BOWLES, Mr David, Ethics Counsel, Queensland Law Society [by video link] McGILCHRIST, Mr Adam, General Manager, Product and Partnerships, Positive Salary Packaging [by video link] PARKER, Ms Jodie, Managing Director, Iceberg Events [by video link] RYAN, Dr Gregory, Director, Business Excellence, Water Services Association of Australia [by video link] CHAIR: I now welcome the witnesses representing small businesses and not-for-profit organisations to give evidence today. This hearing is a legal proceeding of the parliament. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. I really want to thank all of you for joining us today. We wanted to hear directly from small-business owners themselves and really appreciate the time you've taken to answer the survey but also to appear before the public hearing today. I now invite you to make a brief opening statement before we proceed with any questions. I should note that we did make sure that the survey responses that you provided were deidentified, so we haven't seen your specific survey responses, if you did want to also let us know the business that you have and your experience with any cybersecurity breaches that you're comfortable with sharing. Dr Ryan : The Water Services Association of Australia is the peak body for water and wastewater providers around Australia and New Zealand. Our members provide water and wastewater services to around 24 million customers in Australia and New Zealand and many of Australia's largest industrial and commercial enterprises. In terms of SMEs, we're looking at the organisations that supply to the water and wastewater utilities. Whilst the Water Services Association of Australia is one of those organisations, we've only got 20 people, so we're quite a small organisation but a not-for-profit. There are certain challenges in supplying for the water sector, given the number of utilities that are critical infrastructure entities under the Security of Critical Infrastructure Act, the SOCI Act. To provide a service that involves any injection of potentially sensitive business data from these organisations requires demonstrating a high level of cybersecurity consistent with the SOCI Act requirements, particularly looking to align with either the Essential Eight or ISO 27001, coupled with the need to be able to report a cybersecurity incident that could affect any sensitive data within 12 hours. There's quite a tight requirement there. Internally, we look to fund reliability, safety and resilience. That includes cybersecurity. This means we work to have appropriate policies and governance, aligning contract requirements with our suppliers, along with internal cybersecurity protocols, having a secure but highly reliable, robust and efficient system that enables the services needed whilst providing and meeting our supply chain requirements. It has a consequence of increased cost and effort to achieve these outcomes. We have only had one major cybersecurity incident, which was around 2016, which was a security lock of a number of our files. It wasn't anything significant in terms of confidentiality, but we were able to block that and just reload from a separate area from a backup, so it was not a major issue for us. But we are aware of a number of key challenges around the country. Mr Bowles : The Queensland Law Society is a professional member association representing the solicitors branch of the legal profession in Queensland. I can also give you some insights into the deliberations of the Law Council of Australia as the peak body, but only as a committee member. In Queensland, we've had approximately 10 years in this space. We have north of 13,000 members and we represent 2,900 legal practices. One thing that does surprise a lot of people is just the number of these that are tiny businesses, small and micro. Ninety per cent of Queensland practices are small businesses by almost any definition. The majority have fewer than 10 staff. But, despite that, we're at the peak end of the threat in cybersecurity because we handle information which is critically important, not just health information but financial information. Criminal practices may be negotiating on behalf of small drug dealers who are negotiating to supply information to law enforcement on big drug dealers. When something goes wrong, from an information security perspective, potentially people end up dead as a result of that, so it's critically important. Plus, even tiny practices with quite a small turnover and resource base themselves will be managing millions of dollars of other people's money, usually as part of property transactions, estate settlements and that sort of thing. So it's been critically important to us. I've been told that I can have a little bit of extra time because our submission hasn't been supplied in full, so I'd like to outline roughly what we did starting 10 years ago; from our perspective, what worked and what didn't; the conclusions we drew from that; and where we're at now. So I'd ask for your indulgence for a minute or two there. Ten years ago, the Queensland profession had a really significant BEC and funds diversion problem. We were looking at as many as four incidents a week. Our response was, in essence, to form an expert working group and concluded that, other than putting together an insurance package and expert support once the incident had happened, the most useful thing we could do would be to create a comprehensive maturity model designed specifically for our industry and try to get the smallest businesses, which might just be one person and a laptop up to 10 to 15 people trying to operate with very unconnected legacy systems, to align their resources best with the first steps that they should take. A majority of the firms don't have internal IT teams, let alone security teams, so there wasn't a lot of point to just giving people a checklist. We had to have implementation programs as well. And so we designed those to take every single one of the smallest practices through a 14-week remediation program, starting with just finding where all of their relevant data is and working up to some form of reasonable maturity. As part of that, we had a pilot program, and we nursed 100 firms through that very extensive handholding and implementation assistance back in 2016, 2017 and 2018. At that peak we got as much as a 55 per cent completion rate, with another 20 per cent who probably got enough benefit out of it to call it a success. That was promoted heavily through our education program. Surveys of our members show that they are acutely worried about this issue, but the key for us is taking that worry and concern and translating it into positive action. I can go along to an hour-long conference and I don't have to be particularly inventive. You just read out the last three horror stories, and everybody is looking back at you in stunned disbelief. They go home with the intention of doing something about it, but unless they've got a really clear step-by-step pathway that says, 'Start here, then go here and then go there,' it tends to lead to paralysis rather than actual movement. Lessons learned for us: basically we regarded that project as an initial success but an ultimate failure, because we were unable to build an implementation ecosystem that meant it would fly as soon as we took the training wheels off and stopped holding individuals' hands. Essentially it was a chicken-and-egg problem; we couldn't get the industry sufficiently engaged in our process. Without that industry engagement with people who could find somewhere that worked in that space in their local town and could come out and help them out on the ground, effectively we were really just sending them a checklist and then nothing much would happen. So the lessons we learned from that: telling SMEs to go and get outsourced assistance without a really clear pathway tends to just lead to paralysis. We talked to a lot of managed service providers and asked: 'Would you like to come and work with our people? Working for lawyers is great; you'll really enjoy it.' The response was generally, 'No, we don't like working for you guys at all, because I spend