

1082
00:56:31,040 --> 00:56:33,000
the Department of Science, Innovation and Technology.

1083
00:56:33,740 --> 00:56:36,920
We've also published on the National Cyber Security Centre's website

1084
00:56:36,920 --> 00:56:39,960
some principles for thinking about security

1085
00:56:40,240 --> 00:56:41,440
for machine learning as well.

1086
00:56:42,440 --> 00:56:43,900
So that's something that is, again,

1087
00:56:44,060 --> 00:56:45,000
as for all of us,

1088
00:56:45,060 --> 00:56:48,100
it's going to be one of our number one priorities going forwards.

1089
00:56:48,380 --> 00:56:50,880
Our Prime Minister announced when he visited DC

1090
00:56:50,880 --> 00:56:52,380
a couple of months ago

1091
00:56:52,380 --> 00:56:55,100
that there's going to be a global AI summit

1092
00:56:55,100 --> 00:56:56,980
in the UK in the autumn.

1093
00:56:57,580 --> 00:56:59,000
That's going to be looking at safety

1094
00:56:59,000 --> 00:57:00,920
and working with other countries

1095
00:57:00,920 --> 00:57:03,280
about how we can think about building on things

1096
00:57:03,280 --> 00:57:06,360
like the White Houses and recent voluntary commitments

1097
00:57:06,360 --> 00:57:08,280
and thinking about how we can do this together,

1098
00:57:08,500 --> 00:57:09,840
because what we're really clear on

1099
00:57:09,840 --> 00:57:10,760
is that we can't do it alone.

1100
00:57:10,920 --> 00:57:12,040
We need to do this internationally.

1101
00:57:14,580 --> 00:57:15,440
Great. Thank you.

1102
00:57:15,960 --> 00:57:18,040
So I think something that's really come through

1103
00:57:18,040 --> 00:57:19,540
as a bit of a theme here

1104
00:57:19,540 --> 00:57:22,300
has been the important role of capacity building

1105
00:57:22,300 --> 00:57:23,980
and of how can we ensure

1106
00:57:23,980 --> 00:57:25,320
that we're preparing the cyber workforce.

1107
00:57:26,300 --> 00:57:28,940
So I'd love to hear perspectives on that side.

1108
00:57:29,040 --> 00:57:30,940
So Adam, is that something that you can share a bit more

1109
00:57:30,940 --> 00:57:31,980
on Australia?

1110
00:57:32,280 --> 00:57:32,500
Sure.

1111
00:57:32,700 --> 00:57:35,280
So we're in the midst of developing a new strategy

1112
00:57:35,280 --> 00:57:37,320
and to Ari's point,

1113
00:57:37,380 --> 00:57:39,760
we've just gone through a consultation process

1114
00:57:39,840 --> 00:57:42,980
and garnered about 350 responses.

1115
00:57:43,500 --> 00:57:45,040
And as part of that,

1116
00:57:45,080 --> 00:57:47,540
there was a recognition that Australia,

1117
00:57:47,760 --> 00:57:49,900
if we continue with the current dynamics

1118
00:57:49,900 --> 00:57:51,880
in terms of our workforce and our skills,

1119
00:57:52,200 --> 00:57:57,180
we'll have a shortage of 46,000 people by 2026.

1120
00:57:57,540 --> 00:57:59,040
And so in recognition of that,

1121
00:57:59,160 --> 00:58:02,360
the government is considering a holistic approach

1122
00:58:02,360 --> 00:58:04,080
to the way that we develop skills

1123
00:58:04,080 --> 00:58:06,160
and a cyber workforce in Australia.

1124
00:58:06,280 --> 00:58:08,840
So one of the things that will likely come forth

1125
00:58:08,840 --> 00:58:09,600
in the new strategy

1126
00:58:09,840 --> 00:58:13,880
is a new curricular for first and secondary school students.

1127
00:58:14,040 --> 00:58:16,620
So that looks at not just cyber security

1128
00:58:16,620 --> 00:58:20,000
but also online safety as well and literacy.

1129
00:58:20,520 --> 00:58:23,300
The second is a professionalism scheme.

1130
00:58:23,580 --> 00:58:27,960
So the feedback received was that there's not enough understanding

1131
00:58:27,960 --> 00:58:29,000
of what are the standards

1132
00:58:29,000 --> 00:58:31,780
to meet cyber security skills in Australia.

1133
00:58:32,040 --> 00:58:33,700
And the third is a recognition

1134
00:58:33,700 --> 00:58:36,020
that there's elements of our society

1135
00:58:36,020 --> 00:58:37,940
that we can inject into cyber security

1136
00:58:37,940 --> 00:58:39,240
if we give them the opportunity

1137
00:58:39,240 --> 00:58:41,440
to return to work through schemes

1138
00:58:41,440 --> 00:58:43,320
that will work for migrants,

1139
00:58:43,580 --> 00:58:45,300
mothers returning from work,

1140
00:58:45,400 --> 00:58:48,660
or other people who might be returning

1141
00:58:48,660 --> 00:58:50,180
from a disability, et cetera.

1142
00:58:50,340 --> 00:58:52,520
So there's kind of three key elements

1143
00:58:52,520 --> 00:58:54,620
to the cyber and skills conversation.

1144
00:58:55,280 --> 00:58:57,380
Sorry, the workforce and skills conversation

1145
00:58:57,380 --> 00:58:58,900
in Australia at the moment.

1146
00:59:02,240 --> 00:59:05,640
Yeah, I talked a little bit about the skills thing,

1147
00:59:05,660 --> 00:59:07,640
so I won't repeat any of that.

1148
00:59:07,740 --> 00:59:09,220
The only other element

1149
00:59:09,220 --> 00:59:10,820
in the Cyber Security Act,

1150
00:59:10,960 --> 00:59:12,400
which I should touch on,

1151
00:59:12,460 --> 00:59:14,000
and it's been added by the Parliament,

1152
00:59:14,140 --> 00:59:17,360
it wasn't in the original commission draft text,

1153
00:59:17,580 --> 00:59:20,780
is increasing funding and support

1154
00:59:20,780 --> 00:59:23,780
for the European Cyber Security Agency, EISA,

1155
00:59:23,980 --> 00:59:26,240
and particularly for its work

1156
00:59:26,240 --> 00:59:27,660
on developing its sort of

1157
00:59:27,660 --> 00:59:31,140
the cyber security community of practice

1158
00:59:31,140 --> 00:59:38,180
and of facilitating the exchange of competencies

1159
00:59:38,180 --> 00:59:40,800
with the national cyber security centres.

1160
00:59:41,140 --> 00:59:43,460
As I say, cyber security isn't an EU competence.

1161
00:59:43,600 --> 00:59:45,320
That's why we have to sort of dance around

1162
00:59:45,320 --> 00:59:46,380
the legislation a little bit

1163
00:59:46,380 --> 00:59:47,560
in terms of doing this.

1164
00:59:47,680 --> 00:59:51,000
But there was pretty much universal support

1165
00:59:51,000 --> 00:59:52,480
with the idea of, you know,

1166
00:59:52,500 --> 00:59:53,940
not EISA taking over

1167
00:59:53,940 --> 00:59:56,460
from the national cyber security centres.

1168
00:59:56,640 --> 00:59:57,520
That's never going to happen.

1169
00:59:57,620 --> 00:59:58,820
We just don't have that capacity.

1170
00:59:59,140 --> 01:00:02,080
But improving the exchange of experiences

1171
01:00:02,080 --> 01:00:04,140
and looking at, again, standards,

1172
01:00:04,460 --> 01:00:05,860
Stix, Taxi and others

1173
01:00:06,720 --> 01:00:07,680
for information,

1174
01:00:07,680 --> 01:00:09,100
rapid information exchange

1175
01:00:09,320 --> 01:00:12,880
on new exposed vulnerabilities or attacks

1176
01:00:12,880 --> 01:00:15,000
and being able to improve that

1177
01:00:15,000 --> 01:00:17,160
in an environment which is,

1178
01:00:17,380 --> 01:00:17,960
you've got to remember,

1179
01:00:18,140 --> 01:00:20,160
the European Union's 27 countries,

1180
01:00:20,460 --> 01:00:23,040
European Parliament's made up of 700 members

1181
01:00:23,040 --> 01:00:25,800
from 107 national political parties

1182
01:00:25,800 --> 01:00:27,360
working in 23 languages

1183
01:00:27,360 --> 01:00:29,800
where the legislation that's implemented

1184
01:00:29,800 --> 01:00:32,560
is implemented in those 23 languages.

1185
01:00:32,840 --> 01:00:34,800
So, you know, excuse a little bit

1186
01:00:34,800 --> 01:00:36,600
if things are sometimes a bit complicated,

1187
01:00:36,660 --> 01:00:37,660
but actually,

1188
01:00:37,680 --> 01:00:38,780
even at this level,

1189
01:00:38,880 --> 01:00:40,660
you know, everything working on cyber security

1190
01:00:40,660 --> 01:00:41,620
at a national level,

1191
01:00:41,760 --> 01:00:44,140
English may be the lingua franca

1192
01:00:44,140 --> 01:00:45,600
for a lot of operations and stuff,

1193
01:00:45,940 --> 01:00:47,700
but you cannot impose that

1194
01:00:47,700 --> 01:00:50,600
on a country like Romania or Serbia

1195
01:00:50,600 --> 01:00:53,600
or Estonia,

1196
01:00:53,740 --> 01:00:56,920
that their workforce exclusively work in English.

1197
01:00:57,040 --> 01:00:59,060
So you've got to provide that competence

1198
01:00:59,060 --> 01:01:00,620
also on a multilingual basis.

1199
01:01:00,740 --> 01:01:02,000
And I think that's the other thing.

1200
01:01:02,120 --> 01:01:03,980
The only final element I'd mention is,

1201
01:01:04,080 --> 01:01:04,780
and I touched on it

1202
01:01:04,780 --> 01:01:06,560
when I talked about election integrity,

1203
01:01:06,560 --> 01:01:08,320
and that is there's a call

1204
01:01:08,320 --> 01:01:09,620
from a recent report

1205
01:01:09,620 --> 01:01:10,680
of the European Parliament

1206
01:01:10,680 --> 01:01:12,520
on election interference

1207
01:01:12,520 --> 01:01:13,820
and foreign interference,

1208
01:01:14,060 --> 01:01:15,720
is a call to the member states

1209
01:01:15,720 --> 01:01:17,840
to make election systems part of,

1210
01:01:18,000 --> 01:01:19,660
classify them as critical infrastructure,

1211
01:01:19,920 --> 01:01:21,660
which is not the case at the moment.

1212
01:01:26,240 --> 01:01:26,880
Thank you.

1213
01:01:29,260 --> 01:01:31,020
So I think the only thing I would add

1214
01:01:31,020 --> 01:01:32,940
as a consideration for us

1215
01:01:32,940 --> 01:01:34,160
for the next year

1216
01:01:34,160 --> 01:01:35,720
is going to be looking at cyber skills.

1217
01:01:36,760 --> 01:01:38,420
So for us in the UK,

1218
01:01:39,760 --> 01:01:41,020
there's no point in us talking about

1219
01:01:41,780 --> 01:01:42,660
increasing resilience

1220
01:01:42,660 --> 01:01:44,140
of critical national infrastructure,

1221
01:01:44,480 --> 01:01:45,200
looking at the threat

1222
01:01:45,200 --> 01:01:47,100
if we just don't have the people to do it.

1223
01:01:47,720 --> 01:01:48,480
Currently in the UK,

1224
01:01:48,600 --> 01:01:51,340
we have a gap of 11,000 jobs

1225
01:01:52,040 --> 01:01:53,780
and our cyber workforce

1226
01:01:54,980 --> 01:01:56,820
needs to grow by 50%

1227
01:01:56,820 --> 01:01:58,280
over the last four years.

1228
01:01:58,500 --> 01:02:00,940
So there is a bit of a tight spot.

