Podcast transcript: EY Change Happens Podcast – Michelle Price

Intro: Change happens how we respond to change can make or break us and our careers. Join us for an intimate insight in to how senior business leaders face change. The good, the bad, and everything in between because whether we like it or not, change happens.

Jenelle: Hi I’m Jenelle McMaster and welcome to the ‘Change Happens’ podcast. A conversation with influential leaders on leading through change and the lessons they’ve learned along the way. And today I’m joined by Michelle Price, CEO of AustCyber.

Michelle is a passionate advocate for all things cyber but that’s going to become apparent to you pretty quickly when you listen to her speak. Michelle was the inaugural Chief Operating Officer or AustCyber when she joined the company in January 2017 and then was quickly appointed as CEO in April 2018. And prior to that Michelle was with the Department of Prime Minister and Cabinet where she played an instrumental role in the delivery of the highly regarded 2016 Australia’s Cyber Security Strategy and coordinated national security budget.

Michelle was recently awarded the AWSN Award of 2020 by the Australian Women in Security Network. And that recognises and honours the accomplishments and contributions of individuals or companies that are making a real difference in reshaping the security landscape.

Michelle has made significant strides in the world of cyber and her ability to lead change across the cyber security ecosystem has resulted in new growth avenues for Australia’s economy both domestically and abroad.

I look forward to exploring how Michelle goes about creating change and hearing the lessons that she’s learned along the way.

Welcome Michelle, how are you?

Michelle: I’m great. It’s so good to be with Janelle. Thanks for having me.

Jenelle: Oh my pleasure. I’m excited to have this conversation. Before we get into it Michelle, in layman’s terms, what does AustCyber do? And what does your role entail?

Michelle:  AustCyber is one of the Federal Government’s six industry growth centres. And so we focus on the growth of cyber security and my job is to grow Australia’s cyber security industry and ensure that we’re globally competitive and we can contribute to the country’s sovereign capability when it comes to cyber security. But I guess a bit more than that too is to make sure that the broader economy understands the role of cyber security as a growth opportunity as well.

Jenelle: Just thinking about the context that we find ourselves with COVID, I imagine, with a near overnight shift to remote working, digital businesses completely rethinking their supply chains, there’s quite a massive set of implications for AustCyber, how has COVID been impacting your professional world?

Michelle:  It’s been so significant.

Jenelle: I’ll bet.

Michelle:  I think that obviously there’s been a lot of discussion in the national media about the increase of malicious cyber attacks on Australia during the lockdown periods, plural now. But also more broadly there’s sort of vulnerabilities that have emerged within the Australian economy that can be taken advantage of through malicious cyber activity. And I think further than that, there’s been, that realisation now that goes beyond our own sector into broader economy that we are living now in a cyber physical world. That things that have a physical manifestation will also have a digital manifestation and things that go on within the digital world can have physical impacts as well.

And so from the moment that we found out from the World Health Organisation, you know all the way back in February that there was a global pandemic emerging, AustCyber got super busy and we could foreshadow some of the things that were coming but of course like everybody else there was lots that we didn’t foreshadow or foresee at all.

And so it’s been a mix of going into full tilt support to those companies within our portfolio and our industry more broadly to help them survive. But of course with the increased demand on cyber security services and products to help remote working and remote schooling, it’s also been about right sizing some of that capability to be able to be deployed quickly but also to help the smaller companies within the industry understand where they can fit because they haven’t necessarily had the scale to be able to deploy quickly. But that’s scaled right up into being able to help the Australian Government as well as Governments overseas. Try and work through the sort of quagmire problems and challenges that the world has been facing during this time.

Jenelle: Just speaking about Australian Government and malicious activity, in June this year Prime Minister Scott Morrison announced that Australian private sector and the public sector organisations had been under sustained cyberattacks by a Foreign Government and over the past 6 months we’ve seen a lot of headlines mentioning Australian organisations that have been attacked. In your opinion how well placed are we as a nation to individually and collectively deal with that increasing threat?

