AI-DATA 2026 / APEC Haus, Port Moresby

Trust.

Jason KurdzinskiCo-founder and CTO, NiuPay

Building a secure, trusted and AI-ready digital Papua New Guinea

The question

Do Papua New Guineans trust the digital systems that serve them?

01Responsible AI innovation 02Protecting data 03Securing business 04Strengthening digital laws

Today’s theme: building a secure, trusted and AI-ready digital Papua New Guinea

My answer

Not how it was designed.

Not what the policy says.

It worked last time.

Trust is earned in delivery.

Not declared in policy.

Goroka, Eastern Highlands / 4:12 pm

A business owner, a deadline.

Uploading her coffee shipment’s export documents to a government system before the cut-off.

4:12

Export documents

Shipment 14: green coffee

Goroka to Lae port

Uploading 4 documents

Cut-off today, 5:00 pmSignal: weak

Export licence

Certificate of origin

Phytosanitary certificate

Quality certificate

Submit for clearance

Can I rely on this?

Every systemEvery policyEvery law

Judged by that question. Not by us. By her.

Responsible AI innovation

The world isn’t waiting.

1.2bn+people use ChatGPT every week, OpenAI said this week

Hesitate, and we’re left in the dust.

Source: OpenAI, 21 October 2026

Case in point

An engineer turned CTO. Getting more done.

×2 every 59 daysmy overall output, from my own data, across everything I do

69×October, three weeks in, against the whole of last October

NiuPaythe same curve across our whole company, and it tracks Anthropic’s

Same curve as Anthropic

Code changes merged per day, indexed to May 2026. NiuPay across all our teams; Anthropic from its engineering blog, October 2026.

Agents now run and orchestrate on their own →

One slice of it: my GitHub contributions per month, October 2025 to 23 October 2026

Responsible AI innovation / AI-ready

3 in 4

Papua New Guineans aren’t online yet.

Many will meet AI the day they meet the internet.

10.8MPeople

2.6MOnline

8.2MNot yet online

DataReportal, Digital 2026: Papua New Guinea

OnlineNot yet onlineEach dot is about 11,000 people (illustrative)

AI-ready means data-ready

AI can fix the foundations.
People stay accountable.

0

Records cleaned and checked

Protecting data

“I believe you will look after this.”

Protecting data / What we owe

Clarity in return.

Data Governance and Protection Bill

01What we hold.

02Why we hold it.

03Who can see it.

04The truth, quickly, if something goes wrong.

Responsible AI innovation / Oversight

Not “the system”. A person.

0

Living languages in Papua New Guinea

Responsible AI has to work for the people furthest from this room.

Ethnologue (SIL International)

Securing business

As we digitise, we become a bigger target.

September 2026 / Port Moresby

Police raided a suspected cyber-scam compound. 39 people allegedly trafficked in to run online fraud.

OCCRP, 23 September 2026

Securing business / AI-driven attacks

AI writes a better scam.

86%

of phishing attacks were AI-driven in KnowBe4’s latest six months of data.

+49%calendar-invite phishing

+41%attacks through Microsoft Teams

30%impersonated an internal team (Q1 2026)

KnowBe4 Phishing Threat Trends Report, April 2026

Inbox

From: Michael T. <michael.t@agency-docs.co>

Updated budget before 3pm

Hi Grace, as we discussed after this morning’s planning meeting, could you review the revised figures before the 3pm deadline? Thanks for pulling this together so quickly.

Open document

Written by AI

Securing business / From the front line

Fakes that look better than the originals.

Genuine / issued by a busy office

Typo in the titleCrooked fieldHand correction, stamp off the mark

Certificate of registartion

Reg. no. 2026-04417

Name

Date of birth

Issued

Office

AI-generated fake

Certificate of registration

Reg. no. 2026-04417

Name

Date of birth

Issued

Office

Every field correctFlagged by AI review

Real documents come from busy offices: typos, crooked fields, a stamp that missed the mark.

The fakes get every detail right. Creases included.

By eye, you’d trust the wrong one.

Securing business / This week: PHP2Shell

Hidden for a decade.
Cracked in a week.

~70%of the world’s websites run on PHP

1 weekfor one researcher using AI. Months for a world-class team without it.

Hoursfrom the emergency fix on 21 October to the first attack attempts

Patch todayFixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12

The Hacker News, Forbes, ABC7, 21 to 22 October 2026

Securing business / Deepfakes

US$2.5bn

lost to deepfake fraud in 2025. More than seven times the year before.

A board issue, not an IT issue.

Surfshark Research, July 2026

One video call. Every other face was a deepfake. US$25m gone.

Securing business / Resilience

When something goes wrong, services keep running.

An attack

Service online

A power outage

Service online

A lost connection

Service online

Securing business / The first line of defence

Usually a person.

An officer opening an email.

A shop owner answering a call.

Awareness matters as much as technology.

Strengthening digital laws

Papua New Guinea is moving.

Department of Information and Communications Technology, 2026

Strengthening digital laws

Law builds trust when it works in practice.