1229
01:02:01,720 --> 01:02:02,900
So what we're really clear

1230
01:02:02,900 --> 01:02:03,720
and what we want to do

1231
01:02:03,720 --> 01:02:05,700
for young people,

1232
01:02:05,720 --> 01:02:07,680
and to people in their mid-career

1233
01:02:07,680 --> 01:02:08,700
or any point in their career,

1234
01:02:08,780 --> 01:02:10,460
is have a really clear visualisation

1235
01:02:10,460 --> 01:02:12,280
of what a career in cybersecurity looks like.

1236
01:02:12,620 --> 01:02:14,320
So we talk about teachers,

1237
01:02:14,480 --> 01:02:15,260
we talk about lawyers,

1238
01:02:15,380 --> 01:02:16,440
we have children who want to

1239
01:02:16,440 --> 01:02:17,800
do something like that.

1240
01:02:17,980 --> 01:02:18,580
At the moment,

1241
01:02:18,620 --> 01:02:19,660
there isn't a clear career path

1242
01:02:19,660 --> 01:02:20,880
if you want to become a cyber professional.

1243
01:02:21,600 --> 01:02:22,980
So over the last two years,

1244
01:02:23,080 --> 01:02:23,980
we have worked really closely

1245
01:02:23,980 --> 01:02:24,660
with industry

1246
01:02:24,660 --> 01:02:26,220
and a number of other partners

1247
01:02:26,220 --> 01:02:26,980
to think about

1248
01:02:26,980 --> 01:02:29,660
how do we create a clear career path

1249
01:02:29,660 --> 01:02:31,280
for the people who want to get into cyber.

1250
01:02:32,400 --> 01:02:34,020
So that has led to the creation

1251
01:02:34,020 --> 01:02:35,700
of the Cyber Security Advisory Committee,

1252
01:02:35,720 --> 01:02:35,800
the Cyber Security Council,

1253
01:02:36,740 --> 01:02:38,380
which is an umbrella organisation

1254
01:02:38,940 --> 01:02:40,660
working with lots of different partners

1255
01:02:40,660 --> 01:02:42,400
to create that career path.

1256
01:02:43,380 --> 01:02:44,640
I'm not saying that, you know,

1257
01:02:44,700 --> 01:02:45,760
there's still a long way to go

1258
01:02:45,760 --> 01:02:47,100
and we're still doing a lot of consultation.

1259
01:02:47,520 --> 01:02:49,780
There's currently 16 different specialisms

1260
01:02:50,240 --> 01:02:52,640
within the Cyber Security Council.

1261
01:02:53,120 --> 01:02:55,660
There are different areas of accreditation.

1262
01:02:55,980 --> 01:02:57,020
But what it tries to take

1263
01:02:57,020 --> 01:02:58,100
is a holistic looking at

1264
01:02:58,100 --> 01:02:58,880
all the different things

1265
01:02:58,880 --> 01:03:00,400
that you can do to qualify in cyber.

1266
01:03:00,580 --> 01:03:01,940
So someone who did, like for myself,

1267
01:03:02,020 --> 01:03:02,920
did a linguistics degree,

1268
01:03:03,100 --> 01:03:04,440
you know, is making sure

1269
01:03:04,440 --> 01:03:05,060
that we can value

1270
01:03:05,060 --> 01:03:06,440
all the different things that, you know,

1271
01:03:06,500 --> 01:03:08,260
that people bring to the table on cyber

1272
01:03:08,260 --> 01:03:10,020
and making sure that that is recognised,

1273
01:03:10,360 --> 01:03:12,020
but also creating that clear pathway

1274
01:03:12,020 --> 01:03:15,060
and creating a clear visualisation

1275
01:03:15,740 --> 01:03:16,900
for what people want to do

1276
01:03:16,900 --> 01:03:17,660
by working in cyber.

1277
01:03:21,500 --> 01:03:23,720
Ari, I think you mentioned earlier

1278
01:03:23,720 --> 01:03:25,840
about the consultation deluges.

1279
01:03:26,820 --> 01:03:28,100
It would be great to hear a bit more

1280
01:03:28,100 --> 01:03:29,680
about what you'd like to see more of,

1281
01:03:29,700 --> 01:03:31,300
maybe from what you've seen

1282
01:03:31,300 --> 01:03:32,500
some countries do really well

1283
01:03:32,500 --> 01:03:33,720
in addition to that,

1284
01:03:33,760 --> 01:03:34,760
and then what maybe you think

1285
01:03:34,760 --> 01:03:35,700
that we should be doing more

1286
01:03:35,700 --> 01:03:37,800
to help us get to that capacity issue

1287
01:03:37,800 --> 01:03:38,640
a bit sooner.

1288
01:03:39,480 --> 01:03:40,860
Yeah, I mean, the capacity issue is hard.

1289
01:03:40,980 --> 01:03:42,360
I mean, it's everywhere, right?

1290
01:03:42,500 --> 01:03:44,860
It's in the developed countries

1291
01:03:44,860 --> 01:03:45,980
and the non-developed countries.

1292
01:03:46,140 --> 01:03:47,780
And I think, you know,

1293
01:03:47,820 --> 01:03:48,640
from my point of view,

1294
01:03:48,680 --> 01:03:49,520
a lot of that has been

1295
01:03:50,040 --> 01:03:52,320
that we have to get much more,

1296
01:03:52,380 --> 01:03:54,400
think about getting much more diversity

1297
01:03:54,400 --> 01:03:56,480
into the structure.

1298
01:03:56,560 --> 01:03:57,460
I mean, one of the things

1299
01:03:57,460 --> 01:03:58,460
that the UK has done

1300
01:03:58,460 --> 01:04:00,040
is they had this effort to bring,

1301
01:04:00,140 --> 01:04:03,400
like, I forget what grade level

1302
01:04:03,400 --> 01:04:04,040
it would be here,

1303
01:04:04,040 --> 01:04:06,720
but girls at a certain grade level,

1304
01:04:06,800 --> 01:04:07,300
they have a competition

1305
01:04:07,300 --> 01:04:08,240
only girls can enter

1306
01:04:08,240 --> 01:04:12,600
on tech skills that leads

1307
01:04:12,600 --> 01:04:13,880
towards cybersecurity

1308
01:04:13,880 --> 01:04:16,540
and have a challenge for them

1309
01:04:16,540 --> 01:04:20,320
and had a ton of participation,

1310
01:04:20,700 --> 01:04:22,540
ton, ton, ton participation

1311
01:04:22,540 --> 01:04:24,800
and got national write-ups

1312
01:04:24,800 --> 01:04:25,420
and things like that.

1313
01:04:25,540 --> 01:04:26,560
I think we need to do

1314
01:04:26,560 --> 01:04:27,400
a lot more of that,

1315
01:04:27,460 --> 01:04:30,220
but that's like planning 10 years out, right?

1316
01:04:30,820 --> 01:04:33,040
And I think that might be the path,

1317
01:04:34,680 --> 01:04:35,780
we do have, you know,

1318
01:04:36,520 --> 01:04:37,980
there is this kind of challenge,

1319
01:04:38,080 --> 01:04:39,100
you're talking about AI, right?

1320
01:04:39,240 --> 01:04:40,620
And you have the idea of like,

1321
01:04:40,680 --> 01:04:41,440
we're going to automate

1322
01:04:41,440 --> 01:04:42,280
a lot more of security.

1323
01:04:42,900 --> 01:04:44,180
And at the same time,

1324
01:04:44,740 --> 01:04:46,040
like we want to get more people

1325
01:04:46,040 --> 01:04:46,960
into these jobs

1326
01:04:46,960 --> 01:04:50,400
who then their jobs might disappear as well.

1327
01:04:50,560 --> 01:04:51,580
So I think that there is

1328
01:04:51,580 --> 01:04:52,540
a little bit of a challenge

1329
01:04:52,540 --> 01:04:53,500
on that side of it.

1330
01:04:53,920 --> 01:04:55,300
But the, I mean,

1331
01:04:55,760 --> 01:04:58,380
there are still so many

1332
01:04:59,660 --> 01:05:01,060
cybersecurity jobs right now.

1333
01:05:01,180 --> 01:05:01,780
I mean,

1334
01:05:01,780 --> 01:05:04,500
what Peter was saying

1335
01:05:04,500 --> 01:05:08,140
in terms of the number of open vacancies,

1336
01:05:08,160 --> 01:05:10,560
if you look at what we have in the US

1337
01:05:10,560 --> 01:05:15,500
on the CyberSeek page

1338
01:05:15,500 --> 01:05:17,940
that NICE puts together in this,

1339
01:05:18,980 --> 01:05:19,780
they have,

1340
01:05:19,940 --> 01:05:21,160
I think it is,

1341
01:05:22,680 --> 01:05:25,200
the number of open jobs

1342
01:05:25,200 --> 01:05:28,280
is equal to the number of people in,

1343
01:05:28,480 --> 01:05:31,100
that are qualified for those jobs.

1344
01:05:31,260 --> 01:05:31,760
Right?

1345
01:05:31,780 --> 01:05:32,920
So if everyone switched,

1346
01:05:33,100 --> 01:05:35,220
obviously you'd have all the other new jobs open up.

1347
01:05:35,340 --> 01:05:35,500
Right?

1348
01:05:35,640 --> 01:05:37,100
So it is not like,

1349
01:05:37,180 --> 01:05:37,780
it's just a,

1350
01:05:37,940 --> 01:05:39,980
we have to bring down the number of jobs.

1351
01:05:40,020 --> 01:05:40,120
Yeah.

1352
01:05:40,200 --> 01:05:42,340
And automation can help with that to some degree.

1353
01:05:42,600 --> 01:05:44,100
We also have to get a divert,

1354
01:05:44,180 --> 01:05:45,540
more people into the workforce

1355
01:05:45,540 --> 01:05:47,400
that diversifies the workforce

1356
01:05:48,160 --> 01:05:49,500
and think more differently

1357
01:05:49,500 --> 01:05:50,720
about who those people are.

1358
01:05:50,860 --> 01:05:52,940
And it might mean thinking 10 years down the road

1359
01:05:52,940 --> 01:05:54,680
in order to get enough people to do that

1360
01:05:54,680 --> 01:05:57,160
and to bring those kinds of challenges

1361
01:05:57,160 --> 01:05:58,680
because you're not going to just,

1362
01:05:58,820 --> 01:05:59,300
you know,

1363
01:05:59,300 --> 01:06:01,100
the other key to that,

1364
01:06:01,140 --> 01:06:01,640
this is,

1365
01:06:01,780 --> 01:06:03,520
a lot of those jobs aren't the entry level jobs.

1366
01:06:04,060 --> 01:06:04,420
Right?

1367
01:06:04,480 --> 01:06:06,040
If you look at the job categories,

1368
01:06:06,220 --> 01:06:08,600
most of them need three to five years experience

1369
01:06:08,600 --> 01:06:10,440
as the baseline.

1370
01:06:10,720 --> 01:06:12,540
So how do you get three to five years experience?

1371
01:06:12,660 --> 01:06:12,980
Right?

1372
01:06:13,120 --> 01:06:15,180
So there is a lot of this discussion

1373
01:06:15,180 --> 01:06:18,300
about apprenticeships and things like that

1374
01:06:18,300 --> 01:06:19,180
in order to get there.

1375
01:06:19,300 --> 01:06:21,580
But we got to think a lot more creatively

1376
01:06:21,580 --> 01:06:22,180
because that's,

1377
01:06:22,740 --> 01:06:23,720
apprenticeships are hard to scale.

1378
01:06:23,800 --> 01:06:24,000
So.

1379
01:06:24,660 --> 01:06:25,020
Yeah.

1380
01:06:25,480 --> 01:06:26,540
Just any other points

1381
01:06:26,540 --> 01:06:27,960
that you'd like to raise on the skills agenda

1382
01:06:27,960 --> 01:06:29,080
before we move on?

1383
01:06:30,560 --> 01:06:31,220
Just anything,

1384
01:06:31,360 --> 01:06:32,700
so just what Ari just mentioned

1385
01:06:32,700 --> 01:06:34,180
regarding our Cyber First Girls competition,

1386
01:06:35,080 --> 01:06:35,620
which is,

1387
01:06:35,720 --> 01:06:37,140
thank you for your very kind comments, Ari.

