Hello, everyone, and welcome to the latest and the last in this term of our conversations that have been arranged
by the Oxford Martin School at Oxford University on the theme of building back better.
So some of the challenges ahead as hopefully sooner rather than later we come out of
the pandemic before introducing to today's two speakers or conversation participants.
Let me welcome the audience.
Let me point out that on the bottom right of your screens, you'll see something that says, ask a question, please do ask a question.
What we'll do is we'll have a conversation for about 40 minutes and then have 20 minutes at the end.
And not only can you ask a question, you can also vote on the question.
So if if someone else is asked a question you're particularly keen for me to put, then please do vote.
That makes my job very much easier. We do record these these conversations.
So if you ask a question, we may mention who your name is.
So this afternoon we're going to be talking about cyber security and particularly the issues around new and emerging technologies.
And I'm delighted to welcome two people who's going to explore this topic.
The first professor say decrease. And Sadie is professor of cybersecurity in the Department of Computer Science here in Oxford.
Say he has worked with the Martin School for a long time, in particular in our global cybersecurity capacity centre, and said he's done many things.
She's worked in industry in Connecticut. She was at the University of Warwick before moving to Oxford.
And Miss Sadie is Jamie Saunders. Jamie is a strategic security consultant.
He's been involved in studies programme at the Martin School, is in Oxford Martin Fellow and is also a visiting professor at UCL and has worked
with many parts of UK government over the years and again around cyber security.
So welcome, both of you. I'm one of the things we're going to talk about is a report that you both with colleagues have authored with
the World Economic Forum on the challenges to cyber security that new and emerging technologies are raising.
But before we do that, perhaps we could just talk a little bit about cyber security in general.
And I guess when I think of cyber security, I think of my own personal cyber security, whether my computer can get hacked.
I worry about the companies that I deal with. So cyber security in the in the commercial sphere.
And then I worry about the government.
So the degree to which government functions and all the things that we rely on in for the country to run may be susceptible to cyber security safety.
I come to you first for where are we with cyber security at the moment?
What are the new and emerging threats? How sophisticated are we with our countermeasures?
Yes, well, of course, one that doesn't fit all.
If I was to reflect upon where we are in the United Kingdom, we're very lucky.
We have quite the capacity.
We have a great workforce, people that we can call upon and in terms of how we deliver it and how we think about picture challenges.
Well, first thing to say is that cybersecurity is all about really accepting insecurity.
There's no such thing as 100 percent security. It's really about understanding risk and managing it in such a way that you're exposed
to enough risk to do what you want to do and take the opportunities you want to take,
whether that's in your personal life or in your business life.
In terms of where we are and how it's evolved historically, the way in which cyber assets are exposed has changed.
So you can imagine 20 years ago we might have been concerned with protecting hardware, computers and some data or some programmes on them.
And then that fast evolved as our usage of cyberspace evolves to.
Now we worry about protecting our health because our health care depends so much on them.
We worry about protecting our light, staying on because all of our energy transmission systems are dependent on cyberspace.
We worry about accessing money, food, and this is what we call critical infrastructure in actual fact.
And that's true around the world, pretty much depending on how you use cyberspace.
And I guess it would be lost on people that in recent years we began worrying about protecting democracies and freedom from influence to choose your
destinies because of the way in which people started influencing and communicating and operating in line to really change the populace thinking.
So it really evolves with how we use it.
So as humanity is going online, that places new requirements in terms of what we want to do in terms of cybersecurity.
We think about that in terms of protecting the availability of stuff, making sure the only people that can see the stuff,
the authorised people do you see the stuff and making sure that it's free from sabotage,
it has integrity, and that gets interpreted in many different ways,
depending upon the kinds of assets and services, all that you really require to protect.
And as you can imagine, the job is really big. And understanding where you put your limited resource is what we mean by being risk.
Let me say something here. Yeah, I mean,
I just throw out something that said is sad because I think there's been a change of emphasis around cybersecurity certainly in the last 10 years.
And in the corporate world in particular, a lot of the focus used to be on confidentiality, privacy of information.
I think for individuals, privacy of information is kind of what we thought about what's actually changed.
And I think the pandemic has reinforced this is the dependence that we have on
it for a broad range of extraordinary wide range of day to day activities.
So the concern is now much more about our fundamental resilience and the threat of disruption, loss of critical services, et cetera.
And then to say this earlier point, I think we're now just beginning to think, well, hang on a minute,
can we trust the information that is being served up to us through the digital environment?
So issues of fake news, issues of the integrity of information,
I think are getting to greater prominence and businesses are just beginning to think about.
