1
00:00:00,000 --> 00:00:27,080
Hi, so my name is Robby Mook. I ran Hillary Clinton's campaign in the last election cycle up through last year, but actually before that was working on campaigns basically straight for about 15 years, ran a governor's race, a Senate race, local legislative race, and then worked at the Democratic Congressional Campaign Committee, which oversees all the House races for four years.

2
00:00:27,080 --> 00:00:51,000
So I'm a campaign guy. I've recently made a slight pivot, and I'm at the Harvard Kennedy School at the Belfer Center doing a senior fellowship there with a Republican colleague of mine, actually Mitt Romney's former campaign manager, and we're working on cybersecurity on a bipartisan basis to help get our campaigns and elections more secure. That's what we're doing.

3
00:00:51,060 --> 00:00:56,420
All right, so that's Robby's intro. I'm going to get a sense for everybody here now, too.

4
00:00:57,080 --> 00:01:06,220
Raise your hand if you are, again, enterprise security, chief security officer, security engineer, someone who builds strong things. Okay.

5
00:01:06,840 --> 00:01:13,480
What about if you're like a policy person, someone who does legal stuff, policy? And what if you just break stuff? You just break stuff.

6
00:01:15,460 --> 00:01:16,980
Is it working now? Okay.

7
00:01:17,060 --> 00:01:17,660
Ah, there we go.

8
00:01:17,660 --> 00:01:18,320
There we go. Yeah, yeah.

9
00:01:19,860 --> 00:01:26,300
Okay, yeah, so my background is for the last 20-ish years. I've worked with people.

10
00:01:26,520 --> 00:01:26,980
I see...

11
00:01:26,980 --> 00:01:34,500
In the audience, building companies that break stuff, essentially, and helping people understand how to build things that can't be broken.

12
00:01:35,420 --> 00:01:43,220
And then I came over to Wicker because I thought it'd be fun to try and build a product that was impervious to that breaking.

13
00:01:43,480 --> 00:01:53,480
So I kind of come from the audience standpoint a little bit more, and when I took the job at Wicker, I got pulled into sort of post-election, how do we fix this stuff?

14
00:01:53,700 --> 00:01:55,860
How do we deal with these comms? How do we make them stronger?

15
00:01:56,040 --> 00:01:56,240
Yeah.

16
00:01:56,240 --> 00:01:58,320
And one of the first people I was introduced to was Robbie.

17
00:01:58,500 --> 00:02:03,500
And one of the first things I figured out is that we didn't speak a common language a lot of times.

18
00:02:03,600 --> 00:02:04,720
I didn't know what a committee was.

19
00:02:05,280 --> 00:02:06,020
He did.

20
00:02:06,260 --> 00:02:09,080
Or I thought I knew what a committee was, but I didn't.

21
00:02:09,160 --> 00:02:12,700
And so we spent a lot of time trying to figure out how to go out and help people.

22
00:02:13,000 --> 00:02:17,860
But the first thing we did is we tried to find common language around these issues.

23
00:02:18,060 --> 00:02:22,400
So that's probably the best embodiment of the goal for this talk.

24
00:02:22,800 --> 00:02:25,560
So one of the first things that I didn't understand...

25
00:02:25,560 --> 00:02:34,760
One of the first things that I looked to Robbie to understand is how was it that there were these persistent security issues in 2016 that people knew about, but they just weren't mitigated?

26
00:02:34,880 --> 00:02:38,500
Why did it take so long to really understand them and deal with them?

27
00:02:38,960 --> 00:02:46,660
Yeah, well, the interesting thing about this is the first presidential campaign I worked on was John Kerry's campaign in 2004.

28
00:02:46,880 --> 00:02:54,420
And that campaign was actually suffered a breach that got pushed out by the, I think it was the Chinese.

29
00:02:54,420 --> 00:03:00,380
And then I know that both in the 2008 and 2012 campaigns, there were also incidences.

30
00:03:02,260 --> 00:03:09,380
When we were beginning our campaign, and it's important to make a distinction, the campaign is different from the DNC.

31
00:03:09,700 --> 00:03:15,220
But when we were beginning our campaign, what we were mostly anticipating was espionage.

32
00:03:15,240 --> 00:03:20,700
So that people were going to try to break in to get information that would probably be very helpful.

33
00:03:20,780 --> 00:03:23,920
If you're trying to plan for another administration coming in, it's nice to know.

34
00:03:23,960 --> 00:03:24,180
Everything.

35
00:03:24,420 --> 00:03:28,500
You know, the campaign was talking about and different policies that were being discussed and so on.

36
00:03:28,560 --> 00:03:32,500
And probably some of the rationale behind some of, you know, what the candidate was thinking.

37
00:03:32,920 --> 00:03:34,700
So that's what we were anticipating.

38
00:03:34,900 --> 00:03:49,520
And the important thing to understand about that from a mindset perspective is if somebody goes in and gets something, but you're not imagining how they could sort of release it, then it's like, well, at the end of the day, you know, we can do so much.

39
00:03:49,520 --> 00:03:50,540
We can spend so much money.

40
00:03:50,580 --> 00:03:52,080
We can put so many resources into this.

41
00:03:52,860 --> 00:03:54,260
But, you know, I guess.

42
00:03:54,420 --> 00:03:57,840
The Chinese will be that much more intelligent about what could happen.

43
00:03:59,780 --> 00:04:08,280
So, look, from our campaign standpoint, as far as we know, and that's like people here understand that caveat much better than me, we were never breached.

44
00:04:10,240 --> 00:04:20,440
But my biggest lesson coming out of this, and I think a lesson everybody needs to take away and people in this room understand this perfectly well, is it's not just the data that you control.

45
00:04:20,560 --> 00:04:23,740
It's the data about you or that other people control.

46
00:04:23,740 --> 00:04:26,520
That can be weaponized against you.

47
00:04:26,700 --> 00:04:42,340
So I think the so having said all that, I think the entire ecosystem of our elections, of our democracy, frankly, we're not I think, first of all, didn't really believe that what happened could actually happen.

48
00:04:42,560 --> 00:04:48,380
You know, there was a lot of resistance early on when we were educated on what probably took place.

49
00:04:48,460 --> 00:04:53,320
There was a lot of resistance, this idea that it was actually the Russians, that it was actually done.

50
00:04:53,740 --> 00:04:58,020
And so I think it's really important to think about that as a retaliatory measure against things that Hillary had done and said, as Secretary of State.

51
00:04:59,620 --> 00:05:00,780
So that was one issue.

52
00:05:00,900 --> 00:05:10,520
But then again, I think because it had never happened before, look, I think law enforcement could have done a lot more to be a lot more proactive with the DNC.

53
00:05:10,520 --> 00:05:17,620
I mean, the fact that they were only calling a help desk for like a year and that they were only doing that intermittently, I think that's a problem.

54
00:05:17,780 --> 00:05:23,720
I think the DNC obviously internally could have done a lot more to shoot this up to the top and do something about it.

55
00:05:23,740 --> 00:05:34,900
And then I think there's a series of questions that are really tough around the news media and social media and what ethical obligations they have.

56
00:05:35,040 --> 00:05:40,380
And we can talk more about like France and other places where I think we saw some different strategies work.

57
00:05:42,120 --> 00:05:48,200
You know, what role they have in mitigating the ability of another country to influence our election.

58
00:05:48,360 --> 00:05:53,660
The last piece that I'd touch on, which is really complicated, I don't think we're going to figure this out for a long time, is in France.

59
00:05:53,660 --> 00:05:57,500
Again, as a good example of this, what is the government, does the government have a role?

60
00:05:57,600 --> 00:06:04,500
And then what is that role to work proactively with campaign organizations to make them more resilient to these sorts of attacks?

61
00:06:04,680 --> 00:06:05,920
That just didn't exist.

62
00:06:06,220 --> 00:06:11,920
So that was going to be my other question is law enforcement seemed not speedy to come to the rescue.

63
00:06:12,000 --> 00:06:13,640
And yet we had these past elections.

64
00:06:13,800 --> 00:06:22,140
I mean, I think probably a lot of people in this room had some knowledge of what was happening with in the geopolitical sphere, if you will, in previous elections.

65
00:06:22,140 --> 00:06:29,260
So was there something around the political climate that constituted that a call to the help desk was an appropriate reaction?

66
00:06:29,520 --> 00:06:31,180
Or what do you think really led to that?

67
00:06:31,340 --> 00:06:32,120
I don't know.

68
00:06:32,240 --> 00:06:34,940
I don't know if it was politically motivated.

69
00:06:36,800 --> 00:06:40,260
You know, James Comey said in retrospect, he would have walked over to the DNC.

70
00:06:40,640 --> 00:06:41,660
That would have been nice.

71
00:06:41,940 --> 00:06:49,540
But again, I don't like to get into too much finger pointing on all this because I think we are where we are.

72
00:06:51,140 --> 00:06:52,120
And every time.

73
00:06:52,120 --> 00:06:55,900
Everybody, everybody in this entire situation could have done a lot of things differently.

74
00:06:56,080 --> 00:06:59,240
So my focus right now is on, OK, what should they do differently?

75
00:06:59,360 --> 00:07:00,960
And, you know, this is a perfect example.

76
00:07:01,120 --> 00:07:03,400
I think there is no absolutely no reason.

77
00:07:03,460 --> 00:07:11,580
This is one of the things we're working on that law enforcement and the and the party and campaign infrastructures can't have systems in place to have those conversations.

78
00:07:11,760 --> 00:07:12,460
And they should.

79
00:07:12,700 --> 00:07:13,100
Yeah.

80
00:07:13,380 --> 00:07:17,800
So in Robbie and I first met in February, something like that after the elections.

81
00:07:17,840 --> 00:07:21,640
And again, it was it was precipitated by people trying to get me.

82
00:07:22,120 --> 00:07:22,980
I was involved in helping.

83
00:07:24,360 --> 00:07:28,360
And then we submitted a paper to talk at this conference.

84
00:07:28,480 --> 00:07:35,600
And one of the things we said is information security is now the number one priority of all elections domestically and internationally.

85
00:07:37,020 --> 00:07:38,320
Pen test that statement.

86
00:07:38,480 --> 00:07:38,500
Yeah.

87
00:07:38,700 --> 00:07:39,980
Stress test that statement.

88
00:07:40,040 --> 00:07:42,800
Do you still think that's that's a valid statement?

89
00:07:43,120 --> 00:07:43,900
Yeah, I think.

90
00:07:44,240 --> 00:07:46,140
And again, this is what we're trying to work on.

91
00:07:46,200 --> 00:07:50,460
I think if you pulled aside any campaign manager now and said.

92
00:07:51,900 --> 00:07:53,320
Obviously, do you want to get hacked?

