foreign
[Music]
we're going to start another talk so we
have our
Professor Walter C so
Paul Works in areas around cyber
security
concluding governancy risk and
compliance reducing harm online reducing
fraud and scam as well as teaching
Online skills today Paul will talk about
the recent speed of data bridges in
Australia
and how a more transparent culture would
improve our response please welcome
you can clap that's actually okay
thank you for that introduction
um
so before I kind of start my side deck
and I actually really hate PowerPoint
but I feel like I should have a
PowerPoint
um
I'm just gonna
I'm gonna just show something and
briefly and very selectively read it off
is that showing or not no
okay well
I'm just going to read it
and not show it perhaps
um
so this is
how has everybody here heard of the
Optus data breach
yeah okay okay okay
so immediately 10 seconds in you can see
where the talk is heading right so I'm
just going to read off a Verbatim quote
from the Optus CEO and this is a channel
9 news report which is entitled no
victims of crime or financial fraud due
to Optus cyber attacks CEO says
uh and so I'm I'm not going to put words
in their mouth right I'm just going to
read off what uh what they said
and I think just listen really carefully
to this
given how inevitable these types of
attacks are
I'm relieved we were able to act fast to
ensure that ultimately the data that was
exposed was not successfully used to
harm any customers
do I need to read it again or is that
and
I I she has not finished
um
just to Double Down
not a single customer has suffered any
Financial loss or Fallen victim to a
crime through misuse of the data
this outcome should reassure all of us
about what a strong and fast and
collaborative response
can achieve
and most importantly and relating back
to the theme of
this presentation sorry I I paused
because I I really can't believe what
I'm reading sometimes but we were being
transparent open and honest good
we were apologetic and accountable
good
I used four of those words in my
presentation which is great
and finally we did more than any other
company in a Cyber attack before had
done and we did it much quicker
oh it's okay to love I mean I I
and look I'm not um I should be upfront
and honest and say I'm not picking on
any company in particular but
I feel personally quite Disturbed
reading that from someone who was
legally
responsible and had been given a special
license to hold the personal and
confidential data of many of us
um
and it then just does lead me to this
broader question around
sorry
are we doing things right
and are we doing the right thing
nationally in terms of cyber policy and
I'll drill down into a little bit more
detail
in this presentation and touch on I
think some of the things that I come
across
in my day job which uh you know I do
everything from working with you know
corporate clients uh through to quite a
number of Charities and organizations in
the not-for-profit sector
and uh
I just want to kind of provide a bit of
a reflection on that and also to
encourage people to you know if you feel
as outraged as I am about what you just
heard
so get involved in things like the
cyber policy and strategy review that's
coming up the government is currently
calling for submissions
so
you know if we sit back and no one says
anything and we just accept that
standard that we all walk past which is
what we just heard
then government policy will never change
and if government policy doesn't change
then there's
very little that will then trickle down
into those really important areas of
personal data that are held Now by many
organizations
and I'll talk about my experiences uh
with that shortly so
firstly and I would love to pick the
brains of the audience about you know
what is driving this
absolute rash of data breaches at the
moment I wrote a little research paper
about nine years ago where I calculated
the cost of a data breach in Australia
at the time which was about two million
dollars
we did a lot of calculations like
with the Telco company involved wasn't
Optus by the way
um
you know what was the cost of trying to
do password resets I think that at 80
000 of them through their Philippines
call center so we did quite a bit of
detailed modeling work
it was costly
there was an initial stock market
reaction but then within a month and
this is something that we see time and
time again it's a it's a paradoxical
outcome but there's like often a bit of
short-term Market pain but then I think
the executive team think hang on if we
just hold on
people will forget the market has no
memory Beyond a week or so so we'll get
there don't panic
and then then we'll go and do an
interview and we'll say actually what we
did was grade and everything's cool and
no one needs to worry no Panic
and then what changes so it's about how
I think for me the challenge that we all
face is how do we create that momentum
for a change that will really ensure
that people who hold
very special officers like being a
