And so ladies and gentlemen welcome to straight talk now it is nice to be home When Greg gave me the call and he said would you host it this year? And he said we've got three. He said I think I can get these three gentlemen together And he said come on early April the weather will be wonderful So thank you for that Greg at least you got half of it right now I was of course here last year, but my role has changed this year. It's like going from the hunted to the hunter and We should have we want this to be a very informal evening Now all of us will remember Former Prime Minister of Robert Muldoon's famous quip that when the New Zealander moved to Australia He raises the average IQ of both countries But of course he was only half right in this case as we've loaned out some of our greatest talent And all three men as Jane said have graduated from this fine institution now 30 they and by the way they graduated from this institution within six years of each other So within a short period there now 30 years later It probably dates you a little bit gentlemen They are now running three of the four largest banks in Australia responsible between them for assets Over I think the numbers are right over three trillion New Zealand dollars. It's over 10 times New Zealand's GDP a Coincidence I think not So I want to welcome these three men New Zealanders well sort of two New Zealanders One sort of honorary Kiwi, but we'll claim them just like we did farlap and And we'll get back to that in a minute. And now I know you've all read their bios impressive bios Three impressive CEOs leading huge organizations. So let me introduce them now I'm going to tell you a few things that aren't in their bios So Andrew beside me Andrew Thorburn group CEO of National Australia Bank born in Melbourne But he spent the next 20 years making up for that when he was here and Then one Twitter feed and I quote. He was called just as Kiwi as the Pavlova He's a man who believes in keeping fit is quite an accomplished What do you call it drummers drum drum guy it bashes the drum kit in his garage and he's clearly had a significant impact on National Australia Bank Ian Revb CEOs beside him CEO of Commonwealth Bank famous to every one of a certain generation as Davey from the 1979 TV series children of fire mountain He moved from axi acting to management consultancy to actually doing some real work in banking Clearly winning open your bosses at Commonwealth Bank. Thanks to his combination. So it says of intellect and empathy You can be the judge of that tonight Beside Ian Shane Elliot CEO of FZ Now according to bank insiders Shane's father did not believe in borrowing money So a career in banking was the obvious way to go He he was Citibank's youngest ever country head in Egypt and Understand he's a vegetarian. I don't know whether those two things are related perhaps perhaps they are so gentlemen welcome and thank you for giving up your time and Thank you to the team here for a particularly a mole for putting this all together and this Really is a unique occasion. I was talking to this gentleman before and I think it was Ian said to me He just probably this is the only place you could get these three together and that's in New Zealand And I think that's a credit both to the business school here in the university But also said something about what New Zealand does to to pull us all back now this is straight talk so we're going to cover all the big issues and Just to add to that To I guess that pressure. We've got a couple of the parents sitting here as well So that will add a bit to the pressure and I'm going to open up later on to questions from the audience and The only rules are you can ask whatever question you wish Which is why it is called? Straight talk So let's get started gentlemen now. They sort of don't know what I'm going to say here sometimes I don't either But just to get into the mood. We're going to start with I'll call it a quick fire round Just to warm us up a little bit and these gentlemen don't know what it is. So Andy let's start with you Potential conflict of interest Do you prefer? Lugby or Aussie rules always taking way too long This is quick Okay, Ian, I'm pinfolds range of cloudy Bay. Oh See You're not doing well. What's cloudy Bay? I'll go the baby. Okay, a bond I beat your Mount Manganui. I'm not gonna be Jim with a pub pub Suits or jeans jeans I paddle pen and paper. Here's a tougher one for you Bill English or Malcolm Turnbull Okay, got it bill the bill And and the one the the question that anyone can ask the first one on the buzzer and this was honestly a question That was asked to Donald truly asked to Donald Trump's nominee to the Supreme Court During his Senate confirmation hearings in the Senate confirmation hearings And I could do not would you rather fight a hundred duck-sized horses or one horse-sized duck? The horse-sized duck yeah, you gotta go to the horse-sized duck to the ducks ever Okay, so again under we're going to we're going to do things tonight in a few things we're going to start With these gentlemen's thoughts on leadership and as I said all three of you are alumni of this fine establishment I think we actually have some photos somewhere Magnificent And so gentlemen, I know I bet it only seems like yesterday But but I'd like you to cast your mind back to those distant days. It's over 30 years ago So Shane, let's start with you any standout memories of this place that particularly Auckland Union here in Auckland that impacted your leadership today and and I guess with Kiwis Overrepresented leading big business particularly financial businesses and not just to in Australia, but around the world What it is? What is it about this country? Let's start with sort of nice nationalist question here for our audience What is about this country that propels people? Well, the first thing you notice coming back is that it shrunk actually and It feels a lot smaller than it was when I was here at University But I think actually I was lucky. I was here at a time Well, it's hard to say was lucky was here at a time when Maldine was Prime Minister and studying economics and business at the time When we had a price and wages freeze that was interesting, you know thinking through those kind of issues But actually the reality was went out into the workforce right at this amazing time when there was this huge liberalization of the New Zealand economy And you know to be a very very small part in a witness and and to see all of that was really just an amazing opportunity And I think the great thing about New Zealand Was the size and scale of where you were working was small enough that you could see it all and we're going through this huge Transformation and you know you just learn a lot when you're on the ground going through change and that to me was what really set me up for You know my future What about you in I mean you spend a long time in this place. What's it you are? I don't know where the shadows is still around at the end of this day But some of the great existential conversations of the world took place there as far as I can see Actually one one memory I've got of the University which came back to me today and Vaughan and I were talking about it a bit earlier I took this course and I think it was 18 100 or 18 101 English literature And it was jointly taught by Roger Horrocks Don Smith and Sebastian Black and they were Sensational passionate teachers Really and I've had the benefit of studying in a couple of years overseas and the quality of some of the teaching of the caliber of those individuals they really broadened the mind and To sort of combine that with The question of what's unique about New Zealand a lot of people talk about the can-do attitude Etc, which I think every country talks about to some degree But what I do think New Zealand's got quite uniquely is there's a complete absence of pretension in this country And I think for leaders in organizations today. That's a pretty good trait to have Because the days of leaders being able to see themselves as sort of great people that others respect just because the leaders etc Are if they're not long gone, they are not long for this world and to that extent I think that the sort of the New Zealand psyche and the New Zealand culture is actually quite conducive to good leadership And Andrew, do you think there's a lack of pretension in Australia? I mean firstly and and I mean all you three gentlemen were CEOs and big jobs really young Now I read some research last week that suggested that a lot of Really good CEOs had big jobs in their 30s. Do you agree with that? So I think on the first part of your question, I think I wouldn't describe Australians as Pretentious, but I think there's been a degree or you know, it's 25 years without the recession And I think that's bred a degree of entitlement and a degree of complacency, which is dangerous today there's no doubt about that in my mind and I think to the point of CEOs in the 30s, I would agree that I think You need stretch You need to be stretched and you need to get Brett. I think to be a CEO So one of the reasons I think in New Zealand Particularly in the banking sector there, you know We have actually standalone banks and if you can come through those banks You get to see at close quarters how a whole bank works, which is when you're in a big bank in Australia It's much harder to see that you see your bit whereas in New Zealand You get to see the whole and learn from people who lead the whole Ralph Norris is here tonight I think one of my most significant mentors and influences on that very point And you get to see it all and I think you get stretch assignments and you get Brett as a result of that But I don't know whether you need to be a CEO in your 30s, but I think those other two points actually do help you See what's possible and fuel your ambition and fill your skills to be able to do it If you ever get the privilege to run an organization in you you did management consultancy before you went into you know the banking world and You got your first jobs and if you look back now, what do you wish?  I mean, you know the interesting thing and this is not unique to leaders But it's certainly relevant to leadership context The quality of decisions you would make every day on your in early in the job If you knew what you knew later just changes exponentially and I guess the moment that isn't true that you get kicked out But interestingly, you know, I think the the challenge for many people and I started in law and then went to consulting and then to To the bank and like Andrew one thing we have in common Ralph and I was lucky to work very closely with Ralph when I made the transition But the transition from thinking interesting good big ideas to actually Seeing them through is nine day And if you manage to do both successfully, that's a great combination But one does not Guarantee success for the other and in many cases they don't go well together So as what I guess I wish I'd known back then was if I knew what I knew now how to get stuff done I think the some of the strategic thing I've done earlier would be a lot Stronger, what about the role of consultants do they know how to get stuff done? Well, interestingly one of the reasons that I ended up in the Commonwealth Bank is because I was consulting the Commonwealth Bank and A very esteemed banker who will remain nameless who's in the third row Said to me well, if you love working for the Commonwealth Bank The any choice you've got is coming here because I'm not paying a dollar to you as a consultant That was sort of the environment at the time Look, I had I had a terrific ten years at McKinsey. I think it's one of the world's most extraordinary firms I do think though that knowing when to benefit from the really strong problem-solving the global reach and those really unique skill sets which is a small subset at the time for big stuff Versus not using them as an excuse to let your people stop doing their job That's the magic of knowing how to use consultants. Well, and it looks