- 1 week ago
- #considerthis
Malaysia is increasingly becoming more digital, everything from banking and healthcare, to government services and logistics. But much of the infrastructure supporting that digital economy extends beyond our borders. The recent conflict in Iran is a reminder that geopolitical shocks can disrupt systems, even half a world away. So how much digital sovereignty do we need as a country? And can we remain connected to the global digital infrastructure without becoming dangerously dependent on it? On this episode of #ConsiderThis Melisa Idris speaks with Dr Jun-E Tan, Senior Research Associate at Khazanah Research Institute, and Farlina Said, Director of Cyber and Technology Policy programme at ISIS Malaysia.
Category
🗞
NewsTranscript
00:01Music
00:11Hello and good evening, I'm Melissa Idris. Welcome to Consider This.
00:14This is the show where we want you to consider and then reconsider what you know of the news of
00:19the day.
00:19Malaysia is increasingly becoming more digital.
00:23Everything from our banking and healthcare to government services and logistics.
00:27But much of the infrastructure supporting that digital economy extends beyond our borders.
00:33Now the recent conflict in Iran has really highlighted the fact that geopolitical shocks can disrupt systems
00:40and can disrupt systems that are even half a world away.
00:44So how much digital sovereignty do we need as a country?
00:48And can we remain connected to the global digital infrastructure without becoming dangerously dependent on it?
00:56Well, joining me on the show to discuss this weather, I have Dr. Juni Tan,
01:00who is a Senior Research Associate at Kazanah Research Institute,
01:03where she looks at digital rights and AI governance in the context of Southeast Asia and Malaysia.
01:09I also have in the studio with me Faralina Syed,
01:11who is Director of Cyber and Technology Policy Program at ISIS Malaysia.
01:16Welcome, both of you, to the show.
01:17So, if I may begin with you, Juni, and the article that you wrote about digital resilience in times of
01:25crisis.
01:26Now, maybe we can begin our conversation today by understanding what that term means.
01:30What is digital resilience?
01:32And one of the things that I found particularly interesting was the fact that you said,
01:36well, we had that US-Israel conflict in Iran,
01:41and that really highlighted the need for us to look at whether or not we are digitally resilient.
01:46So, let's begin there.
01:47Talk to us about digital resilience.
01:49Okay, so maybe we can start with resilience as a concept.
01:52It basically means the ability to withstand shocks and then bounce back and then function, right?
02:01So, digital resilience in our case is, for instance,
02:04if our internet services or our software or things like that go down,
02:10including in hospitals or in banks, in transportation systems,
02:16do we have backup options?
02:18Are we able to actually resume the critical services as quickly as we can?
02:23Because we are talking about, you know, sometimes life and death,
02:28sometimes like economic functions that are quite important.
02:31And so, if we look at digital resilience from a national perspective,
02:37it is kind of to prioritize certain sectors, right?
02:40I've mentioned a few, healthcare and then finance,
02:43transportation systems and all of that.
02:45They are known as the national critical information infrastructure
02:50that we need to keep functioning so that we are resilient.
02:56Yes, so we want to try and minimize in these very critical sectors any risk of downtime.
03:02But here's where I'm kind of more curious about.
03:07When we think about risks of downtime, we think,
03:11oh, it'll just bounce back.
03:12How connected are we to the kind of global, digital?
03:17How exposed, how vulnerable, how dependent?
03:19I'm not sure what the right term to use is because it changes the nature of the conversation.
03:23But how exposed are we to any kind of disruption in digital infrastructure?
03:29If I may come to you, Fadina.
03:30Sure.
03:30I think actually there are many ways that we can try to take a look at the interconnectivity.
03:35A lot of people, when they talk about cyber,
03:37you would always think cyber is supposed to be transboundary.
03:39So, it's actually borderless in a lot of ways.
03:41But if we actually were to break it down,
03:43when it comes to this specific topic of resilience,
03:47I think we can actually think of it in terms of the interconnectivity for the utilities or the services.
03:52Because, for instance, if you have the ASEAN power grid,
03:55that would mean that, to a certain extent,
03:57the delivery of the electricity from one end of ASEAN is actually supposed to pass through other nations.
04:02And that includes Malaysia all the way from Laos to Singapore.
04:05So, that means that there are certain infrastructures
04:09that may actually be delivering services beyond our borders.
04:11But the second thing that we actually do have to think about is in terms of technology.
04:15Because if we are to take a look at some of the advisories that's actually given by NACSA under NC4,
04:22for instance,
04:24the types of systems that you actually have used in your operating systems for your own utilities
04:30is the same that's actually delivered in other parts of the world.