Michelle:  I think that’s from an individual point of view. The situation is vastly different from where we were 5 / 6 years ago. But it’s still not at a level where we can say that we’ve got an overall baseline and common understanding across the Australian community about why it is so important to be thinking about the security and privacy ramifications of the types of activities we do in this cyber physical world. But collectively I think we’ve really stepped up our game over the past 4 years in particular since the release of the 2016 National Cyber Security Strategy and the Government obviously had released an update to that this year with the 2020 Cyber Security Strategy. I think in between almost every jurisdiction in Australia has also released its own cyber security strategy to organise at the state and territory level as well as local Government level. That’s really driven forward a lot of change within the ICT and technology areas of the economy. We’re probably still though honestly quite lumpy when it comes to boarding out across the rest of the sectors that haven’t traditionally had digital infrastructure as their first port of call. We’ve seen this obviously manifest in challenges and problems in moving rapidly from an office environment or a school environment into the home environment. We’re seeing a lot of vulnerability being exposed as a result of that.

We’re doing better than where we were 4 /5 years ago, but we still do have a way to go. I guess the upside within that is that we shouldn’t feel as though that’s a depressing state. This is actually the situation for every nation on the planet and the high, high bar that is set around what great looks like when it comes to cyber resilience is often Estonia because Estonia does have a very centralised approach to digital identity and the intersection of physical infrastructure and digital infrastructure. But we need to remember that Estonia actually did that in response to some significant attacks from their near neighbour Russia and had a really, really big push on trying to maintain their sovereignty through the digital domain and how that then impacted on the physical domain.

Australia is in a very, very different position and we often refer to the incentives to step up our cyber security game coming from the economy more so than the protection of our country’s sovereignty. The incentives to do this is very, very different. But we’re certainly not at the bottom of the pack by any stretch of the imagination and in fact we’re one of the top nations within our part of the world when it comes to dealing with cyber risk and cyber threats and more broadly across the world we probably sit somewhere in the top half so we’re not doing too badly.

Jenelle: I understand this is a big week for you with Cyber Week. Can you tell us what that’s all about and why it’s so important during this time of recovery?

Michelle:  Yes Cyber Week. We’re doing this for the fourth year in a row at AustCyber and it’s all about having a national focus for a week where we can de-risk, disarm, myth bust, all of the things that go into people’s perceptions of what cyber security actually is and really open up conversations around different elements of the cyber security industry and the role that it has on both the Australian economy but also the community more broadly.

This week we’ve got huge amounts of activity going on across the country both in hybrid events through an online platform that’s a bit like a circuit gauge style virtual conference where people can access a whole range of different topics to learn more about what goes on for cyber security but also to meet the companies that are these fantastically innovative entrepreneurs that are both inventing but also driving change through both products and services in the economy globally. It’s all free. Engage, engage, engage.

Jenelle: Just picking up on the point around the quality of skills that we have available to us in this market. Clearly skills can be used on the wrong and the right side of the ledger. I’m interested in hackathons that are being run. I guess they’re ethical hackers who get applied to solve problems like Missing Persons Week for instance. Can you tell us a bit about that?

Michelle:  At AustCyber we work quite closely with the National Missing Persons Coordination Unit which is a part of the Australian Federal Police to be able to take some of the live cases, the real cases out of National Missing Persons Week and apply that within a hackathon type environment where we use ethical hackers within teams of 4 people come together to actually use what’s called ‘Open Source Intelligence’ to be able to see whether or not we can generate new leads for police to follow through on in finding those real missing people. We worked on 14 of real cases last year and while we haven’t been able to solve any of those cases through the hackathon all but one of those cases actually had the generation of new leads that police are still working through.

Jenelle: Wow.

Michelle: This year again we’ll be working on different real missing people cases and what we also do as part of that and I’m getting tingles as I say it. We actually get the families of the missing people involved in the hackathon and I cannot describe the amount of energy that is in the room for this hackathon.

Jenelle: I’ll bet.

Michelle: Where we have the case workers from the Missing Persons Unit, police officers who are investigating the cases, the family of those who are left behind, these teams of ethical hackers that come together of all different skills and maturity, ages. It’s a really great showcase of skill being applied to a complex problem but of course we can’t escape the emotional side of it of being able to use our community of ethical hackers to be able to find real missing people. It’s incredible. It’s a privilege.

 
Jenelle: Oh it is incredible. Such a powerful application of the skills being used on the right side of the equation. It’s hard not to be aware of the enthusiasm in your voice when you speak about this stuff and actually when you and I spoke last week, you said something to me that has sort of stuck in my mind. You said “that people accuse you of being passionate about cyber”, which I thought was an interesting term of phrase. Obviously the word ‘accuse’ as a negative connotation to it. Why did you use that word? Do you think people see it as a negative thing? What is it about cyber that has you so passionate about it?

