thank you so much and um
and i'm so glad to see that everybody
uh survived the excellent dinner last
night
um
when when i first
i was approached
to moderate this panel and i saw the
words
indo-pacific
um in the theme then then immediately
china came up to my mind
we've been talking a lot about ukraine
during this uh this conference and then
rightly so
but at the same time
we're seeing quite many developments
happening um in the
in the pacific um
[Music]
area uh we see we kept news about china
doing kind of this island hopping
trying to get new uh defense agreements
with their with different countries
and the the big question
for me
is
are we missing something
what what is the role of of cyber and in
this domain as
as we know also china um having been
quite active in in cyber so
to talk about this and and some other
aspects of that of this area
i have a fascinating panel here um
and first of all thanks for the
organizers it's a gender balanced
panel so uh so kudos for this
um
i will start from uh from what we
internally agreed
as a speaking order um
first ambassador and arima from
from japan ambassador for
for cyber policy
um then
deputy assistant secretary of uh from a
department of defense from the u.s mikao
yang
and
representing
more
free speech
in cyber and
carly winkler
from the australian strategic policy
institute
um so we we do have kind of that the
government views here and and
non-government views but um
um
what is your take on what is happening
in your neighborhood right now
thank you very much uh and thank you uh
for having me here i'm extremely honored
to be
a panelist amongst uh distinguished
colleagues
um
i guess before i go into
our part of the world or our region um
what is happening in ukraine uh has
shocked uh everyone around the world uh
and people around
in
japan uh and in our neighborhood are
shocked as well
the existing international order based
on the rule of law is being challenged
and the international community must
stand up to it
anyone who is seeing this any country
who is seeing the situation in ukraine
must come to understand that
the use of force to change the status
quo or to use by
military means in violation of internal
law will not be tolerated
and will have consequences
china
is
have become an economic power a strong
power a military power as well
and
the security situation in our part of
the world has become very difficult uh
we feel uh not we feel i mean i think
cyber is a realm that reflects
geopolitical tensions uh in our part in
any part of the world
and
china
on its own uh is
carrying out activities that are of
concern to us uh president biden
recently made a visit to tokyo
in the
joint statement between our prime
minister and the president we expressed
concern for many of their activities
and
what is also of concern to us is that
china and russia are
they have been close but they may be
even getting closer
president putin visited beijing in
february uh right before the beijing
winter olympic games
their joint statement said
their
friendship has no limits and there are
no forbidden areas of cooperation um
they have on the 24th of may on the day
that the quad leaders leaders of japan
the united states australia and india
were meeting in tokyo on that specific
day
russia and china jointly flew bombers in
areas around japan they had only started
to do this in 2019 but this was the
fourth time that they had carried this
out
so you can understand the geopolitical
tension that is surrounding
japan
and
the cyber realm is where
we see increasingly activities that
reflect this
both nato and japan us alliance
recognize that cyber attacks could
constitute an armed attack
but the
activities that we see today are below
the threshold but it is it's more
challenging to to deal with these uh
these malicious cyber activities um and
it's it's becoming more challenging for
japan i don't want to go on for too long
so i'd like to pass the baton over to uh
domica
yeah um i really appreciate the question
i think it's a very important one and
one that we're wrestling with uh all the
time in the department of defense uh our
new national defense strategy recognizes
that china is the pacing threat and
while russia and the conflict in ukraine
is the acute threat and um
is i think what many have acknowledged
here the first time that we are seeing
uh cyber con in conflict uh there's a
lot for us to be learning about what
this means but at a strategic level the
key takeaways from
the
conflict between russia and ukraine
is that it is not just a regional
conflict it is not just of interest to
the to nato and the countries in europe
it is of interest to countries all over
the world and we have seen countries
from all over the world recognize that
the attempts to deprive ukraine of its
sovereignty
is something that all of us
oppose and so we appreciate the aid
provided by japan by australia by others
all around the world on the other side
of the planet
this also has tremendous implications
for potential conflict in the
indo-pacific if someone attempts to
change the existing status quo and
self-governance by force i think we have
been very clear that that is something
that is unacceptable and that
like in ukraine countries will pay a
very high price for doing that and it
will
and there will be a need to be held
accountable for any such attempt but as
we look at this current crisis we are
learning many lessons about how we need
to prepare especially in the cyber
domain to ensure that countries are able
to preserve their self-governance in
cyber and in conflict
currently
so i think the only the only useful
thing i can add to that because my
colleagues have expressed it so well um
is how the indo-pacific region um
is is a slightly different problem from
a from a cyber domain perspective and
that is because a lot of the you know um
cutting-edge technology development
much of it is happening in the
indo-pacific we have
some very technologically advanced
neighbours
and of course china is a technological
powerhouse
that means that
in addition to
you know the traditional methods of
warfare that we would expect in in
conflict and again no one no one wants
to see conflict in the indo-pacific um
but in addition to that they have a lot
of other levers they can pull and it
means that
