FINISHED FILE

ASIA PACIFIC REGIONAL INTERNET GOVERNANCE FORUM
BRISBANE 2023

AUGUST 29
STORIES FROM THE PACIFIC – THE HUMAN SIDE OF CYBER INCIDENTS
2:30 P.M. LOCAL TIME

	
Services provided by:
Caption First, Inc.
P.O. Box 3066
Monument, CO  80132
719‑941‑9557
www.captionfirst.com

This text, document, or file is based on live transcription.  Communication Access Realtime Translation (CART), captioning, and/or live transcription are provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.  This text, document, or file is not to be distributed or used in any way that may violate copyright law.

>> CHERIE LAGAKALI:  Good afternoon.  My name is Cherie Lagakali.  Originally from Fiji but I belong to the group of people we discussed yesterday in the Pacific IGF because of the brain drain now in New Zealand.  Maybe we can have a discussion on how to solve that issue some time today.
Welcome to this session called stories from the Pacific, the human side of cyber incidents.  And this session was prepared in collaboration with a bunch of people who have been keeping the cyber capacity building discussions going in the region.  So I have here with me today our speaker Brenda and is in the case for all session preparations, you invite everybody to come to your session and then your speaker goes missing.  My speaker is missing.  If anybody knows where he is, please remind him he needs to be here.  But if he's not here we will have more discussions from the floor.
>> (Away from microphone).
>> CHERIE LAGAKALI:  Well, we'll get started.
So again this session was a collaboration between our friends.  We have people from APNIC.  We had the ‑‑ also we've got Bart Hogeveen from the ASPI.  We've also got Klee Aiken who's moderating on the chat and our director, this was organized and planned together with the GFCE Pacific hub and our director Saia Vaipuna was not able to make it here.  You know, we had a discussion in the cyber diplomacy session yesterday funding is an issue when it comes to who should be sitting at these events so if you were able to make it, you belong to that elite.  We want to keep these discussions going.  Let's keep talking to each other because we might not be able to solve everything one go but we take this information from here, learn how to apply it in the context of how does the Pacific and the topic today is the stories from the Pacific.  How can we take all these things that we've learned here in the last two days and take it back into our local communities in the Pacific and apply it over there.
Well, there's a problem about having sessions at 1:30 in the afternoon after everybody's had lunch and ready is to fall off to sleep.  So if you need to ring the bell to wake anybody up, please tell me if you fall asleep in my session please also remind me that I might be boring.  I am going to give this time over to Brenda who has a presentation and some intervention on what is happening in Tonga.  Recently there was an incident and Brenda over to you.