Data Governance and Protection BillCybersecurity and Critical Infrastructure BillVerifiable Credentials Bill

Attackers don’t care where your data is hosted. They care whether it’s protected.

Four strands.
One national conversation.

Trust.

None of us can do this alone

Built here.
Together.

Learn from the world. Do the work here, with people who know this country.

Take the slides with youtrust.niupay.com.pg

Back to the exporter

She’ll just know it worked.

4:19

Documents acceptedShipment 14 is cleared for export. Your records are stored securely.

Export documents

Shipment 14: green coffee

Goroka to Lae port

Submitted 4:19 pm✓

Before the 5:00 pm cut-offReceipt sent

Export licence✓

Certificate of origin✓

Phytosanitary certificate✓

Quality certificate✓

Take the slides with youtrust.niupay.com.pg

That’s what trust looks like

When we get it right,
nobody notices.

So let’s get it right.

Take the slides with youtrust.niupay.com.pg

Thank you.

Trust is earned in delivery.

Jason KurdzinskiCo-founder and CTO, NiuPay

AI-DATA 2026
APEC Haus, Port Moresby

Scan for the slides

trust.niupay.com.pg

Sources for every number →

Sources

Where the numbers come from

Deepfake losses. Surfshark Research, 14 July 2026: US$2.5bn lost in 2025 (US$335m in 2024); US$764m in the first half of 2026.
AI adoption. OpenAI, 21 October 2026: more than 1.2 billion people use ChatGPT each week.
PNG policy timeline. Department of ICT: Draft AI Adoption Framework (Feb 2026); draft national AI strategy (Mar 2026); Data Governance and Protection, Cybersecurity and Critical Infrastructure, and Verifiable Credentials Bills for consultation (6 Aug 2026).
PNG connectivity. DataReportal, Digital 2026: Papua New Guinea. 10.8 million people; 2.60 million internet users (24.1%); 8.21 million offline.
Languages. Ethnologue (SIL International), via Our World in Data: 840 living languages.
Scam compound. OCCRP, 23 September 2026: police raid on a suspected cyber-scam compound in Port Moresby; 39 people allegedly trafficked to run online fraud.
AI phishing. KnowBe4 Phishing Threat Trends Report, Vol. 7 (30 April 2026): 86% of phishing attacks AI-driven; calendar-invite phishing up 49%; Teams attacks up 41%.
Deepfake video call. CNN: Arup lost about US$25 million after a video call in which the other participants were deepfakes (Hong Kong).
PHP2Shell. The Hacker News, Forbes (21 October 2026) and ABC7 (22 October 2026): CVE-2026-109618 and CVE-2026-109619; code in PHP for more than a decade; signs spotted in the 2024 audit; AI-assisted exploit built in about a week; patches released 21 October 2026, with attack attempts reported the same day.
Anthropic. “Redesigning source control at Anthropic”, Anthropic Engineering, 13 October 2026: code changes merged per day grew about twelvefold from May to September 2026.

Trust.

Do Papua New Guineans trust the digital systems that serve them?

It worked last time.

Trust is earned in delivery.

Not declared in policy.

A business owner, a deadline.

Can I rely on this?

The world isn’t waiting.

Hesitate, and we’re left in the dust.

An engineer turned CTO. Getting more done.

Papua New Guineans aren’t online yet.

AI can fix the foundations.
People stay accountable.

Clarity in return.

Not “the system”. A person.

Responsible AI has to work for the people furthest from this room.

As we digitise, we become a bigger target.

AI writes a better scam.

Fakes that look better than the originals.

Hidden for a decade.
Cracked in a week.

lost to deepfake fraud in 2025. More than seven times the year before.

When something goes wrong, services keep running.

Usually a person.

Papua New Guinea is moving.

Law builds trust when it works in practice.

Four strands.
One national conversation.

Built here.
Together.

She’ll just know it worked.

When we get it right,
nobody notices.

So let’s get it right.

Where the numbers come from

Next slide

Target

Trust.

Do Papua New Guineans trust the digital systems that serve them?

It worked last time.

Trust is earned in delivery.

Not declared in policy.

A business owner, a deadline.

Can I rely on this?

The world isn’t waiting.

Hesitate, and we’re left in the dust.

An engineer turned CTO. Getting more done.

Papua New Guineans aren’t online yet.

AI can fix the foundations.People stay accountable.

Clarity in return.

Not “the system”. A person.

Responsible AI has to work for the people furthest from this room.

As we digitise, we become a bigger target.

AI writes a better scam.

Fakes that look better than the originals.

Hidden for a decade.Cracked in a week.

lost to deepfake fraud in 2025. More than seven times the year before.

When something goes wrong, services keep running.

Usually a person.

Papua New Guinea is moving.

Law builds trust when it works in practice.

Four strands.One national conversation.

Built here.Together.

She’ll just know it worked.

When we get it right,nobody notices.

So let’s get it right.

Where the numbers come from

Next slide

Target

AI can fix the foundations.
People stay accountable.

Hidden for a decade.
Cracked in a week.

Four strands.
One national conversation.

Built here.
Together.

When we get it right,
nobody notices.