93
00:07:53,420 --> 00:07:53,860
They'd say no.

94
00:07:54,180 --> 00:07:56,400
Do you think it's a big problem if you get hacked?

95
00:07:56,620 --> 00:07:59,140
I think most of them would say yes.

96
00:07:59,660 --> 00:08:04,920
And then I think if you ask them, have you done everything you can, they'd sort of say no, but I don't really know.

97
00:08:05,180 --> 00:08:07,020
And so there are two issues here.

98
00:08:07,140 --> 00:08:10,960
I think one is campaigns often underestimate the value of the information they have.

99
00:08:11,080 --> 00:08:15,260
I'm still hearing this today where a campaign will say, well, we don't have anything that's that great.

100
00:08:15,420 --> 00:08:18,520
And you say, well, how would you feel if that poll you did got out?

101
00:08:18,620 --> 00:08:20,440
How would you feel if the research about your campaign?

102
00:08:20,440 --> 00:08:24,900
Candidate was pushed out publicly and then they say, well, yeah, but that's really hard to find.

103
00:08:25,040 --> 00:08:31,100
So I think we need to do more culturally to get people to understand if that information exists anywhere, it's vulnerable.

104
00:08:31,840 --> 00:08:40,660
And then secondly, we need to do a much better job getting all the resources that exist, like in this room, for example, but certainly in this building today.

105
00:08:42,180 --> 00:08:49,320
Plugged into the campaign space on both sides of the aisle because we we know everything we need to do.

106
00:08:49,320 --> 00:08:57,000
I would argue to to protect certainly these midterm campaigns because they're pretty they're in the scheme of the world.

107
00:08:57,080 --> 00:08:58,860
They're pretty simple organizations.

108
00:08:59,120 --> 00:09:03,140
You know, they're anywhere from like 10 to 200 people by and large.

109
00:09:03,620 --> 00:09:11,520
Presidential campaigns are bigger and the more complex and the committees, you know, the the campaign committees or the the DNC or the RNC.

110
00:09:11,700 --> 00:09:15,700
Those are more complex. But I would even argue there we have all the tools and resources.

111
00:09:16,200 --> 00:09:18,140
We're just not we're not getting connected.

112
00:09:18,140 --> 00:09:26,980
So we've got to deal with the cultural piece and then we've got to figure out how to apply the brainpower that exists and the strategic know how and get people up to speed.

113
00:09:28,380 --> 00:09:37,660
So firsthand, I'm seeing committees and and different campaigns come to us and say, hey, we want to use a different kind of tool for communication.

114
00:09:38,080 --> 00:09:42,740
And so that's a I don't know if that's a United States thing, but it's apply a product to a problem.

115
00:09:42,980 --> 00:09:47,280
Yeah. Talk about France a little bit, because I think there was a little bit of a different approach there.

116
00:09:47,280 --> 00:09:54,780
Yeah. Well, and I'd say during and we talked about this during the campaign, our problem was we didn't know if the Russians.

117
00:09:54,920 --> 00:09:59,140
So, again, we were the campaign. We knew the DNC had been breached as a campaign.

118
00:09:59,300 --> 00:10:06,000
We we had to assume we were breached, too, until we could get a team in there to to to test that.

119
00:10:07,160 --> 00:10:10,060
And so the question came up, how do we communicate?

120
00:10:10,340 --> 00:10:14,240
How do we share documents? How do we do phone calls and how do we message each other?

121
00:10:14,360 --> 00:10:17,200
And that's where, you know, the encryption piece became key.

122
00:10:17,280 --> 00:10:23,380
So I think between Wicker and a lot of there's other solutions out there, I think that's going to be a lot better next time.

123
00:10:23,400 --> 00:10:26,460
You know, that people won't face. It's almost like a comedy.

124
00:10:26,540 --> 00:10:30,420
Sometimes we were trying to figure out, like, do we print this? Do we you know, what do we do?

125
00:10:32,040 --> 00:10:36,100
But in France, I think a few things went much better there.

126
00:10:36,780 --> 00:10:47,180
First of all, you had a non-military, non-law enforcement government agency work very proactively with all political parties together to provide them with.

127
00:10:47,280 --> 00:10:54,220
Strategies to better secure themselves. So first of all, just providing that base level security that they need.

128
00:10:54,320 --> 00:11:02,380
But also, we know that the government worked very proactively with Macron in particular when they knew that information had been stolen to set up a bunch of honeypots, basically.

129
00:11:02,500 --> 00:11:07,640
So that when it was pushed out, there'd be confusion about what was real and what wasn't.

130
00:11:07,760 --> 00:11:13,240
We, in theory, have that with DHS and they're working very hard to get into that space.

131
00:11:13,400 --> 00:11:16,680
But I think we have a long way to go in terms of having that kind of working relationship.

132
00:11:17,580 --> 00:11:23,900
Look, the other piece in France was the media was blacked out for days when that came out.

133
00:11:24,040 --> 00:11:27,540
And that's never going to happen here. That shouldn't happen in the United States.

134
00:11:27,780 --> 00:11:35,540
I would never argue for that. But I think, like I said, I think there's an important ethical discussion to be had about, let's say that information is put out.

135
00:11:36,420 --> 00:11:41,620
Every reporter I've ever worked with, and I understand where they're coming from, is going to say, well, if I don't report this, someone else will.

136
00:11:41,820 --> 00:11:46,120
So if I'm running a news organization that's supposed to keep people informed, I need to report that.

137
00:11:46,120 --> 00:11:52,060
So I also don't think the answer is the news media saying, well, don't, you know, we shouldn't mimic a blackout.

138
00:11:52,740 --> 00:11:55,540
But I do think there's important contextual information.

139
00:11:55,880 --> 00:12:07,300
And I think I think I'm certain most reporters now would say, well, if we had all the context around what was going on when these emails were put out, we, of course, would have provided that context.

140
00:12:07,420 --> 00:12:14,480
So I think there's a real question about how do we take intelligence and and get that out there faster?

141
00:12:14,480 --> 00:12:17,400
In in real time is too much to ask.

142
00:12:17,560 --> 00:12:24,280
But how can we leverage resources outside the IC community to give reporters more confidence to give that context?

143
00:12:24,700 --> 00:12:28,540
So that's just one of many things. But yeah, I mean, don't get me wrong.

144
00:12:28,660 --> 00:12:32,800
I'm interested in products being used, but I love the misdirection piece.

145
00:12:32,940 --> 00:12:35,880
I love the fact that law enforcement came together and said, here's it.

146
00:12:35,940 --> 00:12:41,920
You know, we're going to learn from what happened in the US and we're going to figure out ways to make that information less disruptible.

147
00:12:41,940 --> 00:12:44,360
Yeah, right. Because that that's a lesson that they learned.

148
00:12:44,480 --> 00:12:50,860
Here's the funny thing, too. We actually discussed doing that when we we learned very shortly before it was announced that the DNC had been breached.

149
00:12:51,140 --> 00:13:00,400
And I remember brainstorming this idea of like putting a honeypot in there so we could prove like if we saw where that popped up and we didn't do it because we were afraid nobody would believe us.

150
00:13:00,980 --> 00:13:08,780
Now, I think everything would be different. But that's where if you had a government agency partnering with you with credibility, you can do those sorts of things.

151
00:13:09,240 --> 00:13:14,460
OK, so some of my naivete around the political scene was I don't think I fully appreciated the difference between.

152
00:13:14,480 --> 00:13:19,240
The DNC and the campaign itself. And so as Robbie talked about, you know, he ran the campaign.

153
00:13:21,360 --> 00:13:26,420
And so I'm pivoting here. I'm making an assumption a lot of people in this room just from having come here for years.

154
00:13:26,840 --> 00:13:29,560
You're working on security problems for larger organizations.

155
00:13:31,760 --> 00:13:38,720
Something I didn't appreciate was that you were actually a CEO of a 5000 person startup that had to kind of grow overnight.

156
00:13:39,180 --> 00:13:42,960
And so, I mean, I've been working with companies like that for a long time.

157
00:13:42,960 --> 00:13:51,500
And I absolutely understand that it's difficult to build an organization that is growing that fast and changing that fast.

158
00:13:51,660 --> 00:13:55,600
And then to put the appropriate, you know, priority on securing your systems.

159
00:13:55,720 --> 00:13:59,260
That's kind of a heavy lift and not something I appreciated.

160
00:13:59,720 --> 00:14:07,800
So in that context, you know, if Podesta's email is the, you know, the huge thing, the tremendous thing that changed everything.

161
00:14:09,520 --> 00:14:12,880
You know, you told me that of the 5000 people you were overseeing.

162
00:14:12,880 --> 00:14:15,580
You know, 4900 were only using their phones and messaging.

163
00:14:15,760 --> 00:14:19,160
And yet it's this Gmail that had all the impact.

164
00:14:19,340 --> 00:14:23,380
How, in retrospect, would you attack those two different populations?

165
00:14:23,440 --> 00:14:26,000
The front line, I'm only going to use messaging.

166
00:14:26,700 --> 00:14:33,680
Versus, you know, kind of what is the equivalent of like a board of directors or a C-suite that's using older antiquated technology.

167
00:14:33,680 --> 00:14:40,140
Yeah. Well, I think the, I mean, look, this gets to this whole cultural issue.

168
00:14:40,360 --> 00:14:42,620
And I didn't know.

169
00:14:42,880 --> 00:14:44,280
I didn't know very much about cybersecurity at all.

170
00:14:44,380 --> 00:14:54,120
And I certainly didn't have any training in how to lead an organization when, again, it wasn't, when there was a breach that affected us so deeply.

171
00:14:54,260 --> 00:14:54,360
Right?

172
00:14:55,260 --> 00:15:01,480
And, in fact, as an example of that, the DNC had some PII taken and put out.

173
00:15:02,040 --> 00:15:04,840
Those were our donors that we, like, directed there basically.

174
00:15:05,060 --> 00:15:07,660
So we had to kind of deal with this thing across the board.

175
00:15:08,900 --> 00:15:10,300
And I don't know the answer to this.

176
00:15:10,540 --> 00:15:12,300
The cultural piece is so key.

177
00:15:12,880 --> 00:15:18,480
The staff are sensitive to understanding how their behavior could potentially lead to something that's catastrophic for the organization.

178
00:15:19,500 --> 00:15:22,600
They'll do the right thing, by and large, as much as they can.

179
00:15:22,840 --> 00:15:25,240
It's really hard to make that real until it happens.

180
00:15:26,380 --> 00:15:30,640
So I noticed, we talked about this at the beginning of the campaign.

181
00:15:30,900 --> 00:15:33,880
You know, we had, we required two-factor for the work accounts.