04:33And actually, like the vulnerabilities in those systems,
04:36because they're technology,
04:37can mean that it can be the same entry or window or gap that tends to be quite open.
04:43So, because of that, you can see that the interconnectivity can be sliced in many different ways.
04:51Okay.
04:52So, let's look at how that works.
04:55So, when you use that example, Junie, of the conflict in the Middle East,
05:01specifically in Iran,
05:02why was that kind of your tipping point, a pivotal point for you saying,
05:07hey, we've been talking about the supply chain disruptions and energy crisis.
05:12For you, alarm bells rang on digital resilience.
05:16Why was that?
05:17Yeah.
05:17So, I think we underestimate how much we rely on some of this global digital infrastructure.
05:24So, it could be hardware.
05:25It could be software.
05:26And then, in our case, for instance, if we focus on internet connectivity,
05:32like about 90 plus 99% of the internet's traffic run through subsea cables, right?
05:38Malaysia has like 29 that we rely on, international subsea cables.
05:42And about five of them actually do run around that conflict area.
05:47Really?
05:48Yeah.
05:48So, if they get disrupted and also state actors have actually threatened to disrupt them,
05:55so then it's where we will experience outages and internet connectivity will be affected.
06:04And, yeah, so we kind of need to consider that.
06:08I didn't think so.
06:10I thought of the shipping lanes, disruptions in trade.
06:14I did not think that my internet could be affected by the conflict.
06:19Did that ring alarm bells for you as well?
06:23I think actually technically it does.
06:25A lot of things can be, it is actually interconnected.
06:29But I think immediately when you mentioned about subsea cables,
06:33the thing that comes to mind is that actually even simple typhoons can actually cause disruptions.
06:38So, I think there are examples in 2007, I think sometime in 2011 as well,
06:45when there were actually different typhoons in the region that actually also disrupted.
06:48And the thing is that you can actually have redundancies,
06:52meaning because we actually have more than one subsea cable,
06:55it can actually mean that if one is affected or one is actually in a state requiring repair,
07:04there could be others supporting the activity.
07:07But it can also mean slower internet during the time period.
07:11Also, it can mean if you have,
07:14if it's difficult for you to get someone to the location to actually fix the cables,
07:18then it will just mean that your situation gets extended.
07:22But we don't, so you said five of them,
07:25or sorry, 29 international subsea cables.
07:28So, we don't actually own these.
07:30We have to kind of plug into the digital infrastructure,
07:33the global digital infrastructure.
07:34Is that right?
07:34So, there is really no way for us to not be dependent.
07:38But how do we minimize the risk?
07:41Is it by diversifying the areas in which we are connected?
07:47How do you see it?
07:48So, like for instance, actually Malaysia scores quite okay in terms of internet resilience.
07:54Okay.
07:54Just to lay that as a baseline.
07:57So, we are not doing too badly globally speaking.
08:01But there is this thing called a traffic localization,
08:04which we are scoring kind of low on.
08:07What is traffic localization?
08:08So, like imagine if you're sending a postcard to your friend who is living in your same city, right?
08:14So, the postcard in this situation, when the traffic is not localized,
08:18it goes out of Malaysia, gets routed through, say, Paris, and then goes to America,
08:24comes back to KL, where your friend receives it.
08:28So, along the way, of course, the postcard gets, you know,
08:32there's an increased risk of the postcard getting lost or getting torn or whatever it is.
08:37So, what we can do is actually to try to increase our traffic localization
08:42to then, by extension, rely a little bit less on the international subsea cables.
08:48And reduce risk, right?
08:50In between?
08:51Okay.
08:51Right.
08:53What are the potential disruptions?
08:55So, we talked about, you know, disruptions or damage to subsea cables.
09:01Talk to me about other risks of disruption that might test our digital resilience.
09:08I think, actually, back to some of the examples that we're looking at,
09:13because I think what was raised was about Iranian conflict.
09:16But, actually, other examples in terms of conflict,
09:20when you actually even refer to experiences in Ukraine.
09:24And then, actually, you're looking at, also back to the earlier opening remarks
09:30of where our dependencies on these digital technologies are.
09:35Because you realize in a moment of crisis, there's actually a lot of,
09:40we have, we rely on technology to deliver information,
09:44to actually get information on where to go for safety.
09:46Yes.
09:47To actually get information on where we can,
09:49where there might actually be an incident or there might not be.
09:53I mean, it can happen whether you're looking at earthquakes,
09:56whether you're actually looking at fires.
09:57And in this sense, the type of resilience that you need for these systems means that the government
10:09who would actually be delivering some of these services needs to be available for other,
10:15to prepare for these types of situations.