like Ralph Norris, of course gets the mentor of the year We introduce you Another one of the same team of course was Ross McCurand is now the CEO of all Bank of Scotland Is a friend of mine in the UK? Now Shan, I want to bring you back in because these two gentlemen spoke about mentors and the importance of that Did you have the same sort of experience with mentors and coaches? Yeah, I had a very different part. So I was very I by total accident I ended up working in an American Bank city bank at a time when its culture was all about You know just hiring good people giving them a chance a real meritocracy and that was my experience I went there for 20 years and 18 of those 20 years was a great experience and they lived up to their promise And if you did a good job, they would give you more and they just had a great attitude towards people along the way I mean I work for some great people and you know the people that I work for people like Mike Hawker who you know and and others and and I the advice I give a lot of a people in A and Z and I Didn't want to sit here is like ensure that you choose great bosses Ensure that you work for great people is one of the most important things you can do in your career And you know great bosses because they're the ones that will nurture you and look after you and push you and test you And stretch you and actually let you go at the right time as well and move on So I think it's it's in a critical part of all the people that I see and that I admire and I see around Organizations that have done well all of them can point to those one or two Bosses in their career that really pushed them off into the right direction and took a chance on them and in city bank obviously had an amazing legacy and It's a small world Mark Hawker is actually on my board in the UK So but what went wrong in city then? Great training ground It is great shame was it was one of the you know great I think one of the great organizations not you know a global organization You know when you work there you inherently knew this was a global company in a mirror talk is in all those good things What went wrong is you know we did a merger and we thought we were infallible and we tried to Merge together a different you know an investment banking culture and a commercial banking culture and you know There wasn't a whole lot of thought given about how that was all going to work out So it was in the kind of times pre financial crisis when you know There was a lot of deregulation and it was really about the cultural clash though I think the lack of clarity about what we were about What was it what what our what our culture was what we believed in as a company? It wasn't clear anymore. That's part of the reason I left It wasn't that same place that believed in people and You know the UK seems to have invented all the sports that everyone else Excelsior soccer for the Brazilians cricket for the Australians rugby for us now the other sport that they've got to a fine art in the UK as the art of bank bashing and the Australians seem to have perfected that sport and Recently, I know the three of you were front of a parliamentary committee being grilled and there was calls for a law commission and There seems to be is this part of a wider trend of declining trust and institutions and business leaders and What do you think about it? And what are you doing about it? Well, I think There's no doubt because of the 24-hour new cycle That things can get overblown and run that don't deserve really on merit to be so But around the world our people have been impacted by Banks that have collapsed through bad management and bad decisions in what are essentially, you know, leveraged institutions So I think banking as a profession and a craft needs to absolutely be respected and you see when banks get it wrong particularly in North America and the UK You know the impact on society on Taxpayers to actually address that and how long it takes we talked about Ross Bacu and Ross is doing a great job there But you know, he's still got years to go probably to address that and that happened in 08 So that's my first point the second point is that underneath it. I think there is a view particularly I think in Australia and the US and Brexit drove The same issue that people feel left out. Don't understand. It's all moving too fast Some are some are seem to be doing well and I can't yet afford to buy my own house and how will I ever be able to do that? I think there's that and banks become big business go-kart and how will they ever be able to do that? I think there's that. And banks become, big business, government become targets for that disappointment and anger. So I think that's part of where it's fuelled from, including the banks have made a mess in some senses. However, let's come to Australia because the facts don't support that the Australian banking system overall isn't doing a great job because if you look at the way it went through the GFC, the lending that continued to households and businesses to keep the economy growing, that's been part of the reason why Australia's had extended growth. It has continued to be profitable and it's not called on government bailout. It was assisted in some part, which the banks paid for, during the post the GFC. It's continued to be profitable and 80% of the bank's profits get paid back to shareholders, most of them are Australians, directly or in super funds. And before the bank makes a profit, we probably between us employ nearly over 100,000 people, clearly. People get paid fortnightly and it works. And generally the service levels, sorry guys, I'll give you a shot in a minute, but the service levels have been excellent. If you look at the digitisation of Australian banking and what's possible and the transfer of money and the ability to get loans and with brokers in the market, the service levels have continued to go up and the profitable cost to income ratios are excellent. So overall, I think the Australian banking sector is in very good strength. Now, I think all of us would agree there are some bits that we're not proud of that are largely in the past and have been acknowledged, owned up to and are being addressed. And so that, you know, we could go on about that and maybe Ian and Shane will. But my view, Mark, is there's some of the reasons, but actually overall the Australian banking system, the fact support is well-run, well-governed, and actually it's standing very well in very difficult times. And that's really important for what the future is likely to hold. So I agree with all of that, 100%. I think that's fair to say our industry, like a lot of other big businesses, lost touch with the community in terms of the way that we spoke about our businesses. We took a lot of those things for granted that people would understand that, that people would understand the role of banks, that people would understand that, you know, who the shareholders and we pay the divin and all that stuff and what we do for society and how we allow people to start businesses, own homes, safety, superannuation, whatever. But actually we shouldn't have taken that for granted and people forgot. And we didn't do a very good job. And we got caught up in talking about returns on equity and profits and all these ratios. They just go over people's head. And we can do a better job of just talking more simply about what we do. Because that's what we do. We actually allow people to buy that first home. We allow people to save for their retirement. We allow people to start and run and grow businesses that employ other people. You know, we're kind of the oil and the machine. And I think we can all do a better job of just talking more plainly to the community at large and reminding people what our role is. And we were talking before and you said you didn't see the same sort of bank bashing or big business bashing in New Zealand and it was a different sort of psyche. Why is that? Well, I think the banks here are great banks. I'd like to say it's just the ASB. And it is. No, seriously. You've got my staff here tonight, haven't you? And I say that about the Australians. So I really think the New Zealand banking system is extremely well served. And I also think at the moment, and this sort of goes to the point Andrew was talking about before, I'm not in the school and I know Shane and Andrew aren't either. None of us are in the sort of blame the political environment. It's just we're sick of people doing that and it just sort of completely avoids the point. What I will say is that, and it may not feel like it in New Zealand at times, but we see this from the outside, the nature of policy debate in this country is so constructive relative to just about anywhere else in the Western world. And therefore, and this sort of comes to Shane's point, the role that business and the banks play in the policy environment is just well understood and well led. And to sort of tie that together, I think there are two points of view that I've got on this which build a bit on what Andrew and Shane have said. Number one, which is the bit that's in our camp, and this is something I've really learned in my time in the job, which is we've got record levels of customer satisfaction across the banking industry in Australia and we are proud of it, we should be proud of it. But the thing that I've learned is that if we've got 10 million customers, as we roughly have at the Commonwealth Bank, and 0.1% of those are having a bad experience, that's 10,000 people, and they're having a bad experience with their money. So if I said we've got 99.9% satisfied customers out of 10 million, most people would go, that's great. We do need to pay a bit more attention now to whatever the number is because I think all of us would say we probably haven't done enough on that. But part B is we've also got to be prepared to just stand up and say at certain times the debate is fact free and it's cynical and it's poor. And if we're not willing, at the same time as we say, there's stuff we have done and we have to fix and we're going to, but we've also got to be prepared to call out other institutions in our economy that are letting down their constituents and there are a few. And I would add, I think one of the sectors that we're all facing into to say that we need to do more work with is small business. Because the housing market is well developed and there's a lot of competition and the corporate and institutional market bit the same. But this small business piece, which is the fuel of growth in most economies, they don't have time, there's difficult contracts, there's legal issues, there's complicated words to change the point, not plain English. So I think that's the sector we're sort of saying, we need to do more work here to lift our game and rebuild some trust and our reputation with that sector. Can I, I'm just slightly related topic then about the role of banking institutions going forward. We're seeing with the global digitization happening, you're seeing for example, if you have a look in action in China, the biggest payment systems now aren't banks. I mean, 10 cent, the largest tech firm in China. Over China's new year, did 46 billion individual payments on their own platform.  You've got Alibaba as well, I guess which they see themselves now as competitive, how do you cope with that? Well, I mean, I don't know that there's anything terribly new in that. I mean, our organizations have been around for a couple of hundred years and right through that period things have changed and the business models have changed and new people come along and threaten and take away parts of our business and that's just normal evolution of business. Actually, the reality is it keeps us on our toes and it pushes us to be better and smarter and we think harder about what we've got to do.  