company director and sit on a board
how do we make them really sensitized to
the significant responsibilities that
they have
and you know to be honest I I did a
whole series of sessions a few years ago
with the aicd and we traveled around
Victoria and um
you know we kind of start the
presentation with well who knows
anything about cyber security and these
are all directors and you know I mean
the level of knowledge was relatively
low
uncomfortably low
some councils I think up in Aubry they
actually it was almost the opposite they
had this crack team that would go onto
social media and identify graffiti tags
and then like pass the information on
the police I'm like
guys you've got it you know um
so what are we doing at the national
level well every four years for the past
10 years or so we've had this cyber
security strategy which has come out
um
when the new government came in last
year they said
scrap that we're going to start again
[Music]
and then some of the people on the new
panel are actually identical to the
people on the old panel and if you do a
top level heading comparison between the
new consultation paper and the previous
two strategies
there's a fair bit of overlap I think
it's fair to say so fresh thinking the
only way we're going to get it is if we
actually speak up and say something so
again I encourage you again we are going
to um
as a company we are going to not just
put it as a submission in we're going to
release it as well and get the
conversation going so by all means don't
agree with what we say please put in
your own and I think it is really really
critical for government to hear many
many voices on these really important
issues
I think related to the data breach you
know issue is it's really around what
are we trying to protect you know what
are the goals with the Cyber program
how do we go through a process of
working out what we should be focusing
on and what we can not worry about
um
and you know I think what I see in some
of my work is that there's
outside of the sort of specialist cyber
area particularly in ICT there's often a
a real lack of awareness of what people
on the Cyber side of things are actually
doing
um apart from paying thousands of
dollars for certifications uh several
times a year not me by the way I'm not a
big believer but um many people do
and you know really drilling down and
saying are we spending money in the
right places and are we spending it on
the things that really matter and to my
mind it's really the data that is held
about us as people which is really what
we should be focusing on
um there's a heck a lot heck a lot of
throwaway data out there that we
probably should never worry about
and you know in an age of social media
where people routinely disclose stuff
about themselves you know what is that
balance
and the consequential obligation on
corporations to then identify and work
out what they should be protecting so
I'm not saying it's easy but
I do think that there's a certain level
of
naivety
about the goals of a cyber program
and it's something that you know
sometimes
you know there's a requirement for
people to put in place a cyber program
so
I'm working with a company at the moment
who work with defense and so as part of
their engagement they have to achieve a
certain status with defense and uh at
the end of the day they kind of got no
choice because they thought when I keep
the contract going forward they have to
comply
but lots of companies I mean yeah we've
got the Privacy Act and other things but
we don't really sort of have this
overarching
set of legislation or regulation that
says this is specifically your
obligations about cyber security and I
think that is very confusing for
companies
and I think related to pursuing those
security goals is you know what are the
values I mean
and I mean really our national values
that we hold about data
I had a bit of a brainstorm and it took
me about 30 seconds and I thought these
were kind of the five that really jumped
out at me
um
particularly things like fairness
[Music]
and and openness but you know
I guess a lot of things around cyber
tend to be very secretive by their
nature but
sometimes I think unnecessarily so and
I'll come to an example later on but I
talk about
I don't know people who want to
standardize and say yep I'm compliant
with a standard well hang on to even
look at the standard you have to pay a
license fee and before you even know
what you're looking at and so we kind of
come back I think in some ways to the
whole uh open source movement I've got
to say in in my kind of thinking so if
you
if you have a very narrow kind of closed
private
fee paying standards committee versus
one which reflects the views of the
community
I think
looking back at my first question this
is definitely one of the issues that's
driving data breaches okay
so and hopefully you know by the end
people might have reflected on what
their values are and what our value
should be around data as a nation
so hopefully I'm going to sketch out
some of those kind of ways forward
