Cybersecurity, Aerospace and New Zealand’s Digital Direction

Transcript is computer-generated and may contain errors.

Paul Spain:
Hey folks, greetings and welcome along to the New Zealand Tech Podcast. I'm your host, Paul Spain. Joining us on the show today is Craig Young, who is the Chief Executive of TUANZ, the Technology Users Association of New Zealand. They're an independent organization representing users of technology and connectivity across the country. Craig has been at the helm there for 12 years since 2014, championing better connectivity, digital inclusion, and ensuring that Kiwis can benefit across the board from our increasingly digital world. Welcome, Craig. Great to have you on the show.

Craig Young:
Kia ora, Paul. Thanks for having me back.

Paul Spain:
Yeah, no, it's always good to catch up and to have you on the New Zealand Tech Podcast. Before we jump in, of course, a huge thank you to our incredible show partners. So thank you to Spark, One NZ, 2degrees, SAP, Workday, PwC, and Gorilla Technology. Always appreciative of their support making the show possible, and of course their broader support of New Zealand's tech and innovation ecosystems. Well, to start, Craig, I think we'll duck into the, the New Zealand news, and, you know, top of the list is Cyber Smart Week running this week in New Zealand. In other parts of the world, they run a an equivalent, I think, across the whole month in some places. But yeah, I think it's great that we get a bit of time to remind people about the importance of cybersecurity or being cyber smart, as they like to say. And we've got the National Cybersecurity Centre who have issued their latest report quite recently.

Paul Spain:
You know, their warning is that artificial intelligence is making, you know, scams certainly quicker to produce, easier to personalise, and increasingly convincing. And we might delve into one or two of those. So, you know, they've got a campaign going around, you know, find a scam before it finds you. And, you know, really encouraging everybody to be questioning unexpected messages and to be stepping up their habits when it comes to operating technology. So, you know, they're really recommending that organizations need to maintain the fundamentals from a cybersecurity perspective. And, you know, I guess I would argue, yeah, it's really important to, you know, to do all of the basics because across New Zealand, we still have so many scenarios where organizations don't, you know, don't even meet those kind of, you know, basics. Things like ensuring they've got multi-factor authentication in place, appropriate backups, incident response plans, and that they've, you know, tested these things. And yeah, it's definitely a challenge.

Paul Spain:
So they've got a bunch of resources online. What are your thoughts about the current landscape? You were telling me before we started around your upcoming summit or your upcoming event that's taking place next week, and that the hotel involved were targeted with a sort of a spear phishing campaign of sorts that we probably would have been very, very unlikely to have seen in a pre-AI era. But now in an AI world, you get these very targeted communications.

Craig Young:
Yeah, I think the AI question, you know, is, um, you're seeing this mold— molding between AI and security, you know, that sort of— you can't pull them apart anymore because they're just impacting each other so much. And yeah, the, the example that I was using was I got an email last night through from the venue saying, have you ordered something from overseas? Because here's an email that we've had asking us to help clear something through customs. And it was Very well put together. I went through the email and had a good look. It had the right names in there. I did look at the attached invoice. I made sure it wasn't a dodgy link, but it was actually a PDF that was tidy. And I could tell from that though that it wasn't actually coming to anybody in particular.

Craig Young:
But they'd got the name of the person that was at the hotel or at the venue.

Paul Spain:
Hmm.

Craig Young:
And so, and they had the right branding on there. They had one of the freight forwarding companies. And it was quite complex. And you look at it and you go, that looks real. But I did go back and I said, look, we haven't ordered anything. You better check with your other customers before you do anything. And it turns out that nobody's asked for anything.

Paul Spain:
Hmm.

Craig Young:
So it is a very sophisticated piece of email phishing. And we know that, you know, one of the highest threat points in an organization comes from those sorts of phishing attacks. And as you said, they're getting clever and clever. You can't necessarily see that it's a scam until you take a good look at it. And I think that's what the, you know, and it's good to see the NCSC, you know, being a lot more public and out there talking about things, you know, find the scam before it finds you is a good tagline because it reminds us we've got to be looking at these things.

Paul Spain:
Yeah. Although there is some caution. So I'd be saying definitely don't open the PDF because if you've got a zero-day issue, then actually that could compromise, you know, compromise your, you know, your systems. Don't, you know, don't click the links. And now we, you know, we're starting to have, you know, more and more different vendors making available mechanisms that'll do what we call a remote detonation. So they will, they will open the link or the attachment remotely in a sandbox environment where it's, you know, it's, it's in theory, you know, super safe and can't cause any harm. So, you know, those things are useful. And one we saw recently that was similar, it was something that, you know, it wouldn't be worth taking the time to send an email like that for the size and scale of the opportunity, most likely traditionally.

Paul Spain:
But when you can do that on a mass scale with AI, you're going to get a percentage of people. And what it appeared to use was an external an external link. So the attachment as such wasn't a, you know, wasn't actually attached. It was through an external link. And of course, the trickery that a bad actor can play with external links is when the email is sent and when it's originally, say, scanned by Microsoft or Google might be checking those links, you can have that go somewhere very, very nice where there's no problem. And then, you know, however that gets triggered a little while later when it comes to actually the intended person that is trying to be compromised clicks it, then it actually may change. It may redirect to actually a different location. So yeah, these things are becoming very, yeah, certainly getting harder to catch.

Paul Spain:
Put it that way. Yeah.

Craig Young:
very fortunate that, you know, I can look at these things because I'm not connected to a corporate network. I'm not connected to anything. So I, you know, my laptop is pretty open because there just isn't that concern. But yeah, absolutely do not open links, particularly if you're in a corporate environment, do not open links. Just talking about that sort of stuff. So next week at our summit, you know, we are talking about cybersecurity. And I was talking to a CISO yesterday. Chief Information Security Officer in one of our banks who is speaking next week, and he said basically it's all going to be about AI because that's the threat, you know, the, the frontier that we're seeing, and everything is coming in.

