Covert Cyber Investigator Well-Being With Carol Brooks

Paul: Hello and welcome to this episode of Forensic Focus podcast. I’m joined today by Carol Brooks. Carol is a cyber and organizational psychologist and leadership consultant whose work bridges industry and academia.

Carol’s currently completing a PhD at the University of Huddersfield on covert cyber investigators and the psychological factors impacting their personal resilience and investigative decision making. She aims to better understand the people behind the covert online investigations.

In this interview, Carol shares her research, the challenges of engaging with this unique workforce, and what organizations can do to support investigator wellbeing. Welcome Carol.

Carol: Thank you Paul. Brilliant to be talking about this again.

Paul: It is. It’s really good to see you. For the benefit of the viewers, I should tell you, Carol very kindly joined me at the forensic psychology conference in Glasgow earlier on this year where she assisted the team—myself, Carol, and Paul Phillips—to give a talk on the mental health impact of digital forensic investigators.

And together, we were rated as one of the best lectures given over the two days, which was impressive. It was a really impressive response from those who attended. Carol, it was a good experience. It was a great experience, wasn’t it?

Carol: It was.

Paul: So, Carol, can you tell us about your PhD and what led you to study covert cyber investigations?

Carol: Oh gosh. It was a bit of a cliché, but it was a bit of a light bulb moment. Literally waking up one day and thinking, this is it. This is what I want to study, this is what I want to do my PhD about. I don’t know whether I dreamt about it or not that night. I have no idea. But it had been the culmination of a number of years.

I had been providing consultancy and training in areas of things like decision making and personal resilience to different organizations. And I’d worked for a number of years with a colleague who provided cyber crime investigation training. And at some point I started to input into that training around things like the psychology of decision making, the psychology of staying resilient and health and wellbeing, and feeling safe when people were going online and having to take on a covert role for investigations.

And then I’d also joined the cyber psychology section of the British Psychological Society, more because I was starting to get more and more interested in that world. And I realized that all my organizational psychology background I could bring into the cyber world.

I think it was the coming together of those different activities, those different interests. And the fact that I had wanted to do a PhD for about 10 years. I kept saying, I’ll do a PhD one day. But I knew that you absolutely have to choose something that you are totally enthusiastic about and something you don’t mind consuming you because it does consume you.

It’s one of those things you don’t quite get until you’re in it. And then you think, oh, that’s what they meant by all consuming. Different things came together. And that brought me to that point of thinking, right, this is what I want to do. And I was off. I found a supervisor. I looked for a supervisor, somebody that I wanted to supervise me. I looked for the right university for me. And I pursued it until I got the answer of yes, you can come and do a PhD here, which was the University of Huddersfield.

I’ve really just been building on what I’ve always been interested in and I’m bringing it to the cyber world. And I guess the real uniqueness for me is this whole stepping into a cyberspace—the investigators are stepping into a very different world when they’re investigating compared to the traditional investigative world.

I knew from the tiny bits of consulting I’d done at that point in time that we didn’t understand enough about it. We didn’t understand enough about what people are experiencing when they take on a covert role. And I’m talking about all shades of covert—people not quite understanding the potential for that world of cyberspace impacting on them, not quite knowing what they were going to experience.

I saw a research gap. This was before I’d even applied. And that was part of my argument in terms of getting accepted to do a PhD.

Paul: It does. What—just for the benefit of people watching, because not everybody might be aware of what a cyber investigator is—can you explain what that is?

Carol: This is more complicated than you would think. I set off doing the PhD with this title Covert Cyber Investigator. And I went round and round in circles. Is it covert online investigator? Is it covert cyber investigator? What is it? And what sits under that umbrella? And boy has that become complicated.

What I’ve already learned is that job titles across—I’m not just talking about law enforcement here, I’m talking about the commercial sector, all sectors in the economy, and I’m talking globally as well—job titles are not consistent. That introduces a massive amount of confusion when I’m talking about covert cyber investigators because in my head I’m thinking about those investigators for this PhD who go online, i.e. connect to the internet in order to conduct the investigation.