yeah actually I did this little screen
mock-up before we had the the quote from
the Optus CEO so um
but I think it does you know
yeah look
I don't know
I don't know what to say really I mean
it's it's kind of shocking to me but um
but let me move on to something which I
do want to talk about so was anyone here
affected by the Optus data breach
yep a few yeah okay well now we come to
the one that I was affected by
which is
medibank
okay so let me tell you a bit of ancient
history
um
back in about 2001 when I was a
government employee I signed up for this
thing called the government employees
health fund
uh which uh at some point I stopped
being a member of and then medibank
took them over and I ceased my
membership in 2009 I actually went back
and checked my email
and the reason I went back and checked
my email is I got this message from
medibank saying oops sorry we just lost
your data and uh I had never actually
been a medibank customer and even for
the corporate entity
I hadn't been involved with them for 13
years
so I'm kind of left thinking
who made the decision to
put my data on the Internet or make it
accessible for an attacker in such an
easy way
when I hadn't even been a damn customer
for 13 years so
um again I mean really raises basic
questions around
who in a company decides what data is
collected under what conditions where is
it stored what are the protections
what are the proportional protections
for
different classifications of data within
the organization how long is data
retained when is it thrown away how is
it thrown away and so on and so forth I
mean these it seems to me this is a
really basic set of questions but I'm
sure if I went to most companies and
said who makes that call
there'd be multiple people pointing
their fingers at each other
CIO saying well it's a CTO that's like I
don't know a librarian or that's an I.T
problem
it's as well it's probably a cyber thing
so and they'll say well maybe it's a
compliance function let's ask the
lawyers and sometimes yeah I mean this
stuff just goes around and around and
the longer it goes around and around
when the Tire hits the gravel and you
get a breach then this is kind of
what we're left with so yes this is
definitely my impression that we've got
this safe and everything's safe but
maybe it just didn't really turn out
like that so
I've actually joined one of the two
class actions that's being launched
against medibank I certainly don't
expect a million dollars
um
but you know there's I guess given the
the data that can be used to
assume my identity and then to go on to
commit fraud I mean for 10 million
customers
I've got to say to my mind this is
probably the most significant national
issue in cyber we've ever faced
and I don't think the understanding is
still there yet
think both in the corporate sector and
government about what the risks are with
effectively half the population being up
for identity theft from just one attack
so it is really really significant
um
and quite worrying
um
but if I get a million bucks I'll I'll
be thankful to you all for your support
so the discussion paper that has come
out
um again these are kind of the top level
headings
none of which
are bad
I've got to say
public private mechanisms and
Partnerships threat sharing wonderful
building the skills and talent pipeline
it's been in the last two strategies so
I have myself been heavily involved in
some of those
initiatives particularly through the off
cyber project fund I worked with
a little organization called genius
Armory where we try to create training
materials to encourage people on the
autism spectrum to get involved in cyber
um
that is free by the way if you know
anyone who might be interested please
jump on and register them get them
involved
we actually have a national skills
crisis in cyber for those of you who try
and hybrid hire cyber people from time
to time you'll know what I'm talking
about
um
and we have something like a a 30 annual
churn rate in cyber teams
which is just
I
don't I won't talk about that today
because it's very frustrating but you
know absolutely you want to support this
kind of stuff
National Frameworks well we have the
essential eight
do we need the essential 16 or coverage
issues International Frameworks like
nist or is that just a US Government one
or
ISO 27 000 oh hang on it will cost you
120 bucks anyway let's not go there I'll
come back to that
you know investing in the ecosystem
I just love this stuff
but there's a big problem
and I I kind of I challenge myself I
read the thing and I thought
you know I read this and I just feel
really warm and fuzzy inside
but I then went through with my little
fine function and I said okay I'm going
to do a bit of a frequency count how
many times does it mention the word
firewall in this document
zero
anything to do with endpoints
socks
I don't know AV products
zero
any mention of any operating system at
all
nothing
what about the operational side teams
red teams blue teams nope completely
silent
and
give it I think some of the discussion
