Thank you very much. Good afternoon.
I would like to thank the committee for the opportunity to speak with you today about cybersecurity in the financial sector.
My name is Charles Docherty. I am the assistant general counsel for the Canadian Bankers Association, or CBA. Joining me is my colleague Andrew Ross, director, payments and cybersecurity.
The CBA is the voice of more than 60 domestic and foreign banks that help drive Canada's economic growth and prosperity. The CBA advocates for public policies that contribute to a sound, thriving banking system to ensure Canadians can succeed in their financial goals.
Banks in Canada are leaders in cybersecurity and have invested heavily to protect the financial system and the personal information of their customers from cyber-threats. Despite the growing number of attempts, banks have an excellent record of protecting their systems from cyber-threats. Banks take seriously the trust that has been placed in them by Canadians to keep their money safe and to protect their personal and financial information.
Canadians have come to expect greater convenience when using and accessing financial services, and banks have embraced innovation to provide Canadians faster and more convenient ways to do their banking. Now consumers can bank any time from virtually anywhere in the world through online banking and mobile apps that provide real-time access to their financial information. Today 76% of Canadians primarily do their banking online or on their mobile device. That's up from 52% just four years ago. As more and more transactions are done electronically, networks and systems are becoming interconnected. This requires banks, government and other sectors to work together to ensure that Canada's cybersecurity framework is strong and able to adapt to the digital economy.
The CBA was an active participant in the Department of Public Safety's consultation on the new national cybersecurity strategy. Our industry is a willing and active partner that supports the government in working to achieve the outcomes outlined in the strategy with the common goal of improving cyber-resiliency in Canada.
The banking industry is strongly supportive of the federal government's move to establish the Canadian centre for cybersecurity under the Communications Security Establishment as a unified source of expert guidance, advice and support on cybersecurity operational matters. We also welcome the creation of the centralized cybercrime unit under the RCMP.
A key priority for the new centre will be to ensure cyber-resiliency across key industry sectors in Canada. Encouraging a collaborative environment with the centre providing a focus where the public and private sectors can turn for expertise and guidance will enhance Canada's cyber-resiliency.
The security of Canada's critical infrastructure sectors is essential in order to protect the safety, security and economic well-being of Canadians. The banking industry counts on other critical infrastructures such as telecommunications and energy to deliver financial services for Canadians. We encourage the government to leverage and promote common industry cybersecurity standards that would apply to those within the critical infrastructure sectors.
We recognize that critical infrastructures such as energy cross jurisdictional boundaries, and we recommend that the federal government work with the provinces and territories to define a cybersecurity framework across all critical infrastructure sectors. Having consistent, well-defined cybersecurity standards will provide for greater oversight and assurance that these systems are effective and protected.
Effective sharing of information about cyber-threats and expertise about cyber-protection is a critical component to cyber-resiliency and increasingly important to Canada's digital and data-driven economy. The benefits from sharing threat information extend beyond the financial sector to other sectors, the federal government and law enforcement agencies. Sharing information is a highly effective means of minimizing the impact of cyber-attacks. Banks are supportive and active participants in initiatives such as the Canadian Cyber Threat Exchange that promotes the exchange of cybersecurity information and best practices between businesses and government as a way to enhance cyber-resiliency across sectors.
To foster information sharing and for such forums to be effective, we recommend the government consider legislative options such as changes to privacy legislation and the introduction of safe harbour provisions to ensure that appropriate protections are in place when sharing information related to cyber-threats.
Protecting against threats from industries or other nations requires a defensive response that is coordinated between the government and the private sector. The government can play a pivotal role in coordinating among critical infrastructure partners and other stakeholders, building upon existing efforts to respond to cyber-threats. Establishing clear and streamlined processes among all major stakeholders will enhance Canada's ability to effectively respond to, and defend against, cyber-threats.
We understand that the government plans to introduce a new legislative framework that addresses the implications and obligations in a world that is increasingly connected. We look forward to engaging with the government on the framework.
The CBA also believes that raising awareness about cybersecurity among Canadians is imperative. Educating Canadian citizens is, and should be, a shared responsibility between the government and the private sector. General knowledge of the issues and an understanding of personal accountability to maintain a safe cyber environment are required to help ensure that comprehensive cybersecurity extends to the individual user level. The banking industry looks forward to further collaboration with the government on such common public awareness initiatives as incorporating online cybersecurity safety into federal efforts to promote financial literacy.