Craig Young:
I don't know about you, we're a Google shop, so I got an email over the weekend from Google saying we're looking at our next release of our model, but we're not releasing it yet. We've given it to this small group of people who are going to check it first to make sure, you know, they're going to test it and check that it's not going to find things that it shouldn't find, etc., before we give it to you, which I thought was a very interesting way of just letting us know that they were moving forward, but they weren't going to give it to us yet. So it is going to get more and more tricky, isn't it?

Paul Spain:
Yeah, I think, yeah, you're absolutely right. It is a little— I think it's a little bit hard to know whether those messages from the big AI players are being entirely transparent or whether they're being, you know, there are ulterior motives in play. Probably on some of the communications that have come through recently, my feeling is there's maybe some ulterior motives at play, whether it, you know, gets them some media attention, whether it turns a sort of particular narrative that creates additional concern around open weight, open source, you know, type models. You know, there's probably a range of things there, but we won't Marketing speak, right? Into that, uh, you know, too, too far today. But I, you know, I think it is worth, you know, recognizing it, you know, especially when we get messages about, you know, AI sort of ending the world and, and, and so on. Uh, yeah, that, that these things maybe have, um, you know, some, some, some goals that, uh, um, you know, may not align with, with the messages being, uh, being shared, shall we say.

Craig Young:
Yeah.

Paul Spain:
So I think, you know, just from a, let's, you know, let's look for how we get the very best out of technology, including AI. Let's look how we, you know, create, you know, safety and use technology appropriately. But, you know, I think we've gotta be careful about, you know, laying on, you know, too much fear as well. So it's a bit of balance. So yeah, also on the AI front, I see that One News, you know, published a story around a Kiwi job seeker, Charlie McLean, who has had a bit of an experience with what's being described as, you know, ghost job adverts. And these are scenarios where you apply for for a role, you get interviewed by an AI, but in actuality, there may not actually be a job. But by spending some time and asking you, you know, questions, the AI can have its model trained and, or, you know, an organization can learn from you in one way or another. So, yeah, you could imagine an organization that wants some results from a survey.

Paul Spain:
It's pretty, you know, time-consuming and expensive usually to get surveys done, but a sneaky, dodgy way to collate data. And I mean, there's all sorts of possibilities here in terms of what they might be trying to actually collate in terms of information. But, you know, that would be one way of doing it. You know, you could target individuals when you're trying to do covert research about a particular company. You just offer roles to a whole lot of people at a particular company. AI can find out who sits where and what roles, and you tell them you've got a great offer for them at a competing firm, and some people might turn up and a percentage of people might give away information that they shouldn't. So there's certainly things to be aware of on that. on that front.

Paul Spain:
So, um, yeah, concerning.

Craig Young:
I'm pretty sure it's happened. This, this is another example where these sorts of things have happened in the past, but they're, uh, they were a lot more intense, you know, resource intensive to do in the past. And so now you've got AI, you can do these sorts of things really easy, you know. So it's an example of where the technology is improving or increasing the ability to do it. I'd hate to be in recruitment now. Because, you know, you've got this type of example, you've got it on the other side as well where people are just firing off AI-generated applications. You know, there was a story a couple of weeks ago of somebody who was sending off 400 applications by using AI. And it's like they're just hammering the recruitment agencies and like—

Paul Spain:
They may have no interest in it.

Craig Young:
No interest.

Paul Spain:
They've just handed it all off to the AI and say, go and apply for everything until you get me a job. Come back when you got one.

Craig Young:
Absolutely. So that's just overloading the recruitment agencies. straight off. But then of course you're going to get them using AI. It gets very meta where the AI is talking to an AI. We were advocating strongly for a human-in-the-loop approach, good design, human in the loop, utilizing the technology. Like you said, we're definitely pro the tech, using it in the right way to improve our lives. So there are real benefits to this.

Craig Young:
It's when this sort of thing happens that it's—

Paul Spain:
Yeah, when it— when, when the applicants are doing this at scale with AI, uh, that's the sort of thing that could overwhelm a process that is not AI-operated. And so, you know, you potentially end up forcing the hand of employers who prefer to keep things done by human because they end up not having a choice. If, you know, if you run a— run an advert and you get too many applicants that, you know, at some point needs an appropriate level of automation. Of course, there are mechanisms that have been around for a long time that still help with that, even in an AI context. But it is going to be a space that keeps evolving.

Craig Young:
Oh yeah. And we know that, like, if you start using AI to filter your applicants, we know that AI can bring through discriminatory practices, look at someone's CV and not see what is actually behind the CV, et cetera. So it does start to bring out some real significant issues in a cultural sense as well.

Paul Spain:
Yeah, and I think there's some genuine concerns there, but I don't know what the perfect answers are. I was talking to a friend recently, he's worked in big multinational tech firms, was applying for a role within a large New Zealand firm. And he had to go through an interviewing process with an AI. Now, credit to the organization, they— well, after they declined and said that he hadn't got the role, they gave feedback on why he hadn't got the role. But that feedback was, you know, from an AI interview.

Craig Young:
Oh yeah.

Paul Spain:
And the AI was feeding it back. And, you know, to him, it didn't feel like it had really understood him, which of course can happen in a human context as well. But I was— yeah, I could see from his perspective, it felt quite dehumanizing. But I can, you know, also understand for, you know, an organization dealing with you know, hundreds of, of roles a year and, and, you know, wanting to use the best of technology and, and an appropriate sort of efficiency that, you know, it's, it's challenging to know exactly how to land these things. And we probably all should be experimenting, you know, with new technology and working out where, where it fits.

Craig Young:
Mm-hmm.

