1 00:00:00,000 --> 00:00:02,730 - The theme that we chose for the talk this morning 2 00:00:02,730 --> 00:00:06,060 of interview our Fireside Chat without a fireside 3 00:00:06,060 --> 00:00:09,780 was the shifting nature of cyber power 4 00:00:09,780 --> 00:00:11,610 over the last four decades. 5 00:00:11,610 --> 00:00:13,320 Small topic. 6 00:00:13,320 --> 00:00:16,650 When we talk about cyber power, we often think about 7 00:00:16,650 --> 00:00:20,640 or we think we're referring to offensive operations. 8 00:00:20,640 --> 00:00:22,890 But I think that we need to focus more 9 00:00:22,890 --> 00:00:25,620 on defensive operations because they really play 10 00:00:25,620 --> 00:00:27,753 a critical role in national security. 11 00:00:28,650 --> 00:00:32,670 It reminds me of an exercise that Israel did back 12 00:00:32,670 --> 00:00:35,280 in 2013 in Tela Aviv University. 13 00:00:35,280 --> 00:00:38,880 Where they did a simulated exercise involving 14 00:00:38,880 --> 00:00:40,230 an attack that appeared to be coming 15 00:00:40,230 --> 00:00:43,980 from Iran and Iran back Hezbollah and Lebanon, 16 00:00:43,980 --> 00:00:46,620 it started with physical attacks into Tela Aviv, 17 00:00:46,620 --> 00:00:48,930 and then it escalated into cyber attacks. 18 00:00:48,930 --> 00:00:52,350 And eventually those cyber attacks spilled over into the US, 19 00:00:52,350 --> 00:00:54,660 took out the stock exchange. 20 00:00:54,660 --> 00:00:57,960 Again, this was a simulation, took out the stock exchange, 21 00:00:57,960 --> 00:01:00,180 took out air traffic control at JFK, 22 00:01:00,180 --> 00:01:04,050 caused two airplanes to crash and kill 700 people. 23 00:01:04,050 --> 00:01:05,370 And there was some confusion about 24 00:01:05,370 --> 00:01:09,450 whether Iran was responsible or whether it was Israel 25 00:01:09,450 --> 00:01:13,470 that was responsible in an effort to pull the US into a war. 26 00:01:13,470 --> 00:01:15,180 And there was an Israeli official 27 00:01:15,180 --> 00:01:17,239 who said something very interesting 28 00:01:17,239 --> 00:01:18,600 after the exercise was over. 29 00:01:18,600 --> 00:01:22,923 He said that it was very surprising to him, 30 00:01:24,330 --> 00:01:26,460 he was shocked to see how quickly cyber events 31 00:01:26,460 --> 00:01:28,500 could turn dangerously kinetic, 32 00:01:28,500 --> 00:01:31,050 when leaders were ill prepared to deal with the attacks 33 00:01:31,050 --> 00:01:34,740 on cyber domain and were under pressure to respond quickly. 34 00:01:34,740 --> 00:01:36,960 Without properly defended critical infrastructure, 35 00:01:36,960 --> 00:01:39,432 he said leaders were left with little room to maneuver 36 00:01:39,432 --> 00:01:42,330 in their decision making when an attack occurred. 37 00:01:42,330 --> 00:01:44,730 When civilian systems were struck and citizens were killed, 38 00:01:44,730 --> 00:01:47,220 leaders were under pressure to make quick decisions, 39 00:01:47,220 --> 00:01:50,040 often based on faulting incomplete information. 40 00:01:50,040 --> 00:01:53,310 Good defense then was integral... 41 00:01:53,310 --> 00:01:55,200 Sorry, good defense then was integral 42 00:01:55,200 --> 00:01:56,610 to good decision making. 43 00:01:56,610 --> 00:01:59,550 If systems were resilient and could fend off attacks, 44 00:01:59,550 --> 00:02:02,130 they wouldn't contribute to escalation. 45 00:02:02,130 --> 00:02:03,678 So I thought this is a really good illustration 46 00:02:03,678 --> 00:02:05,970 of the national security responsibility 47 00:02:05,970 --> 00:02:07,197 that owners and operators of business 48 00:02:07,197 --> 00:02:09,000 and critical infrastructure have. 49 00:02:09,000 --> 00:02:11,130 It's not just about keeping a pipeline running 50 00:02:11,130 --> 00:02:13,980 and fuel flowing, but about shoring up what essentially 51 00:02:13,980 --> 00:02:17,130 could become the frontline in a conflict. 52 00:02:17,130 --> 00:02:19,920 So, Chris, I wanna turn to you and sort of talk 53 00:02:19,920 --> 00:02:23,250 about what's... 54 00:02:23,250 --> 00:02:27,600 In your impression exactly, how important is defense? 55 00:02:27,600 --> 00:02:30,930 How important is the commercial sector, the private sector, 56 00:02:30,930 --> 00:02:35,820 really a national security and keeping systems resilient so 57 00:02:35,820 --> 00:02:38,730 that government officials have the time that they need 58 00:02:38,730 --> 00:02:42,090 to make decisions when attacks occur or preventing them? 59 00:02:42,090 --> 00:02:43,050 - Yeah, so thanks Kim. 60 00:02:43,050 --> 00:02:45,273 Thanks for that excellent introduction. 61 00:02:46,399 --> 00:02:47,850 Can everybody hear me? 62 00:02:47,850 --> 00:02:49,140 Great. 63 00:02:49,140 --> 00:02:51,690 Thanks for that excellent introduction to the topic. 64 00:02:51,690 --> 00:02:53,400 And thanks for sharing the stage today, 65 00:02:53,400 --> 00:02:55,620 I'm really looking forward to this discussion. 66 00:02:55,620 --> 00:02:57,180 I know you're supposed to ask the questions, 67 00:02:57,180 --> 00:02:58,410 I'm gonna provide some answers, 68 00:02:58,410 --> 00:03:01,440 but I think I will learn as much as anyone in the room might 69 00:03:01,440 --> 00:03:05,040 just from the nature of the discussion we're gonna have. 70 00:03:05,040 --> 00:03:08,160 I think defense is very important and I'll explain kind of 71 00:03:08,160 --> 00:03:10,200 in my opening remarks why I think that is, 72 00:03:10,200 --> 00:03:13,050 but I'll lead with an anecdote that I often tell. 73 00:03:13,050 --> 00:03:15,480 So for anybody that's heard me speak before my apologies, 74 00:03:15,480 --> 00:03:17,310 but it's one of my favorite anecdotes, 75 00:03:17,310 --> 00:03:21,300 which is the anecdote about an agency or a CEO, 76 00:03:21,300 --> 00:03:24,390 a head of organization who's walking around the building, 77 00:03:24,390 --> 00:03:27,240 happens to bump into a chief information security officer, 78 00:03:27,240 --> 00:03:30,720 not knowing quite what that is, and says you do cyber? 79 00:03:30,720 --> 00:03:32,850 I've heard all this stuff about cyber. 80 00:03:32,850 --> 00:03:34,770 How are we doing in cyber? 81 00:03:34,770 --> 00:03:37,693 And the CISO being somewhat intimidated at that moment says 82 00:03:37,693 --> 00:03:39,780 in a word, good. 83 00:03:39,780 --> 00:03:41,610 And the CEO or the head of agency now 84 00:03:41,610 --> 00:03:43,980 being somewhat embolden, says there might be a bigger, 85 00:03:43,980 --> 00:03:45,180 better, longer story here. 86 00:03:45,180 --> 00:03:46,860 Or maybe I'll tell that to my leadership team 87 00:03:46,860 --> 00:03:49,350 next time I meet them, says, how about in two words? 88 00:03:49,350 --> 00:03:50,553 Two words, not good. 89 00:03:51,480 --> 00:03:53,760 Now I tell that story not simply 90 00:03:53,760 --> 00:03:56,040 because there's a small amount of mirth in it, 91 00:03:56,040 --> 00:03:59,850 but that's actually the nature of cyberspace as we speak. 92 00:03:59,850 --> 00:04:02,190 There are things about cyberspace we 93 00:04:02,190 --> 00:04:04,140 could say are quite good. 94 00:04:04,140 --> 00:04:07,020 The use of cyberspace or the digital infrastructure 95 00:04:07,020 --> 00:04:11,220 that underpins everything we do, is what made it possible 96 00:04:11,220 --> 00:04:15,150 for us to imagine, to design, to fabricate, 97 00:04:15,150 --> 00:04:17,340 to kind of generate, to ploy, 98 00:04:17,340 --> 00:04:22,200 administer a vaccine in record time, 12 to 15 months. 99 00:04:22,200 --> 00:04:26,730 When here to four with the standard processes that will rely 100 00:04:26,730 --> 00:04:30,390 upon the kind of manual exchange of information 101 00:04:30,390 --> 00:04:33,150 at much slower rates and with much less intensity, 102 00:04:33,150 --> 00:04:34,650 would've taken many years time. 103 00:04:34,650 --> 00:04:36,600 That's good, that's hugely good. 104 00:04:36,600 --> 00:04:39,690 And what we do in our individual lives or business lives, 105 00:04:39,690 --> 00:04:42,810 what we do across societies to generate and take advantage 106 00:04:42,810 --> 00:04:45,000 of critical functions, that's good. 107 00:04:45,000 --> 00:04:47,250 But there's a lot that's not good. 108 00:04:47,250 --> 00:04:50,250 Across my experience, my time kind of in this domain, 109 00:04:50,250 --> 00:04:53,064 which now borders on 45 years, 110 00:04:53,064 --> 00:04:55,140 I think we've experienced three waves 111 00:04:55,140 --> 00:04:57,900 of what I would describe as macro attacks. 112 00:04:57,900 --> 00:05:01,680 First wave was focused on adversaries holding data 113 00:05:01,680 --> 00:05:03,180 and systems at risk. 114 00:05:03,180 --> 00:05:05,580 It's what gave rise in the early days to a focus 115 00:05:05,580 --> 00:05:06,935 on the defender's part to, 116 00:05:06,935 --> 00:05:09,570 we have to focus on the confidentiality, 117 00:05:09,570 --> 00:05:12,930 the integrity, the availability of data and systems, 118 00:05:12,930 --> 00:05:15,000 the kind of CIA triad. 119 00:05:15,000 --> 00:05:16,500 But we later learned that, 120 00:05:16,500 --> 00:05:19,050 that was merely the kind of opening round. 121 00:05:19,050 --> 00:05:20,670 The subsequent waves of attacks, 122 00:05:20,670 --> 00:05:22,980 they still held data and system at risk, 123 00:05:22,980 --> 00:05:24,420 but they then abstracted that 124 00:05:24,420 --> 00:05:26,430 into holding critical functions at risk. 125 00:05:26,430 --> 00:05:29,250 And if you're gonna try to defend critical functions, 126 00:05:29,250 --> 00:05:31,432 you have to imagine how are they generated? 127 00:05:31,432 --> 00:05:35,250 They're not merely simple abstractions of data and systems, 128 00:05:35,250 --> 00:05:37,920 they generally require collaboration between disparate 129 00:05:37,920 --> 00:05:39,270 and diverse organizations, 130 00:05:39,270 --> 00:05:42,420 often private and public organizations working together 131 00:05:42,420 --> 00:05:44,820 to generate electricity, to cause it to flow, 132 00:05:44,820 --> 00:05:46,860 to cause it to then have the right properties 133 00:05:46,860 --> 00:05:48,570 in terms of the underlying system. 