A skilled cybersecurity workforce that can adapt to a changing digital and data-driven economy is equally important, not only for our industry but for all Canadians as well. Every year the CBA works with members to organize one of Canada's largest cybersecurity summits, bringing banks together with leading experts to share the latest intelligence about threats and to deepen the knowledge of our cybersecurity professionals.
As cybersecurity threats continue to rise, there's a growing demand for cybersecurity talent in Canada and abroad. Canada's new cybersecurity strategy recognizes that the existing gap in cyber-talent is both a challenge and an opportunity for our country. To address this shortage, we encourage the federal government, in co-operation with provincial and territorial governments, to promote and establish cybersecurity curricula in grade schools, colleges, universities and continuing education programs to enable students to develop cybersecurity skills.
In conclusion, I want to reiterate that cybersecurity is a top priority for Canada's banks. They continue to collaborate and invest to protect Canadians' personal and financial information. Banks support the government's work to protect Canadians while promoting innovation and competition. However, the industry recognizes that threats and challenges are constantly evolving. We want to work more collaboratively with the government and with other sectors to ensure that Canada is a safe, strong and secure country to do business in.
Thank you very much for your time. I look forward to your questions.
Thank you very much, Mr. Chair and members of the committee. It's a real pleasure to be here with you today.
I'm Trevin Stratton. I'm the chief economist at the Canadian Chamber of Commerce. The Canadian chamber is the voice of business in Canada, and represents a network of over 200,000 firms from every sector and region and every size of business. I'm here with my colleague, Scott Smith, the senior director of intellectual property and innovation policy at the chamber.
Banking transactions are increasingly being conducted in new ways, with 72% of Canadians primarily doing their banking online or through their mobile device. Disruptive or destructive attacks against the financial sector could, therefore, have significant effects on the Canadian economy and threaten financial stability. This could occur directly through lost revenue, as well as indirectly through losses in consumer confidence and effects that reverberate beyond the financial sector, because it serves as the backbone of other parts of the economy. For example, cyber-attacks that disrupt critical services, reduce confidence in specific firms, or the market itself, or undermine data integrity could have systemic consequences for the Canadian economy as a whole.
Banks have invested heavily in state-of-the-art cybersecurity measures to protect the financial system and the personal information of their customers from cyber-threats. In fact, cybersecurity measures and procedures are part of the banks' overall security approach, which includes teams of security experts who monitor transactions, prevent and detect fraud and maintain the security of customer accounts.
The sophisticated security systems in place protect customers' personal and financial information. Banks actively monitor their networks and continuously conduct routine maintenance to help ensure that online threats do not harm their servers or disrupt service to customers.
However, cybersecurity issues are marked by significant information asymmetries, where a disproportionate amount of intelligence and capacity resides with large institutions like the federal government, the Bank of Canada and a few large private sector companies, including financial institutions. Yet, small and medium-sized enterprises are no less vulnerable. It is important for them to secure a cybersecurity ecosystem. They are also disproportionately subject to mounting asymmetries in resources, technologies and skills to defend against nefarious adversaries who, with relatively primitive skill sets and resourcing, can inflict excessive financial and reputational damage.
My colleague, Scott Smith, will now outline the cyber-threat landscape facing Canada's small and medium-sized enterprises.
I believe you've heard from several witnesses over the past few months about the evolving cyber-threat landscape, some of the attacks that are being experienced across the board and how that's changing, and the challenge that represents. Instead, today I'm going to draw your attention to the growing attack surface and how economic disruption that impacts national security can come from unexpected places.
Canada depends on small business for economic well-being. There are 99.7% of businesses in Canada that have fewer than 500 employees, but they employ over 70% of the total private labour force. Small to medium-sized enterprises contribute 50% of Canada's GDP, 75% of the service-producing sector and 44% of the goods-producing sector. They also represent 39% of the financial, insurance and real estate sector.
Fintech has a projected continuous annual growth rate of 55% through 2020. Canada is a hot spot for fintech growth, especially in mobile payments, and most of the emerging companies are SMEs. SMEs collectively constitute a very large attack surface. This attack surface has attracted the attention of hackers.
With regard to some examples of the link between supply chains and major disruptions, in 2018, five natural gas pipeline operators in the U.S. had their operations disrupted when a third party supplier of electronic data and communications services was hacked in the spring of that year. The hacking of a third party vendor to more than 100 manufacturing companies was discovered in July 2018. Approximately 157 gigabytes of data that Level One Robotics was holding was exposed via rsynch, a common file transfer protocol used to mirror or back up large datasets.