So what does that mean for us? And I guess as that attack surface evolves, what we've also seen is an evolution of the threat ecosystem.
So the those that would attack us in cyberspace that's evolved over recent years to us just
remembering it was about 20 years ago when I was working in the business side of this,
and we used to see large ransomware attacks even then on very large organisations who would pay large ransoms.
And of course, ransomware attacks have seen a massive surge up in the last couple of years in the in the press.
But they've always been there.
And so I should say ransomware attack is essentially where somebody hacks into somebody's systems, essentially holds that data to ransom.
They do that by encrypting it and then selling back the decryption key.
That's the kind of traditional ransomware attack in so many organisations find themselves in the position where they do pay the ransom to get the key.
Sometimes they have the benefit of not needing to for whatever reason.
But yeah, so we've seen an evolution of the threat ecosystem.
That's quite important because what happens is as the weaponry used to conduct attacks proliferates and the global supply chain,
then that becomes cheaper. It gets these skills that more people can use.
What we see is a filtering out of attack weaponry, if you like, tools that enable many more people to use them.
So the barrier of entry to conduct a cyber attack is down.
We also have seen, of course, more and more people generating the skills and knowledge to be able to attack in cyberspace.
And we've seen by virtue of the Internet and dark websites, ways of maintaining a background of supply chain activity.
So now what you have is a whole number of different people that can work together to conduct a cyber attack and people can purchase their skills.
So it's a fairly evolved ecosystem and things are changing.
We've also seen a significant movement of organised crime in cyberspace.
So old crimes using against cyber assets or against those assets, but using cyberspace because they can monetise it so easily,
that's attracted much more influx of a greater influence of threat actors.
So that's changed, too. And consequently, what's happening is our tech office is growing because we are using more and more
new technology and will and that's unfortunately often comes with vulnerability.
And the the interest of threat to attack us is growing because they can make the gains that they want to make and not actually scaling up,
too, which is kind of creating a perfect storm in a way that's just nonsense.
When you say the attack surface, as we use more and more different types of devices that are connected to the Internet,
do you mean that there are more ways that a hostile act I can get can can attack us usually?
So usually new tech will come with inherent vulnerabilities not necessarily designed in on purpose,
just sometimes the way in which technology is developed.
If somebody were to send something against that that was unexpected, it doesn't always deal with that safely.
And sometimes it can be tricked into running someone else's programmes and that enables them to take control of boxes.
But it isn't just about technology. It's also about the way in which we glue it together and which we orchestrate it.
And there's something about the way in which we incorporate these new technologies into our lives that can open up new attack services.
And sometimes it's in us in the way we use things as human beings.
We see in our cybersecurity world we see this system as having the humans inside it.
They're not just on the outside watching passively, they're actually taking part.
So we're part of that system and sometimes unintentionally, unintentionally, we are in witness.
Other times, of course, that's with intent. And if you were to classify the hostile agents or the motivation behind the hostile agents,
then some of the groups that do ransomware and things like that, some are out there just to extort money.
Others make money by stealing secrets, presumably. And then you have others.
And you mentioned I haven't really realised that it came within cybersecurity,
but the systematic misinformation and social media that one gets that tries to influence a political process,
is there a sort of typology of the different types of threats out there in cybersecurity?
And that's the actual. And they all have kind of strengths and weaknesses.
I think the important thing is to to think very broadly about this.
I mean, ultimately,
cyber security is about the risks that are inherent in the dependence that we have on I.T. And some of that is that someone might hack our data.
But some of that is that, you know, that could be misinformation in terms of the sorts of actors there are.
There's a lot of conversation about cyber criminals, whether they are criminals who will make money by whatever means they can.
And cyber crime is a particularly attractive activity because the rewards are high and the risk of getting caught and punished are low.
So when it comes to cyber crime, really the game that we're in is how can we increase the cost to.
So and that's very difficult to do, especially when they are operating globally,
but we are often tied to our own nation state when it comes to nation state threats.
Again, I mean, any any advanced country worth its salt has made some kind of investment in cyber.
And the real issue is what do we mean by a hostile state actor and what do we think
are acceptable normative behaviours in terms of what a state should and shouldn't do,
in terms of how it uses that level of power? And we often talk also about hacktivists and teenagers just having a laugh and so on.
The other thing I think it's important to bear in mind, just just as we need a broad definition of cyber security,
we also need a broad definition of cyber crime, because any crime which is exploiting the characteristics of cyber space is of concern.
And that's as much about child abuse, incitement to violence, radicalisation.
Most social woes have some kind of digital component.
And we need to think about all of that when we think about cyber crime and cyber security.