134 00:05:48,570 --> 00:05:50,190 But if you're gonna defend a critical function, 135 00:05:50,190 --> 00:05:51,870 you have to defend a collaboration, 136 00:05:51,870 --> 00:05:54,570 you have to actually effect a collaboration. 137 00:05:54,570 --> 00:05:56,160 But the most recent wave of attacks 138 00:05:56,160 --> 00:05:58,557 that we've experienced were an attack on confidence. 139 00:05:58,557 --> 00:06:00,480 And kind of put all those together in thinking 140 00:06:00,480 --> 00:06:03,510 about the Colonial Pipeline attack that we suffered a year 141 00:06:03,510 --> 00:06:08,280 and a half or ago or more, the Russian criminals got into 142 00:06:08,280 --> 00:06:11,610 that system essentially by holding data at risk. 143 00:06:11,610 --> 00:06:15,330 Somebody failed to properly secure a virtual private network 144 00:06:15,330 --> 00:06:18,484 that being exposed, that attack surface being available, 145 00:06:18,484 --> 00:06:20,910 the kind of integrity availability of 146 00:06:20,910 --> 00:06:23,070 that security kind of mechanism not 147 00:06:23,070 --> 00:06:25,085 being up to snuff, got it. 148 00:06:25,085 --> 00:06:28,650 They then kind of used that to hold the kind of delivery 149 00:06:28,650 --> 00:06:30,990 of fuel stocks up and down the Eastern seaboard at risk, 150 00:06:30,990 --> 00:06:33,390 so they held the critical function at risk. 151 00:06:33,390 --> 00:06:34,860 But what really then happened 152 00:06:34,860 --> 00:06:37,080 in the most important kind of lesson from that is 153 00:06:37,080 --> 00:06:40,830 they then held the confidence of millions of people at risk. 154 00:06:40,830 --> 00:06:43,590 And what they eventually succeeded in doing was 155 00:06:43,590 --> 00:06:45,780 in defeating one, they defeated all. 156 00:06:45,780 --> 00:06:47,730 They defeated tens of millions of people because 157 00:06:47,730 --> 00:06:49,800 of a single person's error. 158 00:06:49,800 --> 00:06:51,390 We need to flip the script, 159 00:06:51,390 --> 00:06:53,850 we're not gonna shoot our way out of that. 160 00:06:53,850 --> 00:06:57,030 No amount of response, no amount of a fire drill responding 161 00:06:57,030 --> 00:06:59,070 to two and three alarm fires is going 162 00:06:59,070 --> 00:07:03,030 to restore the confidence that people didn't have that day, 163 00:07:03,030 --> 00:07:04,770 or to defend the collaboration 164 00:07:04,770 --> 00:07:06,510 that we didn't defend that day, 165 00:07:06,510 --> 00:07:10,519 or frankly, to defend kind of in the time necessary, 166 00:07:10,519 --> 00:07:13,260 the data and systems that are underneath all of that. 167 00:07:13,260 --> 00:07:15,840 The only reasonable solution is to get serious 168 00:07:15,840 --> 00:07:18,870 about defense, to make defense the new offense. 169 00:07:18,870 --> 00:07:21,210 Such that if you're an adversary in this space, 170 00:07:21,210 --> 00:07:23,100 you gotta beat at all of us to beat one of us. 171 00:07:23,100 --> 00:07:25,137 That requires an investment upfront in resilience 172 00:07:25,137 --> 00:07:27,848 and robustness, not just in data and systems, 173 00:07:27,848 --> 00:07:29,910 but in roles and responsibilities, 174 00:07:29,910 --> 00:07:31,980 that's how you defend collaboration. 175 00:07:31,980 --> 00:07:34,980 And the confidence too, so that you need to make sure 176 00:07:34,980 --> 00:07:38,310 that everyone in the system understands what role they play 177 00:07:38,310 --> 00:07:39,780 in the defense of that system so 178 00:07:39,780 --> 00:07:42,210 that everyone can participate in their own defense. 179 00:07:42,210 --> 00:07:44,760 But today we teach kids more about hot stoves 180 00:07:44,760 --> 00:07:45,983 and crossing city streets, 181 00:07:45,983 --> 00:07:48,210 than we teach them about cyberspace. 182 00:07:48,210 --> 00:07:49,230 We need to fix that. 183 00:07:49,230 --> 00:07:50,670 So do I think defense is important? 184 00:07:50,670 --> 00:07:51,600 I absolutely do. 185 00:07:51,600 --> 00:07:52,890 Defense is the new offense. 186 00:07:52,890 --> 00:07:53,970 And unless we get serious 187 00:07:53,970 --> 00:07:56,580 about defense make the investments necessary, 188 00:07:56,580 --> 00:07:58,740 we will not put cyber in its proper place, 189 00:07:58,740 --> 00:08:02,190 which I would not elevate to some new exalted status. 190 00:08:02,190 --> 00:08:04,110 I would subordinate cyber such that it 191 00:08:04,110 --> 00:08:06,723 then delivers the confidence that we want 192 00:08:06,723 --> 00:08:08,280 in our personal activities, 193 00:08:08,280 --> 00:08:10,519 our business activities or societal activities. 194 00:08:10,519 --> 00:08:12,360 If we're serious about cyber, 195 00:08:12,360 --> 00:08:14,280 we need to then bend it to our purpose. 196 00:08:14,280 --> 00:08:17,040 We need to make sure that we have confidence that we can do 197 00:08:17,040 --> 00:08:19,470 on digital infrastructure the things that we want to do. 198 00:08:19,470 --> 00:08:20,757 I think it's all about defense. 199 00:08:20,757 --> 00:08:22,765 And any amount of offense must extend 200 00:08:22,765 --> 00:08:25,920 from the defense as opposed to be imagined as something 201 00:08:25,920 --> 00:08:28,220 that plays out on a completely separate field. 202 00:08:29,310 --> 00:08:31,590 - I'm actually going to switch positions over here, 203 00:08:31,590 --> 00:08:32,940 'cause I'm having trouble hearing you. 204 00:08:32,940 --> 00:08:35,340 So I'm just gonna come down here if that's okay. 205 00:08:39,227 --> 00:08:41,483 If you wanted to move over to get us some space. 206 00:08:43,680 --> 00:08:45,600 With that in mind, I'm wondering, 207 00:08:45,600 --> 00:08:46,800 we talk a lot about defense, 208 00:08:46,800 --> 00:08:49,147 we talk a lot about the need to show up, 209 00:08:49,147 --> 00:08:50,573 to get more serious. 210 00:08:50,573 --> 00:08:52,590 But I'm wondering how we actually do this. 211 00:08:52,590 --> 00:08:54,642 Because when we have attacks, 212 00:08:54,642 --> 00:08:58,230 major attacks like Colonial Pipeline SolarWinds, 213 00:08:58,230 --> 00:09:01,290 we usually find out afterwards that there were ways things 214 00:09:01,290 --> 00:09:04,470 that they should have done in order to prevent or mitigate. 215 00:09:04,470 --> 00:09:08,280 I'm thinking about to Operation Aurora attack back in 2010 216 00:09:08,280 --> 00:09:11,130 when the attackers went after source code repositories, 217 00:09:11,130 --> 00:09:13,500 using the source code management systems. 218 00:09:13,500 --> 00:09:15,900 And Dimitri Perivoliotis said something interesting 219 00:09:15,900 --> 00:09:18,570 at the time that those systems were wide open 220 00:09:18,570 --> 00:09:20,670 because no one had ever really thought 221 00:09:20,670 --> 00:09:22,380 that those were the things that they should be protecting. 222 00:09:22,380 --> 00:09:23,370 They were protecting email, 223 00:09:23,370 --> 00:09:27,060 they were protecting consumer information, things like that. 224 00:09:27,060 --> 00:09:32,060 And so the crown jewels of these companies were left open. 225 00:09:32,070 --> 00:09:34,620 And something happened similar to that with SolarWinds, 226 00:09:34,620 --> 00:09:39,620 where after the back door was injected into the software, 227 00:09:40,230 --> 00:09:43,260 people were saying that the source code repositories 228 00:09:43,260 --> 00:09:44,820 were secured, but they hadn't thought 229 00:09:44,820 --> 00:09:46,650 to secure the build environment 230 00:09:46,650 --> 00:09:49,230 because no one had injected malware 231 00:09:49,230 --> 00:09:51,630 into software during a build before. 232 00:09:51,630 --> 00:09:54,990 So I'm wondering how we fixed this problem of a lack 233 00:09:54,990 --> 00:09:57,540 of anticipation or a lack of imagination, 234 00:09:57,540 --> 00:09:59,490 of where hackers are going to go next. 235 00:09:59,490 --> 00:10:01,590 And how do we really get companies serious 236 00:10:01,590 --> 00:10:06,590 about doing security, when they often are reactive 237 00:10:07,080 --> 00:10:08,400 rather than proactive? 238 00:10:08,400 --> 00:10:11,130 How do we instill in them the need? 239 00:10:11,130 --> 00:10:13,110 And if they may not have budget, 240 00:10:13,110 --> 00:10:14,520 they may not have the skill set. 241 00:10:14,520 --> 00:10:16,740 How do we get them up to speed and the level 242 00:10:16,740 --> 00:10:17,820 where we need them to be? 243 00:10:17,820 --> 00:10:19,320 - That's a great question. 244 00:10:19,320 --> 00:10:22,320 So first I would observe building on what you've said, 245 00:10:22,320 --> 00:10:25,590 that the problem that we face is not a technology problem, 246 00:10:25,590 --> 00:10:28,260 it's a doctrinal problem or plenary speaking, 247 00:10:28,260 --> 00:10:30,360 it's a roles and responsibilities problem. 248 00:10:30,360 --> 00:10:32,490 We actually don't know who is accountable for what 249 00:10:32,490 --> 00:10:35,820 in delivering the resilience and robustness that's required 250 00:10:35,820 --> 00:10:38,070 in digital infrastructure, not for its own sake, 251 00:10:38,070 --> 00:10:40,770 but so that it will deliver personal activities, 252 00:10:40,770 --> 00:10:43,260 business activities on and so forth, as I've mentioned. 253 00:10:43,260 --> 00:10:44,490 There are three reconciliations 254 00:10:44,490 --> 00:10:46,050 that I think need to take place. 255 00:10:46,050 --> 00:10:49,110 And these are primarily reconciliations in terms 256 00:10:49,110 --> 00:10:51,346 of how do we get a new doctrine on the table? 257 00:10:51,346 --> 00:10:54,300 We wrote an article out of my office couple of months ago, 258 00:10:54,300 --> 00:10:56,700 we called this a New Social Contract. 259 00:10:56,700 --> 00:10:59,760 Leave the term behind which may or may not be pithy enough, 260 00:10:59,760 --> 00:11:00,960 but it was essentially about 261 00:11:00,960 --> 00:11:02,730 what do we owe each other in this space? 262 00:11:02,730 --> 00:11:03,930 How do we get that right? 263 00:11:03,930 --> 00:11:06,240 And the three reconciliations I think are required is first, 264 00:11:06,240 --> 00:11:10,230 there's a vertical reconciliation in any organization. 