That is that kind of creative destruction that happens and our business models will change. I personally think the idea of complete ownership of the entire kind of value chain with them banks is not the way forward and I think it's gonna be more about partnerships, et cetera. A lot of those, these competitors who come in with new payment system run off our rails that we've built and that's fine and we have to figure out ways to accommodate that and shift and change over time. Yeah, I agree. I think the mindset of people inside our banks today needs to be a mindset of focused on the market and focused on clients and competing well and thinking much more broadly and globally about who our competitors are because obviously there's ones we know well and ones we can't see that are in the shadows and are getting significant venture capital funding and have a completely different mindset and I was reminded of this last year when I was in San Francisco and I was walking back to my hotel after a day with investors. I was crawling along the road. And I went past all the big banks. I was like seven or eight o'clock at night, all the big banks lights off and I got to a building that I've been in earlier today that had quite a few VC firms, lights still on, right? Hungry, wanna beat us, right? So our mindset, first of all, has to be completely different. All our people that we have to think much more expansively and think of our new competitors in a really different way. The second thing is that I think we do have to think like we're technology and innovation companies ourselves and I know we're all doing work with labs and R&D and ventures. We're all trying to learn as quickly as we can. I think actually the banks have got a good chance given our technology capability and the way we've adapted over many years, I think we've, I still believe it's we've got a very good chance of winning this in the long run. I think one of the things we have to deal with though is there's a lot of regulation, more, more regulation. Now, good regulation is important for any industry, particularly banking, but I think if you layer more and more, banks become inward looking, boards become inward looking, CEOs spend too much time looking back rather than looking forward and we become too risk averse. Now that is not gonna beat these players. I do see that as something that we have to navigate through culturally and with policy makers. I mean, it's interesting. I mean, we get a hard time with that. We're not innovative enough as an industry but I think, again, the facts don't support that. I mean, I recall, I joined A&Z in 2009, came to Australia and you know, then 2000, it's not that long ago. There was no mobile phone banking in Australia or New Zealand, it didn't exist. 2010 it started and now it's one of our top channels, if not the top channel for interacting with our customers. That's having a really short period of time. That was built and paid for and innovated by banks and now it's just become an accepted norm and we have to keep challenging ourselves and I think over time, the banks have actually done a pretty good job. Well, does that mean we have to work differently with FinTech and partner and adopt some of those ideas? Absolutely. But it's not as if we've been, I don't, and I'm not Pollyanna on this, I understand we've got to do better but it's not like we've been sitting doing nothing and I think actually the story of innovation and banking and these markets is really interesting. Simple thing like pay wave, tap and pay cards. In Australia, New Zealand lead the world in adoption of that technology. Okay, that's developed with Visa and Mastercard but we've done those things and we've provided all those things essentially for free to customers and that's one of our challenges because people wanna actually have all of the new stuff and keep all the old stuff as well and that's of course one of the challenges in terms of cost and compliance and all of those things as well. You know, the only thing I'd add because I agree entirely and I think the imperative for innovation is very, very immediate. To pick up on Andrew's point, there are two mistakes we can make. Number one is completely underestimate the level of transformation but equally we've got the pretty good hand of cards and the thing I think gets lost in a lot of the debate is the social utility of banks is about maturity transformation, i.e. Shane wants to deposit a dollar and have it on call and Andrew wants to borrow it for 30 years. We make that happen. We also know how to assess and price risk and that's actually, these are the reasons why we exist and a lot of the, we're a bit in, I mean, I remember everyone will remember in 2000 we were all told retail banks aren't banks anymore, they're retailers. Well, guess what everyone found out in 2008? Banks are banks. Now we're hearing banks aren't technology, banks aren't banks, they're technology companies. Well, guess what? We're still banks but we have to be exceptional at technology but the reality is, and I had this argument with somebody in the US who told me that they can do better credit scoring from a Facebook profile than our risk managers could do and I remember saying to him, let's see how people's Facebook friends change the next time there's a financial crisis and let's see whether your analytics are still good because our risk people remember what happened to property developers in 1990 in Australia. So we've also got to realize we've got very strong cards in the game and if we build the technology around those and keep those strengths, we should be able to do pretty well. And you've got a customer base. Talking about global change, I want to move us on just a little bit to another big area of global change, geopolitical change and the global trends around that and I'll start with you on this. So one of the biggest changes of course, okay we have Brexit but let's put that to the side for the moment, what about Trump? Storm in a teacup or do you want to run back to the hills in New Zealand and hide? No, well here's a bit of the frustration I had and I spent a few years living in the US and I follow US politics very keenly. And you know, what my own politics are on this or irrelevant, he probably wouldn't have been my personal first choice for president but that's not the point. The bit that was missing, this sort of goes to Shane's point earlier, there were all these people lamenting about Trump, all this hand-wringing about how could he? The reality is 50 million Americans voted for him. And you can say what you want about electoral colleges, et cetera, this is a democratic outcome. And rather than complain about the candidate and have all this hand-wringing and bubble op-eds where people are telling each other who read their papers how bad the world is, what actually people who are worried about it need to do is get in touch exactly to this point about what is the underlying sentiment people are reacting to?  But regardless of your view on that, the question is he is a legitimate outcome of the democratic will of a big country. And actually that's the debate people ought to be having rather than this whole how could he do this, which I think sort of misses the point. And what's the impact, the reality, and what's the impact on Australia and New Zealand? We've got US, China tension, partly from Trump. You've got what I call a moratorium on multilateralism, so you're not gonna have the same block trade deals, TPP, et cetera. You're gonna bilateral trade. What's the impact on China's role in the world and what's the resulting impact on New Zealand and Australia? It's quite a big question. Well, I don't know that anybody knows. I just didn't say, so we live in a volatile, uncertain world, that's not going away. If anything, it's possibly increasing. Maybe that's to do with media cycles and technology and allowing us to be, there was a great article in the Australian, not that long ago, pointing out that 30 years ago, mums and dads would have seen the Australian Prime Minister be the same in New Zealand, once or twice a quarter in the newspaper. Now, you are hearing from them every day multiple times, tweeting, they're talking through social media. So we live in a more volatile, uncertain world. Our job is to help our customers navigate through that, whatever that might be. And we have to sit there and help them understand what that risk is to their business and help them mitigate that, whether that's around currency or funding or debt or whether they should expand their business or not. But I don't think it's my job to sit and have an opinion or a view about what that will mean and therefore drive customers down a certain path. It's really to prepare them for that uncertainty. I do think the risk has gone up in the world in the last 12 months or so. It does have a, I agree with Shane, that's the way I think as leaders now, we have to be, we have to be in our organisations on a war footing. Perhaps a wrong term. It'd be much more adaptable and able to handle whatever happens. I think that's the case, but it does affect Australia and New Zealand in one respect and that is that we are importers of capital. New Zealand has diminished a bit, but we still are importers of capital. One of the things I said at the House of Representatives when I went up a few weeks ago before you guys in this case, it's like we don't know how the batting order works, but it was like there it was. It was a green wicket and... There was plenty of shine on the board. And they had a new, they had a new ball from both ends too, I, but I said, look, since I was here last, NAB alone has imported $10 billion of funds from overseas markets and we are now using that to support the growth in the Australian economy. Now they didn't want to talk about that, but that is actually, we are importers of capital. So if the world is uncertain, rates go up, markets are more difficult, then that is going to have an impact on our economy and on our welfare. There's no doubt about that in my mind. The best thing though that can happen is that we get growth in the US and growth in China. That's the best thing for our countries. And at the moment, that looks actually pretty good, but the Trump factor, gee, I like who knows where it's going to go. I think certainly the checks and balances in the US political system are working, but how he plays this when he's five big initiatives, he's about to go up on the third one and get it knocked back, how he handles that as a character, I think, I don't know, you know, like I think, you know, I think we just have to have our organizations ready and strong and resilient to be able to move in different directions at different speeds because we just don't know the uncertainty in the world has gone up in my opinion. He'd be glad on straight talk, wouldn't he? Maybe that's an idea for you for the next year. Ian, Andrew spoke about rates. You know, we've been in a decade of rates, pretty much, and consumers aren't used to, I guess the rates are high on this part of the world, but consumers in most parts of the world aren't used to rates. You've got negative rates in a lot of places in the world as well. What happens when they go up? And one thing was for certain, at some stage the world is only a matter of timing. What happens? I think there are a couple of angles to that. And we were, yes, it is a low rate environment, but it's not the first time the world's experienced rates going up, and we were talking before about the rates people were paying when they got their first mortgage. The first thing I'll say is that by the nature of our institutions, we are lending money based on rates going up, and rates going up pretty significantly. So every Australia and New Zealander who is being assessed for serviceability of a mortgage is being assessed as if rates were, you know, 2.5% higher at least. So that doesn't mean there can be no problem, but what people can assume is that banks don't lend as if rates aren't going to go up. I think the bigger question, which is much more the macroeconomic question, is if you go back three or four years, all the debate was around what happens at the point at which this massive unprecedented expansion of central bank balance sheets and