>> BRENDA:  Thank you, Cherie Lagakali.  To begin with, I would thank our heavenly father for making this event happen as well as guiding us from different distance to be here in person safe and secure.
Secondly, I would like to salute the organizers and sponsors for their effort and dedication that brought us together in this event.  Thank you so much to the global forum on cyber expertise for choosing and sponsoring me to be a part of this remarkable event.  It gives me great pleasure as a Pacific Islander to be here from a small island country.
[PAUSE]
>> Brenda.  And to share with you a story ‑‑
[PAUSE]
>> BRENDA:  From my country, the kingdom of Tonga on the given topic, the human side of cyber incidents.
Background information for those who don't know much about Tonga.  The kingdom is a small Archipelago in the South Pacific ocean located southeast of Fiji and 2000 kilometer northeast of Auckland, New Zealand and 3,280 kilometers east of Brisbane.
Tonga has 176 islands and 36 of them are inhabited with a total population of 100,179 in 2021 census.  Most of the Tongan population lives in the three major groups and nearly 3/4s live on Atapu island which is the main island.  The king doll is small and presence of technology has changed the way people communicate, work, and interact.  Whether it is through access to government services via Internet in the action via social media and technologies, receiving all when requested technology is being employed as an able to build and strength then services.  Therefore, the government of Tonga present the strategic framework for 2019 through 2024.  Strategy sets the direction for the government's use of information and communication technology with the ultimate intent to improve government decision making, business process and workflow efficiency improving the quality of timeliness of services for the people of Tonga while reducing the complexity and cost of government services.
Security of physical ICD infrastructure, protections of personal and privacy information and protections of national critical data are fundamental to all digital government strategic goals:  The digital government security requirements flows several security principles, including protection of confidential information and sharing the integrity of data and information and ensuring accessibility of information to those with a valid need and proper security authentications and authorization.  With the kingdom of Tonga, population is important to measure the amount of threats, cyber security or impact our people.  Due to isolations and limited resources, there is a need to build resilient towards these impacts.
About me, my name is Pelenita, also known as Brenda.  I am a civil servant for the government of Tonga for 19 years now.  Previously I worked as an assistant inspector for four years.  Then was promoted to senior cooperative assistant for nine years.  And assistant secretary for one year all in the ministry of trade and economic development.  I am currently work for Tonga's computer emergency response team that operates under the ministry of many names.  Ministry of meteorology, energy, information, disaster management, environment climate change and communication and CERT.  As the senior engagement officer leading our engagement in administration site for five years now.
Other experience and most of them are voluntary, in 2020 I was on a program to the interim Pacific fusion center in Canberra.  Supposed to be a three month but due to COVID‑19 I was locked down there for ten months before returning home.  I am currently an executive member of Tonga women in ICT.  Get safe online ambassador for Tonga as well as a Bahai faith study circle cluster coordinator as well as an assistant auxiliary board member for the western district.  For this presentation, we'll focus on the background information about CERT Tonga, ransomware attack in Tonga and the way forward.
Tonga's computer emergency response team was established and effective via cabinet decisions on July 15, 2016.  And as I mentioned before, CERT operates under the ministry.  We currently have three established staff members, two males and one female.  Remember these three staff members are looking after the cyber security issue and all cyber security related matters for the entire nation.  Other than that, recently we have one voluntary staff but she has now moved due to new opportunities and that is something we encourage students in some of our tertiary institutes in Tonga to know and think of CERT, Tonga is happy and available to offer them internship opportunity if they wish to develop their skills in cyber security.  We also have three additional staff that we will be recruiting soon under a project between CERT Tonga and the ministry of innovations and trade of New Zealand known as cyber security workforce development program.
This year we are blessed and lucky to have extra hands and assist our team from the media team that they previously in the information department because they are under the care and management of CERT Tonga director.
CERT Tonga worked towards the vision of safe and secure digital environment for the kingdom of Tonga and its citizens.  So it was a mission to coordinate and collaborate amongst stakeholder to prevent through public awareness detect and manage cyber threats in the kingdom of Tonga.  In the next slide there is a short video that provide more information about CERT Tonga so please bear with me.

>> Information and communication sectors in Tonga have developed significantly over the years.  But the vulnerabilities to ICT related incidents also increased.  Tonga have come a long way in developing its ICT sector to where it is today.  Since the rival of the fiber optic cable in 2013, Tonga's Internet penetration rate rose rapidly.  Despite this development, Tonga's vulnerability to incidents such as hacking, identity theft, fishing, virus and scams increased.  To reduce those vulnerabilities and criminalize the misuse of computers, mobile phones and Internet, government established Tonga national emergency response team to address and respond to computer incidents raise awareness and build in capacity of ICT personnel.  The prime minister staff of Tonga at the time, honorable Keela launched in July 2016 under the ministry of made deck with a vision to build a safe and secure digital environment for the kingdom of Tonga and its citizen.  Mission is to coordinate and collaborate amongst the stakeholders to prevent through public awareness detect and manage cyber threats in the kingdom of Tonga.
The roles of CERT Tonga include ‑‑

>> The operations of CERT Tonga is governed by cert board consist of may deck, Attorney General's Office, Tonga limited Tonga communications corporation.
[PAUSE]
>> Technology.

>> Information and communication sectors in Tonga have developed a significantly over the years but the vulnerabilities to ICT related incidents ‑‑ Tonga has come a long way in developing its sector until today.  Since the rival of a fiber optic cable in 2013, Tonga's Internet penetration rose rapidly.  Despite this development, Tonga's vulnerability to incidents such as hacking, identity theft, fishing, virus, and scams increased.  To reduce those vulnerabilities and criminalize the use of computers, mobile phones and Internet, the Tonga government established Tonga national computer emergency response team to address and respond to computer incidents, raise awareness, and build in capacity of ICT personnel.  The prime minister of Tonga at the time, Heela launched CERT Tonga in 2013 and the ministry of made deck with a vision to build a safe and secure digital environment for the kingdom of Tonga and its citizens.  Its mission is to coordinate and collaborate amongst the stakeholders to prevent through public awareness, detect and manage cyber threats in the kingdom of Tonga.  The roles of CERT Tonga include.

