Ciaran Martin experienced a career whiplash unlike many others, when he went from the role of a straightforward yet impactful civil servant to helping lead a new organization in the battle against cyber attacks. Discover the insights he gleaned from this unique experience on this week’s Perspectives from the Top.
From Civil Service to Cyber Security (ft. Ciaran Martin)
Ciaran Martin on tech’s role in business and leadership
OPENING QUOTE:
It wouldn't be any good if they didn't have the really, really good technological and operational underpinnings of the wider organization. So why aren't you asking to speak to them? Do you have those people? If you don't, it's not your fault, but don't think you can do this without that.
—Ciaran Martin
GUEST BIO:
Ciaran Martin founded the UK's world leading National Cyber Security Centre for the UK government, and headed it for the first four years of its existence. Ciaran has served in government for 23 years, working directly with five prime ministers, having held senior positions in the treasury, the UK prime minister's office, as well as government communications HQ, the UK's secret signals intelligence and security center.
In 2020, Ciaran was honored for his work by the Queen, and has received a range of other awards internationally and in UK, in recognition of his work in cyber security. He's now professor of practice in the management of public organizations at Oxford University's Blavatnik School of Government, advises several public sector organizations on cyber security strategies, and is one of the leading global authorities in the field of cyber security.
CORE TOPICS + DETAILS:
[23:11] - Judgment Over Competency
A hidden marker of success
When Ciaran worked in the Treasury and Cabinet Office, he found that the greatest marker of success wasn’t competency frameworks, but judgment, leadership, and analytic abilities. Politics is complicated, and outcomes may take years while trying to balance public satisfaction. These difficult-to-measure factors require judgment to properly manage, and Ciaran learned that judgment is often a prized commodity to have in your possession in both the private and public sectors.
[27:34] - From Civil Servants to Technical Wizards
A ‘life-changing’ transition
After a career as a traditional civil servant, Ciaran moved into his role as Head of Cyber Security at GCHQ and ultimately an instrumental part of the creation of the National Cyber Security Centre. He described this shift as ‘life-changing,’ detailing his struggles to adapt and then the overall wonderful experience it became— and the change he was able to enact.
[39:32] - Technology as a Foundation, Not an Afterthought
Establishing the underpinnings of a successful organization
From being a traditional civil servant to working in cyber security, Ciaran has seen how too many organizations in the private and public sector push technology to the periphery. He’s found that you must have solid technological and operational foundations of a wide organization, and the right people to put them in place and keep them strong.
[43:49] - How Leaders Get the Best
Lessons on everyday leadership
When asked about what leaders do on a day to day basis to get the best from their people, Ciaran hones in on the importance of focus. “You can choose things that are interesting to do, you can choose things that your partners like you to do, but actually we did try and ask the question— Is this good for UK cyber security?— before we did something.” Developing that focus on the greater good, and instilling it in your people, is central to the role of a great leader.
RESOURCES:
Follow Ciaran Martin:
Follow Chris Roebuck:
ABOUT PERSPECTIVES FROM THE TOP:
Discover the secrets of success for you and your organization shared by the world’s leading thinkers, doers, and trailblazers. Join Chris Roebuck, Honorary Visiting Professor of transformational leadership, leader in military, business, and government, inspiring global keynote speaker, one of HR’s Most Influential Thinkers, bestselling author, and your host of Perspectives from the Top. The show reveals a treasure trove of insights from mega trends to practical strategies and actions to take your career up a gear. From government world shapers and business mold breakers to evidence driven academics and enthusiastic entrepreneurs, each episode shows you how you can immediately use these new ideas and actions to drive your success.
Learn more at: PerspectivesFromTheTop.com
ABOUT DETROIT PODCAST STUDIOS:
In Detroit, history was made when Barry Gordy opened Motown Records back in 1960. More than just discovering great talent, Gordy built a systematic approach to launching superstars. His rigorous processes, technology, and development methods were the secret sauce behind legendary acts such as The Supremes, Stevie Wonder, Marvin Gaye, Diana Ross and Michael Jackson.
As a nod to the past, Detroit Podcast Studios leverages modern versions of Motown’s processes to launch today’s most compelling podcasts. What Motown was to musical artists, Detroit Podcast Studios is to podcast artists today. With over 75 combined years of experience in content development, audio production, music scoring, storytelling, and digital marketing, Detroit Podcast Studios provides full-service development, training, and production capabilities to take podcasts from messy ideas to finely tuned hits.
Here’s to making (podcast) history together.
Learn more at: DetroitPodcastStudios.com
ABOUT THE HOST:
Chris has shown over 21,000 leaders in over 1500 organizations globally how they can discover their secrets of success in a way that meets and beats their organizations specific challenges.
Chris has done this across sector, culture and geography - UBS, HSBC, KPMG & London Underground, legal firms to construction, tech and IT, to retail, facilities to scientific research, police to not for profit, pharmaceutical to SMEs. From the UK National Health Service of 1.4m staff and UK Government to the Red Cross in Myanmar, from Investment banks in London to Middle East Telecoms, from the Chinese Space Program leaders to HR Directors in India and global retail CEOs in Rome.
When he was the Global Head of Leadership at UBS, overseeing a staff of 70,000 across 100 countries, his team helped the bank transform organizational performance to increase profitability by 235%, market capitalization by 50% and win numerous awards. This is now a Harvard Case Study.
Chris has been quoted as a business leadership expert globally in the Harvard Business Review China, FT, Wall Street Journal, Le Monde, New York Times, Business Week, Time Magazine, Washington Post, Times of India, Straits & Gulf Times and many others. He judges business awards and has done over 350 TV interviews on leadership and business on BBC, Sky, Bloomberg, Al Jazeera, CNBC & CNN. He’s also skied at 60mph by accident.