1388
01:06:37,560 --> 01:06:38,200
Because yeah,

1389
01:06:38,220 --> 01:06:40,120
we're really proud of the Cyber First competition

1390
01:06:40,120 --> 01:06:42,120
and it's about aged girls at age 13

1391
01:06:42,120 --> 01:06:45,560
and they do a coding competition over the summer.

1392
01:06:45,900 --> 01:06:46,580
And it's,

1393
01:06:47,440 --> 01:06:50,120
what we see is this point where in the UK,

1394
01:06:50,380 --> 01:06:52,700
that's where you choose your next stage of education,

1395
01:06:53,060 --> 01:06:55,020
which can dictate what A levels you do,

1396
01:06:55,080 --> 01:06:56,200
which university you go to.

1397
01:06:56,300 --> 01:06:58,060
So it really is a real determining point.

1398
01:06:58,140 --> 01:06:58,840
Quite terrifying,

1399
01:06:59,080 --> 01:07:00,480
you have to make that as with age 13, 14,

1400
01:07:00,740 --> 01:07:01,080
but you know,

1401
01:07:01,100 --> 01:07:01,440
there you go.

1402
01:07:01,840 --> 01:07:04,220
But what we're seeing is a lot of girls drop off from,

1403
01:07:04,740 --> 01:07:05,340
you know,

1404
01:07:05,360 --> 01:07:08,280
a cyber sort of topics at that age.

1405
01:07:08,320 --> 01:07:08,520
So that,

1406
01:07:08,540 --> 01:07:10,120
so this is why that competition is age,

1407
01:07:10,260 --> 01:07:12,260
aimed at that age to try and tackle that.

1408
01:07:13,180 --> 01:07:14,360
The only other thing I would say

1409
01:07:14,360 --> 01:07:15,640
is some of the other programmes we have,

1410
01:07:15,740 --> 01:07:17,600
we're starting to see some results.

1411
01:07:18,020 --> 01:07:19,980
So they've been in programme progress

1412
01:07:19,980 --> 01:07:21,460
for about this last seven, eight years.

1413
01:07:21,620 --> 01:07:23,100
And we're now seeing some of those people

1414
01:07:23,100 --> 01:07:25,980
who have went to these competitions at age 13,

1415
01:07:26,160 --> 01:07:28,820
now coming as interns into the Department of Science

1416
01:07:28,820 --> 01:07:29,540
and Innovation Technology.

1417
01:07:30,020 --> 01:07:30,440
You know,

1418
01:07:30,500 --> 01:07:31,220
we're talking small numbers,

1419
01:07:31,320 --> 01:07:32,600
but it is a really good sign.

1420
01:07:35,880 --> 01:07:36,280
Peter,

1421
01:07:36,520 --> 01:07:37,040
just before,

1422
01:07:37,460 --> 01:07:38,520
before we go to questions,

1423
01:07:38,820 --> 01:07:39,300
Peter,

1424
01:07:39,480 --> 01:07:40,160
you mentioned briefly,

1425
01:07:40,300 --> 01:07:42,120
and feel free to not speak on,

1426
01:07:42,260 --> 01:07:43,720
but you were talking about

1427
01:07:43,720 --> 01:07:44,640
the importance of elections

1428
01:07:44,640 --> 01:07:46,080
and the election security component.

1429
01:07:46,300 --> 01:07:47,660
I'd love to hear any more input

1430
01:07:47,660 --> 01:07:48,580
you have on that side.

1431
01:07:50,100 --> 01:07:50,500
Yeah,

1432
01:07:50,580 --> 01:07:50,960
I mean,

1433
01:07:50,960 --> 01:07:51,440
I don't,

1434
01:07:51,440 --> 01:07:52,180
for this audience,

1435
01:07:52,240 --> 01:07:54,680
I don't think anyone needs reminding

1436
01:07:54,680 --> 01:07:56,120
about some of the challenges

1437
01:07:56,120 --> 01:07:57,620
that we see in elections already,

1438
01:07:57,820 --> 01:07:58,800
with deepfakes,

1439
01:07:58,800 --> 01:07:59,940
whether video or audio,

1440
01:08:00,880 --> 01:08:04,280
but also the way that social media

1441
01:08:04,280 --> 01:08:05,980
has been used and driven by

1442
01:08:05,980 --> 01:08:07,900
increasing the automated systems

1443
01:08:07,900 --> 01:08:08,900
which are brought by,

1444
01:08:10,680 --> 01:08:11,500
let's say,

1445
01:08:11,500 --> 01:08:13,820
either state or non-state actors,

1446
01:08:14,020 --> 01:08:14,520
you know,

1447
01:08:14,520 --> 01:08:15,200
off the shelf,

1448
01:08:15,800 --> 01:08:18,480
sort of disinformation

1449
01:08:18,480 --> 01:08:22,300
or interference capacities.

1450
01:08:24,060 --> 01:08:26,140
The Parliament's approach has been,

1451
01:08:26,300 --> 01:08:28,180
we had a special committee set up

1452
01:08:28,180 --> 01:08:28,440
for,

1453
01:08:28,800 --> 01:08:29,580
a year and a half,

1454
01:08:29,740 --> 01:08:31,220
looking at foreign interference

1455
01:08:31,220 --> 01:08:32,640
and election integrity.

1456
01:08:33,820 --> 01:08:35,060
And some of the issues

1457
01:08:35,060 --> 01:08:36,240
were sort of pointing,

1458
01:08:36,340 --> 01:08:37,580
not just pointing the finger

1459
01:08:37,580 --> 01:08:39,260
at online platforms,

1460
01:08:39,460 --> 01:08:40,080
but sort of saying,

1461
01:08:40,140 --> 01:08:40,340
you know,

1462
01:08:40,360 --> 01:08:41,120
you guys have got to,

1463
01:08:41,120 --> 01:08:42,240
you've got to pull your weight

1464
01:08:42,240 --> 01:08:43,240
a little bit in terms of

1465
01:08:44,860 --> 01:08:46,160
trying to either,

1466
01:08:46,240 --> 01:08:48,460
to ban is unrealistic,

1467
01:08:48,680 --> 01:08:49,760
but to call on them

1468
01:08:49,760 --> 01:08:51,400
to rein in

1469
01:08:52,140 --> 01:08:53,020
the possibility

1470
01:08:53,020 --> 01:08:54,120
for advertisers

1471
01:08:54,120 --> 01:08:56,800
to do sort of micro-targeted

1472
01:08:57,560 --> 01:08:58,440
political campaigning.

1473
01:08:58,500 --> 01:08:58,680
So,

1474
01:08:58,700 --> 01:08:58,780
you know,

1475
01:08:58,800 --> 01:09:00,600
even in a particular electoral district,

1476
01:09:00,760 --> 01:09:01,540
to be able,

1477
01:09:01,620 --> 01:09:02,540
using AI,

1478
01:09:02,880 --> 01:09:05,740
a malign actor would be able to

1479
01:09:05,740 --> 01:09:08,760
target an audience of

1480
01:09:08,760 --> 01:09:10,980
a thousand Facebook users,

1481
01:09:11,080 --> 01:09:11,480
for example,

1482
01:09:11,480 --> 01:09:12,600
in one constituency,

1483
01:09:12,820 --> 01:09:14,920
each with a very different message

1484
01:09:14,920 --> 01:09:16,320
based on the information

1485
01:09:16,320 --> 01:09:17,860
and data available to them.

1486
01:09:18,060 --> 01:09:19,380
And to do that,

1487
01:09:19,380 --> 01:09:20,680
to do that well,

1488
01:09:20,760 --> 01:09:22,620
that's what political campaigning is about,

1489
01:09:22,760 --> 01:09:24,180
to do that nefariously

1490
01:09:24,660 --> 01:09:27,680
and to put out misinformation

1491
01:09:27,680 --> 01:09:28,660
or lies,

1492
01:09:28,920 --> 01:09:30,560
knowing that one person

1493
01:09:30,560 --> 01:09:31,500
is going to be more susceptible

1494
01:09:31,500 --> 01:09:33,700
to something which is claimed

1495
01:09:33,700 --> 01:09:34,660
in one area

1496
01:09:34,660 --> 01:09:36,420
where another person would not.

1497
01:09:36,580 --> 01:09:38,000
That sort of micro-targeting

1498
01:09:38,000 --> 01:09:38,800
is something which we're

1499
01:09:38,800 --> 01:09:39,580
very concerned about.

1500
01:09:39,960 --> 01:09:41,440
We are calling on

1501
01:09:42,140 --> 01:09:43,540
the online platforms

1502
01:09:43,540 --> 01:09:44,780
to take more seriously

1503
01:09:44,780 --> 01:09:46,020
and more rapid action

1504
01:09:46,020 --> 01:09:47,480
on takedown of misinformation

1505
01:09:47,480 --> 01:09:48,740
where it's clear,

1506
01:09:48,820 --> 01:09:49,720
not misinformation,

1507
01:09:49,980 --> 01:09:50,600
disinformation,

1508
01:09:51,040 --> 01:09:53,400
to clarify the terminology,

1509
01:09:54,200 --> 01:09:55,460
where it's known

1510
01:09:55,460 --> 01:09:56,560
that there are actors

1511
01:09:56,560 --> 01:09:57,660
that are clear

1512
01:09:57,680 --> 01:09:59,480
and clearly behaving

1513
01:09:59,480 --> 01:10:02,720
in a way of promoting

1514
01:10:02,720 --> 01:10:04,380
false information online.

1515
01:10:04,740 --> 01:10:06,420
I mentioned about the integrity

1516
01:10:06,420 --> 01:10:07,320
of election systems

1517
01:10:07,320 --> 01:10:08,360
and them being considered

1518
01:10:08,360 --> 01:10:09,800
as critical infrastructure.

1519
01:10:10,280 --> 01:10:12,380
The other area which I think is,

1520
01:10:12,440 --> 01:10:15,360
it may be marginal interest,

1521
01:10:15,700 --> 01:10:17,920
but protection of journalists

1522
01:10:18,350 --> 01:10:21,640
and of what we're talking about,

1523
01:10:21,740 --> 01:10:23,580
introducing so-called mirror clauses

1524
01:10:23,580 --> 01:10:26,680
whereby we will provide access

1525
01:10:27,740 --> 01:10:30,400
to non-European journalists

1526
01:10:30,400 --> 01:10:32,800
in reciprocity of the openness

1527
01:10:32,800 --> 01:10:33,840
of other third countries

1528
01:10:33,840 --> 01:10:34,920
to do the same for us.

1529
01:10:35,080 --> 01:10:37,000
So if you are faced with a country

1530
01:10:37,000 --> 01:10:39,220
which has a very tightly controlled media

1531
01:10:39,220 --> 01:10:40,600
where there are no journalists

1532
01:10:40,600 --> 01:10:41,460
or foreign journalists

1533
01:10:41,460 --> 01:10:42,400
have very limited access

1534
01:10:42,400 --> 01:10:43,000
to information,

1535
01:10:43,260 --> 01:10:44,760
well, it's going to be a tit-for-tat

1536
01:10:44,760 --> 01:10:46,440
and you can expect

1537
01:10:46,440 --> 01:10:47,940
to get more limited access

1538
01:10:47,940 --> 01:10:51,680
as a journalist from those countries

1539
01:10:51,680 --> 01:10:54,100
to the political space that we have.

1540
01:10:54,100 --> 01:10:57,340
I think a lot of that is,

1541
01:10:57,400 --> 01:10:58,840
a lot of people talk about AI

1542
01:10:58,840 --> 01:10:59,920
and I think AI is going to be

1543
01:10:59,920 --> 01:11:00,640
one of the critical aspects

1544
01:11:00,640 --> 01:11:03,380
in terms of where we are

1545
01:11:03,380 --> 01:11:04,540
and we have the whole AI Act

1546
01:11:04,540 --> 01:11:05,320
and I'm not going to go into

1547
01:11:05,320 --> 01:11:07,240
any of the details about that.