last week about should we reintroduce
the Australia card and Link every
government service together again and
that's going to be the solution to all
this stuff and make it go away and
National centralized identity management
not a mention in the discussion paper
so
I don't know about you but
when I read a strategy that
is disconnected from the implementation
so radically and completely ignores it
I
how can I say it nicely
there's a there's a gap let me let me
just I was going to say something rude
but I'll just say that there's a gap
there's a gap I think between what
people in this room would understand the
actuality of protecting data to be
versus the the idealization from the
panel at this stage so
please please please please set them
straight send them a one word submission
to say where is the firewall question
mark or
where is the cryptography or you know
where is
the compliance Frameworks where's
legislation you know
but unfortunately uh I might be
disappointed with it I mean it really um
but it's not finalized right so it's the
consultation paper we can change this
so the thing about data is that you know
data is important to all of us but
you know it has a market value people
are buying and selling data because data
can be used for identity theft and
identity fraud as I mentioned before so
unfortunately where you've got something
there that is so easy to steal
um
the Temptation is very high and with the
lack of concrete mechanisms to bring
people to Justice who actually steal
this stuff
um
you know we've we've got to do two
things we've either got to try and you
know reduce the value of that data
somehow or just make it really hard to
get in the first place
um
now if there's one thing I've learned
over many years in working with
companies in cyber
it's pretty rare that I go into a
company and they say
you just we'll give you a blank check
you just tell us what the cost is and
we'll just do it you know
um
typically it's you know it's just
um
it's more like this is on the cost side
of the business our quarterly profit
results are coming up uh what's it going
to cost us
because then we have to remake that that
money again
um
in the charitable space and and this is
where yeah honestly I do get a bit uh
heartbroken at times
um
you know I did an assessment last year
and you know we've talked about costs
and things and uh this was for a charity
that among other things provides you
know beds for homeless people and uh
so what they said was
sure we we accept that we need this
thing
but
I want you to really think about
do we have to put 10 people out on the
street tonight or could we shrink it
down so we only put five people out you
know and uh it's it's pretty harsh and
um
you know
but
the consequence of them having a breach
um
and what we sort of uncovered through
our Discovery was that actually held
quite a lot of data about children who
were
under various uh court orders and things
and and in different types of state care
and at that stage they really had
nothing in place to protect that data so
to protect
the 395
had to go without a bit I mean I think
that's the consequence of what we're
really talking about so it is really um
sad
um but it is something that you know in
that conversation we talk about well
with your budget next year when you go
back to funders particularly government
you just need to have the line item that
says you know we are serious about
protecting the data of honorable people
and I said really don't think you're
going to have much argument but it's not
something that people have consciously
been building in uh up until now I think
so
you know you can't protect everything
and it's it's not necessary to do so and
as I said before like with social media
and so on it's really about
I think backtracking from the data that
can be used for things like identity
theft and identity fraud or where
the disclosure that data is going to be
uh uh embarrassing or in some ways uh
dangerous
uh for people and so you know
[Music]
um
with some of the medibank data for
example that was disclosed I mean it was
uh pretty pretty awful it wasn't just
identity data I mean there was a range
of you know highly personal medical
records that were completely released
with full identifying information and uh
again I really feel for the people
who've had to to go through that
disclosure
and then of course the consequential
scam phone calls and things which I'm
sure have have been a part of that um
so are we chasing this Fool's Paradise
where we can't keep things secret in the
first place
um
you know I mean I I looked at a few
Graphics around privacy versus
confidentiality and it was all about
privacies about people but confidential
is about data and then I thought but
what about personal data that is also
private but needs to be confidential and
at the end of the day I thought you know
there's probably nothing blanket that
you can really say about it except that
every company an organization needs to
go through a process
where they classify that data and assess