>> The operations of CERT Tonga is guided by CERT board, consists of made deck, Attorney General's Office, Tonga limited, Tonga communication corporation.
[PAUSE]
>> BRENDA:  Sorry about that.  Let's look at the ransomware attack in Tonga with a focus on how did CERT Tonga respond to the incident?  What are the existing mechanisms for this attack?  Who are the people we should go to?  And what are the challenges and lessons learned from the incident?
Our normal procedure, all incidents should be reported to us but most incidents of tech are not reported to us, mainly because their organization don't want to report it or be handled internally by the IT staff.  In February this year Matusa ran son wear critical ISP and reported to CERT Tonga within three days deadline from the attack until victim.  Any way, our limited resources, technical capacity and capability as well as the fact that this is our first time CERT Tonga has faced such an incident, CERT Tonga reach out to other CERT in the region for assistance with information and procedure and that is CERT since the ransomware attack that line was up and the advice was for them not to be the ransomware.
Lucky for the affected party, their services were not fully compromised.  However, the Tonga government request emergency summon assistant from the Australian government.  We have CERT Tonga meeting.  CERT Tonga was directed to lead the coordinations and collaborations of the first cyber security incident response teams to Tonga consist of teams from Australia, New Zealand and Tonga.  Cybercy attacks and the rest of the team from New Zealand and Australia were responsible for the investigation recovery and restorations of the affected parties services.  CERT New Zealand then focused on conducting training to ICD staff from government ministry public and private sectors as well as the affected parties staff and they also provide assistance advice as well as communications.  The digital transformation department operates with the prime ministers office were focused on consultations with government ministry to see what their knowledge of ransomware is like and what methods they will use to safeguard the systems in incidents like that as well to check on critical networks and they did this in collaboration with Tonga and this consultation session was before the rival of the Australian team.
One other existing mechanism for this ray tack, while yes attacks included in most of our session to ministry public and private sector.  We do have SOP in place but there was no SOP in place specifically for ransomware.  With assistant from cyber CX they would assist with providing additional to our current SOP.  With regards to ‑‑ yeah.  With regards to prevention method, we did and continue to reemphasize in awareness sessions some of the cyber security ‑‑ such as don't click on unknown e‑mail or link and do not open attach.  This able remote desktop protocol unless it is used VPN.  Update and patch software applications and use line news operating system.  Backup files using the 321 backup strategy.  Copy of data, store copy of two different types of media keep one file off site and one copy offline so as encourage them to close unused ports and scan USB tribes USB ‑‑ for response to the attack during the attack we'll record evidence and document shut down affected device and plug and detect from any other device so exchanging administration password in other important password.  For recovery we had to check backups and ensure it is not affected or compromised, ready for ‑‑ ready to restore informations.  Wiping and reformatting all affected tribes and device which is the best way to remove ransomware and so as restore your informations but remember we encourage to check backups and clean if it's clean and not compromised for the way forward we're planning of developing standard operating procedure for ransomware attack, revise and exercise it with training practice.  The second one is notifying and report.  It is a critical ‑‑ if it's a critical information network and hold sensitive information, part of the government supply chain you need to report the incident to regulators as we all know documentation is violate.  Documenting procedure step by step and mechanism in place so as disaster recovery plan and business recovery plan is important to do documentation.  The third one is to have information security policy and classification of handling of information is something that we look up to and that will be cover the information from data rest and transit and up to end of life data so is looking at having other standard guidelines documents and procedure to support that information's security policy not only that but to continue the awareness and encouraging people never to pay ransomware.  It is no guarantee that ‑‑ encourage them that there's no guarantee of file will be restored nor the woods that they will not publish your stolen data or sell it for use on other matters or criminal activities.  So it's important for them to make sure that they going to pay for that one for the ransomware.
Finishing the challenge of limited numbers of staff, a lack of technical capacity and capability and a lack of acumen or resources to handle cyber security incidents is always there but to combat cyber security incidents with magazine in place or limited resource, that is what sir Tonga is focusing on such as contacting more outreach programs for the public to facilitate more capacity building and the most important one is strengthening or engagement with our domestic original international partners of stakeholders because with that strong relationship, collaboration come in and that is what makes things easier for our involvement in handling the ransomware attack is through coordinations from the team from Australia, New Zealand and our local team.  I believe that we're due for an instant in the future.
To finish off this presentation with one of my favorite quotes, it says the stronger the advertise of fellowship and solidarity amongst men, the greater will be the power of constructiveness and accomplishment in all the plains of human activities.  So powerful is the light of unity that it can illumine the whole earth.
Thank you.
>> CHERIE LAGAKALI:  What a great presentation.  I don't always get to hear much about the incidents ‑‑ the incident had a has taken place and the details on that and Brenda, that was such an impressive presentation.  Thank you for the details.  I think a lot of us are going back home learning a whole lot more on this topic and that incident in Tonga.
But before we go into discussions I need to acknowledge Brenda you have been with CERT Tonga for five years, yes?  I mean, women and cyber pioneer here in the Pacific, come on, yes.  And you know, you've ‑‑ you know, this presentation it's just amazing.  You're part of the success stories that come out of the Pacific that we want to keep hearing more about.  So thank you for that great work.  Thank you for that presentation.
I want to go down to you mentioned one of the things that you found in the ‑‑ during the incident was the lack of SOPs for those who don't know SOPs, we like to use a lot of acronyms in these discussions, standard operating procedures and I think that a lot of times we find that when there is an incident we probably don't have a policy strategy or any operating procedure around that.  And I think that this is a classic example of we're going into these discussions because we're collecting stories from the Pacific to put into the best practice forum on cyber security and we're taking these incidents from the Pacific and, you know, we're talking about the Internet covenants.  First of all this is Brenda's first forum.  I hope this is not the last time we see you.  We want to see more you.  And we want to hear more stories coming out of Tonga.
>> BRENDA:  Thank you.