stimulus stops. And we were all talking about inflation and that whole debate, and all of a sudden it went away. And it went away because people started, whenever there's a mantra, my instinct is always the opposite it's about to happen. So my instinct that rates would go up started when everyone started saying lower for longer because there was a new mantra and a new tag and everyone told everybody lower for longer. And in the meantime, we forgot that debate about what's gonna happen when monetary policy gets reversed. We still don't know the answer to that question. And while I don't see that as being a catastrophe, I think we've all got to be very careful about the fact that everything from the tapering in the US to the enormous stimulus put in by the European Central Bank, no economist based on past history can tell you how that unwinds. And therefore there's a range of outcomes. We just need to be very careful of that. In many ways that worries me more than what is the impact of a percent or 2% on interest rates, which can make families struggle and we're all attuned to that. But we think is manageable. Well, what about a domestic issue here then? There's still plenty of people saying, man, the world that you're doing, the house prices are still unsustainable. Do you concur with that? And what would you do about it? I mean, versus GDP versus average incomes, the house prices are still, would appear from the outside in to be high. Shane, what do you think? Well, I was saying to a team this morning, I've been hearing that house prices are still unsustainable for a long time. And 20 years. Yes, exactly. And at some level, the market is what the market is and there are buyers willing to pay those prices. And so kind of from a purest point of view, that is the price. I think from a risk perspective, there's more risk of prices going down than there has been in the past because of that and because of the inherent levels of leverage in households.  Households can't continue to lever up a whole lot more. So you probably, you know, the issue that you've got in both countries, though, is there's no silver bullet to this and there's not a, you know, in Australia we talk about where you're changing negative gearing or stamp duty or whatever. I think it needs a quite a comprehensive policy approach around that's ending with both supply and demand. And what we run the risk of at the moment is trying to look for magic one-off solutions. And if anything, they're actually making the problem more complicated and more difficult to deal with. And so it's finely tuned. I think the banks, we're actually very, very lucky in Australia and New Zealand to have really good regulatory framework. And the new kind of macro-prudential rules that are put in place, frankly, have been a good thing. And they've actually taken a little bit of heat out of the market and they've served us well and they've served the economy well. But the way forward is a bit more complex. You concur? Yeah, I do. If you look at Auckland, Sydney and Melbourne the same, but Auckland prices have gone up 100% in 10 years. And that's because it's an attractive city. Both people coming from within New Zealand to seek jobs, be with families, go to university and immigration into New Zealand the last 10, 20, 30 years has been extraordinary. And that's actually a really positive thing. I think that's actually one of the positives for Australia that there is population growth. I think that is fundamentally good but when you don't have long-range planning for your big cities, it's a big issue. I absolutely agree with Shane. Everyone wants simple solution. Let's reduce capital gains, negative gearing, positive... And I think they do have an impact at the margin but they don't address the problem because it's a very complex problem. And in Australia, we know the 30-year forecasts for Sydney and Melbourne are essentially for those cities to double. Now we live there now and it's hard enough to navigate round cities like that. There's got to be long-range planning, 10-year planning between banks, business, government, state and federal, to there's cities like Geelong and Ballarat and Bendigo and Victoria and Newcastle and places like that in New South Wales where we should be thinking of those as destination points building the infrastructure, schools, internet, hospitals first so they become places. So I do think there's a long-run planning issue which goes to one of the things that everyone wants now is quick, easy solutions, mantras. Let's get it fixed and let's do it next month and some of these things just require more discipline and patience and teamwork to solve longer-run issues. I think there's another point of this because I think the discussion on house price is very important, particularly from a housing affordability perspective. From a banking perspective, I would twist the debate a bit and say, what concerns me more when I say concerns interests me more is a good discussion about household debt and making sure people take on levels of debt that they're comfortable with for their household. So my dad in the Second Rosa War refugee, he hated borrowing money a bit like your dad and I remember the day he came home and said I've paid the last cent of the mortgage off and this was a big, big moment. Now, that may be right for some families, it may not be right for other families but I think the debate about making sure people can have good affordable houses where they want to live, where they can send their kids to school, etc. is absolutely critical. That's part A. Part B is just making sure that we're all having the right conversation about what is the right level of debt for individual families or businesses to have that suits their lifestyle, their risk appetite, etc. Because actually I'm less worried in many ways other than affordability about the houses with X or Y and much more worried that a family has a level of debt that they have sort of stumbled into, they can still service, so from the bank's perspective it all looks fine but actually in the meantime they've stopped taking the kids out to play and they've cut back on the things they wanted and that's not a healthy way to be. Can I just say because both Shane and Ian have talked about their dads, I just have to mention my dad, I don't think he had any problem with banks but I must say the story goes on, he's a Scotsman so he did have a particular view about money and I remember when I first got my first job, he brought in this little bit of paper and on it was a big number and he said, that's how much I'd cost him so far. That's a true story. Well, my daughter's sitting in the front row, I might do the same as after this. Well, that'll be higher than me for sure. I mean, one of the interesting issues for us is that it's actually the changing nature of the workforce and that assessment about affordability, well, I'm talking about your ability to pay debt. You know, at a very simplistic level, our model, historical banking model was really simple. You walked in with a pay slip and we assumed that you're going to have a pay slip that sort of looks like that for the rest of your life. That was the assumption we made and we lent you money on that basis. Actually, increasingly that is not the case. A, people walk in with three pay slips because they've got three jobs, they work in a different kind of economy, more casual work, part time and actually the chances that they're going to have a pay slip that looks exactly like that from the same employer in five years is diminished very, very fast. So how we react to that as an industry, we can't ignore it. We can't just say, oh, we're only interested in people who've got full-time employment and secure jobs because that is not the nature of work. And that's gonna, I think that's gonna be a really big shift that we need to think through from a risk point of view. You know, the fastest, I don't know the stats in New Zealand in Australia, the fastest growing part of employment population are people with multiple jobs. And this is not the working poor. This is out of choice. People who drive for Uber have a little business on the side and then work on the weekends in some industry. That's a choice people. That is the fastest growing part, small numbers, but very fast growing. And how we think about that is gonna be really a challenge for us because that's not our business model. Can I move, gentlemen, to a hard topic? Politics, now, the Australians seem to change their PM about as much as the Auckland Blues change their coach. So you must almost be due for another change soon. Just give us a bit of an overview of what's happening in Australian politics, how it's impacting you, and of course, we have an election coming up here soon. Just any comments on that? I don't mean who you want to win and stuff like that. I mean, what are you looking for from politicians on both sides? Well, the thing we were talking about before and oddly, as we've been increasingly battered by politicians, I've certainly developed a greater sense of empathy for some of the tough aspects of their job. And I don't say that as an apologist, but we were talking before and we said, imagine if our teams, so our direct reports and their direct reports is roughly 100 people, imagine every time we sat down with them, they were going to vote on whether we would still be the CEO. I would hate to think where it would come out. It'd be a different straight talk to that. And the reality is that if you look at Australian politics and I think the defining period is really the sort of middle to end of the Rudd period to today. And I joked with David Murray, who is Ralph's predecessor. He ran the Commonwealth Bank for 14 years and served under two Prime Ministers and I've done five and a half and I've served under four or five. But the dynamic that was created then was because of the very fluctuating nature of opinion polls and the febrile nature of politics, there was a lot more ongoing discussion within the party room about who should lead even where that person was the Prime Minister. That is a very, very difficult environment in which to lead. Now there can be arguments about who's to blame for that, et cetera. But the reality is that while we have that environment, you will not have stable policymaking. Because part of what oppositions can do is play not only against you in the court of public opinion, but try to destabilise your own party room. And you know, there are far better human beings than me around, but I would find it extremely difficult to formulate good policy in that sort of environment. And until we're out of that environment, until we're in a position where a leader is in a position of stability for a period of time under which good policy can be made, it's gonna be tough. New Zealand has had the opposite experience. I think, yeah, sorry. Don't go ahead. No, I was gonna say, there's also been an environmental change, you know, and it's different in Australia than here. Australia went through this massive change, we had this enormous mining investment boom, where mining investment was 8% of GDP and now it's fallen back towards two. And that has been a massive change in the economy. And along the way, actually, the place did pretty well and it managed to grow through that and replace jobs and all of that stuff. But along the way, there are 1.7 million Australians who are either unemployed or underemployed, so people want to work more and they can't. So there's a question, there's a natural question about the system and saying, is this actually delivering the globalisation question? Is this system delivering for all? So when you agree with the ends point and then you overlay this huge change of people questioning the system, is it delivering for me and my children? Very much the same stuff you hear in the US. The first-time generation in Australia is saying, my children are gonna have a lower standard of living than me. That's not the same in New Zealand. That is a real question. So people are looking for