the risk in terms of disclosure
but you know
they're also kind of numerous tools I
think that um
that we can bring to bear to try and
shape the way that we
not just respond to data breaches but to
try and prevent them in the first place
and so this is a really great Matrix
which if you've never seen before this
is the situational crime prevention
framework and um
it's sort of hard to summarize because
there's 25 different strategies
I can't remember them all but really
across five high-level Dimensions so
increasing the effort increasing the
risks reducing the rewards reducing
provocations and removing excuses and so
I think where we see say CEOs making
excuses then
it's something that we have to push back
on and say well
we don't need excuses we need
explanations but what could have been
done to to prevent this in the first
place and of course
classic Kind of Blue Team engineering
stuff down the left how do we Harden the
target how do we Implement Access
Control you know how do we screen data
going out I mean data exfiltration I
mean there's Technologies around to
detect this kind of thing
um
deflection and so on no smart guns I've
got to say but you know this is just a
generic list of things but
you know increasing the risks like
having better Guardianship and kind of
custodianship of data I think is really
important
um
you know
as I talked about before kind of
reducing those rewards making sure that
people can't make as much money out of
it as as they hope to
um
and you know I guess other kind of
things around you know reducing
provocations may be a little bit less
relevant in this context but I actually
think this is a great a great tool
generally speaking but certainly really
relevant to to data breaches
so values are kind of talked about
before
um and I guess in many of the previous
talks that have gone on today I think
we've seen some of these come to the
force so you know the idea of many I
many eyes kind of uh bringing their own
perspectives and having that kind of
open peer review
assumptions and things being actively
challenged
code being looked at standards being
looked at
um
you know
one of my Long Time Collaborators when I
was an academic Joseph pepasic uh
caused a bit of a kerfuffle when the AES
encryption standard was implemented
because he devised an algebraic attack
which showed that theoretically of
course but with some high school algebra
that you could reduce the search space
very very significantly and
I've got to say he he didn't win any
popularity points I mean I suspect he
was deeply unpopular with standards
bodies for a while because they'd had
this competition and invested a lot of
money they've been implementations
pushing this stuff out saying it's
gazillion times more secure and
well maybe it's only a third of a
gazillion times more secure and with the
Advent of constant Computing and so on
and you know
it just kind of um
yeah set the cut among the pigeons but I
guess that's the point about having an
open process for review and so on that
uh
those kind of things will be caught
um
fairness
I think one of the things that
I'd like to put in our submission to the
government is
particularly in things like the
charitable sector you know
we can't leave an entire sector behind
because they want to devote all their
money to the particular service that
they're trying to provide so can the
government really stump up and provide
you know cold hard cash or a direct
service
for the sector
you know you think about say a domestic
violence shelter women's Refuge this
kind of entity
the privacy of the data for their
clients is really really important and
you know I don't know how people could
sleep at night thinking that hey
we've done nothing to really try and
address that situation and so you know
with our uh
our NFP partner workventures which is
Australia's longest running ICT charity
this is something that we are really
urgently seeking to try and address and
to
provide those Services where they are
absolutely needed
um
that's not to say for some of the really
huge National Charities who are turning
over hundreds of millions of dollars a
year that they can't afford cyber
services
but
at the local level initiatives that are
primarily volunteer run
but provide critical protection for some
of our really vulnerable people in our
community it is really important
transparency
I think it's actually quite good at the
moment because you know we do have a
notifiable data breach scheme which um
you know we all get notifications which
is good
um I do wonder whether some of these
things are not covered up whether those
discussions aren't being held to say hey
there's only three people in the room
know what actually is going on maybe we
can just
but the proposed penalty scheme I think
was going to greatly increase the the
fines which can be levied so
you know I think having that honest
conversation with your customers with
people that are affected is really
important
um
the opposite is also true having a
less than genuine conversation and