1548
01:11:07,680 --> 01:11:08,920
But this issue,

1549
01:11:09,480 --> 01:11:11,080
whether it's for us operationally

1550
01:11:11,080 --> 01:11:11,620
in the Parliament

1551
01:11:11,620 --> 01:11:13,100
to have sort of transparency

1552
01:11:13,800 --> 01:11:15,540
or insight to how algorithms

1553
01:11:15,540 --> 01:11:18,860
are being used for a service

1554
01:11:18,860 --> 01:11:20,320
that we may buy in off the shelf

1555
01:11:20,320 --> 01:11:22,180
to help some of our internal work,

1556
01:11:22,320 --> 01:11:23,700
to know that it's,

1557
01:11:23,700 --> 01:11:25,500
that the service is reliable,

1558
01:11:25,760 --> 01:11:26,920
that it has high level of integrity,

1559
01:11:27,340 --> 01:11:29,600
that the data source is being used

1560
01:11:29,600 --> 01:11:31,500
or whatever are known,

1561
01:11:31,780 --> 01:11:33,340
that there isn't data poisoning upstream

1562
01:11:33,340 --> 01:11:34,740
before the algorithms

1563
01:11:34,740 --> 01:11:35,840
or the language models

1564
01:11:35,840 --> 01:11:37,020
are being used or deployed.

1565
01:11:37,240 --> 01:11:39,780
These are all issues about transparency

1566
01:11:39,780 --> 01:11:41,720
which have a clear relationship

1567
01:11:42,240 --> 01:11:43,920
to the whole world of cybersecurity

1568
01:11:43,920 --> 01:11:45,340
because you want to,

1569
01:11:45,340 --> 01:11:47,320
you want to keep the integrity

1570
01:11:47,320 --> 01:11:49,900
of that whole chain of training data,

1571
01:11:50,560 --> 01:11:52,120
operational data, synthetic data,

1572
01:11:52,140 --> 01:11:52,900
whatever coming through.

1573
01:11:53,920 --> 01:11:56,520
Those models before providing

1574
01:11:56,520 --> 01:11:57,540
sort of decision support.

1575
01:11:57,760 --> 01:11:58,620
Whether that's in terms

1576
01:11:58,620 --> 01:11:59,580
of our operational systems,

1577
01:11:59,840 --> 01:12:00,880
whether that's in terms

1578
01:12:00,880 --> 01:12:03,660
of what gets pushed out in mass media

1579
01:12:03,660 --> 01:12:05,800
or online and social media,

1580
01:12:06,800 --> 01:12:09,080
that interface between cybersecurity challenges

1581
01:12:09,080 --> 01:12:10,540
and AI I think is going to be

1582
01:12:10,540 --> 01:12:11,100
an increasingly,

1583
01:12:12,200 --> 01:12:14,480
a headache for us in the coming year.

1584
01:12:15,120 --> 01:12:15,720
Thank you.

1585
01:12:16,020 --> 01:12:16,940
Thank you very much.

1586
01:12:17,220 --> 01:12:18,620
I'd love to hear any questions

1587
01:12:18,620 --> 01:12:19,480
that we even have as well.

1588
01:12:19,560 --> 01:12:20,300
So please do feel free.

1589
01:12:20,360 --> 01:12:21,000
There's a microphone here.

1590
01:12:21,440 --> 01:12:23,200
If anyone would like to come join.

1591
01:12:23,260 --> 01:12:23,580
Yes, please.

1592
01:12:26,260 --> 01:12:26,740
Apologies.

1593
01:12:26,820 --> 01:12:28,080
It'll be a little long-winded,

1594
01:12:28,120 --> 01:12:29,180
but I promise there's a question.

1595
01:12:29,380 --> 01:12:30,520
I wanted to hit on a couple points

1596
01:12:30,520 --> 01:12:31,220
that you talked about,

1597
01:12:31,340 --> 01:12:33,160
especially as it comes to two issues

1598
01:12:33,160 --> 01:12:34,620
that are kind of related

1599
01:12:34,620 --> 01:12:37,080
in the way that they have their impacts

1600
01:12:37,080 --> 01:12:38,020
in their respective ways.

1601
01:12:38,160 --> 01:12:40,460
And that's the kind of implication

1602
01:12:40,460 --> 01:12:42,820
of enforcing a national or international,

1603
01:12:43,060 --> 01:12:43,780
at whatever level,

1604
01:12:43,860 --> 01:12:44,800
cybersecurity policy

1605
01:12:44,800 --> 01:12:46,020
on small businesses.

1606
01:12:46,660 --> 01:12:49,020
And also kind of conflated

1607
01:12:49,020 --> 01:12:49,840
with a separate issue

1608
01:12:49,840 --> 01:12:51,260
and that's what we spoke about

1609
01:12:51,260 --> 01:12:52,460
as far as Mexico

1610
01:12:52,460 --> 01:12:53,600
not having the expertise

1611
01:12:53,600 --> 01:12:53,680
to do that.

1612
01:12:53,680 --> 01:12:53,880
I think it's important

1613
01:12:53,880 --> 01:12:54,700
to develop their own

1614
01:12:54,700 --> 01:12:55,960
cybersecurity policy

1615
01:12:55,960 --> 01:12:56,740
or to implement

1616
01:12:56,740 --> 01:12:57,920
that cybersecurity policy.

1617
01:12:58,180 --> 01:12:59,420
Looking at, for example,

1618
01:12:59,420 --> 01:13:00,660
Africa and developing

1619
01:13:00,660 --> 01:13:02,620
into a more modern

1620
01:13:02,620 --> 01:13:04,460
internet-connected world.

1621
01:13:05,280 --> 01:13:06,940
Kind of this similar impact

1622
01:13:06,940 --> 01:13:07,840
on small businesses

1623
01:13:07,840 --> 01:13:09,120
applies to smaller countries.

1624
01:13:09,300 --> 01:13:09,700
For example,

1625
01:13:09,700 --> 01:13:11,020
complying with GDPR

1626
01:13:11,020 --> 01:13:12,240
is a challenge

1627
01:13:12,240 --> 01:13:13,100
for small businesses

1628
01:13:13,100 --> 01:13:13,900
as well as it is

1629
01:13:13,900 --> 01:13:14,760
for smaller countries

1630
01:13:14,760 --> 01:13:15,760
to comply with those kind

1631
01:13:15,760 --> 01:13:16,680
of internationalized

1632
01:13:16,680 --> 01:13:17,620
cybersecurity policies.

1633
01:13:17,920 --> 01:13:19,280
So taking into account,

1634
01:13:19,440 --> 01:13:19,880
for example,

1635
01:13:19,900 --> 01:13:20,880
the geopolitics

1636
01:13:20,880 --> 01:13:21,760
of Russian

1637
01:13:21,760 --> 01:13:23,120
and Chinese influences

1638
01:13:23,120 --> 01:13:23,660
as it comes to

1639
01:13:23,660 --> 01:13:25,240
Africa and being able

1640
01:13:25,240 --> 01:13:26,400
to knowledge transfer

1641
01:13:26,400 --> 01:13:27,680
to smaller countries

1642
01:13:27,680 --> 01:13:28,600
and smaller businesses

1643
01:13:28,600 --> 01:13:29,260
how to comply

1644
01:13:29,260 --> 01:13:30,040
with those cybersecurity

1645
01:13:30,040 --> 01:13:30,640
policies,

1646
01:13:30,940 --> 01:13:31,840
what do you see

1647
01:13:31,840 --> 01:13:32,620
as the most feasible

1648
01:13:32,620 --> 01:13:33,840
solutions for us

1649
01:13:33,840 --> 01:13:35,720
to be able to kind of

1650
01:13:35,720 --> 01:13:37,340
prevent conflating

1651
01:13:37,340 --> 01:13:38,080
national security

1652
01:13:38,080 --> 01:13:38,920
with cybersecurity

1653
01:13:38,920 --> 01:13:40,320
and be able to share

1654
01:13:40,320 --> 01:13:40,900
that information

1655
01:13:40,900 --> 01:13:41,740
and that knowledge

1656
01:13:41,740 --> 01:13:42,700
with smaller businesses

1657
01:13:42,700 --> 01:13:43,200
and countries

1658
01:13:43,200 --> 01:13:43,980
to not impose

1659
01:13:43,980 --> 01:13:44,820
a greater cost

1660
01:13:44,820 --> 01:13:45,640
on them to comply?

1661
01:13:51,340 --> 01:13:52,680
So a lot of countries

1662
01:13:52,680 --> 01:13:53,640
that have been

1663
01:13:53,660 --> 01:13:53,820
able to do that

1664
01:13:53,820 --> 01:13:55,000
have actually had

1665
01:13:55,000 --> 01:13:55,480
kind of like

1666
01:13:55,480 --> 01:13:56,280
the minimalist rules.

1667
01:13:56,380 --> 01:13:57,220
So Japan

1668
01:13:57,220 --> 01:13:58,960
and their privacy law

1669
01:13:59,440 --> 01:14:00,060
came up with,

1670
01:14:00,100 --> 01:14:00,640
you know,

1671
01:14:00,640 --> 01:14:01,560
this is the minimum

1672
01:14:01,560 --> 01:14:02,500
amount of information

1673
01:14:02,500 --> 01:14:03,120
you collect

1674
01:14:03,120 --> 01:14:05,620
and also here's

1675
01:14:05,620 --> 01:14:06,440
the number of like

1676
01:14:06,440 --> 01:14:07,280
how small

1677
01:14:07,280 --> 01:14:08,440
like your income

1678
01:14:08,440 --> 01:14:09,800
is and et cetera

1679
01:14:09,800 --> 01:14:11,080
and kind of has

1680
01:14:11,080 --> 01:14:12,020
some degree

1681
01:14:12,020 --> 01:14:12,900
of changing that

1682
01:14:12,900 --> 01:14:13,500
based on that.

1683
01:14:13,600 --> 01:14:14,040
Obviously,

1684
01:14:14,080 --> 01:14:14,500
you don't want

1685
01:14:14,500 --> 01:14:15,460
just because

1686
01:14:15,460 --> 01:14:16,560
someone doesn't make

1687
01:14:16,560 --> 01:14:17,080
a lot of money

1688
01:14:17,080 --> 01:14:17,580
or it only has

1689
01:14:17,580 --> 01:14:18,260
a couple employees

1690
01:14:18,260 --> 01:14:19,040
but collects information

1691
01:14:19,040 --> 01:14:20,560
on the entire world

1692
01:14:20,560 --> 01:14:21,960
you don't want to like

1693
01:14:23,660 --> 01:14:23,680
that kind of stuff

1694
01:14:23,680 --> 01:14:24,040
and so there's

1695
01:14:24,040 --> 01:14:24,720
a balance there

1696
01:14:24,720 --> 01:14:25,860
especially in the privacy

1697
01:14:26,620 --> 01:14:27,100
discussion.

1698
01:14:27,360 --> 01:14:27,840
But I do think

1699
01:14:27,840 --> 01:14:28,360
that it is

1700
01:14:28,360 --> 01:14:29,640
your point about

1701
01:14:30,280 --> 01:14:31,120
the separation

1702
01:14:31,120 --> 01:14:31,880
of national security

1703
01:14:31,880 --> 01:14:34,460
and cybersecurity

1704
01:14:34,460 --> 01:14:35,620
is a good one

1705
01:14:35,620 --> 01:14:36,780
and having

1706
01:14:36,780 --> 01:14:37,580
an understanding

1707
01:14:37,580 --> 01:14:38,600
of like

1708
01:14:38,600 --> 01:14:39,020
the impact

1709
01:14:39,020 --> 01:14:40,080
like the broader impact

1710
01:14:40,080 --> 01:14:40,760
that you're having

1711
01:14:40,760 --> 01:14:41,400
on the economy

1712
01:14:41,400 --> 01:14:42,320
when you come up

1713
01:14:42,320 --> 01:14:42,860
with these rules

1714
01:14:42,860 --> 01:14:44,380
and how do you go

1715
01:14:44,380 --> 01:14:45,220
about it affecting

1716
01:14:45,220 --> 01:14:46,480
small businesses

1717
01:14:46,480 --> 01:14:47,540
and keeping that

1718
01:14:47,540 --> 01:14:48,860
into account

1719
01:14:49,440 --> 01:14:50,040
as you make

1720
01:14:50,040 --> 01:14:50,800
the policy

1721
01:14:50,800 --> 01:14:51,680
and you know

1722
01:14:51,680 --> 01:14:52,760
one of the things we hear a lot

1723
01:14:54,580 --> 01:14:55,700
is don't worry about it.