10:18Even the media, to a certain extent, actually, as a carrier of information in these types of crisis means that
10:25if people are to get to places of safety,
10:29they actually do require these types of, the access, I think, to some of these.
10:34So, some of the things that we could, we can think about even when we think about resilience aside from
10:40just the infrastructure itself,
10:42is that when you actually have moments when something happens, you actually require the systems to be redundant.
10:49It has to be able to move.
10:51I mean, it's like if, because if one data center actually goes down,
10:55you actually need like the services that data center is servicing.
10:59For instance, if it's your government or a certain, or a certain, like say, the media,
11:04then you would actually require for there to be another backup system in place.
11:09So, for just thinking about it in that sense, cyber security is about redundancy, it's about diversification,
11:15it's actually, it's boring in that way, but it actually means that availability is quite necessary.
11:20Well, I don't agree at all that, you know, cyber security is boring.
11:27I think redundancy is so important that we really need to talk about it.
11:30But redundancy costs money.
11:34Backup costs money, right?
11:35Having, building backup systems, having resilience, duplicate systems, alternative providers,
11:42all of that costs money for disruptions that may or may not happen.
11:47So, when we think about that, and in an environment of fiscal constraints, shall we say,
11:54how do we think about how much redundancy is economically viable for a country like Malaysia?
12:01I'm sure you've put in some thoughts into this.
12:03Junie, what do you think?
12:04Yeah, so, when we were writing the paper, we decided to look at the financial sector in Malaysia,
12:11because it is very highly digitalized, it's very interconnected, so many interconnected systems,
12:19and it's also got a strong regulator, right?
12:21Yeah.
12:22So, in this situation, I want to sort of cite how they think about the problem of backups and costly
12:30backups.
12:30I think, from what we understand on their thinking around it, is that they don't think that these incidents are
12:38not going to happen.
12:39Actually, they think that there are probable incidents.
12:41As what Falina was saying, you could have typhoons, you could, you know, there are a lot of things that
12:46can go wrong.
12:47So, it's a matter of, like, when, not if.
12:50Rather than if.
12:50Okay, so they don't think that it may not happen, they are planning for a scenario to happen.
12:56Exactly.
12:57So, like, basically, something bad will happen, and then they will have bad consequences,
13:03and it will have ripple effects throughout the entire system, right?
13:06So, therefore, one way to think about it is that it will cost us less to work on it now
13:14than if something happens,
13:16and, you know, we try to fix it.
13:18It can come in the form of lost business, lost trust, like consumer trust, you know, all of those,
13:25and we kind of don't want that.
13:27But, of course, not everything we have to keep redundant, right?
13:30So, we need to have an exercise to sort of prioritize what are the critical services that we cannot do
13:37without.
13:38Like, in the hospital, maybe operating theaters have to keep functioning.
13:42Or in, say, the financial sector, maybe ATMs have to keep working.
13:46Right.
13:47For instance, right?
13:48So, business continuity has to happen in various critical services,
13:53and the rest can be less, you know, tense about it.
13:57Okay.
13:58But you have to prioritize.
13:59Okay.
13:59That's an interesting point because it does mean that you have to have a very clear idea
14:05of where the high-risk areas are and the lower-risk areas are.
14:11But I'll come back to that.
14:12Farina, what do you think about the cost of resilience?
14:16I think, okay, so the Cybersecurity Act made it compulsory, I think,
14:21for national critical infrastructure operators to come to terms with their risks.
14:28I think one part of it is actually a risk mitigation framework.
14:35They actually do have to actually write an explanation of all the risks that the systems are having.
14:40And this risk can actually be tiered, I think, in like three, four tiers.
14:45You can accept the risk.
14:47You can transfer the risk to your vendors.
14:50I can't particularly recall the other two, but I think not confronting the risk is not really an option.
14:57It's not an option.
14:58You can't ignore the risk.
14:59Yes, you can't ignore the risk.
15:00You actually have to write to NACSA technically to mention about the risk that you have
15:05and actually also the impact that it would actually have on your systems.
15:08So because of that, you have to audit your own systems to make sure that it is within,
15:16you would be able to see actually where the highest impacts are to avoid the situation where,
15:22no, to perhaps plan the resources that you have.
15:25So if it's actually a risk that you have to confront, you can't transfer it,
15:30and it's also something that is of high impact, there should actually be a solution.
15:35Or there should be a solution on your part to actually mitigate that risk.
15:39And that's actually where the Cybersecurity Act is aiming to build that baseline so that it would at least elevate
15:48the high impact risk that would happen.