Michelle: Such a good question! I think that the ‘accuse’ piece is because the birth of cyber security came out of national security and this concept of the way that you protect a nation and the crown jewels around that being vested in a nation’s Government and that’s all for very good reason.

Within that space though, of course the behaviours of how you go about doing the business of traditional cyber security has been very conservative and bound up in the world of the intelligence community, which is a world that I have spent some time in and fully appreciate why it is the case for that part of the industry and sector. But there is this whole world out there that exists beyond that needs to actually exist to support the intelligence and national security communities and vice versa.

So when you come out of a conservative and comparatively narrowly focused world as a discipline, and you kind of have this birthing out into the broader economy and broader society having a passion for the topic and understanding how it can have positive impact and help grow the size of the pie for both individuals, their families, as well as the economy and sustain the prosperity that Australia enjoys so much. I think that you stand out from all of that conservative world and so I’ve come out of many years of being accused of being ‘passionate’.

As part of the culture that we’re hopefully starting to cast aside now into history in Australia that we have traditionally of course assigned ‘passion’ to tall poppy syndrome. That element of Australian business, whether that business be in the public or private sectors has been something that’s obviously been quite a legacy that has in many respects held us back as a nation. To see all of that negative connotation starting to be unshackled and not being valued anymore as part of how we do business as much as there is a long tale to that, I think is a really, really positive thing. I now kind of actively joke as I did with you Jenelle that I get ‘accused’ of being passionate and I talk about that publicly reasonably often because it’s about inspiring people of all ages, all ethnicities, all genders to be able to feel as though they are empowered to jump in and understand cyber security because it is just so important to everyone’s lives now.

Jenelle: Is there any one moment or moments maybe that you can remember that really ignited your resolve and your passion to get into this space?

Michelle: Yeah I think the moment for me came when I was working in the Prime Minister’s Department and it was under Prime Minister Gillard. At the time I was working on the National Security Strategic Risk Framework which was the first of its kind - actually it turned out in the world. In doing the risk assessment as part of the development of that framework to demonstrate to the senior people within Government including Ministers why we needed to embark on such an endeavour. You do your horizon scan and of course you translate the threats that emerge in that horizon scanning as well as the opportunities to translate that into risk, both upside and downside. I came across this thing called ‘Cyber Security’. I had heard a little bit about it through various conversations and reading various materials – I had to in that role in National Security within the Prime Minister’s Department. I became instantly fascinated around it’s ‘sense of convergence’. That it really embodied such a range of different disciplines, thinking and creativity as well as needing to have structure and robustness and trust. For me, that just brought together in an instant, all the different things that I had worked on within my career to date and I also saw in that moment that it was going to become one of the biggest issues of our generation.

Jenelle: What was it like working with the first and only female Prime Minister?

Michelle: It was, can I say, and I hope that, wouldn’t it be amazing it Julia was listening, she was the most…

Jenelle: Well we do have a wide audience so it’s inside the realms of the possible.

Michelle: Well if you’re listening Julia, it was amazing to work for you.

Jenelle: Tell me about the changes then. If you were to sort of bullet point a few changes that you would be seeking to lead or drive at AustCyber, what are those changes?

Michelle: I think first and foremost for me it is about recognising in the country that we really have do have talent in Australia around cyber security. Both in product and service. That from my background as a kid, I grew up in a house of inventors. Both my Mum and Dad invented foods. I love telling people this that my Dad invented the Pine Lime Splice and the Golden Gaytime.

Jenelle:: No way! Did he really?

Michelle: Yes.

Jenelle: This is a gem, I love Pine Limes.

Michelle: It’s super cool. And my Mum and Dad were both food technologists. When they went to university, which is where they met, they were doing food technology and food tech has now become a new thing again. They were doing this in the 70s. And their food technology strengths focussed on sort of food innovation and so then invented things. Mum invented the technology that enabled caramel within the Magnum Ego to remain liquid when the ice cream is frozen and that’s now used in space. That’s the environment that I grew up in. And so being able to kind of appreciate the value of entrepreneurship and the value of small business. And the value of small business scaling into medium size business and seeing firsthand the impact that that has. On both community and economy. And that that really has been a lived experience of a lot of Australian business.

For me I want to see that happen for cyber security. Because cyber security has such an important role now as I’ve mentioned. And so that’s one of the changes that I’m trying to drive at AustCyber is that understanding of how we really can do this. Not just for ourselves but to be able to impart some of that capability into the right hands globally to help others as well.