182
00:15:34,580 --> 00:15:37,140
You know, we had endpoint protection on the devices and everything.

183
00:15:37,320 --> 00:15:38,740
And we talked about it.

184
00:15:38,860 --> 00:15:40,760
And we talked about not clicking on the links.

185
00:15:40,760 --> 00:15:44,620
Because we were all getting phished pretty constantly.

186
00:15:46,300 --> 00:15:55,760
But, you know, I can tell you the way people behaved and the way people heard and checked into those conversations after the DNC breach was totally different.

187
00:15:56,020 --> 00:16:05,840
I think the other thing that really helped was, like, phishing our staff, you know, internally to prove to them that everybody had more work to do to be vigilant.

188
00:16:05,980 --> 00:16:09,760
That, I found, was a really helpful conversation starter.

189
00:16:12,780 --> 00:16:24,520
But, look, I think they were both, I guess they were similar in that people needed to understand, we have to start being sensitive that anything we write down could be out there.

190
00:16:24,700 --> 00:16:27,200
And we have to be sensitive about what we save.

191
00:16:27,380 --> 00:16:31,280
So another example is we auto-deleted emails after every three weeks.

192
00:16:31,300 --> 00:16:32,320
Some people were archiving.

193
00:16:32,960 --> 00:16:35,080
They changed their behavior after that happened.

194
00:16:35,240 --> 00:16:39,740
And so, you know, hopefully, I think the sad reality of more briefings.

195
00:16:39,740 --> 00:16:42,340
Is we'll have more reference points that hopefully make it more real.

196
00:16:42,740 --> 00:16:45,100
So this gets to be a wickery thing.

197
00:16:45,240 --> 00:16:46,140
So apologies in advance.

198
00:16:46,360 --> 00:16:49,760
But one of the other things I learned around ephemeral communications.

199
00:16:50,240 --> 00:16:59,800
And so, look, when I was out there, I was always thinking about attack surfaces and crown jewels and what's the thing that matters most to the company and how do you access it and how do you protect it.

200
00:17:00,040 --> 00:17:09,200
And in political context, you say things like polling data or opposition research and people are like, oh, God, yeah, that has to go.

201
00:17:09,200 --> 00:17:10,000
Right away.

202
00:17:10,200 --> 00:17:18,040
And so, you know, it's interesting how the political campaign has these pieces of information that are very different than other things.

203
00:17:18,140 --> 00:17:23,600
I mean, communications are one thing, but there are certain pieces that are not needing to be kept around.

204
00:17:23,760 --> 00:17:26,140
Can you expand on other things or why that is?

205
00:17:26,260 --> 00:17:26,880
Well, definitely.

206
00:17:26,980 --> 00:17:35,540
I mean, I think for every organization nowadays, there's the liability of maintaining something and the liability of deleting something.

207
00:17:35,660 --> 00:17:38,700
Obviously, some organizations have a legal obligation to preserve communications.

208
00:17:38,700 --> 00:17:41,260
So there's a high liability for deleting that.

209
00:17:41,640 --> 00:17:42,740
That's pretty simple.

210
00:17:43,020 --> 00:17:51,840
I think for a campaign where we have very few retention requirements, the liability of keeping anything is enormous.

211
00:17:52,480 --> 00:17:59,000
And in particular because campaigns exist to communicate a message to people.

212
00:17:59,160 --> 00:17:59,940
That's all we do.

213
00:18:00,000 --> 00:18:00,440
We communicate.

214
00:18:00,700 --> 00:18:02,900
At the end of the day, tactically, we do a ton of things.

215
00:18:03,000 --> 00:18:08,360
And a lot of times we sort of think about, well, they produce TV ads or they organize volunteers to knock on doors.

216
00:18:08,700 --> 00:18:09,960
That's all about delivering a message.

217
00:18:10,140 --> 00:18:20,280
And the killer about an information operation like what was perpetrated and the danger in any communication whatsoever getting stolen is that blocks your ability to communicate.

218
00:18:20,540 --> 00:18:31,400
Even if it's just the media talking about the fact that you had a breach instead of your own candidate's ability to get out there and just drive what you want people to understand about them.

219
00:18:31,880 --> 00:18:38,680
So that's why on it, like I've been arguing to campaigns now, just defaulting.

220
00:18:38,680 --> 00:18:39,200
This is ephemeral.

221
00:18:39,460 --> 00:18:42,340
Obviously there's exceptions when you have legal requirements.

222
00:18:42,680 --> 00:18:45,580
But there's just very little reason to keep things.

223
00:18:45,860 --> 00:18:59,700
And I even experienced situations, you know, where we had people breach retention policies who had to, you know, when I was doing congressional races, who had to spend time in depositions for hours and hours.

224
00:18:59,980 --> 00:19:02,580
In fact, we talk about redistricting nowadays.

225
00:19:02,700 --> 00:19:08,660
Republicans would try to take our e-mails and spin them into, you know, getting, defending people.

226
00:19:08,680 --> 00:19:10,320
And they would end up getting their really terrible gerrymandered maps.

227
00:19:11,480 --> 00:19:14,700
So I just think there's every incentive in the world not to keep that information.

228
00:19:15,700 --> 00:19:16,060
Okay.

229
00:19:16,240 --> 00:19:16,600
So.

230
00:19:16,760 --> 00:19:17,480
If you don't have to.

231
00:19:17,620 --> 00:19:22,300
There was some, about a decade ago, I thought some really thoughtful security people, when they were talking about red teaming exercises.

232
00:19:23,240 --> 00:19:26,800
That was about, I think, when it became more and more popular to do red teaming.

233
00:19:26,980 --> 00:19:31,800
And they would say what I really want to understand is how to deal with the PR aspect of this.

234
00:19:32,240 --> 00:19:33,300
Because that's what matters.

235
00:19:33,400 --> 00:19:34,680
You're going to try and fix the problems.

236
00:19:34,840 --> 00:19:37,080
But it's how you control the message.

237
00:19:37,080 --> 00:19:39,960
How would you have controlled the message differently in retrospect?

238
00:19:41,960 --> 00:19:43,100
That's a great question.

239
00:19:45,640 --> 00:19:58,200
I would have been more forceful about what was going on in terms of the Russians were deliberately doing this to hurt our candidate and help the other candidate.

240
00:19:59,260 --> 00:20:02,640
I think it even seemed crazy to us.

241
00:20:02,840 --> 00:20:03,600
You know what I mean?

242
00:20:04,000 --> 00:20:06,400
And it certainly seemed crazy to a lot of other people.

243
00:20:06,400 --> 00:20:10,560
And if you go back and read the early coverage, you know, it was dismissed as sort of spin.

244
00:20:10,780 --> 00:20:24,380
And I wish we had done, I think we could have done more to formally bring reporters in with numerous experts to reinforce that this wasn't just something we were concocting.

245
00:20:24,400 --> 00:20:28,200
This was a real, we were saying what we were being told by genuine experts.

246
00:20:28,440 --> 00:20:32,020
And in fairness to our communications people, they did.

247
00:20:32,100 --> 00:20:34,540
They brought, you know, experts around.

248
00:20:34,720 --> 00:20:36,380
But I think we potentially could.

249
00:20:36,400 --> 00:20:42,720
We really could have somehow raised the bar on that even more and brought in, you know, brought that into, in a more focused way.

250
00:20:44,480 --> 00:20:52,400
Not to get off track, but like Donald Trump, this is actually, I think this is the thing that Democrats are kind of like sometimes least conscious about moving forward.

251
00:20:52,540 --> 00:20:57,600
It is incredibly difficult to drive a message when Donald Trump is your opponent.

252
00:20:58,000 --> 00:20:58,480
Period.

253
00:20:58,680 --> 00:20:59,340
For starters.

254
00:20:59,900 --> 00:21:03,840
It's really hard when you got all this other stuff churning around.

255
00:21:04,240 --> 00:21:04,720
So.

256
00:21:04,720 --> 00:21:11,380
You know, I think there's a lot of different tactical things we could have done to draw more attention to our message.

257
00:21:11,640 --> 00:21:18,480
But I think back then and certainly moving forward, we've got to provide the context so that voters aren't just hearing the intriguing pieces.

258
00:21:18,780 --> 00:21:23,760
They're understanding that it's part of a broader effort that will, that changes the way they hear the information.

259
00:21:24,100 --> 00:21:24,340
Yeah.

260
00:21:24,440 --> 00:21:25,800
I mean, I'm a political expert.

261
00:21:25,960 --> 00:21:27,060
I have not become at all.

262
00:21:27,120 --> 00:21:28,340
I'm not advocating that.

263
00:21:28,420 --> 00:21:34,100
But I would imagine that people are thinking some strategic thoughts about how to deal with the information.

264
00:21:34,100 --> 00:21:39,200
And the next election cycle and how you can use that to your advantage while also trying to protect communications.

265
00:21:39,460 --> 00:21:42,080
So I think there's a lot of strategy there.

266
00:21:42,220 --> 00:21:42,500
Yeah.

267
00:21:42,600 --> 00:21:42,780
No.

268
00:21:42,880 --> 00:21:44,320
Look, I mean, we have to completely.

269
00:21:44,560 --> 00:21:45,000
Yeah.

270
00:21:45,100 --> 00:22:01,980
Not to get off on a tinder, but we have to completely start from scratch and rethink about the way people receive information about what's going on and figure out ways to help drive and control to the extent we can the narrative of campaign.

271
00:22:02,140 --> 00:22:02,840
I can't even.

272
00:22:02,840 --> 00:22:05,680
This is like my big thing that I haven't had enough time to talk about.

273
00:22:06,200 --> 00:22:07,940
I mean, look at the last few days.

274
00:22:08,300 --> 00:22:11,660
It's so hard to drive anything when Donald Trump is around.

275
00:22:11,900 --> 00:22:13,860
I mean, it's like it's like that reality show.

276
00:22:13,960 --> 00:22:20,240
It's like you've got like the the PBS, like you've got like the Lawrence Welk show and he's got like Survivor.

277
00:22:20,260 --> 00:22:21,060
You know what I mean?

278
00:22:21,140 --> 00:22:23,560
And like you're trying to like it's really hard.

279
00:22:24,120 --> 00:22:26,300
I'm going to switch gears here real quick, too.

280
00:22:26,400 --> 00:22:30,740
I I'm going to assume for this room a relatively provocative question.

281
00:22:30,840 --> 00:22:32,160
That's around policy.

282
00:22:32,160 --> 00:22:33,820
And the law around encryption.

283
00:22:34,120 --> 00:22:36,820
And there's an awful lot of discussion right now around.

284
00:22:37,300 --> 00:22:41,280
I mean, our back doors mandatory.

