1
00:00:00,000 --> 00:00:02,540
I'm Alia Mayorkas. I'm the Secretary of Homeland Security.

2
00:00:11,440 --> 00:00:15,420
Jeff, thank you very much for inviting me to share a few thoughts.

3
00:00:15,660 --> 00:00:25,960
You know, I want to start on a somber note, because this morning I spent some time addressing the tragedy,

4
00:00:25,960 --> 00:00:36,720
the natural disaster tragedy in Hawaii. Approximately 55 people are already confirmed deceased and reports are that 1,000 are missing.

5
00:00:36,880 --> 00:00:42,400
It is a fire that has really destroyed the island of Maui.

6
00:00:43,900 --> 00:00:54,420
You know, last year, we had a software vulnerability that enabled an individual

7
00:00:54,420 --> 00:00:55,940
to be able to go to the airport, to go to the airport, to go to the airport, to go to the airport, to go to the airport, to go to the airport, to go to the airport.

8
00:00:55,940 --> 00:01:08,880
to really circumvent, to bypass our security measures, and communicate from our official .gov site, our email address.

9
00:01:09,820 --> 00:01:18,260
And the results of that could have been catastrophic, because we communicate with people, millions of people, every single day.

10
00:01:18,880 --> 00:01:25,140
And very often, we communicate with vulnerable communities every single day, including, for example,

11
00:01:25,940 --> 00:01:30,560
the survivors of the tragic fires in Maui.

12
00:01:32,040 --> 00:01:35,500
That consequence never materialized.

13
00:01:36,440 --> 00:01:42,280
The vulnerability was discovered and addressed.

14
00:01:42,660 --> 00:01:46,660
And it wasn't because of anything that we in the Department of Homeland Security did.

15
00:01:46,860 --> 00:01:48,760
It was because of what you did.

16
00:01:49,470 --> 00:01:55,180
One of you, one of the more than 500 people that participated in Hack DHS,

17
00:01:55,940 --> 00:02:00,720
our bug bounty program, discovered the vulnerability, communicated it to us,

18
00:02:00,800 --> 00:02:02,680
and it allowed us to close it.

19
00:02:03,440 --> 00:02:04,540
You can...

20
00:02:13,020 --> 00:02:14,740
We need you.

21
00:02:15,500 --> 00:02:18,020
We need you to help us.

22
00:02:19,020 --> 00:02:24,040
And I want to share a story that I thought of on the way out here.

23
00:02:26,500 --> 00:02:32,600
There was a postal service employee and his wife.

24
00:02:32,680 --> 00:02:35,560
And his wife worked, I think she worked as a bank teller.

25
00:02:35,600 --> 00:02:36,560
She worked in a bank.

26
00:02:36,660 --> 00:02:40,700
Two people, a couple, of very modest means.

27
00:02:41,520 --> 00:02:44,800
And they lived in a very, very modest apartment in New York City.

28
00:02:45,120 --> 00:02:49,140
And he loved art, but they couldn't afford very much.

29
00:02:49,200 --> 00:02:52,000
So he would always travel through the art district.

30
00:02:52,240 --> 00:02:54,740
And if there was a young, struggling artist

31
00:02:54,740 --> 00:02:59,680
that he liked he would and he liked the piece he would buy a piece a couple

32
00:02:59,680 --> 00:03:05,100
hundred bucks maybe sometimes a little bit more and he made it a regular event

33
00:03:05,100 --> 00:03:10,240
with his wife it was their weekly outing and over the years he gathered a lot of

34
00:03:10,240 --> 00:03:17,860
of this art of young aspiring artists that had not yet made it and a couple

35
00:03:17,860 --> 00:03:23,240
decades later every inch of his apartment was covered with this art on

36
00:03:23,240 --> 00:03:27,700
the walls it was stacked on the refrigerator it was under the bed and

37
00:03:27,700 --> 00:03:35,680
the like and ultimately in their later years they donated a much of their

38
00:03:35,680 --> 00:03:43,020
collection to the Smithsonian valued at more than 250 million dollars he had an

39
00:03:43,020 --> 00:03:49,940
eye for artists that became the dominant American artists in the post-war period

40
00:03:50,680 --> 00:03:52,740
and there's a clip that I saw

41
00:03:53,240 --> 00:03:58,480
of him meeting with one of these artists that he liked and he was looking at a

42
00:03:58,480 --> 00:04:03,960
piece of sculpture and he and he looked at it and he said you know that's nice

43
00:04:03,960 --> 00:04:10,160
but I think it would look better like this and he turned it on its side and as

44
00:04:10,160 --> 00:04:15,320
soon as I'm not a expert in art but as soon as he turned it on its side in

45
00:04:15,320 --> 00:04:23,220
this clip I recognized that as an iconic sculpture the artist adopted a

46
00:04:23,240 --> 00:04:35,440
that way of positioning his art we need you we need you to turn us on our side

47
00:04:36,080 --> 00:04:45,880
we you see things that we do not see you discover things that we do not and we

48
00:04:45,880 --> 00:04:53,020
really need your help you know we we need to serve the

49
00:04:53,240 --> 00:04:59,440
people more effectively the things we do are of tremendous consequence I hope

50
00:04:59,440 --> 00:05:08,100
that you understand that your talent and what you can do is is and can be of

51
00:05:08,100 --> 00:05:14,760
tremendous consequence in not just when you when you discover a vulnerability or

52
00:05:14,760 --> 00:05:19,160
what-have-you or when you discover an opportunity the the real-life