I suspect many of the audience will have been reading in the last couple of weeks about the Microsoft hack and maybe going a little bit further back,
the solar winds hack, and which struck me as particularly insidious and that they have malware lurking on systems for a long time.
So this is a new type of threat, or is it something that's been around a long time and just more visible in the last six months?
Yeah, it's been around a number of years now.
We refer to anything that persists on a system for some time is, generally speaking, an advanced, persistent threat.
We've seen examples of attacks like that since years ago.
I believe the first one that really made it into the public eye was the Stuxnet attack, which was on a uranium refinement facility.
And they are insidious. And actually, one of the most worrying characteristics is not simply what we know to have happened,
whether you're talking about the exchange server attacks or whether you're talking about getting
malware into patches that are distributed through a supply supply chain to everyone using it.
And what's really concerning is actually what else might have happened and the difficulty for organisations or indeed I guess individuals,
if it were to happen to them, is really deciding when to call time on the investigations that you have to make.
You can imagine when something like this gets announced and it's in your system.
You you might know about some evidence, so we know this state has been essentially stolen, although we still got it,
but we've seen it for sale somewhere or somebody has told us they've hacked us, they've asked us for money.
However you find out there's an immediate harm that you have to deal with, but then you have to ask ourselves the question, what else happened?
And if they were there for years, you really have to conduct fairly detailed investigation,
trying to identify where these attackers had presence on your systems,
where they moved to, because they generally will pivot around what they've accessed,
data process, what they've learnt about you and your people and what what they may have done with that kind of knowledge,
if you like, which, by the way, is often sold on and used in other attacks later on down.
It as much as we know about the Microsoft hack hack and the solar winds, this was a criminal enterprise or state backed enterprise.
Is it is it clear yet to. Um. Well, I think there's lots of different claims around in the press, do you know?
We know certainly who were the perpetrators of these?
I think we got pretty strong suspicions about the solar wind and without going into accusations that that was state backed or an organisation.
Highly sophisticated. OK, I can take that means the assertions of state backing them about highly
sophisticated is a particular vulnerability with the big platforms that we have.
And we'll talk about in the moment that this extraordinary connectedness and increasing connectedness.
But this is a accomplished accompanied by a relatively small number of very big companies being involved.
And we all the same degree use a limited amount of it.
Is that a sort of lack of resilience in the system and what can be done about it?
You have identified exactly the issue. They're not particular needs with the hacks that you're talking about, particularly sophisticated.
I mean, technically, they require you to have very sophisticated knowledge, but it doesn't take a whole nation a number of years to craft.
Those we call them exploits the actual pieces of malicious code.
It will take a long period of time to work out what to craft and then you make it.
But the real vulnerability that we face is actually this.
This what looks like a form of systemic risk is a lot of dependency on a few building blocks in our digital infrastructures.
And that means if one of those building blocks gets taken out, then that risk can propagate, as will the harm across the systems.
And in the research that we conducted with the World Economic Forum, this is one of the things that we were really drawing people's attention to,
that there is not only risk is aggregating, but it's potentially hidden.
And organisations,
people and countries are not entirely aware of exactly where these common dependencies are because they're often further down the supply chain.
They don't necessarily have visibilities, is not totally transparent.
So if you don't understand there's this risk aggregating, then there's not much you can do.
I mean, we can recommend people attempt to build in resilience and prepare for bad things happening.
But you'd be far better equipped if you could at least prepare and have early warning signs as this risk was becoming realised,
if you like, and we know where it is. So I do think we need the right balance in this because it's not a black and white issue.
And there are big advantages to the availability of commodity computing, cloud computing and so on,
because you are embedding security functions in extremely capable organisations so that there's a real security gain from that kind of application.
But clearly it does bring into question issues of of monoculture for want of a better term.
And therefore, it's right that there's a a a conversation with the providers of those systems that says, OK,
how can we have the benefits of aggregation with addressing some of the resilience issues which inevitably arise.
But I certainly wouldn't be saying that aggregation is a bad thing.
It's how do you manage the risk in a in an environment where there's a high level of aggregation and dependence on on a small number of supplies?
It certainly feels like this is a space where we need to do some more policy development work.
We need to think about oversight mechanisms, incentivisation of markets, what kind of behaviour,
standards of care should being being adopted by these organisations that are so critically dependent upon?
And we certainly need to be doing more thinking about how we can ensure that they're
doing what we need them to do in order to secure up these things that we're
very dependent upon and the system to cyberspace that we could talk a little bit
more about your report with the World Economic Forum and members of the audience.
We put a link to it, which should be a green bar and bottom of your screen.
And you begin in a report to talk about the the evolving dynamics of cyberspace.