285
00:22:41,960 --> 00:22:43,680
And you have an opinion on that.

286
00:22:43,820 --> 00:22:51,300
I think what's more important is do you see any distinction on the left or the right in terms of someone falling into a certain camp on that issue?

287
00:22:51,440 --> 00:22:51,840
Yeah.

288
00:22:52,060 --> 00:22:56,960
Well, I think I think the good news is people in the two parties are in different places.

289
00:22:57,120 --> 00:22:59,320
You have Democrats who are definitely pro back door.

290
00:22:59,380 --> 00:23:00,640
You have Republicans are pro back door.

291
00:23:00,720 --> 00:23:02,020
And then you have people on both sides.

292
00:23:02,020 --> 00:23:02,360
You're not.

293
00:23:06,440 --> 00:23:12,340
I my answer to this would be I don't know enough to feel passionately.

294
00:23:14,280 --> 00:23:25,260
And number one and number two, when I talk to experts, the idea of building a back door opens up vulnerabilities, potentially as many as it's trying to solve.

295
00:23:27,380 --> 00:23:31,740
And there's also a legitimate argument that like that's just not possible.

296
00:23:32,020 --> 00:23:35,160
You you you create what you created back door in this technology.

297
00:23:35,800 --> 00:23:37,380
But this one doesn't have one.

298
00:23:37,520 --> 00:23:39,140
So why aren't people just going to go there?

299
00:23:39,280 --> 00:23:45,020
And so that leads me to think that it's it's it's hard to imagine how that scenario is realistic.

300
00:23:45,880 --> 00:24:01,600
All that said, the reason I start by saying I don't know enough to feel especially passionate is that I think the political space, I think this world needs to help get elected officials.

301
00:24:02,760 --> 00:24:12,060
And actually, practitioners like myself were interacting with some of those officials as candidates better educated on these issues so that there we have.

302
00:24:12,120 --> 00:24:14,000
We can look at it from multiple angles.

303
00:24:14,120 --> 00:24:17,780
I think people who want to protect lives and stop terrorists are entirely legitimate.

304
00:24:18,120 --> 00:24:22,480
And I think Alex is Alex Stamos speech earlier this week really encapsulated this.

305
00:24:22,560 --> 00:24:24,940
Well, I think everybody has really good intentions.

306
00:24:25,980 --> 00:24:32,000
But I think sometimes the policy debate isn't as productive as it could be because you have a lot of people.

307
00:24:32,000 --> 00:24:42,020
You have elected officials, many of whom just don't understand the basic technological, the basic technologies or mathematics that we're talking about here.

308
00:24:42,860 --> 00:24:44,380
So I don't know if that's OK.

309
00:24:44,540 --> 00:24:47,040
So I'm going to try and summarize a little bit.

310
00:24:47,180 --> 00:24:49,780
No, it doesn't fall on party lines, which I think is no.

311
00:24:49,880 --> 00:24:52,660
And that shouldn't. I mean, I was just going to weigh in.

312
00:24:52,720 --> 00:24:55,180
I think that would be one of the worst things that can happen here.

313
00:24:55,900 --> 00:24:59,520
I don't see that actually. I mean, we're getting drawn in that conversation quite a bit.

314
00:24:59,520 --> 00:25:01,260
And I don't see that happening.

315
00:25:02,000 --> 00:25:03,220
It would be very damaging if it did.

316
00:25:03,920 --> 00:25:06,480
I would lump cybersecurity in there in general, too.

317
00:25:06,920 --> 00:25:19,800
I think that I think this this argument we're conflating whether what Russia did is bad with whether Donald Trump did well in the election or anything else is that is horribly counterproductive and stupid.

318
00:25:21,060 --> 00:25:24,420
Democrats and Republicans should be angry about what happened.

319
00:25:24,600 --> 00:25:30,440
We know that in past elections, both campaigns were hacked and we we have to work on this together.

320
00:25:30,440 --> 00:25:33,740
And actually, so the last thing I'll say on this, this is something I'm passionate about.

321
00:25:34,860 --> 00:25:40,440
I think the political space can learn from the security space because you talk with these.

322
00:25:40,780 --> 00:25:43,420
I was at the CISO summit at Black Hat.

323
00:25:44,460 --> 00:25:46,740
They're competitors out front with their customers.

324
00:25:47,260 --> 00:25:49,600
But behind the scenes, they're working together on security.

325
00:25:49,840 --> 00:25:52,520
We've got to build that culture in the political space.

326
00:25:53,000 --> 00:26:00,420
My goal and my hope is that within a year or two, you see Republican and Democratic folks working together on this issue.

327
00:26:00,420 --> 00:26:01,200
Pretty seamlessly.

328
00:26:01,480 --> 00:26:03,980
So my I'm going to layer on there.

329
00:26:04,800 --> 00:26:06,040
It's not just political.

330
00:26:06,560 --> 00:26:08,580
It's the whole goddamn country.

331
00:26:09,620 --> 00:26:11,620
Everything is so stupid.

332
00:26:13,740 --> 00:26:15,160
It's not just political.

333
00:26:15,780 --> 00:26:16,940
It's not just military.

334
00:26:19,260 --> 00:26:24,420
It's not just the my military, but it's the people.

335
00:26:24,540 --> 00:26:26,000
And I deal with this sort of thing.

336
00:26:26,140 --> 00:26:30,400
My job is to really and truly is to protect all of you.

337
00:26:30,400 --> 00:26:30,940
All the people.

338
00:26:31,320 --> 00:26:32,880
Not just a segment.

339
00:26:33,340 --> 00:26:33,660
Right.

340
00:26:34,340 --> 00:26:37,460
And you see what you're talking about is a little bit of this, a little bit of that.

341
00:26:37,660 --> 00:26:38,100
No, no.

342
00:26:38,200 --> 00:26:39,460
It's a whole damn picture.

343
00:26:39,820 --> 00:26:40,760
Yeah, I would agree.

344
00:26:40,860 --> 00:26:45,460
What I was going to say is this is typically a bit of an activist community.

345
00:26:45,680 --> 00:26:45,900
Thank you.

346
00:26:46,000 --> 00:26:48,840
And people who want to go out and pitch in and help.

347
00:26:49,040 --> 00:26:52,660
And I'm going to tell you, it is, we're halfway there, I'm told.

348
00:26:53,640 --> 00:26:55,020
And we're about to go to Q&A.

349
00:26:55,120 --> 00:26:57,380
So if you guys want anything, I'm going to open it up.

350
00:26:57,480 --> 00:26:57,820
I'm sorry.

351
00:26:58,120 --> 00:26:58,820
No, it's not a problem.

352
00:26:58,820 --> 00:26:59,480
It's not a problem.

353
00:26:59,580 --> 00:27:02,560
What I was going to say is it's hard to understand D.C.

354
00:27:02,640 --> 00:27:03,640
Let me rephrase.

355
00:27:03,780 --> 00:27:05,560
It was hard for me to understand D.C.

356
00:27:05,600 --> 00:27:11,360
When I got pulled in and I was given an opportunity to step in and try and help people untangle some of this stuff,

357
00:27:11,780 --> 00:27:13,720
it's a different language.

358
00:27:13,760 --> 00:27:14,740
It's a different structure.

359
00:27:14,860 --> 00:27:16,480
It's a different decision-making model.

360
00:27:17,000 --> 00:27:19,140
It's not fast, for sure.

361
00:27:19,780 --> 00:27:20,220
It's education.

362
00:27:20,720 --> 00:27:20,960
Yeah.

363
00:27:21,020 --> 00:27:22,480
So you have to be patient.

364
00:27:22,540 --> 00:27:27,680
But you have to, if you really care and you want to get involved in this issue, you can definitely lean in

365
00:27:27,680 --> 00:27:29,240
and get it done.

366
00:27:29,900 --> 00:27:30,460
I don't know.

367
00:27:30,480 --> 00:27:32,780
Did you have any other questions that you wanted to ask?

368
00:27:32,860 --> 00:27:33,140
No.

369
00:27:33,540 --> 00:27:34,500
Oh, you want me to do this.

370
00:27:34,600 --> 00:27:35,040
I got you.

371
00:27:35,300 --> 00:27:38,240
Well, I'm going to do this just to say, now I see a hand back there.

372
00:27:38,280 --> 00:27:39,300
I'm going to open it up for a question.

373
00:27:39,600 --> 00:27:43,520
I think what they want you to do is walk up to the mic, even though there's not a mic.

374
00:27:43,780 --> 00:27:47,680
I'm not fully understanding why that would be the case.

375
00:27:47,940 --> 00:27:48,920
I think we give up.

376
00:27:49,100 --> 00:27:50,040
Put your hand up there.

377
00:27:50,160 --> 00:27:50,480
Yeah.

378
00:27:50,540 --> 00:27:51,840
I think you and I can share this one.

379
00:27:53,360 --> 00:27:54,360
I think this guy now.

380
00:27:54,420 --> 00:27:55,000
I'll get you.

381
00:27:55,560 --> 00:27:55,880
Yeah.

382
00:27:56,640 --> 00:28:03,000
Mr. Wink, I served in a senior role for a political party.

383
00:28:04,340 --> 00:28:08,000
I thought I could just reject.

384
00:28:09,140 --> 00:28:09,660
Sorry.

385
00:28:10,280 --> 00:28:11,140
Everybody does.

386
00:28:12,960 --> 00:28:14,020
I saw the stand.

387
00:28:14,100 --> 00:28:14,820
I figured I'd stand there.

388
00:28:14,920 --> 00:28:14,940
All right.

389
00:28:15,160 --> 00:28:16,980
I have two questions, if you don't mind.

390
00:28:17,160 --> 00:28:17,260
Yeah.

391
00:28:17,320 --> 00:28:17,340
Yeah.

392
00:28:17,340 --> 00:28:23,560
My first question is, you just claimed that both political parties were compromised this election cycle.

393
00:28:24,160 --> 00:28:24,680
No.

394
00:28:24,680 --> 00:28:24,780
No.

395
00:28:24,780 --> 00:28:25,960
I already submitted in the past.

396
00:28:26,640 --> 00:28:28,520
In 2012, they were both compromised.

397
00:28:28,540 --> 00:28:28,900
Okay.

398
00:28:28,900 --> 00:28:29,840
That answers one question.

399
00:28:29,880 --> 00:28:30,120
Okay.

400
00:28:30,120 --> 00:28:30,340
There you go.

401
00:28:30,400 --> 00:28:31,040
Thank you for the clarification.

402
00:28:31,620 --> 00:28:32,780
I mean, I don't.

403
00:28:32,780 --> 00:28:34,900
The honest answer, on 2016, I just don't know.