Learn more about Chris at: ChrisRoebuck.Live
CREDITS:
Ciaran Martin:
It wouldn't be any good if they didn't have the really, really good technological and operational underpinnings of the wider organization. So why aren't you asking to speak to them? Do you have those people? If you don't, it's not your fault, but don't think you can do this without that.
Chris Roebuck:
Welcome to Perspectives from the Top. I'm Chris Roebuck, global keynote speaker with unique leadership experience from military business and government, bestselling author, and your guide to greater success. Together we will discover powerful insights from the world's leading thinkers, doers, and trailblazers, the must-know trends, thought provoking revelations, and practical actions you can use immediately. This is your exclusive and personal shop of insight and inspiration to help you get to the top.
Chris Roebuck:
Welcome to you and all of our Perspectives from the Top community of listeners around the world. It's great to share the insights of such successful people with you to help you get to where you want to be through their insights and ideas for action. Our guest today is Ciaran Martin who founded the UK's world leading National Cyber Security Centre for the UK government, and headed it for the first four years of its existence. Ciaran has served in government for 23 years, working directly with five prime ministers, having held senior positions in the treasury, that's the UK finance ministry, the UK prime minister's office, as well as government communications HQ, the UK's secret signals intelligence and security center.
Chris Roebuck:
In 2020, Ciaran was honored for his work by the queen, and has received a range of other awards internationally and in UK, in recognition of his work in cyber security. He's now professor of practice in the management of public organizations at Oxford University's Blavatnik School of Government, advises several public sector organizations on cyber security strategies, and is one of the leading global authorities in the field of cyber security.
Chris Roebuck:
Ciaran, welcome to Perspectives from the Top. And to start off, we have a question that we always ask our guests, which is about ... you've been so successful in your career, but back in the dim and distant past, we often find that there was somebody that was a catalyst to get this person to go in the direction they went in. A family member, a mentor, an old boss. Was there perhaps one person or a couple of people in your past that sort of shaped you and got you to where you are now?
Ciaran Martin:
Well, thanks for having me, and thanks for your kind words. It's nice to know that at least someone thinks that it's been a successful career. I suppose I went in so many different directions in the course of my life, that there was no single person who guided me in any particular path. And I could probably spend the whole show talking about multiple people, so with apologies to those I've left out, here's a handful. So in terms of bosses, I had the privilege to work for ... I had a number of terrific bosses. I had one for six years, and that was Gus O'Donnell, my Lord Gus O'Donnell, the Cabinet Secretary and head of the Civil Service. He was someone of tremendous ability as an economist, and the indeed as a leader, but what always stood out for me was his unbelievable ability to remain calm no matter what was happening.
Ciaran Martin:
And to put things in perspective, he'd been through all sorts of crises when he was John Major's Press Secretary, when I was still at school. The crises ranged from the Black Wednesday economic catastrophe to, actually, an attempt on his and the cabinet's life by the IRA in a Downing Street cabinet meeting. And his ability just to see the big picture and get on with things and deliver was just astonishing. And just his temperament. I worked very closely with him for six years as, essentially, Chief of Staff. I believe he raised his voice to me twice. Thoroughly deserved on both occasions, but I mean, that's an astounding sort of partnership.
Ciaran Martin:
The other person who only worked with [inaudible 00:04:26] for six months was the Director of GCHQ who appointed me, Sir Iain Lobban. Now Iain was completely different. He was much more introverted. He was a lifer at GCHQ with no experience outside the organization, but he turned it into, as The Guardian said when the Snowden leaks happened, he turned it into a global intelligence superpower. And that was just sheer drive and force of will and ability to make people follow him. I once characterized the Iain's leadership style as hugging the organization occasionally a bit too tightly, and he really drove it on, but he got people to come with them.
Ciaran Martin:
I also, very early in my career, had a remarkable woman, the Director of Communications at the National Audit Office called Gabby Cohen who at a time when I was directionless and was in a very, very junior level, did something that I hope I've done for other people, which she just let me try out abilities way beyond my level of responsibility, but under careful supervision. And that was really, really important at a time where I didn't think I was going anywhere, and I didn't at the start of my career. That was very important. Gus's calm is also something that's been very important to me, and probably learned from my father.
Ciaran Martin:
And the other person I would mention, my mother was the person who inspired me to make big choices later on. She was a teacher until she was in her mid fifties and then left, but took up educational technology, and became a pioneer of the use of technology and education despite never having switched on a computer until her mid fifties. Got a PhD, and published several books. Taught online in the US until her early eighties. So the passion to keep going and try new things, no matter how advanced your years get is something I take from her. And I think that one of the things that given the demographics, that I find genuinely inspiring about that story is that's kind of what I think a lot of people should be doing, because people have so much to offer, and they can try out new things. I debuted in cyber security at the age of 39, and it transformed my life.
Chris Roebuck:
That's a beautiful point for all of our listeners, the fact that there's the sort of assumption that the die is cast at 25, and that's it. And the beautiful stories. The fact that you didn't get into cyber security until later on, and your mother, in particular, not even sort of touching keyboards, and then becoming an expert on online education across, not just in Northern Ireland or UK, but across the world. That's wonderful.
Ciaran Martin:
She was doing extraordinary things that are par for the course now. But in the mid 1990s, I remember A Level politics class in my hometown of Omagh. I wasn't in it. It was a few years after I'd done my A Levels. I was at university. But they were video linking with people in the congress of the new post-Apartheid South Africa. So A-Level politic students were talking to members of the South African congress, national parliament, national legislature, over a video link as part of their studies in the mid 1990s.