And I think the second thing for me is around now we can use cyber security, how it can be a use case for technological change. Where we do see the convergence of technology and humans happening every day. And further how we adapt as humans in that point of convergence and really drive forward the changes we want to see around diversity in our community. There’s lots of misperceptions and misunderstandings around what it genuinely is when you sort of have these images from the movies and the tv shows and all of that kind of stuff around how complex it is. Absolutely it’s complex but that’s why we need everyone involved. Then of course we want to make sure that people further value the fact that it is ok to make money from being an entrepreneur. And that in Australia, entrepreneurship often means that when you make that money, you’re giving back as well. And that’s the spirit that I think that we can carry forward for future generations to continue that spirit of giving in Australia. At times maybe we’ve stepped back from that a little bit. If there’s a couple of good things that could come out of the cascade of events over the past 12 months in Australia with, you know, drought, flood, fire and pandemic, it’s that we can come together in times of crisis. But it shouldn’t take a crisis for us to maintain that spirit.

Jenelle: AustCyber put out a Digital Trust Report and in that report you talk about the role that digital trust plays in attracting investment and driving job growth and enabling growth opportunities across other sectors of the economy, how do we, we – Australia – rate on the dimension of digital trust and what do we need to do to lift our digital trust worthiness?

Michelle: Oh that’s so good! There’s so much to unpack in that! I think that, it’s interesting again this tall poppy thing comes into play because domestically I think that we’re actually quite distrusting of each other even though we’re reasonably good at going after solving complex problems. There’s so many sort of, you know, tensions that exist across the way that we do business and how we collaborate with each other in Australia. Outside of Australia, particularly within this region of the world, we are actually seen as a trusted and sometimes in the world of technology, honest broker. In being able to navigate the complexity of what we find ourselves in. And so beyond our shores, I guess as per usual, the learned experience of the past 30 or 40 years, Australia actually fairs quite well when it comes to the sort of digital trust quotient if you like. We are often drawn in across, it doesn’t matter really if it’s Government, business or academia, we are drawn into international conversations. Because we are seen as being knowledgeable. That knowledge is trusted. And we are seen as being a trusted set of hands in how you go about applying that knowledge.

Domestically though, of course, we lot a fight. We love the battle. We see that on the sporting field. It translates into how we do business domestically, it’s fascinating. And we do need to, I think, particularly when it comes to these concepts of a cyber physical world and the digital infrastructures that we’re investing a huge amount of time and effort into now and of course the data that those digital infrastructures carry. We need to, I think, increasingly remember, it’s almost like we’ve got to have it on a post it note on the computer screen kind of thing to remind ourselves that we are actually all on the light side of the equation.

Jenelle: Others see us, overseas they view us as more digitally trustworthy than we view ourselves. Is that what you’re saying?

Michelle: Indeed. That’s absolutely the case. Now of course we know that trust is hard to earn and very easy to lose.

Jenelle: Correct.

Michelle: Some of the changes that we’ve made in Australia at a regulatory and legislative standpoint has eroded some trust over the past couple years in Australia but it’s been very limited to particular industries. And this is again where we see that kind of conversation happening around, you know, sort of the flow through of culture where Europeans are kind of seen as being as a bit more open and less risk averse as oppose to the Americans and by association I guess the so called Five Eyes nations of which Australia is a part. And that we tend to be more conservative when it comes to matters of national security and the way that national security intersects with community and of course the big issue that has happened over the past two generations in that case is terrorism. And of course New Zealand had to be the latest example of how that gets born out through changes legislation last year. And necessarily so, of course, in trying to push back against that kind of intrusion on Australian and New Zealand and global lifestyle.

The trustworthiness piece is just, it’s a classic case of that convergence between human and technology. Because of course now we are entering into conversations around whether or not we can trust the technology, whether or not we can trust the machines and in a world of artificial intelligence, can we trust the data that the machines are talking to us about. And that relationship between machine and human. But of course we need to remember in all of that that it’s the humans that are developing the machines.

Jenelle: That’s right.

Michelle: And so we can get into lots of conversations about ethics but ultimately, at the very basis of that, it is about trust.

