Confronting the security and data protection challenge

TLDR version: Over the last decade our economy and society have become increasingly dependent on telecommunications networks and the array of digital services they support. Discussions around cybersecurity policy and data protection are no longer confined to IT or risk forums and are now part of the wider telco sector policy debate.

Faced with the prospect of a worsening geo-political landscape and rising customer concerns about security, industry and government need to develop principles for equitably sharing the burden of increasing national security requirements.

Secure and safe telecommunications are essential requirements for Australia

On 14^th June 2023, Venture Insights attended the Comms Day Policy Forum. The Forum brought together representatives from across the industry to discuss the policy and regulatory issues facing the sector. It saw discussion on many long running issues – reform of the Universal Service Obligation, nbn’s Special Access Undertaking, spectrum policy and consumer protection. As expected, there was a divergence of views on these issues reflecting the different priorities of the groups involved.

One area where there was greater consensus was how vital digital connectivity has become to Australian’s lives and the economy. Data usage has grown materially over the last decade and the industry has met this ongoing growth at the same time as delivering faster speeds.

Even where headline prices have risen, consumers have in many cases received ‘more for more’ and the telecoms sub-index of the CPI has fallen in contrast to the overall CPI rise. Spending on communications accounts for a larger share of household expenditure than a decade ago despite this price deflation. We are consuming more telecoms services as connectivity has become essential for the way many people live, work and play. These issues are explored further in our ‘State of the Industry’ report that was launched this week to coincide with the Forum.

Taking up the security and protection challenge

What fell outside the scope of our report, but was certainly a hot topic for many speakers, was what this digital dependence means for cybersecurity and the protection of personal data. Representatives from several organisation addressed these topics, albeit each with a different perspective.

• Security governance and AI. Telstra had a strong focus on Artificial Intelligence (AI) during its session. AI underpins its ‘Cleaner Pipes’ program that removes scam texts, and the company revealed it is involved in an innovative trial with a major bank to implement real time scam detection for the bank’s customers. Telstra also highlighted the privacy and security guardrails it employs to protect customer information, and its involvement in helping establish Australia’s ethical standards for AI use. This messaging suggests the company may have big ambitions for AI that will require building high levels of trust.
• Online safety as an enabler of the digital economy. Keeping people safe online is an enabler of the digital economy according to nbn Co. Like other telcos, it has had to invest in public fraud awareness programs to mitigate the risk from impersonation scams. Online safety also appears intertwined with nbn’s digital inclusion objectives.
• National security decisions can have long lasting impacts on competition. The requirement to exclude Huawei from the 5G upgrade path meant some telcos faced a time and cost burden that put them at a competitive disadvantage. TPG argued there are lessons to be learned from other jurisdictions where compensation is paid to assist with equipment replacement costs in these scenarios. As other speakers emphasised, the geopolitical situation is not improving so this topic will stay in the spotlight.
• The importance of a people centric approach to security engagement. Should we approach cybersecurity in a similar way to how we approach road safety? That was one of the suggestions from AWS’ policy representative, Min Livanidis. People are fallible, and therefore our security systems and policies must be built to minimise the harm from people’s mistakes. More broadly, online safety and security education needs to be as much a part of our children’s upbringing as road safety. It also needs to avoid being overly alarmist or falling back on tech speak lest the messages be lost.

Why does this matter?

Like any social endeavour, delivering the benefits of the digitally enabled society is going to require a lot of trust. As we’ve discussed previously, the Optus cyber incident saw the telco sector become Australia’s most distrusted industry. But the sector had a negative trust score (i.e. distrust) even before this. Rebuilding trust will require ensuring the sector uses customer data in ways that consumers feel are acceptable, and that personal information is appropriately protected.

The industry and government will also need to develop principles for equitably sharing the burden of increasing national security requirements. Operators have their own incentives to implement strong security and that will drive a certain level of investment.

Where there are collective benefits for the nation of higher security levels, placing the entire burden on the industry may lead to unintended negative impacts. This could include changing competitive dynamics between existing players, as arguably occurred following the policy change that led to Huawei’s exclusion from the 5G ecosystem in Australia. Stringent security requirements may also change the incentives for those looking to enter the industry.  New entrants will need to either come well-resourced or have access to a vibrant wholesale and ‘security as a service’ market they can build on.

Lastly, broader public engagement on the topic of cybersecurity is going to be needed, and so we will be interested to see if this follows the people centric approach discussed at the Forum.

About Venture Insights

Venture Insights is an independent company providing research services to companies across the media, telco and tech sectors in Australia, New Zealand, and Europe.

For more information go to www.ventureinsights.com.au or contact us at contact@ventureinsights.com.au