Chris Roebuck:
That's absolutely ... that's amazing. But then now, linked to that, obviously, you were born and brought up in Northern Ireland, and obviously, over of seventies, eighties, and into ... before the Good Friday Agreement, the troubles were there, and growing up in that context must have had a significant impact on the way you lived your life, on the way you thought about things, that even though you were doing the normal things of going to school and all the rest of it. How did that impact you the sort of way you thought and the way you looked at life? Because I think that's a really interesting perspective that many people who haven't been in that sort of environment, probably, don't quite understand.
Ciaran Martin:
Well, first of all, I should say that, thankfully, unlike many others, far too many others, I wasn't very closely, directly affected. There are, thankfully, no stories of troubles-related tragedy, particularly close to me even. The time I grew up in Omagh was relatively peaceful until, tragically, right at the end of the troubles, after the signing of the agreement, where it suffered the worst attack of all, but I'd left by then. Obviously, it impacts you. But lots of people had it much worse than I did. Secondly, it is the only life you've got, so it appears normal. And the abnormal thing when you go to university in England, and so forth, is that the streets aren't populated with armed security, and there are no barriers in town centers at night and so on.
Ciaran Martin:
But I suppose looking back, what did you take from that? I suppose there are two things. One obvious, one less obvious. I mean, I suppose the obvious one was just the dangers of community polarization, and I know contexts are different around the world, but we seem to be living in politically angrier times with ... of course, technology impacts on this, but people living in singular environments, not hearing other perspectives, is inherently dangerous. The less obvious thing, but for my career, I suppose. I was born in '74, the same year as a number of hugely important reforms to the state took place, essentially, to remove some of the intrinsic discrimination of the old state.
Ciaran Martin:
And so growing up, I rarely, if ever, experienced any of that. In fact, by the time I was sort of sentient, I feel like, in my early teens, public authorities were almost going out of their way to show scrupulous fairness. But you talk to people a bit older, and that legacy of unfairness and distrust and demonstrable lack of integrity in the functions of government is so corrosive. And you do take it for granted in the United Kingdom, even these days in Northern Ireland, because you have to be well over 50 to remember any of the sort of institutionalized discrimination and bad practices of the old days. But we do take it for granted, and we shouldn't, because you can complain about poor public services and poor civil services and so forth.
Ciaran Martin:
But now where I teach in Oxford at a global school of government with students from 50 countries coming every year, and many of them are living in countries where you're talking about things like integrity and values in public life, and fairness towards citizens, and so forth, are just not things that are deeply rooted in many societies across the world. And it's profoundly dangerous and difficult when that's the case, and completely changes the character of society.
Ciaran Martin:
On a few occasions, in the course of my government work, I won't go into details, but I remember once in a foreign country, there was an altercation near me in a hotel. And talking to the people involved afterwards, the thing was when the police turned up, you didn't quite know whose side they were on. And when you have that sort of thing ... so the reforms to the state in Northern Ireland of the seventies were absolutely crucial, I think. You talk about the agreement and so forth, but building, if you like, a sense of not just trust, but participation in the state, and having people be confident in its fairness are just ... you can't do anything else without that.
Chris Roebuck:
No, but that's why I asked you the question, because the UK listeners, the other side of the water, made the presumptions that you made about Northern Ireland before even changes were made. And there was an assumption that because it was part of the United Kingdom, everything was above board, everything was fair. And it's just interesting to talk to somebody, even though you haven't significantly experienced it, that there was a significant problem there that nobody who was just living the other side of the water even believed or understood existed, which is just ... that's just why I asked the question, to help people get that context.
Ciaran Martin:
And I think what's important about that is that, and this is true in Great Britain, in the rest of the United Kingdom, it's important in the changing demographics of the Republic of Ireland, it's important in European societies, it's important in every society. If you have a group ... if you've groups of people of any size who feel fundamentally disaffected from the state, and the state behaves in a way that ferments that disaffection, you really don't have the basis of a functioning, decent and high performing society.
Ciaran Martin:
And so you don't govern on the basis, and you shouldn't shape governments on the basis of if I have enough support to get by. Obviously, electorally you have to get enough support to get by and so forth, but when you're in power, whether that's on the political side or on the permanent civil service side, you have to exercise that power and responsibility with scrupulous fairness and impartiality.
Chris Roebuck:
That's the way it should be. So you studied hard at school with a little bit of diversion in terms of your sporting prowess in Gaelic football, the indie rock band that you contributed to now and again. I just find that interesting that there has to be that balance between the hard academic work and being able to let off steam. You went to Oxford, you did history, and then what I find interesting is you were at that point that a lot of us have been at in terms of what are we going to do now?
Chris Roebuck:
And I don't know whether you thought you were predestined for public service, but there's that group of people that says, "No, no, no, no. Public service. Forget that. I'm going to go into the City and make loads of money, and I'm going to be happy with the money." And another group of people who say, "Actually, there's something about public service, the greater good, even though it's not as well paid." So, I mean, if you want, dive into the pre-university escape mechanisms, but also just that question about, do you go for the money or do you go for the public good?
Ciaran Martin:
Well, firstly on the sort of hinterland stuff, I'm assuming you got this information ... I have a glorious set of friends from Omagh with whom I'm still in touch, and one of their hobbies is to post true, but irrelevant and slightly embarrassing details of my past life. So I was a very enthusiastic Gaelic footballer. It was a big part. It taught me a lot, actually. It's very much rooted in community, obviously. It teaches you about teamwork and so forth. And still, to this day, despite the fact that its top matches are beamed around the world, it's wholly amateur, and rooted very much in place in locality. So the top teams are not based on big money signings, they based on people playing where they live, and grew up, and so forth. So it's an extraordinary spectacle. The rest of it shows the power of the modern internet. It's certainly not disinformation, because it's all true. But whether or not messing around on keyboards for a while [inaudible 00:16:05].