the first week of our engagement fighting with you as a client to try to explain what the problem is and what you need to do about it, and you're suspicious; you think I'm upselling you.' As a result, they would really prefer to spend their limited expertise and resources somewhere other than on a tiny law practice. A maturity model without detailed implementation assistance works, but only to a very limited degree. We found that we made the initial stages too ambitious, and that didn't improve outcomes; it just led to people being upset and adding that to their general feeling of being overwhelmed. Even a cleaner pathway that's inappropriate to the business size is equally unhelpful. Awareness training is useful, but the role-based specific training was essential in a specific context. And I think most of your witnesses today would stand by the idea that you can't simply buy your way out of a cybersecurity problem, especially for small business. The security foundation, education and tailored processes are just as important, if not more so, than the actual technical controls that are protecting your email system or the patching or anything else. Where we got to from there was a not-for-profit called DSI. They publish SMB1001, which is a small-business maturity model. From our perspective, the great advantage of it is that it has a commercial implementation and certification ecosystem that has emerged around it. We found that preparing the model and the implementation stuff and the support material was the easy bit—getting that commercial infrastructure, a person they can call and get along to get past those initial difficulties with implementation. That was really the critical difference. In terms of what we see as emerging problems here and moving forward, there's a multiplicity of competing expectations from insurers, regulators and gatekeepers to electronic transaction networks. Some of the expectations and lists of things that they're asking of their small-business participants are in fact quite contradictory, and that's leading to fundamental problems where you've got one regulator saying they want you to take copies of passports and another regulator telling you you're not allowed to. It causes a great deal of stress and anxiety. There's no national consistency, so a law firm that wants to practise in Queensland and Victoria has two contradictory and antagonistic lists of obligations, for example. The recent removal of the Privacy Act small-business exemption for law firms that are providing professional services that are designated services under the AML/CTF Act has added a lot of uncertainty and stress—adding yet another regulator in the picture. And, of course, there's the general blowtorch of new regulatory demands from other areas, leading to management paralysis. In our case, an increasing number of small firms are just saying, 'This is too hard,' and they're walking out of regional towns and away from the more heavily regulated areas of practice. That's what we see as the current regulatory challenge. Thank you for the indulgence of the slightly longer period to introduce the journey of what brought us here. CHAIR: Thanks, Mr Bowles. I appreciate your frank explanation of what you've seen occur over the years. Can I just double check: will you be making a delayed submission, or is this public hearing— Mr Bowles : If you think that would be helpful, I can put some notes together, yes. CHAIR: I think that would be very helpful, if you wouldn't mind, and we can see if we might be able to just extend that due date for you. Thanks very much. Mr Bowles : What would be the due date? As a lawyer, I'm very good at ignoring them anyway! CHAIR: I will just quickly check. I will invite Ms Parker to provide her opening statement, and I will find out about a due date for you. Mr Bowles : I can coordinate that with Talis afterwards anyway and save the committee's time. CHAIR: Yes, okay, great. Ms Parker, I'd invite you to— Ms Parker : I have a number of businesses that are within the business events industry. I have a conference management business, I have an association management business, and I have a teeny tiny travel agency that only services things to do with the other two businesses. I've got 10-ish staff; we're recruiting at the moment. Throughout that, we manage seven different associations—smaller associations, not as big as the Law Society but little associations—and we probably run 20 to 30 national and international conferences per year, in Australia and sometimes overseas, on behalf of different clients. The sizes of the conferences range from probably 200 to over a thousand delegates, depending on what it is. I've been in business, personally, for 30 years now. Lots has changed in the events management sphere in that time. We've had several instances of attempted hacking and phishing in the business. I can't tell you how many times my staff's credit cards get hacked and I have to shut things down and call banks and do that kind of thing. My identity was stolen a couple of years ago, when my personal details were leaked in the Medibank and Optus breaches, and the person who did that managed to open another bank account in my name and change the email address and mobile number on my business bank accounts before the fraud team shut it down. Nothing happened in the end, but that was a super stressful couple of hours for me. Internally, here, I think we're really aware of cybersecurity. I was in a peer-mentoring business group for businesswomen years ago, and we did this as part of the exercise within the peer group, where everyone set up password managers and we locked all that kind of thing down. Here, we use a password manager. I'm super strict with everyone. They use randomly generated passwords on everything. We don't reuse passwords for anything. We use two-factor authentication on everything that it's available for. All of this is unbelievably onerous for us, but I think it's necessary. We also have issues where presenters at conferences that we run are targeted. If we have an event website up that has the keynote speakers there, those keynote speakers will get emails that look like they're from us, when they're not, saying, 'We're here to sort out your accommodation—just send us your credit card details and we'll do that,' and then they get scammed, or they have been in the past. We warn them not to do that now, but that has happened. I've had the same email address since the nineties, because I've been around for a long time, so it is everywhere, on every dark web thing everywhere. I'm on Equifax, so I get alerts about it coming up all the time. My staff regularly get emails that look like they're coming from me, asking them to buy gift cards or authorise payments or that kind of stuff. They all know to ignore all of those kinds of things. We had an incident a couple of years ago where someone quite convincingly duplicated one of our event websites and set it up on another ticketing platform, so we had a whole lot of people turn up at the event thinking they'd bought tickets to the event, but they had been scammed. They paid for it through some other website, and we had no record of it. This stuff happens so often in this industry. The boards of some of the associations that we manage regularly get emails that look like they're coming from the treasurer, for instance, to the president saying, 'Authorise this,' and then they email me and say, 'Is this for real?' and I'm like, 'No, that's not for real; that's not how we do things.' So, yes, it feels to me like there is this constant unseen threat hovering around the outside. My IT provider tells me that we have something like 6,000 attempts to hack into the server per hour. They tell me that regularly, and that's my teeny little server in a teeny little place in Brisbane. Anyway, that's what I've got to say. Thanks for the opportunity to tell you. CHAIR: Thank you so much for being so honest with what you have experienced. This is precisely why we really appreciate the time that you've spent speaking to us, because hearing firsthand exactly what you're having to put in place but also what you're having to