alternatives and you can understand that. And they're looking for somebody to blame as well. And you know, we cop a little bit of that. I would just add, I do think in Australia, over time, it's become a less cohesive, aligned, unified country, believing in the same sort of values and the vision of what it stood for. I actually think New Zealand, when I first came here in 1983, to go to university, I think over that time, it's become more like that, in my view. Whereas it wasn't like that at the beginning. Australia's gone in the other way. I do agree with Ian. I think it's probably, in political terms, developed in the late-time period of the Howard era. When we had a lot of immigration issues at the time that were very angsty. And then since 2007 and beyond, I think politics has become so personal. It's terribly unpleasant to put it in a minor way. And what we need politicians to do, because underneath it, I think Shane's point, is that people have become fragmented and disconnected. That's what's happening underneath. There's a little fire burning there. So a lot of the MPs are hearing that when they go back to rural parts of Queensland. You say, are they hearing that? They're lining up and they're saying, I'm unhappy. And look what's happened. So they take that back to Canberra. And it's just got fragmented. But in the end, it's got to come down to leadership. And look, I think there's a lot of politicians who are very good people, very well-meaning, certainly when they start out. But you need leaders. You need leaders. Well, I think it just... I remember recently talking to Mike Baird, who was the New South Wales Premier, who'd been in politics for 10 years. He just said, it's exhausting. It is so personal and it's exhausting, right? And he was a banker. Going to become a banker again. But he... And a big success. Yeah, and very successful. But, you know, if I could point to him, but I would just make the general point, you need character, conviction-based politicians to say, this is going to be my plan. It's a good policy plan. And I will stand accountable for that. So elect me or don't. But this is what I want to do. Make and create change that's good for our country. Not be in power. And I think we need more political leadership. But we need businesses, banks, everyone to realise the future. But if you're in politics, you're there to make a difference and to serve people. And I think the best thing you can do is put out some really strong statements about what you stand for. And over the course of three to five years, what you'll commit to changing. And stick to it. And stick to it, yeah. Well, ladies and gentlemen, in a few minutes I'm going to open up for questions and we have a hold of the mics. Before I do that, we thought we'd give these gentlemen hair. They don't get together that often. We know that, at least in this sort of form. And we thought we'd give these gentlemen the chance to ask each other a question. Being the fine competitors that they are. So who wants to go first? Right, I'll go first. Shane, your daughter's 13. 11 and a half. Yes. Wait till she gets to 13. What career advice are you going to give her and why? That's a good question. We haven't got to that stage yet. That's a really good question, Adam. I haven't really thought about it.  And the reality is that our children will be able to essentially do whatever they like. And as much as I like, you know, I didn't have that opportunity. And I don't know if that's a good or bad thing for my daughter, actually. And that's one of the things that I struggle with as a parent. You know, it's like that great, and we're not in that position, it's that great Warren Buffett line that says, I want to leave my children enough money that they can do anything they like, but not enough that they can do nothing. And I think that's a challenge with my child, my wife and I's child, trying to think that through. How do we make her passionate about something and really want to do something? Because reality is she will have many more choices than I did. I have, and the thought of any of them having careers at the moment is just more than I can conceive on. I think, and it's a little bit of line with what Shane said. I mean, I think the one thing, and again, this is a, comes from my family background where having watched my parents and my cousin who's here, the number one thing about getting a job was provide for the family before you think about anything. So I do would want my kids to understand that there's a reality of you've just got a job and there's a reality of you've just got to get by in the world and it's your job to make sure you and the people around you can. And then be, though, just try and give them a bit of the freedom to go with what they really love and want to do, whatever that is.  And that's not what I wanted to do, Dad. I really, really didn't want to do it. No, but seriously, so if there's one thing that you can, you know, yes, you've got a big responsibility as part of your job to provide for yourselves and others, but just try and not limit yourself too much by what you want to do. And what's your question? I'm interested in knowing from these guys. So at that moment on a Friday afternoon at about three o'clock, where the week's gone really well, and you're in your office and you get that call and we've all had it, and somebody's ringing you with that bit of bad news which is totally going to ruin your week, even though it's already three o'clock on a Friday. What's your mechanism for dealing with that? Well, if you've got a standard... What? Yeah. And I know that 99.9% of our jobs is all upside and fantastic, so this is maybe the one day a decade where this happens. I was going to start by saying... If somebody could have a camera of you in that room, what would it look like? This concept, you know, you said the week has gone so well to that point, I was thinking that's a concept. Exactly. I'm looking forward to that. I'm looking forward to that week. When does it happen? If you said, like, when you're sitting in your office at three o'clock on Friday, in between two and three, things have gone well. And then you get the call. Now, I think it's a really good point because I think, firstly, sometimes I'm sure I don't handle it well, and my response is not what it should be as the most senior leader in the company, you know, and to put it crudely, I'll probably shoot the messenger, you know, and that's not good. I usually know that's happening and often I've run people back and said, look, I'm sorry. However, most of the time it's not like that. I think my job here is to listen to the substance of the issue and understand what's happened and, most importantly, what's being done about it and to try to acknowledge the person phoning you to tell you that.  It's not your intent. It's not what you mean. It's like how you land, right? So I think most of the time I handle it well, but I do hang up and say, oh, gosh, right? But I try to be, you know, to hear it. I need to take no action. In all seriousness, I don't really get upset with other people. I get upset with myself. And so I, honestly, I tend to listen to those and take it fairly calmly because I'm really conscious of that.  Actually, I might bring you. What are you doing? No. On Friday. But you do. And, you know, I tend to get more upset of myself on issues rather than other people. So I, you know, those things, you may find that hard to believe. One of my very few strengths, I'm very good at generally switching off over a weekend. I hate working on the weekends. I've never done it. I don't like it. I will travel on weekends if I really have to. I don't read work things. I really try to switch off. To me, that's really important for my mind to have a rest and to just be focused on, you know, take my daughter to swimming and piano and birthday parties and all that kind of stuff, like everybody else. And that, to me, is an important recharge. And while you have the mic, the question. Oh, look, I've just been essentially notified of you ever, at what point did you ever realise you had the desire to be the chief executive of a large organisation? It's going to come sometime. The next one. Yeah. No. No, it's quite a... Actually, a question because when I joined the bank, and Ralph will know this in 2010, I didn't dream, you may have, he probably did know you, but I didn't dream in a million years of running the bank. And actually, it was quite close to the succession process happening that I was asked the question, are you going to put your hat in the ring? And you've got to be really serious about it. And I went home to my wife, Francis, and I said, you wouldn't believe what I'd been asked. So the reality is really late. Like, I would say that the thought first crossed my mind within a year that I might ever be a CEO of a big company about a year before it happened, candidly. Interestingly, on the point, though, and this sort of goes to the 3 o'clock point as well, I think a lot of people assume they want to be, and I think for a lot of people, success is your boss's job, and the council I always give our executives at the bank is, if it's great if you want your boss's job, but you don't know it very well, and make really sure you really do want it versus just assuming you want it because it's the next rung up the ladder because it's got its pros and cons. Yeah, it does. Absolutely right. Shane, when I became the CEO of B&Z here in 2008, up until that point, I just loved banking the challenges and what was before me. That's really what I had been thinking about. When I became the CEO of B&Z, and I saw the real challenge and delight and breadth of customers and different businesses, and being like your companies in New Zealand, national icons, and the real difference you could make, I really started to love it. So when I was at B&Z for five and a half years, I really loved the job. And so for me, now, going to now it was a completely different step up and different challenge, but I sort of knew the nature of it and I loved it. Having said that, I've always tried to hold it lightly, and if it wasn't this, I always thought, well, there's going to be something else that I'm really passionate about, that I want to make a difference to people, and if it's not this, it'll be something else. So it wasn't something that I was focused on and said I want to get. It just was a natural evolution. Well, ladies and gentlemen, sadly, we're out of time. You can see why these gentlemen are in the roles they have. Thank you for your openness. Thank you for the fun as well. It was a great evening. Ladies and gentlemen, please welcome the New Zealand Aussie financial mafia. APPLAUSE Good evening, mafia. Thank you. Thank you very much. Well done.