Chris Roebuck:
It just adds to tapestry of Ciaran.
Ciaran Martin:
It adds to the tapestry. But I think I always enjoyed ... I did work reasonably hard, but I always enjoyed, and I think it was important for development, trying out different things. Sometimes I think I tried out a bit too much, and didn't specialize in anything, but then I had great fun. Oxford was a wonderful experience, and it was ... funnily enough, I don't quite know why, maybe it was a BBC soft power, because I used to watch some documentary about it when I was four with my grandmother, and always wanted to go there, and never thought I'd get in. It was remarkably open and welcoming. It was remarkably open and welcoming to someone from my background in the early nineties. I had a fantastic time.
Ciaran Martin:
And actually ... so the choice ... it was a choice I sort of never made, because funnily enough, when I look back, going to Oxford was almost an ambition in itself, and when I finished, I didn't really know what to do. And like a lot of people, I just tumbled down to London. I worked for a market research company for a while. I never sat down and thought money or public service. I do come from a family of public servants, and we were always reasonably comfortable, but never noticeably wealthy. And I never felt particularly motivated by money. I suppose at the back of my mind, there was this thing where ... I had studied a lot of history, I studied a particular type of history where the sort of discussions we were having about nature and systems of government were a particular interest to me. So I wasn't a civil service fast streamer. I had drifted into this market research consultancy.
Ciaran Martin:
When I was struggling with that a bit, I applied for a very junior job in the National Audit Office, and they took me on, and that's where, as I said in the first question, I got a leader who took me under her wing, and very much allowed me to develop. And by that point, I did catch the bug. It was a very exciting time. You had government coming in after 18 years in opposition, you had the major constitutional reforms that formed part of my life later, and not just, obviously, in Northern Ireland with the agreement, but with Scotland and Wales. There was an excitement about public service at that time, and by the time that excitement may have waned, and we had gone to the more cynical age of the post crash 21st century, I was hooked. I was in.
Chris Roebuck:
Then you were in the system, so to speak, and you went through the traditional civil servant process, as you mentioned, up to constitution director at the Cabinet Office. So that was within the traditional civil servants, the system, the leadership ethos, and all the rest of that. Having worked with people in that world, there is a different attitude to why you do things to the commercial world, and a slightly different style of leadership. But I would say, is it more consultative, more focused on this greater good rather than ... but do you also do a lot of very, very detailed planning? How did you sort grow and develop within that context over those years? What was the skill you have that enabled you to get to where you got to?
Ciaran Martin:
So my career in the civil service was numbered 23 years in total, but there were two very distinct parts. It was the pre GCHQ and National Cyber Security Centre, and part on the post. And they were chalk and cheese. There was some overlap in that when I got to GC-
Chris Roebuck:
Start with the civil service, and we'll talk about a cyber security, because that's really interesting. Sorry, go ahead.
Ciaran Martin:
No, well, and in terms of things like values and so forth, I think I might come onto this later, the cyber security job actually completely reappraised my approach to the private sector, but we can probably cover that that bit later. I think the skills ... I worked in National Audit Office, then the Treasury and then the Cabinet Office. They are small organizations.
Chris Roebuck:
Sorry, sorry for listeners. Sorry, Ciaran, for listeners, Cabinet Office equals UK Prime Minister's office, if you're not in the UK.
Ciaran Martin:
Pretty much. Thank you. My apologies for being UK-centric there. But they are small, and certainly ... so the National Audit Office is an independent body. So we'll talk about the Treasury, which is the finance and economics ministry. Probably the most powerful institution in the British Government. And then the Cabinet Office, which is the Prime Minister's department, which by the standards of most heads of government offices, actually, comparatively weak in the system. But they're both small organizations that are focused on policy. So the Treasury is, certainly in my day was roughly a thousand people.
Ciaran Martin:
The tax collection authority in the UK, HM Revenue and Customs is 90,000 people, and the Department for Work and Pensions, which is a social security department, similarly. So it's a very, very different set of drivers. It tends to be ... it's very political. It's very fast-paced. Tries to be very evidence driven, although obviously the politics do have to be very strongly taken into account. But it sort of feels like one would imagine, certainly the Treasury feels like a sort of high powered management consultancy type of environment, rather than say a big business. If you like, a big retailer or a big logistics company or something like that.
Ciaran Martin:
So I suppose one of my skills, I suppose, which is a prized skill was if you're like a policy fixer, there were various problems you have. When the Freedom of Information Act comes in, how do you safely declassify really some very sensitive papers about the financial crash of 1992? How do you adapt ... which led me into national security work. How do you adapt the intelligence services who, historically, for eight decades, their existence was officially denied. So there was no legal recourse in post 911 on some of the allegations of human rights abuses. People started suing them. The government had to contest those cases. There was no means of contesting secret material in court. We had to go on and find one. So it was sort of fixing that type of policy, and making things work in that way.
Ciaran Martin:
What was interesting about it was you mentioned lots of planning and so forth, and the civil service does do lots of planning, and much of it is good. But in terms of the HR framework, when you go up to the senior civil service [inaudible 00:22:44], there's a formal part. The civil service in the UK [inaudible 00:22:47] somewhere between, depending on when you're talking about 400 and 500,000 people. The senior civil service is about 3 to 4,000 people. The formal sort of set of ranks. And when I got to the senior civil service at the age of 31, it was this competency framework. I'm sure many people in many organizations listening to this will recognize a competency framework.
Chris Roebuck:
I've seen many of them.
Ciaran Martin:
The one that wasn't in it, which certainly in the Treasury and Cabinet Office was ... determined more than anything else your success, was judgment, and that's not in the competency framework. And our leadership, analytical abilities, et cetera, et cetera are all there. But actually people wanted judgment. There's a good part to that. Politics is complicated. I think one of the differences with the private sector is there is no profit and loss account, and I don't mean that in a bad way.