conflict can look a little different or
at least it needs to be taken in that
broader context now i know i'm repeating
things that many others
have said during this conference
but you know cyber cyber conflict isn't
one angle uh in in conflict in the
indo-pacific um
china
uh
there is there is no one more interested
in spying on and manipulating the
chinese than the chinese communist party
and that means they are very practiced
in
certain types of
state monitoring
it makes them very very competent at
applying things like social credit
system and applying new and advancing
technologies such as facial recognition
um technology drone-based warfare
they're investing
enormous amounts into advanced
technologies such as ai have a major
driver in that space to develop
with managing an enormous population
industrial upgrades and a very large
military
from a quantum perspective they
in 2020 they invested
more money than the next uh
five i believe um competitors in the
quantum space so they invested more
money cumulatively than
uh germany france the united states and
the eu combined
that is a lot of investment in advanced
technology
and and what is capable when when you
are practiced and have invested a lot in
that technological space
is that
it's not just a matter of
um
you know
cyber attacks as we are currently used
to them it is also
um the use of authoritarian direction on
technology companies that are worldwide
and so the integration of technology
that is dictated or directed by a
certain government um being implemented
in critical infrastructure worldwide
and again we've spoken about supply
chains the need to understand what kind
of technology is where what capabilities
are where
and
you know
technology such as for example
language translation when you combine
organizations who are particularly
interested in disinformation
misinformation
uh investing in this kind of technology
and then embedding it into systems and
deploying that around the world where we
aren't sure where it is it means that it
becomes very very hard to manage
misinformation
and disinformation and censorship so
the the breadth of cyber
um campaign is quite broad um with when
you're working with highly sophisticated
technology adversaries and there is a
lot of risk in the indo-pacific which um
as as we have the majority of the
world's semi-conductors manufactured in
uh taiwan and south korea in china and
in america
um without chips we have no tech so
being able to make sure that we are
protecting our neighbours that we're
protecting
our technological freedom and how that
is going to be directed that we're
protecting
standards in a way
that um they adhere to to principles
that we all agree to um that are open
fair transparent um and that adhere to
international uh rules based orders
so
there is there is a lot at risk in the
technical domain in this space and it's
a
you know
again we've spoken a lot about the
ukraine and russia and i can i extend my
respects to the ukrainians here today to
everyone who has
dealt with and has to live in countries
that have faced russian aggression and
to those of you who fight back um
you know it is humbling your bravery and
engagement and
it's again on the other side of the
world we find it difficult to figure out
what we can do in this space
so please let us know
again
there's additional additional threats
that i think it's worth also continuing
to look at at the same time as they
learn from russia
thank you so much i wanted to clarify
one one aspect here and uh
yeah you mentioned um the the quads and
and the quad recently also had at the
summit
um and all of the countries also pledged
50 billion dollars for the
infrastructure
are there any implications also on on
on the cyber or how how we can
how quad wants to defend
or invest here
quad
is a
a a framework of four like-minded
countries that wants to promote uh
international order based on the rule of
law fundamental values that we all share
um and
we are
saying that we would like to promote
what we call the free and open in the
pacific which is international order
based on the existing international i
mean where we where we are now
and we would like to do good deeds
within the region and even beyond uh and
50 billion dollars uh investment in the
infrastructure project
the vaccines that we will be promoting
uh the
cyber
security sphere where we would cooperate
and we would cooperate to provide
technical assistance to countries in the
region
we cyber
of course is one of the areas that we
would like to do good deeds within the
region
50 billion dollars is more for
infrastructure but but cyborg is
obviously included in the things that we
would like to carry out yeah i think one
of the
keys when we think about the quad and
cyber is all of our commitments to the
free and open internet and the cyber
domain i really appreciate our
lithuanian colleagues who've done deep
technical analysis of chinese products
and discovered that chinese censorship
tools are hardwired into the products
that they sell throughout the world the
four of
the four countries are committed to a
different vision of technology a
multi-stakeholder
free and open environment and i think
many of our european colleagues share
that view
and so as we think about how to contest
the increasing digital authoritarianism
i think the quad and the conversations
that we have there become increasingly
important
and if i can add to that too you know
with um relationships like the quad and
with orcus and with asean and and a
bunch of the other relationships that we
have around the world that are that are
beyond nato um
the point of those is not to be
exclusive it's it's to
pull some threads and try things um
based on existing relationships that
have worked say in the five eyes domain
and in bilateral relationship that we've
always had with japan with india
and to to pull together different groups
to try some things out based on existing
trust that has been built over decades
and then to bring people in
um and i think that's that's a key
message that that we need to make very
clear that we're not here to be
exclusive um we're here to
enhance the edition the you know and
provide additional effort on top of
what's already happening in the nato
community and so
we would really like um you know to