1724
01:14:55,740 --> 01:14:56,140
We don't have it

1725
01:14:56,140 --> 01:14:57,600
in the regulation

1726
01:14:58,100 --> 01:14:59,080
but I mean

1727
01:14:59,080 --> 01:14:59,420
we don't have it

1728
01:14:59,420 --> 01:15:00,320
but when we put

1729
01:15:00,320 --> 01:15:01,040
when we have the

1730
01:15:01,520 --> 01:15:01,820
what's it called

1731
01:15:01,820 --> 01:15:02,780
the implementing language

1732
01:15:03,240 --> 01:15:03,640
right?

1733
01:15:03,940 --> 01:15:04,680
It'll be in the

1734
01:15:04,680 --> 01:15:05,380
implementing language

1735
01:15:05,380 --> 01:15:06,220
this issue

1736
01:15:06,220 --> 01:15:06,940
and then a lot

1737
01:15:06,940 --> 01:15:07,860
of the small business stuff

1738
01:15:07,860 --> 01:15:08,440
that we have raised

1739
01:15:08,440 --> 01:15:08,760
with EU

1740
01:15:08,760 --> 01:15:09,940
they say you know

1741
01:15:09,940 --> 01:15:11,260
wait for the implementing language.

1742
01:15:11,900 --> 01:15:12,620
I can't say

1743
01:15:12,620 --> 01:15:12,960
that makes

1744
01:15:12,960 --> 01:15:14,060
the small businesses

1745
01:15:14,060 --> 01:15:14,780
I spoke to

1746
01:15:14,780 --> 01:15:15,640
that understand

1747
01:15:15,640 --> 01:15:16,300
what the CRA

1748
01:15:16,300 --> 01:15:17,140
is going to do

1749
01:15:17,140 --> 01:15:18,500
very like

1750
01:15:18,500 --> 01:15:19,540
doesn't modify them

1751
01:15:19,540 --> 01:15:20,920
but I do think

1752
01:15:23,660 --> 01:15:23,720
that sometimes

1753
01:15:23,720 --> 01:15:24,260
if we can get

1754
01:15:24,260 --> 01:15:25,620
as we get into

1755
01:15:25,620 --> 01:15:26,520
more details

1756
01:15:28,180 --> 01:15:29,140
and that

1757
01:15:29,140 --> 01:15:30,720
you know

1758
01:15:30,720 --> 01:15:30,960
the people

1759
01:15:30,960 --> 01:15:31,480
with expertise

1760
01:15:31,480 --> 01:15:32,320
that are writing it

1761
01:15:32,320 --> 01:15:32,900
you know

1762
01:15:32,900 --> 01:15:33,780
can go into

1763
01:15:33,780 --> 01:15:34,460
more detail there

1764
01:15:34,460 --> 01:15:35,260
and then don't have

1765
01:15:35,260 --> 01:15:35,740
to worry about

1766
01:15:35,740 --> 01:15:36,580
you know

1767
01:15:36,580 --> 01:15:37,420
what that

1768
01:15:37,420 --> 01:15:38,620
like every

1769
01:15:38,620 --> 01:15:39,580
like this becoming

1770
01:15:39,580 --> 01:15:41,360
a thousand page

1771
01:15:41,360 --> 01:15:42,080
regulation

1772
01:15:42,080 --> 01:15:43,220
in the first place

1773
01:15:43,220 --> 01:15:43,520
right?

1774
01:15:43,580 --> 01:15:44,940
So but the implementing language

1775
01:15:44,940 --> 01:15:45,660
can deal with it

1776
01:15:45,660 --> 01:15:47,180
so I think

1777
01:15:47,180 --> 01:15:47,840
that there is

1778
01:15:47,840 --> 01:15:49,020
has been some more effort

1779
01:15:49,020 --> 01:15:49,940
to deal with small businesses

1780
01:15:49,940 --> 01:15:50,660
and kind of like

1781
01:15:50,660 --> 01:15:52,280
what we would consider

1782
01:15:53,660 --> 01:15:54,160
legislation language

1783
01:15:54,160 --> 01:15:55,280
and the EU

1784
01:15:55,280 --> 01:15:55,560
would consider

1785
01:15:55,560 --> 01:15:56,560
to be the implementing language

1786
01:15:56,560 --> 01:15:56,820
so.

1787
01:15:56,960 --> 01:15:57,620
Thank you.

1788
01:16:00,900 --> 01:16:02,400
Actually in the CRA

1789
01:16:02,400 --> 01:16:02,840
there is

1790
01:16:02,840 --> 01:16:04,260
in the primary legislation

1791
01:16:04,260 --> 01:16:05,340
there is direct reference

1792
01:16:05,340 --> 01:16:07,160
to small businesses

1793
01:16:07,160 --> 01:16:08,240
with certain exemptions

1794
01:16:08,240 --> 01:16:09,240
in terms of how

1795
01:16:10,020 --> 01:16:10,960
how they implement

1796
01:16:10,960 --> 01:16:12,000
but also support

1797
01:16:12,000 --> 01:16:12,800
for small businesses

1798
01:16:12,800 --> 01:16:13,460
for example

1799
01:16:13,460 --> 01:16:14,380
to engage

1800
01:16:14,380 --> 01:16:16,480
in the standardization

1801
01:16:16,480 --> 01:16:17,560
or conformity assessment

1802
01:16:17,560 --> 01:16:18,120
processes

1803
01:16:18,120 --> 01:16:18,640
or whatever

1804
01:16:18,640 --> 01:16:19,260
and giving them

1805
01:16:19,260 --> 01:16:19,580
a sort of

1806
01:16:19,580 --> 01:16:20,260
bit of a leg up.

1807
01:16:20,880 --> 01:16:21,860
The other element

1808
01:16:23,660 --> 01:16:23,780
that I think

1809
01:16:23,780 --> 01:16:24,580
it can't be ignored

1810
01:16:25,380 --> 01:16:27,420
many of the European

1811
01:16:27,420 --> 01:16:28,360
Union countries

1812
01:16:28,360 --> 01:16:30,580
are former

1813
01:16:30,580 --> 01:16:31,880
colonial powers.

