 I want to start by asking you, what do you think are going to be the kind of priority issues for a new government? We will have a new government of some stripe in a couple of months time. What do you think they're going to, how are they going to front up to the challenges of cyber security and cyber crime? One of the things that's becoming more and more apparent is that cyber is not a single technological issue the way that we have attended to think about it over the last 10, 15 years. It covers the gamut of social issues, social interactions and the problem is that the field itself is becoming more and more noisy. The signal-to-noise ratio is diminishing and so there is a tendency just to leap on the latest thing and trying to react to that. So the challenge for the government is going to be to how best to overcome that immediate need for reaction which you'll need to do but rather than just coming in having a knee-jerk reaction, take the time to think about the longer term. And the longer term includes questions such as how do we build the social capital amongst our people to be able to deal technologically and socially, politically, economically with these challenges? How do we invest in our institutions and research organisations to actually have that long-term investment into the future rather than just relying on let's bring another law in put another law in place because we'll end up in a thicket of laws that will actually diminish our capability to take a longer term view and do what's best for our society. What we don't get I think you're emphasizing is just the variety of one of the criminal conduct or disruption that we're actually dealing with under that basket of cyber security and it can be state actors you know trying to undermine I don't know nuclear facilities I'm thinking of Stuxnet as a kind of as a classic example right down to you know social media bullying, self-harm the sorts of things that take place in social media might be scammed it might be all kinds of you know misuse if you like of the internet and abuse the internet. I'm thinking too things like child exploitation materials and so on so that variety is a bit of a challenge too isn't it? And the area in which you deal with mainly is a really it's like a it's like a petri dish of all these things this is where the testing ground is this is where a lot of those tools can be tested and what we're seeing is that those tools are tested in those environments because it's all globally networked they can spread very quickly and nation-state actors particularly those with the big four regimes that we're seeing in this space which is Russia China the North Korea and Iran are picking up those tools and techniques and then reforming them and so we're still seeing this positive feedback loop in in the cyber domain. One of the issues is because it's entirely man-made is how do we actually you know deal with its how can we shape that environment for good rather than just leave it for you know for bad and let it rot at the edges and fall apart. Well I mean yeah look I think there are so many different challenges there's lots I'm very quite optimistic I mean in the sense that some of these some of these areas some of the sorts of you know because what's what's really happened is the internet's enabled crime it's a facilitator you know before the 1990s yes there was child exploitation or child sex abuse material but it wasn't on the scale so there's the scaling up problem which you clearly have identified and then as you say there's this interesting interaction or iteration between you know criminal activity crime follows opportunity and the way in which states intermesh with that so there is there is a there is a greater complexity but I'm kind of interested a little bit in what you said about the sort of cyber security training education research area a bit close to us because we we know we have a profound shortage of the kind of expertise the skill sets that we need and we're desperate to try to make it more multidisciplinary as well so what's the next step do you think Leslie so that side of it because that's the roof that is challenges no there's couple things there's immediate education problem I'll get back to that but there's the analogy often use is public health so 150 years ago we had to governments had to convince people that there are in these invisible things that could do them harm and not only that if they you know were themselves infected then they could affect their broader population their family and society and this is not on you know there's a useful analogy because it illustrates how we have to put in those particular behaviors we have to trust individuals we also trust organizations to do things it is not merely the government to do things and it's a that enabling of the broader society so now we wash our hands we have vaccinations you know we know about immunity we have institutions like hospitals to take worse you know care of the worst cases and I think there is something we can learn from that in the cyber realm that you know the analogies obviously aren't one-to-one but it does talk to you talk to prevention does talk to reshape the environment to be less risky and we also educated about how we can be healthier and so on as well as well I think on the education side I often talk about that broader ecosystem we cannot just rely on law enforcement we cannot just rely on the technologists we have to broaden that understanding so that people just take those aware and take those preventative measures we also have to ensure that people who do things like the funding resourcing and build the economic models are aware of the of the downsides and think proactively about how they can improve things rather than throw the hands up say I've had a problem I need someone fix it yeah look I think that I mean you're up obviously the prevention approach is