to start exercising some of the issues
that we have around trust around data
around infrastructure around people
and the challenges that we face
particularly in the indo-pacific region
around technology around climate change
again is a key message that's come out
of the quad because you know a number of
our neighbors the the drivers for them
are not the same as as they are for us
or at least
you know they're they're struggling to
survive in a world or worry about the
future of their countries their cultures
um in a world where you know the island
nations may be underwater in five years
now that aspect of survival you know
changes the equation in terms of where
their vulnerabilities might be and where
their priority is going to go in terms
of cyber support so we
you know
our role in the region is not to come
and protect everyone from
um big bad outside forces it's to help
these countries protect themselves
and so the concept of
um helping vulnerable nations uh build
their own cyber capacity is really
critical
if we you know when when cyber security
really is only as good as its weakest
link if we're able to smooth out that
attack service
regionally and give attackers nowhere to
latch onto
then it reduces the noise when if it
comes to conflict
it increases trust
we have difficult time trusting people
or building trusted relationships if
their networks are being owned or if
they're being manipulated so we can
build trust in that space
and it allows us and buys us time to
plan rather than to react when we're
under pressure
so
working with countries to build that
cyber capacity for themselves to
maintain their sovereignty their ability
to self-govern and and their
resilience um in in a cyber domain which
in a lot of cases is
um
almost extraneous to their to their
driving needs at the moment to to be
competitive and to survive um and to
thrive in the modern world
so
um again the the goal is really to to
try things out to see what works to
bring people in and and to do it in a
way that that
you know adheres to those international
um you know rules-based law
and and do it together
and still
we heard from jonah we were a couple of
days ago
about
the number of democratic countries the
number of undemocratic countries
my question here would be are our
policies working in that
from my daily job when we deal with the
capacity building projects or we're
discussing coordinating different
projects
i don't see that that
we are
really kind of leveraging what we do in
these countries we are not leveraging
these projects to become a kind of
political
mind shift in this country so
maybe to put you on the spot clearly um
what are we doing wrong then well i mean
i think in in certain cases it's about
making sure that we're we're asking
questions and doing it respectfully um
that we we understand um again where
some of these nations are coming from
and what they're vulnerable to but also
understand that
no one wants
no one wants other countries to come in
and dictate how things are going to go
for them and no one wants to open doors
and allow in attackers to manipulate
their population uh and no one really
wants to seed sovereignty and their own
national resilience neither do we
so i think
making sure that we provide them with
options and alternatives in the region i
mean china again technological
powerhouse is able to go out and sell
really sexy sounding solutions to a lot
of these nations um and
and those nations
they're not stupid they know what the
costs are
um to to engaging and what we try to do
is provide an alternative that
um
you know
protects some some more of those values
that they hold true so
i think it's about an ongoing ability to
build trust and to to also expose um to
people in our own countries because our
own people are just as vulnerable to
manipulation and disinformation as as
people in other countries um expose and
shine daylight and fresh air on
um
you know cyber attacks and and you know
cases where we've got
demonstrable manipulation coercive
diplomacy being applied pressure
that that does reduce people's ability
to be sovereign
and make sure that those
cases are clear and so if
you know these countries are able to
make a conscious and educated decision
about what they choose to invest in and
then it honestly it is up to them
but we we provide an alternative that
aligns with a set of rules that we need
to both adhere to be transparent about
and also walk the walk on
any additions
hey not on the quad
all right um
um next point that that
could be a bit more
sexier topic in within within cyber and
and china
is um
what do you think what is
what is china right now
learning
from
russia's cyber activities in ukraine
yeah or the whole conflict how how would
that kind of
um
inform
their policies
yeah
so
what the chinese are actually learning i
think um
we would have to ask them but i do think
that there are some important lessons
that they can be observing from this
conflict that are very important for us
to understand when it comes to fighting
in the indo-pacific
first is that it is much it is difficult
to change the strategic orientation of
the defender by cyber means
that if the defender is committed to its
own self-governance and territorial
integrity
cyber disruption does not change that
strategic perspective and that it is
much harder
to
force a the defender to give that up
even with kinetic means
the other thing that they should be
learning is that
their estimates of how long and how
difficult this conflict might be
may be off russia very clearly thought
this would be much easier
to take the entirety of ukraine than
they expected their own analysis and
their own their assessments of their own
capabilities were off
in an authoritarian system
where disagreement and bringing bad news
to your leadership
is something to be punished and not
something
to be taken in as a opportunity for
improvement
the chances that you are not being told
accurately whether or not you are ready
to fight are quite high
and that is a real challenge for china
the other thing that i think is really
important to understand and this is a
challenge for all of us is that a
history of cyber attacks
prepares the defender to be resilient in
the face of them
and ukraine has been tested
and