experience is really valuable. I know that we'll have a whole bunch of questions for all of you, but I'll just invite Mr McGilchrist to give the final opening remarks, and then we'll go to questions. Mr McGilchrist : I'm general manager of product and partnerships at Positive Salary Packaging, and I'm appearing today on behalf of the business. PSP is an Australian novated leasing and salary packaging provider. We're headquartered in Brisbane, with offices in Melbourne, Adelaide and Hobart, with approximately 52 staff at the moment. We work for employees across multiple state governments, local governments, mining and corporate service industries, and we handle their employees' payroll deductions, bank details, vehicle finance, and personal financial information and identification documents. For a business our size, that actually makes us a target. It means that our clients actually hold us to a very high bar. Over the last few years, we've made cybersecurity a core part of how we run. We're certified to ISO 27001:2002 and audited by BSI. We complete independent ASAE 3402 control audits every year on cybersecurity for our government contracts, and we're working towards and finalising our Essential Eight maturity level 2 over the coming month. Staff do monthly awareness training and regular phishing and phone scam simulations. Until recently, we've relied on a virtual CISO and a managed detection service. We've now, just in the last month, hired our own head of technology to work alongside that virtual CISO and strengthen our network and our cloud security. I want to share three small points from that journey. First, it's expensive and slow for businesses our size. It took us approximately six months and roughly $60,000 to get certified for ISO, before the ongoing cost and the cost of keeping regular audits and keeping that framework in shape. Much of that effort is actually in documentation rather than protection. Second, the real driver wasn't government guidance; it was our customers and our funders. Large employers, banks and government buyers now ask for an ISO 27001 certificate or a SOC 2 type 2 before even allowing you to tender, let alone contract. We've seen smaller partners locked out of work because they simply couldn't show this level of security or detail. Third, none of the frameworks actually line up. We enter ISO, Essential Eight, bank third-party assessments and client questionnaires that all ask exactly the same things in different ways. A common tiered framework set by industry and turnover would make far more sense. Our view is that any business holding customers' personal or financial data should have to meet a minimum security standard—maybe not a full ISO certification but a clear, proportionate baseline with practical support to get there. Thank you. CHAIR: I'm really grateful for all of your time today. One thing that has really come up quite clearly in many of the submissions is making sure that there is industry-specific advice that is provided. There's the general advice and training that's available on cybersecurity, but we should be making sure that it is industry specific, and it's great that you are all in very different industries. You have all invested significantly in training your staff and making sure you've got the systems in place. How much of that is regulation in your industry and a requirement of government, and then how much of that—like you said, Mr McGilchrist—is something that is placed on the industry if you want to be part of supply chains or if larger businesses are asking for it? I'm trying to gauge from each of your industries where there is strong government regulation, like with the SOCI Act, or where it is more a cost of doing business. Would anyone like to go first? Mr Bowles : Yes. From the perspective of most smaller Queensland law firms, it is almost entirely client demand which is driving this. As a fundamental professional obligation, we obviously must protect client confidentiality, so we must use reasonable steps, and there's no really effective definition of what that is. The new APP 11 regulation that will be visited on us by the Privacy Act changes also requires reasonable steps. But I think if you really want to get a small business moving it's the fact that there is a tangible benefit to you doing so in terms of client acceptance and the ability to say—in our case, one of the reasons we like the SMB product is that they can hold up a certificate instead of filling in one of those 25-page forms again and say, 'We've certified to this particular standard.' That satisfies a good many retail clients. Dr Ryan : For the water sector, it's similar because essentially it's the water utilities that mandate what you must do. Yes, you should need to align with the Security of Critical Infrastructure Act, but that's [inaudible] for their contracts. So, if you want to do any work with them, you establish the contract, and their contract will say, 'You must meet ISO 27001 and you also need to get a certain level of the essential eight.' Then they also say: 'These are some of the things you need to do. If we give you sensitive either private data or SOCI Act data, then you need to have a whole lot of things that meet the requirements, can report quickly and can make sure that everything's secure, you've got regular updates and you've got regular reviews of all your data and applications. There's a lot, and it's fairly onerous for each of the suppliers to be able to meet all of that. But, if you don't meet it, you can't even play the game. So there's a lot of expense, time and work. As was said by David earlier as well, for smaller organisations, there's not the ability to do this all internally. You need to engage a third party to be able to do all the work, to set up all the applications, to do the reviews and to set up security aspects that make sure there are updates and make sure if there are any problems it's all notified. There's a lot of work and cost to get that done, but it generally can't be done internally until you get to a certain size, because it's not within your scope. You need very strong experts in this, and for smaller organisations they're not really the people you have. Ms Parker : I'm going to say that the events industry is not as heavily regulated as any of the other organisations shown here. I've just done all of that because I've had to; otherwise, I'd get hacked. I don't know how to not do it. Unless I'm tendering for government contracts, which I don't do very often, nobody's asking me what the security measures are, because most of my clients are smaller associations. They're volunteers. They're not asking. Mr ABDO: Sorry, Chair, can I jump in for one second? CHAIR: Go ahead. Mr ABDO: Ms Parker, considering you're in an unregulated industry, are you taking these steps because you've personally been impacted by it, so that's where your thinking is? I just want to know what made you want to set these parameters. Ms Parker : Well, to a degree, but I put the password management stuff in place before my identity was stolen. We'd had probably some minor phishing attacks. But I put that in place beforehand because I was in a peer-mentoring women-in-business group, and it was something that we did as part of the exercise, because the woman who ran that group thought it was important and she told me that I really should. That's the only reason, I think. But I'm glad I did. It happened anyway, but the fact that I had that in place probably mitigated that significantly. It could have been a lot worse. Mr ABDO: Thank you. CHAIR: Mr McGilchrist, you said a 'proportionate baseline with practical support to get there'. Can you describe to me what 'support to get there' would look like? Are you envisaging support from government or support from the businesses that you are supplying into? Mr McGilchrist : All of our demand is being driven by our customer base. It's never been formalised by government within our industry. We are semi-unregulated. We are regulated by certain sections of government in different parts of it, but not completely. A support level or even a standing that clients [inaudible] could use