>> CHERIE LAGAKALI:  Want to take these stories and put them into the best practice forum on cyber security which you will be hearing more about it in Kiyoto Japan in October.  The essence theme for this Internet Governance Forum is Asia Pacific ready for the next phase of the Internet?  And we've discussed from a process perspective from a connectivity and development perspective, what about from an individual perspective?  How many of us here actually have an idea of what you going to do if your laptop gets hacked with ransomware?  Anybody?
>> (Away from microphone).

>> CHERIE LAGAKALI:  Brenda, I had a question and I know I promised I would not ask you plenty questions.  It's just one question.  And it's really around, what we want to know is that we know that ‑‑ you talked about we're collecting this information to put into the working group that's collecting stories on ransomware attacks and we're looking at the impact and we know that there was a big impact.  What was the impact of that to the users?  Was there ‑‑ you know, you mentioned ‑‑ I think you mentioned earlier that the community was surprised with the attack.  And I think that's always the case.  We always think that oh we're safe until something happens.  But when something happens we actually surprise that it actually did happen, yeah?  So Brenda, did you have anything to say about that in particular?
>> BRENDA:  Thank you, Cherie Lagakali.  I think the case back at home, the most people or community when this happened are the IT people.  Mainly because they understand the situations and they know what is happening out there but I think if what happened was affecting the user or the customers of that organization, that will be a huge impact to the public or to the rest of Tonga, but as I know for what happened, it's mainly the IT people that they got shock.  I think they probably don't really get what is happening because they are not ‑‑ they were not really affect so, yeah.

>> CHERIE LAGAKALI:  Thank you Brenda.  I wanted to acknowledge my online moderator Klee Aiken.  Klee Aiken, did you have any questions coming up from the chat on Brenda's presentation in particular?

>> KLEE AIKEN:  Say nothing at the moment, no.

>> CHERIE LAGAKALI:  We'll go back to the room.
Hello, please introduce your yourself.  The mic is right over there.