Paul Spain:
So yeah, it'll, it'll be, yeah, I think a time of, significant change when it comes to that sort of hiring side over the next few years. And I'm sure some of the early experiments and approaches will probably get kicked to the curb and new, better practices will come in over time. Also on a local front, we've just had the New Zealand Aerospace Summit for 2026 held at Te Pai Convention Centre in Christchurch. That was last Thursday and Friday. Look Up and Lean In was their theme. So, but look, yeah, this comes at a time when we've been told that the aerospace sector in New Zealand potentially accounts for about $2.6 billion worth of revenue. Now, I think there's a fair bit of discussion around, well, how do you come up with those numbers? That's significantly more than the global revenue for Rocket Lab, for instance. And, you know, they're very much considered the largest player in the market.

Paul Spain:
So I don't know how, you know, how you land on the most accurate numbers. But, you know, certainly from what I saw at the summit is, hey, you know, the aerospace sector is growing.

Craig Young:
Yeah.

Paul Spain:
There's continuing innovation. There's a growing international interest in New Zealand from an aerospace perspective, and particularly that sort of space side. And I also was fortunate enough to have the chance while I was down there to go out to Tāwhaki, which is the— National Aerospace Centre. It's sort of about 45 minutes out of Christchurch by—

Craig Young:
Lake Ellesmere way?

Paul Spain:
Yeah, Lake Ellesmere. And yeah, really inspiring just to see what they've set up there. This was a space that originally Rocket Lab were looking at as potentially where they could launch Electron from. In the end, as we know, that ended up in the North Island, not in the South. But they have a space there with an airfield that's testing, you know, a range of things from, you know, what Dawn Aerospace are doing there with their space plane, and, you know, SCIOS and others. But it's also attracting international attention. And so, Yeah, I think it's exciting. They potentially could support vertical launch from there.

Paul Spain:
So I think they talked about potentially 3 different launch pads that they potentially could have within that space. So yeah, lots of opportunity ahead for a growing sector.

Craig Young:
Looking at some stats last week, if you list countries in the order of the number of rockets, because rockets are rockets, right? Great things. Yeah, yeah. Number of rockets, big and small, that have been launched in the last 12 months, New Zealand is the 3rd country in line. I mean, you can understand who the first 2 are.

Paul Spain:
Yeah.

Craig Young:
But yeah, so in terms of number of rockets, we're the 3rd one. But I think it's an example of where, you know, New Zealand can play smart.

Paul Spain:
Yeah.

Craig Young:
So Rocket Lab's been really smart. You know, they've found a space. They're not trying to build, you know, the supersized rockets that Elon Musk is trying to build and land, et cetera. You know, they've found a space where New Zealand technology New Zealand people can utilise technology and actually create something that fits the market, meets the market, and is unique. And I think it's a good lesson for all of our technology sector, which is you don't have to be everything to everybody. And in fact, you don't have to be anything to everybody or everything to anybody. You've just got to find the niche that works well for New Zealand and Kiwis. And so play on our strengths, find that space, and then just go for it.

Craig Young:
And, you know, Rocket Lab is showing us that you can actually clean up and provide, you know, and grow significantly.

Paul Spain:
Yeah.

Craig Young:
Yeah.

Paul Spain:
And, you know, like, it's incredible to, you know, just to watch their growth and what they've been achieving. Obviously, you know, some really impressive acquisitions as well as part of their broader growth story. But, you know, I had a look this morning and there's, dozens of roles within Rocket Lab in New Zealand that they're hiring for right now, whether that's directly in Mount Wellington, Auckland. They've had some roles in the Waikato, which I hadn't seen before. Mahia, where they do the launches from, and also Warkworth, which is where they're doing a lot of production.

Craig Young:
Yeah. We will know that Rocket Lab has really landed or really, you know, taken flight when they— when, when Lego does a Lego set of an Electron rocket. There you go.

Paul Spain:
You heard it here first. Or a Neutron.

Craig Young:
Or a Neutron. Yeah, you heard it here first.

Paul Spain:
Yeah.

Craig Young:
So if you're listening, Lego.

Paul Spain:
Yeah, yeah, yeah, yeah, yeah. That's— yeah, no, that'd be very— that'd be very cool. I don't follow that closely enough to know what rockets have been, have been made from from a Lego perspective to date. But yeah, that'll be good to see. And, and SIOS Aerospace getting a lot of attention as well. Sam Vye, who, you know, we've had, you know, on the podcast earlier on in the year, he was giving one of the keynotes and, you know, talking about what it takes to win on the global stage and some really, really good insights. And I think, you know, a key looking in at SIOS is the pace at which they've, you know, they've, they've worked. And, you know, timing accounts for, for a lot as well.

Paul Spain:
So, you know, they've taken up a significant opportunity, you know, closely tied to the Ukraine and, you know, Russia war. And I think, you know, that, that's, that's probably part of the reason that we end up, you know, seeing, you know, protests outside the Aerospace Summit as there's a defence aspect to it. But there's also a reality as a country, as, you know, part of the Five Eyes that, you know, New Zealand probably needs to defend itself like most other nations to some degree. And if we can contribute in ways that are positive on the global defence stage, then, you know, I think there'll be a lot of— well, there tends to be, you know, a fair amount of support for that.

Craig Young:
Yeah.

Paul Spain:
pushback and those who are completely uncomfortable with anything that's, you know, relates to war. So, you know, I think it's good that in New Zealand there can be folks turning up outside a conference and showing that they disagree with it and they don't get, you know, shut down like they would in, you know, in some parts of the world. So, yeah.

Craig Young:
I would say one more thing about the aerospace sector, and it's about things in general, in that you see innovation coming from companies like Rocket Lab and so, you know, because the environment's been set and the government's taken some leadership. So government taking leadership is not necessarily about money, but it's about setting things up, talking it up, being there, encouraging it. You know, we've had really good ministers in this space who have focused in on it and, you know, talked it up and talked it up when it's overseas. And that's what you need. in these sectors, in the tech sector and in this area, you don't necessarily need ministers or governments giving money, but you need them giving some leadership, talking it up, being out there talking about it. So aerospace, great example. We should be doing that across broader technology sector.