other countries
other partners have provided assistance
to their cyber defense
for a very long time
and how we think about shoring up the
cyber defenses and improving the
resilience of countries in the
indo-pacific region is something that we
need to do with alacrity lessons learned
from this conflict about the importance
of resilience the structures that are
needed to maintain insight into your
national networks to be able to
remediate those things quickly to know
what help you need from the outside
world these are all very important
lessons that we are learning right now
but this conflict is still ongoing so i
am hesitant to say exactly what those
lessons are
because there can be further turns in
this conflict our insights into exactly
what has happened in the cyber domain
is still evolving as we learn more from
the private sector from the ukrainians
themselves and even i think as we may
learn more from russia about how
restrained or unrestrained they have
been in this conflict
in the cyber domain
so i think that there's a lot that we
can learn and a lot that we need to
think about preparing
in the indo-pacific so that countries
there are also prepared to preserve
their sovereignty and their territorial
integrity
i completely agree with uh what mika
just said i mean exactly what china is
learning you really have to ask the
chinese but what we can see
from the conflict in ukraine is what she
had just talked about especially in the
cybersphere is cyber resiliency i am
just
impressed at the the how the ukrainians
are supposed to are able to maintain all
the major critical infrastructure within
their own territory to continue to
provide
services to their cell phones and their
their
sns accounts are all very active and and
it's it's like how are they doing this
we have one earthquake and we you know
we we have one
uh we could have a electric power plant
down but they have a war going on uh
when they have a
continuous cyber attacks which they are
resisting um and so
for the lessons we can learn from what
the situation in our part of the world
would be to have
to enhance and then continue to enhance
cyber security and to have cyber
resilience
uh at the same time i guess it will be
just a little bit off uh
we come above ground
we saw in the united nations that over
140 countries voted to condemn russia
for their uh aggression against ukraine
so that's 140 out of 193 you may think
that you know we're missing 50 but that
that's three quarters of the countries
around the world are united uh in
opposing this unilateral aggression in
clear violation of international law uh
and the economic sanctions that we are
all imposing on them the g7 is leading
that uh that effort uh and
the the the
financial costs to uh russia and their
economy uh is substantial uh and i think
as i said at the beginning we must make
sure that any country watching or
following this conflict must take away
go away with the
lesson that this cannot be repeated or
that they should not be trying this kind
of an effort
so
is my translation now correct saying
that
the ukrainian resilience and
somewhat chaotic russian activities are
right now deterring also
china to take further actions against
taiwan
to quote joe and lie as we saw earlier
too soon to tell
um but i do think uh
any country that is thinking about
changing self-governance by force by
changing the existing status quo by
force
needs to be wary of the consequences
globally for doing so
and especially
a country that is as intertwined in the
global economy that have so many
leverage points
that countries could say i am no longer
interested in doing business with you
i'm no longer interested in supplying
you with
whatever
those are high prices to pay um aside
from the fact that it could be
incredibly embarrassing for the country
that is attempting
uh to take
by force um thinking that they are the
stronger power in fact turning out to be
not as capable and demonstrating that
weakness on the global stage
i mean the
i completely agree i think
the
the fact that china will attempt to
reunify
taiwan into china is not up for debate
they have been very clear about that for
decades that they believe that taiwan is
part of china
i think the question is how and what
we've learned from russia is really
that doing that by force is really not
an option for them if they want to
preserve peace and again as you've said
not embarrass themselves in the face of
hundreds of countries that are going to
um argue that that is not an appropriate
way of of working in the region
i guess one of the leverages that that
we have and and the chinese leadership
has also
kind of
voiced it out is that
we have
huge kind of economic ties with china
and china is also interested in keeping
these economic ties and we saw that
that's in the debate
about the sanctions against russia and
chinese seem to be quite wary about that
um
my next question here would be
so if we see
see or try to interpret what china is is
is learning from
the conflicts or russia's war against
ukraine
what are the lessons for us
how to deal with china tomorrow and day
after tomorrow
yeah
i think that as
we think about
global technology development and
adoption
i think um
we need to think carefully about what
adoption of chinese technology might
mean you know i think that for a long
time there was a you know the 90s were
very optimistic to turn through
entanglement
that we would have entwined economies
and that would prevent conflict
but largely the entanglement has gone
one way um we have not seen
the same adoption of chinese of western
technologies within china
and i think that that poses a challenge
but as we think about and as some people
i think
are
see the appeal of adoption of chinese
technology platforms based on cost and
all the rest of that um
it may feel cheaper in the moment but
the long-term security costs to being
able to ensure that you have control
over your network that your network is
not part of a censorship apparatus for
another in another country's interest
and not your own i think are things that
countries have to consider
very carefully when when considering
that offer um
it does not have to be that you know
there is confrontation here but i think
we have to figure out how
um we can
uh
shape uh ensure that china is playing by