And that has particularly struck by a quotation we had from our readers.
You talk about the increasing complexity and many feel that this is so complex with increasingly sophisticated
characteristics that our role will change so that we become observers of the system increasingly outside our control.
Now, you go on to talk about some of the things that can be done, but could you just elaborate a little bit about that?
Because it it's when I first read it, it was a bit apocalyptic. So, yeah, well.
It's probably actually, when you think about it, quite intuitive. Really,
it's the observation that what we're doing is we're creating systems of many moving
parts and they're now and we're not just talking about the Internet infrastructure,
we're talking about all of the systems that that gives rise to support systems.
We mean ecosystems of businesses, government services, individuals, the tech, the process, the routines, the products.
And all of these are coming together in various moving parts. So the dynamics are getting quite complex.
Some of the relationships, long time some have passed, created and dissipated.
Some of these supply chains, the very, very long end to end.
In fact, they're multidimensional. They're hard to even think about in a two dimensional, three dimensional space.
And all of this is being driven by these new kinds of technologies and the processes that are created from them.
And if you think about it, what's happening is groups of people, not just single human beings,
groups of organisations are coming together to engineer parts of it.
And then we've and we're creating in such a way that you can almost glue it all together.
And the consequence of that is something that is very complex and changing so dynamically complex.
And it's already the case. If we were really honest with ourselves, if you would turn round to a CTO of a very large organisation and ask them,
do they really understand all the constituent parts that form that information infrastructure,
even without thinking about how they relate to what the people are doing with it?
And they would say, we probably couldn't write that down and get that right is very hard for humans to hold that in their heads.
It's very hard for us to tool it. And so if you think about that in a global way and the way in which we're instrumenting the planet and the
way in which we're now generating new knowledge and processing the data from instruments on the planet,
you can see already that we are what we're doing really as humans is creating tools to enable us to make some sense of this,
to spot some connexions, if you like, to hear the weak signals and find the intelligence elsewhere in the universe.
But at the same time, we're kind of giving birth to the cyber universe,
which is much greater than any of these lenses that we have in any one part of it.
And we're probably already there. It's just expecting at the moment.
So that knee jerk reaction to that would be, well, what we need is some rules and laws and and standards.
But there are dangers to that as well, that just because cyberspace is so ubiquitous that if you put in rules and standards,
if you put someone in charge, there's a potential for the misuse of that authority.
Can I can I make a slightly different point and then come back to that?
Of course. And this, I think, takes us back to the pandemic and building back better.
I think what. What saving has one of the things that society has said is that.
Resilience and understanding has, in a sense, gone second place to issues around convenience and efficiency,
which one could argue is a feature of global supply chains, and hit us very, very hard when the pandemic hit us hard.
So it seems to me when we're thinking about cyber space and cyber security and lessons that we draw from this report and from this pandemic,
we need to give a greater emphasis to resilience.
We need to give a greater emphasis to really understanding the risks that we're dealing with a degree of simplification,
because simplification does lead to greater resilience and predictability.
I think standards actually have a role to play in that.
And I agree that if the standards are too prescriptive, then you can end up undermining innovation and so on.
But I think principle based standards, outcome based standards and so on all part of the answer in terms of both enabling innovation,
but also making sure that we're thinking about these resilience type issues is
very important and actually in the concept of the expanding cyber universe.
It is about what it's really about understanding the science and how you deliver the resilience.
Of course it is. That's the implication. If we were dealing with so complex,
we stop trying to pretend we can understand all of it and engineer for everything and focus on how we get what we need from this.
So take all the opportunities it provides and deliver resilience.
It's like it's like a form of science in a way. We need to remind ourselves that science is a model that explains things to which we
have evidence and it changes over time because we to new evidence and and in a way,
the pursuit of resilience is really it is that in a nutshell, I would say it's incredibly important.
And if you think about the work that we do at the capacity centre and I mean the model
for benchmarking national capacity has been used by over 85 countries now in the world.
And that's incredibly important in the concept of the development agenda,
because we know that helping some of the poorest nations develop their economies is going to hinge upon their ability to harness cyberspace,
whether that's enabling very tiny farming enterprises to do business and to bank online,
or whether that's really about accessing energy and facilities in order to manufacture in that kind of thing.
And one of the new pieces of work that you and I are involved with actually in the context of the capacity
centre is really trying to help explain the importance of cybersecurity to the sustainable development goals,
that all of the things that we've become working on this year because we know it's incredibly important to delivering on these kinds of visions.
So on the one hand, there's understanding how we might be introducing new risks that we need to be managed
and we need to ensure that we are resilient in the face of in terms of new technology.