would be fantastic. Similar to the Australian Made logo, it could go on to websites if business is made to a certain standard. I know I would change my purchasing habits if I knew that my data was not held within this country or in a secure environment. This change has already been made and put in place in Singapore, I believe, in 2022. It would be highly important for the Australian public to be able to see whether their data was actually being kept on an offshore server. I wouldn't want my data kept in the US or Japan or a European nation without my consent or knowledge. I'm now very conscious of where I shop and what organisations I give any form of data to. The amount of hacks and scams that we've seen over the last six to 18 months is [inaudible] been personally affected. I've seen that increase dramatically. If I knew where my data was being kept and it was at a level of standard that government had across industry and business, I think it could make a difference to how we purchase—and reward the organisations that are going out to do this. It becomes the ticket to the sale, in theory. CHAIR: I've got a couple more questions, but I'm going to invite my colleagues to have this as a free-flowing discussion, because I suspect that, as people raise issues, that will spark questions. Mr Abdo and Ms Clutterham, feel free to pop in at any time if you've got questions. One of the things I wanted to ask about was the resilience piece. Ms Parker, you mentioned, after there had been a breach, the work that you had engaged in to get your business back on track. Mr Bowles, I think you said there had been similar incidents which made your organisation decide to pursue an uplift in cyber maturity amongst all your members. I would like to hear about what you do once an attack has happened, because, given the rate of attacks that are occurring, the prevention piece is very important. But how do we make sure that, if an attack happens, businesses are able to survive that? So I'm keen to find out where you go for advice once an attack has happened, and what do you need to be able to get back on your feet again? Ms CLUTTERHAM: Chair, can I just jump in with a question that's quite similar to that. I would be interested to know if anyone has done a crisis management exercise with an external provider. I know there are companies out there that will come in and they'll do a mock hack or ransom exercise with a business to find out where the gaps are. I was involved in a couple of those in my pre-politics career, and, to be honest with you, they exposed massive gaps in the organisations that I was with, particularly about what you do—where do you even start—when something like that happens. I'd be interested to know if anyone has done that and, if yes, whether they saw merit in that. Mr Bowles : Sure. Would you like me to address those two points? CHAIR: Yes. I'll go to you, Mr Bowles, and then Dr Ryan, who also had his hand up. Kick off, Mr Bowles. Mr Bowles : The only solution we came up with in terms of getting members the critical assistance they needed post breach was an insurance product. We went out and bought every law firm in Queensland 50 grand worth of cyber insurance, which is first-party cover that goes on top of our existing PI cover, which only looks after third-party risk. That's being called on again and again and again. Fifty grand is very much at the low end. We're starting to see incidents now where that's not really covering all of the costs. I think the key point was that it bought access to small-business members for a really effective response panel through Chubb, who's the provider for us. Previously, they would ring up at 10 to five on a Friday afternoon, when these things always happen. They would say, 'I need critical assistance,' and the answer was either, 'Sorry, we're too busy,' or 'Sure, put $20,000 into our bank account, and we'll send someone out.' That was completely beyond the realm for most of these small practices. Not only having the money there but having access to the panel was critically important, and I don't really know how we would have got through the last 10 years if we didn't have that in place. In terms of—actually, sorry, I'll let anyone else have a comment first. CHAIR: Mr Bowles, in order to get that insurance product coverage, did the small businesses have to demonstrate increased cybersecurity measures that they were taking? Was there some sort of certification that they had to go through in order to qualify for the insurance product? Mr Bowles : No. We were able to negotiate and purchase a group policy. That has automatic acceptance. A lot of premium pressure has come on that. That's, again, one of the reasons why we're looking at a certification standard. It's so that we'll be able to, perhaps, run a two-tier system. We'll say, 'Okay, firms that aren't certified get 50 grand minimum cover; if you can show that you're certified up to a gold standard then the insurer will give you another $50,000'—or, potentially, I think a lot of the insurers are accepting that SMB standard now as a de facto reasonable standard to qualify for higher levels. Certainly, it has been a real struggle, and it's taken sometimes months and months of negotiation through top-end brokers to get that group policy. They're really quite rare now. I think, if we didn't have one in place, we would struggle to get that now. CHAIR: Dr Ryan, I'll invite you to respond. Dr Ryan : We've been working with a third-party provider on the software. They're monitoring 24/7 using some AI assisted software such as Tenable to look at whether there's been a compromise or a change in things within our system and then can get an alarm and then do a deep dive to understand if it has been a cyber issue or not. As soon as you've identified a potential cyber issue, you stop internet connection—external connection—and look at what you need to freeze. That's one part they're doing. Then we have data backups. If the system has been compromised, you want to know what has gone out and if there's any sort of information that at risk. Then being able to inform the right organisations is fairly onerous because it has got to be quick. Once you've understood that, you need to then be able to do a quick restoration. We found that data backups and doing it via cloud-type approaches can be done within an hour or two. You've got that rapid way of resetting things. That's how we're doing the resilience side of it, and we test it, but we haven't done the pen testing and the crisis management. We have that as a mock-up. We've become a member of the Australian Signals Directorate—the infrastructure protection service type stuff. With the chips, they do an assessment of our systems every quarter. They look at how risky certain parts are, they identify what they see as the areas that are not consistent with the rest of the country and they also provide you with the trend every quarter, so they can show how you're increasing or where you're getting worse. And we find that extremely useful to making sure our system is resilient and showing how it's matching with others—that are serving under the SOCI Act, at least. CHAIR: Mr McGilchrist, and then Ms Parker. Mr McGilchrist : In regard to the earlier question, we test biannually from a business recovery and data recovery component. In doing that, we actually let our MSP—where our virtual CISO is—sit in and test our systems, and test and run through simulations of a data breach and what it would mean to our business—what it would mean, for example, if we had a massive weather event, from an IT situational standpoint. But also from a data breach—if we had a laptop, for example, that was lost on a bus, what would that actually mean to our business? I know these are really minor things to go through and test. What would happen if one of our SaaS platforms were compromised? How could we get up and running? We run on a Salesforce platform. In our Salesforce platform we have nine instances, of which all are backed up on a 24-hour basis, 24/7. We're lucky enough because we're spending our budget against that, but I know many of our competitors in the market aren't doing