Jenelle: It’s interesting you know, you talked a lot about the complexity, which I completely agree with you on, but you talked about the physical threats and infrastructure, in a mega trends report that we wrote at EY fairly recently actually, we mentioned that cyber warfare has expanded into a new domain altogether and that’s around disinformation. So the target’s not just physical infrastructure, it’s not about data or money, but it’s actually around truth and truth itself. And we saw that really come into public consciousness in the 2016 US Presidential Election for instance. So there’s every reason to think that tactics can be used to attack, like the disinformation tactics can be used to attack companies. I know that the Edelman Trust Barometer for instance, found that six in 10 people across 27 countries are no longer sure what’s true and what’s not. And in 2019 the coverage of fake news and conspiracy theories increased by 93%.

So I guess my question, Michelle to you on this one is, what’s your thoughts on the weaponising of disinformation as a threat to companies, and what responsibilities to business and Government leaders have to counter that kind of threat?

Michelle: This is a really interesting area and it’s one that is climbing up risk registers all over the place. But perhaps not as much in Australia as what it needs to be. And I think the conversations around foreign interference is probably what’s going to scratch the surface around this one for Australia because absolutely companies do need to be more aware around what risks this can have for the operations. And of course if a company is listed, what kinds of implications this can have for shareholders and, you know, we’ve long had discussions publicly through, particularly through the media, but also through other forms of communication around the ways that these kinds of acts of disinformation can have an impact on, you know, hostile stakeholders and shareholders, hostile board directors and whether of not the hostility is actually true. It is really, really complex and of course this is where it gets really properly scary for a lot of business owners as to how they could keep across that kind of a landscape.

Jenelle: Exactly.

Michelle: Especially with the pace of how everything is happening these days. When you do pick up your phone to be able to quickly do an internet search around answering a question really quickly to be able to just move on with you day. And that can obviously expand out into quite serious and significant decisions that companies and organisations might be making about their future. And the way that they spend money or the way that they hire staff, the way that they manage their staff, all of those kinds of things. I mean ultimately of course the responsibility does lie with organisations, when it comes to the business world, whether that be Government or the private sectors, but I do think this is where, it’s one of the manifestations in our modern world, if we can keep referring to it as that, it’s the current world and what we’re seeing over the horizon as then needing to be business and Government in lock step. We have to work on this together because there will necessarily be organisations within the economy, whether they’re small agencies, and if you think I apply this to local Government, local Government is now very distanced in their service delivery from the Federal Government for example, how did they keep pace with these kinds of things in the same way as how does the local sole ???[26:36] and a franchise of a lawn mowing business stay across this when they absolutely could be leveraged as a vector for disinformation through either their website or their invoicing or even their Facebook presence in the same way that a very large corporation could be. And I say to my team all the time, if we’re not five steps ahead of the rest of the industry, ensuring that the stepping stones are there behind us, then actually we’re not doing our job effectively. It’s our job to take the bullets out in front of making some of the mistakes early so that the rest of industry can benefit.

Jenelle: How do you do that? How do you stay ahead of the threats?

Michelle: Great question. It’s really, really hard but the first thing to do is to actually care. Understanding what the threat landscape looks like. If you’re an individual and family and school and community group, you can go to staysmartonline.gov.au and if you’re a business or you’re even a Government agency you can go to cyber.gov.au. These are resources that provide alerts around the kinds of threats that are manifesting at the moment and so the first thing is understanding and reading the news is a really good way to stay across some of the threats that manifest.

Jenelle: Sure.

Michelle: If you go to reputable sources, there’s lot of websites that being actively protected against disinformation and fake news that means that you can trust those as information sources to be able to better inform yourself to ask the right questions.

Jenelle: It strikes me that there’s a number of words that people use in the cyber world, they have a really specific meaning in the world of digital and cyber. You know words like trust, resilience, vulnerability, but those words also carry a hell of a lot of weight in the world of, when I talk of leadership styles and attributes and I just wonder if it’s something that you are conscious about, that you’re thinking that these words of vulnerability, resilience, testing, failure, trust, how do you marry that up when you’re talking about it in cyber and how you lead personally?