going to be the one that's going to yield bigger returns and figuring out how to do that is important but we have got a couple of different levels haven't we let me one one that sort of kind of worries me a bit is that we have you know we have that what are we called the high you know the national security type the infrastructure the kinds of things that we really must protect and then we've got of course you know that for one of a better word you know the mum and pop sort of vases that come through ransomware or romance frauds or whatever scams that are around and it strikes me is that we might I don't know look this is a question I want to do are we putting enough effort in into target hardening if you're like producing Cape enabling cable guardianship to look after our really you know our key infrastructure needs and are we putting enough money into that I mean I'm yeah I do I do think there is a relationship actually by the way yes between the higher you know people attacking computer systems grabbing databases going after disrupting either as competitors yeah or you know commercial we see this on the dark net market just as matter it's quite fascinating you've got a lot of illicit crypto markets out there and they're constantly fighting each other as well yes there's a hyper competition in place so that's distributed on all services tax going on all the time so yes from us from a research point of view it's a bit painful because we're trying to collect data yes so this is where I think we have to rethink what society is and looks like because it's clear that our attack surface for the technical and so we have to harden from the nation-state level downwards hardening merely the nation-state is not enough hardening at the individual level is not going to be enough we also need to understand that's the the adversary has a range of different motive so particularly in the crime space it is you know about money and you know about you know ways that whether it's actually directly pulling money out or getting credentials to on sale to etc so there's a market market mechanism there some of the nation-state actors are actually more interested in disruption confusion eroding our social norms so we need to also put into place a lot of things about how we actually strengthen our society and that's where I'm concerned about just regulation just as a response because that makes things more brittle you need to give people the ability to be able to respond and harden their own yeah I think the problem too with the law I mean not not not that I wouldn't be arguing that is a solely a law enforcement but the problem is there is an appetite there's a huge appetite for you know law enforcement services and we've got to have that you know you're releasing we've got to have some appetite control and we've got about to direct those limited resources in the best way we can so in a sense I guess look it does remind me we've been saying this for a long time actually the person or the company or the individual that will the corporations will the innovators who can put together a really clever mousetrap a better better word that can help unwitting people like us to use yes the technology is a general purpose technology can they come up with something a better my mouth and can we come up with the people can generate high level of trust and efficiency security they're the guy they're going to profit in this environment yes I guess what troubles me a bit less is I don't see governments having a role on that or they may have a role but they don't deliver that kind of product well there's two things there firstly we can see that mechanism that you know already in play as being a commercial advantage so Apple plays on that very does now does yes now it does and doing a very good job in that space at the government level this is where we think governments have to put a bit more thought into things because it's very easy for them to say right we will control we will act we will do things and then of course when it doesn't work because all software is vulnerable all those guarantees aren't put into place or at least shown to be well actually we didn't really understand yeah or it was used in an environment we haven't anticipated all sorts of kinds of things and so yeah and so there's a erosion of well how can we trust governments and then on top of that you have you know even in our society we have the fallout of things like Snowden and so on so how can we trust these people so there's a lot of work government has to do about rebuilding trust they cannot demand it you cannot enforce it you have to earn it and that's a hard road and it requires a lot of time and attention and investment and smart people actually and they're pathetic people so one of the other problems we have to is that people are people they're messy and we try to sort of make it well this is a standardized person that's what they everyone should look like that people are messy they grow and change it's like beat our rock coming out as being the cold you know for my member the cult of the dead cow you know for my hacker group okay just picked up that reference okay but yeah and people these days it would be seen oh he's really bad he's up there with anonymous and last you know etc now it's seen as well he's actually and you can see how people evolve and change and we have to be more forgiving of people and let them grow and express themselves because it's creativity that will actually help us get through that and how do you foster that and how do you bring that into an ethical space in the sort of kind of suppression of hacking and all the things that we worry about that's actually just because I wonder things we're going to be doing first when we do is again a norm norms and ethics thing so you need to be able to pass a reasonably high level I think to be a progress progress through it but it comes