1814
01:16:32,920 --> 01:16:33,600
Britain

1815
01:16:33,600 --> 01:16:34,520
well Britain

1816
01:16:34,520 --> 01:16:35,160
is no longer

1817
01:16:35,160 --> 01:16:35,620
in the EU

1818
01:16:35,620 --> 01:16:36,100
unfortunately

1819
01:16:36,500 --> 01:16:37,220
but you know

1820
01:16:37,220 --> 01:16:37,620
France

1821
01:16:37,620 --> 01:16:38,160
Germany

1822
01:16:38,160 --> 01:16:38,840
Netherlands

1823
01:16:38,840 --> 01:16:39,380
Spain

1824
01:16:39,380 --> 01:16:39,940
Portugal

1825
01:16:39,940 --> 01:16:40,600
Italy

1826
01:16:41,700 --> 01:16:42,960
little Belgium

1827
01:16:42,960 --> 01:16:44,180
where I'm a national

1828
01:16:44,180 --> 01:16:45,800
they're all former

1829
01:16:45,800 --> 01:16:46,500
colonial powers

1830
01:16:46,500 --> 01:16:46,880
and the reason

1831
01:16:46,880 --> 01:16:47,300
that's important

1832
01:16:47,300 --> 01:16:47,820
is because

1833
01:16:47,820 --> 01:16:48,800
they still have

1834
01:16:48,800 --> 01:16:50,460
strong links

1835
01:16:50,460 --> 01:16:51,440
with those former

1836
01:16:51,440 --> 01:16:52,620
former colonies

1837
01:16:52,620 --> 01:16:53,380
and those countries

1838
01:16:53,380 --> 01:16:54,640
which are now independent countries

1839
01:16:54,640 --> 01:16:55,880
and there's a very strong

1840
01:16:55,880 --> 01:16:56,640
political

1841
01:16:56,640 --> 01:16:57,540
and administrative

1842
01:16:57,540 --> 01:16:58,360
culture

1843
01:16:58,360 --> 01:16:59,600
of cooperation

1844
01:16:59,600 --> 01:17:00,700
with those countries

1845
01:17:00,700 --> 01:17:01,280
on a bilateral

1846
01:17:01,280 --> 01:17:02,660
and multilateral basis

1847
01:17:02,660 --> 01:17:03,380
and I don't think

1848
01:17:03,380 --> 01:17:04,180
that can be ignored

1849
01:17:04,180 --> 01:17:05,420
in terms of the support

1850
01:17:05,420 --> 01:17:06,800
that they can provide

1851
01:17:06,800 --> 01:17:07,660
indirectly

1852
01:17:07,660 --> 01:17:08,600
to

1853
01:17:08,600 --> 01:17:10,480
to those countries

1854
01:17:10,480 --> 01:17:10,940
through their

1855
01:17:10,940 --> 01:17:11,280
bilateral

1856
01:17:11,280 --> 01:17:12,280
efforts

1857
01:17:12,280 --> 01:17:13,380
and the final

1858
01:17:13,380 --> 01:17:13,880
element though

1859
01:17:13,880 --> 01:17:14,280
I'd mention

1860
01:17:14,280 --> 01:17:15,980
is I touched on this

1861
01:17:15,980 --> 01:17:17,200
Trade and Technology Council

1862
01:17:17,200 --> 01:17:17,880
which is sort of

1863
01:17:17,880 --> 01:17:18,400
jamboree

1864
01:17:18,400 --> 01:17:19,560
the bigwigs

1865
01:17:20,460 --> 01:17:21,720
in trade and technology policy

1866
01:17:21,720 --> 01:17:22,480
between the EU

1867
01:17:22,480 --> 01:17:22,880
and the US

1868
01:17:23,240 --> 01:17:24,240
but they have launched

1869
01:17:24,240 --> 01:17:24,720
a number of

1870
01:17:24,720 --> 01:17:26,160
small pilot projects

1871
01:17:26,160 --> 01:17:26,700
for

1872
01:17:27,440 --> 01:17:28,080
support

1873
01:17:28,080 --> 01:17:30,680
in various technology areas

1874
01:17:30,680 --> 01:17:31,080
for

1875
01:17:31,080 --> 01:17:32,340
third party countries

1876
01:17:32,340 --> 01:17:33,340
I think the current ones

1877
01:17:33,340 --> 01:17:33,980
are Senegal

1878
01:17:34,980 --> 01:17:35,620
Jamaica

1879
01:17:37,480 --> 01:17:38,540
Sierra Leone

1880
01:17:38,540 --> 01:17:39,320
and

1881
01:17:39,320 --> 01:17:40,580
there was a fourth country

1882
01:17:40,580 --> 01:17:41,400
where there are

1883
01:17:41,400 --> 01:17:42,300
particular projects

1884
01:17:42,300 --> 01:17:43,000
whether it's in

1885
01:17:43,000 --> 01:17:43,760
supporting

1886
01:17:45,120 --> 01:17:45,760
5G

1887
01:17:45,760 --> 01:17:46,800
implementation

1888
01:17:46,800 --> 01:17:48,100
in remote areas

1889
01:17:48,100 --> 01:17:48,760
to improve

1890
01:17:49,080 --> 01:17:49,740
infrastructure

1891
01:17:49,740 --> 01:17:50,200
for

1892
01:17:50,460 --> 01:17:51,700
for learning

1893
01:17:51,700 --> 01:17:52,880
and for schools

1894
01:17:53,280 --> 01:17:54,340
but coupling that

1895
01:17:54,340 --> 01:17:54,940
with cybersecurity

1896
01:17:55,700 --> 01:17:56,300
capability

1897
01:17:56,300 --> 01:17:56,820
to ensure

1898
01:17:56,820 --> 01:17:57,620
that's not going to get

1899
01:17:57,620 --> 01:17:58,160
taken over

1900
01:17:58,160 --> 01:17:59,960
by some

1901
01:17:59,960 --> 01:18:00,960
malign force

1902
01:18:00,960 --> 01:18:02,200
to undermine

1903
01:18:02,200 --> 01:18:02,980
the whole project

1904
01:18:02,980 --> 01:18:03,680
but so

1905
01:18:03,680 --> 01:18:03,940
there are

1906
01:18:03,940 --> 01:18:05,220
various avenues

1907
01:18:05,220 --> 01:18:06,700
and I would say

1908
01:18:06,700 --> 01:18:07,960
in addition to which

1909
01:18:07,960 --> 01:18:08,980
the European Union

1910
01:18:08,980 --> 01:18:09,540
treaties

1911
01:18:10,380 --> 01:18:10,680
specifically

1912
01:18:10,680 --> 01:18:11,320
have

1913
01:18:11,320 --> 01:18:11,580
a

1914
01:18:12,760 --> 01:18:13,360
provisions

1915
01:18:13,360 --> 01:18:14,680
for small businesses

1916
01:18:14,680 --> 01:18:15,540
so it's sort of

1917
01:18:15,540 --> 01:18:16,640
baked into the treaties

1918
01:18:16,640 --> 01:18:17,620
in terms of

1919
01:18:17,620 --> 01:18:18,940
how the European Union

1920
01:18:18,940 --> 01:18:19,240
works

1921
01:18:20,460 --> 01:18:20,480
I think that's

1922
01:18:20,480 --> 01:18:21,140
a really good point

1923
01:18:21,140 --> 01:18:21,340
in fact

1924
01:18:21,340 --> 01:18:22,180
and we run this

1925
01:18:22,180 --> 01:18:22,920
this group called

1926
01:18:22,920 --> 01:18:23,600
Latem CISO

1927
01:18:23,600 --> 01:18:25,280
which is made up of

1928
01:18:25,280 --> 01:18:25,940
you know

1929
01:18:25,940 --> 01:18:27,020
250 of the

1930
01:18:27,660 --> 01:18:29,000
chief information security officers

1931
01:18:29,000 --> 01:18:30,040
in Latin America

1932
01:18:30,440 --> 01:18:30,840
and

1933
01:18:30,840 --> 01:18:32,340
the annual conference

1934
01:18:32,340 --> 01:18:32,660
this year

1935
01:18:32,660 --> 01:18:33,200
is actually going to be

1936
01:18:33,200 --> 01:18:33,640
in Spain

1937
01:18:33,640 --> 01:18:35,160
and the reason for that is

1938
01:18:35,160 --> 01:18:35,680
not

1939
01:18:35,680 --> 01:18:36,580
the Spanish government

1940
01:18:36,580 --> 01:18:37,380
is excited to have it

1941
01:18:37,380 --> 01:18:38,400
but it was really Telefonica

1942
01:18:38,400 --> 01:18:39,980
that's excited to have it there

1943
01:18:39,980 --> 01:18:40,860
and it's to bring in

1944
01:18:40,860 --> 01:18:41,440
and some of these

1945
01:18:41,440 --> 01:18:42,120
are small businesses

1946
01:18:42,120 --> 01:18:43,840
they want to fly them over there

1947
01:18:43,840 --> 01:18:44,860
and they want to

1948
01:18:44,860 --> 01:18:45,380
like it's

1949
01:18:45,380 --> 01:18:46,140
it's actually not

1950
01:18:46,140 --> 01:18:46,680
the government

1951
01:18:46,680 --> 01:18:47,420
as much as

1952
01:18:47,420 --> 01:18:47,980
as

1953
01:18:48,540 --> 01:18:48,960
yeah

1954
01:18:49,380 --> 01:18:49,800
the

1955
01:18:50,240 --> 01:18:50,840
you know

1956
01:18:51,300 --> 01:18:51,720
the

1957
01:18:51,720 --> 01:18:51,900
the

1958
01:18:52,640 --> 01:18:53,460
telecommunications company

1959
01:18:53,460 --> 01:18:54,960
the large telecommunication companies

1960
01:18:54,960 --> 01:18:55,500
from some of these

1961
01:18:55,500 --> 01:18:56,660
from these

1962
01:18:56,660 --> 01:18:57,160
from the

1963
01:18:58,160 --> 01:18:58,580
former

1964
01:18:59,780 --> 01:19:00,200
colonizer

1965
01:19:00,200 --> 01:19:00,860
right

1966
01:19:00,860 --> 01:19:01,380
that is

1967
01:19:02,000 --> 01:19:03,380
engaged in working with them

1968
01:19:03,380 --> 01:19:03,720
et cetera

1969
01:19:03,720 --> 01:19:04,280
and we see that with

1970
01:19:04,280 --> 01:19:05,200
U.S. companies too

1971
01:19:05,200 --> 01:19:06,100
a lot of the U.S. companies

1972
01:19:06,100 --> 01:19:07,580
want to engage with them

1973
01:19:07,580 --> 01:19:08,420
and kind of give support

1974
01:19:08,420 --> 01:19:09,920
to some of the smaller companies there

1975
01:19:09,920 --> 01:19:10,140
and

1976
01:19:10,140 --> 01:19:11,700
get them to buy their products

1977
01:19:11,700 --> 01:19:13,220
or get the governments to

1978
01:19:13,220 --> 01:19:14,920
support them buying their products

1979
01:19:14,920 --> 01:19:15,160
so

1980
01:19:16,140 --> 01:19:16,300
I think that

1981
01:19:16,300 --> 01:19:18,120
there is something to that

1982
01:19:18,120 --> 01:19:18,340
and

1983
01:19:18,340 --> 01:19:19,800
in terms of helping boost it

1984
01:19:19,800 --> 01:19:21,140
even from the government

1985
01:19:21,140 --> 01:19:21,560
from the

1986
01:19:21,560 --> 01:19:21,940
from the

1987
01:19:22,680 --> 01:19:23,360
from the

1988
01:19:24,060 --> 01:19:25,340
from the companies

1989
01:19:25,340 --> 01:19:26,460
involved in the space

1990
01:19:26,460 --> 01:19:27,220
or the pseudo

1991
01:19:27,860 --> 01:19:29,040
in some cases

1992
01:19:29,040 --> 01:19:29,540
the pseudo

1993
01:19:29,540 --> 01:19:30,360
you know

1994
01:19:30,360 --> 01:19:31,260
when you have a telecom

1995
01:19:31,260 --> 01:19:31,760
a lot of times

1996
01:19:31,760 --> 01:19:32,040
it's a

1997
01:19:32,860 --> 01:19:33,300
joint

1998
01:19:33,300 --> 01:19:34,180
jointly run

1999
01:19:34,180 --> 01:19:34,580
so

2000
01:19:34,580 --> 01:19:34,820
yeah

2001
01:19:35,440 --> 01:19:35,880
and

2002
01:19:35,880 --> 01:19:36,820
just from my side

2003
01:19:36,820 --> 01:19:37,780
I have three points

2004
01:19:37,780 --> 01:19:37,940
on

2005
01:19:37,940 --> 01:19:38,940
thank you for the question

2006
01:19:38,940 --> 01:19:39,960
I think that

2007
01:19:40,700 --> 01:19:41,360
first of all

2008
01:19:41,360 --> 01:19:42,140
there is a clear distinction

2009
01:19:42,140 --> 01:19:42,960
between like

2010
01:19:46,140 --> 01:19:46,420
the OECD

2011
01:19:46,420 --> 01:19:47,720
and something that the OECD does

2012
01:19:47,720 --> 01:19:48,820
because of course there's

2013
01:19:48,820 --> 01:19:49,740
international organizations

2014
01:19:49,740 --> 01:19:50,820
have mandates

2015
01:19:50,820 --> 01:19:51,840
and so

2016
01:19:51,840 --> 01:19:53,260
the OECD

2017
01:19:53,260 --> 01:19:54,480
it doesn't look at

2018
01:19:54,480 --> 01:19:55,360
national security

2019
01:19:55,360 --> 01:19:55,780
because

2020
01:19:55,780 --> 01:19:57,020
there are other organizations

2021
01:19:57,020 --> 01:19:58,060
that engage on that basis

2022
01:19:58,060 --> 01:19:58,340
so

2023
01:19:58,340 --> 01:19:59,480
they work at security

2024
01:19:59,480 --> 01:20:00,700
within the digital economy

2025
01:20:00,700 --> 01:20:01,820
which is looking at vulnerabilities

2026
01:20:01,820 --> 01:20:02,620
that help to

2027
01:20:02,960 --> 01:20:03,580
if exploited

2028
01:20:03,580 --> 01:20:04,720
can underpin digital security

2029
01:20:04,720 --> 01:20:05,400
now of course

2030
01:20:05,400 --> 01:20:06,880
I recognize that there is

2031
01:20:06,880 --> 01:20:07,540
there have been diagrams

2032
01:20:07,540 --> 01:20:08,900
not two separate bubbles

2033
01:20:08,900 --> 01:20:09,620