Michelle: Yeah I marry it up all the time in my own mind. Whether or not I’m effective at demonstrating that or talking about it I guess that’s for others to decide. But I guess one of the principles of how we do business at AustCyber is modelling the behaviours that we would love to see collectively. And I don’t mean it’s AustCyber telling the rest of industry how to behave. I’ve been told by numerous people over the past, particularly 12 months, that my leadership style is more from the centre. And really of course that’s actually how cyber security needs to behave as an industry. We need to be leading from the centre and showing a better way on how cyber security enables all other industries. But also within our own industry how different capabilities enable others. And how you can have that collaboration and cooperation happening within the sector as well and so being vulnerable within cyber security is something that is very, very treacherous because of course the second that you admit vulnerability means that you are open to attack. And if we’re open to attack it means that actually we’re exposing our clients, customers, colleagues, partners, upstream/downstream to attack. And so thinking about it from that perspective is that, you know, it’s less of a focus on vulnerability as a leader and more about empathy. Because we do need to lead with empathy because being attacked through cyber means it’s one of the most devastating things that anyone can go through now because it does have physical ramifications. And one of the examples that I give often to kind of illuminate, it’s a pretty negative one so I sort of give the warning that this can unsettle some people but at the cost of less than $50, a perpetrator of domestic violence really can end a woman’s life and do that in front of her children. By buying information on the dark net around their whereabouts. And so that sort of sense of having a new identity and that identity being protected by agencies and things like that is really challenging business these days because of the pace at which information can be obtained and then sold at a really cheap rate. And that rate has come down from hundreds of dollars only a couple of years ago. And so that really shines…

Jenelle: Brings it to life doesn’t it, yeah.

Michelle: It really does.

Jenelle: Michelle just turning to your pretty amazing career trajectory, you’ve had a collection of skills and experiences and evidently so has your parents, which I find fascinating, you started out studying graphic design then you moved into food safety, so no doubt that was inspired by your parents, and then you became a cyber specialist and that included five years with the Department of Prime Minister and Cabinet, can you give me a bit of a potted history maybe of how each of those transitions happened and perhaps what is was from each role that you carried forward and evolved into the next role.

Michelle: Yeah sure. So I also studied economics at university. So I did economics and business law first and then I did graphic design and I think that when I…

Jenelle: Natural progression!

Michelle: That’s right. When I get forced to admit in that very un-Australian way what the strengths are that are a foundation of my career it’s that I did listen to my left and right brains. I was one of the first six students to graduate in the country with environmental economics. I didn’t actually kind of end up getting a job in that space because it was so new that I instantly then thought in my final year well I kind of really like colour and the psychology of colour and then went off and did graphic design straight off the back of graduating from my economics degree. But I did my graphic design degree while working full time in food safety risk and that was actually in my parents’ business. So they owned three companies, one of which was a global company. Ended up running one of those companies for them largely and I guess it was kind of a convergence of the two degrees in one job. That sort of I guess, what gave me a pretty strong sense of what small business is in Australia and at the time Mum and Dad were actually writing on behalf of the Federal Government the National Food Safety Standards for the country for the first time ever which then got adopted and adapted into different jurisdictions in the country and they went on to help out Woolworths, Coles, NSW Government, Victorian Government to actually figure out what food safety meant.

And so again that spirit of community and that spirit of business and being able to marry those two was instilled in me very, very early. Of course the backdrop of invention, going after your entrepreneurial spirit and all of that kind of stuff. But I ended up marrying boy in uniform of the Air Force variety and so I ended up in Canberra. It was interesting because we got posted here and I’d always had an interest in politics and so you know, coming to Canberra and seeing what Government had to offer, I just jumped in and it was a completely different world. Just for whatever reason, early days, that’s sort of bringing into my first job in Government which was in Workplace Health and Safety at Comcare. Having a leader in that agency at the time who recognised instantly that there was someone in me that not only understood economics and as it applied to different context, but also understood risk. And this was at the juncture of when Comcare on behalf of Government policy was trying to nationalise workplace health and safety legislation. And get away, remove this kind of separation of different ways of doing workplace health and safety legislation around the country.

Really interesting time to jump in and start to understand how legislation is developed and drafted. How you form trusted relationships between Government and industry. And those were some really hefty conversations around how we needed to do better as a country on that with people, those skills come through from my private sector experience into that world. Actually what was propelled me forward. I didn’t stay at Comcare for very long because then I got sort of poached from there to go off to Customs, got poached from Customs to go off to Medicare, got poached back to Customs again and then got poached off to the Prime Ministers Department. And so I guess the sort of thread across all of that was this understanding of how industry worked and how relationships really even mattered. Putting the shoes on of the other people sitting across the table from you in negotiations. But also of course having a pretty in-depth understanding of the difference between threat and risk but necessarily how they operate together. The time at ??? [35:16] was critical in where I’m up to as a person. It was a privilege to work for, four people, there were five Prime Ministers. Prime Minister Rudd had two shots at it, everybody would remember.