265 00:11:10,230 --> 00:11:11,280 Just pick one. 266 00:11:11,280 --> 00:11:13,230 Where you have to make it such that the leaders 267 00:11:13,230 --> 00:11:15,270 of that organization who are responsible 268 00:11:15,270 --> 00:11:17,070 for determining what the strategy, 269 00:11:17,070 --> 00:11:18,510 what the strategic objectives, 270 00:11:18,510 --> 00:11:20,820 what the aspirations of that organization are, 271 00:11:20,820 --> 00:11:23,610 take into account not just the people resources 272 00:11:23,610 --> 00:11:25,770 that they would deploy to bring that off, 273 00:11:25,770 --> 00:11:28,620 or the big ideas that they would deploy to bring that off, 274 00:11:28,620 --> 00:11:31,410 but the use of digital infrastructure to bring that off. 275 00:11:31,410 --> 00:11:33,630 'Cause digital infrastructure is not a commodity 276 00:11:33,630 --> 00:11:35,910 in the corner, it's actually the lifeblood of most 277 00:11:35,910 --> 00:11:37,080 of these enterprises. 278 00:11:37,080 --> 00:11:39,660 And so the leaders need to think I am accountable 279 00:11:39,660 --> 00:11:42,360 for figuring out how I'm gonna use digital infrastructure, 280 00:11:42,360 --> 00:11:45,300 I am accountable for me getting whatever risks that I take, 281 00:11:45,300 --> 00:11:47,550 I need to make sure that I have the relationship 282 00:11:47,550 --> 00:11:50,460 with the information technology or the cyber people 283 00:11:50,460 --> 00:11:52,350 that would allow me to make intelligent choices, 284 00:11:52,350 --> 00:11:54,000 but it's not delegable. 285 00:11:54,000 --> 00:11:57,000 We have to make sure that the agency heads or the heads 286 00:11:57,000 --> 00:11:59,460 of organizations or boards are the accountable party 287 00:11:59,460 --> 00:12:02,550 for digital infrastructure's use. 288 00:12:02,550 --> 00:12:05,190 And as much as any other critical asset they think about, 289 00:12:05,190 --> 00:12:10,170 this is a CapEx issue, not an OpEx issue. 290 00:12:10,170 --> 00:12:11,850 You don't think about it in the formative moments 291 00:12:11,850 --> 00:12:14,070 as you're designing your business strategy, 292 00:12:14,070 --> 00:12:15,810 then you're kind of off to the races. 293 00:12:15,810 --> 00:12:17,250 But in that vertical reconciliation, 294 00:12:17,250 --> 00:12:19,260 we also need to think about what's the responsibility 295 00:12:19,260 --> 00:12:21,270 of the folks who deliver these services. 296 00:12:21,270 --> 00:12:25,080 If you ask Align, CISO, or CIO, or IT or cyber person, 297 00:12:25,080 --> 00:12:27,750 we don't have enough of them, that's for sure. 298 00:12:27,750 --> 00:12:29,640 But if you ask them what they do, 299 00:12:29,640 --> 00:12:32,310 and if they say I defend critical infrastructure 300 00:12:32,310 --> 00:12:35,220 or I defend IT, that's a good answer, 301 00:12:35,220 --> 00:12:37,170 might be a technically correct answer, 302 00:12:37,170 --> 00:12:38,370 but it's an insufficient answer. 303 00:12:38,370 --> 00:12:40,830 What they need to say is I defend the business. 304 00:12:40,830 --> 00:12:42,000 And I've read the business plan, 305 00:12:42,000 --> 00:12:44,310 I know what we're gonna do with digital infrastructure. 306 00:12:44,310 --> 00:12:46,530 I know we wanna do business in some interesting odd, 307 00:12:46,530 --> 00:12:49,170 maybe dangerous places, and I know how to actually mitigate 308 00:12:49,170 --> 00:12:52,440 the risk and deliver on the business results. 309 00:12:52,440 --> 00:12:54,120 That's a vertical reconciliation. 310 00:12:54,120 --> 00:12:56,640 There's a horizontal reconciliation across the system. 311 00:12:56,640 --> 00:12:58,500 Again, I've said that this should be focused 312 00:12:58,500 --> 00:13:01,560 on capital expenditures not operational expenditures. 313 00:13:01,560 --> 00:13:03,690 And we need to make sure that we're no longer going 314 00:13:03,690 --> 00:13:06,960 to accept that you can deliver a system 315 00:13:06,960 --> 00:13:08,910 to somebody who's using it for some purpose, 316 00:13:08,910 --> 00:13:10,860 whether it's individual or societal, 317 00:13:10,860 --> 00:13:12,960 and have made no investment 318 00:13:12,960 --> 00:13:15,300 in its inherent resilience and robustness. 319 00:13:15,300 --> 00:13:18,360 We need to allocate responsibility and accountability 320 00:13:18,360 --> 00:13:21,180 to the providers, the suppliers, the integrators, 321 00:13:21,180 --> 00:13:23,820 so that they actually invest what's required 322 00:13:23,820 --> 00:13:26,550 to make those systems inherently resilient and robust. 323 00:13:26,550 --> 00:13:27,960 They'll never be secure, 324 00:13:27,960 --> 00:13:30,630 but they need to be more inherently resilient and robust. 325 00:13:30,630 --> 00:13:31,667 We've done that with cars. 326 00:13:31,667 --> 00:13:34,890 You can't buy a car without an air safety bag, 327 00:13:34,890 --> 00:13:39,120 or a safety seatbelt, or some form of interlock brakes. 328 00:13:39,120 --> 00:13:40,080 We've done that with airplanes. 329 00:13:40,080 --> 00:13:41,250 We've done that with therapeutics. 330 00:13:41,250 --> 00:13:45,090 If cyber is as important as it is, and it is, 331 00:13:45,090 --> 00:13:47,190 we need to make sure we allocate some responsibility 332 00:13:47,190 --> 00:13:50,250 across that supply chain, so that it's not the person 333 00:13:50,250 --> 00:13:52,470 who's operating at the end of that whip chain 334 00:13:52,470 --> 00:13:55,230 who's stuck with the system that can't be defended, 335 00:13:55,230 --> 00:13:57,570 and having to wholly defend themselves against somebody 336 00:13:57,570 --> 00:14:00,390 that they actually can't beat on that given day. 337 00:14:00,390 --> 00:14:02,580 And the final reconciliation, 338 00:14:02,580 --> 00:14:05,310 if we reallocate that set of responsibilities, 339 00:14:05,310 --> 00:14:07,230 is back to that kind of formative moment 340 00:14:07,230 --> 00:14:08,490 when we build anything, 341 00:14:08,490 --> 00:14:10,320 how do we build in the resilience and robustness? 342 00:14:10,320 --> 00:14:12,690 I've mentioned that more than a time or two, 343 00:14:12,690 --> 00:14:14,640 but it's not something we do or do well, 344 00:14:14,640 --> 00:14:15,810 we just have to do that. 345 00:14:15,810 --> 00:14:17,280 I think we do those things that we 346 00:14:17,280 --> 00:14:20,220 then will have a resilient and robust infrastructure 347 00:14:20,220 --> 00:14:22,770 that then can be defended, but it won't be secure, 348 00:14:22,770 --> 00:14:24,360 it must then be defended. 349 00:14:24,360 --> 00:14:27,237 And on top of that, we must then have a collective defense. 350 00:14:27,237 --> 00:14:30,060 And we have this kind of slogan, this catchy phrase 351 00:14:30,060 --> 00:14:32,430 that we're kind of parroting around in our various venues 352 00:14:32,430 --> 00:14:35,160 where we say, we propose that from this day forward, 353 00:14:35,160 --> 00:14:37,260 if you're an aggressor in cyberspace, 354 00:14:37,260 --> 00:14:40,080 you have to beat all of us to beat one of us. 355 00:14:40,080 --> 00:14:41,790 Now, as pithy as that might be, 356 00:14:41,790 --> 00:14:43,440 what's really behind that is, 357 00:14:43,440 --> 00:14:45,720 the division of effort defense doesn't work, 358 00:14:45,720 --> 00:14:47,100 it never has worked. 359 00:14:47,100 --> 00:14:48,360 If you say to someone, 360 00:14:48,360 --> 00:14:51,450 you defend your patch of this shared space, 361 00:14:51,450 --> 00:14:52,950 you defend your patch based upon 362 00:14:52,950 --> 00:14:55,740 what little you know, what little authorities you have 363 00:14:55,740 --> 00:14:58,200 and what limited capabilities you might have 364 00:14:58,200 --> 00:15:01,530 to perhaps bring some resources to bear in that defense 365 00:15:01,530 --> 00:15:03,300 that's setting you up for disaster. 366 00:15:03,300 --> 00:15:04,710 That's essentially being in a rowboat 367 00:15:04,710 --> 00:15:05,970 where there's a hole in the other side. 368 00:15:05,970 --> 00:15:08,520 And you say to that person, holes on your side of the boat, 369 00:15:08,520 --> 00:15:09,480 I'm not gonna help you. 370 00:15:09,480 --> 00:15:11,346 Good luck with your side of the boat. 371 00:15:11,346 --> 00:15:13,140 That simply doesn't work. 372 00:15:13,140 --> 00:15:15,600 A collective defense is one where you make 373 00:15:15,600 --> 00:15:17,070 and beat all of us to beat one of us. 374 00:15:17,070 --> 00:15:19,122 It's actually beginning to happen in the Ukraine. 375 00:15:19,122 --> 00:15:21,300 Think about what's transpiring in the Ukraine. 376 00:15:21,300 --> 00:15:23,400 First, we didn't get enough credit to the Ukrainians 377 00:15:23,400 --> 00:15:26,100 for being able to defend cyber space. 378 00:15:26,100 --> 00:15:27,690 I and a whole bunch of others 379 00:15:27,690 --> 00:15:30,369 would've said early in that contest, 380 00:15:30,369 --> 00:15:34,380 that gross kind of aberration of offense applied 381 00:15:34,380 --> 00:15:36,600 against the Ukraine, that the Ukrainians would have 382 00:15:36,600 --> 00:15:38,610 a really tough time defending themselves 383 00:15:38,610 --> 00:15:40,260 in cyberspace against the Russians 384 00:15:40,260 --> 00:15:42,750 'cause the Russians numerically superior, 385 00:15:42,750 --> 00:15:45,780 lots of capability, lots of doctrine on their side. 386 00:15:45,780 --> 00:15:48,120 We didn't get enough credit to the Ukrainian's ability 387 00:15:48,120 --> 00:15:49,440 to defend themselves. 388 00:15:49,440 --> 00:15:52,050 Their interior lines, meaning that they essentially 389 00:15:52,050 --> 00:15:56,202 have back to back kind of defenders on all sides facing out, 390 00:15:56,202 --> 00:15:58,560 their ability to do the preparatory work 391 00:15:58,560 --> 00:16:01,020 to become reasonably resilient and robust, 392 00:16:01,020 --> 00:16:03,870 and their ability to kind confidence that their suppliers 393 00:16:03,870 --> 00:16:06,300 are providing inherent resilience and robustness, 394 00:16:06,300 --> 00:16:08,190 and will deliver under the terms of service 395 00:16:08,190 --> 00:16:10,260 that resilience and robustness has made 396 00:16:10,260 --> 00:16:13,110 for a collective defense that's really hard to be. 397 00:16:13,110 --> 00:16:14,850 Not impossible but hard to be. 398 00:16:14,850 --> 00:16:17,220 When Microsoft essentially delivers 399 00:16:17,220 --> 00:16:18,780 under their terms of service, 400 00:16:18,780 --> 00:16:21,570 inherent resilience and robustness, and Cisco and ISSET 401 00:16:21,570 --> 00:16:24,660 and some number of others, that's a collective defense 402 00:16:24,660 --> 00:16:25,770 that is different than what we 403 00:16:25,770 --> 00:16:28,050 would've done 5, 10, 15 years ago. 404 00:16:28,050 --> 00:16:29,640 I think that's what was required. 