Ciaran Martin:
There are a multiplicity of things that determine success outcomes, but they may take years. Public satisfaction. How you measure that? Political impact, et cetera, et cetera. Efficiency of resources. They're very, very hard. So a good part of that is incentivizing good judgment to balance all of those competing interests is a good thing. The area where it gets difficult, and its common criticism of the British Civil Service, is that judgment is often measured by the avoidance of mistakes and failure, which of course leads to risk aversion.
Ciaran Martin:
So some of the things that I was proudest of at the time earlier in my career, I'm not not proud of them now, but they're more difficult to talk about. And I sort of think about them less and less, because actually they were about putting out fires. They were about just stopping bad things from happening. They were about correcting mistakes. They were about getting people out of a tight spot, et cetera, et cetera. I was quite good at that, but overall ... and you can build a very good career out of that, but overall, I was very glad that later in my career, the cyber security work allowed me to do something more.
Chris Roebuck:
But it's that beautiful contrast between, are you known as the expert firefighter or have you actually created something that will grow and flourish in the future? And I think from a personal perspective, a little bit of firefighting is fun, but it's nice to leave a legacy. Is that how you might sum it up?
Ciaran Martin:
I think so. And I think, also, there was something around ... I learned so much in that early period. The other thing was that gave me fantastic exposure to senior politicians, senior civil servants. You saw some amazing operators. I mean, I mentioned some of them. You saw the public spiritness of most politicians. And I worked for ministers of three parties, because I had Labour ministers, I had Conservatives, and of course Liberal Democrat ministers for a five year period in my career. So you certainly saw that, and you're doing things like when I helped Gus O'Donnell plan the change of Prime Minister in 2007, which went pretty smoothly. Started some of the planning for what ended up being the coalition negotiations of 2010, although I was in a different job by the time that happened.
Ciaran Martin:
And then of course the Scottish referendum, which was quite a niche, but obviously hugely important policy issue but, again, in the sort of remarkable flexibility of Britain's unwritten constitution. You had a political assumption that, unlike most countries, that the secession of one part of it is allowed. But because until relatively recently there wasn't much measurable support for Scottish independence, nobody had given any thought to what form that process might take. And then because of the election results in Scotland in the summer of 2011, all of a sudden, consensually, you had to build one because Prime Minister Cameron had already conceded that there should be a referendum.
Ciaran Martin:
That's the sort of ... that last one, in particular, I think is something, although it's obviously fiercely contentious now, and many people criticize what we did back in 2011 to '14. That is something that I think ... I don't want to give the impression that everything was sort political frippery and firefighting and so forth. We did do some really interesting and substantive things. But in a sense, in terms of things like leadership and so forth, it was a particular type. You weren't taking a subject and motivating large numbers of people to do things, et cetera, et cetera. You were taking a defined problem on behalf of political leaders, and trying to give them the best advice on how to grapple with that.
Chris Roebuck:
And that then led on to your move into GCHQ as Head of Cyber Security, and then onto the creation of the National Cyber Security Centre. Clearly, as we previously discussed, the transition from working with traditional civil servants in Whitehall to, A, Cheltenham GCHQ and very, very technical, very focused people, and then trying to create a new entity where you had to lead, that must have been an absolutely massive change in your leadership style, and indeed your whole environment.
Ciaran Martin:
Oh, yeah. It was completely life changing. I mean everything about it. I mean, looking back it was a wonderful experience, but there were times, particularly in the early days, where I just thought, what is this about? You'd gone from ... the Treasury and the Cabinet Office was in yards of each other in the street of Whitehall, which dominates the British Government. Cheltenham is a hundred miles away behind barbed wire. No mobile phones, cell phones. So very, because of the secrecy and a lot of what the organization does, all the cyber security, is much more open. A very, very different environment. The workforce didn't-
Chris Roebuck:
Sorry. So for listeners listening, just imagine one moment what it is like to go to work without your mobile phone, and being unable to dive onto social media now and again, because that's what everybody at GCHQ has to do.
Ciaran Martin:
I mean, things are adapting all over, classified work all over the world these days, but certainly in 2014, it was a sort of internet-free zone, and connectivity-free zone for the workforce. I think the people there, many of them astoundingly gifted, and highly specialized, people sometimes say of state service they don't do anything better than the private sector. There are people in technology employed in that organization who big tech would [inaudible 00:29:46] do, bite their hands off or try to bite their hands off for them. Actually, to their enormous credit, they're so dedicated to what they call the mission, which is a phrase I heard a lot in Cheltenham that they don't go. So absolutely brilliant.
Ciaran Martin:
Most of them couldn't care less about politics whereas, obviously, if you're working with Whitehall civil servants, and saying that you have to be impartial, but you do care about politics, because you can't survive working for ministers if you don't, and dealing in a level of specialism that is beyond almost the comprehension of the generalist. And actually, the reason I was posted out there, initially really, was to help them put out policy fires of the Edward Snowden leaks, which had plunged the organization into some fairly challenging circumstances and, of course, they didn't have any prior capacity to deal with that sort of thing in terms of getting press and legislative scrutiny and that sort of stuff. So I did all of that in the early days, but the long term plan was to get me into cyber security.
Ciaran Martin:
I was actually quite unsure, and indeed told Iain Lobban that I'm not sure I'd appoint myself if I were you, because of my lack of background. What was special about it as a leadership? I mean also it was a jump from ... in my constitution director had about 160 people. As head of cyber security GCHQ you had about nearly a thousand, and certainly the NCSC was about a thousand. So there was that jump in numbers. The first time where you can't, obviously, know everybody by name and that sort of thing, but just trying to channel the absolute world class brilliance of what they could do into, hopefully, a more useful public good. So in my induction week ... my induction week was, it was unforgettable.