Welcome everybody to our next talk, Electronic Evidence and Criminal Matters, an introduction and critique of the EC proposal for a regulation. Our speaker is Klaus Landerfeld. He is a member of the board of the Eco Association of the Internet Industry, and he's also in the board of directors at the Dick Kicks Group AG. And usually at first sight you would think that it is a good idea to have an easier way for law enforcement authorities to secure electronic evidence when there is the suspicion that maybe there was a crime committed. That sounds reasonable at first, but as is often the case with such proposals, there are some shady side effects that people either have not thought of or they have thought of them, but they don't care, particularly there's a lot of concern when it comes to data privacy. And Klaus is going to tell us now what the problem is and what should be done about it.  Yeah, a proposal for a regulation on European production and preservation for electronic events and criminal matters is a very ungainly name, and it has come out as cumbersome as one might expect. So what's it all about? It's actually a proposal from the commission from April this year with a proposed regulation. Regulation meaning it will become direct law in every country, so there don't need to be any transportation into national law. And let's be very clear right from the onset, this is about access to store data by law enforcement. So this is not about mass surveillance or preemptive measures or something like that. There needs to be an ongoing investigation, and this is about gaining evidence for that ongoing investigation. So it compels service providers who enable legal or natural persons in one or more member states to use the services listed. I'll explain what that means. To directly cooperate with law enforcement from another member states, usually that never happens. So you're only talking to law enforcement in your own member state. And that's actually what is different. So the scope of the regulation is that a service provider is supposed to provide a full copy of all stored data. So I go into data types a bit later as well. From the inquiring member states. So data types could be everything. Telephone records, email transaction data, communication data, cloud storage, anything. And the authorization and the limitations for the access exclusively follow the law of the requesting member state, meaning the state where the investigation is actually happening. So it doesn't matter where you are, which law system you under. The only law which is required to be upheld at that point in time is the law of the inquiring member state, which is one of the big problems of the proposal. So it isn't even a requirement to even involve the state where you reside in or even inform the authorities that data was requested from a service provider in your country. So which type of services are covered? I think that's one of the most essential parts. So the commission made a presentation for that at the open meeting in May and gave some examples of service providers. So everything you'll see in the next three slides is not from me. This is actually the examples provided by the commission. And it's three areas. It's electronic communication service is defined by the European electronic communication code. It is also information society services. That means things like social networks, online marketplaces, other services facilitating transactions, hosting service providers, all this stuff. But also internet domain name registrars and registries, IP numbering services and things like that. So what were the examples given by the commission? For access service, they used BT Vodafone. Every internet access service, be it via fixed line or mobile, is basically covered that also covers in principle at least Wi-Fi providers, even so it's very difficult obviously to get some data from them. It's also interpersonal communication services. So everything, email, SMS, stuff like that. So they use KPN Vodafone Tele2, la, la, la, but you'll see also telegram, Skype, WhatsApp, Signal. So there after every type of interpersonal communication, also email services, everything. A bit more tricky is the conveyance of signals. That's also one area. So what the commission listed here is in principle also ISP, satellite network providers, but also radio and TV broadcasters. So they could basically tell you, oh, if you have a subscription, was that used for somewhere else to gain insight into where people were using the service from, for example. However, in having further talks with the commission, we found out that might also include IoT services, all sorts of other communications where the only requirement is that the company offering the service controls the transmission of the signals over the network, which obviously falls for every closed service. So it's a very broad definition. It gets even worse if you look at the information society services. They're obviously looking at social networks like Facebook, Twitter, LinkedIn, Google, online marketplaces, Amazon, eBay, Twitter, Hunts was explicitly mentioned as examples. But also, and this is where it gets tricky, hosting service providers like Amazon Web Services, OVH, Cloud Service Providers for corporate infrastructure. What does that mean? Basically, everything which is stored with someone else could be accessed through that regulation. And they also mentioned services like YouTube for uploaded videos, Microsoft Azure, Microsoft Office 365. I was kind of like, oh, wait a second. Does that mean a document's stored there? Yes, that's what it means. Online gaming websites, or even things like iTunes, so what did you download there? And when did you use the service from where? This is all stored data. So you could basically get transaction data from these services. For the inter-domain IP numbering service, they use Drive as an example for the IP addresses. For registries, your ID, the National Registration Service, but that obviously goes for the German registration service and all the similar ones as well. So this is just examples. Registries like OVH.com, KPN, and things like that. But also, privacy and proxy service providers, United Domains was listed because they provide the anonymity service nowadays under the GDPR so that you can't see who's actually behind the domain. So they can target these as well in order to release who's actually ordering the service. Well, to be very clear, it is all data stored in a single member state, which is supposed to be released to requesting member states' law enforcement authority within 10 days. Or in emergencies, even within six hours. So service providers are required to deliver a full set of data stored with them within six hours if that it's declared a very important inquiry without involving your national authorities at all. The idea behind it is that each EU member state has its own governance laws and that the law enforcement procedures can be followed through to investigate in all EU member states, regardless of the locality of the actual stored data. The service providers are not even supposed to check the legality of the request. And most often, they will not be able to do so because they don't know the law system of the country where the inquiry actually comes from. And that is not harmonized. Criminal law is not harmonized throughout the EU. So the time frames, what can be prosecuted, what even is a punishable offense, things like that is not harmonized throughout the EU at all. Can liars do that already? That's the question I often hear. In principle, they can already do that. They can access all sorts of stored information if they have an ongoing investigation and to further a case or further the ongoing investigation, they can already submit a request for stored data, but not to the service provider. They'll have to go to the law enforcement authorities of the country where the service provider resides, or the customer resides, in order to get that processed. So the authorities of where the seat of the service riders will have to process the request and will only forward it to the service provider if that is a punishable offense under local law. And the request warrants a release of the data. There might be other provisions why that is not acceptable to release the data. This is all circumvented by this proposed regulation. Normally it's the application of the local authorities to observe our local laws, that the individual fundamental rights and all legal remedies are given to the person in question and things like that. That's all upheld under the normal procedures, the multilateral agreement by the local authorities. So what are the challenges to individual rights? There are certain problem areas identified. Obviously, the enforcement of due process and the legal remedies for the individual are not clear at all. If you live in a country, data from you is requested, what do you know about what is happening in WoggerWoggerLand? Whatever, I mean, what the legal remedies are there, how do you actually file a court case, what are your rights and under their data protection laws and everything? You just don't know. And there is no harmonization in that as well. Even the information after a case is closed and you were clear maybe that you're informed that data of you was handled at all. There is no harmonization for that as well. You might never learn that your data was actually released. Typically under national law there are provisions that this happens to this and that extend one way or the other. This proposed regulation does not cover that at all. Only the law of the requesting country is taking into account. So we have some examples on where that might affect people. A good example is abortion in Poland. It's illegal there. You might have several years of jail time for that. In other countries, it's completely legal. So if you would use email services to arrange for that in the Netherlands, you might be very careful that you won't have that visible in Poland. Still, it might be requested now from the Netherlands. And you might be prosecuted based on that. We had a good example in Germany earlier this year when Putzermann was even within the authorities that actually put him under hold at some point. But the German court ruled, wait the offense where the arrest order was put into effect, that's not even prosecutable in Germany. So they had to release him again. But everything which would have happened in between telephone calls, cloud data, anything emails sent from that could have been requested by the Spanish authorities if that were already law. Another good example in Austria, it's legal to use toll data to actually build a case against someone where did someone use the roads. There's a provision in German law that you can't do that. The data of toll collect cannot be asked for by the authorities to build a criminal case. There's no provision that this is not going to happen. Meaning data can be inquired from a foreign country which your national law enforcement authorities cannot even inquire, which is it's very hard to explain to local law enforcement that they cannot ask for data which other European countries can ask for. We have the same problem with the types of cell data, for example, or location data from cell phones. In Spain, you can do mass inquiries, even for whole zones or whole cities, which is illegal in Germany. So a typical example from Telefonica, they told us, oh, it's normal. We release several hundred thousand data sets for one inquiry while in Germany this would be completely illegal. Also, there is no harmonization for the treatment of stored data, so very personal information for photos, diaries. But also, if you look at the fact that they want to go for cloud service providers for enterprises, what about company secrets about intellectual property rights? Are we supposed to release everything, your whole cloud storage, whole corporate networks, cloud storage, to law enforcement based on a request which might not even be prosecutable in your own home country? It's very unclear, and that has not been remedied in the talks over the course of the year. Interesting enough, a similar measure would never be accepted in the physical world. So imagining the Hungarian police ringing at some flat in Vienna somewhere in the morning just looking at it, copying everything they want and leaving again, not even telling the Austrian authorities they were there. Completely unthinkable. No one would accept that. No country would accept that. But in the digital world, it's exactly the same. So they think, well, why not? It's just digital data. The same is, they have certain constitutional rights. Best one, well, obviously I know that best because I'm from Germany, but we have something you just call the Kahnbereich Schutz in Germany. That is the core private life which is protected even from law enforcement. They cannot look at this data. And in the Lisbon contract, there was even a provision for that, that no European law can infringe on that right. This one does if it becomes law. So obviously, it's not thought through and it needs some amendments. There are also procedural problems. So every judicial authority of a member state is authorized to issue European production and preservation order and directly contact the service