That could be somebody who is engaged in OSINT research, or it could be somebody at the other end who is totally undercover. And they’ve taken on not just the false persona, but the legend behind it and everything else. And everything in between. You get some people who do it all, particularly if you’re looking out into the commercial sector.

Law enforcement is more structured. There’s more consistency. There’s more shared understanding about the roles. Get outside law enforcement, there are all sorts of different titles. You can have, for example, outside of law enforcement, somebody who calls themselves a digital forensic investigator, but they might go into networks live in order to find out what a potential criminal is doing. They may go the full way at some point and go undercover, but may pull back from that.

There’s a mix of different approaches. And of course within law enforcement, we understand what the DFI does, but take that title and place it somewhere else, it could mean something totally different.

And it’s the same with researcher. What’s researcher? Researcher has not got investigation in the title, so OSINT researcher or researchers in policing. But some of their activities are investigations.

Paul: They are.

Carol: It’s been fascinating discovering this inconsistency within job titles, and I think that is a challenge when it comes to doing the research because it doesn’t help you access the right people to get engaged in the research.

Paul: That’s exactly why I asked the question, because the type of people that you are looking to engage with for this research are those people who are physically going online, who are undercover and interacting with targets for want of a better word.

Carol: They might interact, but they don’t have to because obviously if you’re covert, it doesn’t mean that you are undercover. You might have started to work with a false persona. And that false persona is part of your safety net, part of your tradecraft for making sure that perpetrators, criminals, can’t trace back to where you really are and who you really are. But you might not be interacting with them.

You might be monitoring them, you might be surveilling them. You might be collecting information or developing intelligence. You’ve got that at one end of covert. And then undercover is the other end of covert where there might be that building of relationships and having to build rapport, and having to really work at communication and how you communicate with the person on the other side of the screen.

I see it almost like a continuum. And the reason I see it as a continuum is because I’ve come across people who do it all. Now in law enforcement, we might say that you shouldn’t be doing it that way. It should be far more structured and the roles need to be very structured and the boundaries around the roles need to be very firm.

But it certainly isn’t like that once you get outside of law enforcement. And of course you’ve got those people who are employed in big organizations outside of law enforcement, but you’ve also got a workforce who are self-employed or work in really small teams. There’s a big difference in terms of how these investigators might be working and in the environment in which they work, which potentially is crucial to their experience of investigating online.

Paul: That must make it really difficult to recruit participants for this research.

Carol: It does. And I think for a number of reasons. One, because if I use the term covert cyber investigator, there are a lot of people who will look at that and go, well, that’s not me. I’m not called a covert cyber investigator. And they won’t go beyond that title.

I’ve tried to address that in a number of ways through how I communicate the research or the recruitment side of the research. But the other issue I’ve come across is the suspicion. That’s the only word I can use. It is the suspicion. It is almost the, well, why do you want to know this? Why do you want to do this? What’s the motivation?

That took me aback at first because I thought, how can anybody be suspicious of me? And I had to really think about it and put myself in their shoes. Then of course I talked to people and they said, well, it comes with the territory. That’s how they have to work every day. You can’t take people at face value.

But it’s frustrating because my intent is positive. It’s all about trying to understand the role more so that we can begin to support that workforce more effectively. That we can begin to understand how people are making decisions in cyberspace, knowing that that experience of being in cyberspace potentially is going to become more and more complex as AI develops.

My intent is positive and it’s driven by my interest in psychology. It’s driven by my interest in how individuals respond to their environments. The connection between their thinking, their behavior, their emotions—all for the good rather than any kind of nefarious motivations.

Paul: Nefarious, yes.

Carol: That’s been a bit frustrating. But I’ve had to think, well, I can’t influence somebody’s behavior or thinking around this, particularly if it’s remote and I don’t know them personally. It’s difficult to do.