Jenelle: Indeed.

Michelle: Absolutely I do have my favourites in those four people but it is a privilege when you work in that environment and when you’re working on national security it can get very, very sharp. You are dealing with life and death situations and I learned a huge amount and across the trajectory I was always that square peg because I had come out of industry. At one time I was the only person on the national security side of the equation that had worked in industry. But it was highly valued at by the very senior people including Prime Ministers.

Jenelle: Most people when they describe themselves as square pegs or sort of sitting outside of the norm see that as something that is problematic. When did you realise that that actually was your strength? That you were sort of different to everybody else in terms of your skills experiences profile?

Michelle: I think it was probably when I was doing the work on the National Security Strategic Risk Framework where I had the trust of the then National Security Advisor, Duncan Lewis, we don’t have a National Security Advisor at the moment as a position within Government but at the time I was working to Duncan and he trusted me to be going and having conversations with some very, very senior people in Government. And I was a middle ranked person at the time and he knew that I had the subject matter expertise and he also trusted that I had the right kind of experience and self-awareness to understand how to read the body language and the circumstances of the people sitting across the table from me and I guess after having a series of kind of quiet, you know, hearting throat conversations because they got quite pointed with some of these very senior people, you know but I actually did have something to offer because of how different I was and that I needed to just slightly reframe how I positioned that to be seen by them and not just by Duncan as an asset. And an asset in how they could pursue what they were trying to get done in the whole equation as well. That was probably where it came from I think.

Jenelle: What changes do you think need to be made in order to encourage more women to become more involved in the industry and to nurture greater diversity in cyber.

Michelle: This would not be surprising to you Jenelle, but I get asked this reasonably often.

Jenelle: Yes!

Michelle: It is a challenging question because I deeply appreciate that for a lot of women and also people from ethnically diverse backgrounds and, first Australians and, first Nations people as well as those who are gender diverse, it can be incredibly challenging. I guess what I would say in the first instance is that I’m really proud that now in cyber security increasingly I’m not a minority. I’m very, very conscious of the kinds of emotions and kinds of challenges that I experienced when I was part of the minority. For groups that are still experiencing barriers to entry and barriers to being valued that there is still a long way to go in that equation.

The number one piece of advice that I give to people of any age, any persuasion, is to figure out who you can trust, even if that is someone within your own family. Figure out who you can trust and ask for help because the experiences that you are experiencing in having barriers or challenges in being valued and being appreciated, you’re not alone.

You’re absolutely not alone and I say to particularly younger girls and women who are just entering into technology fields including cyber security but also people of ethnically diverse backgrounds because of course in anything that has anything to do with national security there are matters of having security clearances which can make it challenging.

Asking for that trusted help means that you can leverage people like me who have gone through these kinds of challenges and experiences before and you’ll get some really, really helpful advice, but use us as your bullet proof vest for as long as you need it. Use us to help you push forward in those barriers because there is absolutely no shame in doing that. There just isn’t and if there are people around you that are making you feel shameful for asking for that kind of help they’re not useful to you in your career endeavours and what you want to have impact on in the world.

That’s probably the sharpest point that I can say because it is really hard of course. This is all driven by emotion and it’s really hard to cast aside those emotions that get reinforced especially the negative ones. I guess I’m acknowledging that this stuff is really tough and it’s really, really hard and that the Australian way and also the western way is, if you ask for help you’re admitting that you’re not perfect and that we need to be perfect to be considered valuable and to be worth it, and that’s just simply not true.

Again, I’m trying to use our industry in cyber security as the ‘use’ case for change around these things – to be able to stand up and call out some of these really quite treacherous but also quite tricky behaviours that can happen. We absolutely come into the economic side of it, we have to have diversity.

We all know and we can see now through the work of many organisations the economic metrics around:

•  Why we need to have diverse Boards
• Why we need to have diverse Management
• Why we need to have diverse teams,

in making decisions and getting work done.
As a country we have to do that to be able to continue to maintain our global competitiveness not just grow it. It is now an economic imperative quite apart from the fact that culturally and from a community standpoint. Largely as a society we want that to happen as well.

Jenelle: I couldn’t agree with you more Michelle. If I draw the formal questions to a close with maybe a broad big one. Maybe you can look into your crystal ball as you answer it. From your perspective what is recovery and reframing the future look like to you? Think about our country – what do we need to do to really take advantage of the respective crisis that we’ve navigated together as a country.