404
00:28:35,580 --> 00:28:41,220
We've been told that at least the Russians were trying to do the same thing to the RNC,

405
00:28:41,240 --> 00:28:42,100
whether they got in or not.

406
00:28:42,160 --> 00:28:42,700
I just don't know.

407
00:28:43,120 --> 00:28:43,480
Okay.

408
00:28:44,080 --> 00:28:47,980
My second question is that as someone who has served for a party that was not the DNC,

409
00:28:48,960 --> 00:28:53,440
to the point that was just made earlier, there are some of us who would love to engage in

410
00:28:53,440 --> 00:28:55,140
political technology across the aisle.

411
00:28:55,400 --> 00:29:00,980
And in this current commercial and political climate, it's very difficult to do so as a

412
00:29:00,980 --> 00:29:01,180
vendor.

413
00:29:01,940 --> 00:29:07,120
Is the, obviously, I'm not asking you to speak for the Democratic Party, but in your opinion,

414
00:29:07,680 --> 00:29:13,780
are we entering a world where that fungibility of allegiance is viable?

415
00:29:14,160 --> 00:29:14,980
Is viable?

416
00:29:15,260 --> 00:29:15,460
Yes.

417
00:29:16,200 --> 00:29:18,340
And I don't understand your question.

418
00:29:18,400 --> 00:29:22,740
Are you saying can people work, can like a Republican help Democrats, you mean?

419
00:29:22,900 --> 00:29:23,220
Or can...

420
00:29:23,440 --> 00:29:23,820
Can someone...

421
00:29:24,380 --> 00:29:29,740
So, traditionally, you'll find that you have to pick a side if you want to be a vendor

422
00:29:29,740 --> 00:29:30,560
in American politics.

423
00:29:30,660 --> 00:29:30,720
Yeah.

424
00:29:30,720 --> 00:29:30,980
I got it.

425
00:29:31,200 --> 00:29:33,840
How far are we away from eliminating that concept?

426
00:29:34,140 --> 00:29:34,180
Okay.

427
00:29:34,180 --> 00:29:35,340
No, it's a great question.

428
00:29:36,540 --> 00:29:37,400
So, what's that?

429
00:29:37,680 --> 00:29:38,340
It's the same thing.

430
00:29:38,640 --> 00:29:39,040
Yeah.

431
00:29:39,200 --> 00:29:39,840
It's the same thing.

432
00:29:40,180 --> 00:29:41,000
It's two.

433
00:29:41,940 --> 00:29:42,340
Yeah.

434
00:29:42,440 --> 00:29:44,020
No, it's a great question.

435
00:29:44,120 --> 00:29:50,000
So, the work I'm doing at Harvard, actually, Alex Stamos announced this in a speech on

436
00:29:50,620 --> 00:29:51,700
Tuesday, I think it was.

437
00:29:52,840 --> 00:29:57,320
So, I've partnered up with Romney's manager from 2012, and we are...

438
00:29:57,320 --> 00:30:03,640
Alex announced that we're putting together an ISO, a bipartisan ISO for campaigns and

439
00:30:03,640 --> 00:30:03,960
parties.

440
00:30:04,300 --> 00:30:09,960
So, it will serve on a bipartisan basis to provide that node that you're talking about.

441
00:30:10,060 --> 00:30:14,680
What we want to have is, first of all, a culture change where the parties are working together

442
00:30:14,680 --> 00:30:16,080
on this behind the scenes.

443
00:30:16,140 --> 00:30:18,940
We can say whatever we want about each other out front, but behind the scenes we're working

444
00:30:18,940 --> 00:30:19,160
together.

445
00:30:19,160 --> 00:30:26,740
And then, secondly, that the good news on this is I have not met a single person who

446
00:30:26,740 --> 00:30:27,620
doesn't want to help.

447
00:30:28,000 --> 00:30:33,640
So, we want to provide a place where people can bring that help and know that they are

448
00:30:33,640 --> 00:30:37,680
helping the system and our democracy and not having to pick sides.

449
00:30:38,040 --> 00:30:41,200
So, I don't know if that answers your question, but I think that's where we need to go.

450
00:30:41,960 --> 00:30:43,100
To some extent.

451
00:30:43,180 --> 00:30:48,820
I think that helping independent entities is certainly viable, but there are companies

452
00:30:48,820 --> 00:30:55,080
that have contracted for either of the two major coalition parties and for smaller parties

453
00:30:55,080 --> 00:31:00,600
that find it impossible to get business with other parties because you're painted once

454
00:31:00,600 --> 00:31:01,260
you've contracted.

455
00:31:01,460 --> 00:31:02,280
Oh, I see what you're saying.

456
00:31:03,200 --> 00:31:05,820
Yeah, I think that's just going to be a...

457
00:31:06,840 --> 00:31:09,460
We may get to a point where that's not a problem anymore.

458
00:31:09,600 --> 00:31:15,280
I think the more the parties are working behind the scenes on information sharing and threat

459
00:31:15,280 --> 00:31:18,080
awareness, we could potentially get to where you're talking about.

460
00:31:18,200 --> 00:31:18,700
But I don't...

461
00:31:18,820 --> 00:31:19,760
I don't know in the short term.

462
00:31:19,840 --> 00:31:20,160
It's interesting.

463
00:31:20,580 --> 00:31:22,600
I mean, look, I'll give you an example.

464
00:31:22,800 --> 00:31:27,620
We picked a different firm to come in and take a look at our stuff than the DNC because we didn't

465
00:31:27,620 --> 00:31:30,320
even want to have the same firm as the DNC necessarily, right?

466
00:31:31,120 --> 00:31:34,520
So, some of that, you know, you deal with this in the corporate world, too, I imagine.

467
00:31:34,620 --> 00:31:34,860
Yeah.

468
00:31:36,480 --> 00:31:36,840
Hi.

469
00:31:36,940 --> 00:31:39,240
So, I work for a large security vendor.

470
00:31:39,360 --> 00:31:43,560
I was the speaker in the session before yours and I'm very passionate about this topic.

471
00:31:43,700 --> 00:31:48,420
I actually gave a talk about doing fact checking on the indicators of compromise.

472
00:31:48,420 --> 00:31:53,260
That have been publicly released by the various companies who investigated the different

473
00:31:53,260 --> 00:31:56,600
breaches that happened in 2016 related to the different bears.

474
00:31:56,920 --> 00:31:59,780
And a comment and then a question for you.

475
00:31:59,840 --> 00:32:05,440
The comment is, as good as the security community is at sharing information internally, I still

476
00:32:05,440 --> 00:32:06,680
think we have a ways to go.

477
00:32:07,300 --> 00:32:13,920
One of the things that I learned in doing my analysis of those IOCs is that there was limited

478
00:32:13,920 --> 00:32:15,800
utility in that information.

479
00:32:16,120 --> 00:32:18,400
That there were some file hashes for example.

480
00:32:18,400 --> 00:32:21,500
That reference files that I just simply had no access to.

481
00:32:21,620 --> 00:32:22,960
And that there was no way for me to get.

482
00:32:23,140 --> 00:32:28,640
So, there was no way for me to validate that the files were what the company, you know,

483
00:32:28,660 --> 00:32:31,620
who said that they were related to such and such attack and did this certain behavior.

484
00:32:32,020 --> 00:32:34,780
You know, I wasn't able to confirm that that was the case.

485
00:32:35,860 --> 00:32:43,740
The question, though, is, you know, what we're seeing around us is a very rapid erosion of civil society.

486
00:32:44,240 --> 00:32:48,380
And we're getting to a point where it definitely feels like there's a lot of

487
00:32:48,400 --> 00:32:53,500
there's a portion of this country that will do anything and will stop at nothing to win.

488
00:32:54,180 --> 00:32:59,780
Including and, you know, obviously on top of everything that has already happened that was dirty tricks

489
00:32:59,780 --> 00:33:00,960
in the last election.

490
00:33:01,080 --> 00:33:08,400
How do we reverse that course and convince people who are very interested in winning that they

491
00:33:08,400 --> 00:33:11,900
need to do it in a way that shows that there's some legitimacy to their win.

492
00:33:12,020 --> 00:33:13,680
Otherwise, people will be upset.

493
00:33:14,620 --> 00:33:16,260
Yeah, it's a really hard question.

494
00:33:16,460 --> 00:33:18,000
I mean, I don't have a great answer.

495
00:33:18,400 --> 00:33:18,940
I'll give you some thoughts.

496
00:33:19,100 --> 00:33:23,020
I mean, I think the first thing is I think there are way more people in this country

497
00:33:23,020 --> 00:33:29,080
who want to do things the right way and have good intent than there are people who do not.

498
00:33:29,340 --> 00:33:39,260
And so I think creating a space for people who want to have a democracy that is robust

499
00:33:39,260 --> 00:33:45,700
and where we're arguing with each other but isn't sort of where ultimately, you know,

500
00:33:45,700 --> 00:33:47,140
we are greater than the sum of our parts.

501
00:33:47,140 --> 00:33:51,200
And I think the problem right now is, to your point, we're just gnawing at each other.

502
00:33:53,360 --> 00:33:59,080
So I think there's long-term value in lifting that piece up.

503
00:33:59,420 --> 00:34:06,740
I also think in campaigns we need, I think something over the last ten years that happened was

504
00:34:06,740 --> 00:34:13,820
people like me, the campaign operatives, we kind of became enamored with what we do a little too much.

505
00:34:14,000 --> 00:34:16,420
And I think the media sometimes reported, like,

506
00:34:16,420 --> 00:34:21,820
campaigns are not the voters listening to two arguments and then making the best informed decision

507
00:34:21,820 --> 00:34:24,000
and it's on them to pick the right person.

508
00:34:24,160 --> 00:34:30,200
And more about campaigns are about which team can manipulate the situation better to their advantage.

509
00:34:31,000 --> 00:34:36,960
And so I actually think part of what I've been, you know, I talk about this with some reporters sometimes,

510
00:34:37,060 --> 00:34:41,500
is, like, we've got to get, we've got to always go back to what are you,

511
00:34:41,540 --> 00:34:45,580
what's the case you're making to the voters and not what fancy, you know,

512
00:34:45,580 --> 00:34:49,520
psychographic tool do you have to manipulate people's thinking.

513
00:34:49,740 --> 00:34:54,340
Because when we celebrate that, we encourage people to go to, to do those things.

514
00:34:54,700 --> 00:34:56,260
Does that make sense? So, you know.

515
00:34:57,180 --> 00:35:01,840
The success of the current campaign, you know, shows that there is some, you know,

516
00:35:01,840 --> 00:35:04,240
effectiveness to that and that they might want to continue to do that.