I’m really trying to go down roads where even if there’s a little bit of a door open, I’ll knock on it hard and see if anything happens. I’ve got quite good at sending cold emails to random organizations where I think, oh, there’ll be covert investigators in there. It’s interesting.

Paul:  Hi folks. This is not a glitch. Do not adjust your sets. I’m butting in to your regular viewing to remind you to complete the DFI Mental health and well-being survey. This is your chance to have your voice heard and to add to the evidence base so we can continue to campaign for the support DFIs should be receiving but aren’t.

Please, please click the link and complete the survey. Now back to your regular program.

Paul: I get the impression it’s been quite difficult to recruit participants for this.

Carol: Far more difficult than I thought it would be. Although if you were to talk to my supervisor, they would say, this is not—you know, it does happen. It is all good. This is all part of the learning, because part of the learning is that that workforce is naturally suspicious and would want to know more about why I want to know these sorts of things.

Yes, it’s been slow. I think that’s what it’s been—slow. And I’m going to leave the survey open probably until—well, I’m going to take stock at the end of January, beginning of February and see where it’s at at that point. Because at some point you’ve got to move on from the surveys to the interviews.

I don’t even want to think about that because if I found it difficult to get people to fill in a survey, I’ll be thinking, oh my goodness, am I going to get anybody to talk to me?

But I would like people to know that the survey and when I get round to the interviews has all been through ethics. It is not just me creating a survey that hasn’t been scrutinized for how ethical it is in terms of research framework. That’s quite important for people to know.

Paul: It is. And just for clarity purposes, is the information collected anonymous?

Carol: Absolutely, totally anonymous. The platform on which the survey’s hosted is the Qualtrics platform, which I think is commonly used by universities. But it’s hosted by Huddersfield University. And even in the survey there aren’t any IP identifiers. You can switch it all off.

That was really important—that however the survey went out, there was even that safety of knowing that there were no IP identifiers embedded anywhere within the survey. I have absolutely no idea who is responding to the survey at all. And people have wanted to know that. Organizations have wanted to know that.

Paul: That’s really good. It’s really good for the cyber investigators themselves to know that a) it’s been through ethics, it’s been scrutinized properly by a university. And the fact that it is entirely anonymous. There is no way to trace those participants who do take part.

Carol: No way at all.

Paul: So, what makes the work of a covert cyber investigator different from other roles within digital forensics or cybersecurity?

Carol: I think in some ways we’ve touched on some of that. But if I was to summarize it, I’d be saying that the uniqueness here is the going online, connected to the internet and stepping into—metaphorically stepping into—this virtual world in order to conduct an investigation, whether that is contact and relationship building with perpetrators or whether it’s just to sit, for example, in a forum to watch what’s going on and what’s being said.

I know that’s different from the DFI in law enforcement because it will be extremely rare, I think—and you correct me if I’m wrong—but extremely rare for DFI in law enforcement to go online. Because you’re examining devices.

Having said that, and I know we’ve had this conversation before, the more I’ve learned about DFI, the more I think there is this world that DFI step into. There’s this psychological cyberspace bubble that I think DFI end up in, almost like blocking the rest of the world out. You’re immersed in this bubble, which I suspect—but obviously I don’t know—would have parallels with a covert cyber investigator who’s online, connected to the internet and conducting their investigations in that way.

But in some ways, that’s—I keep making parallels and drawing parallels and we did that at the conference. But it’s almost another opportunity for research.

Paul: It is, and I think, she says, it hurts me head. Given how long our conversation about this went on, I don’t think we’ve got time to get into that again.

Carol: No, no. But that’s different. The other thing—cybersecurity was mentioned—I think this is interesting because the people I’ve spoken with who would say I work in cybersecurity, one or two might get the covert side. But then others, I’ve almost had to coax it out of them.

I’ve asked questions like, if you are investigating an incident, does somebody go into a network, or is it live? I’m assuming you wouldn’t want to be found by any criminals who are still in that network. Well, that’s covert. And you can see sometimes people start thinking, oh, right, okay, it is covert because you don’t want them to find you.