Paul Spain:
Yeah, it's a good point. And in fact, there was a session on the Thursday, which was their kind of, sort of smaller day, they didn't have the big keynotes and so on, that was all on the Friday. But there was one session there with the Civil Aviation Authority, and that was, yeah, that was really, really insightful.

Craig Young:
Yeah.

Paul Spain:
Led by Catherine McGowan, who used to be part of Wisk Aerospace when they were doing R&D in New Zealand. And what really stood out to me is a very sort of pragmatic approach to, you know, how they're operating. And so they've got this focus that's not just on, hey, how do we, you know, have appropriate regulations, but how do we have appropriate regulations that also support innovation and a growing sector in New Zealand? So that there's an appropriate balance of red tape, shall we say. And yeah, I was very encouraged actually by that. And it seems like that's come a long way from where it was if we look back a decade. There's been significant changes. So, you know, it shows that governments can get it right and can do good things.

Craig Young:
Mm-hm.

Paul Spain:
And, you know, that's taken, you know, multiple governments to bring that transition and change, but some really good work. internally from the CAA. So, you know, hats off to them on that front. And yeah, as you say, you know, space ministers and the like have been doing some great work and some of that was, you know, was certainly called out. Now, we've done a whole lot of content from the Aerospace Summit, so that'll be coming up—

Craig Young:
Yep.

Paul Spain:
Over the coming days. I'm not sure if we've got an exact day for launch of that, but, you know, certainly within the next 1 to 2 weeks. bunch of interviews that were carried out there at the Aerospace Summit. It was great to catch up with so many people, and yeah, fortunately I was able to capture, you know, a number of those chats. Next year we'll see the Aerospace Summit come to Auckland, so it steps it up in terms of, you know, being closer to, you know, I would say where the biggest part of the aerospace sector is, is Auckland. You know, Christchurch has a has a significant role there as well. And hence why Christchurch NZ, the council's economic development and their economic development group really get behind the event and were nice enough to bring me down to the summit. So thanks, Christchurch NZ.

Paul Spain:
Now, also on the New Zealand Craig, you mentioned around Bunnings having launched their AI assistant to help out DIYers. Have you had much of a look at this?

Craig Young:
No, I haven't tried it yet. I mean, people will, you know, my family will tell you that my favourite time of the weekend is when I pop off to Bunnings to search the aisles for things that I think I need.

Paul Spain:
Yes, yes.

Craig Young:
And things that, you know, like the, uh, which anchors will actually not rip your jib board, for example. Um, but yeah, I thought this was really interesting because it's a great use of the technology, bringing it into mainstream. So individuals who, you know, might use the Bunnings website or the Bunnings app, there's this button which says Buddy. And so you can go there and you can, um, utilize it. It'll ask you questions, you can answer it. But also what I did read was you could Draw up a handwritten list, scan it and chuck it in, and it'll tell you, you know, give you step by step and products, etc., on what you can and can't do. So if you're planning a deck, for example, it'll give you some steps, project steps, relevant products. And then I haven't checked it, but I presume it tells you where they are in the store because that's always the hardest thing.

Paul Spain:
Right.

Craig Young:
I don't know what you're like when you go into one of those big stores, but Actually finding something sometimes is the hardest thing. So that's some— that's really a really interesting use of the technology. And I thought the other interesting thing was it was built with Gemini's enterprise tech. And so when I looked at it, I thought, that's got to be Gemini because we're a Gemini shop.

Paul Spain:
Right.

Craig Young:
And the utilization of that sort of technology from someone like Google, you know, is showing that the enterprise side is starting to pick up. And I think that's where these large organizations are wanting to play a lot more, you know, these bespoke AI tools utilizing the enterprise technology. Because for the Googles, the OpenAIs, the Anthropics, that's where the money is for them, you know? And at some point these guys have to make money.

Paul Spain:
It's always interesting to see Yeah, how new technologies become mainstream. You know, AI is one of those where, you know, lots of companies have, you know, made varying plays. I remember one of the early ones in New Zealand for an AI-driven chatbot was a particular supermarket chain, Pack 'n Save, the stickman brand. Oh yes. And you could throw in ingredients and then it'd tell you what you could put together. But of course you could— it didn't have that many guardrails, so you could put in ingredients of something that maybe would kill you. So you have to be careful. They've tried to put some guardrails on this.

Paul Spain:
So something I've been looking at recently and working with, working with some of the AIs on is an approach to some smart control for my, my hot water in my home. So that's what I threw into Buddy, kept it very simple. This is what I typed: best approach to smart control for hot water system. So very light, not much detail. Came back with: if that's a licensed job, it needs a licensed tradie. I can still help you pick the right kit but cannot provide any guidance— sorry, any advice. Please contact a professional. So it's kind of, you know, saying you know, can help me pick the right kit.

Paul Spain:
So then I was, you know, basically asked it to, you know, well, what can you help me with planning and purchasing the relevant components? Because you can buy a Rheem, you know, hot water cylinder from Bunnings and, you know, varying other kind of components. So, you know, help me plan it and purchase the relevant components. You know, and I said, you know, if I'm using a registered electrician for the job. It came back with what I've often seen where there are guardrails in place. It just completely repeated exactly the same previous statements. Hardwired. Here it is. Computer says no.

Paul Spain:
Sorry, Paul Spain, not here to help you today, is kind of the way it came across. Now, I— and I get that they have to, you know, be cautious with where they could get into trouble.

Craig Young:
Yeah.

Paul Spain:
You know, in the same way, if you've got an AI giving financial advice and, you know, that's a regulated area. So yeah, it is. It's just, it's interesting just to, you know, to see how they handle those kind of more tricky edges.

Craig Young:
Yeah.