>> Hey there.
That was a lovely presentation.  It's good to hear what CERT Tonga is up to and your community work and what you're doing.
I have a few questions.  Not just one.  I have a few.  Sorry, my name is Joebins.  I'm from Samoa.
So I'll just shoot it out.  So first question was how easy was it to reach out to the other CERTs?  Did you find any challenges reaching out to the other certs?  The other question is do you have any –

>> One question at a time.

>> Okay.  Sorry.

>> BRENDA:  It was not hard because we were planning of having a meeting ahead of what happened.  So once the attack happened, it was the only organization that comes to the teams is to reach out to the CERT Tonga because they will be the first team getting to Tonga even they were planning on something else but –

>> Thank you.  You mentioned something about the limited capacity of CERT Tonga technical as well.  Do you have any experts on island in the private sector?

>> My question is two way, do you think reaching out to your own local people they had the capacity to help CERT Tonga, is that something that you might think of using in the future?

>> BRENDA:  Yes, that is something we are looking to do in the future is to revive Tonga cyber security community.  We established that before but I think most of the people involved are busy with their other priorities but what happens it's really encouraging us to revive the community because we believe that we'll be where we go to if something happened again in the future is to use our local expertise.

>> Thank you.  I think that's all my questions.

>> BRENDA:  Thank you.

>> Thank you.
Next?

>> Audience:  (Away from microphone).  I was thinking about your comment the Tongan don't necessarily see this as an issue for them and one of the things we have been having in Australia particularly in the last few weeks is lots of media stories about people loseing their life savings through fishing, et cetera.  And I think possibly because some of the AI has now gone into the fishing, it's actually getting harder and harder for people to know what it is.  So I just wonder how that would translate into a Tongan arrangement now that you've got these stories that are about to happen for you.

>> And not to put on spot there but other country representatives who might be able to put this question in the form of your country, we're probably not ready and yes we might have a situation where we will end up having these sort of issues in the Pacific and the communities, the people, the end users are not ready for it but Brenda, did you want to answer that or should I put it back to the floor?

>> BRENDA:  I'll put it back to the floor.  I'll be the same as you.  We're not ready.

>> That was a great question.  Joe Benzi again.  My background is in cyber security.  We do a lot of cyber security work in Samoa.  I have here on my right is principle officer of Samoa CERT.  We work closely with the governments that's why I asked if you have any experts in the private sector that you can reach out to assist you guys.  So we work in collaboration with the government of Samoa.  So we're the dark side as people say, we're in the private sector but to answer your question I think a lot of what we're doing right now to combat AI through spams and fishing attacks is awareness.  We're doing a lot of capacity building.  Our companies work with private organization and building capacity of the users.  I guess that's the main target that we're trying to get to is so that the user's aware of what a fishing attack is, what it looks like to have them know that it can be in Samoa as well not just English, not just broken English but also in Samoan language.

>> CHERIE LAGAKALI:  Thank you Joe.
Finoti you had something to add.

>> We just had our roadshow which is the first community awareness which is want to see the label of no knowledge and skills in terms of cyber security but actually what the people need is the computer skills, literature how to do the settings of those simple cyber security.  So if we believe that if we build the capacity with those basic skills, then for the time that this AI will implement in Pacific Island, then they will basically adopt those advanced technologies.  So but for now better working on to build their capacity in especially the grass roots level.  As Jobins mentioned the Samoa CERT because of what happened in Tonga that is a wake‑up call for Samoa before ‑‑ so now we start the training ‑‑ the capacity building for all the IT officials and government, including the private sector in terms of technical training, the incident response just to ensure that because we don't have resources reducing cyber attacks is our priority to reduce the impact and the cost, the resources so now we're working together with the private sector, train them in case cyber attacks happen in Samoa at least we can call them for help if we don't have the capacity we can also reach out to the collaboration ACSE for help but we ensure that we work with the private sector first ‑‑ so currently we're doing training for the IT officials for cyber security with the help of A ‑‑ cert New Zealand and capacity of our grass roots level people too with those basic community basic cyber security skills.
Thank you.