The 2017 NotPetya malware outbreak forced shipping giant Maersk to replace 4,000 new servers, 45,000 new PCs and 25 applications over a period of 10 days, causing major disruption.
Why is this happening? Criminals are a bit like flood water; they follow the path of least resistance. Small to medium-sized enterprises have several challenges when it comes to security: limited financial resources, limited human resources and a culture of disbelief, the so-called “we're too small to be hacked” syndrome.
The digital economy has been a boon to small business growth, enabling rapid entry to global supply chains. However, this innovation and growth comes with significant risk if security concerns are not addressed, particularly given the increasing sophistication of cybercriminals. They've moved from the disruption of viruses, trojans and worms 10 years ago, which were common to hear about, to now generating usable digital trust certificates that bypass the human element.
The goal must be to reduce the attack surface, making Canadian business a less attractive target to criminals. The solution is a culture shift, through education, awareness and setting achievable industry-led standards, without stifling innovation. It's a big challenge. It also means investing in international criminal enforcement relationships and capabilities.
I'll stop there, and I'm happy to answer any questions.
Gentlemen, thank you for being here.
I have a question about the banks and the credit card companies. That relationship is more complicated than people realize.
There is a belief that the banks are responsible for several of the steps in a credit card transaction, but in fact, it is the credit card company that is responsible.
The Privacy Commissioner shared concerns about the fact that the credit card company servers are located elsewhere, such as in the United States. The legal protections conferred on clients by citizenship are not necessarily the same. There is also the fact that an ill-intentioned actor could pose additional risks, should the relationship between two countries deteriorate. From that perspective, the servers that contain our data, for instance the ones in the United States, could become a target.
Do the banks that deal with those enterprises have a role to play in this? Can the Government of Canada do anything to protect the data and transactions of Canadians?
According to what I understand, credit card companies are independent from the banks. Nevertheless, the banks deal with those enterprises for certain important aspects of their activities.
I thank the committee for this opportunity to contribute to your important deliberations on cybersecurity in the financial sector as a national economic security issue.
l'm pleased to respond to your invitation requesting insights into the context of critical infrastructure, internet routing, routing of data and communications technologies.
ln previous hearings you've heard many valuable points, notably that Internet infrastructure is critical infrastructure not just for the financial sector but for the Canadian economy more generally; that this infrastructure is changing quickly in ways that are risky and not generally transparent or well understood; that threats to security of this infrastructure are multi-faceted, complex and growing.
ln addressing these risks, I particularly endorse Professor Leuprecht's earlier recommendation:
that Canada should pursue a sovereign data localization strategy, reinforced by legislative and tax incentives to require critical data to be retained only in Canadian jurisdictions; set clear standards and expectations for the resilience of Canadian communication infrastructure; monitor that resilience; and impose penalties on critical communication infrastructure players who fail to adhere to standards or fail to make adjustments without which they would be left vulnerable.
I will elaborate on this recommendation made in the context of 5G networks, but will apply it to reducing the threats posed by excessive volumes of Canadians' domestic data communications, including financial data, flowing outside of Canada even when headed for Canadian destinations. These flows add a host of unnecessary cybersecurity risks while undermining Canadian economic security more generally.
To be sovereign economically and politically a nation must exercise effective control over its Internet infrastructure, ensuring that critical components remain within its territory, under its legal jurisdiction and operated in the public interest. Most obviously, this refers to locating databases. Less obviously, though no less critical, are the routes data takes between databases, users and processing centres. This latter area of vital concern is much less well understood and the one to which I direct my comments.
I'm Andrew Clement, a professor emeritus in the Faculty of Information at the University of Toronto. Beginning in the 1960s, l was trained as a computer scientist, so l've seen a lot of remarkable changes, good and bad, in the digital infrastructure that is now an essential part of our daily lives. Much of my academic life has focused on trying to understand the societal and policy implications of computerization. I co-founded the cross-disciplinary ldentity, Privacy and Security lnstitute to address in a practical, holistic, manner some of the thorniest issues raised by the digitization of everyday life. Currently l'm a member of the digital strategy advisory panel advising Waterfront Toronto on its smart city project with Sidewalk Labs.
One of my main research pursuits has been to map Internet communication routes to reveal where data travels and the risks it faces along the way. My research team developed a tool, called IXmaps, short for Internet Exchange mapping, that enables internet users to view the routes their data follows when accessing websites.