Paul Spain:
Whereas, you know, you could argue across just about anything that they do, you know, if it's building related, that, well, you know, you could be getting close to some some regulations and so on. So I don't know how often those things will come up for others. But, you know, look, I applaud the, you know, the experimentation and the use of the technology. But if it does end up, you know, just continuing to sort of say no, then that can become a frustrating experience as well.

Craig Young:
So the other thing that'd be interesting with the Bunnings one is it is obviously built by the Australian parent. So I presume it's going to take into consideration New Zealand regulation, etc. So looks like a little test for many of us this weekend. Try it out, see what it does. And I'm going to put in something like you tried and see what happens this weekend.

Paul Spain:
Yeah, yeah, yeah, yeah, yeah. So I tried a different one and just asked it in very simple, what hot water cylinder options, or I put it in HWC options, do you, you know, do you have? And it's come back with, with a bunch there. But it's interestingly, it is, it does look different from what I, you know, I thought that I had seen from them previously.

Craig Young:
Right.

Paul Spain:
So I don't, I don't know. whether they're out of stock. But yeah, when I do a Google search, it comes up with the Rheem hot water cylinders. When I use— oh, look at this. It's actually my— I searched for Bunnings and Buddy because that was the name of the product. It actually had taken me to the Australian website.

Craig Young:
Okay.

Paul Spain:
So that's why I'm not seeing Rheem being in New Zealand brand. So there you go. Anyway, enough live experimentation on the podcast. Back to our current agenda for the day. Let's delve into some, some of the things on an international front. Now, we, you know, we talked about AI enabling some very sophisticated, you know, phishing scams or, you know, spear phishing. types of campaigns that are, you know, very, very personalized to, you know, to individuals within an organization, something that wouldn't have happened in the old days. But the news did come through around one of these voice scams.

Paul Spain:
Now, you know, probably most people will have heard through, you know, phishing training and, you know, whatever other mechanisms, they would have an awareness that, and through other, you know, for other reasons, that voices can easily be faked in 2026. And, you know, that's been possible for a number of years, you know, video too, of course. But what we saw was Italy's top bank, Intesa, have an amount of €95 million that was scammed. Through fake WhatsApp messages and then an AI-cloned voice that I understand impersonated a senior executive within their organisation. They recovered back more than half of the figure, but still the final figure that was lost, I understand, was around the $70 million New Zealand dollar level. So, and this, this one was, you know, some, some, some months ago now. It's only just very recently come, come to light. It's a reminder that organizations need to have appropriate and robust mechanisms for, you know, testing and, and proving things, especially related to financial approvals.

Paul Spain:
And I know this is a challenging area for many because it does add some painful layers. But I think the reminder is, and I came across this being in the US last week, was that, you know, there are parts of the world that still have to deal with cheques and banking cheques and getting cheques cleared and all of these sort of things that, you know, in New Zealand, a transaction happens electronically, has done for a very long time. We haven't had cheques here for a long time. And there are people that go and clear a letterbox for cheques and then go and deposit those in banks. So, you know, when we find it an inconvenience to get proof when it comes to making payments and so on, it's just because life has become a lot more digital and a lot easier. And, you know, some of these things still do need an extra layer of process around them.

Craig Young:
It's a tricky one, isn't it? Because if your boss rang you— well, you run your own business, but let's say one of your staff members took a message from you saying, I need— I'm here and I need XYZ. It's tricky for them to go, no, boss, I'm not going to do it for you. But that's the sort of behavior we're going to have to build into this sort of thing, isn't it? So, you know, you're going to have to have, I don't know, secret words? passwords, particular things to authenticate things. So it's going to be more complex. The good thing is we do have technology, and technology often finds a way through. So we will get there, but it does remind us all to be very careful and mindful of what's coming.

Paul Spain:
It really does. And, you know, these are things that we have been training, you know, people for, for, you know, years when it comes to cybersecurity awareness training. Your organization may not have the structures to have those sort of mechanisms in place. And that is one of the other challenges that we have in New Zealand. And we've been, I guess, telling people for years about Team New Zealand. They were a small organization when they sent offshore to a cyber—

Craig Young:
A competition.

Paul Spain:
criminal who scammed them, you know, a significant percentage of their budget for America's Cup campaign when they, you know, deposited money into the wrong bank accounts because they didn't have those processes set up. And yeah, these are the realities that can happen. But there are, you know, pretty tried and tested mechanisms for ensuring that we avoid these sorts of issues.

Craig Young:
Yeah.

Paul Spain:
But it's those things that sort of come out left field that are a little bit different and where we forget to slow down, think through, is there a process? What does that look like? You know, and why is somebody contacting me via WhatsApp rather than—

Craig Young:
Yeah, that's right.

Paul Spain:
You know, et cetera, et cetera, right? So yeah, some good learnings, but yes, I understand. And look, in some cultures too, the way in which people will respond to a senior leader can vary. I think in New Zealand, we're probably more on the egalitarian side.

Craig Young:
I was going to use that word, yes.

Paul Spain:
And more likely to shun a boss who's not following the appropriate process and say, well, thank you for your call, boss, but you will need to come back to me through the official processes. And in some parts of the world, that, that, you know, just might never happen. So yeah, it's a, it's a bit of a shocking one.

Craig Young:
It is. That one.

Paul Spain:
But, you know, these things keep happening and they have done over a long, a long period of time. But this is a reminder that, you know, these sorts of big scams are not all in the past. They are still, you know, they're still happening today and AI makes them unfortunately an increasing threat rather than something that's necessarily about to disappear. Yeah. We had news through that OpenAI has fired 3 members of their team for mishandling sensitive information. These were members of the AI safety team. Look, it is hard to read between the lines and to fully understand what's happened here. But we're certainly in complicated times when it comes to AI safety.

Paul Spain:
And also, I think that we're seeing more openness for people to be whistleblowers of sorts and the like, where they see things that concern them. And look, we don't know the full story.