but

2034
01:20:10,120 --> 01:20:10,480
you know

2035
01:20:10,480 --> 01:20:11,760
there is an active decision

2036
01:20:11,760 --> 01:20:12,140
to think

2037
01:20:12,140 --> 01:20:12,720
well how can we

2038
01:20:12,720 --> 01:20:13,780
how can we do that

2039
01:20:13,780 --> 01:20:14,160
and I think

2040
01:20:14,160 --> 01:20:15,900
a benefit of doing that

2041
01:20:15,900 --> 01:20:16,580
from my side

2042
01:20:16,580 --> 01:20:17,660
is that it helps to diffuse

2043
01:20:17,660 --> 01:20:18,280
the conversation

2044
01:20:18,280 --> 01:20:19,180
about transparency

2045
01:20:19,180 --> 01:20:20,120
about sharing information

2046
01:20:20,580 --> 01:20:21,220
because you can say

2047
01:20:21,220 --> 01:20:22,340
I don't care about

2048
01:20:22,340 --> 01:20:22,700
the sort of

2049
01:20:22,700 --> 01:20:23,640
the national security stuff

2050
01:20:23,640 --> 01:20:24,960
but we do need to track

2051
01:20:24,960 --> 01:20:26,520
how much you're boosting resilience

2052
01:20:26,520 --> 01:20:27,420
and a helpful way

2053
01:20:27,420 --> 01:20:28,140
to diffuse that

2054
01:20:28,140 --> 01:20:29,040
is to focus on the

2055
01:20:29,040 --> 01:20:30,340
digital security component

2056
01:20:31,160 --> 01:20:32,120
another thing

2057
01:20:32,120 --> 01:20:32,880
that I'd probably talk about

2058
01:20:32,880 --> 01:20:33,300
is the

2059
01:20:33,300 --> 01:20:34,860
the talk about smaller countries

2060
01:20:34,860 --> 01:20:35,220
again

2061
01:20:35,220 --> 01:20:37,220
the OECD has 38 member states

2062
01:20:37,620 --> 01:20:38,880
and produces recommendations

2063
01:20:38,880 --> 01:20:40,100
that are then shared with

2064
01:20:40,100 --> 01:20:40,840
and used quite often

2065
01:20:40,840 --> 01:20:41,940
by those countries

2066
01:20:41,940 --> 01:20:42,820
that are middle income

2067
01:20:42,820 --> 01:20:43,540
and also

2068
01:20:43,780 --> 01:20:44,280
section countries

2069
01:20:44,280 --> 01:20:45,320
so like the Brazils

2070
01:20:45,320 --> 01:20:45,820
of this world

2071
01:20:45,820 --> 01:20:46,940
and which

2072
01:20:46,940 --> 01:20:47,780
who are sort of

2073
01:20:47,780 --> 01:20:48,260
looking to

2074
01:20:48,260 --> 01:20:49,200
the outputs

2075
01:20:49,200 --> 01:20:50,060
from those organizations

2076
01:20:50,060 --> 01:20:50,740
and saying

2077
01:20:50,740 --> 01:20:51,480
well how can we look

2078
01:20:51,480 --> 01:20:52,240
to use these as

2079
01:20:52,240 --> 01:20:53,160
as starters

2080
01:20:53,160 --> 01:20:53,600
for the

2081
01:20:53,600 --> 01:20:55,060
how we look to introduce policies

2082
01:20:56,300 --> 01:20:57,440
on a sort of

2083
01:20:57,440 --> 01:20:58,020
purely very

2084
01:20:58,020 --> 01:20:58,380
sort of

2085
01:20:58,380 --> 01:20:59,640
very specific point

2086
01:20:59,640 --> 01:21:01,060
on IoT security

2087
01:21:01,060 --> 01:21:02,440
when the UK government

2088
01:21:02,440 --> 01:21:02,840
introduced

2089
01:21:02,840 --> 01:21:04,360
the product security

2090
01:21:04,360 --> 01:21:05,040
telecommunications

2091
01:21:05,040 --> 01:21:05,980
infrastructure act

2092
01:21:05,980 --> 01:21:07,360
prior to doing so

2093
01:21:07,360 --> 01:21:07,980
we placed

2094
01:21:07,980 --> 01:21:08,620
we actually

2095
01:21:08,620 --> 01:21:09,820
created a grant scheme

2096
01:21:09,820 --> 01:21:11,000
which was supporting

2097
01:21:11,000 --> 01:21:11,720
businesses

2098
01:21:13,780 --> 01:21:13,860
to look at

2099
01:21:13,860 --> 01:21:14,240
minimum requirements

2100
01:21:14,240 --> 01:21:14,960
and actually to

2101
01:21:14,960 --> 01:21:16,800
to look at how they can implement

2102
01:21:16,800 --> 01:21:18,160
the better security practices

2103
01:21:18,160 --> 01:21:18,980
within their products

2104
01:21:18,980 --> 01:21:20,360
and because we recognized

2105
01:21:20,360 --> 01:21:21,300
that like actually

2106
01:21:21,300 --> 01:21:23,080
there was the optimistic viewpoint

2107
01:21:23,080 --> 01:21:24,320
that most manufacturers

2108
01:21:24,320 --> 01:21:25,500
wanted to do good

2109
01:21:25,500 --> 01:21:26,440
but maybe just didn't know how

2110
01:21:26,440 --> 01:21:28,000
so we created a grant

2111
01:21:28,000 --> 01:21:28,420
a grant

2112
01:21:28,420 --> 01:21:30,060
which supported the development

2113
01:21:30,060 --> 01:21:30,780
of assurance schemes

2114
01:21:30,780 --> 01:21:32,040
across connected televisions

2115
01:21:32,040 --> 01:21:34,420
and also smart connected toys

2116
01:21:34,420 --> 01:21:35,840
because that's a bit more emotive

2117
01:21:35,840 --> 01:21:36,720
and also

2118
01:21:36,720 --> 01:21:39,480
just a self-assessment framework

2119
01:21:39,480 --> 01:21:41,360
that manufacturers could then use

2120
01:21:41,360 --> 01:21:42,340
and that then came with

2121
01:21:42,340 --> 01:21:42,940
the free training

2122
01:21:42,940 --> 01:21:43,480
that was available

2123
01:21:43,480 --> 01:21:45,380
so it's not like

2124
01:21:45,380 --> 01:21:46,120
a perfect solution

2125
01:21:46,120 --> 01:21:46,840
but it was something

2126
01:21:46,840 --> 01:21:47,360
which government

2127
01:21:47,360 --> 01:21:47,580
you know

2128
01:21:47,580 --> 01:21:48,360
helpful to prioritize

2129
01:21:48,360 --> 01:21:49,140
thinking through

2130
01:21:49,140 --> 01:21:50,340
how are you making sure

2131
01:21:50,340 --> 01:21:51,060
that you're not

2132
01:21:51,060 --> 01:21:51,360
you know

2133
01:21:51,360 --> 01:21:52,920
you're balancing the carrot and stick

2134
01:21:52,920 --> 01:21:54,100
so supporting manufacturers

2135
01:21:54,100 --> 01:21:55,140
particularly those

2136
01:21:55,140 --> 01:21:55,840
at the smaller end

2137
01:21:55,840 --> 01:21:57,260
where you do want to generate

2138
01:21:57,260 --> 01:21:57,820
the innovation

2139
01:21:57,820 --> 01:21:58,840
and I think you know

2140
01:21:58,840 --> 01:22:00,120
UK's use of ARIA

2141
01:22:00,120 --> 01:22:00,640
is a really

2142
01:22:00,640 --> 01:22:01,640
it's a great example

2143
01:22:01,640 --> 01:22:02,180
of you know

2144
01:22:02,180 --> 01:22:03,260
taking the model from DARPA

2145
01:22:03,260 --> 01:22:04,580
and looking to how we can amplify it

2146
01:22:04,580 --> 01:22:05,040
you know

2147
01:22:05,040 --> 01:22:05,780
it's a really helpful scheme

2148
01:22:05,780 --> 01:22:06,280
there as well

2149
01:22:06,280 --> 01:22:07,680
so thank you for the question

2150
01:22:08,120 --> 01:22:08,840
any other points

2151
01:22:14,300 --> 01:22:15,940
thank you all for doing this panel

2152
01:22:15,940 --> 01:22:16,780
I know most of you

2153
01:22:16,780 --> 01:22:18,920
as a former U.S. government

2154
01:22:18,920 --> 01:22:19,680
of cyber officials

2155
01:22:19,680 --> 01:22:20,460
it's really great to hear

2156
01:22:20,460 --> 01:22:21,980
how much commonality there is

2157
01:22:21,980 --> 01:22:22,460
in the approaches

2158
01:22:22,460 --> 01:22:23,460
that your governments are taking

2159
01:22:23,460 --> 01:22:24,360
but you know

2160
01:22:24,360 --> 01:22:25,620
as we see increasingly malicious

2161
01:22:25,620 --> 01:22:27,620
authoritarian cyber attacks

2162
01:22:27,620 --> 01:22:28,880
by authoritarian governments

2163
01:22:28,880 --> 01:22:31,980
and increasingly debilitating

2164
01:22:32,440 --> 01:22:33,080
ransomware attacks

2165
01:22:33,080 --> 01:22:33,940
the private sector

2166
01:22:33,940 --> 01:22:34,800
plays a key role

2167
01:22:34,800 --> 01:22:36,140
developing new capabilities

2168
01:22:36,140 --> 01:22:37,440
we have new programs

2169
01:22:37,440 --> 01:22:38,940
like bug bounties

2170
01:22:38,940 --> 01:22:40,000
that help get at

2171
01:22:40,000 --> 01:22:40,420
you know

2172
01:22:40,420 --> 01:22:41,240
identifying vulnerabilities

2173
01:22:41,880 --> 01:22:42,320
and so

2174
01:22:42,340 --> 01:22:43,220
as you look to the future

2175
01:22:43,220 --> 01:22:44,240
what do you think

2176
01:22:44,240 --> 01:22:45,720
what are you most optimistic about

2177
01:22:45,720 --> 01:22:46,620
in the way

2178
01:22:46,620 --> 01:22:47,420
that the private sector

2179
01:22:47,420 --> 01:22:48,020
can assist

2180
01:22:48,020 --> 01:22:49,280
in doing cyber security

2181
01:22:49,280 --> 01:22:50,460
because we've talked a lot

2182
01:22:50,460 --> 01:22:51,380
about what governments can do

2183
01:22:51,380 --> 01:22:52,020
you know

2184
01:22:52,020 --> 01:22:53,580
cyber security strategies

2185
01:22:53,580 --> 01:22:54,880
workforce development

2186
01:22:54,880 --> 01:22:55,860
but what are the things

2187
01:22:55,860 --> 01:22:56,500
that you really want

2188
01:22:56,500 --> 01:22:57,460
the private sector to

2189
01:22:57,460 --> 01:22:58,360
you know

2190
01:22:58,360 --> 01:22:58,880
launch on

2191
01:22:58,880 --> 01:22:59,560
that can really help

2192
01:22:59,560 --> 01:23:00,060
the governments

2193
01:23:00,060 --> 01:23:01,100
protect their citizens

2194
01:23:01,100 --> 01:23:01,920
thanks

2195
01:23:04,320 --> 01:23:05,200
I mean Brian

2196
01:23:05,200 --> 01:23:05,860
you talked about

2197
01:23:05,860 --> 01:23:06,920
how this is

2198
01:23:06,920 --> 01:23:07,580
everyone's

2199
01:23:07,580 --> 01:23:08,380
getting this together

2200
01:23:08,380 --> 01:23:09,540
I think that's totally true

2201
01:23:09,540 --> 01:23:09,920
and that

2202
01:23:09,920 --> 01:23:11,800
that we have seen

2203
01:23:12,980 --> 01:23:13,640
you know

2204
01:23:13,640 --> 01:23:14,000
the

2205
01:23:15,360 --> 01:23:17,120
there is the kind of

2206
01:23:17,120 --> 01:23:18,120
well we need

2207
01:23:18,820 --> 01:23:20,040
companies to do better

2208
01:23:20,040 --> 01:23:20,700
in terms of

2209
01:23:21,400 --> 01:23:22,380
securing their code

2210
01:23:22,380 --> 01:23:22,640
etc

2211
01:23:22,640 --> 01:23:23,380
but also

2212
01:23:23,380 --> 01:23:24,600
I do think that

2213
01:23:24,600 --> 01:23:25,940
the companies

2214
01:23:25,940 --> 01:23:26,340
are the ones

2215
01:23:26,340 --> 01:23:26,680
that come up

2216
01:23:26,680 --> 01:23:27,260
with the solutions

2217
01:23:27,260 --> 01:23:27,880
right

2218
01:23:27,880 --> 01:23:28,240
I mean

2219
01:23:28,240 --> 01:23:28,700
most of the

2220
01:23:28,700 --> 01:23:30,160
solutions in this space

2221
01:23:30,160 --> 01:23:30,980
don't come from

2222
01:23:32,460 --> 01:23:32,940
governments

2223
01:23:32,940 --> 01:23:33,460
that say

2224
01:23:33,460 --> 01:23:34,240
oh here's

2225
01:23:34,240 --> 01:23:35,380
here's how we can

2226
01:23:35,380 --> 01:23:36,200
here's what we need

2227
01:23:36,200 --> 01:23:36,560
to implement

2228
01:23:36,560 --> 01:23:37,780
in order to make this happen

2229
01:23:37,780 --> 01:23:38,020
I mean

2230
01:23:38,020 --> 01:23:38,580
look at

2231
01:23:39,180 --> 01:23:39,660
even

2232
01:23:40,220 --> 01:23:40,700
CSRB

2233
01:23:41,800 --> 01:23:41,920
this new

2234
01:23:42,560 --> 01:23:42,920
report

2235
01:23:42,920 --> 01:23:43,860
the cybersecurity

2236
01:23:43,860 --> 01:23:44,540
review board

2237
01:23:44,540 --> 01:23:45,620
on the lapsus

2238
01:23:45,620 --> 01:23:46,820
the first thing on there

2239
01:23:46,820 --> 01:23:47,440
is FIDO

2240
01:23:47,440 --> 01:23:47,880
right

2241