And then of course you’ve got threat hunters who are constantly monitoring. Well, somehow they’ve got to stay safe from the people they are hunting or the threats they are keeping an eye out for. There has to be—I’m saying has to be because I don’t know the detail—but there has to be some way of them not being identified by the adversary.

I do think within cybersecurity there’s an element of covertness that might be very different from other types of investigation, but it’s there. And that brings us back to that whole thing about title because the different shades of covert cyber investigator—it’s, I think the numbers are phenomenal. If I was to do that mapping out, I’d never end it. I don’t think if I was honest, to go into every sector and try—it just wouldn’t be possible.

Paul: Even within digital forensics, because obviously I’ve looked at this on a global scale now, and the titles for digital forensics change massively across the globe. They’re different in Europe, in the States, different in Canada. But it’s all the same role.

Carol: Yes, you are absolutely right because when I’ve been looking into the literature, I’ve come across different articles that won’t use digital forensic investigator, but the activity they’re involved in is what we would call that in the UK. But it’s different in a different country.

Paul: It is interesting. But it also stumps the research as well, because if you are talking covert cyber investigator here in the UK and someone sees this in America without understanding the difference between the titles, they may not—

Carol: Yes, you are right. The fact that I’ve gone beyond the UK almost compounds and adds to the level of difficulty in recruiting. And I mean, having said that, there are surveys coming in from different parts of the world. All’s not lost, but it just adds—it’s another layer that I’ve added into it.

But it didn’t make sense to stick to the UK because we were talking about cyber and cyber is global. No walls, no—it goes beyond one country. It just didn’t make sense to say, oh, let’s stick to the UK. I wanted to throw the net out wide.

Paul: I totally agree. And see what happens. I totally agree because obviously the introduction of the internet takes away the boundaries of not just physical space, but time as well.

Carol: Absolutely.

Paul: By doing it internationally, you’re getting a global view. Not just within the UK, which might not be generalizable across the world.

Carol: Yeah, yeah. And obviously I’m hoping that I will find something that’s generalizable, but we will have to see.

Paul: We will have to see. So why did you decide to focus on the psychological factors impacting covert cyber investigators? And I’m talking about around decision making and personal resilience.

Carol: I suppose the thing that drove me to focus on psychological factors is just who I am. I am a psychologist. I’ve always worked with psychological frameworks, theories, approaches, research underpinning my practice for the last 20 years.

And I have this inherent curiosity. I have this inherent fascination. I was always going to go down the psychological route. There was never any doubt. I didn’t even question it. That was what I was going to do.

And I think also because of the psychology side of it, that is what feeds this desire to really complete a PhD that is going to do some good. And I know that’s a cliché and a bit cheesy, but what’s the point of me doing a PhD that doesn’t have any positive impact?

Paul: In the real world.

Carol: And as a psychologist. I currently work now—have always worked really—to find that best fit. Support organizations, support people to find the best fit between their capacity, strengths, and what it is they’re trying to achieve.

And this PhD is driven by that very basic desire. As soon as I start to get themes and results, and as soon as it’s completed, I’m going to be trying to find a way to get the message—if you like—or the findings and the outcomes out there for people to use, because that’s why I’m doing it.

Paul: I have to say from Forensic Focus’s point of view, we would welcome you back to share those findings when the PhD is complete.

Carol: Oh, I’d love it. Wouldn’t it be great to be sitting here and I’ll say two years’ time rather than three? Because in theory I’ve got three. Just in case anybody’s thinking it takes that long to do a PhD, it’s because I’m doing it part-time. Six years and I’m at end of year three. I’d like to complete it within the next two years.

Paul: That’s a huge commitment.

Carol: End of 2027. Yeah. When I think about it too much, I think, maybe Carol, that’s a bit ambitious. But I’ve got to have something to aim for. I have an impatience to get on with things, and that has been one of the things about a PhD—anybody doing a PhD, you have to be patient. And if you are not naturally patient, it will drive you mad at points in time.