Chris Roebuck:
Sorry. Sorry, Ciaran. Maybe worth for our listeners, maybe worth [inaudible 00:31:42], just give a very, very quick overview of what GCHQ does for those who aren't in UK, which will give them a flavor for what you had then had to do.
Ciaran Martin:
It's a digital foreign intelligence and cyber security agency. So in a sense, many countries, particularly in continental Europe, have those functions split. They have a cyber security agency which tends to be quite open, and then a digital foreign intelligence agency. The Americans and the rest of the so-called Five Eyes partnership, Canada, New Zealand, and Australia, tend to have them in the same place on the sort of poacher turned gamekeeper approach. If you're very good at [inaudible 00:32:19] law, because everything's governed very strictly by law. If you're good at breaking into systems, then you'd be very good at defending them and so forth. And the GCHQ's most famous employee, Alan Turing, the codebreaker of the Second World War, actually spent more of his time throughout the totality of his career, spent more of his time on the information security of the United Kingdom rather than breaking other people's codes. So you can see, so that's the sort of synergy, if you like, between the two.
Ciaran Martin:
Historically GCHQ, in terms of information security, was just about protecting military and intelligence secrets, the sort of thing that Turing did during the war. But as the whole world digitized at the turn of the century, cyber security became, in the literal sense of the word, a popular undertaking, not a specialist one. You know and I care about cyber security, our families do, our businesses do. It's not just the preserve of elite government, military and intelligence assets anymore as it was in the past. So in my induction week, I remember they'd organized 8:30 to 5:30 half minute slot ... sorry, half hour slots of briefings about these mind blowingly technical things.
Ciaran Martin:
And obviously by the middle of Wednesday, I was getting somewhat overwhelmed. And a chap came to see me called Dr. Ian Levy, and I met him in the coffee bar in GCHQ, and eventually asked her to cancel the rest of the afternoon, because it was just absolutely fascinating. It was this sort of ... he's a world around expert. He's now a Technical Director of the NCSC. Started talking about what the organization did, but what it could do. And some of the frustrations, if you like, about not being able to, if you like, channel some of their expertise in cyber security into a more general good. Because I was preoccupied with the Snowden related work for about 6 to 12 months afterwards, I sort of kept this on the back burner, and then I had various trips to the US, and trips to other places.
Ciaran Martin:
And eventually I came back and I gathered some of the top technical and operational leaders together. And I said, "Look, in terms of cyber security, lots of people seemed to think growing problem, growing concern, government intervention, well funded, but not making the difference it might be. And a lot of this seems to be about policies and I have to mention the moment we delve into them, because they're not that interesting. You promote information sharing and public-private partnerships. And everybody's saying that in America, and everybody's saying that elsewhere, but we've been doing that for years. It doesn't seem to be doing very much." And I sort of paused thinking, I probably committed heresy and lost the trust of these people who I've been trying to ... they were a bit skeptical of me. Just another blow-in from Whitehall there to embellish the CV for a couple of years and then go.
Ciaran Martin:
And eventually one of them said, I think it was Ian just said, "So glad you said that. That's the sort of thing we've been saying for years." And I said, "Well, look, I do know a bit about how to work the Whitehall system. I know ... " It was just after the 2015 election, and the Conservatives had come back to power on their own. Before the referendum, Chancellor Osborne was very ... George Osborne, who was the sort of second in command of the Cameron Government, was very interest in cyber security. He was looking for new ideas, and we just pitched them a whole bunch of things. Why are market forces taking care of some really difficult parts of the cyber security problem, like threat intelligence, but why are they not doing things like the massive spoofing of identities, the massive spoofing of brands?
Ciaran Martin:
And the answer is because nobody has commercial incentive to protect their brands. Because if your brand gets spoofed, if you get a fake email from your favorite retailer, you don't blame the retailer. It's not their fault. So they don't lose money, whereas they do lose money if they get hacked. So they buy threat intelligence, but they don't pay for brand protection, et cetera, et cetera. So we kept thinking, right, how do we automate brand protection? And you have to get a bit technical then, because information sharing in public-private partnership, anybody can understand that. That's the problem. It was meaningless. Here I was, "Look, here's something we could introduce. We could do it for free. Pilot it in government networks, which makes it far harder to spoof brand." And we did a pilot with the tax authority in the UK HM Revenue and Customs, which was the most spoofed brand in the UK, because people were being offered fake emails about offering them tax refunds.
Ciaran Martin:
And the way their domain worked around the internet. And we said, "If you're getting an email that looks like it's pretending to be from HMRC, but isn't, because here's how you authenticate HMRC's domain. Don't send it to us." And we captured half a billion, 500 million, fake emails in one year. So 500 million times people tried to send fake emails pretending to be from the British tax authority, and they didn't arrive. So that's the sort of cooler stuff we started doing. And from those sorts of ideas, we said, "Look, we could do this much better as a subset of GCHQ, because you still need all the cooler stuff that you get from foreign intelligence to try to mitigate the big nation state threats and so forth. But we need to be out in the open. We need to be telling people about password managers. We need to be telling people about multifactor authentication." Et cetera, et cetera. So we pitched the idea and got brilliant political backing for, if you like, a hybrid model where the National Cyber Security Centre would be part of GCHQ, but would be public facing.
Chris Roebuck:
Interesting. Interesting. It must have been quite an amazing moment, because when you sat down with all of those experts, and made your sort of semi proposal, you were effectively unleashing their own thoughts, their own potential. Because I suppose what had happened was they'd all been thinking these things, they'd all been saying, "Look, we have the potential to be able to do all of this extra good," but nobody before yourself had actually said, "Hey, look, ladies and gentlemen, if you were given the opportunity to do more good, how would you do it?"