405 00:16:29,640 --> 00:16:32,520 I just add one further thing, which is I had the chance here 406 00:16:32,520 --> 00:16:35,520 to walk around to the various kind of activities, 407 00:16:35,520 --> 00:16:37,650 the villages that were kind of set up, 408 00:16:37,650 --> 00:16:40,860 and what I found remarkable was not just the audacity 409 00:16:40,860 --> 00:16:43,733 of the technology and the talent in those various rooms, 410 00:16:43,733 --> 00:16:46,110 but the applied purpose to which 411 00:16:46,110 --> 00:16:48,480 that's being kind of affected. 412 00:16:48,480 --> 00:16:50,340 What people were actually considering is 413 00:16:50,340 --> 00:16:52,860 how do I do something that's technologically interesting, 414 00:16:52,860 --> 00:16:55,710 stimulating new novel for some purpose 415 00:16:55,710 --> 00:16:57,998 that would then aid and vet the increase of resilience 416 00:16:57,998 --> 00:17:00,540 in an automobile or the increase of resilience 417 00:17:00,540 --> 00:17:03,090 in a piece of critical infrastructure? 418 00:17:03,090 --> 00:17:05,640 Kind of folks who actually are sharing the responsibility 419 00:17:05,640 --> 00:17:07,410 delivering critical function side by side 420 00:17:07,410 --> 00:17:09,870 in those various venues, that's very cool. 421 00:17:09,870 --> 00:17:11,850 And that muscle memory would be really useful, 422 00:17:11,850 --> 00:17:14,370 necessary for us as we defend these assets out 423 00:17:14,370 --> 00:17:15,693 in the larger society. 424 00:17:17,400 --> 00:17:19,080 - I love that you brought up Ukraine 'cause I do wanted 425 00:17:19,080 --> 00:17:20,490 to ask you a couple questions about that, 426 00:17:20,490 --> 00:17:21,840 But I'll come back to that later. 427 00:17:21,840 --> 00:17:24,000 Because you started to talk about supply chain 428 00:17:24,000 --> 00:17:26,700 and the responsibility of software vendors 429 00:17:26,700 --> 00:17:30,930 and equipment makers here to put out secure systems 430 00:17:30,930 --> 00:17:32,490 to the market. 431 00:17:32,490 --> 00:17:34,260 But there's another side of the supply chain issue. 432 00:17:34,260 --> 00:17:36,420 And of course that is the foreign manufacturing 433 00:17:36,420 --> 00:17:38,880 of devices and equipment. 434 00:17:38,880 --> 00:17:43,880 And we're talking about a situation obviously with chips 435 00:17:44,040 --> 00:17:48,660 from China and manufacturing in China that was created 436 00:17:48,660 --> 00:17:50,130 because for economic purposes, 437 00:17:50,130 --> 00:17:52,140 it was a lot cheaper to have chips manufactured there. 438 00:17:52,140 --> 00:17:52,973 It's a lot cheaper 439 00:17:52,973 --> 00:17:55,020 to have motherboards manufactured in Beijing. 440 00:17:55,950 --> 00:17:56,783 How do we... 441 00:17:56,783 --> 00:17:59,400 The government has gone in on an aggressive push 442 00:17:59,400 --> 00:18:02,880 to get Huawei systems out of telecoms. 443 00:18:02,880 --> 00:18:07,170 But how do we realistically, I guess wean ourselves 444 00:18:07,170 --> 00:18:08,940 from the reliance on systems 445 00:18:08,940 --> 00:18:12,960 that we now recognize maybe ubiquitous 446 00:18:12,960 --> 00:18:14,550 in critical infrastructure, 447 00:18:14,550 --> 00:18:17,160 and we need to walk back that reliance. 448 00:18:17,160 --> 00:18:18,450 How does that happened? 449 00:18:18,450 --> 00:18:19,410 - In two ways. 450 00:18:19,410 --> 00:18:21,750 One, and there might be some other components, 451 00:18:21,750 --> 00:18:23,280 but I'll just kind of broadly point out 452 00:18:23,280 --> 00:18:25,050 two kind of dynamics. 453 00:18:25,050 --> 00:18:27,870 One is you need to have an honest kind of eyes 454 00:18:27,870 --> 00:18:30,300 wide open recognition of what the true cost is 455 00:18:30,300 --> 00:18:32,820 and relying on kind of foreign produced 456 00:18:32,820 --> 00:18:34,590 critical infrastructure. 457 00:18:34,590 --> 00:18:37,080 If it comes from a country like China or Russia 458 00:18:37,080 --> 00:18:39,840 where the legal system is not one that deals 459 00:18:39,840 --> 00:18:42,450 with privacy interest, proprietary interest, 460 00:18:42,450 --> 00:18:44,310 in a manner that you're comfortable with. 461 00:18:44,310 --> 00:18:46,812 The true cost of that is not to be measured in the dollars 462 00:18:46,812 --> 00:18:48,660 or the Yuan that you spend, 463 00:18:48,660 --> 00:18:51,930 is to be measured in the opportunity costs you have, 464 00:18:51,930 --> 00:18:53,520 about the lack of confidence you have, 465 00:18:53,520 --> 00:18:56,100 and how your information's gonna be protected, 466 00:18:56,100 --> 00:18:58,020 or the competitive disadvantage you're at 467 00:18:58,020 --> 00:19:00,450 when that information is then used for purposes 468 00:19:00,450 --> 00:19:02,280 that are then gonna be used directly against you 469 00:19:02,280 --> 00:19:04,800 in an economic or in national security context. 470 00:19:04,800 --> 00:19:07,050 So we need to be serious in understanding 471 00:19:07,050 --> 00:19:08,280 what the true cost is. 472 00:19:08,280 --> 00:19:11,310 Having said that, just saying no is not the answer. 473 00:19:11,310 --> 00:19:13,470 We can't just rip and replace this stuff 474 00:19:13,470 --> 00:19:15,660 if we don't have anything to replace it with. 475 00:19:15,660 --> 00:19:17,640 And so we need to actually fill that vacuum 476 00:19:17,640 --> 00:19:20,880 with material equipment systems, 477 00:19:20,880 --> 00:19:23,790 systems of systems that we do have confidence in. 478 00:19:23,790 --> 00:19:25,680 We might not onshore all of that, 479 00:19:25,680 --> 00:19:27,690 but we need to make sure that we reassure that 480 00:19:27,690 --> 00:19:29,490 to places where we have confidence. 481 00:19:29,490 --> 00:19:31,830 Both in the manufacturing and the resilience 482 00:19:31,830 --> 00:19:33,180 that's invested in that, 483 00:19:33,180 --> 00:19:35,880 and in the legal systems that essentially govern that. 484 00:19:35,880 --> 00:19:39,030 The administration, the Biden, Harris administration, 485 00:19:39,030 --> 00:19:43,080 just signed into law, the kind of the legislature just, 486 00:19:43,080 --> 00:19:46,380 I think magnificently kind of generated something called 487 00:19:46,380 --> 00:19:48,210 the CHIPS and Science Act. 488 00:19:48,210 --> 00:19:51,360 52 billion that we're now about to invest 489 00:19:51,360 --> 00:19:54,180 and essentially filling that vacuum to ensure that 490 00:19:54,180 --> 00:19:56,430 if chips are a fundamental commodity 491 00:19:56,430 --> 00:19:59,280 in the economic security, the national security 492 00:19:59,280 --> 00:20:02,250 of everything that we do and it's a matter 493 00:20:02,250 --> 00:20:03,840 of extension important to all 494 00:20:03,840 --> 00:20:05,280 of our individual activities as well. 495 00:20:05,280 --> 00:20:07,980 You can't buy a car if we can't buy chips. 496 00:20:07,980 --> 00:20:09,210 We need to actually make it such 497 00:20:09,210 --> 00:20:11,370 that we can build those again here. 498 00:20:11,370 --> 00:20:13,800 Good news is as we retain in the United States 499 00:20:13,800 --> 00:20:16,050 and like-minded nations, the Netherlands comes quickly 500 00:20:16,050 --> 00:20:20,010 to mind the ability to innovate that technology. 501 00:20:20,010 --> 00:20:22,230 But we do not have the ability to manufacture, 502 00:20:22,230 --> 00:20:24,120 and we need to actually make the investments required 503 00:20:24,120 --> 00:20:24,953 to do that. 504 00:20:26,760 --> 00:20:28,950 - To touch on the Ukraine issue, 505 00:20:28,950 --> 00:20:30,780 and you mentioned Microsoft, 506 00:20:30,780 --> 00:20:33,960 we have had a lot of reports on a lot of public declarations 507 00:20:33,960 --> 00:20:36,220 from companies like Microsoft, Cisco, Mandiant, 508 00:20:36,220 --> 00:20:40,050 about their assistance given to Ukraine prior 509 00:20:40,050 --> 00:20:43,380 to the invasion in the midst of the invasion and since then. 510 00:20:43,380 --> 00:20:46,110 And they've talked about defending government systems 511 00:20:46,110 --> 00:20:48,990 in some cases, moving data out of Ukraine. 512 00:20:48,990 --> 00:20:53,990 I'm wondering if this puts the private companies in any kind 513 00:20:54,960 --> 00:20:56,643 of risk of repercussions. 514 00:20:58,950 --> 00:21:01,620 We don't know the full limits of what they're engaging in. 515 00:21:01,620 --> 00:21:02,940 Presumably it's just defense. 516 00:21:02,940 --> 00:21:04,920 But if you're talking about defending military systems 517 00:21:04,920 --> 00:21:06,070 and government systems, 518 00:21:07,590 --> 00:21:09,660 and what is the calculus that is made 519 00:21:09,660 --> 00:21:11,130 by these private companies? 520 00:21:11,130 --> 00:21:13,650 Is there a potential for a risk against their own people, 521 00:21:13,650 --> 00:21:17,280 their own data centers, their own operations, 522 00:21:17,280 --> 00:21:19,140 that they might be the target 523 00:21:19,140 --> 00:21:21,810 of some kind of repercussive activity? 524 00:21:21,810 --> 00:21:22,978 - Well, as I see it, 525 00:21:22,978 --> 00:21:25,290 I can't tell you how Vladimir Putin sees it. 526 00:21:25,290 --> 00:21:27,660 But as I see it, shouldn't be. 527 00:21:27,660 --> 00:21:31,140 I gotta notice two weeks ago from the manufacturer 528 00:21:31,140 --> 00:21:33,810 of my car saying that they had found a safety defect 529 00:21:33,810 --> 00:21:35,610 in the car and they wanted me to bring the car back 530 00:21:35,610 --> 00:21:38,430 in so they could fix it. It's a hugely good thing. 