provider that offer the service. So we're talking about tens of thousands of service providers throughout the EU, but we're also talking about thousands of authorities which are in principle allowed to issue these production and preservation orders. So in Germany, this is 900 eligible authorities. We counted them and we did some counts in some other countries. So we estimated to be 13,000 authorities which can go to every single service provider and ask them to reduce data. An impossible amount, how should the service provider be able to detect manipulation? How do we even know that this is a genuine request that the authority inquiring the data is even allowed to do so? So possibly the EU Commission could publish an official list of authorized agencies, but it says, oh no, we're not going to do that. This is the individual country's responsibility and the countries do not want to publish this list of authorized agencies, which makes it even more strange is that coming up with the idea, hmm, is this going to be electronic inquiries which are signed, which we can maybe check upon? No, no, no, this could be paper, it could be text, it could be anything. So another area which is not harmonized and where the regulation has problems is the regulation of maximum penalties or minimum penalties, it's a bit unclear. One of these orders can only be sent out if the crime you're accused of is punishable and this soon stays with a sentence of at least three years. But this is, it's not really very much. So there could be fraud, there could be anything. So three years is a joke, especially looking at the fact that there might be several countries inquiring the data and even if in your country or in your neighboring country it might be only two years, there could be another country in the EU where there's a five-year penalty on exactly the same crime. So this doesn't really give you anything. And a case-by-case examination of the service provider is not possible anyway. How should a service provider be able to check that specific offense, which he's not really even in detail told about because he's not allowed to know what the specific offense is, and how should you check if that legality is upheld and if the request of the assessment of the state inquiring the data that, yes, this is an offense punishable by at least three years is actually true. The service provider will not be able to do this. And the same thing goes for the question if that is punishable in my country at all. So we cannot really tell. These problems could be solved by a binding list from the European Union and that would be sensible in considering harmonization is what they're really trying to do. So that specific offenses are listed in sort of a catalog where you can say, okay, but this offense on a pan-European level, we see this minimum sentencing or things, but the states have signal, they have no interest whatsoever in harmonization and the criminal laws. So they don't want to produce that catalog and they cannot agree on a catalog. So it is very clear that obviously companies should not be permitted to produce data for foreign authorities that would domestically not punishable, but it is very unclear right now how this can be achieved, how a service provider is even able to check that anything he receives is genuine. The same goes for the relationship to third-party states. There should be a provision in there that transfer of the data gained should not be allowed to be transferred to a third party. So one European member states requests data and then shares it with the US, for example. I think it's very clear that this should not happen, but at the moment, individual member states can negotiate their own individual agreements with whom they share data under what provisions. And we think that there should be something in the regulation that says no, this can only be done through the entire union. If, for example, the US Cloud Act, there's a provision that data is shared with you, it should be harmonized, it should be the same regulations, the same way to do this throughout the European Union so that not one country can do their own individual contract on that. The same goes for the existing process. There is a process of voluntary cooperation and a lot of countries have individual contracts between each other on how to share data. So whatever the Netherlands and Germany have a contract, Austria and Germany have a contract, France and Spain have a contract on how to help each other in gaining this data. Currently, it's not clear what is the leading law. Will this be the new regulation, be the conclusive agreement, or will the individual contracts still be upholded, especially if there are lower standards? And in some cases, there are lower standards for this cooperation than what the epoch now stipulates. And obviously, this also goes for the non-EU states and the production of evidence there. So it must be very clear for all parties involved what is the new standard and which standard should be applied. Even worse, there are no technical provisions whatsoever. The proposed regulation is only about procedures and minimum sentencing and things like that. There isn't even an opening clause to come up with a technical specification. So, but in order to make this a timely response, if we consider six hours and things like that, we need a technical regulation. If something like this will even come to pass. So for the European investigative order, there's an Etsy standard, which secures the integrity and the privacy of the data while it is transmitted. It's obviously encrypted. For the epoch, there's nothing. It's not even clear how this is supposed to be transmitted. You could receive effects and then, what do you do? You produce electronic data. You don't even know what to send it to, unencrypted via email. That's, there's no provision in there at all. And if the opening clause for technical provision will not be in the proposed regulation, then you cannot have a technical provision afterwards. You need to amend the regulation. So this is really a requirement which is absolutely essential in a digital world. I can't even understand how someone can come up with a proposal for electronic evidence, which does not say it needs to be transmitted electronically. I mean, it's, well, okay. Yeah, well, for people versed in digital matters, it's, I don't know, right? So the same goes for companies. I mean, obviously a lot of you probably work for providers or some companies which offer digital services. So in principle, a unified procedure for a single market. I mean, we're working on the single European market for electronic communication, for electronic goods and services. So in principle, the idea that there is a unified procedure on how to access data and what data should be accessed is not a bad idea. I have to admit, it's sometimes very difficult to work in the current system where there are individual agreements between some states and what can be shared and how it's done is a bit unclear. And you never know when your own local authorities talk to you and request some data if this is actually for some other country. You never know. So procedure would be very helpful. But the direct contact of foreign state authorities with you as a service provider in another country means there is a discharge of sovereign tasks by your own state. And that is something which we view is very problematic because who is responsible to uphold the rights of the individuals in that setup? Will that be discharged to the private company, the private sector? It's something which obviously politicians are trying to do all throughout the EU, typically within national law. So there's a lot of state responsibilities being outsourced to private sector companies nowadays. But on international law or international treaties, you almost never see that. So why is that in here? Why are the state's responsibilities simply ignored and the individual countries have no rights, no safeguards, nothing in there to protect their own citizens? That we as industry, few as a big problem. Because obviously this is also about liabilities. It needs to be clear for a service provider to have a release data based on that regulation that I'm only acting in an official capacity, working on an official state order and carry out measures that have been prescribed by, well, yes, some other state, but at least for some state. So I'm not liable for releasing that data. Under the current proposal, it's not even clear if the user could not sue me for the releasing that data. Yes, it is EU law, but it's very unclear how that relates to the national law about safeguarding data of the individuals. Actually, one provision is in there, which states that if I don't follow the order, if I don't release the data in a timely manner, I could be fined up to 2% of my turnover as a company. So again, very hefty financial risk, not responding in emergencies within a couple of hours. So am I willing to take that risk? Am I willing as a company to not follow that order and actually do some checks, do some legality checks? I might not, if I'm a large company, I'm talking about several million euros or even a billion euros or something like that in potential fines for not following that request. It's very difficult, so this should really be put into the proposal. It should also be very clear that if that was a manipulated request and I have no means to check this, I have no means to do a signature check or something like that. If I receive a fax with a stamp from some court somewhere, I cannot verify if that is even a true court, if that even exists or if that has the authority to request this type of data. Under the current proposal, I'm supposed to simply release data. I'm not even supposed to properly check this. So can I be made liable if that was fraud, let's say court fraud, that we think is a big problem, at least for the companies. How can you do business in an environment like that? And obviously you cannot check if that is legal in 28 different legal systems. And it should also be clear and that's also not part of the proposition right now that the data cannot be used for something else. So it was requested for one thing and it can be used in a different legal case. Not even that is in there. And also it should be very clear that evidence released to a law enforcement authority and then it becomes clear that this data should not have been released, that it cannot be used in court and that is also not in there. So what is the current status of the proposal? Where are we in the process? It's not law yet, it's not passed. The European Data Protection Board adopted a resolution that said this is very critical and it's not supposed or shouldn't happen. On the 26th of September, but the Council, so the EC Council adopted it as is without amendments on the 7th of December. So if it goes through Parliament as well, then it would become law immediately. If the Parliament stops it, then there will be trial log disputes and we can actually still prevent it from become law. The Parliament held a hearing on the 28th of November and it's currently not clear if there will be any further hearings or proceedings before the EU election in May. So what is required? And that's where I say it should be a call to action. Please, in this case really, NGOs, private individuals and companies we're all on the same side here. This should not come to pass as it is because it will really rob you of clear law and a clear system on where you are, on what is really the law system you work in and you can actually have a clear understanding of what, if you save something on the net or if you put something in storage somewhere, if that is not released to someone else. Only a handful of companies opposed the regulation. So there was active opposition to that. There was Germany, the Netherlands, Finland and Greece and also Hungary and the Czech Republic but on different grounds because they thought it doesn't go far enough. So that's the typical things you have in the