global rules
um that are consistent and preserve the
allow countries to preserve their own
self-governance
and not be coerced
either explicitly through economic means
or implicitly through the technology
they have adopted
to someone else's national security
interest
again i agree with what mika just said
and also
i guess in terms of what we would
like to do is to deter uh
action uh meaning
not just in cyberspace but just to deter
any activity by the chinese that will
will change the status quo uh in our
part of the world which they are in east
china sea uh doing uh on a daily basis
and then making unlawful maritime claims
in the in south china sea
they are becoming they they are
challenging what we would call the
existing international order uh and i
think
as mika just said there are risks to uh
the the economic influence of china is
just global
they are the second largest economy in
the world uh and we are 20 of japan's
trade is with china but we must make
sure that uh
the the important uh infrastructure that
we rely on or be it in the cybersphere
or in the physical sphere
are reliable we just enact the new
legislation on economic security
where
and if we would designate uh certain
industries as critical infrastructure
industries and if they're going to make
a major procurement they will uh submit
the proposal to the government we will
only review and we will only advise but
make sure that they are uh we would make
sure that they are from trusted vendors
uh and i think
um
one you know
it's it's important to
maintain our
international order the way we
live continue to enjoy the economic
successes that we have had uh at the
same time not be too reliant on uh
on
products that are not reliable and so
that that we would be at the at the
mercy of a certain
untrusted vendor
i would just like to add i we really
appreciate that japan has taken the step
because as we think about capacity
building with other countries and we
think about increased
cooperation in the cyber domain
whether or not a country's networks are
trusted
is a key factor in how far cyber
security cooperation with the united
states can go
if we have concerns
that the networks are vulnerable
have been compromised it makes it very
difficult for us in the u.s to share
sensitive or classified information
with another country so this is a real
challenge as countries think about these
networks
typically you know when you think about
your information technology networks you
don't think about the national security
implications but if someone else is able
to turn off or route traffic on your
networks differently than you would
choose to if they are able to
collect in bulk the traffic on it that
poses a real challenge
to our ability to share because the last
thing that we want when we are trying to
plan and coordinate together activities
in the national security arena is to
have adversaries sitting inside that
communication
i'm like can i be slightly controversial
at this point i don't feel like i've
said anything controversial so far i
mean we need to prepare the audience
also for the questions
yes controversial the not controversial
part is again could not agree more i
think the extension to
um to what we've just heard is that
any conflict um with advanced
sophisticated advanced technological
powers such as china or anyone else
is that
it is not
contained to a military versus military
argument right this is not where the
bounds of that fight is going to happen
and we can expect to see ongoing gray
zone um engagement and conflict um as as
we are currently facing now so
it is tempting to to look at conflict
and say the defense is going to to
handle it and i think
you know
conflict with
um in cyberspace is one of those
here's the first controversial part
defense is uniquely not qualified to
fight that on their own
we know that public private partnerships
have been really successful in ukraine
we know that there's there's problems
with getting enough skilling and and um
staff to who can work in the cyber
domain but one of the reasons that
defense can't do it on its own and this
is not anything to do with their
capabilities defense is probably able to
to protect defense if they're very very
good they're able to protect defence and
a bunch of government departments
but we also have people in our countries
who are individuals and who have small
businesses and who fall below the
threshold of what a state can afford to
to support and yet we owe them
protection we owe them protection that's
a little bit why they pay taxes so
uh
we we need to be able to deal with the
fact that today we are those those
people are having their lives destroyed
and their livelihoods ruined um and are
being manipulated um by by foreign
actors
and
and our response to that probably needs
to not be focused on it in a narrow
space i mean
the controversial part which i will say
now is that we tend to get wrapped
around the axle a little bit about whose
responsibility it is
depending on the activity and it is
arguably unhelpful to do that so
traditionally i mean we all have secrets
we all have intelligence communities
that that have you know information they
protect and have sovereign interests
that they'll protect and that is good
and right and we all agree to that
but
we get caught um
usually in a policy domain about what is
coming from offshore and what is onshore
and what's domestic and of course in
cyberspace
sure is largely irrelevant
which means that the division of of
effort that we
have inherited from many years working
in an intelligent space
tires in knots so is this is this an
intelligence problem is a security
problem is it a military problem is it a
domestic security problem is it a law
enforcement problem and and
and the answer is it doesn't matter
those groups need to be working together
is it is it a cyber security industry
who cares
we have to be able to get around this
issue and make sure that we're getting
the right people to deal with the fact
that they're all attacks
and that we do need to protect our
people as much as we need to protect the
institutions that that they have either
voted in or that that run their country
so
it's a it's a difficult space to figure
out we will always have information that
we need to be able to protect and we all