anything along those lines. By not testing these sorts of things, we're leaving this to chance with our data sitting in these organisations. Something has to change in the way that we view this and how we value it as customers. It would actually make the investment in this sort of technology for these companies—it would become, as I've said earlier, the ticket to the sale. I wouldn't want my money going to a company—where I had the choice of two, and they were both the same price or similar price, I would be using the company that was keeping my data safe, that was doing annual testing and that had some form of watermark on it from the government saying that this organisation meets requirements. CHAIR: The point that you raised about having that kind of check mark is something on which the work is underway, as part of the CyberSmart program, with that trust mark. It'd be, I think, really helpful to figure out what the requirements would be in order to get that trust mark—requirements that would be proportionate to the industry that you're in and the information that you are holding as well. Ms Parker, I invite you to speak. Ms Parker : I have an external IT provider who has a 24-hour helpline, and they come and do maintenance. Every month, they come into the office and they check everybody's laptops, and they do maintenance from their office as well. But, if ever something happens, I call them, and they shut everything down until we work out what needs to happen from that point. So that's all I do: I call them and they shut it down, and then we work it out. We haven't had anything that is that serious. I haven't had ransomware; I haven't had anyone do anything like that. We've just had ones where one of the staff has clicked on something, and then someone sent emails to everyone on your contact list. They're just kind of annoying—trying to get in in backdoor kinds of ways. I've never done a simulation thing—to that question. I wouldn't know what that would cost. It sounds like it would be cost prohibitive. CHAIR: Can I ask: have you got cybersecurity insurance? Ms Parker : No, I don't think I do. I just looked, actually, while you were talking about that before. It's an extra on my business insurance that I don't think I'm covered for. I'd rather prevent it, I guess. CHAIR: Yes. Mr McGilchrist, go ahead. Mr McGilchrist : We run a cyber insurance program. It is not cheap. We're required to have $5 million worth of coverage to be able to work on state government policies and programs. That costing is, for an organisation of our size, upwards of $50,000 to $60,000 per year. It's not a cheap option anymore to have this, compared to what it was maybe three or four years ago. The cost is astronomical. CHAIR: So that is in addition to all the other business insurance—an additional $50,000 to $60,000? Mr McGilchrist : Correct. It may be because of the type of data that we're dealing with that we're a higher risk, but it's not to do with our programs and the way we are. We run a fairly high Microsoft security score. All of our data is kept within the country. We have event monitoring on Salesforce. I can actually tell the GPS location of an individual when they try to log into the system. We've got fairly stringent standards. Everything is beyond MFA. It's now gone to biometric, as we're moving on to Essential Eight phase 2. And I'm still looking at a $50,000 to $60,000 policy per year, just so that I can actually compete and work on state government contracts. CHAIR: And in your discussions with your insurance mortgage broker or the insurance company directly, is there anything you could be doing to reduce the premium? Mr McGilchrist : Yes. As we reach, for example, Essential Eight phase 2, that will help bring that premium down, but that's only really then covering the cost of your policy increases each year. It's not dramatically decreasing it. We've already taken significant steps. If you're not up to scratch or up to standard, in the common language, you will simply not get a policy. It's not something that can just be offered willy-nilly to anybody. They are very stringent as far as cyber questionnaires and those sorts of things, and it's normally about three-to-four days worth of work to prepare them each year. It's significant work for us, as an organisation of our size, to be able to do that. Maybe if we had 500 or 600 people employed, you would have a full-time department looking after these sorts of things. But our organisation has gone from me being in my spare bedroom five years ago, as a business, to employing 52 people. It's become a significant part of our work. It's become a core decision-making process. In every single new piece of software that we take on, with every single new business contract, security becomes probably 30 per cent of the weighting on every decision. CHAIR: Great. Thanks very much for sharing that. I'll invite to ask some questions now. Ms CLUTTERHAM: I just had some general questions. They're not directed to anyone in particular. We just heard from a couple of witnesses this morning about the need for improvement in communications from government to small business. For example, when there's an incident, like the OpenAI hack of Medicare and last week's Optus hack—I think there was another, maybe a Qantas hack or something like that—and when these large-scale incidents happen, we heard that small businesses are often left in the dark about what that might mean for them, how they might be impacted and how their customers, supply chains and employees might be impacted and that there was a need for greater, improved communication. Do any of you share that view? I realise you're representing businesses from across industry, but the evidence was given from a chamber of commerce or business advisory type group representing a lot of different stakeholders. Do any of you share the view that communication from government to the small business community when there are cyber security events is poor and needs improvement? Mr Bowles : I would be very careful about calibrating a fire alarm that's going off all the time. There's already an enormous amount of information which comes out, and unless it's directly relevant to your technology stack or your particular industry, I think it would rapidly lead to just being one of those million emails that sits in your inbox, doesn't get opened and ends up in spam. Yes, have industry specific warnings, but I don't know how you calibrate that appropriately to a mass email or communication strategy. Ms CLUTTERHAM: Does anyone else have a comment on that? Ms Parker : Yes. I probably feel like that already. Every time there's some kind of notice about yet another hack, I just roll my eyes and go: 'Oh, okay, whatever. Let's see what happens now.' I don't expect that would come from the government. I think that should come from whoever got hacked. Ms CLUTTERHAM: I think there are a range of views about where that communication should come from. I see another hand. Dr Ryan? Dr Ryan : There's another bit that I find a challenge. If you're not a technical expert, trying to respond to some of these things is really hard. So, when we see this stuff, we tend to just give it off to the third-party provider that's doing the security for us. Honestly, if it gives me, 'You've got to modify this little thing or that little thing within the technical bit of the apps you've got,' no, I go for the third party. So the key people who would need to be informed are probably the third-party providers that support us. They can then act straightaway, whereas we'd have to react to them, let them know and get them to address it, and that can take half an hour or an hour, which may actually be a problem at certain times. Ms CLUTTERHAM: Yes. That would be a financial institution, like a bank or something. So, if your company accounts get scammed or hacked into or something like that, you would be relying on that financial institution, as the intermediary, to identify that and take steps to resolve it, rather than hearing from government, right? As you say, that's going to take an eon, and you've got to deal with the problem straightaway. Do you feel