Paul: Well, good luck for the next hopefully two years.

Carol: Two years. It will be two years.

Paul: So I think we’ve touched on this as we’ve talked, but what specific challenges have you faced in reaching and connecting with people who work covertly? Both within law enforcement and within private industry.

Carol: Gosh, I mean, in some ways it pulls at different threads of what we’ve talked about as I think about it now. We’ve talked about the suspicion. People being naturally suspicious of this person who is not an investigator. Why do they want to know about this?

I’ve even had an instance of somebody suggesting that by them completing the survey—or a number of people completing the survey—I might be able to work out the capacity that organization has got for investigations. I have to say, I have to be pretty brilliant to do that. It’s just not possible.

Paul: But it’s little things like that. That makes me giggle a little bit inside because given the fact that all of the data is anonymous at the point of collection, you’ve got no idea how many people are employed in any company to do this.

Carol: I haven’t. No idea.

Paul: It’d be impossible to work out what their physical capacity is.

Carol: Yeah, absolutely. And then I guess one of the other things that I learned quite early on was I had to be really clear if I was speaking to people from individual organizations. I had to be really clear that there was not going to be a comparison of organizations—whether you’re in the public sector or private sector, commercial sector. I can see why that would be a bit of a barrier if I was going to do that. But I’m not doing that.

I really have no interest in the individual organization. I’m only interested in the different sectors, overall sectors that people are working in. I learned that quite early on as well.

And it’s almost like you don’t know what you don’t know. Every week I come across different networks or organizations that I realize covert cyber investigators will be a part of. Then I’m trying to make inroads into those networks to see if there’s an opening to distribute the survey.

That’s all I need to do. I don’t need any of the contacts. The survey can be literally passed on for people to complete. That element of I don’t know what I don’t know—I’m growing my knowledge and my connections every single week. Even if it’s by one or two people, I’m keeping a list, a detailed, methodical list of which organizations and individuals I’ve contacted.

The outcome from that—whether it’s because obviously some are a dead end, they just don’t have covert cyber investigators in that particular organization. And then the other people who are quite difficult to access are the people who work for themselves.

Paul: There’s no central point of contact for them, is there?

Carol: There’s no central point of contact, no. And I guess you know that they’re going to be distributed across different networks if they’re a member of networks as well.

And I depend a lot on LinkedIn, which isn’t necessarily a good thing because sometimes a post will do really well and then you’ll put a similar post out and it hardly goes anywhere. You can’t control who of your network is seeing what you’re posting. Which is frustrating.

Yes, it’s had its challenges just accessing the different populations within the covert cyber investigator world. But it’s also quite exciting because I’ll know more about that world and the different networks and individuals by the time I’ve done—I would hope so. It keeps me going. Little bit of information, I get very excited, but it’s usually when nobody’s around me. I’ll go, yay, and there’s nobody here to celebrate with. You do start talking to yourself quite a lot.

Paul: I have to say, your Christmas party’s gonna be very small, isn’t it?

Carol: Why do you say that?

Paul: You’re a sole trader.

Carol: Oh yeah, yeah. Well, it is, yes. Always small. I thought because I had no friends.

Paul: No, no, no.

What can organizations do to better support the wellbeing and resilience of investigators, do you think?

Carol: In some ways I do have to say this—obviously I’m hoping that the research, the PhD, will give some answers almost to that question. It’ll be part of what might drop out of the PhD in terms of something that’s really tangible that organizations and people can take away with them.

But because I’ve got experience and I’ve worked with organizations and individuals, and I know a little bit about the covert cyber investigator world, I do have an opinion. But I have to be aware that that opinion could, if I don’t think about it, could bias my research. That’s what I need to be aware of.

But in terms of if somebody—if an organization was to say to me, what do we need to do?—I describe it as this organizational scaffold that needs to be in place. We’re talking about organizations initially.