Craig Young:
Yeah.

Paul Spain:
On this one, you know, we're told that they were not, you know, dismissed for calling or raising out safety concerns. But yeah, it's complicated. It is.

Craig Young:
And it's pretty important because these large tech companies, you know, Meta, OpenAI, Anthropic, are saying that their safety teams are going to keep us safe. And so there's no, therefore no need to regulate or put in place rules or anything around it. So if we can't trust their safety teams, then we, we really do need to look at what else do we need to put in place. So as you say, it is complicated. Do we need to read between the lines? I don't know. There's probably NDAs involved as well now, unfortunately. So, but yes, you're right, there has been a number of whistleblowers over the just the last 6 months, isn't it? So we're starting to see some real concerns arising out of some of these people. So it's a, it's a very interesting time.

Craig Young:
And then you get to, um, you know, OpenAI is an American company. We have a president who's saying, you know, don't worry about rules, just go, go, go for, go for gold, gangbusters, you know. Don't know why anyone wouldn't want to have an AI data center in your backyard. Um, and then other politicians— I heard this morning that Bernie Sanders wants to jail people who work for these organizations that push forward rather than taking their time. So it's a real jumble of messages coming out of that environment, isn't it?

Paul Spain:
Yeah, and often from people who don't really have maybe a clear understanding of—

Craig Young:
That's a very polite way of putting it, Paul. Of the picture.

Paul Spain:
But reality is, I think for, you know, for all of us to get a, you know, to get a full, clear perspective is actually very, very hard because, you know, there's so much money involved. There's so much, you know, at stake that, yeah, knowing where the genuine risks and challenges are, when it is and isn't appropriate to bring in regulation, especially if the regulation actually ends up benefiting these biggest players, you know, certainly complicates it. And now, of course, we've got, you know, US President Donald Trump having created what's being called the Superintelligence Force and this sort of mandate that, you know, US government entities have to change their terminology from AI to SI, from artificial intelligence to superintelligence. So, you know, you've got more rebranding kind of going on there as well. So I mean, we're getting, you know, somewhat used to, to that with Lake of America and, and, and, and the like in the US. So yeah, fascinating times. One thing that caught my attention from a telecommunications perspective was a subsea cable cut between Singapore and Philippines, and those 2 countries I've just been in in the last couple of weeks. And so, yeah, that certainly caught my attention.

Paul Spain:
That was, I think, end of last week. And that led to some disruption to connectivity. Now, like most countries, there's a level of redundancy, but it seems that they weren't maybe as prepared as they should have been. And it did lead to a significant chunk of— disruption there for at least a number of hours. So, you know, a reminder that it is important to have redundancy when it comes to connectivity. New Zealand conveniently is a lot better placed than we were in the early years of the New Zealand Tech Podcast when, you know, it was like, ooh, yeah, we need some redundancy. We now have a fair chunk, but You know, if you end up with a nation-state wanting to cut a country off, that is actually probably, you know, not out of the bounds of reality for it to happen. And so things like having data centres that are here within New Zealand and, you know, allow certain parts of the economy to keep operating if we were—

Craig Young:
Mm-hmm.

Paul Spain:
disconnected from the rest of the world to a small or large degree, actually becomes something that becomes important along with having local AI capability too.

Craig Young:
It's easy to forget that digital and broadband and mobile all relies on physical infrastructure. These fibre cables that are under the sea, they're not buried, they're just sitting on the bottom of the ocean. So they can be dragged up. And in fact, you can go right back to the first cable, or the telephone cable put between the North and South Island. They laid it the first time, it didn't work. The second time they laid it, the ship went to leave the harbour and pulled up its anchor and pulled the cable up. You know, it took them 3 times to put it in. It's quite an interesting story.

Craig Young:
That is amazing, isn't it? But yeah, I think New Zealand, you're absolutely right, is better served, except that all our cables land on the North Island. Which happens to be the shakier island.

Paul Spain:
For now.

Craig Young:
For now. I think I'd just, um, if you want to know more about how the internet actually works at a physical level, there's a couple of really good books. One I read a couple of years ago called Tubes, which is the journey to the center of the internet, and it's about the physical pipes and infrastructure of the internet. It's a really easy read. It's actually really simple to read, but it's something if you want to understand And a little bit more about those unmarked buildings that you see out by Whenuapai, et cetera. This is what these things are.

Paul Spain:
Yeah.

Craig Young:
And then there's another one that came out last year, I think, which was The Web Beneath the Waves, because these are fragile cables. You can break them. And so that's another really good place to— it's not very long. It's quite a good little book to read about how these things hang together.

Paul Spain:
Yeah, yeah, no, it's great. And yeah, I've had the privilege of being able to get on board a couple of the ships that lay those cables. And I imagine you've seen that stuff too. And yeah, it is a fairly flimsy piece of infrastructure in the scheme of it. And when it has to run for many thousands of kilometres to link New Zealand to the US or Australia, et cetera, you understand there has to be a balance in how how strong these things are. Yeah, that's right. And yeah, the redundancy of connectivity is important. Some might think, well, actually that's okay because, you know, satellites, Starlink, etc., we're fine.

Paul Spain:
But of course, generally those are going to be bouncing back to New Zealand when it comes to, you know, local landing stations. And so, you know, in terms of actual connectivity to the rest of the world, It is, it is, you know, I don't know what the percentage is, but it is very, very, you know, significant percentage that is running over fibre optic cable. And, you know, the percentage that you could run, you know, outside of that, you know, would be a very, very tiny fraction of, of 1% would be my, my pick.

Craig Young:
And satellites.

Paul Spain:
We'd be pretty stuffed without our fibre optic connectivity. And not trying to give any baddies any ideas there, but yeah.

