Privacy Risk in Australia

This week is Privacy Awareness Week in Australia, and I attended a webinar on AI, automated decision-making and privacy risk, presented by privacy law expert Anna Johnston from Helios Salinger. Over a thousand people registered for the webinar, an impressive effort.

The webinar covered a lot of ground. What it mostly did for me was reinforce a view I’ve held for a while: privacy risk in Australia is consistently underestimated, frequently treated as a compliance checkbox, and almost never given the same weight as financial or reputational risk, despite being directly connected to both.

Read the full article 

This article was first published on the ENVEE Digital blog.  

Read More

Interview with Institute of Community Directors - Boards urged to close tech gap

A couple of weeks ago I had a great chat with Matthew Schulz, a journalist at Our Community, after my post about the board pipeline problem for technology professionals.

That article landed earlier today - in the inboxes of more than 60,000 NFP leaders across Australia. That's a LOT more people than I expected to be talking to when I originally wrote about my own frustrating experience applying for board roles!

The piece covers the structural catch-22 that keeps technology expertise out of boardrooms: you can't get board experience without being on a board. Boards see the risk of appointing someone without governance history as more manageable than the risk of not having tech expertise - but that's a choice about which risk to accept, not an absence of risk. And right now, most boards are choosing the risk they understand less.

Ben McEvoy from Digital Directors ANZ puts the scale of it plainly: at the current rate, Australian boardrooms are on track to have one director with digital expertise by 2078. That's tongue-in-cheek, but the underlying governance problem it describes is real - and it applies well beyond the NFP sector.

If you work with or on boards, or are a technology professional who's been through the experience-required merry-go-round, worth a read.

Click here to read the article by the Institute of Community Directors Australia 

Learn more on the ENVEE Digital blog - Digital Strategy at the executive level

This article was first published on LinkedIn

Read More

Australian Boards and Technology Governance

 

My husband attended the AICD Australian Governance Summit in Sydney earlier this month. He called me a couple of times to check in and give me a run down.

Almost every session, he said, touched on AI and technology governance, and the urgent need for boards to have more digital expertise.

I've just read the AICD's report on AI use by directors and boards (link to their post in the comments). It's thoughtful and well-researched. It talks about AI literacy, the risks of directors using public AI tools on sensitive board papers and the importance of human judgment remaining central to governance. It doesn't mention the pipeline problem though.

I hold the AICD Foundations of Directorship credential and an MBA. I have 30 years of hands-on technology experience across enterprise, NFP and SME organisations. I've reported directly to boards and CEOs on technology strategy and risk. By the AICD's own definition, I'm exactly the kind of person they're saying boards need.

I also can't get onto a board without prior board experience. And I can't get prior board experience without being on a board. 🤯 

This isn't a new problem. Australian boards have long operated as a relatively closed system, with roles going to people who already hold board roles - predominantly lawyers and finance professionals, predominantly older and with limited technology expertise. ASIC Chair Joe Longo noted recently that directors with a technology background represent less than 8% of Australian boards, numbers which have scarcely changed in the past year.

Now the institutions that built that system are saying boards urgently need people with technology and AI expertise. The people who actually have that expertise at depth are, on average, not lawyers or CPAs, younger, and mostly haven't yet accumulated the governance CVs that get you into the room.

I don't have a clean solution to this. Boards are genuinely trying to grapple with a fast-moving space, and the AICD report reflects that seriously.

I do think it's worth naming the gap between the problem being described and the structural barriers preventing it from being solved.

AICD report referenced in this post - AI use by directors and boards: https://www.linkedin.com/posts/australianinstituteofcompanydirectors_boardroom-conversations-are-shifting-from-activity-7441589560666615808-xx4H/ 

Learn more on the ENVEE Digital blog - Digital Strategy at the executive level

This article was first published on LinkedIn

Read More

Corporate Social Engineering 101

Another day, another Australian corporation actively encouraging social engineering. 🤦‍♀️ 

For YEARS, RACV has called from a "Private Number" to discuss a claim, and immediately asked me to confirm my full name, date of birth, and address “for security purposes.” (They're not the only Australian company that does this, but they are today's example).

Whose security?! 

Let’s be clear:

You called me. From a hidden number. Asking for personal details.

That’s not security. That’s textbook social engineering.

When I push back, they read out an obvious script along the lines of "if you're not comfortable with this we will send an SMS to your mobile with details on how to call us back". So they know this is a problem. Yet they persist.

Kevin Mitnick was doing social engineering in the 1990s ("The Art of Deception" was published in 2002). It’s 2025. With scams and identity theft at an all-time high, why are large organisations still normalising insecure behaviour?

We need to stop training customers to hand over personal data to anyone who sounds official.

Do better, for all of our sakes.

This article was first published on LinkedIn

Read More

Governing Through a Cyber Crisis

This morning I attended the AICD’s “Governing Through a Cyber Crisis” because I was interested to see what strategies for building a cyber-resilient organisation would be covered at a board level. As a 30-year tech professional, I reckon there’s a difference between governing through a crisis and building a cyber-resilient organisation – but it depends how you look at it.

As outlined, the talk focused on how a board would manage a situation where the horse has already bolted. It covered ensuring the right people are in place to manage the situation, reporting to authorities in the event of a breach, communications and media management – all very important, and we’ve seen the fallout when these things aren’t done right. In this context, “cyber-resilience” is about making sure your organisation is set up to manage the inevitable cyber situation.

What really stood out for me was that we only touched on preventative measures – auditing, including third party vendors, and penetration testing – after 51 minutes, and AI at 55 minutes. Doing all this and more to try to prevent the situation from occurring in the first place, AND having the strategies in place to manage if it fails, is how I define true “cyber-resilience”.

Read the full article 

This article was first published on LinkedIn and is also on the ENVEE Digital blog. 

Read More

Foundations of Directorship results

Happy to have successfully passed all three "Foundations of Directorship" exams via Australian Institute of Company Directors last week, after completing the courses in April. 👍

#Governance

#RiskAndStrategy

#Finance

#CompanyDirector

#Director

#aicd

Read More

NetThing 2022

This week I attended NetThing 2022, the Australian Internet Governance Forum, an event I've attended several times before and always get a lot out of.

From the About page:

NetThing is Australia’s Internet Governance Forum, an annual event for the discussion of public policy issues pertaining to the internet in Australia. It is a multidisciplinary community, forged by the common will to increase understanding of Internet related issues but, most importantly, increase understanding of a diverse range of stakeholders’ views on these issues.

NetThing aims to provide a diverse and inclusive platform for the exploration of Australian technology policy issues, to mobilise Australians to collaborate on solutions, and to connect Australia to the regional and global Internet Governance Forums.

Read More