have the sovereignty uh and the need to
make sure that we're all individually
resilient i think the trick is
finding a way to share what we can share
and going beyond sharing because the
reality is also sharing is not
sufficient we need to actually build
something that is greater than the sum
of the parts and that means we need to
build something together in a
collaborative way but not in this naive
collaborative way that's like we're this
utopia where we're all magically going
to open up and give everything that we
have to everyone else because that's not
going to happen
but we can look at building systems you
know in a world where we talk about xero
trust and we talk about
trust but verify we can trust our
partners but verify and expose the right
information that is going to provide the
right context but we need to exercise
the policy and get the policy issues
sorted out both domestically and
internationally to be able to do that
it is also quite interesting uh as you
mentioned that the public private
partnership and i would even widen that
it's not
about partnership with them with the
industry
but what what we have seen
in in ukraine
besides the the new role of of big tech
companies
are also these vigilante groups that are
completely and uncontrollable
um
and my my last question before we go to
the audience um questions
is what do you think what is china how
is china looking at at these kind of
developments because these are kind of
new elements in in cyber world and cyber
warfare
yeah
i think the
call to arms for volunteers that
in the cyber domain that has happened
here is a complicating factor and it's
very difficult for us to assess the
overall impact of that activity um on
russia's military capability
and what kind of assistance that has
provided to ukraine
likewise i think we have all known for
quite some time that there are a large
number of non-state actors within russia
that have
varying degrees of relationship with the
government
in cyber crime and they you know how
they are used in the russian system
they they pose this sort of hybrid
threat
um
we saw in the microsoft hafnium incident
and this was part of the u.s attribution
statement about that activity was that
there was certain an ungoverned
ecosystem in china taking advantage of
that exploit and that was actually quite
problematic
we had not seen typically and we don't
see the same kind of criminal actors the
sort of scope and scale that we see in
russia operating out of china that china
has announced that they um are against
cryptocurrency processing on their
territory so the availability of
non-state actors
in china is different they obviously are
a country that puts an emphasis on
control
but how they would have to deal with
non-state actors if they were to try and
change the status quo by force and and
take on this very aggressive unprovoked
affront to
uh the international rules based order
um i think that it's something else that
uh uh an aggressor nation would have to
consider reconsider
not only
the non-state actor hackers
but the non-state actor
industry responses that might happen as
you have seen as we have seen in the
russia ukraine context com western
companies withdrawing their services
from russia
in response to sanction in as a protest
to the activity itself or in response to
criminal act criminal laws imposed by
russia against the kind of things that
were core to their business model this
is another complicating factor for how a
conflict with china might play out that
is outside of specific government
direction
and so i think that these things are
things that we will all study and if
they're academics here we look forward
to your analysis um
but i think these are important lessons
for all of us to understand and analyze
going forward
do you add anything or could i can i
make a speculation
i'll write it down so uh next year we'll
quote me on it
one of the interesting things about
quantum computing
is not that it's here today although we
can do certain amount of quantum
computing today
and and the threat has always been well
it's going to break
you know most of the public key
cryptography and the cryptography we
depend on for our security today
but one of the interesting things about
the fact that it's coming
um is really trying to guess how far
away it is because
at some stage it is entirely possible to
harvest data now
um hold it and then decrypt it when the
quantum computers are ready
so
if someone were to invest a lot of money
in quantum computing
and if they had an appetite for stealing
people's cheese
then you can probably suggest that there
would be groups who would be happy to
harvest data
and sell it to the highest bidder who
would be
potentially thinking of that as an
intelligence opportunity for the future
hypothetically speaking
um are there any hypothetical questions
from the audience
uh first here and then i saw him there
also
and please pose your question as a
question
thanks
i will try to keep it short um so katie
question to you very good points you
made there jumping to solutions what
would you say are good approaches
to reach out to china on a diplomatic
level and give them a hand to save their
pace and
yes try to bring this conflict to an end
more or less in a
peaceful way because i guess they will
be quite interested in that given that
they are heavily investing in their belt
and road initiative
i'm going to defer that to people with
diplomatic experience as opposed to
people with technical experience about
how how we could use that path um
i think the
for us what is extremely important is
we're not seeking confrontation
we are seeking
as we often say in many of our
declarations peace and stability uh
of the taiwan strait and that the the
straight issues need to be resolved
peacefully
and we are all
japan and the u.s both in australia as
well we are always having dialogue or we
are seeking dialogue with china to say
we have issues that we would like to
raise we have concerns about what you
are doing in east china sea south china
sea your uh economic coercion measures
these are some but at the same time as i
said we both have very strong economic
ties with china and we want
to have a constructive relationship and
work on global issues of mutual interest