saying everything's cool
um it just doesn't cut it I think
collaboration
sharing intelligence
not seeing security and data that you
have about threats as some kind of
fiefdom
uh I've got to say I spent six years as
a research director trying to encourage
collaboration in our finance and banking
sector and sharing data and I absolutely
wore out many many pairs of shoes
knocking on doors and so on and uh
uh sad they've got absolutely no way
so I can say that from experience that
is something that I think we have to
learn about Collective Security that you
know a threat to one of us is really a
threat to to all of us and uh
you know
a customer with one entity is probably
also accustomed with other entities so
if you're protecting your customer you
need to take that holistic viewpoint
and finally the question I think that
nobody wants to really answer
um
we spend a lot of money on on Cyber on
defense as broadly speaking
is it actually making any difference and
how would we know
and who's responsible for actually going
out and doing that kind of analysis and
Reporting
we are soon apparently going to acquire
not just one but two sets of
nuclear-powered submarines
how do I say anything controversial but
you know
it's a lot of money
and it's a lot of money from a fixed
budget that
will be taken away from other budgetary
line items at the federal level
that provide funding for hospitals
schools cancer treatment
sorry ma'am no radiotherapy for you
today because we had to
buy another submarine you know and
that's just the reality of a budget-free
process right
but I do think it's really important for
cyber to
really be clear about the outcomes
that can be achieved and what is
actually realistic
so values I think is really important
and I'm not going to pick on any
particular country I'm going to give
just two examples in these infographics
um
so you know does does Cyber and
protecting our data mean the government
looking at every packet of data that we
store or transmit
you know and I'm kind of thinking of the
the Snowden kind of scenario where it's
just a big Hoover and it just goes into
a black building somewhere and
there's no oversight there's no control
and of course I've got friends who say
if you're doing nothing wrong you don't
need to be afraid
trust us
okay all right
just chucking it out there is
and I've got to say I don't have all the
answers to these questions by the way
but is this approach consistent uh with
our values
okay
here's another example that we find from
a a federal government's uh National
level
um
you know I've I've got to say uh
back in the day when I used to travel a
lot in China you know I
I never felt unsafe on the street you
know I uh I knew that I could walk
around at one o'clock in the morning
after a a few hearty uh ales at the
local pub and have absolutely no issue
at all in terms of Public Safety
personal safety
um
yet to achieve that
um
there is this vast collection of data
about every aspect of personal life
which goes into a
a big algorithm and um
what comes out of the algorithm is your
score and if you are
scoring in a pro-social manner it's all
good but
I don't know if you have a bad day or
everything just all happens to go wrong
at once then there's this kind of
cumulative effect so again that that
notion of
large-scale surveillance
um
is it what we want you know if you use
your alipay card to buy a fish and chips
two days in a row
your score might begin to drift
because of course that's going to have
long-term consequences for public health
budgets if you do that two weeks two
years 20 years
so what are the kind of limits to to
government looking at this stuff I think
is really important
okay so final slide and definitely don't
want to hold anyone up from going to
their dinner but you know I think it is
this big question for me around how do
we build a
values-based approach to cyber at the
national level
um
one which really takes into account
those values I'd love to hear if other
people have got ideas around values
because if we don't have values then
what do we have
you know
we probably have oppression which I
think is the likely outcome
you know
I want to look at the the vast array now
of of cyber security Frameworks you know
there are very few that are genuinely
open and transparent and freely
available and adaptable
I think in the way that we see
code being written and shared and
transmitted
um
I'm not sure why this is but you know as
I said like I mean there's sectors like
the charitable sector that actually
a can contribute really valuable use
cases that are probably unique but B I
mean just don't have a lot of budget to
be going and and paying for this stuff
themselves
um
you know at the national level I think
we need
strategies that can facilitate data
sharing and Reporting you know we can't
go around arresting everybody literally
because they're probably
in a foreign country in many cases
[Music]
so it's difficult to go and use
traditional policing
um
but at the same time you know it's very