Early in our research we generated a trace route, found on the first image, called Boomerang, which shows the data path between my office at the University of Toronto and the website of the Ontario student assistance program that is hosted in the provincial government complex a short walk away.
This route surprised us, especially since the route to and from the U.S. went through the same building in Toronto, Canada's largest Internet exchange, at 151 Front Street. At the very least it challenged presumptions of maximal efficiency of Internet routing, prompting our further investigations into how widespread this phenomenon was as well as into the reasons for this counterintuitive behaviour. We dubbed this type of path—data leaving Canada before returning—“boomerang” routing. It turns out to be quite common. We estimate at least 25% of Canadian domestic traffic boomerangs to the U.S. The Canadian Internet Registration Authority, CIRA, recently put the figure much higher.
There are several problems related to Internet routing that are relevant to this committee.
The longer route adds risk from physical threats, even as banal as a backhoe cutting through the fibre optic cable. The extra distance adds both expense and latency, undermining economic efficiency and opportunity.
Data passing through major switching centres faces bulk interception by the United States National Security Agency, the NSA. Even before the Snowden revelations, we knew that New York and Chicago were prime sites for NSA surveillance operations. It not only poses risks for Canadians' personal privacy, but also for financial and other critical institutions. At your latest meeting, Dr. Parsons pointed you to a Globe and Mail report that the NSA was monitoring the Royal Bank of Canada and Rogers' private networks, to mention only those beginning with the letter R. The article suggested that the NSA's activities could be a preliminary investigative step in broader efforts to “'exploit' organizations' internal communication networks”.
Boomerang poses a further, more general threat to national sovereignty. If one country depends on another for its critical cyber-infrastructure, as Canada does with the U.S., it makes itself vulnerable in multiple respects—and not just from their spy agencies or to shifts in the political relationship, as we're seeing now. Will even the best ally keep the interests of its friends in the fore, when its own critical infrastructure is threatened? If the U.S. experiences a cyber-attack, might it not feel compelled to shut down its external connections, leaving Canada high and dry? Previously, you've heard that some see Canada as a softer target than the U.S. and, hence, potentially, as an entry route into the U.S. At some point, might the U.S. see Canada as a source of threat and disconnect us?
So far I've focused on the risks from routing Canadian domestic traffic through the U.S. A similar argument applies to Canada's communications with third countries, but even more so. Our mapping data suggests that approximately 80% of Canadian internet communications with countries other than the U.S. pass physically through the U.S. This is related to the relative lack of transoceanic fibre cabling that lands on Canadian shores, as shown clearly in the maps produced by the authoritative TeleGeography mapping service. You can see the slides, I hope.
Only three transatlantic fibre cables land on our eastern coast, compared with much greater capacity south of the border. Most of our traffic with Europe goes via the U.S. Remarkably, on our west coast there are no trans-Pacific cables, so all traffic with Asia transits the U.S. One way of assessing how well banks can withstand severer financial downturns is subjecting them to stress tests. What would a stress test of Canada's cyber-infrastructure reveal? If, for whatever reason, our connection with the U.S. was cut, even in its own legitimate self-defence, how resilient would Canada's Internet prove to be? We should know the answer, but we don't. However, the evidence available suggests very poorly.
What should we do about this? Broadly speaking, the appropriate policy response, as mentioned, is to pursue a strategy of “sovereign data localization” that includes data routing. More concretely, this would involve a coordinated set of technical, regulatory and legislative measures designed to achieve greater resilience.
First, we should require that all sensitive and critical Canadian domestic data be stored, routed and processed within Canada. Second, we should support the development and use of Canada's Internet exchange points for direct inter-network data exchange to avoid U.S. routing. CIRA has lead the way on this. Third, we should increase fibreoptic capacity as needed within Canada, as well as between Canada and other continents. Fourth, we should include transparency and accountability reporting requirements in cybersecurity standards for financial institutions and telecom providers, in relation to routing practices. Fifth, we should establish a Canadian cyber-infrastructure observatory, with responsibility for monitoring Canadian cyber-infrastructure performance and resilience, responding to research requests and reporting publicly.
Thank you for your attention and I look forward to your questions.
For the sake of brevity, I won't read it all because I believe you've all got a copy on your desk.
Good afternoon, Mr. Chair, members of the committee and ladies and gentlemen. My name is David Masson, and I'm the country manager for Canada of Darktrace, a cybersecurity company.