15:54Can you talk to me about auditing the digital resilience?
15:59You cited a little bit earlier, Junie, about how Malaysia has quite high internet resilience, right?
16:07Do we know where we are strong and where we might need to work at in terms of our digital
16:14resilience?
16:14Are there, who's monitoring this, who's tracking across sectors?
16:19Because each sector is also quite difficult.
16:21Who's the regulator for this essentially?
16:23So I would point to NACSA.
16:25Oh, NACSA, okay.
16:26Being the kind of central hub for these and many spokes going out.
16:32With the 11 NCII, like the National Critical Information Infrastructure, sector leads.
16:40So you have sector leads, regulators such as BNM, MOH and all that, to take care of their own sectors.
16:47And then these guys will then have the ability to put out codes of practice, for instance, on guiding the
16:57entities.
16:58So you have the leads and then you have entities out there, right?
17:01Hospitals, banks and all that.
17:03So they will then be guided by these codes of practice to understand what they have to do.
17:10Like if you don't do, you get punished.
17:12Or what is good to do, you know, all of these.
17:14So I think that we have actually a pretty good structure in place.
17:18A structure in place, okay.
17:19But of course, it depends on the sector, right?
17:21So some sectors might be less digitalised than others.
17:25Some sectors might have more need for support from NACSA, for instance, on how to consider the problem.
17:32Give me an example of a sector.
17:34You said the banking sector is good practice, right?
17:37So best practices in the banking, the financial sector.
17:40Which sectors may be struggling in terms of this digital resilience?
17:45So I'm not sure because we're only looking at the financial sector within the context of this paper.
17:52We did sort of look at the energy sector.
17:55They also have some sort of code of practice as well.
17:58There's one section that looks at cybersecurity and resilience, I believe.
18:04But we haven't really done like the research across sectors to sort of do that sort of benchmarking.
18:10Do you think, well, what about you, Ferdinand?
18:11Do you have any insight into which sectors you think may need more help?
18:16Because one of the things that's happened in the last few years, Malaysia has rapidly digitalised, right?
18:22And it was part of a concerted effort, a push, which is great.
18:26But have we created new vulnerabilities in our acceleration of digitalisation?
18:31Have we digitalised too fast without being resilient enough?
18:36I think it would be difficult to, just backing up Junie's answer to a certain extent,
18:42unless we've actually taken a look at the maturity across the sectors.
18:46It may be difficult to actually know.
18:48But there are certain idiosyncrasies, I think, with sector-based approaches.
18:54Because for instance, wastewater management, which may use a specific type of system,
19:00which may look, and it may be of a certain digital maturity,
19:06meaning that they probably use operating system for certain things,
19:09which is different from central, for banking and finance,
19:12which would actually use it in a lot of the operations and activities.
19:16It can mean that as they are in the current state,
19:22they would actually have to assess the risk that they have,
19:26and also approaching newer smart city kind of like technology adoptions and things like that.
19:33They would actually probably incorporate these types of technologies
19:35if they can actually do it very quickly without actually conducting the risk mitigation
19:41at the rate that it should be conducted to address some of the challenges.
19:47So I think in that sense, some sectors do actually have larger experience,
19:52I think like deeper experiences.
19:54Because to be fair, our cyber security experience goes all the way to like 2008
19:58with the National Cyber Security Policy.
20:00So from there, they have already instilled like the sector leads.
20:04So some sector leads do have deeper, I think, understanding of the issues
20:09and they're actually quite used to looking at the sector governance.
20:12But there might be certain sectors, inclusive of if you're actually looking at states,
20:17things managed at the states.
20:19It can be such a varied, I think, digital environment.
20:25And also at the same time, chasing your Malaysia Digital 2030, AI Nation 2030.
20:30So these are things to think about.
20:31That's actually a good point.
20:32There are some sectors where it's kind of built into the thinking, the policy making,
20:37whereas some may be more of an afterthought or more of a tick boxing, a box ticking exercise.
20:44So here's what I want to ask you.
20:46Where do we go from here?
20:48Like where, what do you think we need to do?
20:50I'm so glad that you brought this up because I do think that as we're addressing
20:54resilience in other areas of food supply and supply chain and energy,
20:59we need to look at digital resilience.
21:01So where do we go from here and what would a national stress test for digital resilience look like?
21:10Is it even possible for us to do that?
21:12So I think a two-pronged way of looking at it is we can, one aspect,
21:22look at the overarching, how do we increase our or decrease our dependence
21:28on global digital infrastructure to the extent that it's possible, right?
21:32Because we did mention just now that subsea cables, 99%, you know,
21:37that is actually, some of that is unavoidable.