01:23:47,880 --> 01:23:49,720
governments didn't

2242
01:23:49,720 --> 01:23:51,080
create FIDO

2243
01:23:51,080 --> 01:23:52,400
companies created FIDO

2244
01:23:52,400 --> 01:23:53,340
it's a standard

2245
01:23:53,340 --> 01:23:54,080
that then

2246
01:23:54,080 --> 01:23:54,660
is implemented

2247
01:23:54,660 --> 01:23:55,340
by companies

2248
01:23:55,340 --> 01:23:55,640
so

2249
01:23:55,640 --> 01:23:56,200
I mean

2250
01:23:56,200 --> 01:23:57,020
almost every solution

2251
01:23:57,020 --> 01:23:58,080
comes out of

2252
01:23:58,080 --> 01:23:58,660
you know

2253
01:23:59,600 --> 01:24:01,140
companies coming together

2254
01:24:01,140 --> 01:24:02,580
addressing an issue

2255
01:24:03,460 --> 01:24:04,100
you know

2256
01:24:04,100 --> 01:24:04,580
and then

2257
01:24:04,580 --> 01:24:05,580
that leads to

2258
01:24:05,580 --> 01:24:06,740
it being standardized

2259
01:24:06,740 --> 01:24:07,380
and then

2260
01:24:07,380 --> 01:24:08,440
you kind of

2261
01:24:08,440 --> 01:24:09,320
have the policies

2262
01:24:09,320 --> 01:24:09,960
that come over

2263
01:24:11,800 --> 01:24:12,260
there's a standard

2264
01:24:12,260 --> 01:24:13,200
out there to do it

2265
01:24:13,700 --> 01:24:15,100
which is one of the reasons

2266
01:24:15,100 --> 01:24:15,940
I think there is

2267
01:24:15,940 --> 01:24:16,580
some frustration

2268
01:24:16,580 --> 01:24:17,600
from the way

2269
01:24:17,600 --> 01:24:18,100
that Europe

2270
01:24:18,100 --> 01:24:19,080
basically says

2271
01:24:19,080 --> 01:24:19,540
well

2272
01:24:19,540 --> 01:24:20,840
we need to come up

2273
01:24:20,840 --> 01:24:22,000
with a European standard first

2274
01:24:22,000 --> 01:24:22,300
well

2275
01:24:22,300 --> 01:24:23,160
the reason you know

2276
01:24:23,160 --> 01:24:23,800
it's a problem

2277
01:24:23,800 --> 01:24:24,380
is because

2278
01:24:24,380 --> 01:24:25,320
there was a standard

2279
01:24:25,320 --> 01:24:26,160
out there already

2280
01:24:26,160 --> 01:24:27,160
and people aren't

2281
01:24:27,160 --> 01:24:27,840
implementing it

2282
01:24:27,840 --> 01:24:28,360
not because

2283
01:24:28,360 --> 01:24:29,220
we need a new

2284
01:24:29,220 --> 01:24:30,240
European standard

2285
01:24:30,240 --> 01:24:30,720
right

2286
01:24:31,380 --> 01:24:32,520
so I think

2287
01:24:32,520 --> 01:24:32,740
that

2288
01:24:32,740 --> 01:24:34,760
that is exactly

2289
01:24:34,760 --> 01:24:35,860
the kind of

2290
01:24:35,860 --> 01:24:36,000
like

2291
01:24:36,000 --> 01:24:37,280
we need to

2292
01:24:37,280 --> 01:24:38,000
be able to get

2293
01:24:38,000 --> 01:24:38,780
these standards

2294
01:24:38,780 --> 01:24:39,860
we need to get

2295
01:24:39,860 --> 01:24:40,580
that structure

2296
01:24:40,580 --> 01:24:41,060
from

2297
01:24:41,680 --> 01:24:42,880
okay we have a solution

2298
01:24:42,880 --> 01:24:44,160
and we need to

2299
01:24:44,160 --> 01:24:45,100
standardize the solution

2300
01:24:45,100 --> 01:24:46,260
we need to

2301
01:24:46,260 --> 01:24:47,580
internationalize that

2302
01:24:47,580 --> 01:24:48,080
and we have to

2303
01:24:48,080 --> 01:24:48,460
get governments

2304
01:24:48,460 --> 01:24:49,140
to accept that

2305
01:24:49,140 --> 01:24:50,260
happen faster

2306
01:24:50,260 --> 01:24:51,700
than it does today

2307
01:24:52,280 --> 01:24:53,060
but it's getting

2308
01:24:53,060 --> 01:24:53,740
it is already

2309
01:24:53,740 --> 01:24:54,440
pretty efficient

2310
01:24:54,440 --> 01:24:55,540
of a system

2311
01:24:56,100 --> 01:24:56,900
if we can get

2312
01:24:57,440 --> 01:24:57,960
people

2313
01:24:57,960 --> 01:24:59,140
the problem is more

2314
01:24:59,140 --> 01:25:00,280
getting the people

2315
01:25:00,280 --> 01:25:01,180
to actually implement it

2316
01:25:01,180 --> 01:25:01,460
or

2317
01:25:02,080 --> 01:25:02,500
you know

2318
01:25:02,500 --> 01:25:03,460
creating the structure

2319
01:25:03,460 --> 01:25:04,260
in which people

2320
01:25:04,260 --> 01:25:05,500
are forced to implement it

2321
01:25:06,160 --> 01:25:06,420
so

2322
01:25:10,960 --> 01:25:11,980
we need to

2323
01:25:11,980 --> 01:25:12,160
try and

2324
01:25:12,160 --> 01:25:12,280
you know

2325
01:25:12,280 --> 01:25:12,700
together

2326
01:25:12,700 --> 01:25:13,460
well this is

2327
01:25:13,460 --> 01:25:13,780
you know

2328
01:25:13,780 --> 01:25:14,100
this is

2329
01:25:14,100 --> 01:25:15,420
we have to work hand in blood

2330
01:25:15,420 --> 01:25:15,680
from

2331
01:25:15,680 --> 01:25:16,420
in the UK

2332
01:25:16,420 --> 01:25:17,400
we have lots of initiatives

2333
01:25:17,400 --> 01:25:18,780
like public private partnerships

2334
01:25:18,780 --> 01:25:19,220
it's obviously

2335
01:25:19,760 --> 01:25:20,760
a buzz word

2336
01:25:20,760 --> 01:25:21,100
of today

2337
01:25:21,100 --> 01:25:21,520
but

2338
01:25:21,520 --> 01:25:22,320
in the industry

2339
01:25:22,320 --> 01:25:23,040
100 program

2340
01:25:23,040 --> 01:25:23,560
we have

2341
01:25:23,560 --> 01:25:24,200
the information

2342
01:25:24,200 --> 01:25:24,580
exchanges

2343
01:25:24,580 --> 01:25:25,160
we have

2344
01:25:25,160 --> 01:25:25,680
with our critical

2345
01:25:25,680 --> 01:25:26,840
national infrastructure partners

2346
01:25:26,840 --> 01:25:28,380
the charity sector

2347
01:25:28,380 --> 01:25:28,800
of academia

2348
01:25:29,940 --> 01:25:30,620
it's everything

2349
01:25:37,280 --> 01:25:41,520
you know you want to do you know obviously you've got your day jobs as well and it's we

2350
01:25:41,520 --> 01:25:44,520
just need to make it really clear and as actionable for you as possible

2351
01:25:49,240 --> 01:25:53,860
thanks for the question rob um yeah probably a bit more difficult from a european union

2352
01:25:53,860 --> 01:25:59,180
perspective we're the ones who you always always seen as sort of taking a sort of sledgehammer

2353
01:25:59,180 --> 01:26:08,640
approach to to industry um innovation uh we you know there's a lot to talk about so you know

2354
01:26:08,640 --> 01:26:12,320
there's innovation there's regulation and they're opposed to each other you can't innovate if there's

2355
01:26:12,320 --> 01:26:21,320
too much regulation you can't i think it's a bit of a bs uh dichotomy um the famous phrase what is

2356
01:26:21,320 --> 01:26:28,020
it um you know necessity necessity is the mother of invention um when gdpr was being discussed

2357
01:26:28,020 --> 01:26:29,160
we had a lot of discussion about how we could do something about it and i think it's a bit

2358
01:26:29,160 --> 01:26:33,000
a lot of pushback a lot of pushback say oh this isn't possible nobody can do with this do this

2359
01:26:33,000 --> 01:26:37,400
and the very cynical amongst the the parliament at the time sort of said

2360
01:26:37,980 --> 01:26:43,020
you innovate you you're always claiming you can innovate go innovate go find a new model instead

2361
01:26:43,020 --> 01:26:48,300
of just sort of pimping off um people's private data in order to make your money go find another

2362
01:26:48,300 --> 01:26:54,120
way of of making money and people did innovate and we now have very thriving business around

2363
01:26:54,120 --> 01:26:58,320
privacy protection and a lot of businesses have made a lot of money out of that

2364
01:26:58,320 --> 01:26:59,060
um

2365
01:26:59,160 --> 01:27:05,820
so i think there is i mean that's that's one extreme uh view personally i don't necessarily

2366
01:27:05,820 --> 01:27:13,440
share that um but i think innovation um has to there has to be incentives and i think to say

2367
01:27:13,440 --> 01:27:17,220
you know necessity is the mother invention go out and innovate so that's that's fine in practice

2368
01:27:17,220 --> 01:27:22,900
but if you're in an environment where innovation is rewarded and that's clearly the sort of u.s

2369
01:27:22,900 --> 01:27:28,600
sort of free market model which which it makes uh it very very attractive then

2370
01:27:29,900 --> 01:27:34,060
europeans shouldn't be so surprised that some of that innovation moves to the u.s i mean

2371
01:27:35,380 --> 01:27:42,580
uk france germany we have thriving i.t infrastructure industries or whatever through the 50s 60s and 70s

2372
01:27:43,100 --> 01:27:48,880
we didn't innovate in though and we didn't invest in those and today those a lot of those

2373
01:27:48,880 --> 01:27:54,220
industries have have drifted away so i think there's a more fundamental problem in terms of

2374
01:27:54,220 --> 01:27:59,140
providing the incentives to industry to be able to come up with the sort of responses you need to have

2375
01:27:59,160 --> 01:28:05,440
talking about and i think that that imbalance between the innovation response and the incentives

2376
01:28:05,440 --> 01:28:10,260
i think is the core issue i don't have a magic wand i don't have any obvious solution for that

2377
01:28:10,260 --> 01:28:17,320
but i think that's where the that's where the real problem lies uh so sorry three points from me

2378
01:28:17,320 --> 01:28:23,720
so i think that i'm most optimistic about uh the manner in which we're moving towards a more

2379
01:28:23,720 --> 01:28:29,100
collaborative environment with um industry on on threat sharing and threat blocking and it's so

2380
01:28:29,160 --> 01:28:34,200
certainly the jcd construct here while still nascent i think is something that we're looking at

2381
01:28:34,200 --> 01:28:39,280
very closely in australia and see if we can triage that to work within the five eyes to do something

2382
01:28:39,280 --> 01:28:45,580
similar the other element to the innovation point is around building sovereign capability with the

2383
01:28:45,580 --> 01:28:49,960
australian government where there are incentives to do so and then also potentially working with

2384
01:28:49,960 --> 01:28:57,840
the within the august framework to develop those those high-end technologies that we will all need

2385
01:28:57,840 --> 01:28:59,140
for the competition that's coming and i think that's where we're going and i think that's where we're going

2386
01:28:59,160 --> 01:29:05,580
the last point and to that um that issue as well is working with the quad partners and the ability

2387
01:29:05,580 --> 01:29:11,420
to bring industry into the into the dialogue there because the quad which is india japan australia

2388
01:29:11,420 --> 01:29:17,860
and the united states has a huge economic uh heft behind it 28 of the world's gdp sits within that

2389
01:29:17,860 --> 01:29:23,140
those four countries so the ability to shape and set standards is will be pivotal through that

2390
01:29:23,140 --> 01:29:26,020
bringing industry into that conversation is crucial

2391
01:29:27,800 --> 01:29:29,080
and actually thank you

2392
01:29:29,160 --> 01:29:33,020
all very much for the questions um and today also thank you very much for our panel

2393
01:29:33,020 --> 01:29:37,040
um so thank you ari thank you brian you thank you peter and thank you adam and thank you all

2394
01:29:37,040 --> 01:29:41,900
for joining um we will be around and round and available um for some time if you'd like to have

2395
01:29:41,900 --> 01:29:45,900
some conversations uh following the panel and thank you very much and enjoy the rest of your day