uh we are
trying to establish that kind of a
relationship but we are not what we are
trying what we are
adamantly against is a
an order where the strong dictates what
the weak should do
or the the in their sphere of influence
that they get to do whatever they want
to do uh uh
ignoring the the the norms that we have
the rules and the laws that we have
established over
over many years uh and so that
we i think
it is for
uh the uh
it is as much on the part of the chinese
as it is on the part of us to be able to
have that kind of a constructive
relationship
i would just say before we can get to
what we would discuss we would have to
have a commitment to a discussion
and so i would encourage the chinese to
welcome
the chance to have these conversations
at all levels
we had a question here in front
president
and then
we'll go back there
uh thank you the uh in the
basic with the rise of the digital era
regional groupings such as the north
atlantic treaty organization that
obviously by definition cannot have
uh japan or south korea
uh or australia in it becomes kind of
irrelevant thailand torino toronto
topeka tokyo and taipei are all
the same same distance
uh from each other or from an adversary
and apt 28 and 29 don't care about
whether it's the u.s
state department or it's the dutch
foreign ministry or the bundestag that
they are hacking
clearly in this era we need far far more
regional cooperation between like-minded
anti-authoritarian rule-based societies
my question is
uh well how much of that is there there
isn't very much i mean even between the
united states and europe now that the uk
has departed
uh
from the from the european union
uh i mean five eyes europe is out of it
and then there is then there are the
democracies uh on the other side of the
pacific
they too high
rule-based democratic societies
um highly technologically advanced yet
we see
uh we don't see any kind of defensive or
security based uh
activity with question i mean
cooperation
alliances my question is what are the
prospects what needs to be overcome why
can't we do this
i am so happy that i am a moderator
right now
the national defense strategy emphasizes
the importance of partnerships and
alliances as general nakasone says the
united states has friends other
countries have clients
the united states
yes we are
very focused on the security
relationship with the north atlantic but
we also have treaty commitments
and defense agreements mutual defense
agreements with asia pacific allies
which are very robust the united states
has significant military presence
in countries in asia we are a pacific
nation which as someone who grew up on
the pacific coast i'm very aware of and
that's not even
the end of where the united states is in
the pacific
i think that we have to be
wary of a narrative that the chinese are
trying to spread
that
asia should only be for asians
and sitting here as a representative of
the united states
the united states is an asia-pacific
nation
and so as we build those relationships
as we continue that i think the
cooperation is quite strong our
alliances are quite strong um we need to
build on that we have partnerships
around the world and it is a network of
partnerships that we bring to bear and
we work with people depending on their
interest and depending on
their maturity it does not require a
monolithic
bipolar network confrontation
we will work with countries as they come
i think we have uh alliances in the asia
pacific region which are
strong
which
work on a daily basis to deter
malicious activities or activities that
will challenge the existing
international order
and ultimately conflict
the
the united states
has the seventh fleet four deployed in
japan uh
japan okinawa and okinawa hosts the
one of the three marine expeditionary
forces of the united states marine corps
the naval academy cadets are nodding
yeah
we have 55 000 uh us
troops stationed in japan um
there's also a strong alliance with
japan with the us and korea as well in
australia as well
and on top of that
i'm not foreseeing a new uh military
alliance uh to be to be forged but we
have various layers of uh international
uh
fora that we cooperate with that we
cooperate with asean there's also the
east asian summit which includes asean
post us and also australia new zealand
india
we also have that the quad is something
that we had created this was something
that we had advocated for
uh and
now
because of well not just because of
ukraine but we are forging closer ties
with nato um
our foreign minister attended nato's
foreign minister's meeting for the first
time in april
we have close ties in cyber we have we
have the cyber staff talks with nato
we attend as an observer the formal
exercise we also attend the locked
shields here at the center we have an
official from the ministry of defense uh
in the center uh this past concert
continuously
and i think
what i'd like to say is
amongst all the military alliances the
united states is at the center uh with
with the strongest military in the world
i mean there is no question about that
uh and
they with the alliance that we force
in this part of the world it's nato in
our part of the world it's bilateral uh
treaties
but the this is extremely strong and
sound and i think
up until now have deterred
a really serious uh malicious or
military activity to take place okay let
me just clarify my question
if you discover a new apt
how do we know about it
how is it that all of i mean because the
apt
or advanced persistent threat that you
discover brand new
it can attack
us just as much as you but you have
discovered it how do we find out about
what are the structures
the that currently exists by which we
automatically you know with the
milliseconds that it takes to get from
tokyo to thailand find out that oh we
discovered this new bad guy
that's all i mean this is what exactly
we don't have the institutional
arrangements for that right now
i think that as we look at
public-private partnerships
the persistence requirements for an apt
means that they would be very clearly
visible
not only to our governments but to
private sector actors the question then
becomes the attribution and the intent
behind the apt that an apt is out there
and that it is uh establishing presence
on a network is a different question on