that financial institutions are providing the right level of support to small businesses when it comes to cybersecurity? Are they identifying suspicious transactions, cancelling cards, putting blocks on cards? Is it a good level of assistance? Is it getting in the way? Is it too conservative? What's the view of the group in that sense? Mr Bowles : I think we can easily overdo it if we essentially shift liability onto providers such as banks. Their payee verification has been great. There's been a dramatic improvement, and I notice that didn't happen until you guys got the chainsaw out and started to threaten to remove bits until they did it. That has led to a significant decrease in scam transactions, but I think it's going to be really easy to overregulate, to the point where it takes half an hour to transfer a small amount of money. I don't know that that's going to dramatically improve the outcomes for consumers, and I think it would be very easy to cross the line into performative regulation. Ms Parker : I think my bank, particularly, did an amazing job of flagging when my identity got stolen, because I was trying to call them to say, 'I think something's happening,' and they were calling me on my mobile simultaneously. I spoke quite a bit to the fraud person, and they told me what they were doing. I have no idea how they were managing that. There must be millions of those things happening all the time. I transfer a lot of money around on behalf of clients and that kind of stuff, and I bank with all of the banks. I'm with all of the banks. The fact is that the name of the account comes up now. Why wasn't that a thing a hundred years ago? I don't know. That's made a major difference, I think. Ms CLUTTERHAM: Yes. So it's small steps. Mr McGilchrist? Mr McGilchrist : One of the major things that's happened over the last couple of months that I believe has put a dent in cybercrime has been the simple fact that the federal government has regulated sender listings on text messages through the ACMA. It's been fantastic. We utilise the service here. We are able to send text messages to clients to let them know account balances and those sorts of things, and they're not questioning that. Instead of calling us now to ask, 'Is that actually true?' they're able to believe the text messages that are sent to them. That's been a federal government initiative. It has taken some time to come through. But I personally believe that, in coming through, it's a godsend. It's hats off to you. To echo a few of the other people in the meeting today, I will say that, within banking applications, having the other account name and bank account come up—because you've actually pushed banks to have this—has made a difference as well. Sometimes, I think, you may have to wield a slightly larger stick with some of these top 100 ASX organisations to make them comply, but it's to the benefit of consumers. Ultimately, if we keep on running around and hearing about every small business that's had a hack, it will eventually just fall on deaf ears. I think Mr Bowles mentioned that, firstly, if that comes out repeatedly, it's just going to go over the top. But, if major top 100 or top 200 ASX listed organisations are having a hack, I believe it needs to go to the public immediately, because it's more than likely they're that size because the majority of the public or businesses are dealing with those organisations—for example, the Qantas one that happened. That was off a Salesforce based data loader issue. Most of us use the national carrier at some point during the year. Having that brought to the public's attention—it's important. Ms CLUTTERHAM: I have two other questions. Firstly, in your respective industries, how do you currently get your best-practice information? If your local chamber of commerce, business support group, business advisory group or whatever holds a cybersecurity briefing, a networking thing or a seminar—whatever it might be—do you go? Do you find those types of events valuable? Do you discuss them with—Ms Parker, there might be other events businesses there or other law firms. Do you find that to be a valuable source of information, not just from whoever's presenting but from your peers? Is that something worthwhile? Ms Parker : Yes. Absolutely. I'm a member of the PCOA, which is the Professional Conference Organisers Association, and ABEA, the Australian Business Events Association. Both of those run special interest groups for owners of events companies. We all know each other; there are not that many of us. At those forums—usually at the national conference—there's a special interest group side session for business owners that I always go to, where people talk about things that have happened like that and flag that it's a thing. The thing I talked about before, about keynote speakers getting targeted, came up at a conference one year because it was happening for all of us. All of the conference event pages that were up and all of the speakers were getting targeted for that kind of thing, so it made us all put warnings on all of the websites to say: 'We won't call you. Don't do this via email.' Absolutely. Ms CLUTTERHAM: Does anyone else have a view on that? Mr Bowles : We run pretty much a constant education program. Most solicitors would encounter a specific cybersecurity training session at least once or twice a year. That's nice, but it doesn't really move the dial in terms of fundamental changes within the organisation. We as a professional association have tried to get people to come up to these things and then go home and actually do stuff. You do end up with a little bit of a 'preaching to the choir' problem in that it's the organisations with the best maturity that will come and spend the two afternoons to get a really detailed analysis of what they need to do, so I'm not sure that it's necessarily something that we would think we could get complete penetration on. Make it as easy as possible. Have different formats. It's lovely to have people in the room, but, if you can't, have a webinar or on-demand materials that people can download at 10 o'clock on a Sunday night when this problem wakes them up and spooks them. Having as much as possible simple introductory stuff, and then moving through the progression, has been basically the only solution that we can come up with. Ms CLUTTERHAM: Mr McGilchrist, did I see your hand go up? Mr McGilchrist : Yes, certainly. The local chamber of commerce and these sorts of organisations will work for a small business. Once you've reached a certain size or turnover, though, the information that you're going to be able to receive that's digestible in that room is nowhere near what is required. The local plumber who might have three staff members, who needs to make sure that his bank accounts are safe and that he hasn't accidentally sent his client list or his latest Xero export to somebody else—that level can be done through the local chamber of commerce, but there probably needs to be more. We've built AI listing tools out into the marketplace to actually go off and look for these sorts of things that are happening across our industry and find out what's happening instead. It's one of the steps that we've taken. We're a fairly large tech-orientated organisation, but we've gone off and done that because there probably isn't enough information coming out there. Some of that is dismissed each morning once it's read, but, at the end of the day, it is there for us to read and go through. We then also attend multiple conferences each year in regard to this. We have meetings with our different providers. We use Huntress as part of our endpoint detection, and read reports through from there, and meet with the different representatives of those different organisations as well that work in that software space to make sure that we're completely up to date as much as we possibly can be. Ms CLUTTERHAM: I have one more topic that is probably mainly directed at you, Mr McGilchrist, based on something you said earlier. We've heard from a few people today that there is a bit of a gap between what is a contractual requirement with respect to cybersecurity and