Confidential. This complexity isn’t without purpose: It is often by design. The beautiful graphical interface you love in an app may be a product of a technology labyrinth inherent to the interconnectedness and specialisation of the modern digital economy where no single company can deliver the intuition and ease-of-use you love. Start-ups, algorithm specialists, and data manipulators of all kinds may tinker with user data as it flows through an app’s ecosystem.. 

Scene 2

This complexity isn’t without purpose: It is often by design. The beautiful graphical interface you love 
in an app may be a product of a technology labyrinth inherent to the interconnectedness and 
specialisation of the modern digital economy where no single company can deliver the intuition and 
ease-of-use you love. Start-ups, algorithm specialists, and data manipulators of all kinds may tinker 
with user data as it flows through an app’s ecosystem.

You may ask yourself what happens to these streams of data after all is finished? What happens 
when you delete your account?

Data may be erased but all too often pools remain. Messages you delete in a popular chat app, for 
example, may instead be simply archived and remain on the company’s servers but hidden from 
view. That archiving may be intentional or may be an oversight, and you may never know until a 
data breach.

Data may also be unwittingly replicated across an organisation making deletion difficult. Think of 
your own file storage systems; are you rigorous in removing old data, or do you spring clean when 
things get too messy?

Small data breaches too often become catastrophic when hackers breaching corporate walls find 
sensitive data laying forgotten in storage spaces. Mikko Hypponnen, a respected cyber security 
thinker, once eloquently characterised sensitive data as uranium: “useful for a purpose but 
dangerous to have laying around”.

Keeping sensitive data safe requires discipline. It cannot be left to linger on storage drives or email 
sent folders. Equally, it cannot be sent into unapproved apps and services to flow into the unknown 
digital ether.

Artificial intelligence throws petrol on the need to protect sensitive data. Services like ChatGPT and 
Google Bard may store all of the information it is given, like questions and code, in huge data sets 
picked over by neural networks called large language models (LLMs) designed to improve the quality 
of AI responses. Data may also be exposed to the gig economy where people work behind the 
scenes to classify data and tinker with AI to help it respond more intelligently.

Sensitive information properly stored can make the difference between hackers finding little or 
making off with the crown jewels.

Protecting data in the age of AI isn’t just about minding what you feed the blinking text box cursor. 
Microsoft’s CoPilot, soon to be deployed within Telstra, will operate within our corporate walls to 
make finding answers and data immeasurably easier. It will also assist with writing, creative 
presentations, and more. It may also find data improperly stored in places like open Sharepoint sites. 
As much as ChatGPT and its ilk remind us of the need to be careful with sensitive data on the 
internet, CoPilot reminds us that life behind the corporate wall is no excuse to be sloppy.

Sensitive information properly stored and secured within the corporate network can make the 
difference between hackers finding little or making off with the crown jewels.

But while CoPilot is controlled and approved, third-party AI-boosted software and services from 
media creative suites to web search is becoming the norm.

Confidential. How, then, might AI and its proclivity to suck up everything it sees in a thirst for fast learning be considered safe?. 

Scene 3

How, then, might AI and its proclivity to suck up everything it sees in a thirst for fast learning be 
considered safe?

Even grander, how can the average person assess whether data is truly secure when it flows through 
these obscure pipes to be read by unknown systems and stored, perhaps, forever?

Corporate-approved applications and services are considered more secure than those on the wild 
internet because Telstra can ink contracts that allow it to assess a company’s state of, and approach 
to, cyber security. Agreements can also be drawn up with clauses around data breach responses 
without which Telstra has no guarantee of understanding how its data may be affected in the event 
of a hack.

Sensitive data therefore must be kept within the corporate walls.

Without these assessments and agreements, an organisation must implicitly trust that an app or 
service is secure and will not mishandle the information it is fed, that they will delete data when 
asked, and that their supply chains will promise the same.

That is an intolerable risk for sensitive corporate and customer information.

Staff use unapproved external applications and websites everyday. It isn’t hard to understand why; 
consumer apps and services like Notion, Slack, and Trello are more intuitive and easier to use than 
ever.

Apps continuously emerge to help us solve new problems or deal with existing ones in better ways. 
We all have our favourites. Considering whether each is safe for corporate use is an infinite task for 
our security experts.

But that isn’t the end of the story. An adage that pays homage to our inclination to skirt impractical 
and frustrating roadblocks that sit between us and the things we need to do has it that ‘security that 
comes at the cost of convenience ultimately comes at the cost of security’. It is a guiding principle 
that modern security practice should meet people where they are, enabling them to do their jobs 
more effectively and efficiently, while keeping them safe and secure.

Holding back AI is like holding back the sea. Telstra’s position with respect to AI is one of careful and 
considered embracing of the technology. We have long seen ourselves as a technology company as 
well as a telecommunications provider and so it is in our DNA to embrace AI safely and securely.

Telstra’s AI Council has issued guardrails to help our people navigate the new age of AI. Be sure to 
read them carefully before you next use AI systems for work. But while policies and procedures are 
important, they are the smallest piece of the puzzle when affecting behaviour change.

German psychologist Hermann Ebbinghaus writing in 1885 found that we are likely to forget 75 
percent of new information after six days if it is not regularly applied. Evolution, it seems, has little 
use of information that isn’t practical. Ebbinghaus had a balm for this in the same publication; by

Confidential. spacing out the dissemination of new information to learners over about two months, recollection surges to above 80 percent in what he called the Spacing Effect.. 

Scene 4

spacing out the dissemination of new information to learners over about two months, recollection 
surges to above 80 percent in what he called the Spacing Effect.

The upshot to safe and considered use of technology like ChatGPT is one of incalculable benefit and 
change. There is no doubt, despite its quirky ‘hallucinations’, that AI has and will fundamentally 
assist, shift, and upend digital work. It produces digital art in seconds and generates code as easily as 
a change management email. It has even created craft beer.

In homage to Ebbinghaus, you’ll hear more from Telstra’s AI and cyber security experts on how to 
use AI more effectively and safely in the coming months. We also encourage open discussion on 
Teams and Engage on how you are using it; active peer discussion is rocket fu

Keeping Telstra safe in the age of AI

Page 1 (2m 19s)

Page 2 (3m 48s)

Page 3 (5m 8s)