And on the other hand, we've got how can we make sure that the world can.
Do what it needs to do to address some of these big issues around climate change or food security and well-being in general, and of course,
one of the great opportunities in making in achieving sustainable jobs is leapfrogging technology,
much of which is digital, which, if it's compromised, will undermine that.
And you touch on four particular areas of emerging technology,
one of which I think we've been discussing for the last 10 minutes or so, which is increasing complexity.
If I can ask you about the other three and Jamie, I could come to you on artificial intelligence and machine learning.
What are they? Well, both the threats that the spread of AI raises and also whether it can be part of the solution of improving cyber security.
I mean, the first thing I would say is that artificial intelligence machine learning is
already being used quite extensively to help cybersecurity professionals do the work.
So, you know, there's a lot of really positive things there.
But it's also true that artificial intelligence machine learning is being used by attackers to improve their ability to attack.
So there's a kind of cat and mouse game there, and it's actually quite hard to tell who is where the benefit of advantage is going to be.
And we have a go at that in the report and I think essentially conclude we don't know.
But I think there's a broader issue here that says if you're thinking about a world
which is much more dependent on what we call algorithmically curated processes,
then you have to think about, well, what are we actually defending? Because you're not just defending hardware and software.
You're also defending the data that is going into these systems, the algorithm itself,
which you don't necessarily understand because it's a heuristic algorithm rather than a deterministic algorithm.
And so we need to think much more broadly about, well, it's back to say this term, the attack surface.
So what are we trying to defend? And I think perhaps the most significant conclusion from this part of the report was that we're
not yet building these systems thinking deeply about how we can build them as secure as possible.
Also, how can we operate them through a whole lifecycle point of view as accurately as possible?
And what we need is clearer principles and approaches to developing an operating system so that we can do it securely.
And indeed, that's going to be an area of the future research. As a follow on from this report,
I thought a very relevant phrase you used here and actually in several places and
report is building security from the base upwards when you're designing a system,
just having it from the very beginning. If I could go on to the next topic you looked at, which is around quantum computing.
And I got to ask you just to explain briefly what quantum computing is, if that's possible in your seconds.
And then I'm going to play devil's advocate and ask a question for you to shoot me down.
So quantum computing. Yes, really exciting, but sufficiently far on the horizon.
It's not something we need worry about now. So let me for both of you.
So the one sentence on what quantum computing is was a completely different way
of doing computation where things can be essentially in more than one state.
And so historically, when we think about how we compute the answer to a problem, then we fill the probabilities,
compute that through a series of if it's that this if it's not, it's this point because there isn't one.
And the thing about quantum is you can be zero and one at the same time.
That's a simplistic way of communicating it.
And that, as you can imagine, though, if you can compute as if things are in many different states at once,
then you could computational power and the kinds of problems that are now tractable to solve grows dramatically.
The reason why we were considering it in the context of the report is actually, although it might feel like it's very, very far away,
there is significant investment being put into the ability to create quantum computing,
to be world leaders and being able to deliver quantum capabilities.
Could be for many reasons, not least because of the kinds of problems that will then become Tatopoulos,
the new kinds of solutions and insights that will have new kinds of programmes that will be able to will be far more sophisticated,
we expect, but also importantly from the cybersecurity perspective,
because as I think we began this discussion by reminding everyone that there's not a 100 percent security effort.
And if you think about how we deliver confidentiality and encrypt data,
that's a good example of in actual fact, we don't deliver cryptography that is 100 percent secure.
We deliver we encrypt our data in such a way that it was it would be nearly impossible to comprehend of someone having
the computational power to break the encryption and to calculate the the primitives that create the encryption keys.
So essentially, the concern is if quantum computer comes along, lots of our old crypto will be very, very easy to decrypt.
All of a sudden, at even the moment, we rely on the fact that it would be very, very hard to do so.
We're considering it because, one, there's lots of investment.
We know that there's capability building and it could speed up because of that investment.
And we know that there's at least one security mechanism that would be vulnerable if an attacker had access to this kind of computational power.
But by the way, any kind of security control that for which its reliability depends upon it being very,
very hard to compute something would be vulnerable to attack as it has quantum computing power.
Jamie, let's go. I was going to add is we're building and designing systems now that will still be alive in 30 years time.
Exactly. Industrial control systems or systems in space.
And so we better think now about how we can design them in a way that if quantum computing does become a reality,
and I think it will in that time period,
that we can at least easily swap out the cryptographic that we got and replace them with something that is quantum secure.