cyber resilience if you want to win work and do business with government and what small business is actually able to achieve. You said before that a $5 million cyber insurance policy costs you an extra 50 to 60 grand, and that was a requirement—you have to have that or you're not going to have a seat at the table with respect to winning that work. Do you have any other examples of contracting requirements that you see being imposed on small business, and where there is a gap between what is required and the stage that small business is generally at? If you do have examples, are they good requirements, are they productive requirements or are they risk-averse, checkbox-type requirements being sought to be imposed on small business? Mr McGilchrist : I've actually got an example of a federal government department at the moment that's gone out to tender. It has now currently asked for a $20 million cyber insurance policy. That is four times larger than the Queensland government and two of the other state governments that we look after, and this is for a department that only has 500 people. There seems to be a point here where some organisations haven't actually read the room in what this costs and what it costs to maintain, and it becomes a checkbox exercise for them to think they're covering themselves when they don't actually understand what the market and what the cost behind this actually is. There was a certain state government department that actually went out with $10 million worth of coverage and then got that much pushback that they didn't actually have people apply for the tender unless they dropped it because the cost level was so high. But to have a federal government department come forward and ask for $20 million—four times the amount of the largest US novated leasing organisation in the country, which is the Queensland government—for a staff of 500 people, there may be some points here where the federal government is somewhat out of touch when they're going to market for these sorts of things and the requirements and levels that are actually genuinely needed. Ms CLUTTERHAM: It seems to me that it's getting into the territory—Mr Bowles, you'll probably appreciate this—of liability caps, where everyone puts in that the liability cap is the value of the contract, even if that doesn't actually reflect the risk. It's just a very risk-averse, one-size-fits-all approach. From the sounds of it, if everyone was being asked to have a $20 million insurance policy on the remote off-chance that that would be the quantum of the loss of any cyber incident, that would be prohibitive to businesses even bidding for work. Is that right? It will be the same people who can afford it. It will impact on competition and the marketplace et cetera. Mr Bowles, did you have your hand up? Mr Bowles : I did an analysis a little while ago of all of these different contractual and pay-to-play obligations that affect small law firms, from the insurers and from electronic network operators such as PEXA. Most of the court websites now each have a little page somewhere that says, 'Here are your minimum cybersecurity obligations.' I ran out of steam, basically, when I got up to, I think, 15 different standards. Some of them are really useful, and no-one would argue that the steps you've been asked to take are sensible. One of the problems is that the biggest players in this area are all from government, and they really can't get their head around an organisation that doesn't have a thousand people in it. They really struggle to scale down to what they define as small business. I've been going to a great many of these conferences over the years. You talk to the regulatory staff and then the people who are ex-regulators and now working for the vendors and say, 'Okay, how do you go about working with small business?' They say: 'We love small business. We can go down to 100 people.' You just go: 'Mate, that's just—it's not even where we need to start. How do you go with five or 10?' They go, 'Well we can do it, but the cost per seat is going to be ridiculous—sorry, not very helpful.' It's just the complete mindset problem, I think, for people that are sitting there drawing these up. And it's unfortunate. You do have to leave significant risks in the ecosystem, because, if you try and remove all of it, then, effectively, you'll have three or four people who can potentially participate. And, if you look at it from the perspective of the person who's sitting there drawing up that list, who's possibly going to be held to account three years down the track when something goes wrong, everybody gets very, very risk averse. So I think having a little bit more of a centralised starting point—all of this is calibrated to the fact that we're dealing with tiny, tiny businesses, up to 200 or 300. I think that's going to be a really useful resource. Ms CLUTTERHAM: Yes. And I think it's looking at the risk and looking at the possibility that the risk will actually crystallise. There's a step that's being missed. Mr Bowles : Yes. There's always a question. If you do one thing, you're not doing something else. CHAIR: I think Dr Ryan had his hand up. Dr Ryan : Yes, I did, thank you. To build on what we've been talking about there, for the water sector it does depend on what the use of the data is. If you've got someone who's just doing catering, they're not going to have cybersecurity requirements. It depends on what they're doing and how sensitive the information is and also the assets they're providing. So, if they give you particular assets or services, it depends how sensitive it is and how much it affects the assets. Even there, they're not necessarily having a strict requirement on the level of insurance. The key requirement is on the practices and the management of the risk. So it's understanding—they generally have a set of criteria, particularly if they're under the SOCI Act: 'Here are the criteria you must meet.' If you meet all of those, then, generally, you're able to provide the services. That can be quite difficult for smaller organisations. Ms CLUTTERHAM: Thanks, Chair, that's me done. CHAIR: Mr Abdo, do you have a question? Mr ABDO: Is anyone aware of GDPR rules [inaudible] CHAIR: You're coming through really softly for me, Mr Abdo. Mr ABDO: GDPR rules in Europe—is anyone aware of them? CHAIR: Ms Parker and Dr Ryan, did you want to answer that? Mr ABDO: I guess my question is: if you are aware of them, do you think our Privacy Act is lacking on the [inaudible] Ms Parker : Sorry, I couldn't quite hear the end of that, but I'm very aware of GDPR because a lot of our delegates come from Europe. Our systems still need to comply with GDPR, because there are European people registering for our conferences, and the software that we use needs to be compliant with that. So we just are; we've just been compliant with GDPR since whenever it came in, which was pre COVID. Mr ABDO: Will you compare Australia's Privacy Act with GDPR rules— Ms Parker : Certainly, the GDPR rules are a lot more stringent. I'm not really sure, because I've just been complying with GDPR for—I don't really look at what the Australian rules are, because the GDPR rules are harder. Dr Ryan : I'm aligned with Ms Parker. We get third-party software to help us meet the GDPR. It is extremely strict I suppose it is stricter than the Australian privacy, including some of the ways you contact. My understanding is that you can't randomly go to an email that you have and then engage with them if you haven't contacted the person before; they've got to come to you first. So there are certain things about the protocol that are different in Australia, and it's less strict than over in the European Union. Mr ABDO: When you're using the software or whatever to comply, do you have a certain timeframe in which you have to remove the data that's been in use, or does software do that automatically? Dr Ryan : Generally it does it automatically if there's a requirement. Ms Parker : I don't think we need to remove them once they've engaged. Dr Ryan : It might be three or five years. I'd have to read through it. It's been a while since I've— Ms Parker : It's certainly