>> CHERIE LAGAKALI:  Thank you, Finoti.  I see a question at the back but I thought I'd bring a friend back on to the spotlight a little bit.  I am reminded there was an incident in 2021 in Samoa, Jobens, is that something you would be able to talk about?
>> Yeah, the incident?  2021, it's only seven computers affected and that ministry is not a critical infrastructure.  So it's also lesson learned for us so now we work with the risk assessment and also we identify our critical infrastructure.  So we so thankful that the incident in 2021 it's only seven computer affected and it's also ransomware.  So by that time it was handled within the FCIT and the ‑‑ also with the help from the ‑‑ under the contract at that time.  So the impact is not really that big and also that was a lesson learned for us for our to prepare the IT government.  And the ‑‑ it's shame like you know because it's very simple.  It was just the antivirus.  So that's why we believe building the capacity of our IT officials it's very important and we also identify critical infrastructure at the moment is one of the things that we can highly consider now.  So incident?  2021 it's because of the antivirus connecting to the computer network and handled by the administration at that time and also the ministry and the incident was happened.
Thank you.

>> Thank you for that.  I think we had a hand up at the back.

>> Dave from APNIC.
I much like many of my colleagues do a lot of training in the Pacific and one of the things I've noticed is that especially within government departments there's a fairly hierarchical structure and what tends to happen based on feedback from my workshop participants is you'll have someone at the top ask for something or access to something.  And through that access a breach occurs now these people responsible for handing out access to resources don't feel empowered to say no or why do you want this?  What can be done to try and sort of change that mind‑set I guess within ‑‑ which has probably been through culture through years into a cyber security mind‑set of ask the question first why do you need the access and I guess that can be from anybody from the islands if they want to talk about this because it affects everybody.

>> Do we have anybody from the islands that want to talk about that?  Soren, yeah.

>> Good afternoon, my name is Soren from Fiji.  I am an academic from Fiji international university and one of the cool things I train and teach on is ISA ‑‑ my team does consultancies on SOPs and policymaking for ICD generally.  Further to that we are also custodians to ISOs in Fiji.  Massive configurations from all of the Pacific Islanders and as a woman I am extremely proud of that.  Having said that I think Tonga has already sent the benchmark and then many Pacific islands, and I'm going to name my own that we really ‑‑ there's so much that we have to learn from you and also from Samoa and Vanuatu.  Personally in my experience to answer that question, what I have realized is that in organizations there are still lack of ICT policies, data policy information.  I mean, actually amazed and surprised at how many huge organizations still don't have an information policy.  There are gaps in the privacy act and in the information act.  There's a very thin line of difference but in both however really gray areas.  I think there this is a problem that needs a holistic approach because the legislation needs to be fixed as well and people need to be part of the legislation making process.  For example, the cyber crimes act, being finalized whatever contributions we had, we saw it in the 2000 ‑‑ people need to be part that have multistakeholder process that we advocate for.  It's everybody.  Just this morning we had a conversation involving youths involving this conversation.  Because ICT affects everyone, everyone is a gadget user we need to be part of the conversation but in organizations going back to the question organizations if we have a policy no one is above the policy.  Be the CEO or anybody for that matter.  We need to start strengthening our organization policies and if there are gaps what we do is train organizations who then train every staff member who is going to be using the digital spaces provided by that organization what the consequences are.  This is how long you can get jail for, actors all that combination.  So happy to speak on this later and I don't want to take up all the time.
Thank you.

>> Thank you Soren.  Thank you Dave for that question.
Realistically in the situation of Fiji, I can identify with the hierarchy.  We have an all boys network that is really strong and because of the different levels of government that these because you're an old schooler from somewhere, nobody's going to question you on why you need it.  It's because you asked for it.  Whether it's the formal or informal channel something will get across to you in some way.  Did you have a follow‑up question?

>> It's not necessarily about the policy.  You can have all the policy in place but if somebody is, you know, I'm going to say a C level within a department or a business and in talking to somebody who is entry level two systems engineer and that C level says I need access, they don't feel policy or no policy and I mean this is the reality whether this is a policy or not they don't feel they have the right to say no.  It's a culture thing that I have seen everywhere.

>> Yes, it is a culture thing and we're probably not going to be able to have work around and it's probably going to stay around for a long time as well.  Thank you for that comment and observation and thank you Soren also on that information regarding policies.  It is true.  A lot of organizations don't have policies in place.
I see somebody weaving but ‑‑

>> I've got the mic.  I would like to add on what Dave was saying.  I think we need to change the culture of how you deal with executive middle level management and their lower staff management because I feel what you ‑‑ I know what you're saying because if this comes down to me and say give me that information, you know, we don't feel the policy.  The approximately's there we should advocate at the higher level, we should provide awareness and encourage them to follow the policy because if we keep on doing that this culture will go on and on with and we won't solve anything in terms of cyber security.