Ciaran Martin:
Well, I mean, that's how I'd like to think about it. I'm sure all this of their own perspectives, and everybody tells their own story. But I suppose if I did one thing, it was connecting that. One of the interesting things is I did spend time learning as much as I could about the technology. I was never going to be anything like those people, but you did have to understand how it worked. So I did get them. I set aside time to be taught. You had to understand some of the detail. You just couldn't ... so you couldn't just sell their ideas, because you had to understand them first.
Chris Roebuck:
And I think that's an interesting insight for leaders listening that, to some degree, you need to have a basic understanding of what your people are doing so that you can, even at the surface level, understand how the jigsaw comes together.
Ciaran Martin:
So I mean, cyber security as a subject, I think I spend my time immersed in it all the time. And I think it does require a huge plurality and diversity of skills. People in other countries who like the NCSC model would come and see us, and they'd always say, "Can we see your press office?" Because we recruited this amazing press office. The best public communications in cyber security in the world, I'm pretty sure about that, because most governments weren't doing it.
Ciaran Martin:
Then I'd say, "Look, you're asking the wrong question, because setting up an excellent comms team, it was hard, but lots of people have done it in lots of different fields. It wouldn't be any good if they didn't have the really, really good technological and operational underpinnings of the wider organization. So why aren't you asking to speak to them?"Do you have those people? If you don't, it's not your fault, but don't think you can do this without that."
Chris Roebuck:
Yeah. Yeah. That's interesting. And so therefore, in the process of doing all of this work, you have gone from the traditional civil servant role into the cyber security role, but now because of that world, you're also interacting a lot with the private sector as well, which again is another world in itself. And how did you find that balance between your civil service experience, your GCHQ tech world and tech role, and the outside commercial world?
Ciaran Martin:
Working with the private sector much more closely in that role than I had ever done before was a real eye opener. I think there would be two things I'd highlight. One was there was a culture change in GCHQ long before I joined, I think Iain Lobban was largely responsible for it, which was very open to the private sector within the parameters and necessary secrecy. And on that induction week, one of the other few things I remember after all this time, I was shown a chart which was GCHQ's budget, global tech industry, and obviously it dwarfed it. And I said, "Look, we can't control this anymore, and we can't change it in that respect. You can influence it in all the rest of it. We can do what we need to do for national security, but you can't achieve your objectives without some form of engagement with the private sector." [inaudible 00:41:22] always very open to that.
Ciaran Martin:
The second thing was in cyber security, which there's a burgeoning global industry of several hundred billion US dollars, it completely ... I'm sort of ashamed of what passed on this. It completely removed the standard conceit that many public servants have about the private sector, about motives and values and so forth. They were incredibly collaborative. Cyber security companies, same thing like any company, they've got to make a living, they've got to make a profit, so they sell stuff that's commercially useful. But in the course of that, sometimes it isn't. Or sometimes it's potentially interesting to government, but also sellable. And because we were open to conversations with them and to building trust, they helped us enormously.
Ciaran Martin:
So our ability as the NCSC when it was set up to provide useful information to the British public was massively augmented by private sector capability. Massively. It would've been a much poorer offering without them. So to that end, looking back on my civil service career, there is a conceit, and this was part of removing it. This experience was part of removing it, not the whole part. But there is a conceit that there's only really one way to make a difference, which is to work for the executive branch of a government, preferably a strong executive branch like you have in the United Kingdom. That's just not true. There are all sorts of ways in which people can make a positive difference. Good private sector security companies are just gold dust.
Chris Roebuck:
And we've had other guests on who are entrepreneurial impact investors who are having a greater impact on poverty in the Third World by doing what they do, bar ... rather than top down government money that gets stolen and other things. And I find it interesting having spent some time in the Middle East as well, that in the Middle East there is a much more of a fundamental agreement that society is about true partnership between business, public sector and the people.
Ciaran Martin:
And I mean, selfishly, I think one of the incentives for me to do this was that the brilliant people that were working for the government, who could have worked elsewhere, but you wanted them focusing on the problems that only the government was allowed to solve. You didn't want them putting out minor fires somewhere else. Get the private sector to do that if you can. So it was a very interesting experience in that respect.
Chris Roebuck:
So overall of that vast significant career with those really interesting different chunks in it, you've been a very, very successful leader and achieved much in that, what are your perspectives about the key things that leaders need to do on a day to day basis to get the best from people wherever they may be?
Ciaran Martin:
I was never a great theorist of leadership and never really responded well to lots of the formal training. So I find it quite difficult to talk about, if I'm honest. I think there is a ... I think certainly in that sort of context of not being an expert in a sea of experts about having something, and that's where the story of the NCSC comes from, having something that you can deliver for them that makes their lives, professional lives, more fulfilling. I think that's one thing. From a public service viewpoint, I think the thing that we were able to do at the NCSC, at least much of the time, was focus on, particularly in a secret or quasi secret organization where you don't have some of the same pressures of day to day accountability through parliament and the media as you're doing all this, you have to focus on some things that are making an improvement.
Ciaran Martin:
You can choose things that are interesting to do, you can choose things that your partners like you to do, but actually we did try and ask the question, is this good for UK cyber security, before we did something. This may be very interesting and a very interesting technical challenge or maybe a priority of somebody else, but actually is this going to help the overall IT security of the UK? I think so focusing on that quite relentlessly. And then I suppose the final point was maybe at the risk of repeating myself, but trying to understand enough about what they did so I could communicate it effectively to politicians, and to the general public in way that was consistent with the skills that I'd developed earlier in my career.