But that could be anything from ensuring that people have access to psychological support. We know that some sectors are better than others at that. But it’s accessing the psychological support in the right way. Good practice. What do we know works in terms of supporting people who need support in terms of dealing with potential trauma, burnout, stress.

There’s that, plus things like enabling investigators to develop their own self-awareness about different red flags for themselves. Because we’re all different in terms of how we respond to situations. But if you know what your indicators are for potentially starting on that path of being stressed and moving towards burnout, then there’s a chance that in the right environment, the right organization, for you to say, I’ve noticed something here. I’m doing A, B, and C. And that’s usually an indicator that something’s beginning to eat away at me.

I think enabling people to grow that awareness—probably through the psychological support—the two things I think will go together. And also things like making sure that there are buddying systems in place because covert cyber investigators, clearly because they’re there on a screen or a device however they do the investigation, they’re closed in their own world.

And for some it’ll be really tempting not to speak to anybody else most of the day. To have a buddy system in place strikes me as being sensible in terms of helping people—literally, I’m using the phrase—you get out of your head into the real world. So that you can normalize again and get that equilibrium back.

And I’m talking about that in the workplace as opposed to the social support that’s so important for people outside of work. We need peer support, peer support and buddying, mentoring, those sorts of things.

Those are just some examples. I think for organizations, they have more opportunity to start building that scaffold. And I think for organizations in particular, you think, well, why would they not do that? Because it’s a win-win. It’s a win for the investigator because it means that they stay healthy. They’re going to carry out the investigation to the best of their ability.

It’s a win for the organization because they’ve got—and this is sounding a bit blunt as I say—but they’ve got fully functioning investigators in their organization. It just makes sense.

And I would say that we need to be focusing more on resilience because I see that as being upstream from somebody showing symptoms of stress and moving towards burnout and really being impacted by trauma, maybe through things they’ve seen and heard.

If we are looking at resilience, let’s look at that as almost like a protective layer, and see it as a really positive thing to focus on resilience as opposed to negative—which it has had a bit of a negative reputation over the last few years. Almost like, if we do resilience training, that just means that the organization can put more on us.

We need to move away from that and really focus on helping people to be as resilient as they can be, because that’s the right thing to do with these jobs. We can’t take the stress out of the jobs as they are. We’ve got to do what we can to mitigate that inherent stress within the job.

When we look at individuals—self-employed, very small teams of investigators—it’s going to be harder for them because they’ve not got an organization to build this scaffold. They’re going to have to somehow do it themselves.

And I think that’s about looking at one-to-one coaching. It’s about making sure you are accessing peer networks and engaging with those networks and working with somebody to work out what your red flags are, similar to an organization. Building that self-awareness, and really making sure that you are doing all the things outside of work that you need to do as well.

The social supports—because there’s a danger, I think more with freelancers, self-employed, sole traders—that they become more isolated because they’ve not got the organization around them.

Paul: That’s a really interesting point, and one that I hadn’t thought about. In respect of freelancers who work solo, is it the case that they run a greater risk because they have lesser peer support to the stressors?

Carol: On the surface, you might say yes, but I think it’d be more—obviously without doing the research, we don’t know. But personality, individual approach will play into this as well as it will with resilience.

It brings me back to the differences in resilience as well and what’s—how people grow or strengthen that resilience. Because we’ve all got it because we won’t be where we are today if we didn’t have it.

But it’s being more explicit about what those strengths are and how we can build on those strengths. And there is some research around which looks at—it starts to get into the personality side of resilience as well, which I’m not specifically getting into in this research, but I can see it’s another fascinating area of research around the psychology of resilience.

Paul: Yeah.

Carol: So many—

Paul: There’s so many different variables that could play into that, isn’t there?

Carol: Oh, totally. And I guess that’s why it took me a while to really work out the essence of what I was researching, because you say the word resilience and the lens that you use to look at resilience could be many.

It took me a while to really get to grips with what was in my head—thinking through covert cyber investigator, investigative decision making, their personal resilience, all that within cyberspace.