>> Thank you and also as Soren said we need these policies we need discussions around who and what and how and what level of information can or cannot and if it is breached then we go back to what are the procedures in place.
Dizzy other the hand up or did somebody just ‑‑ we have about 11 minutes left for this session.  Klee Aiken, do we have anything online?  And I think Klee Aiken maybe everybody wants to hear your voice so maybe we would have an intervention from you while we're waiting.

>> KLEE AIKEN:  Hey, everybody.  No comments in the moment in the online chat.  Thank you guys everyone for your interventions and presentations so far.  I guess I have a bit of a question for folks in the room.  We talked a bit about a few incidents.  So the one in Samoa, Tonga and kind of looked at it as ‑‑ from an incident perspective from a technical perspective and a response perspective but I was wondering if anyone had any thoughts on the kind of human impact of these incidents, whether services were impacted and how that flow on effect impacted the wider public and how we can shape up Pacific specific policies to really incorporate that view of the human elements into response for these sorts of incidents because unfortunately it's becoming increasingly common to have these ransomware impacts impacted and focusing on government.

>> Jobens, I also request that you please turn the best practice forum on cyber security for the Internet governance so we can have all these stories there as well please.

>> It's okay, Cherie Lagakali.
[LAUGHTER]

>> So thanks, Klee Aiken.  Hope you're doing well.  That's a good question.  Going back to the incident that happened in Samoa in 2021 I guess I wanted to touch about the aftereffects of what happened.  During that time we had an election on and it was a change of government and then the ransomware happened.  So when the new government came in they were saying, oh, they got in and deleted all the files.  The aftereffects of the ransomware took its own pathway and got into the news and the news media turned it all around and said, yeah, the old government went in and depleted files because of the new government coming in.  I guess I wanted to point that out because it was a lesson learned for us as incident responders and also of the cert team is start to look at the PR side of things.  It's not just technical.  So what happened there is that we didn't jump in front of the media before the news broke out and it spun into a lot of aftereffects of the actual incident.  So it is not technical anymore but it's just trying to cover the tracks and all of that after stuff.
Thank you.

>> Klee, I think all of us learned after that incident is the establishment of the cert because the cert was just established last year 2022 just after that incident.  So I guess that's the ‑‑ one of the lesson learned from that one is just for them to approve the establishment of the Sam cert.  Thank you.

>> I think I wanted to add an example of because we had an incident in Fiji in 2020 and it was right in the middle of the vaccination process and so we had a lot of people getting sick and a lot of people dying from COVID and then a lot of people lining up to go get the ‑‑ get vaccinated but you had to register online and that system went down and it was chaotic because the people from the ministry are sitting there in the tenants for the vaccination and sitting with their tablets and it's just spinning and the lines are getting longer and people are getting more frustrated.  As a result of that three years later we still don't have a cert but there are discussions around incident reports for critical infrastructure and those discussions are still going.  It would be nice to have more people contributeing to these discussions I think as Soren had pointed out earlier.  It's in places like this where we have these stories and take them back home and put them in the context of how can we progress as a Pacific Island nation and be ready because the Internet it's already here.  It's probably in every Pacific Island country, you know, the awareness and the training came a little later but it's not going away where there was an awareness campaign a few weeks ago and the villages asked the team doing the campaign please take away the Internet.  That's not possible.  It's not going to go away but we have to learn how to live with it and keep our families safe.  Do we have ‑‑ I think we have in six minutes, do we have a question or intervention?  Three, okay.  We'll start with back there and then Sarah and Gina and then we'll call it a day.  Yeah.

>> Thank you very much.  I'm just curious about, there was a group from (Away from microphone) university and I think they were called cyber security center but ‑‑ I'm not sure whether you're aware about what they do or your work with them.

