The Cyber Brief: cyber innovation and investment with former Prime Minister Malcolm Turnbull (part two)

Dom: Well, let's stick with the theme, then, of innovation and technology. You've obviously been across cyber as PM, but also in your capacity as an investor and as an advisor to some of the world's leading cyber startups and companies. You're the Australian face of US-based Semperis. You're also an investor in Cato Security that was acquired by Darktrace recently. You're an investor in Sydney's highly lauded Kasada, which allows organisations to repel AI data scraping bots, and Dragos, which is a US cyber security provider for industrial infrastructure. You once said, I believe, that you found investing in cyber security to be as rewarding as investing in renewable energy businesses. What motivated you to expand your private investments in cyber security, and do you see it, I guess, as an area of existential importance that rivals the net zero challenge?

Malcolm: Yeah, it's always hard ranking, you know, ranking these existential challenges. And, of course, they link. Yeah, I do. It is, it is very—no question. It's absolutely right up there in the existential area. And, yeah, I mean, I guess my investing nowadays, I mean, you know, most of my investments are sort of boring, prudential, you know, prudent, you know, type portfolio investments that any, you know, fund manager would have. But at the pointier end, you know, the more active end of the portfolio, we have a renewable development, renewable energy development business, Turnbull Renewables. We've got a number of projects, large projects, we're working on there, and then on in the venture capital part of our portfolio, cyber is a, yeah, a big part of it. So, it's not the only part of it. I mean, I've got a lot of, I'm a pretty active venture capitalist for a self-funded retiree.

Valeska: As PM, you funded two bodies to facilitate investments in high-growth companies. So, there was AustCyber, which became the Australian Cyber Network, and then the Cyber Security Cooperative Research Centre, but both of which actually were either wound up or closed last year, and private capital obviously plays a really significant role in nurturing this ecosystem. But from a public policy perspective, do you think we're doing enough to encourage and facilitate innovation in the cybersecurity ecosystem?

Malcolm: I don't think you can ever do enough. And I was puzzled that these, you know, agencies were closed down. I don't know whether that, you know, it might have been because the Labor government thought they weren't invented by them and wanted to have something, put something else up. So there was never a great explanation for this. There's a few puzzling things about the current government. I mean, another thing that was set up in my time, which I would have thought was completely uncontroversial, is the Australian Space Agency, which is, you know, very connected to all of this, all of these issues, because, you know, cyber security in space is a bigger and bigger issue. And it's not just cyber security, there's sort of physical security too, but its funding has been cut. Again, you would think, you know, at a time like this, that's an agenda that you'd actually be doing more of.

Valeska: It'll be interesting to see whether that changes again. The space security and space risk featured quite prominently in that independent review into the SOCI Act as well.  

Malcolm: I think there needs to be, you know, if I was in Albanese's shoes today, I would be looking at a, you know, a whole-of-economy, sort of national security assessment, you know, that wasn't just, you know, the ships and planes and guns and boots and tanks and that sort of stuff and missiles, but included cyber, included our resilience with supply chains; you know, fuel security. You know—what is it? What? How are we going to manage; you know, we've had some big wake-up calls recently. We've had the Covid pandemic. Now we've had this. And with the war with Iran. And, you know, the one thing that is pretty obvious is that Iran isn't going to go away. And, you know, they're a big country, very ancient country, 94 million people, and they have threatened to block the Strait of Hormuz for many decades, but haven't done it. They've now done it, and it's worked a treat, from their point of view. You know, we've got, there are real risks there for us, I think. So there needs to be, you know, I think, like, a big picture assessment of our risk across a whole range of dimensions.

Valeska: Risk and resilience, yeah.

Malcolm: Risk and resilience, yeah, well, and, I mean, this is why I've had now, two years running, a conference on sovereignty and security. Now, that's been more focused on the, you know, traditional defence areas, although we did have a session on cyber. Rachel Noble, former director-general of ASD, was one of our speakers. George Freney, you know, from Space Machines, was one of the speakers on the panel. But it was, you know, it was more, you'd say it was more traditional defence. But I held that conference last year, a year ago, because I was frustrated that this, these issues, were not being properly debated. You know, this, there just wasn't a … everyone was pretending that nothing had changed. I mean, I don't think anyone can now pretend that, you know, there is the relationship. I mean, but people that will look you in the eye and say, Oh, the relationship with the United States is as rock solid as ever, and nothing has changed. Honestly, that may wash in Canberra, but it doesn't cut with any, won't cut it with anybody else in Australia, I reckon. It just so obvious. You know, people have got eyes and ears. They can see. They see what's happening.

Dom: We've talked about sovereignty quite a bit in this discussion, Malcolm. I mean, from an innovation perspective, the stronger our homegrown industry is, the stronger our cyber security posture will be. What are your views on the strength of our startup ecosystem in Australia, in the cyber security space?