517
00:35:04,240 --> 00:35:07,460
That's the narrative. I mean, that's the question I want to push on a little bit,

518
00:35:07,540 --> 00:35:14,600
is I think we're too quick sometimes to point out tactics as the reason that somebody was successful.

519
00:35:15,580 --> 00:35:17,000
And not look at bigger things.

520
00:35:17,180 --> 00:35:20,040
If there's anything I've learned in all my time in politics,

521
00:35:23,520 --> 00:35:28,380
like, a big part of why President Trump's behavior is not a problem right now

522
00:35:28,380 --> 00:35:32,520
for a lot of the electorate is the economy is doing very well.

523
00:35:32,660 --> 00:35:34,100
The stock market is doing great.

524
00:35:34,320 --> 00:35:39,040
If the stock market was losing 200 points a day, I don't think this behavior would be tolerated.

525
00:35:39,320 --> 00:35:41,780
There's those meta things, but that's never what gets written.

526
00:35:41,860 --> 00:35:43,500
It's like, oh, it's this little tactical thing.

527
00:35:43,800 --> 00:35:45,560
And so I think we need to, like, step up.

528
00:35:45,580 --> 00:35:47,280
Step back and get out of some of that.

529
00:35:47,380 --> 00:35:49,600
Because I think it encourages some of that nefarious behavior.

530
00:35:49,900 --> 00:35:51,580
I'm not saying any of this is a panacea.

531
00:35:51,640 --> 00:35:53,060
And the point you made is right.

532
00:35:53,360 --> 00:35:54,620
But, yeah.

533
00:35:54,860 --> 00:35:55,120
Thank you.

534
00:36:01,380 --> 00:36:05,340
So when you were talking about encryption and backdoors being a nonpartisan issue,

535
00:36:06,260 --> 00:36:09,680
you kind of phrased it as saying you knew people who were pro-backdoor and people who were not.

536
00:36:11,200 --> 00:36:15,400
And then you kind of went on to say you and others are not very passionate about the topics

537
00:36:15,580 --> 00:36:15,740
sometimes.

538
00:36:15,980 --> 00:36:19,220
Do you know anyone who is anti-encryption backdoor?

539
00:36:19,600 --> 00:36:25,580
Or is it largely just people who are pro or kind of undecided or don't really care, don't know which way to go?

540
00:36:25,920 --> 00:36:27,300
I'm not the best person to ask.

541
00:36:27,420 --> 00:36:30,840
But, you know, look, there's a libertarian wing of the Republican Party.

542
00:36:30,960 --> 00:36:35,420
And I think a lot of those people are very much on the record against the government doing anything,

543
00:36:35,660 --> 00:36:37,960
having any backdoor to go read people's materials.

544
00:36:38,100 --> 00:36:40,260
I think there are liberal Democrats who are in the same place.

545
00:36:41,440 --> 00:36:45,040
So I think there's lots of, you know, elected officials on record,

546
00:36:45,040 --> 00:36:45,660
both ways.

547
00:36:46,560 --> 00:36:47,740
And I think the...

548
00:36:49,000 --> 00:36:50,040
I think...

549
00:36:50,640 --> 00:36:51,840
Yeah, right.

550
00:36:52,460 --> 00:36:58,140
I think, isn't Rand Paul, I think, you know, pretty out there against it.

551
00:37:03,300 --> 00:37:06,760
Do you see those pulling a little bit more along some lines?

552
00:37:06,860 --> 00:37:09,200
You said there's a liberal and a...

553
00:37:09,920 --> 00:37:12,720
Or, sorry, a libertarian sect of the party?

554
00:37:12,860 --> 00:37:14,220
Or, you know...

555
00:37:14,220 --> 00:37:16,560
Do you see more of a line there than you see...

556
00:37:16,560 --> 00:37:17,700
No, I don't think so.

557
00:37:17,860 --> 00:37:18,600
Honestly, I don't.

558
00:37:18,620 --> 00:37:19,040
Okay, that's good.

559
00:37:19,240 --> 00:37:22,220
I think Senator Orrin Hatch is a really big defender of encryption.

560
00:37:22,620 --> 00:37:26,620
And, you know, to me, it doesn't fall on a map in a specific way.

561
00:37:27,600 --> 00:37:31,040
Geographically, party lines, it's just kind of a belief system.

562
00:37:31,480 --> 00:37:31,900
That's it.

563
00:37:32,520 --> 00:37:38,300
It's probably more, you know, but it's probably more like law enforcement versus, you know, some other...

564
00:37:38,300 --> 00:37:39,320
Like, there's a lot of...

565
00:37:39,320 --> 00:37:42,300
Honestly, I just think it's people who've had time to think about it.

566
00:37:42,300 --> 00:37:46,000
Because I think there's almost an inevitable end state of this thought process.

567
00:37:46,840 --> 00:37:51,520
And it's people who've been involved in the debate.

568
00:37:51,800 --> 00:37:52,400
It's the back door.

569
00:37:52,580 --> 00:37:53,520
Yeah, exactly.

570
00:37:53,720 --> 00:37:54,100
They're listening.

571
00:37:54,280 --> 00:37:55,440
That's been my experience.

572
00:37:55,580 --> 00:37:58,120
I mean, people who have been tasked with looking at this issue.

573
00:37:58,240 --> 00:38:00,560
And it doesn't always fall down, you know...

574
00:38:00,560 --> 00:38:02,720
Some people will take a long time looking at it.

575
00:38:02,760 --> 00:38:06,900
And they're like, yeah, we need to have an easier way to get access to these communications.

576
00:38:07,040 --> 00:38:12,020
But ultimately, it's the people who've been around the issue for a while.

577
00:38:12,020 --> 00:38:14,280
I think who end up with that inevitable...

578
00:38:14,280 --> 00:38:18,420
We've got to find a way to not mandate back doors.

579
00:38:20,120 --> 00:38:21,560
One is only having two mics.

580
00:38:21,740 --> 00:38:25,880
Okay, a quick comment to follow up on his.

581
00:38:26,120 --> 00:38:31,000
Which is to the people who are in favor of back doors for the government.

582
00:38:31,140 --> 00:38:36,440
If we can convince them that back doors can be used by bad guys as well.

583
00:38:36,580 --> 00:38:38,960
We haven't figured out a way to fix that.

584
00:38:39,120 --> 00:38:41,540
Then the question I would ask to the people who are...

585
00:38:42,020 --> 00:38:46,220
In favor of it is, how would they feel if their campaigns were hacked?

586
00:38:46,520 --> 00:38:48,060
And it was published.

587
00:38:48,780 --> 00:38:52,180
So, my question is, just to assess the risk.

588
00:38:52,400 --> 00:38:57,140
What is the data that has to be kept for governmental reasons?

589
00:38:57,300 --> 00:39:00,160
Assuming the communications are all going through Wicker.

590
00:39:00,790 --> 00:39:01,080
Yeah.

591
00:39:01,840 --> 00:39:02,700
Very little.

592
00:39:02,780 --> 00:39:06,200
There's some compliance information that you basically have to store.

593
00:39:06,620 --> 00:39:11,100
And in fact, this is why a campaign breach is...

594
00:39:12,020 --> 00:39:16,800
Sometimes the flip of a corporate breach is you don't need...

595
00:39:16,800 --> 00:39:21,740
The only reason the DNC had PII is because you need that for when President Obama was doing events, basically.

596
00:39:21,820 --> 00:39:23,700
People need to get waived by the Secret Service.

597
00:39:23,900 --> 00:39:27,160
But otherwise, all of your donor information is public anyway.

598
00:39:27,540 --> 00:39:30,880
So, for us, it's actually the information itself.

599
00:39:31,020 --> 00:39:35,760
It's not so much a financial loss as an opportunity loss.

600
00:39:36,240 --> 00:39:37,140
Does that make sense?

601
00:39:37,520 --> 00:39:38,040
Yeah.

602
00:39:43,060 --> 00:39:53,660
One of the things you mentioned was that we had a situation where we had basically a company growing up 5,000 people all at once in a very short time.

603
00:39:53,780 --> 00:39:54,320
I don't know if that's on.

604
00:39:54,420 --> 00:39:55,400
Can you guys hear this in the back?

605
00:39:55,900 --> 00:39:56,260
No.

606
00:39:59,340 --> 00:40:00,540
It's not supposed to be switched on.

607
00:40:00,540 --> 00:40:01,140
Test, test, test.

608
00:40:02,140 --> 00:40:02,660
One, two.

609
00:40:02,760 --> 00:40:03,160
One, two.

610
00:40:03,440 --> 00:40:03,760
There you go.

611
00:40:03,800 --> 00:40:04,640
Totally flushed.

612
00:40:05,160 --> 00:40:05,520
Hello.

613
00:40:05,600 --> 00:40:06,900
It's not very hygienic, but yeah.

614
00:40:07,380 --> 00:40:12,000
One of the things he mentioned was that we had a company grow up to 5,000 people.

615
00:40:12,000 --> 00:40:15,360
An organization grew up to 5,000 people all at once.

616
00:40:15,440 --> 00:40:27,180
You're going to have cultural problems with enforcing best practices with respect to compliance and making sure that people don't get phished so easily.

617
00:40:29,120 --> 00:40:41,980
Obviously, this is not an easy thing to deal with, but I would ask the question, what sort of policy recommendations might you make to make the transition to making campaigns, Republican or Democrat?

618
00:40:43,020 --> 00:40:47,000
Making them more secure as the organizations instantly grow?

619
00:40:47,660 --> 00:40:48,900
Yeah, no, it's a great question.

620
00:40:49,040 --> 00:40:50,780
I think it's a few things.

621
00:40:50,920 --> 00:40:56,400
One is just making the right tools readily available.

622
00:40:56,660 --> 00:41:02,180
So, like, a small campaign should be using a cloud-based email service with all the right settings, right?

623
00:41:02,260 --> 00:41:03,980
Like right off including two factor.

624
00:41:04,120 --> 00:41:07,560
Right off the bat, you've gotten like 90% of the way there, right?

625
00:41:09,700 --> 00:41:11,960
Those sorts of things need to be rooted in the right tools.

626
00:41:11,980 --> 00:41:13,800
And then, you know, I think it's important to be more scrutinized in the culture of campaign management.

627
00:41:13,960 --> 00:41:22,400
So when I'm setting up a campaign, I know to, like, if I go with certain cloud-based services and I use two factor, I'm in good shape.

628
00:41:22,700 --> 00:41:30,420
And then I think the third piece is getting managers in a, I mean, maybe it's because of my experience, I just think it has to start at the top.

629
00:41:30,580 --> 00:41:35,860
So just this, I mean, for example, this is ironic given the current news of the last few days.