531 00:21:38,430 --> 00:21:40,620 I think that, that actually is a necessary part 532 00:21:40,620 --> 00:21:43,890 of their terms of service, because that car needs to be safe 533 00:21:43,890 --> 00:21:45,720 for me to drive it from point a to point B. 534 00:21:45,720 --> 00:21:46,980 I expect it to be safe. 535 00:21:46,980 --> 00:21:49,050 I expect them to then vouch safe 536 00:21:49,050 --> 00:21:50,910 across the life of that car, 537 00:21:50,910 --> 00:21:52,860 or at least the warranty of that car for the safety, 538 00:21:52,860 --> 00:21:54,480 the resilience, the robustness of it. 539 00:21:54,480 --> 00:21:58,410 That's what I see Cisco, and Microsoft, and ESET and others. 540 00:21:58,410 --> 00:22:00,990 That's an illustrative list, not an exhaustive list. 541 00:22:00,990 --> 00:22:03,120 Doing for the products and services that to deliver 542 00:22:03,120 --> 00:22:05,640 to customers in the Ukraine or elsewhere. 543 00:22:05,640 --> 00:22:07,470 If they find a problem in that, 544 00:22:07,470 --> 00:22:10,080 whether that problem is posed kind of in the form 545 00:22:10,080 --> 00:22:12,270 of an inherent vulnerability in the software, 546 00:22:12,270 --> 00:22:14,370 maybe it's a zero day that's been discovered, 547 00:22:14,370 --> 00:22:16,470 or maybe it's the manner in which some adversary 548 00:22:16,470 --> 00:22:19,140 might take advantage of that, it's the adversary's doctrine, 549 00:22:19,140 --> 00:22:22,350 but they can shore that up and make it more defensible. 550 00:22:22,350 --> 00:22:24,900 It is I think an appropriate act of under the terms 551 00:22:24,900 --> 00:22:26,400 of service defense. 552 00:22:26,400 --> 00:22:30,360 It's not provocative, it's not imposing in any particular 553 00:22:30,360 --> 00:22:33,420 effect on a transgressor in that space. 554 00:22:33,420 --> 00:22:35,220 If it is imposing a cost on Russia, 555 00:22:35,220 --> 00:22:37,050 it's only because it's more costly for Russia 556 00:22:37,050 --> 00:22:39,630 to do something that's already inappropriate. 557 00:22:39,630 --> 00:22:43,710 Attacking kind of honest, legitimate users of those services 558 00:22:43,710 --> 00:22:44,820 across the world. 559 00:22:44,820 --> 00:22:46,350 So I think it's entirely appropriate. 560 00:22:46,350 --> 00:22:49,410 And I think it's high time that if you're a provider 561 00:22:49,410 --> 00:22:52,440 of a commodity service, that you think about what's 562 00:22:52,440 --> 00:22:54,870 the inherent resilience and robustness that I 563 00:22:54,870 --> 00:22:57,840 should deliver hand in glove with that? 564 00:22:57,840 --> 00:22:59,760 If that's the only place where that can be done 565 00:22:59,760 --> 00:23:02,670 at scope and scale, then that is the most appropriate place 566 00:23:02,670 --> 00:23:03,503 to do it. 567 00:23:05,610 --> 00:23:07,680 - So the US sent other nations have been talking 568 00:23:07,680 --> 00:23:09,960 for a long time about setting cyber norms. 569 00:23:09,960 --> 00:23:13,110 And they've been having some trouble coming to agreement. 570 00:23:13,110 --> 00:23:14,130 There's some basic agreements 571 00:23:14,130 --> 00:23:16,803 about not attacking civilian critical infrastructure, 572 00:23:18,570 --> 00:23:20,880 but with regarding to get into detail about a lot 573 00:23:20,880 --> 00:23:24,030 of other norms, there's some difficulty because nations 574 00:23:24,030 --> 00:23:25,950 are reluctance to give up some capabilities they 575 00:23:25,950 --> 00:23:27,330 might want to use. 576 00:23:27,330 --> 00:23:30,090 How do we arrive at norms when countries want 577 00:23:30,090 --> 00:23:31,680 to preserve options? 578 00:23:31,680 --> 00:23:34,200 And how do you set norms when you can't be certain, 579 00:23:34,200 --> 00:23:36,510 for example, that subsequent administration, 580 00:23:36,510 --> 00:23:40,950 subsequent governments might not adhere to them? 581 00:23:40,950 --> 00:23:44,500 - Actually, I see that there's more agreement in norms 582 00:23:45,978 --> 00:23:47,670 than that might suggest. 583 00:23:47,670 --> 00:23:50,190 So the global group of experts from the United Nations, 584 00:23:50,190 --> 00:23:51,720 and I think I saw Chris Painter here. 585 00:23:51,720 --> 00:23:54,570 So kudos to Chris and his colleagues were doing this. 586 00:23:54,570 --> 00:23:58,230 Delivered in about 2015 a set of norms that the US 587 00:23:58,230 --> 00:24:00,630 and of great many other nations affirmed. 588 00:24:00,630 --> 00:24:04,530 And the that were defined 589 00:24:04,530 --> 00:24:07,650 then remain the norms United States subscribes to 590 00:24:07,650 --> 00:24:10,110 in terms of what we would do, should do, 591 00:24:10,110 --> 00:24:11,733 will do in peace time. 592 00:24:12,780 --> 00:24:14,790 I think those norms have had an effect, 593 00:24:14,790 --> 00:24:16,620 not simply in giving people the sense as 594 00:24:16,620 --> 00:24:17,970 to what's appropriate and inappropriate, 595 00:24:17,970 --> 00:24:20,457 but it is unified and brought together like-minded nations. 596 00:24:20,457 --> 00:24:22,590 And so they have an effect more 597 00:24:22,590 --> 00:24:24,750 than simply telling potential adversaries 598 00:24:24,750 --> 00:24:27,210 what's on or off limits, 599 00:24:27,210 --> 00:24:30,150 but rather to find and unify like-minded nations 600 00:24:30,150 --> 00:24:32,790 so that they increasingly create common cause 601 00:24:32,790 --> 00:24:35,610 and defenses that are appropriate of those norms. 602 00:24:35,610 --> 00:24:37,500 60 nations gathered in the White House 603 00:24:37,500 --> 00:24:39,330 about three months ago to sign something 604 00:24:39,330 --> 00:24:41,940 called a Declaration for the Internet. 605 00:24:41,940 --> 00:24:44,280 My bet is those 60 nations would find a lot 606 00:24:44,280 --> 00:24:46,530 of other things they couldn't agree about, 607 00:24:46,530 --> 00:24:47,610 but they agreed on that. 608 00:24:47,610 --> 00:24:50,790 They agreed that the principles of a free and open internet 609 00:24:50,790 --> 00:24:53,610 that serves the needs of respected societies, 610 00:24:53,610 --> 00:24:55,920 was important enough that they would sign up to that. 611 00:24:55,920 --> 00:24:57,900 Now the hard work before us is how do we actually 612 00:24:57,900 --> 00:25:00,840 then implement that in the practices principles 613 00:25:00,840 --> 00:25:02,760 and the collective defenses that we would mount 614 00:25:02,760 --> 00:25:03,810 on top of that? 615 00:25:03,810 --> 00:25:06,000 I do think that it's problematic, 616 00:25:06,000 --> 00:25:08,850 because there are some things that look like they're 617 00:25:08,850 --> 00:25:11,040 on the edge and they're not clean and crisp 618 00:25:11,040 --> 00:25:12,810 in terms of absolute boundaries, 619 00:25:12,810 --> 00:25:14,790 but the norms generally are I think, 620 00:25:14,790 --> 00:25:17,733 reasonably well defined and generally well subscribed to. 621 00:25:18,810 --> 00:25:20,220 - So speaking about norms 622 00:25:20,220 --> 00:25:22,050 and we were talking a bit about Ukraine, 623 00:25:22,050 --> 00:25:24,960 I wanted to sort of pivot to the activism 624 00:25:24,960 --> 00:25:26,160 that we're seeing out of Ukraine. 625 00:25:26,160 --> 00:25:28,650 You talked about the resilience and the defense, 626 00:25:28,650 --> 00:25:31,320 and there's this other side that the Ukraine is engaging 627 00:25:31,320 --> 00:25:35,670 in with regard to the IT army and eliciting assistance 628 00:25:35,670 --> 00:25:38,580 from volunteers to launch cyber attacks 629 00:25:38,580 --> 00:25:40,230 against Russian infrastructure. 630 00:25:40,230 --> 00:25:44,640 So Western countries have been very silent 631 00:25:44,640 --> 00:25:45,762 about this activity. 632 00:25:45,762 --> 00:25:49,650 And I wanted to ask if we are setting a precedent 633 00:25:49,650 --> 00:25:52,470 for these kinds of operations. 634 00:25:52,470 --> 00:25:54,930 Obviously there there's extenuating circumstances here, 635 00:25:54,930 --> 00:25:56,493 this is the time of war. 636 00:25:57,540 --> 00:26:01,770 But there are concerns that once you've engaged 637 00:26:01,770 --> 00:26:04,020 this kind of force, this kind of volunteer force, 638 00:26:04,020 --> 00:26:07,590 you can't really put it back in the well, 639 00:26:07,590 --> 00:26:12,590 especially if you're engaging actors like anonymous. 640 00:26:13,050 --> 00:26:17,160 And so I'm curious what you would say 641 00:26:17,160 --> 00:26:20,400 and what government's positions should be on this. 642 00:26:20,400 --> 00:26:23,610 Particularly with regard to Ukraine, 643 00:26:23,610 --> 00:26:28,260 it hasn't been just sort of anonymous volunteers. 644 00:26:28,260 --> 00:26:31,080 They're a case of two companies based in Estonia, 645 00:26:31,080 --> 00:26:35,220 who one built a DDoS attacks tool 646 00:26:35,220 --> 00:26:38,370 for the IT army and others to use. 647 00:26:38,370 --> 00:26:40,140 They're usually as a security company, 648 00:26:40,140 --> 00:26:42,360 usually involved in defensive activities. 649 00:26:42,360 --> 00:26:46,050 And then the other one launched a bug bounty program calling 650 00:26:46,050 --> 00:26:48,690 for vulnerabilities and rushing critical infrastructure 651 00:26:48,690 --> 00:26:51,930 that they plan to hand off to Ukrainian intelligence 652 00:26:51,930 --> 00:26:54,390 and cyber operators to attack those systems. 653 00:26:54,390 --> 00:26:56,310 So where should we be? 654 00:26:56,310 --> 00:26:59,700 Should we be concerned that this is setting a precedent 655 00:26:59,700 --> 00:27:01,380 that we won't be able to control? 656 00:27:01,380 --> 00:27:03,600 - Yeah, I think the law, at least for the United States 657 00:27:03,600 --> 00:27:04,433 is pretty clear here. 658 00:27:04,433 --> 00:27:06,720 The Computer Fraud and Abuse Act of 1986, 659 00:27:06,720 --> 00:27:11,220 makes it clear that there are limits for individuals 660 00:27:11,220 --> 00:27:14,130 who operate using their own authority in terms 661 00:27:14,130 --> 00:27:15,330 of what they're allowed to do. 662 00:27:15,330 --> 00:27:18,450 And the United States government, despite the fact that, 663 00:27:18,450 --> 00:27:20,973 that law is got some kind of age on it, 664 00:27:21,810 --> 00:27:24,240 still of the opinion that it will not condone 665 00:27:24,240 --> 00:27:28,710 nor will it support individuals violating the standing law. 666 00:27:28,710 --> 00:27:30,332 So I think that's very clear. 