And I think, right, okay, I’ve got my parameters here now without starting to explore all these other little rabbit holes that suddenly start to appear. But it is fascinating, and I don’t know whether freelancers are more susceptible or not.

But you know that if we’re doing research which helps organizations, it also needs to help the rest of the workforce who work on their own or in small teams.

Paul: So you’ve spoken previously about bridging the gap between industry and academia. Why is that?

Carol: Oh, I feel quite passionate about this. I very briefly worked in academia full time for about two years or so, and during that time I was very applied. Yes, I had to do teaching and supervision and all that kind of stuff. But I was also outward facing into the public sector. I was outward facing into the public sector, but working from within academia.

And I used to get really frustrated that we couldn’t easily transfer research into the public sector—

Paul: Into the real world.

Carol: —into the real world. And it drove me mad. And that was partly what made me leave academia at that point in time—talking years and years ago—to set up on my own because it frustrated me.

Things I think have changed a little bit, but I think the principle is still the same. Or the objective is still the same for me because I think it’s about constantly trying to create this virtuous circle between academia and industry so that you’ve got constant knowledge flow between the two.

Now that sounds great and there are ways that organizations I think can do that. And some organizations do this already, particularly in the public sector. You’ll have joint roles that sit in academia as well as the organization or the sector. And those roles—part of the reason for them is to bridge that gap between academia and industry.

We know that works in some sectors. We need to do that more because that seems the sensible thing to do. But the other thing of course is that there’s frustration and there are issues because you end up with a clash of culture between academia and industry a lot of the time.

There’s a different pace of work for a start, and I’ve referred to that—do a PhD, you’ve got to be patient. Well, if you are used to having to write reports to deadlines, you are used to scanning stuff, you can’t do that in a PhD. You cannot constantly scan—of course you do sometimes—but you’ve got to get into the detail. It’s a very different way of working. I don’t think that helps.

We need to find a way of acknowledging the different cultures in academia and industry to bring them together. And I think things like publication timelines as well. If you write a paper that is research based and has timely outcomes and findings in there, that needs to be immediately available to industry.

Now I know there’s more open access to research. But I think that time lag is still there. I know individual academics will then try their best to communicate what they found in different ways before publication. But we shouldn’t have publication that is one, hard to access for other people, and two, is a lengthy timeline. Because that doesn’t help bridge that gap.

And bridging that gap—you see, you’ve set me off now. Bridging that gap can only be good for society, for the economy, for global development. Because you’ve got people finding new things out, finding new ways to do things, showing good practice. That needs to immediately be available to the people who are delivering services, delivering products, because they’re all part of that circle.

We need to see it as an ecosystem, don’t we? And at the minute, I think in too many places, there’s still a divide for all the different reasons that I’ve said—I was going to say discussed, but I haven’t discussed, I’ve ranted about.

Paul: I’ve got two more questions for you, Carol. The first question is—obviously you’ve made a massive commitment to studying this at PhD level. And that commitment involves part-time work on the PhD as well as working full-time, obviously evenings, for a period of five to six years. That’s a huge commitment.

And part of the study is to help support those individuals who are doing this job. To support their wellbeing to make sure they don’t succumb to stresses and stuff. It’s a massive amount of work you are doing. So can I ask what you do in your own spare time? Not that you’re going to have very much, but you need to take time out to relax. How do you do that?

Carol: I do. And it is interesting because I’ve spoken to quite a few friends about this. It was a massive life change, starting a PhD, and that sounds dramatic, but it has been.

Because for one, I had decided right at the beginning, I’m not going to be burning the midnight oil. I’m doing this PhD, I need to integrate it into what I’m doing during the week. And I will work at weekends sometimes, but I don’t want it to be something that is entirely separate from how I’m living at the minute.

It has been a life change. And at first, I guess I did see the PhD as being my spare time. An hour here, two hours there, a Saturday afternoon, whatever it was. Because in theory, I should be spending two days, two and a half days a week on the PhD. Some weeks I might get close to that. Other weeks I don’t because I’ve got too many other commitments through my business.