been— Mr ABDO: So you have software where basically, once you input data, that software is meant to be GDPR compliant, so everything is assessed against those rules? Ms Parker : Yes. I think there's a double opt-in. They have to say, 'Yes, I want to be contacted.' It's not just that they don't tick something and they get contacted; they have to say, 'Yes, I want to be contacted.' It has to be specific. We also have to ask all those questions about whether they're happy for us to give their details to sponsors, for instance. Trade display people and sponsors of conferences often want contact details of the people who've registered, and they have to specifically say, 'Yes, it's okay for you to hand my details on,' whereas 10 or 15 years ago it just was a given. You registered for the conference; the sponsor got your contact details. That was just what happened, but that's not a thing anymore. Mr ABDO: Thank you. Mr Bowles : Sorry to interject. As a general observation, I think anybody who's got GDPR-compliant systems is going to find that the Australian Privacy Act obligations are met. There are, I think, some significant problems with making the Australian privacy rules consistent with GDPR. There's a significant economic drag that would come from that. One of the difficulties is that, when you draw rules that are designed to stop a mobile phone company grabbing your data and selling it off to somebody else and misusing it, it's really hard when you try to apply those basic rules and principles to a professional relationship. For example, if a solicitor draws a will, sure, you can say in general terms, 'You've got to maintain that record for seven years and then delete it, and best practice is that you don't have that information sitting around,' but then, in 40 years time, when a savage Supreme Court fight has broken out over the that document and whether somebody had capacity on that day and what their instructions were and what led up to it, it's really critical to have that information available as well. So, if you say, 'We'll just apply GDPR to all the Australian principles,' you will find, I think, that there will be some significant unexpected consequences of that. Mr ABDO: So, if it were to be, your view would be that there are certain sectors which, by the nature of what you're dealing with, would need to retain certain information? Mr Bowles : Yes. Sorry, you're very much breaking up. I'm having difficulty hearing a direct question, I'm afraid. Mr ABDO: What I was saying is that you're saying that, in principle, GDPR rules are good—more stringent—but with the view that certain sectors must retain information given the nature of their work. Mr Bowles : That's one of the issues. I think it would be an error to falsely equate 'more stringent' with 'good', necessarily. There is always a trade-off for each of these regulatory steps. Ultimately, yes, if you go and survey 100 consumers, they'll say, 'Of course I want my data held more stringently and more securely,' but then they've got to pay for it, ultimately, when you are imposing some very significant manual costs to go back. For example, in a solicitor's context, we might have files held from 100 years ago or 50 years ago—some of them—and, if you say, 'Okay, you've got to go back through every single one of those now and cull them to make sure that only a certain component of it is still retained,' that's a very significant cost for probably a very small incremental security benefit. So I think we need to be a bit careful about just automatically assuming that more security and more stringency are better overall. There is a trade-off. Mr ABDO: That's it from me. CHAIR: Thanks very much. Just before we wrap up, I wanted to ask all of you a question about how you engage the cybersecurity experts and the third-party organisations that are assisting you. Through the course of this inquiry, I've come to learn there's no real professionalisation of the job as such. There's nothing where they've got to go and get certain qualifications to be able to call themselves a cybersecurity expert. I'm interested in hearing all your different perspectives around how you find someone, because you've all done incredible work in trying to get uplift within your organisations, and you've done that through third parties and experts. What have you used to make sure that you are engaging with someone who's genuinely going to be helping your business? Mr Bowles : Maybe I can start. We often get the call from a firm, and they'll say, 'Find me a cybersecurity expert.' I was always very wary of that before. Again, I don't want to sound like I've got shares in them, but the SMB1001 commercial implementation group, which built up around that standard, has been very useful. They've all certified, so at least their businesses have a minimum gold standard before they can get on that list. I feel a lot more confident in sending people off, because at least there has been a rough certification process for the business, if not necessarily the individual. On how we choose them—we're very lucky, and I should acknowledge the incredible work that our working group has done. They're all top-of-the-line industry professionals, and they've been very generous with their time over the last 10 years. They've not gotten a cent out of it. If I've got an opinion, it's very much because they've given it to me. CHAIR: Dr Ryan? Dr Ryan : We've generally used recommendations from our peers—from similar types of organisations who've been using similar providers. We get recommendations from them. We will then go to tender, and we'll have clear criteria around cybersecurity that we use to assess it, as well. We also have ways of going through that. We have relationships with cyber experts or technical experts who can actually start to help us with the tender process. We can get them to assist with whether the people are meeting what we need. We find that quite useful. And then, when you find someone who's really good, you stick with them for a while. CHAIR: Ms Parker? Ms Parker : The IT firm that I use, I've been with for well over a decade. They are all humans that I've actually met in person. I would not engage a cybersecurity person that I hadn't actually seen in real life. In fact, I had a go at them the other day because someone from the firm sent me an email, and it wasn't a name that I recognised. And, because I constantly get all these phishing emails, I went back to them and went: 'I don't know who this guy is. I'm not talking to him until somebody tells me he actually works for you.' It would absolutely be a word-of-mouth recommendation thing. CHAIR: Awesome. Mr McGilchrist? Mr McGilchrist : It's all been peer reviewed for us. And once you find a good one, you generally don't leave. One of the things that a great cybersecurity expert can do for you is actually take the complex and turn it into simple. Sometimes your leadership groups might be operations based individuals that don't have a cyber or a technical background, working on Entra, AWS or something along those lines—one of those software programs. Having somebody who is able to make the complex simple will go a long way in getting buy-in from your workforce. Once you've found that person, you don't let go of them. Grab them with both arms. CHAIR: It sounds like a ringing endorsement of all your cybersecurity providers. I really want to thank you so much. You've provided some invaluable insights into what your organisations but also your industries are going through and what is a very complex and challenging issue. So thank you for your time today. If you have been asked to provide any additional information, including questions on notice, please send it to the secretariat by Tuesday 20 October. Please note that responses to questions on notice will be published on the website as submissions to the inquiry. You will be sent a copy of the transcript of your evidence, and you'll have an opportunity to request corrections to transcription errors. I want to thank all the committee members and witnesses for your time today, and I declare the public hearing closed. Thanks, everyone. Committee adjourned at 14:20