Craig Young:
Satellites can do amazing things, but they still have the laws of physics to cope with as well when it comes to latency, et cetera. But it just shows an example, we need all of these things. We need satellite, mobile, fibre, fixed. You need all of these pieces of infrastructure to make your economy and your digital future work properly, and it'd be wrong for us to put all our eggs in one basket.

Paul Spain:
Yep, yep, yep. Well, um, I'm keen to just get a bit of an update on what's happening in the, in the world of, of 2ANDS, Craig. Um, you know, tell us a little bit about, um, you know, well, the big thing, what 2ANDS is and what you, what you're up to for those who aren't familiar.

Craig Young:
Well, I think people, uh, often think that we're an industry group. We're not. We're a user group if you really want to, if you want to put it nice and simple. We're here for the users of technology and telecommunications in New Zealand. I mean, our DNA is telecommunications, but we're now looking at all things tech. And so we're the only ones, really the only independent organization that speaks on behalf of users. So technically, that's everybody in New Zealand, right? So that's, that's who we talk about. And, and we've just turned 40.

Paul Spain:
Congratulations.

Craig Young:
Thank you very much. We should have a birthday cake.

Paul Spain:
You don't look a day older. This is the organization, not you.

Craig Young:
That's right. Yeah, yeah, 1986.

Paul Spain:
Yeah.

Craig Young:
It was started.

Paul Spain:
Wow.

Craig Young:
So we were birthed out of the New Zealand Computer Society in 1986. And so, you know, things have changed over those years, but we are now, we consider ourselves the longest New Zealand operating association in the tech community because the New Zealand Computer Society, which then became IT Professionals, has now closed up. So they've gone. So, you know, um, cred to us, we're still here. We're number one. I'm not saying that we're the best, I'm just saying we're the longest operating association, uh, and it's a great place to be. I mean, it's, uh, it's not easy out there. Everybody is, is taking it hard, and so associations are the same.

Craig Young:
But, you know, we've been around 40 years and we'll continue to make noises where we need to. Um, yeah, so that's, that's our big thing. That's where we've— that's our looking backwards.

Paul Spain:
Folks that are interested in joining Two Hands, whether that's individually or you have organisational support as well, what's the process?

Craig Young:
It's pretty simple. You go to our website and there's a button that says join our community. So it's, you know, for an individual, it's only $175 a year, gets you a free ticket to our conference that we have next week, which is worth $250. So straight up, why don't you join and get a free ticket? You know, that's the sort of thing. Organizations cost a little bit more because they've got more people in their organizations. But our number of individual members is starting to grow. We're seeing people going, actually, I'm interested in that stuff. And I want to know what's going on and want to hear what's going on.

Craig Young:
And so that's bringing a real sense of momentum and urgency. And for example, we're a membership association. We have a board selected by our members. 12 members, there were 6 positions up for election. Last AGM, there were 17 people who put their names forward for the board.

Paul Spain:
Oh, okay.

Craig Young:
And it's not a simple thing because they have to take on the responsibilities of running an organisation. And there's director requirements, et cetera. But 17 people wanted to get those 6 positions. So unfortunately, some people had to miss out. Someone needs to continue to stand up for what's happening on the user side of things.

Paul Spain:
Yeah. Yeah. Folks that are interested, go and have a look. And yeah, if you're wanting to go to the Tech Users Summit next week, then hey, perfect time to sign up and join.

Craig Young:
Sign as a member and you get a free ticket.

Paul Spain:
Yeah. Excellent. Oh, that's good. Your focus at the moment, other than the summit, we've got an election coming up. You've got some thoughts on that.

Craig Young:
So back in July, we released 6 statements around what we're looking at. And next week we're going to release it as one document. But it really is around, you know, the themes of responsible use of generative AI. So we are pro-AI, but we want to see the responsible use. Data transparency and agency, so you get to control where your data's being used.

Paul Spain:
Love that.

Craig Young:
The future workforce, you know, how do we encourage more young people to consider digital as a career? And particularly women, we need more women and we need more Māori and Pasifika. You know, that's our superpower, New Zealanders, you know, Māori and Pasifika culture, bringing that into there. There's the access and inclusion, that's our, you might want to say our DNA, where we come from, making sure everybody can connect. And then being safe and secure online. So whether it's talking about what we've been talking about, cybersecurity, or the age-gating of social media, you know, we think that's a really important thing to be talking about. And it is also way more complicated than just saying ban every child from social media. There are all sorts of issues around there, and we try to bring some nonpartisan, quite evidence-based, clean thinking to these topics so that you can work through those. So those things that we're talking about, those 5 themes, we are trying to think of what are the things that can move the dial for New Zealand? Not asking the government to do everything, just what are some of those things that can be done? But I think the biggest thing that we are most concerned about And I think it's, if you look across all the infrastructure organisations, whether it's in water, electricity, roads, digital, it is about long-term planning.

Craig Young:
It is about governments having an agreed direction to move in. And so because technology, roads, et cetera, they last longer than election cycles. And unfortunately, we don't want to see this chopping and changing. You know, again, we want to see stability and the ability to invest in our future. So our top measure or message to our government or whoever's the next government is we want to see a multi-party agreement to where we take digital technology in New Zealand to boost our productivity and build our economy. That's our overall message. Yeah.

Paul Spain:
Oh, it's really good to have that, you know, have that positive focus forwards. for New Zealand. And look, as you point out, some of these things are complicated. They're not easy, but we've got to have the dialogue. We've got to be looking at, well, how do we maneuver forwards with intention?

Craig Young:
Yeah.

Paul Spain:
And so, yeah, it's great to see that continuing. So thanks for what you do there, Craig. And thank you to all who are members of Two Hands for the the positive contributions there. So—

Craig Young:
Thanks, Paul.

Paul Spain:
That's good stuff. And you put in a note here about RANCO. This is the coming together of the radio access network components that has been proposed by Two Degrees and One NZ. I'm curious what your thoughts are, you know, on this topic.

