Session 3.4d Tutorial: After the Epochalypse - Assuring Defence and Critical Infrastructure in 2038 and Beyond
Tracks
ㅤ
| Thursday, November 19, 2026 |
| 11:30 AM - 12:30 PM |
| Nicholls Theatre |
Presentation Outline
At 03:14:08 UTC on 19 January 2038, systems representing Unix time as a signed 32-bit integer will overflow—the “Epochalypse”. Like Y2K, most modern 64-bit platforms will easily avoid this issue, but vulnerabilities remain in embedded devices, legacy software, operational technology, network appliances, communications equipment, sensors and supply-chain components. In some cases, critical mission systems may suddenly believe it's 1901.
For Defence and critical infrastructure, Y2038 is more than a date-handling defect: it is a cyberworthiness, systems-assurance and operational-resilience issue. Affected systems could reject valid data, disrupt scheduled activities, invalidate authentication, corrupt audit trails or experience critical failures. Interdependencies could turn a minor timestamp glitch into wider mission or service consequences. Problems may emerge before 2038 when vulnerable systems process future-dated maintenance records, contracts, certificates, licences or planning data.
This presentation will explain the technical basis of Y2038 and examine vulnerable time representations in file systems, databases and query functions, legacy applications, and embedded systems underpinning communications devices, routers, wireless access points, IP cameras, mobile and field systems, GPS receivers and aircraft or vehicle inertial guidance systems. Representative scenarios will illustrate potential effects on communications and network management, positioning, navigation and timing, maintenance, security monitoring, and logging.
The presentation will offer a practical approach to managing Y2038 risk: locating vulnerable time representations across software, data, interfaces and embedded components; determining whether affected systems can be updated or replaced; obtaining supplier evidence; identifying vulnerable dependencies; and testing critical boundaries. These findings can inform remediation priorities and system lifecycle planning.
Speaker
Mr Josh Richards
Lead Cyber Security GRC Consultant
Alpha Echo
ㅤ
Biography
Josh Richards is a cybersecurity risk specialist with Alpha Echo and holds CISSP and CISA certifications. His work focuses on risk management, information security assurance and translating complex technical vulnerabilities into practical decisions that support resilient systems and mission outcomes.
Josh brings an unusually broad perspective to cyberworthiness. A former Australian Army combat engineer and Royal Marine Commando, he has worked in high-risk environments where preparation, sound judgement and systems thinking matter. Trained in applied physics and psychology, Josh was also selected from more than 200,000 applicants as one of 100 astronaut candidates shortlisted for the Mars One project. He now leads the Soggy Wombats cave exploration team, applying science, technology and collaborative problem-solving in complex and demanding underwater environments.
An experienced author and keynote speaker, Josh specialises in making complex subjects accessible and engaging. At MilCIS 2026, he will examine the Year 2038 “Epochalypse” and its potential implications for the cyberworthiness and operational resilience of Defence and critical-infrastructure systems.
Josh brings an unusually broad perspective to cyberworthiness. A former Australian Army combat engineer and Royal Marine Commando, he has worked in high-risk environments where preparation, sound judgement and systems thinking matter. Trained in applied physics and psychology, Josh was also selected from more than 200,000 applicants as one of 100 astronaut candidates shortlisted for the Mars One project. He now leads the Soggy Wombats cave exploration team, applying science, technology and collaborative problem-solving in complex and demanding underwater environments.
An experienced author and keynote speaker, Josh specialises in making complex subjects accessible and engaging. At MilCIS 2026, he will examine the Year 2038 “Epochalypse” and its potential implications for the cyberworthiness and operational resilience of Defence and critical-infrastructure systems.