So, Charles, you go ahead. I was going to say the good news is we've had some foresight, as we say in the report,
there has been activity amongst the crypto community for some years developing new kinds
of encryption algorithms that would be considered quantum safe and secure and indeed,
oxfords. We have one of those hubs and there's activities going on all around the world.
So on that particular component, there is there is thought going into how you would generate new kinds of encryption.
But as we know from the reports of people read it, that's just one part of the problem, that even on that little building block alone,
just because somebody produced a way of developing an encryption key,
you still have the practical challenge of rolling that out across all of your data.
And Jamie just said some of this will have to present in your system some years
and legacy understanding what you've already encrypted and where it sits,
knowing that you've got to re encrypt it with a new key to keep it secure, deciding whether you need to do that.
What of the stuff that you've been creating needs this this level of protection
and what you can rest of changing and just think about as human beings.
Is anyone really aware of where they've put their data recently, where the data about what they've what they've been doing in their personal lives?
And you can imagine if you're a business large corporation, it's incredibly challenging.
So in the end, what tends to happen is a focus on the the stuff that people really know they care about and getting that sorted out first and
then lots of things often will naturally fall by the wayside and be considered no longer necessary for that level of protection.
And there's another side of constant technology in constant communication where you can, at least in theory,
have a communication system that's impossible to to eavesdrop on or without being detected.
Do you see that as being an important element of cybersecurity in the future?
I can jump in. Yeah, well, I think we're talking about quantum key distribution and yes.
And lasers and lights and stuff, et cetera. Yes. So we definitely made progress on actually.
It's fantastic, isn't it? Kind of harnessing physics as part of the security argument for one of our security mechanisms?
Yeah, there's always kind of operational limitations as to where you can use that.
In this particular example we're talking about, you have to have really good ability to have line of sight or fibre optic cable that isn't losse,
to have really reliable communications between the two elements that are using this kind of mechanism to talk.
So there'll always be a useful kind of backbone infrastructure where you can guarantee that.
Be very easy for some type of fibre optic suckler to light out and and to do denial of service attack at you.
So here is how it works. Need to create to create some kind of confidentiality and secrecy.
But sometimes that mechanism can be so brittle that also we need to do is come and step in the middle and just lost it.
And you kind of lost it. And your mechanisms will have a failsafe if they can't have reliable communications and that channel is gone.
And so you have to learn another means of communication. But yes, there will always be a role for different solutions.
And if, in fact, there always has been and but they come at different costs.
And that actually, in a way, it doesn't sound very direct,
but it is a direct pivot's with some of the observations we made in the reports around business leaders really being needing to have tools,
knowledge to enable them to understand what these risks are and to lead in the face
of incidents to help ensure that their organisations and the ecosystems are part of
remain resilient and really get your head around what kinds of security needs you have
and then how you line up these kinds of approaches and these tools to deliver them.
That can be really challenging. Time to ask one last question before going to two questions from the audience.
And I do encourage the audience to ask questions and in particular to vote.
And this is the fourth of the areas of emerging technologies you looked at and I guess is INOMAX.
But I wasn't surprised by the first three, but I wouldn't have guessed the whole issue about digital identity.
And Jamie, might you just say why that is important and what the cyber security threats and opportunities are around that area?
Yeah, I mean, the first thing to say is that managing digital identities, well, digital identity identities,
in other words, just like we have a passport that says who we are, we can wave it in front of a border officer.
A digital identity tells someone you have a digital transaction with it.
It tells them who you are, or rather, it shows that you are entitled to the service that you're asking for, which is a slightly different thing.
If one can trust that someone is who they say they are or that they are,
or that they are authorised to receive a particular service or went to a bar or whatever it might be, then obviously that's where they go to security.
So I think most people would say digital identity is an essential component of security in this ubiquitously connected world.
The issue as as as most people would recognise, and especially people who are who are taking part from the UK,
is that the whole question of identity and identity cards and so on and so on is politically very, very difficult.
And so different countries have got different cultures in terms of how digital identities should be managed.
And every single country I talk to is convinced that its approach is the right approach.
And that's fine until you ask the question. Well, what if people want to undertake digital transactions that cross borders?
How can I be confident that the digital identity provided about with a very different approach
in Country A is sufficiently strong for me to be able to safely provide a service in Country B?
And every time I talk to people about how are you ensuring that this will all be interoperable, they say that's easy.
We're going to persuade everyone else to do it the way that we want to do it.
Well, that's not going to happen. And so essentially what the report is saying,
we need to have some sort of international conversation that says what are the
basic standards that we can all agree on that will enable interoperability.
And the reason that this is important is that actually that issue affects almost every other aspect of security that we've talked about today,
because the last thing that we want is for the security tail to wag the global Internet dog, if I may use that expression.