We are the world's leading AI company for cyber-defence. We have thousands of customers worldwide, and our self-learning AI can defend the entire digital estate that people have. We've more than 800 employees—actually, it's 900 now—and 40 offices worldwide, and here in Canada we have three offices.
Prior to joining Darktrace and establishing the company in Canada in 2016, it was my immense privilege and honour, as an immigrant to Canada, to serve my country at Public Safety Canada for several years. Prior to that, I had worked inside the United Kingdom's national security and intelligence machinery, and had done so since the Cold War. I've been a witness, as the previous witness just said, to cyber's evolution over time, from before the Internet to its current mass prevalence and ubiquity in our society today.
In earlier meetings of this committee, I think you heard an awful lot about the scale and size of the cyber-threat that exists in this country, so I'm going to focus on three things. First I plan to share with you some reasons why cybersecurity poses a seemingly insurmountable challenge, and I'll dive into some specific threats. I'll close by offering some suggestions and solutions to these issues.
What we're seeing at Darktrace is that most organizations, unfortunately, aren't as secure as they think they are. When we install our artificial intelligence software in the networks of a Fortune 500 company—sir, you mentioned this earlier—80% of the time we detect a cyber-threat or vulnerability that the company simply did not know about. Outside of the Fortune 500, when we look at smaller businesses, this percentage of companies compromised in some way jumps up to 95%, so that's pretty much all the time.
These statistics highlight two things. First and foremost, obviously, no organization is perfect or immune. Organizations of every size and every industry not only are vulnerable to cyber attacks but are currently more at risk than they imagine. Successful attacks against some of the biggest companies in recent years have revealed that something isn't working. Even Fortune 500 companies, which have budgets, resources and staff to deal with cyber-threats, are still found wanting.
Second, this raises the question: Why are so many companies and organizations unaware they are under attack or vulnerable? The legacy approach that businesses have previously taken to cybersecurity does not work in the face of today's threat landscape and increasingly complex business environments.
In brackets, it's not just the cyber-threat that we're facing. It's actually just business complexity that's bamboozling people.
In the past, companies were focused on securing their networks from the outside in, hardening their perimeter with firewalls and end-point security solutions. Today, migration to the cloud and the rapid adoption of the Internet of things has made securing the perimeter nearly impossible. Another traditional approach, known as rules and signatures, relied on searching for known bad. However, attackers evolve constantly, and this technique fails to detect novel and targeted attacks. Most importantly, these historical approaches fail to provide businesses with visibility and awareness into what is taking place on their networks, making it hard, if not impossible, to identify threats already on the inside.
I'll now look at two potential types of attack that have far-reaching impacts.
Attacks against critical national infrastructure are increasing around the world. When one mentions critical infrastructure, people commonly think of power grids, energy and utilities, companies, dams, transportation, ports, airports, roads. However, Canada's financial sector, the purpose of this committee, the big banks, etc., are also part of a nation's critical infrastructure. Just as roads connect our country physically, these organizations connect the national economy. A successful cyber-attack against these core institutions could dramatically disrupt the rhythms of commerce. The security of financial institutions should be discussed in the same breath and with the same severity as the security of our power grids.
Another type of attack that's more common in recent years is trust attacks. These attacks are not waged for financial gain. As a company, we haven't been able to work out what the financial gain of these attacks is. Instead, they're waged to compromise data and data integrity. Imagine an attacker is looking to target an oil and gas company. One tactic would be just to shut down an oil rig, but another more insidious type of attack would be to target the seismic data used to identify new locations to drill. Effectively, what they do is they get the company to drill in the wrong place.
I also want to touch briefly on what we at Darktrace think we can expect from the future of cyber-attacks. We use artificial intelligence to protect networks, but as artificial intelligence becomes ubiquitous in seemingly every industry, it is falling into the hands of malicious actors as well. Although there's some debate as to when exactly we'll see AI-driven attacks, we think it might be this year, but others think 2020 or 2025. They're something that we will no doubt have to contend with in the near future.
Darktrace has already detected attacks so advanced that they can blend into the everyday activity of a company's network and slip under the radar of most security tools.
Up until now, highly targeted advanced attacks could only be carried out by nation-states or very well-resourced criminal organizations. Artificial intelligence lowers the bar of entry for these kinds of attacks, allowing less-skilled actors to carry them out. AI is able to learn about its target environment, mimic normal machine behaviours and even impersonate trusted people within organizations.