667 00:27:30,332 --> 00:27:34,320 That being said, there's a way to take this enormous talent 668 00:27:34,320 --> 00:27:37,980 and it's represented in this room and outside these halls. 669 00:27:37,980 --> 00:27:39,300 So there's a way to take that talent. 670 00:27:39,300 --> 00:27:43,050 And within the kind of rule of law apply that appropriately 671 00:27:43,050 --> 00:27:46,590 to help identify what flaws might exist in our architecture, 672 00:27:46,590 --> 00:27:49,440 so that we can then through bug bounty programs or red team 673 00:27:49,440 --> 00:27:53,220 or white teams find and kind of patch those 674 00:27:53,220 --> 00:27:56,280 to better understand how we can affect a collective defense. 675 00:27:56,280 --> 00:27:58,599 That talent is hugely valuable and can, 676 00:27:58,599 --> 00:28:01,620 and should be applied under the rule of law for the purposes 677 00:28:01,620 --> 00:28:02,760 that I've described earlier 678 00:28:02,760 --> 00:28:04,560 and what a defense might look like. 679 00:28:04,560 --> 00:28:07,620 But operating outside the bounds of that law, 680 00:28:07,620 --> 00:28:11,160 remains kind of unlawful for the United States. 681 00:28:11,160 --> 00:28:13,890 And I don't think there's any question about that. 682 00:28:13,890 --> 00:28:17,070 - And what about just as an add on to that, 683 00:28:17,070 --> 00:28:19,290 is sort of the activity that we've been seeing in Iran. 684 00:28:19,290 --> 00:28:22,950 We've seen sort of a tit for tap between Iran and Israel. 685 00:28:22,950 --> 00:28:26,370 And in Iran we've seen attackers go after gas pumps, 686 00:28:26,370 --> 00:28:28,170 4,000 gas pumps in the country. 687 00:28:28,170 --> 00:28:32,190 And then also we had an incident recently unconfirmed 688 00:28:32,190 --> 00:28:36,150 regarding a steel mill equipment and fire there. 689 00:28:36,150 --> 00:28:37,830 And I'm just wondering, again, 690 00:28:37,830 --> 00:28:40,650 we're talking about setting norms internationally. 691 00:28:40,650 --> 00:28:42,360 There were 20 nations in 2015, 692 00:28:42,360 --> 00:28:46,680 as you pointed out that sort of set some basic norms. 693 00:28:46,680 --> 00:28:50,730 And yet there are still actors that we're going to see, 694 00:28:50,730 --> 00:28:53,190 obviously, actions that are just reaching up 695 00:28:53,190 --> 00:28:56,070 to the threshold and not necessarily going over. 696 00:28:56,070 --> 00:28:58,140 But in the case of what's happening in Iran, 697 00:28:58,140 --> 00:29:00,447 it is attacking critical infrastructure. 698 00:29:00,447 --> 00:29:05,010 And so I'm wondering how are we going to, I guess, 699 00:29:05,010 --> 00:29:08,013 have some kind of control or set some kind of boundaries 700 00:29:08,013 --> 00:29:13,013 or express what we consider the limits of activity? 701 00:29:13,680 --> 00:29:14,910 Especially if it's, 702 00:29:14,910 --> 00:29:17,280 I understand sort of the complications when it comes 703 00:29:17,280 --> 00:29:20,670 to let's say a country and adversary 704 00:29:20,670 --> 00:29:25,410 where we might not be opposed to the activity. 705 00:29:25,410 --> 00:29:28,380 If you've got Russia, who's a clear aggressor there. 706 00:29:28,380 --> 00:29:31,323 If you've got Iran who may be aggressing as well. 707 00:29:32,700 --> 00:29:35,910 How do we grapple with these kinds of activities 708 00:29:35,910 --> 00:29:37,320 that are going to go after critical infrastructure? 709 00:29:37,320 --> 00:29:39,220 What we consider outside of the norms? 710 00:29:40,740 --> 00:29:45,210 - Well, we affirm the norms, which I think stand to this day 711 00:29:45,210 --> 00:29:47,910 as a reasonable articulation of 712 00:29:47,910 --> 00:29:51,270 what we believe are the activities that are appropriate 713 00:29:51,270 --> 00:29:55,560 or inappropriate in peace time as defined by those norms. 714 00:29:55,560 --> 00:29:56,960 And Iran doesn't check with us, 715 00:29:56,960 --> 00:29:59,060 as they then kind of violate those norms. 716 00:29:59,060 --> 00:30:02,520 So we don't take responsibility for their actions, 717 00:30:02,520 --> 00:30:05,940 but we still affirm the norms and urge anyone 718 00:30:05,940 --> 00:30:09,960 who would stand with us and affect a collective defense 719 00:30:09,960 --> 00:30:12,870 to affirm those norms, to sign the declaration for free 720 00:30:12,870 --> 00:30:13,920 and open internet, 721 00:30:13,920 --> 00:30:16,260 so that we can then combine our collective talents, 722 00:30:16,260 --> 00:30:19,200 authorities, capabilities, to achieve something 723 00:30:19,200 --> 00:30:21,420 that we couldn't do alone. 724 00:30:21,420 --> 00:30:23,250 So I don't think that those are 725 00:30:23,250 --> 00:30:24,450 in conflict with one another. 726 00:30:24,450 --> 00:30:26,220 Affirming those norms and observing 727 00:30:26,220 --> 00:30:28,560 that there are in fact kind of entities, 728 00:30:28,560 --> 00:30:30,810 nation states in the world who violate them. 729 00:30:30,810 --> 00:30:32,730 It does not challenge the norms, 730 00:30:32,730 --> 00:30:34,800 it might kind of make it such that they're not 731 00:30:34,800 --> 00:30:36,210 being perfectly implemented, 732 00:30:36,210 --> 00:30:37,810 but the norms stand as they are. 733 00:30:39,870 --> 00:30:41,970 - Just a decade ago, there were only about a handful 734 00:30:41,970 --> 00:30:46,165 of nations that had offensive cyber operations capabilities. 735 00:30:46,165 --> 00:30:49,680 US, Russia, China, UK, Israel, just by my counting. 736 00:30:49,680 --> 00:30:53,670 And since then, we've added a lot of other countries, 737 00:30:53,670 --> 00:30:56,880 Iran, North Korea, more than a dozen others 738 00:30:56,880 --> 00:30:58,170 that I can think of. 739 00:30:58,170 --> 00:31:00,240 Clearly all aren't equal in their sophistication 740 00:31:00,240 --> 00:31:03,240 and capabilities in terms of causing damage, 741 00:31:03,240 --> 00:31:04,800 but even less sophisticated actors 742 00:31:04,800 --> 00:31:06,540 can cause real disruption. 743 00:31:06,540 --> 00:31:10,230 So I'm wondering is deterrence an international loss 744 00:31:10,230 --> 00:31:13,327 efficient to keep these new powers in check 745 00:31:13,327 --> 00:31:15,431 when some parties may not be deterred 746 00:31:15,431 --> 00:31:17,340 in the way that traditional nation states 747 00:31:17,340 --> 00:31:20,760 might be deterred regarding politics and things like that. 748 00:31:20,760 --> 00:31:23,940 How do you curb hack and leak operations? 749 00:31:23,940 --> 00:31:26,850 Operations that don't yet make the threshold 750 00:31:26,850 --> 00:31:29,160 of being illegal? 751 00:31:29,160 --> 00:31:31,200 How do we control what feels like 752 00:31:31,200 --> 00:31:32,370 it's getting out of control? 753 00:31:32,370 --> 00:31:33,203 - That's a good question. 754 00:31:33,203 --> 00:31:36,330 I would offer kind of two kind of framings 755 00:31:36,330 --> 00:31:38,190 before I come to main point. 756 00:31:38,190 --> 00:31:40,407 First, as you've asked the question 757 00:31:40,407 --> 00:31:43,203 and I often kind of have this discussion as well, 758 00:31:44,130 --> 00:31:46,923 there aren't quite a lot of nation states in the world 759 00:31:46,923 --> 00:31:49,530 that are capable of doing offense. 760 00:31:49,530 --> 00:31:51,300 And it then leads you to consider 761 00:31:51,300 --> 00:31:54,090 whether one is more capable of offense than another. 762 00:31:54,090 --> 00:31:55,350 And so you all of a sudden get 763 00:31:55,350 --> 00:31:57,540 into this kind of mental discussion, 764 00:31:57,540 --> 00:32:00,780 this mental consideration of who's best at offense? 765 00:32:00,780 --> 00:32:03,090 Is party A or party B best at offense? 766 00:32:03,090 --> 00:32:05,280 And that's really however titillating that might be, 767 00:32:05,280 --> 00:32:08,010 not the right kind of compare and contrast. 768 00:32:08,010 --> 00:32:11,370 We need to think about whether our defense is up to the task 769 00:32:11,370 --> 00:32:14,070 of essentially holding at any offense. 770 00:32:14,070 --> 00:32:15,810 It's a comparison of defense to offense 771 00:32:15,810 --> 00:32:17,280 that we ought to then start with. 772 00:32:17,280 --> 00:32:18,930 And so while there are quite a few more 773 00:32:18,930 --> 00:32:21,060 that would enter into offense, 774 00:32:21,060 --> 00:32:23,970 whether that's in peace time or kind of conflict, 775 00:32:23,970 --> 00:32:25,647 kind of lead that to their judgements, 776 00:32:25,647 --> 00:32:29,910 I'm really focused on how do I get the defense up to speed. 777 00:32:29,910 --> 00:32:32,280 And I think in that regard, you mentioned deterrence 778 00:32:32,280 --> 00:32:34,560 as an important piece of that. 779 00:32:34,560 --> 00:32:36,870 I think the deterrence, if you think your way through, 780 00:32:36,870 --> 00:32:40,080 is really about changing the decision calculus of somebody 781 00:32:40,080 --> 00:32:44,070 that would do something to your detriment before they do it. 782 00:32:44,070 --> 00:32:45,750 And I don't think that deterrence 783 00:32:45,750 --> 00:32:50,750 in cyberspace is impossible, I think it's hard. 784 00:32:51,120 --> 00:32:53,700 I think as some have noted that in cyberspace 785 00:32:53,700 --> 00:32:55,470 the cost of being so low, 786 00:32:55,470 --> 00:32:57,660 you'll never completely remove mischief, 787 00:32:57,660 --> 00:33:00,150 but you can in fact kind of challenge it. 788 00:33:00,150 --> 00:33:01,890 And I think you do that in the ways 789 00:33:01,890 --> 00:33:04,290 that traditionally deterrence has been thought of, 790 00:33:04,290 --> 00:33:06,150 first you make yourself hard to target. 