And and it's very easy for security concerns to undermine the very free and open Internet that will actually all here trying to protect you.
Thank you. So let me go and ask some questions. And the questions with the most votes is from Maria Kang.
And I can, to paraphrase it slightly, but she essentially says.
Should we be downscaling the growth of new technologies, is there a risk that we have a runaway train?
So are we perhaps moving too fast towards a multi connected world and things should be put the brakes on for a little bit?
Of oh, well, I would say I realise, having heard lots of talk about security and threats,
et cetera, that I can see where that question would stem from.
But there's little doubt in the value of the connected world and the data that it's providing.
I can't I can't see if you imagine a trade off of benefits.
I just can't see that we want to do anything other than build resilience into this highly connected world.
All the benefits that it comes with, I mean, I appreciate that a bit.
Like Jamie was saying, every country feels its identity system is the right one.
Every generation feels that the way it was when they grew up was the right one.
That's how I am. It's the generations that, however, it's quite clear that medical breakthroughs, the opportunities.
People connecting around the world with with other people like them facing the same kinds of challenges or dreaming the same dreams.
The upside has been so great that I think it's really about it's on us to actually really develop the capacity to ensure
that we're resilient and that we can build with the values and adopt the right principles to see this one through.
So I called. I think we should put the brakes on a little.
And I think if one looks at the evolution of technology, certainly over the last few decades and probably the last few centuries,
there were probably some things which we regret having rolled out quite so fast, DDT and the whole Silent Spring issue.
And it seems to be right that there should be mechanisms for society,
for governments to step back and say, are we really sure this is a sensible thing to do?
Um, so I wouldn't want to stop or reverse the roll out of technology.
And I think we need to do it with our eyes open. That's exactly it.
And in fact, I've been taking agreement and it may not even be about speed.
I just think that we have to do it with the right kind of oversight and insights and it responsibly.
And if that means slowing down a bit so that we have the means to do the right thing, then so be it, but instead be avoiding the opportunities as all.
So that leads onto the next question.
And I'm going to bring together two questions, one by David Bloom and the other by James Reid Darbee, who both who point out,
first of all, the importance for innovation in cyberspace, for economic growth, and that aggregation happens very rapidly.
So what's a tiny Start-Up today is a unicorn. Tomorrow is a trillion dollar company in two years time.
And they both ask questions about what type of mechanisms would you like to see that
ensures that they build in security from the start without stifling innovation?
Well, let me let one. Yeah, I mean.
There's this there's two very, very different ways of looking at that.
I mean, one is that by raising awareness and so on, I mean,
it's important that everyone who is involved in technology is thinking about cybersecurity.
And in a way, you know, we kind of got that. I mean, that is a change that has happened over the last few years.
But I think the more fundamental point is we seem to treat digital technology in a much more kind of less a fair way than we do,
for example, genomics or biotechnology. And it seems to me that.
There ought to be some some sort of process of saying, you know, you're not actually going to be able to deploy,
why wasn't there sufficient regulation that says that actually?
Wildly deploying fundamentally insecure products, you know, the regulation without being heavy handed won't let you do that.
And so if you if if you haven't planned in security early, then that's going to hit you hard and slow down your growth later on.
So it's not it's not saying no one should do anything, but until they've done security,
it's just seeing you as a business need to realise that if you're going to go,
there will be a point where you have to answer these security questions.
And our advice to you is the earlier you answer those,
the quicker you'll actually be able to play the brakes on on your prototype car rather than building a car and then thinking,
how can we put our brakes on later? Yeah, I would I would I would agree with that, and I know that she say.
And then I think that there's some serious creative and deep thinking needs to be given around the space
because there's going to be a role for some regulation is going to be a role for incentivising markets.
That might be a role for incentivising consumers and users and and understanding how we
balance out trying to make it that to be a financial market upside for the innovators,
that will be greater if they're doing things that actually protect us from the harms we're trying to avoid.
That will take some deep thinking because we have seen, haven't we, that there has been a market failure.
If we leave it to just the the technology developers, we've known how to avoid many of the software errors that get exploited by a tax for years.
But the the paradigms, the ways of of writing that code haven't been taken up and the business models have changed.
Now, we work in a world of app stores and download different pieces of software from Yunos where be totally reliant on the App Store.
Obviously, it has is not an email intent inside it.
So the world is shifting and it feels like you couldn't for example,
you couldn't solely rely on regulation because anyone that's in the role of standard setting knows that those things take years to evolve.
And if you look at the pace of change of technology in the way we're using it, there's no way the standards can keep up with that.