down to given that we have doubts about institutions you know you know politicians frankly do need to step up but there's a debate to be had particularly as we're seeing a bifurcation the world between liberal and liberal regimes and the natural reactions of all states is to try and exert control in defence and that takes us down a liberal path there's a discussion we had about values and I think about you know commonality of values the world we want to live in and that's where you start pulling some of these really bright students who who are motivated by those those drivers to actually come together I'm really interested in that I mean I am interested in the values and the fact that we are we have to think about the kind of societies we want to live in and we have to nurture them and it does go back to all sorts of kind of issues about how we keep our democracies democracies vibrant and there's a lot of concern as you say there's a lot of there's going to be some conversations around surveillance for example yes and how much of that we can tolerate them which clearly there's a lot of I guess a gassness that's a proper word or awkwardness around the whole social response you know what's going on in China the social credit system people can see that so there's anxiety about surveillance there's quite a lot more concern about privacy than I think we've we've been aware of and I can really agree one of the classic problems is that we've often said oh kids don't care they care enormously they care deeply and we've got problems like sextors say you know sexting you know evolving cultural behaviors and norms which you and I would find quite sort of strange or rather odd which are very common place and so we have to kind of address these things and so the downside of sexting is extortion yes and it ends up you know and they end up in databases where you know people can miss years and so it's there's a pretty scary from that point of view and so again that value how are we going to get that how are we going to reshape that lesson do you think I mean I think it's a really important point and I do think it's important I really do and I think this is the conversation we have to have nationally and I think we need to change the tone of the conversation if I just take a step sideways to Christchurch for a moment yeah yeah one of the things that has really struck me with that Jacinta Ardern's response I I am full of admiration because by coming back and showing empathy to people very warm secondly but what she's saying is this is not us now it's interesting because rather than coming down and saying oh my god we have to stop this she's saying she's actually empowering the people of New Zealand say step up and say this is not us we are going to exemplify better behavior and that it's a small thing but it's just a really different mindset from a leadership point exactly don't you think? And I think when we start having debates about the sexting, sextortion those sort of things again coming back and saying this is not us this is not the society we want to be it's simple things like that to actually just shift that thinking a bit it may not it sounds weak it may not be enough but I think it's also better than coming down and then just saying well here's a law because you also disempower people you risk moral hazard as a result because someone else will take care of that it's the collective advocacy broken windows problem no look like I mean I I do get that and indeed actually of course the the possession of the video and the manifest of course that's been controlled now for obvious reasons and then we get to the other side which is a game more in the law enforcement so someone has done something what are the what how do we how do we measure that what sort of evidence given that's going to be far more widespread can we build up resilience in people so victims are focusing more on the victims and resilience and they do what are they you know and indeed how do they how do they manage this at their own sort of individual ethical level I mean cuteness has to be given to Facebook I mean they did pull down pull down one half million videos and so on but of course Facebook is not fortunate yeah so there are lots of other you know players in that in that space yes but it does strike me as it's going to be a conversation difficult conversation we're going to have about how we're going to regulate social media as if it were because it actually acts like a media yes platform and I think it's I think confusing Facebook with say fortune is yeah it's pretty very very different totally different Facebook is a walled garden and even there they have any different control you know so the spaces that particularly you're looking at the dark web that's much more the wild wild west so yeah and I'm saying I'm really saying is that Facebook did respond I think responsibly but they've got huge challenges in the content area and we keep and that's why I do think in a way what governments have been government have been doing in the research area with AI and machine that'll all come into play I mean it'll take time yeah but I can see I can envision a space when we're able to kind of catch up yes in a way that we haven't been able to do before yeah I'm still optimistic but I I don't think we're going to stop Brevic number three or whatever you know I mean that's no it's a tough that's a tough gig isn't it yeah but I think with regard to the the AI we shouldn't avoid looking as the silver bullet I definitely it's not it's a it's over there's no question yes we're still working in what we call narrow AI right it's not general AI but it's still pretty it can be really helpful yeah and again those small narrow things understand that they're one of a suite of tools that will be looking at and so on as well rather than saying well we've got the killer app here well no it's not that yes