What do we need to do to recover and reframe?

Michelle: It is a big question!

Jenelle: I’ll give you some light ones after this I promise!

Michelle: I can never give one answer. I think I’m going to give a couple of answers.

1. The first one is that we need to move deliberately away from having a hierarchy structure to our economy to having one that is networked. We already see a whole range of technology oriented segments of sectors bare.

• They are taking a networked approach to how they structure their businesses
• How they engage internally within their organisations
• How they engage with their partners, suppliers, customers etc

We need to do that. We have to or we are going to get left behind and what better time to be doing that now than ripping the band aid off on some of that legacy. Structurally we are still hierarchy as an economy and it means to me that it’s one of the number 1 barriers around diversifying the base of our economy.

2. I think the second point is we have to back ourselves and recognise that we really do have global strengths. It’s not in some of the areas that we have nostalgia attached to. But that doesn’t mean that we can’t leverage the knowledge that has come out of those industries that are seeing some set happen for them. We have to leverage that knowledge. We need that knowledge and I think we’ll find that from most of the people involved in those industries, a lot of those people are retired or on the verge of retirement, they want to be able to help. They absolutely do. Everyone I speak to in those age brackets want to give back. They want to still be involved. They want to keep their minds active because we all know that the science of dementia and Alzheimer's is that we need to keep our minds active. But also for those industries that are transitioning there is lots that can be leveraged there that doesn’t require significant structural reform to be able to get done.
3. I think the third point is that we need to just celebrate more.

Jenelle: I’m up for that!

Michelle: Absolutely! Australia has got so much going for it and we shouldn’t be afraid to celebrate the wins. Let’s absolutely recognise that poppies were never indigenous to Australia. We have so many other things that flourish in our landscape that we can reference and celebrate the growth and the trajectory that we have in front of us if we can get a couple of these foundational pieces right.

Jenelle: Oh how about that. That was a great answer to a big vague question!

The last three. Three fast questions on change to finish the podcast.

Jenelle: I’m going to finish with three fast questions, much lighter questions Michelle. Firstly, what’s a misconception that most people have about you?

Michelle: I’ve only ever worked in Government.

Jenelle: Well we know that not to be true! I’m trying to figure out where you haven’t worked! What’s one guilty pleasure? Like to keep it PG if possible!

Michelle: PG, guilty pleasure! Okay I love binge watching things that completely take me away from what I spend most of my time doing.

Jenelle: So Border Security wouldn’t be one of those?

Michelle: I used to be involved in it. So no! but my kids love it! Bondi Rescue or Housewives of
New York!

Jenelle: Very good I should compare notes with you! What’s one thing that you’re hopeless at? This is going to be a tough one for you!

Michelle: I am absolutely hopeless at getting out of bed before 8am on a Sunday and then get cranky with myself because I haven’t fit everything into my day that I want to fit in. I’m absolutely hopeless at it, which means that it kind of does bleed into the rest of the week sometimes.

Jenelle: Oh come on! You need to be kinder to yourself. Take the sleep in! Celebrate the sleep in. There you go!

Michelle: Oh that’s good. I like that! Thank you.

Jenelle: Michelle, thank you so much for your time today. So much to be taken from this conversation. Not least of which is the passion for your industry and I think that you’ve really painted a compelling picture about why we should all care about the industry and about what it means for our nation.

A few things that really stood out to me. A bit of a theme – whether it’s through your own history and the way that you’ve worked but as you called it the ‘networked economy’, but for me what I also saw in the way that you’ve worked is the power of understanding the intersectionality of industries, of skills, of relationships and the collaboration and the
co-creation and cooperation that’s required to work in that space. I think that’s been really powerful.

I think your point about backing ourselves, our capabilities, our digital trustworthiness. If the rest of the globe sees it, then we should too. I think we need to back that capability and make sure that we leverage that and really achieve what we can from that.

I really liked your point about following intuition. If something doesn’t feel right, there is no harm in asking in the question, and there is no harm, and probably there is a real imperative to follow the trail of that question to understand how that can be physically manifested in organisations.

Some powerful takeaways. I know there is plenty more that others will reflect on as well. Thank you again Michelle, it’s been a pleasure.

Michelle: It’s been so much fun to be with you Jenelle. Thanks for having me.

The ‘Change Happens Podcast’ from EY. A conversation on leading through change. Discover more where you get your podcasts.

END OF TAPE RECORDING