They can catch up with that. But there's always going to be a window of time where they have not yet.
And so you couldn't solely rely on compliance to standards to to remove the tax office.
You will also need something around attitudes and behaviours in organisations.
And you'll need to try and make it so that that if you protect people from the harms you want to avoid, then you're going to flourish.
And and that's in the UK, which we've seen buying power been used by governments.
So they've set up schemes where so I only have organisations in the supply chain
that are implementing to a certain level of integrity cybersecurity controls.
So big, big users of third party services buying in such a way that he actually uses the mechanisms,
the economics of supply and demand to try and make a success out of some of these more innovative solutions.
But what actually happen to think that this requires a very concerted effort to look at what might work, might not work,
and not solely from technology out there needs to be a technology angle, but there also needs to be a whoremonger.
Yes. What it will actually need to be resilient to in terms of threats and what are the harms that we're trying to avoid or to
mitigate and then to use that to help define where we want to put our investment grade sales and financial investments.
What are the kinds of standards? Are the standards of care?
Are they technology standards? Are they something to do with the way we regulate markets?
And what can we do to try and promote those organisations and technologies and
ecosystems that are going to deliver more cyber resilience and protect more people?
Is this something we can do about that? So I think this piece of work, which is of course another sort of, you know,
positive incentives and negative incentive is run by better enforcement, but also around the legal liability.
I didn't think it would help if software companies, platforms, etc have greater legal liabilities for the harms they expose their customers to.
So tell me to start that one off Saturday. I mean, I've heard the argument.
And again, I don't think it's black and white, I think generally when it comes to digital technology.
Governments have been and then the law, if you like, has been more hands off than it has in other forms of commerce.
And to put it away in another way. Tech companies have got away with quite a lot, and that's a one away one competition.
And that applies to competition law, as we know from the debates in the US as much as it does to security issues.
And I think the balance does need to shift a bit, but it mustn't shift kind of too far the other way.
So it seems to me unreasonable to make a supplier of software liable for all the the foolish things that a user of that software might do.
But at the other end, it can't have a completely kind of hands off.
We have no responsibility at all.
So to me, that does need to be a bit of a change in emphasis, but not a kind of dramatic swing, at least not for now.
I think if you imagine it's an.
The good metaphor, because when we do expect cars to be inherently safe, we're certainly about the structure is going to have integrity.
We have now in certain parts of the world, we have laws where you have to sell them with seatbelts and safety features.
But the car manufacturers are not inherently liable for the way in which that car gets driven.
So there is but I agree with Jamie that there is still some health and safety around the vehicle in the first place.
And actually this product recall when when features are found to be wanting and there
are ways of taking remedial action and demanding that remedial action is taken.
And we probably haven't reached that point enough with the tech sector.
So I would totally agree with Jamie. There's a little bit of work to be done,
but it's not the case that you would absolve the drivers of the cars from their actions and they will be cheaper.
Forgive me for interrupting Sandy, because we're coming towards the end. I want to step in one last question, and this is from John M.
We have seen in very real terms how communications platforms have been weaponized and used for very effective disinformation campaigns.
A panel have any thoughts on how governments or society can counter or mitigate this threat.
And I'm really sorry. I'm going to give you about 30 seconds to answer that side.
Would you like to go first? Well, there's this and multiple elements to that.
We in the cyber security space to look at how we maintain integrity and ensure that somebody
hasn't managed to bust the system so that it influences people in ways that were not intended,
but that would not in any way, shape or form deal with the issue of how people are susceptible to messaging, which is something in our biology.
Enough. Jamie? Yeah, I think part of this is the conversation with the platform owners to say, you know, you do have some accountability.
I think the platform owners have accepted that. And I think the platform owners are doing a huge amount.
But Assadi says ultimately this is a social societal problem and one shouldn't expect a technologist in the whole of the problem,
and neither can it be the whole of the solution. Thank you.
And I thought that was one of the strong points that came out from your report that, yes, there is a lot that can be done technologically,
but a lot that requires both government action, but also changes in norms,
changes in the in the way that we view and the way we interact in the digital world champion.
I suspect we could go on talking about this fascinating topic for several more hours and we have to stop here.
So let me thank you very much for taking part in the conversation this afternoon.
I'd like to thank the audience and apologise apologise for not getting through all the questions.
We're now going to take a break until after Easter. We'll put my website details of the next series of conversations.
They will be around the recent report that was produced by His Her Majesty's Treasury,
the UK Economic Ministry on the on the Economics of Biodiversity,
that this is the path to report and we'll have path talking and a couple of other people as well.
So the details will be on our website shortly.
Sadiya, Jamie, thank you again.