>> Yes, cyber security center is operational in Melbourne.  We have a relationship with them from the cyber community here in the Pacific.  We have discussions I think a few of them are members of the working group on the GFCE for incidents response and also on this working group for best practice forum.  Again, it's when we have these stories come out then we can have more discussions around how do we progress together as a region and so the networks are there.  It's just exchange of information and how do we apply it in the context of the Pacific.  Thank you very much for raising that though.
Was it Sarah, yeah.

>> Thank you and your team for this lovely discussion.  I just want to add with the Pacific ‑‑ this is from the Samoa perspective from the national university of Samoa, any way, I'm Sarai from university of Samoa and I think with this issue of cyber security and having start in nationally and regionally is very important but to mitigate what's within your organization I think it's better to have risk assessment first internally before we reach out.  This is an example from the national university there and this is the first time we contact risk assessment, things we don't see that affect those little thing it's impacted a lot.  So for example because we keep the student information and we don't care much about it.  Since we have the risk assessment and then we see we will fit the reputation of students if we don't keep that data right, if we don't protect, save it if we don't follow the OSI level and security levels and all those stuff.  So for my experience within university or academia environment it's very important to have risk assessment first and then we consider other levels.  When this type of cyber attacks attacking our environment or our neighbor, it has a little chance as least we do our work internally first before we reach out.  It's good to have partnerships to explore more but within your organization, everything starts from home, I like the position we have with Rath, sustainability, everything starts from home.  Why you changing your phone if you still can use it, your phone from six years ago, it can manage, you can do your work.  Why are you trying to upgrade it to something?  But everything is there.  Why you solving a problem where there's no problem?  So that's my point of looking at this, yes, we live off the Internet, we evolve with it but you need to be careful and you need to have this digital how to read it and how to adopt it.  And that's the big issue is the adoption of the technology.  So my two cents, have the risk assessment and then look and explore more.
Thank you.

>> Thank you.  I think with risk assessment we need more community champions like Sarai and Joebens going up to decision makers and saying we thought about a risk assessment, can we consider doing a risk assessment.
Gina, you had your hand up?  And I'd like to hear more about that risk assessment.  I'll be coming to you soon.

>> Just from the Fiji perspective working across two sectors, very different banking and health.  Banking takes a lot of security is paramount especially when it comes to money.  Technology in terms of framework they use ISO27001 but when I moved across to the health sector in government just to help out with the work that I do, the critical infrastructure component for health was really not at part with what we see in the banking sector and mainly because there's not enough awareness or ‑‑ not enough resource mobilization in that area.  So one of the two things that had happened in the health sector was the cyber security incidents that occurred for whole of government and it was the road to recovery or response time back to et going the data, patient's data back online and being able to service the health sector component.  So that's a perspective that I think we need to continuously in the cyber security arena really focus as well on the recovery of data, critical data, that critical infrastructure to ensure the country is able to service things, the response time of recovery to ensure that the patient's data is highly secured.  That's a perspective that I think we also need to in our literacy also encourage and ensure that organizations are also doing their data backups, data response times to incidents so that we can also have continuously giving service delivery.  Those are just the two differences that I see and two very different sectors but very relevant I think in terms of from the Fiji's recovery to getting that data back online and so with that thank you.

>> CHERIE LAGAKALI:  Thank you and I'll be putting on my hat to say can you please tell the best service ‑‑ I can see that the red lights have gone off over here.  I just wanted to ‑‑ from my online moderator just make the announcement there is a first symposium happening in Vanuatu in a couple week's time.  We're hoping to have more discusses on this.  You can find me online somewhere if you want to add anymore stories to this discussion.  We need your stories because we want to take these specific stories and put them up on the global platforms and have more discussions so that we can progress as a region.
Thank you very much, Brenda, to are that amazing presentation.  Let's give it up for Brenda.
[APPLAUSE]

>> Thank you everybody else to the room who has contributed.  We may be collating all of this and come back to validity checking and verification and thank you also to my online moderator who I think he's probably gone to do something.  Thank you again everybody.  Thanks, bye.

>> Some brief housekeeping notes please bring also your discussion and thoughts to the APrIGF document discussion comment.API.Asia or come back to the town hall session later this afternoon here.

 This text, document, or file is based on live transcription.  Communication Access Realtime Translation (CART), captioning, and/or live transcription are provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.  This text, document, or file is not to be distributed or used in any way that may violate copyright law.