Craig Young:
It's a great example where you want infrastructure sharing as far up the, if you want to call it the technology stack, as you can, because that reduces the investment cost, right? So you can do more with less. But you want retail competition down as far as you can as well. So you've got to find that balance. And if you look at a mobile network, which is what we're really talking about, right?

Paul Spain:
Mm-hmm.

Craig Young:
There's sort of, or a mobile company, there's sort of 4 key elements to it. You've got the customer-facing bit. So that's your, you know, the ability to bill you, to charge you, to run the service for you, your broadband, etc. Then you've got the core network. So that's the bit of the network that has all the intelligence, smart. So that when you make a phone call or when you send a text message, you know, that's the bit of the network that goes, oh, I know where that goes, and sends it off to the next bit. Then you've got the radio access network, which is the bit in the air, you know, the aerials, the phone device, you know, with actually communicating. And then you've got the physical bits.

Craig Young:
So, you know, those are those towers you see on the top of the hills. Now, both mobile companies sold off the towers a couple of years ago and they're owned by 2 other companies already.

Paul Spain:
Both mobile companies?

Craig Young:
Sorry, all 3. All 3 mobile companies. Sorry, I should say all 3 mobile companies. Yeah. The only Mobile company provider that owns mobile towers now is the Rural Connectivity Group. Well, we should put them in a separate box. Yeah, so what the RANCO is doing is 2 Degrees in One are saying, well, actually we want to put the next bit of the level, which is that radio access network, the bit that controls the access to your device and then back into the core, into one company.

Paul Spain:
Yeah.

Craig Young:
So we don't have to invest as much. And so there is real benefit to that. And not just for them, but for New Zealanders, because every dollar that they don't have to invest in equipment means they don't have to charge customers, 'cause no one else is paying for equipment, right?

Paul Spain:
Yep.

Craig Young:
So there is real benefit. I think the downside, or what we have to be careful of, is that it doesn't reduce competition. And so we need to see what those rules are and how they set it up, what the Commerce Commission comes up with. Whether it limits innovation, because, you know, can you do smart things at that level? I don't know enough about— I'm not a tech— you know, I'm not an engineer, but there are things you can do. A lot of computing is moving to the edge, so is that going to impact that? So look, it's an open question. It's something we need to keep an eye on. And the Commerce Commission has actually come out now saying, here are some of the issues around it.

Paul Spain:
Mm-hmm.

Craig Young:
So we'll look at that, and then we'll try and make an evidence-based submission on what we think is the best outcome for New Zealand users. And we always come back to that. What's the best outcome for users? Yep.

Paul Spain:
Yep. Yeah, I do see the Commerce Commission late last week have put out a statement of preliminary issues. So, you know, they have raised some elements. It's a, it's a reasonably kind of chunky document that I haven't run through or had AI summarize just yet because I hadn't actually noticed it was out until I was just looking now. But one of the things that they're, you know, that they're just, I guess, reminding, you know, bringing a reminder of is that they They do need to assess these types of things that might lead to any lessening of competition. So that's part of what they look at. And they basically will only give their clearance if they don't anticipate that leading to a substantial Lessening of competition. But there's a whole lot more packed into those documents.

Paul Spain:
And I'm sure, you know, those across the telco land especially, you know, will be having a close look and be watching this pretty closely. But yeah, I think, you know, at times there will need to be, you know, changes that may bring down costs or, you know, may have other, other, other implications. And I certainly don't know at this stage whether, you know, which side this one, you know, this one lands on.

Craig Young:
Yeah.

Paul Spain:
And, you know, I think the impact will— whatever happens has an impact, you know, not only on the other, you know, across the industry internally, but has a broader impact on you know, consumers and businesses. So, you know, this does need to be done in an appropriate and thorough way. So we trust the Commerce Commission will get that right and, you know, make an appropriate decision in the future. Yeah. All right. Well, thanks for your comments on that, Craig. Anything else you wanted to add before we finish up?

Craig Young:
No, I think, you know, the topics we've discussed are the ones that are front of mind for most people at the moment. AI, security, you know, those sorts of things, New Zealand's direction, etc. And obviously we'll be covering those at our summit next week on Tuesday. So as you said, you know, that's the place where we get to talk about these things and share the information.

Paul Spain:
Great. Well, just a little reminder, if you're really curious and keeping up to date with what is happening in the aerospace world, we do have that package of interviews coming that may end up being across multiple episodes. So stay tuned for that one. If you've been watching this, then do make sure you're following us on your favorite audio platform, whether, whether that's Apple Podcasts, which is, you know, is still very, very big in the podcast world, you know, Spotify, YouTube Music, etc. And if you've been listening to the audio, then, you know, well worth, you know, subscribing or following us on YouTube is our predominant platform for, for video at this point, but also myself and NZ Tech Podcast on, on LinkedIn is a good way to, to keep up to date with, with the happenings as well. And I'm sure, Craig, you can be, you can be tracked down on, on these sorts of places as well.

Craig Young:
Just about everywhere. Yeah, yeah, yeah. People talk to me about, am I feeling insecure on You know, with all the stuff that I do, well, my face is out there. It's just like you, our faces out there, pictures are out there, so you can find us anywhere. Google Craig Young, @2Ns, and you'll find me. Yep.

Paul Spain:
And we have also opened up on the NZ Tech Podcast site, I believe, an opportunity now to sign up for our newsletters. So that will give you more than you would just catch through through the podcast. So that gives you an extra source. So yeah, thoroughly recommend that as well to keep up to date. And that's on our new website. You will have seen our new logos go up. So we've got change afoot, put it that way. Thanks everyone for listening in.

Paul Spain:
And of course, thank you to our incredible show partners, PwC, SAP Workday, One NZ 2degrees Spark and Gorilla Technology, hugely appreciative of that support and we'll look forward to catching everyone on the next show and thank you very much Craig Young for joining us.

Craig Young:
Thank you Paul. Cheers.