Building things and solving problems

I didn’t work very hard at school and frankly did not appreciate being a child. You’re so disenfranchised. My A levels were mixed and I missed out on my first choice of University. It worked out well though as I had the opportunity to study in the Netherlands, which completely changed my outlook. Bradford’s an amazing place, and the people are something else. Taking my seat in City Hall was a real privilege.

I always knew I wanted to work with technology, but I’m all about delivery and outcomes rather than the technology itself. Finance is the language of business; technology is how it works. It seemed obvious at the time that you would need both, so I set out to do both.

After some years in local government, I stood for parliament in 2010. I actually got the best swing to my party in the constituency in my lifetime, but frankly politics was an increasingly toxic environment and I couldn’t see it getting better. Our son had also just been born and I couldn’t see how to combine being a good MP with being a decent dad. So we were up for a change and we could have gone anywhere, but being a lifelong Gerald Durrell fan, Jersey stood out. It was the right thing to do but I have sometimes missed the complexity and depth of community politics. Now I’m using my skills for public benefit, and it feels like the right place to be.

Everything I’ve done has been about building things that solve problems. I didn’t plan it that way, but when I look back, that’s the recurring theme. I imagine I’ll keep doing that until I can’t.

I’ve been fortunate to contribute to a number of publications and present at various places around the world. Davos was interesting but the place I most remember presenting was at Bletchley Park; you feel the full weight of history. In 1940 it wasn’t called cyber security, but it was the same basic problem. For most of my career it’s been about hacktivists and criminals, and now we’re back with geopolitical conflict as the biggest issue.

It’s an unfortunate truth that much of our time at the moment is spent responding to the threat posed by Russia – both organised cyber crime in that region, and nation state related activity. The invasion of Ukraine has changed the dynamic and it is clear that unfriendly nations are willing to use hybrid warfare techniques including cyber to gain an advantage at any time. Its not about Jersey, we’re just not immune.

Cyber crime has also become incredibly profitable and has a low chance of detection or punishment. It was estimated to be an $8 trillion industry in 2023, which would make it the world’s third largest economy after the USA and China. People are now trafficked into cyber crime and subjected to violence and abuse – it’s not at all the victimless crime people sometimes think it is. If you pay a ransom, that’s what you’re paying for. Ethically I struggle with that. Cyber crime also funds terrorism and despotic regimes like North Korea. Yet at any point in time JCSC will be tracking thousands of vulnerabilities across the island, many of which have easy fixes. You don’t know how cyber crime feels until you lose your business or your life savings, but then it’s too late. There is a lot more we can do together to reduce and manage this risk effectively.

There’s no effective legal framework around what we do at JCSC, because nobody did it here before. We need to fix that so we can protect the island effectively.

Jersey businesses are very committed to the island and strongly connected to their customers, but there is also a tendency to assume if it hasn’t happened here, then it can’t happen here. Unfortunately that’s not the case and we are in the same boat as everyone else. You can see a fire because there is smoke and a fire engine. Cyber attacks are often invisible outside an organisation, and JCSC doesn’t have flashing lights. That doesn’t make the problem any less real.

Culture from the top is key. I’m often told most cybersecurity incidents are caused by people, but that’s simply not true and the surveys saying that are mostly vendor led drivel. In reality, most incidents are caused by companies not consistently implementing controls they have previously agreed on, because they are inconvenient or hard. Hackers don’t care about your risk assessment or your signed exception or your management reporting. They will keep looking at your people, processes and technology until they find a hole.

I also know how hard it is to secure large and complex infrastructure. Instead of adding more security technology, try to make it simpler. Have fewer systems and designate a business owner to be responsible for each of them. Lots of companies don’t even have a list of applications with identified owners. Imagine not knowing who is responsible for the money. It makes no sense. 

Do Cyber Essentials Plus. Everyone has an excuse not to, but for most it doesn’t really wash. It’s only four controls and they are all perfectly sensible. If you can’t do it, make your environment simpler or isolate the risky bits and do the rest. 

Security should work with people, not against them. If your security controls are painful, people will find a way around them. It’s rational human behaviour. Instead of fighting them, aim for better processes. 

Finally, incidents are not fun and how you respond often determines the cost. Practice beforehand so you are ready.

I’ve been a volunteer since I was 15. I find I’m more effective when I have a few points of focus.

Volunteering lets you make a difference to something you are passionate about, it keeps you grounded, and it builds new skills. Without that experience I couldn’t do what I do now.  At Bradford Hospitals we had to replace the chair, the board and the auditors to pull it out of a financial hole that was compromising patient care. I was 25. We set up the channel islands security forum because when I moved to Jersey I couldn’t find anyone else doing cybersecurity. Three of us met in a coffee shop, and it’s now 500 strong. Helping to save Jersey Aero Club after the pandemic has been rewarding. It was in lots of debt and now runs sustainably with cash in the bank. I had to step back from it when I took on JCSC, but I am still on the Committee because I made a promise to someone that I wouldn’t walk away. 

What would be really great is to find a future for the historic De Havilland Heron aircraft the Duchess of Brittany. I bought her for a pound to try to find her a future, but she really belongs to the Island. She’s a crucial part of Jersey’s history and needs a local home, however it’s a hard problem and I don’t know how that story will end.