easy to get on a path to say let's just
lock everything down and lock everybody
up because that will solve the problem
and I think that would really be
contrary to our
our um
our values
do I think CEOs and board members
should go to jail if they lose 10
million of our most personal data
records
can anybody guess what my answer is
going to be
yeah you need an effective deterrent
think back to situational crime
prevention you know
corporations hold a very very special
type of license to operate in the way
they do in our society and part of that
needs to be accountability at the end of
the day
um
we need monitoring you know and we need
monitoring all the things that that are
our crown jewels and I think when we do
assessments we often talk about crown
jewels um
and I truly do think that we need 24 7
continuous monitoring of those crown
jewels to make sure that
we're not going to have another Optus or
midi bank and I really hope that we
don't
but at the same time you know I I don't
want us to get on this dystopian path of
centralized governments controlling
every aspect of Our Lives all of our
data because of course when you bring
all that together
it just becomes another Target because
the value is going to be even greater
when all that data is brought together
so you know mygov 2.0 I think some of
the discussions at the moment
single you know kind of centralized
identity management
um
I'm not sure so why not decentralize it
you know why not get a range of
organizations involved in things like
idam it doesn't just need to be the
government
um
and that's basically it
thank you
[Applause]
yep we got some time for questions so
anyone
thanks for the talk
um I I spoke to my uh local government
uh like my Council the other day I was
applying for a grant for for something
and I they needed to check my address
and I said well I'm a ratepayer can you
just compare can check in you and you're
right and they said no we're actually
not allowed to do that we're not allowed
to compare across
uh you know data like that and I was
super impressed like how do you how do
you how can we translate that sort of
maturity about personal information
across to corporate entities who are
whose shareholders
only really care about profit like
look and I think that's where you know
it's got to be it's got to be
concretized and I think you know it's
got to be real you know and I think
where we see that forty thousand few
forty thousand foot view of what data
protection really means it's just way
too in the clouds but coming up with
with templates and models and policies
and procedures through some kind of
Clearinghouse for example that says
I don't know we've got a community of
lawyers that sit around the weekend and
just check stuff because they think it's
important to the community
I mean I think that's the kind of thing
that that we need and that would really
boost compliance I think
um
I think not having an overarching
piece of cyber legislation that clearly
spells out obligations is not helpful
um Privacy Act is great
I think removing some of the small
business exemptions for Privacy Act is
also good but it's also then going to
reduce profits for a lot of small
businesses
um
if I think about I don't know my local
tradies you know how they're going to
juggle
doing their trading stuff with hang on
I've got to think about app two and
three when I take down someone's data in
my little iPad or you know write it on
the back of an envelope and so on so I
think it's really breaking it down to a
really granular level
you know coming up with
artifacts that people can actually use
software that people can use that is
actually compliant and complete and
usable I mean that's what that's what we
need
um
some of the Cyber software is
extraordinarily expensive and it's
proprietary and
probably not even fit for our local
conditions because it's all done
offshore I mean that was one of the
things that I think in the previous
strategy there was a heavy emphasis on
kind of seeing cyber as an economic
boost
that is still there a little bit in this
um
proposal but you know off cyber for
example as the government-funded entity
for Innovation and cyber has essentially
been folded into stoneage hook so
and somebody asked me recently how many
Australian you know made commercial
products to use in your cyber daily
activity and I said well actually none
so
which is sort of sad but
it doesn't mean that they can't be
activity in the community which is
not necessarily profit driven because
we've all got a vested interest in
seeing this work
so I think that's that's my challenge
out to to the open source Community is
to
look at what we've done in terms of the
approach to to code and think about how
we can broaden that out to this to this
cyber area particularly around standards
and implementation
okay so I well time is up but do people
want to ask more questions
okay
so yep so I think
Paul still around right yep yep so if
you have any question please approach
him
thing is about time for today
thank you thank you