630
00:41:36,000 --> 00:41:41,680
One of the things you're very sensitive to on a campaign is that your staff don't just wander out and talk to the press all day long, right?

631
00:41:41,740 --> 00:41:41,960
Right.

632
00:41:41,980 --> 00:41:46,860
So that is just something that you make very clear on day one.

633
00:41:46,960 --> 00:41:47,640
There are consequences.

634
00:41:48,660 --> 00:41:55,080
It should be the same thing about phishing, about what you're putting in email, about what documents are saved, what are not.

635
00:41:55,180 --> 00:41:57,460
All of that just needs to become part of the culture.

636
00:41:57,600 --> 00:42:03,020
I know that sounds sort of ethereal, but I actually think we can do that pretty quickly and it will make a huge difference.

637
00:42:03,820 --> 00:42:08,760
One thing that you mentioned is that you're working on a new ISO with a partner at a new organization you're with.

638
00:42:09,340 --> 00:42:11,960
Would this cover or would this be part of your organization?

639
00:42:11,960 --> 00:42:23,820
Yeah, our hope is that it can be, again, a clearinghouse and a place that can provide that sort of training and resource.

640
00:42:24,730 --> 00:42:30,760
We have some legal challenges we need to work through to get to that place, but yes.

641
00:42:31,020 --> 00:42:32,280
I'm sure the answer is yes, yeah.

642
00:42:37,480 --> 00:42:40,120
Kind of to build off of what he was asking.

643
00:42:40,120 --> 00:42:47,360
Where do you see state and local parties, those smaller organizations, fitting into this?

644
00:42:47,460 --> 00:42:51,320
Because I know we're talking about federal breaches and Russian hacks and stuff like that.

645
00:42:51,460 --> 00:42:57,040
But if you think about it, I mean, just last night the vote came down to 49 to 51.

646
00:42:57,300 --> 00:43:02,640
So one state election could determine policy for an entire United States.

647
00:43:02,980 --> 00:43:09,940
And I know for a fact that an remain unnamed state party has had an evil twin attack against their building.

648
00:43:09,940 --> 00:43:12,740
So they're definitely happening at that state level.

649
00:43:12,880 --> 00:43:13,740
No, absolutely.

650
00:43:14,040 --> 00:43:26,340
And, in fact, I think the most egregious and painful hacks of last time were actually against the DCCC when those self-research books about the opponents were taken and given out locally.

651
00:43:26,680 --> 00:43:35,340
So the good news, though, is if you put presidential campaigns aside, state parties and these state campaigns, congressional campaigns, state-led campaigns, they're small.

652
00:43:35,740 --> 00:43:39,920
So if we can just get them on these cloud-based, you know, email systems.

653
00:43:39,920 --> 00:43:47,540
And document sharing systems, document storage systems with the right settings, we're in, like, such a better place than we are today.

654
00:43:47,720 --> 00:43:49,420
But that's where the vulnerability is.

655
00:43:49,520 --> 00:43:53,220
Look, the other vulnerability, just quickly, is the families of people running for office.

656
00:43:54,200 --> 00:43:54,680
Right?

657
00:43:55,380 --> 00:43:57,880
I think that's the next place you're going to start to see.

658
00:43:58,400 --> 00:44:05,000
And one of my observations there would be I talked about how I'm trying to learn politics.

659
00:44:05,360 --> 00:44:08,440
The state and local level is a whole new Rubik's cube.

660
00:44:08,440 --> 00:44:13,800
And so it's heavy lifting to understand how you can help at all those levels.

661
00:44:13,900 --> 00:44:19,540
The other thing, one of the guys earlier was talking about trying to sell software into politics.

662
00:44:20,380 --> 00:44:25,240
You talk to offices and they're trying to scrape up change from the couch for laptops.

663
00:44:25,760 --> 00:44:31,800
So we're not talking about organizations, you know, that are going to buy you an island in the Caribbean.

664
00:44:31,900 --> 00:44:32,020
Right?

665
00:44:32,080 --> 00:44:34,840
You have to really want to help in this arena.

666
00:44:35,220 --> 00:44:37,680
And that's even, you know, at the higher levels.

667
00:44:37,680 --> 00:44:40,960
Getting into state and local government is going to be a difficult thing.

668
00:44:41,720 --> 00:44:49,360
So is there, I guess you kind of touched on this, but are you working on some way of getting a platform that then is affordable?

669
00:44:49,720 --> 00:44:51,940
You're talking about these cloud platforms and stuff like that.

670
00:44:52,020 --> 00:44:55,240
And you're saying, you know, we don't have the money, which is 1,000% true.

671
00:44:56,140 --> 00:45:02,580
And I know that the cost of Internet security is going way higher than people can afford that need it.

672
00:45:02,780 --> 00:45:05,880
So is there some sort of plan in the place to try to get this?

673
00:45:06,040 --> 00:45:07,660
Is that one of the questions?

674
00:45:07,660 --> 00:45:14,300
Should the, you know, government step in and be like, here is, you know, something that all campaigns can use?

675
00:45:15,900 --> 00:45:17,060
Do you want to take that first?

676
00:45:17,220 --> 00:45:18,200
I'm just going to use my voice.

677
00:45:18,280 --> 00:45:26,300
I'd say my experience has been that to go do something at the highest levels in a procurement cycle is going to take a really, really long time.

678
00:45:26,660 --> 00:45:31,020
We're just going in and trying to be as inexpensive as possible and help.

679
00:45:31,460 --> 00:45:37,060
It's not how we're kind of approaching corporate clients, but definitely in the political arena.

680
00:45:37,660 --> 00:45:41,800
If there's going to be fast change, it's not going to be done, you know, in a rat race.

681
00:45:41,880 --> 00:45:42,340
It's just not.

682
00:45:43,840 --> 00:45:44,400
Thank you.

683
00:45:44,700 --> 00:45:46,020
I have a microphone for you.

684
00:45:46,620 --> 00:45:47,280
How much time?

685
00:45:48,040 --> 00:45:49,140
I think you have a question.

686
00:45:50,240 --> 00:45:58,380
So my question focuses more on the back end aspect of doxing, where the documents were released on the Internet and the challenge that caused for the campaign.

687
00:45:59,320 --> 00:46:05,980
So you talked about kind of the data retention issue, kind of trying to get rid of your data so that it's not available.

688
00:46:06,860 --> 00:46:07,640
Let's just assume that.

689
00:46:07,640 --> 00:46:12,180
Let's assume that all the best security measures don't match up and data is released.

690
00:46:12,620 --> 00:46:21,660
How did this experience change your view on campaign strategies for protecting once your data possibly gets out there?

691
00:46:21,860 --> 00:46:28,580
How does this experience kind of affect how a campaign responds to doxing, the release of information?

692
00:46:29,920 --> 00:46:36,000
Like, I guess as a voter, one of my concerns was I saw this data, but I wasn't sure if it was accurate.

693
00:46:36,000 --> 00:46:38,520
I was wondering if it was accurate, if it was modified, the integrity of it.

694
00:46:38,800 --> 00:46:41,520
Just how do you view that and how does the situation change?

695
00:46:41,520 --> 00:46:49,780
Yeah, well, I think, again, this is where France is a great example where they prepared in advance for this to happen, right?

696
00:46:50,060 --> 00:46:53,360
So it was ‑‑ and I think this is where this will be better in the future.

697
00:46:53,500 --> 00:46:55,380
It will never happen quite like this again.

698
00:46:56,300 --> 00:47:00,700
It won't be as easy ‑‑ the media won't be weaponized so totally.

699
00:47:00,900 --> 00:47:05,420
The information won't be so purely broadcast out to people.

700
00:47:06,020 --> 00:47:11,640
So, yes, look, I think every campaign now needs to ‑‑ you know, the same way it was routine for us to sit down and say,

701
00:47:11,720 --> 00:47:15,220
what are we doing to secure our office and our emails at the beginning?

702
00:47:15,400 --> 00:47:18,260
Now you're going to sit down and say, let's imagine there's a breach.

703
00:47:18,440 --> 00:47:23,840
First of all, do a basic tabletop exercise the way that any other corporate entity does nowadays.

704
00:47:24,020 --> 00:47:26,340
But then second, let's say there's an information operation.

705
00:47:26,800 --> 00:47:33,400
What are we putting in place to disrupt that so that if stuff is stolen, there's a disruption factor within what they take?

706
00:47:33,820 --> 00:47:35,700
But then also, how are we managing that?

707
00:47:36,000 --> 00:47:38,620
You know, and we could talk about that for hours.

708
00:47:38,780 --> 00:47:41,160
But, yes, I think all that just needs to become part of the routine.

709
00:47:42,120 --> 00:47:42,520
Thanks.

710
00:47:46,780 --> 00:47:50,580
You kind of mentioned this ‑‑ hello?

711
00:47:51,540 --> 00:47:52,980
You kind of mentioned this already.

712
00:47:53,640 --> 00:48:01,160
But you said that if you knew or if you understood, like, the full extent of the Russian hacks,

713
00:48:01,760 --> 00:48:03,960
you would have, like, attempted to make a honeypot

714
00:48:03,960 --> 00:48:05,980
or you would have brought in more ‑‑

715
00:48:06,000 --> 00:48:07,800
You know, like, journalism, right?

716
00:48:08,520 --> 00:48:12,080
What do you think, like, tool-wise and also culture‑wise,

717
00:48:12,240 --> 00:48:16,900
how do you see, like, campaigns changing in the future to respond, not just to prevent,

718
00:48:17,060 --> 00:48:18,620
but also respond to hacks like this?

719
00:48:19,760 --> 00:48:27,480
Yeah, so I think the first piece that I mentioned earlier is I think there needs to be a discussion between the media,

720
00:48:27,720 --> 00:48:34,260
the news media, social media, and the political space about what ‑‑ knowing that none of us want any foreign actor

721
00:48:34,260 --> 00:48:35,980
to be able to get in and influence us.

722
00:48:35,980 --> 00:48:38,240
How are we going to handle this differently moving forward?

723
00:48:38,320 --> 00:48:40,240
And I don't want to sort of prejudge what that looks like.

724
00:48:40,600 --> 00:48:44,020
And, again, a blackout, you know, is not an option.

725
00:48:46,020 --> 00:48:51,400
And the other thing, just to be specific about it, part of why we didn't do more is because we weren't certain.

726
00:48:51,520 --> 00:48:55,180
We were told things by the experts, but a lot of people were, you know, saying that's not true.

727
00:48:55,260 --> 00:49:01,780
And we didn't ‑‑ the intelligence community didn't say until October, you know, they didn't speak out on this.

728
00:49:01,840 --> 00:49:05,900
So we didn't know if we were ‑‑ how firm the ground we were standing on was.