Malcolm: Well, look, it's, you know, it's strong. It could be stronger, but there is, you know, I'm old enough to remember the 1990s and even, you know, the oughties, when there was virtually no venture capital for tech in Australia at all, you know, I mean—but it, you know, started to pick up, and the NISA, you know, with ECVCLP legislation, and, you know, and other associated things, you know, setting up the fund, the CSIRO fund, that became Main Sequence Ventures, etc, etc. All of that gave it a big boost. So, there's plenty of money around at the moment, and plenty of interest. If I had to make a suggestion, I think our agencies, our governments and our big companies are too risk averse and too ready to buy the, you know, the US product, rather than looking for Australian technology. I mean, you know, there's got to, you've got to be prepared to, really, and this is particularly true with government, and particularly with defence, you know, you've got to be looking all the time to find, you know, the Australian technology that you can effectively incubate, and if it's successful, then, you know, maybe, you know, our partners and allies will use it as well. But, you know, it's, as everyone in the tech sector will have said to you guys 1000 times, I'm sure, you know, I'd rather have a contract than a grant. You know, that's what you need.

Valeska: And, Malcolm, the technology is one thing, as is the capital investment. But what role do you think government should be playing in trying to actually attract and retain the talent that we need, especially given the skills shortage in this space?

Malcolm: Well, obviously we can't, you know, confiscate the passports of software engineers or, you know, clever developers or entrepreneurs. Look, I think we just need to make sure that we've got our environment here is attractive for innovation and just constantly benchmark it against other places. The R&D, you know, tax concessions are very, still very, very valuable, particularly for early stage companies, because of the cashback element. Yeah, I mean, I think one of the, I think we could do more to encourage people to set up here, work here. We have got some advantages. I mean, you know, the cost of labour developers is less here than it is in Silicon Valley, although, you know, that gets back to what we were saying about AI, you wonder, that's probably the biggest pressure there. I think just promoting Australia as a place for innovation is important. You know, we've got a number of things going for us in Australia. We have very, very livable cities, you know, this is a very nice place to live, and that's, and look, that that's a big factor, you know. So, we've got a lot going for us, but I think we've just got to be, you know, constant, you've just got to be constantly assessing what are the reasons why people are not doing more in Australia, and how can we get them to do more? The pools of capital are obviously a lot deeper in America than they are here, and nothing's—that's not going to change. But the connectivity between Australia and international markets is so high nowadays compared to what it was when I was first investing in tech, you know, in the 90s. You know, you wonder whether it really matters. And I mean, I think, to be honest, you know, say, you know, people in their 30s and 40s, let alone 20s, in Australia today would think, you know, would think sort of going to London or New York or Los Angeles or Hong Kong or Singapore as no more a big deal than my generation might have thought about, you know, going to Melbourne from Sydney, you know. So, I think the world has shrunk in that sense, and that helps us.

Valeska: We generally ask our guests what their favourite cyber-related film, TV show, podcast, reading material is. So, not sure if you've got a view on that.

Malcolm: The Allens cyber podcast is the best.

Valeska: Thanks very much for your time, Malcolm, it's been really interesting.

Dom: We really appreciate it.

Malcolm: Okay, no worries. Thank you.

Dom: Well, I thought that was a really fascinating discussion with Malcolm. We touched on a number of really important topics. The word 'existential' was used in there as well. What were some of your key takeaways, Valeska?

Valeska: I think for me, the discussion about sovereignty, the need for Australia to be self-reliant when it comes to cyber capability, both offensive and defensive. And Malcolm's comment that actually, in many respects, we are but there's real benefits still, given this is very much a global problem, to be working very closely with our alliance partners, to get and share intelligence with them as well. And I think too the broader context in which all of this was placed with cyber warfare offensive capabilities, the fact that we have many instances of war being perhaps declared in an undeclared way, and the implications for Australia in potentially being pulled into those incursions or left exposed in a way, is a fascinating thing that I think we'll need to continue to be really alive too.

Dom: Yeah, and I think for me, that question of sovereignty came up just as strongly when we were talking about the innovation sector and the importance of building and promoting innovation in Australia to make sure that we have that sovereign capability from a technology perspective, keeping people on shore. You know, he mentioned the sort of natural pull that we have in Australia that plays into our hand there, but also the importance of, I think, government intervention in ensuring that the settings are right for private capital investment to promote that innovation. You know, we think about the tax incentive structures that Malcolm helped implement as part of his broader strategy, I think they all play a really critical role and I think that came through quite clearly. I think one thing that, you know, I was expecting, but, you know, Malcolm was quite positive about the state of the nation in terms of our settings for innovation, the state and maturity of our startup ecosystem. We have come a very long way in a very short space of time, so I think that came through as well. Yeah, it was a really enjoyable conversation.

Valeska: Loved it.

Thanks for listening to this episode of The Cyber Brief. Check the show notes for resources from this episode, or visit allens.com.au/cyber for our latest thinking; don't forget to follow to keep up to date on what's ahead for cyber risk governance and emerging threats as we interview some of the most respected voices in the industry.