791 00:33:06,150 --> 00:33:09,960 Invest in the defense, remember it's CapEx not OpEx. 792 00:33:09,960 --> 00:33:13,050 Such that you're sufficiently resilient and robust, 793 00:33:13,050 --> 00:33:14,850 you might cause someone to reconsider 794 00:33:14,850 --> 00:33:16,380 whether they're gonna have a go at you 795 00:33:16,380 --> 00:33:18,300 because it's simply expensive on their part. 796 00:33:18,300 --> 00:33:22,380 Two, mount a stout defense on top of what then results, 797 00:33:22,380 --> 00:33:24,060 so that you can catch them in the bargain 798 00:33:24,060 --> 00:33:25,950 and engage, interdict and evict that 799 00:33:25,950 --> 00:33:27,810 at the earliest possible moment. 800 00:33:27,810 --> 00:33:30,270 Again, that should affect their decision calculus. 801 00:33:30,270 --> 00:33:32,520 But if it doesn't, you're at least kind of in the bargain 802 00:33:32,520 --> 00:33:34,890 of holding your own against that offense. 803 00:33:34,890 --> 00:33:37,020 Three, impose costs on them, 804 00:33:37,020 --> 00:33:38,910 but not just cyber on cyber cost. 805 00:33:38,910 --> 00:33:40,260 Again, we're not gonna shoot our way out of 806 00:33:40,260 --> 00:33:41,850 this using cyber alone, 807 00:33:41,850 --> 00:33:45,600 but imposed financial cost, kind of legal remedies, 808 00:33:45,600 --> 00:33:47,940 diplomatic remedies, sometimes public shaming works. 809 00:33:47,940 --> 00:33:51,270 But all of those kind of cost impose that on them 810 00:33:51,270 --> 00:33:53,460 to change their decision calculus. 811 00:33:53,460 --> 00:33:55,380 Now, not in a place to know 812 00:33:55,380 --> 00:33:58,950 what Russia's decision calculus is vis avis the Ukraine, 813 00:33:58,950 --> 00:34:01,920 but is an observable fact that they have not attacked 814 00:34:01,920 --> 00:34:06,900 the west in and through cyberspace through this campaign. 815 00:34:06,900 --> 00:34:09,900 That can be described as deterrence, 816 00:34:09,900 --> 00:34:12,150 whether that's deterrence by essentially, 817 00:34:12,150 --> 00:34:13,710 they just haven't thought about it, 818 00:34:13,710 --> 00:34:16,950 or deterrents on the basis of a conscious choice, 819 00:34:16,950 --> 00:34:18,480 it seems to be working. 820 00:34:18,480 --> 00:34:21,240 It seems to be that they've not attacked us in ways 821 00:34:21,240 --> 00:34:25,230 that we imagine they might, kind short of the use of force 822 00:34:25,230 --> 00:34:27,330 as they have complained mightily 823 00:34:27,330 --> 00:34:29,490 that we're inappropriately assisting 824 00:34:29,490 --> 00:34:31,560 the defense of the Ukraine. 825 00:34:31,560 --> 00:34:34,620 So that seems to be at the moment something 826 00:34:34,620 --> 00:34:36,690 that is working out better than we 827 00:34:36,690 --> 00:34:38,910 might have imagined going into that. 828 00:34:38,910 --> 00:34:42,660 That might be deterrence of a proactive affirmative kind, 829 00:34:42,660 --> 00:34:46,920 but in any regard, their decision calculus is where I 830 00:34:46,920 --> 00:34:49,650 would want it to be of, they shouldn't attack us, 831 00:34:49,650 --> 00:34:51,510 if they do, we made it clear that we will 832 00:34:51,510 --> 00:34:53,184 defend ourselves stoutly. 833 00:34:53,184 --> 00:34:55,290 And therefore I think deterrence can work, 834 00:34:55,290 --> 00:34:58,053 and we've got an example in hand where thus far it has. 835 00:34:59,340 --> 00:35:01,140 - I have one last question. 836 00:35:01,140 --> 00:35:03,060 We might have time for audience questions. 837 00:35:03,060 --> 00:35:04,650 So if you think of something, 838 00:35:04,650 --> 00:35:07,290 we might have time for one question. 839 00:35:07,290 --> 00:35:10,230 My last question is regarding how government intelligence 840 00:35:10,230 --> 00:35:14,520 agencies have been recruiting talent internally 841 00:35:14,520 --> 00:35:15,480 for a long time. 842 00:35:15,480 --> 00:35:19,230 And we're seeing particularly interesting developments 843 00:35:19,230 --> 00:35:23,670 in China with the Ministry of State Security, 844 00:35:23,670 --> 00:35:25,260 which is the civilian intelligence agency. 845 00:35:25,260 --> 00:35:27,330 Where they're setting up front companies, 846 00:35:27,330 --> 00:35:30,727 commercial entities, sometimes legitimate security companies 847 00:35:30,727 --> 00:35:34,680 that have this side business of doing hacking operations, 848 00:35:34,680 --> 00:35:37,710 sometimes economic espionage for the government. 849 00:35:37,710 --> 00:35:41,280 And also they're hiring university students and translators 850 00:35:41,280 --> 00:35:46,200 who may be witting, may be unwittingly contributing 851 00:35:46,200 --> 00:35:47,730 to the operations. 852 00:35:47,730 --> 00:35:51,030 So what are some of the ways that governments, I guess, 853 00:35:51,030 --> 00:35:52,560 are leveraging this talent, 854 00:35:52,560 --> 00:35:55,560 and how does it complicate the US government response 855 00:35:55,560 --> 00:35:58,350 to this when we're talking about civilians 856 00:35:58,350 --> 00:36:00,360 that may may know what they're doing 857 00:36:00,360 --> 00:36:01,530 and may not know what they're doing? 858 00:36:01,530 --> 00:36:03,900 - Well, first we need to be crystal clear. 859 00:36:03,900 --> 00:36:05,820 In the United States and like minded nations 860 00:36:05,820 --> 00:36:08,160 about what authorities we bring to bear, 861 00:36:08,160 --> 00:36:10,200 and who's then kind of authorized 862 00:36:10,200 --> 00:36:12,480 to bring those authorities to bear. 863 00:36:12,480 --> 00:36:14,310 So private citizen. 864 00:36:14,310 --> 00:36:15,240 Again, I've talked about the 865 00:36:15,240 --> 00:36:17,880 Computer Fraud and Abuse Act of 1986. 866 00:36:17,880 --> 00:36:19,530 It's not authorized to engage 867 00:36:19,530 --> 00:36:24,333 in kind of unilaterally kind of aimed hacking activities. 868 00:36:26,880 --> 00:36:29,460 White hacking testing that's done with the consent, 869 00:36:29,460 --> 00:36:31,710 penetration testing, kind of bug bounties, 870 00:36:31,710 --> 00:36:32,910 all of that's appropriate. 871 00:36:32,910 --> 00:36:36,420 But we can actually kind of cheat our way to success 872 00:36:36,420 --> 00:36:37,680 in filling these jobs, 873 00:36:37,680 --> 00:36:39,030 we need to do it the old fashioned way, 874 00:36:39,030 --> 00:36:40,290 which is let's be crystal clear 875 00:36:40,290 --> 00:36:41,790 about what the authorities are. 876 00:36:41,790 --> 00:36:44,190 That being said, the question that's really on the table is 877 00:36:44,190 --> 00:36:45,900 how do we fill these jobs? 878 00:36:45,900 --> 00:36:48,000 At the moment about one third of the jobs, 879 00:36:48,000 --> 00:36:50,160 anywhere you look, inside the government or outside 880 00:36:50,160 --> 00:36:52,530 of the government that have the word cyber IT 881 00:36:52,530 --> 00:36:53,730 in them are empty. 882 00:36:53,730 --> 00:36:54,960 We're not filling those jobs. 883 00:36:54,960 --> 00:36:56,580 The good news is, we're continue to fill them 884 00:36:56,580 --> 00:36:57,900 at the two thirds rate. 885 00:36:57,900 --> 00:37:01,080 The bad news is the denominators running away from us. 886 00:37:01,080 --> 00:37:03,930 And so we need to appeal to the broadest possible population 887 00:37:03,930 --> 00:37:06,750 to essentially kind of offer them the opportunity 888 00:37:06,750 --> 00:37:08,970 to fill those jobs and then assist them 889 00:37:08,970 --> 00:37:11,190 in the transition to those jobs. 890 00:37:11,190 --> 00:37:13,500 But we also need to make sure that other disciplines, 891 00:37:13,500 --> 00:37:15,270 whether they're lawyers, or CEOs, 892 00:37:15,270 --> 00:37:17,640 or tradesmen who need to know more about cyber, 893 00:37:17,640 --> 00:37:19,290 that they have the skills necessary 894 00:37:19,290 --> 00:37:21,270 to make intelligent choices about the use 895 00:37:21,270 --> 00:37:23,640 of digital infrastructure in this brave new world. 896 00:37:23,640 --> 00:37:25,920 And that every citizen, every person in cyberspace 897 00:37:25,920 --> 00:37:28,082 knows enough to make full use of cyberspace. 898 00:37:28,082 --> 00:37:30,300 They don't all need to be Python programmers, 899 00:37:30,300 --> 00:37:32,010 but they need to know more than they do. 900 00:37:32,010 --> 00:37:35,490 We need to solve all of that by mobilizing a strategy 901 00:37:35,490 --> 00:37:37,110 that says, how do we educate? 902 00:37:37,110 --> 00:37:38,070 How do we train? 903 00:37:38,070 --> 00:37:40,830 How do we make perhaps the awareness possible 904 00:37:40,830 --> 00:37:42,570 so that everyone's participating 905 00:37:42,570 --> 00:37:45,540 in the defense of this realm, not just the precious few. 906 00:37:45,540 --> 00:37:46,980 But we'll do it the old fashioned ways. 907 00:37:46,980 --> 00:37:48,420 We'll do it under the rule of law, 908 00:37:48,420 --> 00:37:51,000 and we'll do it in the appropriate way that everybody knows 909 00:37:51,000 --> 00:37:52,020 what role they're playing 910 00:37:52,020 --> 00:37:54,060 and they know why they're authorized 911 00:37:54,060 --> 00:37:55,830 or why they're expected to participate 912 00:37:55,830 --> 00:37:56,802 in that particular role. 913 00:37:56,802 --> 00:37:59,040 What the Chinese do shouldn't be something 914 00:37:59,040 --> 00:38:01,800 that kind of teases us or tempts us to do it kind of 915 00:38:01,800 --> 00:38:06,033 in a way that confuses or perhaps challenges our values. 916 00:38:06,980 --> 00:38:09,930 - So I wanted to open up for questions from the audience. 917 00:38:09,930 --> 00:38:12,300 We have time for maybe one or two. 918 00:38:12,300 --> 00:38:14,400 Do we have a microphone? 919 00:38:14,400 --> 00:38:15,233 We don't. 920 00:38:15,233 --> 00:38:17,430 Okay, so I'm gonna have to repeat the question. 921 00:38:17,430 --> 00:38:19,130 Let's take that question up there. 922 00:38:22,620 --> 00:38:23,453 Speak loud. 923 00:38:23,453 --> 00:38:26,280 - [Audience] You raise prospect, there was a great deal 924 00:38:26,280 --> 00:38:31,280 of galvanization from state industry, et cetera 925 00:38:32,010 --> 00:38:33,990 in defense in to Ukraine. 926 00:38:33,990 --> 00:38:36,240 I wanted to give a sense of how replicable 927 00:38:36,240 --> 00:38:39,060 that might be in other geographic areas 928 00:38:39,060 --> 00:38:41,635 where there's much less of that historical 929 00:38:41,635 --> 00:38:45,090 kinda transatlantic unity kinda built 930 00:38:45,090 --> 00:38:46,982 into those relationships. 