You’ve almost got to roll with that a little bit. But then I realized if I see my PhD as my spare time thing, by the end of five, six years, I’m going to be ground into oblivion. So I did take stock and there are certain things that kind of help me.

I like getting out in the fresh air. That’s important to me. If I’ve not seen the light of day for a couple of days, particularly in winter, that’s not good.

And one of the things I do is row. I’m a water rower—not just indoor. I do still manage to get down to the rowing club. But part of that is to connect with other people, which is the social support side of resilience, really, really important.

When I go, yes, I’ll do the training, but I’ll also connect with people I’ve known for years because I’ve been rowing about probably 13 years or something now.

But the other thing that I’ve started doing last year, and it was a very conscious decision, was lifting weights. Lifting heavy weights and the strength training that goes around that. And that has had a really interesting effect because it gives you an incredible high. The endorphin stuff is all part of that.

Even when I’m knackered, even when I am thinking I just haven’t got the capacity to do this training session, I’ll turn up. I do have a coach, so that helps me turn up to be fair because there’s accountability there. And I can guarantee that by the end of that hour, I am so thankful I’ve been, and the endorphins kick in, and for the rest of the day I’m totally alert.

I’ve been doing that now for just over a year and that’s been one of the best things ever. In terms of helping my own resilience, I know that I have to get outside, I have to have challenge physically. And a PhD is what’s challenging me mentally.

But a PhD has a weird effect on me as well. When you find something that you love being all consuming, it has this weird impact on you. When you’re reading and problem solving, I end up in a kind of meditative state and in this kind of flow. And before I know it, two hours have gone and it feels like half an hour, but two hours have gone and I’ve got through stuff that I wanted to get through.

And I have—because I wear my watch thingy—I’ve discovered that my heart rate goes down when I’m in the flow doing my PhD.

Paul: Really?

Carol: So it’s having this really positive impact on slowing me down, which is only good. It’s making me patient and it’s slowing me down.

Paul: That’s really interesting, isn’t it?

Carol: It’s been fascinating. I feel I’ve got the right balance now for keeping resilience throughout this whole process. And I’m probably healthier than I was before I started the PhD. Overall.

Paul: That’s another benefit to academia then, isn’t it?

Carol: Yes. Yes it is. Although if I worked in academia, would I feel the same? I’m not sure. I don’t know. We’ll see.

Paul: So before we wrap, would you like to make a plea to covert investigators who might be watching this and convince them to click the link—which we’ll include in the video—and complete your study? To have their voices heard, sort of.

Carol: And that is really important and that’s where I’ll start, because this is about having voices heard.

Because by completing the survey it will mean that we have a far better understanding of that workforce. Much better understanding of the experience of being in cyberspace, which is so important when you think about the future and where AI is going. And we know criminals are going to make the most of cyberspace in the future.

If you are a covert cyber investigator, please don’t just look at the title. Really think about, do you do anything that is covert to any degree for any proportion of your role? If you click on the survey, there will be more information about the survey anyway, and you can withdraw any time. You’re not clicking on the survey and then that’s it, you’re committed.

If you do get halfway through, for example, and think, this is not quite for me—it doesn’t matter. You just close the browser. I will have no idea that anybody has done that because all the data that you put in just disappears. And I won’t know that anybody’s tried.

It’s not—you can’t break it. You don’t have to be fully committed. The only time that you end up being committed is once you’ve clicked submit. And then I can’t find your—if you then were to say to me, I’ve changed my mind, I want to withdraw—you wouldn’t be able to because it’s anonymous and I wouldn’t have a clue which was your survey.

But you would be contributing to—well, I think of course I would say this—a piece of research that has never been done before. And I think is the start, potentially the start, of a whole raft of research around working covertly in cyberspace.

Paul: That’s great. Carol, thanks very much for joining us on the podcast today.

Carol: Oh, thank you. Thank you for having me.