whether than whether they are disrupting
the network and the disruptions rising
to a particular level announced
themselves
i don't think that we have a challenge
in terms of the arrival of a new apt and
our inability to talk about that law
enforcement cooperation
national security and intelligence
cooperation private sector cooperation
um apts are known by many names by many
different actors and we see them
on the networks all the time so i think
that there's not necessarily a need for
an institutional environment you know we
don't need sort of an icann for apts to
name them and like assign them names so
that everybody calls them the same thing
i think we are doing okay
we are doing okay i think in terms of
swiftly exchanging information uh on
those uh threats that we we catch we
capture we don't we don't hog the
information we we spread it around to
make sure that everyone is aware as you
had
mentioned uh it's instant so it needs to
be shared instantly in the same way we
do for cyber vulnerabilities right i
mean we declare them um internationally
we've got the cyber threat alliance
multinational organizations in the
private domain it would be harder to
keep it quiet than it would be to share
so again i don't think it's a matter of
setting up special alliances to do that
i think we're happy to share that
the fact of and and and some of the
behaviors and i would just like to say
this multi-stakeholder structure stands
in stark contrast to the structure that
china is trying to establish what
requires uh disclosure of these
vulnerabilities to the government first
for their determination on how that
would go i don't think that that is the
kind of thing that we want in us in a
multi-stakeholder free and open society
we do not require that the governments
are the first to know and then decide
whether or not the public and the
industry should know it is something we
all know and share at the same time
absolutely and of course that was
exactly the case of the look for jay
right there was an alibaba employee who
who um announced it and talked to apache
about it and i thought it was okay and
then i hope so too right but you know
china um
i think ended up sanctioning alibaba
cloud and cancelled their
um contract with them for six months and
then said that i will reassess later
when you've addressed this so you know
we're not interested in applying that
kind of pressure we know that they're
going to be hiding the kinds of
vulnerabilities that they find
but you know that's a stark contrast to
how the rest of the world intends to
continue operating
this this information sharing reminded
me of one one
talk of a colleague a couple of years
ago
and there was an european colleague who
was saying that uh it was it's really
useful to have some contacts with
with their asian countries i mean first
with australia with japan with singapore
because they wake up earlier
they know about different attacks
earlier but we have a time for a last
quick question and and we have their
hand happens
please
hi
oh sorry
hi wish all do my highly respect i am
from taiwan
um maybe the
one of the representatives from
indo-pacific area
and let me quickly answer the questions
in uh for the
previous one
we look at the apts not only for layer
ttps but also for layer malware patterns
there are always the signature was some
signal that he then he knows malware and
also like which has uh
um the hacking group from mainland china
we can understand that most of they use
a social engineer as a first as a
stepping point and they also let zero
day to do the attack in the following
but we can discuss that later my
questions for
um
those
panels on the stage is as a conference
discussed lots of about the relationship
between the russia and the
ukraine this is the probably the very
first session bring up the implication
interaction in lake asia and in the
pacific area
i don't really mean timeline the china i
just say it's a
broadly speaking the indo-pacific area
what do you think the front-line
countries no matter in the geographic
term or the cyber term to do to work on
and to keep moving to shape the
environment and to be more sustainable
for the threat in the future and how can
those countries do align with the europe
where nato interests
strategically were taken not technically
um well what can we help what can
taiwan do taiwan help
thanks
i really appreciate the question i think
taiwan like ukraine
is at the front line of
cyber
malicious cyber activity and so they are
very much a frontline state and so
taiwan like ukraine has
very uh has a lot of experience with how
that malicious actor is trying to access
and potentially disrupt their networks
and so there's much that we can all
learn from their experience
in this regard
lessons for frontline countries from
ukraine i think include understanding
how ukraine was able to maintain its
resilience its ability to communicate
with the outside world and its ability
to continue to command and control its
forces while under the most rigorous
strain that we have ever seen in the
cyber domain from outside forces
lessons learned from ukraine in terms of
how they reacted to the disruption of
their satellite communications
how they are able to become resilient
and have
multiple ways of you know falling back
and degrading as things are
disrupted the number of the cooperation
between the isps in ukraine is an
example of how they can
move to migrate quickly when disruption
occurs their migration to the cloud
during the conflict is another example
of things that peop frontline nations
can think about how do you develop
resilient architecture
that will help you withstand
disruption in the cyber domain and i
think that there are many
countries that could learn a lot about
having resilient architecture from what
has happened
in ukraine and we look forward to
being able to continue to engage with
them on their lessons learned perhaps
when they have a little more time
i think this uh this is a good good
moment uh and good thoughts actually to
uh just to end this conversation
um and i'm really sorry for those who
still had questions but that did not
have the time um
i thought it was a fascinating and
and thank you so much for being here and
and
let's thank the panel please
[Applause]