931 00:38:46,982 --> 00:38:49,530 - Yeah, so I'll rephrase - Do you wanna repeat? 932 00:38:49,530 --> 00:38:51,630 - if I cheat on this, you stop me. 933 00:38:51,630 --> 00:38:54,600 I think the question is the Ukrainian situation 934 00:38:54,600 --> 00:38:57,330 has galvanized a collective defense. 935 00:38:57,330 --> 00:38:59,670 And I think the question really is is that an anomaly, 936 00:38:59,670 --> 00:39:02,520 that's a one time event, or whether that's replicable. 937 00:39:02,520 --> 00:39:05,610 Can we actually achieve that on a continuous basis? 938 00:39:05,610 --> 00:39:08,070 I think it is replicable. 939 00:39:08,070 --> 00:39:11,026 I get up every morning trying to make it replicable. 940 00:39:11,026 --> 00:39:13,770 Such that what I pitch is, 941 00:39:13,770 --> 00:39:15,900 Hey, why don't all of us contribute to the defense 942 00:39:15,900 --> 00:39:17,130 of each of us or vice versa, 943 00:39:17,130 --> 00:39:19,500 each of us contribute to the defense of all of us. 944 00:39:19,500 --> 00:39:21,570 That colonial pipeline business where the defeat 945 00:39:21,570 --> 00:39:23,600 of one person held at risk the confidence 946 00:39:23,600 --> 00:39:27,120 of 10 million people, why don't we flip that script and say, 947 00:39:27,120 --> 00:39:30,597 all of us can make it such that we defend each of us. 948 00:39:30,597 --> 00:39:33,300 And if we do that as a matter of course, 949 00:39:33,300 --> 00:39:36,447 the way we've done that for highway transportation systems, 950 00:39:36,447 --> 00:39:37,980 the way we've done that for airplanes, 951 00:39:37,980 --> 00:39:38,910 the way we've done that for just 952 00:39:38,910 --> 00:39:41,430 about every other critical asset in our country, 953 00:39:41,430 --> 00:39:43,860 then we all know what role we play in the defense 954 00:39:43,860 --> 00:39:47,340 of something that we hold as a common good, a shared asset. 955 00:39:47,340 --> 00:39:49,440 I think that's the way to play that. 956 00:39:49,440 --> 00:39:51,900 So it doesn't require some electrifying moment. 957 00:39:51,900 --> 00:39:54,390 That's kind of urban transgression of the Russians 958 00:39:54,390 --> 00:39:57,090 into the Ukraine, to get us to believe that we've got 959 00:39:57,090 --> 00:39:58,950 some common resource here that we need 960 00:39:58,950 --> 00:40:00,900 to step in and collectively defend. 961 00:40:00,900 --> 00:40:04,080 It ought to be something we think of 24 hours a day. 962 00:40:04,080 --> 00:40:04,980 - Other questions? 963 00:40:06,150 --> 00:40:07,317 Yeah, go ahead. 964 00:40:09,572 --> 00:40:12,117 - [Audience] I appreciate your focus on defense, 965 00:40:12,117 --> 00:40:17,117 I'm gonna get you thoughts on the very topic of interest 966 00:40:17,254 --> 00:40:21,687 our government has when they also wanna have offense. 967 00:40:21,687 --> 00:40:25,830 And they actively try to leave vulnerabilities 968 00:40:25,830 --> 00:40:29,123 in (indistinct) or to add back doors. 969 00:40:30,808 --> 00:40:32,730 How do we have a defense 970 00:40:32,730 --> 00:40:35,740 at the same time we also want to have offense? 971 00:40:35,740 --> 00:40:40,740 - Yeah, so I'm not prepared to say what the US government 972 00:40:40,770 --> 00:40:41,670 will or will not. 973 00:40:41,670 --> 00:40:44,700 So the question is, how can we make a case for defense 974 00:40:44,700 --> 00:40:47,010 when we in fact have an offense? 975 00:40:47,010 --> 00:40:49,590 So I'm not going to tell you what the US government has 976 00:40:49,590 --> 00:40:52,590 in terms of an arsenal of one kind or another. 977 00:40:52,590 --> 00:40:57,000 But I would just note that we have offensive capabilities 978 00:40:57,000 --> 00:40:59,790 broadly across kind of just about every country I can think 979 00:40:59,790 --> 00:41:01,200 of but the United States. 980 00:41:01,200 --> 00:41:04,410 Both kinetic, physical and kind of cyber wise. 981 00:41:04,410 --> 00:41:05,243 Why? 982 00:41:05,243 --> 00:41:07,800 Because at some point we may need to bring them to bear 983 00:41:07,800 --> 00:41:11,100 in the legitimate defense of our people. 984 00:41:11,100 --> 00:41:12,780 Now, they need to be built in a way 985 00:41:12,780 --> 00:41:16,080 that they're appropriate, that they kind of are necessary 986 00:41:16,080 --> 00:41:17,730 and appropriate to the task. 987 00:41:17,730 --> 00:41:20,760 Need to make sure that they do not hold at risk the society 988 00:41:20,760 --> 00:41:22,230 that they would defend. 989 00:41:22,230 --> 00:41:24,990 So if we have fighter airplanes and they have munitions, 990 00:41:24,990 --> 00:41:27,000 we need to make sure that they're properly secured 991 00:41:27,000 --> 00:41:30,270 and that they're not at some point kind of easily deployed 992 00:41:30,270 --> 00:41:33,570 or deployed at all to hold that population at risk 993 00:41:33,570 --> 00:41:36,570 that they would defend, same thing's true for cyber. 994 00:41:36,570 --> 00:41:38,670 There's nothing different about cyber in terms 995 00:41:38,670 --> 00:41:40,930 of what norms we would bring to bear. 996 00:41:40,930 --> 00:41:43,620 I would tell you that as a matter of course, 997 00:41:43,620 --> 00:41:46,800 the vast majority of weakness that is discovered 998 00:41:46,800 --> 00:41:49,800 by US government and other like-minded nations 999 00:41:49,800 --> 00:41:52,890 in critical infrastructure, civilian infrastructure, 1000 00:41:52,890 --> 00:41:55,410 the vast majority if not all of that is given 1001 00:41:55,410 --> 00:41:58,110 to the private sector so that they might then be defended. 1002 00:41:58,110 --> 00:42:01,249 And just as I think we know in our own defense, 1003 00:42:01,249 --> 00:42:05,070 85% of what we find goes wrong is attributable 1004 00:42:05,070 --> 00:42:07,080 to kind of a failure of a human being 1005 00:42:07,080 --> 00:42:09,270 or a failure of doctrine, are adversaries, 1006 00:42:09,270 --> 00:42:10,470 have the same challenge. 1007 00:42:10,470 --> 00:42:13,410 And so most of the flaws, the vulnerabilities we would use 1008 00:42:13,410 --> 00:42:14,550 in the heat of the moment, 1009 00:42:14,550 --> 00:42:17,490 are likely to be found in doctrinal differences 1010 00:42:17,490 --> 00:42:19,830 kind of people kind of issues. 1011 00:42:19,830 --> 00:42:22,590 Not in some fundamental flaw that we would take advantage of 1012 00:42:22,590 --> 00:42:25,140 that it's a common flaw for all of us. 1013 00:42:25,140 --> 00:42:27,390 The bias has to be, if there's a common flaw, 1014 00:42:27,390 --> 00:42:28,590 we actually defend it. 1015 00:42:28,590 --> 00:42:31,800 We don't actually use it kind of in some reserve capacity 1016 00:42:31,800 --> 00:42:33,843 to hold everyone at risk, so. 1017 00:42:33,843 --> 00:42:35,640 - We have time for just one more question. 1018 00:42:35,640 --> 00:42:36,640 - One more question. 1019 00:42:38,010 --> 00:42:40,380 - [Audience] You briefly talked about the talent problem 1020 00:42:40,380 --> 00:42:43,230 and hiring pipeline, that defense department 1021 00:42:43,230 --> 00:42:46,050 and the Homeland Security department get a lot of coverage 1022 00:42:46,050 --> 00:42:47,940 as a member of the administration. 1023 00:42:47,940 --> 00:42:50,484 What efforts are happening in the US are talking 1024 00:42:50,484 --> 00:42:52,920 about departments like education and conference? 1025 00:42:52,920 --> 00:42:53,990 - Yeah, that's a great question. 1026 00:42:53,990 --> 00:42:57,180 So we talk a lot, he says about, and I think you're right. 1027 00:42:57,180 --> 00:43:00,450 Talk a lot about the need to properly educate 1028 00:43:00,450 --> 00:43:02,820 and to fill jobs, cyber jobs, IT jobs, 1029 00:43:02,820 --> 00:43:04,890 and I kind of added some other disciplines 1030 00:43:04,890 --> 00:43:06,450 that perhaps we need to do more about. 1031 00:43:06,450 --> 00:43:07,890 And we hear a lot about what's happening 1032 00:43:07,890 --> 00:43:09,540 in places like the Department of Homeland Security, 1033 00:43:09,540 --> 00:43:12,112 the Department of Defense, but what about all the others? 1034 00:43:12,112 --> 00:43:13,980 I agree that we need to actually, 1035 00:43:13,980 --> 00:43:15,570 we can't just filter one end of the poll, 1036 00:43:15,570 --> 00:43:17,340 we need to solve the whole problem. 1037 00:43:17,340 --> 00:43:20,880 And so at the White House about three weeks ago, 1038 00:43:20,880 --> 00:43:24,210 had a summit to essentially focus on this problem. 1039 00:43:24,210 --> 00:43:26,550 We brought 60 leaders from across the private sector, 1040 00:43:26,550 --> 00:43:28,500 academia and the government. 1041 00:43:28,500 --> 00:43:30,540 Interestingly, the secretary of commerce, 1042 00:43:30,540 --> 00:43:33,150 secretary of labor, secretary of Homeland Security, 1043 00:43:33,150 --> 00:43:36,270 and secretary for department of education, all spoke. 1044 00:43:36,270 --> 00:43:38,190 Susan Rice also spoke, 1045 00:43:38,190 --> 00:43:40,470 given her responsibility within the administration. 1046 00:43:40,470 --> 00:43:42,690 And we spoke about the collective need, 1047 00:43:42,690 --> 00:43:45,360 not just one department of two departments need. 1048 00:43:45,360 --> 00:43:46,920 And how do we come up with a strategy 1049 00:43:46,920 --> 00:43:49,470 that actually kind of tries to solve the whole problem, 1050 00:43:49,470 --> 00:43:52,800 make a bigger pie for the nation as much as all the agencies 1051 00:43:52,800 --> 00:43:55,440 and departments, so that any one of us think can benefit 1052 00:43:55,440 --> 00:43:56,790 from what happens inside of that. 1053 00:43:56,790 --> 00:43:58,800 But you're quite right, we have to solve the whole problem. 1054 00:43:58,800 --> 00:44:00,759 We can't solve just a piece of the problem. 1055 00:44:00,759 --> 00:44:01,592 - [Audience] Thank you. 1056 00:44:01,592 --> 00:44:02,572 - Great. - Thank you Chris, 1057 00:44:02,572 --> 00:44:04,020 thanks for your time. - Thanks very Kim, 1058 00:44:04,020 --> 00:44:05,300 always nice to see you, thanks. 1059 00:44:05,300 --> 00:44:08,300 (audience clapping) 1060 00:44:13,759 --> 00:44:16,342 (upbeat music)