729
00:49:05,900 --> 00:49:07,220
You know, we had good reason to believe.

730
00:49:07,280 --> 00:49:09,940
We were talking to smart people who were very experienced.

731
00:49:10,000 --> 00:49:16,460
So I think also next time people will be a lot more firm when they say this is an information operation

732
00:49:16,460 --> 00:49:18,140
and the media will understand what they mean.

733
00:49:19,660 --> 00:49:28,220
So my observation is that we've seen this in the corporate world where it pivoted from, you know, not if but when.

734
00:49:28,400 --> 00:49:33,280
And so I'm just seeing people understand that they're going to get owned the next election cycle.

735
00:49:33,420 --> 00:49:35,580
And they're trying to understand how to deal with that.

736
00:49:35,900 --> 00:49:41,600
Not just how they protect their information, but how they're actually going to work this tabletop exercise

737
00:49:42,240 --> 00:49:48,760
such that it's not how do we protect our assets, it's when our assets get owned, what are we going to do with it.

738
00:49:49,100 --> 00:49:54,340
Someone was asking about policy, and it's a little bit radical, but Last Company really tried to push for ‑‑

739
00:49:54,340 --> 00:50:00,720
I mean, I can't imagine growing an organization like Robbie did and training people not to click on links.

740
00:50:01,260 --> 00:50:03,680
I think their policy is click on them all.

741
00:50:04,040 --> 00:50:05,880
And then build a team that can handle it.

742
00:50:05,900 --> 00:50:06,340
Right?

743
00:50:06,640 --> 00:50:11,460
That's the type of change I'm seeing in this mindset and these campaigns that's coming.

744
00:50:11,600 --> 00:50:18,400
Because, look, you can't grow something that fast and have a bunch of young, just entering the workforce people,

745
00:50:18,660 --> 00:50:21,320
even though they're probably more passionate employees.

746
00:50:21,520 --> 00:50:23,860
I imagine yours are the most passionate employees that exist.

747
00:50:24,500 --> 00:50:26,840
They're going to do the wrong thing.

748
00:50:27,000 --> 00:50:30,400
And so you have to be ready for what happens when the wrong thing is coming.

749
00:50:31,020 --> 00:50:34,600
Previous election cycles, they knew the Chinese were in there looking at their information.

750
00:50:34,600 --> 00:50:35,800
And it was just gathering.

751
00:50:35,940 --> 00:50:36,820
Nothing bad happened.

752
00:50:37,060 --> 00:50:43,380
So now they have this, you know, like white hot nasty taste of this in the back of their mouth on both sides.

753
00:50:43,500 --> 00:50:45,940
They know that this is going to be an impactful thing.

754
00:50:46,040 --> 00:50:51,180
So I think it's just more people are really, really battening down the hatches and saying, all right, this is inevitable.

755
00:50:51,460 --> 00:50:52,220
What are we going to do?

756
00:50:52,260 --> 00:50:53,440
What do we have to really protect?

757
00:50:54,000 --> 00:50:55,760
I mean, it sounds a lot like the corporate world, right?

758
00:50:55,820 --> 00:50:57,000
We've all gone through this.

759
00:50:57,200 --> 00:50:59,100
What is the most important thing to protect?

760
00:50:59,240 --> 00:51:02,200
Let's go all out, and then let's be really prepared for when it goes bad.

761
00:51:02,920 --> 00:51:04,380
And would you say that ‑‑

762
00:51:04,380 --> 00:51:19,040
To that extent, to, like, do that, you see campaigns like yours in the future beefing up their in‑house security, like, analysis or just outsourcing it to third parties?

763
00:51:19,280 --> 00:51:19,480
Totally.

764
00:51:20,580 --> 00:51:24,180
I think it would be, like, the corporate sector both, right?

765
00:51:24,260 --> 00:51:30,020
So, you know, we had security, you know, full‑time security, people this time.

766
00:51:30,300 --> 00:51:33,020
I think you'll see that dramatically expand in the future.

767
00:51:33,180 --> 00:51:34,360
But then we'll also have ‑‑

768
00:51:34,380 --> 00:51:34,740
Yeah.

769
00:51:34,740 --> 00:51:36,880
We'll have partners that we're working with, you know, from day one.

770
00:51:37,380 --> 00:51:37,780
Yep.

771
00:51:42,860 --> 00:51:46,040
So, my question was kind of based off the previous two gentlemen.

772
00:51:46,800 --> 00:51:57,720
As far as, like, when information is found and how it's delivered in situations like this, it sounds like information integrity was the biggest issue because it led hesitation to putting up honeypots and who would believe.

773
00:51:58,120 --> 00:51:58,960
I guess ‑‑

774
00:51:59,460 --> 00:52:00,660
And, I mean, I don't know.

775
00:52:00,700 --> 00:52:02,220
Going forward, it sounds like it's being worked on.

776
00:52:02,320 --> 00:52:04,220
But how can we get that information more streamlined?

777
00:52:04,360 --> 00:52:12,840
And get the intelligence community more involved to ‑‑ I mean, in a two‑party system, it's difficult because the other side is going to believe whatever they want anyway.

778
00:52:13,100 --> 00:52:13,120
Yeah.

779
00:52:13,380 --> 00:52:16,280
But, I mean, it seems like there needs to be an official policy and procedure.

780
00:52:16,560 --> 00:52:17,360
We found this.

781
00:52:17,380 --> 00:52:18,320
This is how we deliver it.

782
00:52:18,340 --> 00:52:18,820
It's factual.

783
00:52:19,080 --> 00:52:19,600
And ‑‑

784
00:52:19,600 --> 00:52:20,960
I totally agree.

785
00:52:21,300 --> 00:52:24,200
I think if we could have that, that would be awesome.

786
00:52:24,380 --> 00:52:26,180
No, and I don't mean that in, like, a dismissive way.

787
00:52:26,240 --> 00:52:26,960
I really mean that.

788
00:52:27,200 --> 00:52:28,440
That's where we need to get to.

789
00:52:28,540 --> 00:52:33,420
I don't know how we get there today in the political environment that we're in.

790
00:52:33,420 --> 00:52:36,000
And with, you know, just ‑‑ I'll leave it at that.

791
00:52:36,200 --> 00:52:39,620
But I think we've got to get where you're talking about.

792
00:52:41,040 --> 00:52:49,240
So just to be a little bit of a skeptic, now that we know that's Robbie's strategy, if we're trying to run a campaign against him, I mean, it's going to be hard.

793
00:52:49,320 --> 00:52:51,720
This is going to be the squishing of the balloon, right?

794
00:52:52,520 --> 00:53:00,080
As soon as we have a standard for how that information is distributed, you're going to figure out how you can impact the campaign based upon that standard.

795
00:53:00,300 --> 00:53:01,700
So I don't think it's a bad thing to do.

796
00:53:01,760 --> 00:53:03,400
But just that's my nefariousness.

797
00:53:03,420 --> 00:53:04,120
That's my nefarious way of looking at it.

798
00:53:04,500 --> 00:53:04,900
Okay.

799
00:53:04,960 --> 00:53:05,160
Great.

800
00:53:05,240 --> 00:53:06,980
I think we'll take one last question if you can make it quick, sir.

801
00:53:07,540 --> 00:53:08,460
Nice T‑shirt, sir.

802
00:53:08,580 --> 00:53:09,060
I love this.

803
00:53:09,600 --> 00:53:10,000
Yeah.

804
00:53:10,140 --> 00:53:11,140
So I had a question.

805
00:53:11,340 --> 00:53:33,040
So it seems like if you had a campaign that seemed like it was run legitimately and you're using all ephemeral messaging and not keeping anything unless you have to, but then at the end there was something that came out where they had colluded with a government agency or a foreign power, it seems like that it could be a really tricky scenario where there is no records.

806
00:53:33,200 --> 00:53:33,400
Right.

807
00:53:33,420 --> 00:53:35,180
There is no something to look back on what happened.

808
00:53:35,380 --> 00:53:38,080
And so it seems like we have this need for encryption.

809
00:53:38,260 --> 00:53:39,800
We have this need for ephemeral communication.

810
00:53:40,200 --> 00:53:47,380
But at the same time, we really need some ability to have accountability for who said what and who bought what, you know.

811
00:53:47,440 --> 00:53:50,740
So it seems like a really tricky, you know, problem to solve.

812
00:53:51,000 --> 00:53:52,060
I'll pass it over to Robby.

813
00:53:52,120 --> 00:53:59,280
But, yeah, I think what I'm seeing happen now is that I reference polling data and opposition books.

814
00:53:59,400 --> 00:54:01,640
And there's just stuff that comes on a really rapid scale.

815
00:54:01,760 --> 00:54:03,400
It's just, it's data.

816
00:54:07,540 --> 00:54:07,920
It's just kind of like a new data set.

817
00:54:08,000 --> 00:54:09,620
This guy used this replica and we're testing it.

818
00:54:09,620 --> 00:54:14,560
This guy used it, and it's like, oh, it's just data.

819
00:54:16,140 --> 00:54:18,000
And we don't know even if they're just trying to say, oh, here's a sample.

820
00:54:18,020 --> 00:54:19,520
And they're saying, well, this is a version of it that I've copied.

821
00:54:19,520 --> 00:54:22,480
And, you know, it's not or it's not something we're going to be able to do.

822
00:54:22,560 --> 00:54:24,820
And we don't know if it's something we can do.

823
00:54:25,620 --> 00:54:27,600
Because if you have some of these things, like we don't have any explicitly that

824
00:54:27,600 --> 00:54:32,380
people have these things, then they're just going to be able to say, you know, I've

825
00:54:32,380 --> 00:54:33,080
got to use this.

826
00:54:33,080 --> 00:54:40,320
around. Well, I'm not going to do better than the moldy bread. No, I just agree with all

827
00:54:40,320 --> 00:54:44,940
that. All this stuff is a tradeoff, right? Just the same way in our own inboxes, if we're

828
00:54:44,940 --> 00:54:49,420
erasing, the pushback I always used to get when we erased e-mails was, well, I need to go

829
00:54:49,420 --> 00:54:54,640
back and get those. And to me, the pain of losing those e-mails is always outweighed by the

830
00:54:54,640 --> 00:55:01,300
assurance that nobody can go in and mess with you. So, yeah, I just think it's a tradeoff.

831
00:55:01,300 --> 00:55:06,780
And I think in the current environment that we're in, it's better just not to have stuff

832
00:55:06,780 --> 00:55:11,120
around. But everybody's got to make that choice for themselves. I think that's it, right?

833
00:55:11,440 --> 00:55:15,540
I'm seeing a orange shirt saying no, more. Thank you. Thank you, Joel.