21:40Unavoidable.
21:40Yeah.
21:41But we could work on, say, traffic localization to sort of increase our resilience.
21:47So the second way of looking at it is like by sector.
21:51And that would call back to what we had just already discussed on NACSAS support
21:56and then NCII sector leads developing what are the risk factors
22:04and how to think about information and how to really ensure that there is no,
22:10like, single point of failure, for instance, ensure that they do, like, drills.
22:14So it's not only about when something bad happens.
22:17Something bad happens, yeah.
22:18You have to drift for it, right?
22:19Yeah.
22:19You have to make sure that you have all these mechanisms in place
22:22in the event that something wrong goes and then what do you do kind of thing, right?
22:28So I would say that we would have, like, a two-pronged approach.
22:31Could I just ask you very quickly, when you talked about diversifying dependence
22:36or reducing dependency to as much as we can to a certain extent,
22:40is it possible for a country to, I guess, have more, less dependence
22:46or more digital infrastructure, say, onshore, locally,
22:50but still be dependent on foreign companies, foreign tech?
22:54Even though we have it on Malaysian soil or within Malaysian borders,
22:59can we still be, quote-unquote, dependent?
23:02Yeah.
23:02So I think if you think about, like, digital sovereignty,
23:05if that is how we're looking at it.
23:07Digital sovereignty, is that the term to use?
23:09So if we're talking about that, and it's really about having the control
23:13over, let's say, your data, your technologies that you're using,
23:19and then maybe your infrastructure, right?
23:21So even if those infrastructure are inside of your country,
23:26who owns them, who controls them, right?
23:29And then there's also data.
23:31And then there's also what types of technology do you develop inside of Malaysia?
23:35Or maybe it's actually more cost-effective to use technologies outside of Malaysia
23:41with certain mitigation, you know, because it is very expensive to control everything.
23:46Of course.
23:47So you need to, in the end, also still prioritize what you treasure the most.
23:53Is it your data?
23:54In which case, you know, you might have certain mitigation strategies
23:57along those lines to achieve the best effort.
24:00Everything comes with trade-offs, right?
24:02Yeah, exactly.
24:03Okay, Farid, you know what?
24:04What about you?
24:05What do you think needs to happen from this point on
24:07if we want to build our resilience digitally?
24:09I think actually based on the question that you asked,
24:12the answer is actually technically in the question
24:14when you asked about stress testing.
24:17And I think like tabletop exercises or exercises,
24:20which actually the government has been doing.
24:23Are we doing that now already?
24:24I think it's called Exmaya.
24:25There used to be a series that was called Exmaya
24:27that was running for a while.
24:30But also at the same time,
24:32Malaysia has been on this digitalization journey for a while.
24:35And then our technologies will get more sophisticated.
24:38And as it's hinted,
24:41certain technologies that's made abroad may have,
24:44there may be a lot of questions on its integrity,
24:48on the types of vulnerability that it has.
24:51And I think that's where there needs to be assurance
24:53for the operator or even the person
24:55who's actually working with it
24:57on how to mitigate some of the challenges,
25:00vulnerabilities, risks, and all these kind of things.
25:02So when we're actually looking at stress testing,
25:06sometimes we can think about stress testing technology.
25:10You can stress test people,
25:12meaning do you even know what you're supposed to do
25:14if something goes wrong?
25:16Do you call the other department?
25:17Do you call the other agency?
25:18Do you call your sector lead?
25:20Do you have a policy in place?
25:22So you can stress test process and policies
25:26to actually see how you can recover certain things a lot better.
25:29Because I think some parts of interconnectivity
25:32and if we're all sharing a similar technology,
25:36could mean that information on the vulnerabilities
25:39are in other countries.
25:42And they would actually...
25:43And that's why information sharing
25:45is actually one core component of cybersecurity.
25:49I didn't think of that.
25:50Yeah.
25:51That's great.
25:52So it's actually...
25:54People process technology
25:55is actually one of the ways that you always learn.
25:57People process technology.
25:58That's where you have to identify
26:01at which point could there be...
26:02The gap that you're looking for.
26:04The gap, the vulnerability.
26:05Both of you, thank you so much for joining me on the show
26:07talking about such an important topic.
26:08I really appreciate your insights.
26:10That's all the time we have for you on this episode of Consider This.
26:14I'm Melissa Idris, signing off for the evening.
26:16Thank you so much for watching.
26:17Good night.
26:17I'm Melissa Idris, signing off for the evening.
26:21Bye-bye.
26:21Bye-bye.
26:21Bye-bye.
26:29Bye-bye.
Comments