Companies will soon be faced with advanced threats on an unprecedented scale. We think it's critical that companies and government—both in Canada and around the world—consider what this will mean and what steps need to be taken to ensure that they can defend against AI-driven attacks.
As this committee and the broader industry looks for answers and solutions, I want to propose a few.
In October 2018, (ISC)2 announced that the shortage of cybersecurity professionals around the globe had soared to three million. I saw this figured repeated again this morning on LinkedIn. Roughly 500,000 of these unfilled positions are located in North America. In Canada, I think we're seeing 8,000, but I suspect it's more. This shortage is only expected to increase. Businesses are struggling to hire professionals. Those individuals they can hire are struggling to keep up.
Threats are moving at machine speeds now. In the time that an analyst steps away to grab cup of coffee, ransomware can enter a network and encrypt thousands of files. Beyond these machine-speed attacks, analysts are faced with a deluge of alerts around supposed threats that they need to investigate, handle and remediate. We need to find a way to lighten the burden for cybersecurity professionals, expand the field of potential candidates by hiring more diversely, and arm them with the technology and tools to succeed.
I'll skip the next two paragraphs.
Collaboration between the private and public sector will also be key to solving the challenges we face. The previous witnesses spoke to some of that. Governments around the world collect a wealth of information on adversaries' attacks and attack techniques. Although certain limitations about what governments can share is understandable and necessary, I'd urge the Canadian government and the intelligence community to share what information they can with corporations. Information is an asset. If companies understand the attacks they are facing, they can better defend against them. The Canadian economy is better ensured from the impacts of these cyber attacks.
On the other hand, it's critical that private companies like mine share insights and lessons-learned with the government. The private sector's ability to pivot quickly and trial new technologies make it in some ways a testing ground for new cybersecurity technologies and techniques. Through discussions around what's working and what isn't, the government can learn what's necessary for companies to succeed, compile and disseminate this information—perhaps through CCTX, which I know has been mentioned several times—and help entire industries quickly improve their security practices.
I want to close with a call for innovation. Attackers are constantly coming up with new ways to infiltrate networks, attack businesses and wreak havoc. It's critical that we, the defenders, are innovative as well. Whether this be by developing novel technologies, adopting cutting-edge techniques or enacting new regulation, creative thinking and collaboration are going to be the key. At the end of the day, it's not just about keeping up with attackers, but getting one step in front of them.
I look forward to your questions.
I used to be a British diplomat. I remember 12 or 14 years ago having it explained to me that a cyber-attack by a nation state or another state was an act of war. However, ever since then, it seems to have become a very, very grey issue. I was at a conference the other week where it cropped up again, and nobody could actually define at what point you reach that stage. Maybe it's because a lot of the time it's been easier, particularly for western democracies, to just ignore that issue, for obvious reasons.
State actors are investing heavily in AI because everybody is investing heavily in AI. The witnesses who were here before invest a lot in AI for their banking systems. This isn't about cybersecurity or cyber-attacks. They're just using AI because AI can do so much more so much more quickly and so much more accurately.
We use AI because we are saying that human beings can't keep up with the scale of this threat, so we use AI to do all the heavy lifting for human beings. It's a bit of a myth to say that AI is going to replace people. That is not the case. There is no broad AI [Editor—Inaudible]. That doesn't exist.
What you see at the moment is AI being used for specific purposes for specific tools in specific areas. We use it for cybersecurity, but the bad guys—and I'm happy to say “bad guys” because we get stuck with the Internet of things—are going to use it because it's going to make things easier for them. In my statement, I pointed out how some of the nation state attacks that we used to see, such as the attack against Sony—a lot of resources went into that—or some of the attacks we've seen in Ukraine, need people, time, money and effort. However, if you use AI to do that, you need less money, time and effort, and, as I say, it will lower the bar for entry to these kinds of attacks.
When we see the first AI attack—we, as a company, think it might be this year; we've been seeing hints of it for quite a few years, but it could be later on—many of the current techniques and systems that are used for protecting networks from cyber-threats will become redundant overnight. That will happen very, very quickly.
Some state-threat actors and others are using AI in the foreign influence field, in the misinformation campaigns that go on. There's a lot of stuff about that. You may have noticed that some of the media platforms have been heavily criticized following the horrendous attacks in New Zealand because they didn't do anything about it quickly enough. But now, if you use AI—we can do it now—you can construct a lie at scale and at speed. It doesn't matter how palpably untrue it is. When you do that, that sort of quantity develops a quality all of it's own, and people will believe it. That's why bad guys are going to start investing in AI.