Council. However, the primary advocates for the proposal were France, Spain, Ireland and Belgium. So they sponsored it. So especially in these countries it would be helpful if people would become active, talk to their governments locally, talk to their parliaments and actually say, okay, well, what is happening here? Why do you support this? Support can still be withdrawn until this was actually adopted. Also, obviously, people should talk to their members of parliament and make clear that this is not something which should become law. So as I said, there is still some time to act, probably the first quarter at least, maybe up until after the European election in May. And I hope that there will be some action that people see that this is a big problem and these production orders should not come to pass. Yeah, thank you very much. Materials used. I recommend these as readings. So there was the opinion of the European Data Protection Board, the original proposal, but also a study for the parliament done, so the legal committee of the parliament, which also strongly requests the parliament not to adopt this. So if you're interested in the topic, look at these materials. And yeah, I'm open for questions. Thank you very much for the talk, Klaus. We still have quite some time for questions and answers. So if you have any questions, you can move to any of the microphones we have here in the room and then we will be happy to take your questions. Are there any questions from the internet so far? Doesn't seem so. There's still thinking about it, maybe. So let us start with microphone number five. When pushing for the electronic signatures and the proof to have a valid request, it ought to be wise to ask for a secondary legal check by the local authority, because when you have a digital format, you can also speed up the check by the authorities. Yes, we thought that, well, actually what the service providers proposed was that it should actually be sent out from the local authorities to some central agency within the state. And they, well, the original requesting authority to sign it, the outgoing central authority should have signed it. Then there was an inbound called double tandem so that both countries actually check on it and then only then it's forwarded to the service provider and you would be able to check signatures on this. So that there was a legality check and also an integrity or an authorization check on this, but it was flatly refused. Even in Germany, the Bundesamt, Bundesamt für Justiz, they said, oh, but we can't do this 24 seven within six hours, it's impossible. So every service provider is supposed to do it, but they cannot do it. But the check, the actual, that the legality check outbound and inbound, we think this is absolutely mandatory to do. Thank you, next question for microphone number two. Thanks Klaus for reporting about this nightmare. When there is an incoming request from a local authority, let's say to D-Kicks, is there any proposal in which language it should be? Should it be in German or in Polish or are you expected to learn all these languages? It's a, well, actually D-Kicks cannot really have these requests, different story. Actually, every company or every service provider is supposed to publish an address to forward requests too and the languages they are willing to accept these in on their website. Don't ask me why, we thought that as with the list of authorities being eligible to request, a list of service providers which can actually receive these would be a nice thing to compile on a national level and then be exchanged maybe through Europol or something like that. But again, flatly refuse because one, it's too difficult to compile this list of authorities who can inquire and electronic signing is completely out of the question. It's supposed to be a couple of years before the local authorities can sign stuff and also this finite list of service providers who can actually receive it was supposed to be impossible to compile because you've seen there's some rather open definitions in there like these controlling signals on the network stuff, right? Anyone who's transmitting and storing data in some fashion could potentially be a target. So the authorities thought that it's impossible to compile a complete list of potential recipients. I'd like to remind the people who are already leaving to please do so quietly and everybody else was in the room to also be quiet. Next question from microphone number three, please. So since you have a big German audience, sorry, the echo. Since you have a big German audience, which of the German European Parliament politicians support and oppose this and which of them do you think should we direct our attention to? Honestly, I cannot answer that because I haven't talked to the German members of Parliament because we were able to convince the German government that this is a bad idea and they oppose the measure altogether. So we need to do this now and we also need to go to Parliament, of course, but my colleague in Brussels already did this, but I don't know who he'd actually talked to and who he didn't. That would be Thomas Bill Maier of Echo. He's talking to the Parliament there. Microphone number seven, please. Yes, how are the sending authorities supposed to identify where to send a request? Like even if you look up on an IP address, it might not actually be the company that's responsible for the server. It might even be like the upstream ISP of the co-location company that has a customer that's where you're supposed to send a request. Very good question. No, I seriously cannot answer it. The proposal doesn't stipulate that. There is no provision in there how to find out who the actual service provider is. So that problem is there today as well. So they need to identify who the service provider is today as well. So there's really no change for the requesting authorities there. Microphone number six, please. Hi, thanks for the talk. I was wondering. So you said attacking state laws are above the targeted state laws. Could there be any protection? Like if my state's constitution says a foreign law cannot apply here, could it invalidate the regulation? That's what we're aiming for. We hope that this will actually come because this is what would be required. If, for example, there are preventions to use data for doctors and members of parliament and things like that, that's not even in there as well. So if there are local requirements that data cannot be released, that is not upheld as well. So, and it's actually a good attacking point for members of parliament to tell them, well, you know what, under this, even your data can be released. And they're typically very proud of their protection. This proposed regulation doesn't clarify this. You have to release the data no matter what because the presumed check already happened at the requesting entity. And it's only a question if it's punishable with at least three years in the requesting state. So your law doesn't matter at all in the regulation as it is right now. Now the time of the internet has come and they will be asking their question. I actually have kind of a double question. For one, is law enforcement actually defined in a way or is it just law enforcement without any definition? It's, well, it is actually, for some things you need a court order as well. So it's basically police, the state attorneys and the courts on the different levels. And under some local jurisdictions, it's very clear that data can also be requested by secret services and things like that as well. So they would probably fall in that range as well, even so it explicitly says that it's only for criminal proceedings. So it's very difficult to tell if they will probably be able to send this through some police agency or something like that. But it's clearly just for criminal proceedings. One actually need to go to kind of a judge even in the requesting country or is it completely free to send request? That depends on what the local law says. If you can request IP addresses, names, certain types of data in the local law without a judge. So if police or the state attorney can do it, then only their signature is required if the local law states that the judge is required, then you would need the authorization by a judge. However, if you want content data, that's a special point in there. So if you want content or whatever of a cloud service or something like that, it will always require the signature of a judge, but this could be from a local court. Microphone number two, your time has come. Please do go very close to the microphone. Thanks for the wonderful talk and preparing it in such a short time. I would have two questions that popped into my mind. One of them is that we have extensive cooperation contracts between legal entities within the European Union. So if I see this correctly, so far the proposed procedure would allow to basically play it in tandem to get the information. So my police is gonna ask someone else's police, the police from another state to ask for data that the police can't ask for, and I don't see how this is omitted in any way. Well, I had this in the presentation that we think that only the state where there are actually criminal proceedings should be able to request the data, but it's not very clear right now in the proposed regulation. So this needs to be clarified. We think that especially this part of the data can be handed on to someone else because we have a different contract in place that this should be explicitly prohibited under this regulation. It's not part of the proposal right now. Microphone number two, please do ask your second question. The other point was, when does data count as being stored? Is this like two minutes after I finished my phone call or an hour or 24 hours? Well, the proposal doesn't say. Typically that is also something which is under local law and it actually differs from country to country what is considered stored data, but it's typically all sorts of account data, all sorts of data which is stored more formal like emails, cloud data and things like that. It's data in transit which is only temporarily stored somewhere does typically not count as stored data. Microphone number five. The amount of scope if I run my own mail server like universities or other big companies?  But universities and things like that, that is really up to local law. So under certain provisions, I don't know that for many countries but I know that in Germany for emails for example, they have an exemptions, they don't need to provide that. So this is part of what do I mean when I say we need to actually change local procedures as well to clarify who's within scope and who's not. This is all about oh, it's kind of like up to local law but if I'm not required to store something or to actually have data and then someone from Spain or whatever inquires something because companies there are required to store that. Well, obviously if I'm not storing anything, they can't release anything but it might work the other way around. Like in Poland they have data retention for five years in some other countries they don't have data retention laws at all or maybe six months and then you request something and you receive data for five years. That's obviously not intended from the requesting entity so this might work both ways. And the internet has the honor of asking the final question for the session. So one Cushia user asked if we should use the law against the politicians which proposed it if it actually comes into effect to kind of show them how bad it really is. Well, if you get some other law enforcement agency to request that data, yes. You could do that because there's no provision against it but it's, I can't really answer that, sorry. All right, anyways, thank you very much for all of your questions. Thank you so much for being so active. Also, thank you very much to Klaus again for giving this very informative talk. Please give another big round of warm applause to Klaus. Thank you. Thank you. Have a good one.