Chris Roebuck:
I think, actually, I don't necessarily adhere to half the leadership theories anyway, because in the final analysis, I think it's about what leaders do day to day. But you've alluded to some of those in terms of what you have done over your career around listening to people, around creating a clear vision within that, asking them for their ideas, showing you care about what they want to achieve, answering the what's in it for me.
Chris Roebuck:
And it's all of those really simple, practical things that leaders do day to day that show the people they're working with that they care about them, and they want to work with them to achieve mutual success. That is, in my view, what's most important. Not the leadership theories. So in that sense, through what you've told me and our listeners, you've picked up those things that have helped you deliver success that aren't really leadership theories, they're just what good leaders do naturally on a day to day basis to work with the people they need to work with. And it's about trust in the end. The people you were working with trusted you.
Ciaran Martin:
Well, we had quite a lot of fun. I think we did build ... there was quite a nice ... I mean, from the safety of having government backing and therefore ... and a government budget, so it wasn't a real entrepreneurial feel, but there was a very different feel to it from, say, a established government department in those days. It was a bit of a startup feel without the serious commercial pressures.
Chris Roebuck:
But that's also really interesting because, to some degree, you've done civil service, and you've also done a quasi startup.
Ciaran Martin:
Well, without the commercial pressures, but yes, we did something. There was some risk. I mean, it was reputational more than anything else, but there was some risk.
Chris Roebuck:
I think given what you were doing, there was an element of risk, because it probably hadn't really been done before. So just to of finish up, you're now teaching at Oxford. What next for you, Ciaran?
Ciaran Martin:
Teaching at Oxford, which I absolutely love. It's the other thing that I said there's more than one way to make a difference. I mean, I've got students from 50 countries. You learn so much from them, and from all over ... every part of the world. So I'm committed to that for the long term. I find it fascinating, and hopefully it's of some use to the students.
Chris Roebuck:
But what you said is just another beautiful point that has come up in other interviews. You might be the person with most experience, you might have done this, you might have done that, but that doesn't ... it's the same with mentoring. Just because you are the mentor, it doesn't preclude you from learning something from the people you are mentoring. Everybody's seen things, and experienced things that you haven't, and we all learn from constantly learning from each other, even if these people are significantly less experienced and younger.
Ciaran Martin:
I've had students who've climbed Everest on the second attempt after a very serious accident on the first one. I have had students who've set up NGOs for refugees. I've had students who've worked as doctors in war zones. Extraordinary people. It's a privilege.
Chris Roebuck:
It is. And it's a joy to hear you say that, because you talk to some people who are CEOs or whatever, and there's this presumption that they've done everything, seen everything. And as you say, there are some young people out there who have done some amazing things. Friday, I was interviewed by a young Royal engineer lance corporal for his podcast, who just completed 111 days rowing solo across the Atlantic. 4,700 miles. And you just think, wow, it's just ... some of the stuff that young people are doing out there is absolutely mind blowing. So how can people learn more about you, and what you've done, and what you want to do going forward?
Ciaran Martin:
Well, a lot of my work is available now that I have published more work in my own name on the Blavatnik school's website or elsewhere. If you're interested in cyber security, then my former organization, not responsible for it anymore, but it's still doing really well, the National Cyber Security Centre website, and I would encourage people to ... cyber security is a part of everyone's life now, so just look at some handy tips.
Chris Roebuck:
I think that's brilliant, because it is. Cyber security is now part of everybody's lives. Unless we pay attention to it, things can go so horribly wrong on the personal level, on the organizational level, and obviously given some of the stuff you can't talk about that you did, on the international and national level, if you're not paying attention to all of this stuff. So thank you so much, Ciaran, for a really amazing interview. It's been fascinating and definitely listeners, if you're interested in cyber security, find out more about Ciaran, and find out more about National Cyber Security Centre. It's all on the internet. And thank you again for your time. It's been great.
Ciaran Martin:
Thank you, Chris.
Chris Roebuck:
Well, listeners, there is a lot to reflect on, and a lot there that you can think about, and do something about tomorrow. What's great is Ciaran's changing career focus at 39 from traditional government work to the world of cyber security, and also the example of his mother who hadn't touched a computer until her mid fifties, and then became a global expert on online education, teaching until her early eighties. It just shows the power we have to adapt, change and learn no matter how old we are.
Chris Roebuck:
Also letting people who work for you try out their ability in stretching work of some type with your support to help them grow, learn and develop more quickly. Maybe, in the process, also allowing you to delegate to them to give you more time for only work that you can do. But perhaps his greatest insight was the importance of doing things, which benefit not just yourself, but others and the community on which Ciaran's focused his whole career, perhaps even sometimes forgoing the opportunity of greater financial rewards of business.
Chris Roebuck:
Therefore, just think about how you can use some of Ciaran's ideas to help you get to where you want to be. And don't forget that in a week, I'll be giving you a more in depth view of the key takeaways with my insights and ideas for action in Reflections on the Top. If you've used any of the insights you've got from previous Perspectives on the Top guests, and they've helped you, please send me your success stories. Feel happy to connect on LinkedIn. I'd love to hear from you, and don't forget to sign up on the website, so you automatically get the episodes as soon as they come out.
Chris Roebuck:
Thanks for tuning in. Check out the show notes from today's episodes at perspectivesfromthetop.com where you can not only enjoy additional resources from today's show, but all previous ones. If you haven't already, subscribe to the show on Spotify, Apple, or wherever you get your favorite podcast, so you don't miss any. And if you really enjoyed the show, please give us a five star rating and review. Have a question or comment? Let's discuss it. Message me on LinkedIn. Perspectives from the Top is produced in collaboration with Detroit Podcast Studios. So have a successful week, use today's new learnings and actions and remember, it's onwards and upwards. See you next time on Perspectives from the Top.