53
00:05:19,160 --> 00:05:22,980
consequences that that work that discovery that

54
00:05:23,240 --> 00:05:30,560
that exercise of your ability can have I hope that you will you know work with

55
00:05:30,560 --> 00:05:39,520
us and and help us in that in that regard we're going to take the hack DHS

56
00:05:39,520 --> 00:05:44,200
bug bounty program and we're going to expand it this year we're going to

57
00:05:44,200 --> 00:05:52,860
expand it to our use of AI and we need to make sure that our use of

58
00:05:53,240 --> 00:05:57,960
AI we want to be leaders in the responsible use of AI we're very

59
00:05:57,960 --> 00:06:03,120
concerned about the security implications of generative AI and other

60
00:06:05,060 --> 00:06:10,980
iterations of it we're also very concerned just quite frankly about some

61
00:06:10,980 --> 00:06:16,320
foundational issues some values principles with respect to AI we are

62
00:06:16,320 --> 00:06:20,880
unique in the federal government we have a statutorily created office for civil

63
00:06:20,880 --> 00:06:22,980
rights and civil liberties an office of

64
00:06:23,240 --> 00:06:29,340
these are two areas of tremendous concern for us with respect to AI and

65
00:06:29,340 --> 00:06:33,640
hopefully you'll work with us in that regard as well hopefully you will

66
00:06:33,640 --> 00:06:40,560
participate in the hack DHS program relevant to AI and also more more

67
00:06:40,560 --> 00:06:46,560
expansively this week system of our cybersecurity and infrastructure

68
00:06:46,560 --> 00:06:53,440
security agency issued a request for information on areas of investment in

69
00:06:53,440 --> 00:07:00,220
open-source security our cyber safety review board issued a really

70
00:07:00,220 --> 00:07:08,060
groundbreaking report on how to better secure open-source the open-source

71
00:07:08,060 --> 00:07:15,760
ecosystem it's of such tremendous utility and promise it's here too is an

72
00:07:15,760 --> 00:07:16,540
opportunity for us to continue to work on the infrastructure security framework

73
00:07:16,560 --> 00:07:24,200
for to work together ideally what i'd love to do is i'd like i'd love to recruit uh many of you

74
00:07:24,750 --> 00:07:29,800
to actually become members of the department of homeland security i don't know what i would call

75
00:07:30,210 --> 00:07:40,500
that recruitment effort whether it would be like um hack the bureaucracy but but yeah yeah

76
00:07:40,500 --> 00:07:53,060
yeah by the way by the way one goal that i had coming in um and behind schedule uh is to

77
00:07:54,900 --> 00:08:00,600
demonstrate that government can be as nimble as any other non-governmental organization

78
00:08:01,400 --> 00:08:07,780
there's no reason that we can't be as i said i'm a little behind schedule but in certain

79
00:08:07,780 --> 00:08:10,340
areas of our work i think in the cyber

80
00:08:10,500 --> 00:08:19,160
domain we are i think we are innovating in ways that are unprecedented if you take a look at some

81
00:08:19,160 --> 00:08:26,960
of the the innovations of the use of technology the harnessing of your talent in other domains

82
00:08:26,960 --> 00:08:33,360
of our work it's it's pretty pretty powerful if you're unwilling unwilling to join us

83
00:08:33,360 --> 00:08:39,860
in our hallways in our in our offices hopefully you'll you'll work with us

84
00:08:40,500 --> 00:08:50,760
um turn us sideways make us better and really help people very much in need thanks so much i'm

85
00:08:50,760 --> 00:08:54,780
looking forward to a conversation with jeff he thinks he's going to ask me

86
00:08:55,140 --> 00:08:59,380
all the questions but i may have a question or two for him and i'm really proud to be here thanks

87
00:09:14,920 --> 00:09:15,760
all the questions but i may have a question or two for him and i'm really proud to be here thanks

88
00:09:15,760 --> 00:09:22,600
is it on can you hear me okay i think we're both got we're both wired up this is uh vegas style

89
00:09:23,080 --> 00:09:30,020
yeah you're good i don't think can you hear me okay yeah yeah now yeah okay all right jeff

90
00:09:30,020 --> 00:09:39,640
so here i am a government employee sitting across from you you started defcon 31 years ago

91
00:09:41,060 --> 00:09:48,520
20 years ago if a government employee sat across from you what would have been your message

92
00:09:49,040 --> 00:09:55,440
to the government employee 20 years ago then 10 years ago then now on behalf of the community

93
00:09:56,840 --> 00:10:01,160
that's a good question the first conversation would have taken place with my lawyer present

94
00:10:08,100 --> 00:10:10,320
that's for sure um but

95
00:10:10,500 --> 00:10:14,400
since then things uh pretty much improved right you've noticed we don't have us really uh

96
00:10:14,400 --> 00:10:20,720
it's a spot the fed contest once fed started intentionally outing each other to get the shirts

97
00:10:21,780 --> 00:10:28,020
we knew that something had changed right it was we were no longer perceived as the adversary

98
00:10:28,500 --> 00:10:35,320
we were you know and then about 10 years ago it changed where when people from dc would come

99
00:10:35,320 --> 00:10:40,020
it was i'm going to go see the people with green hair and it was like uh

100
00:10:40,500 --> 00:10:50,020
a summer kind of like you know side show now you're here you know what i mean people it's

101
00:10:50,020 --> 00:10:54,780
quantitatively changed from uh oh that's interesting summer concert too i've got to be

102
00:10:54,780 --> 00:11:00,920
there and some things change over the last decade and um we're still doing what we're doing but it

103
00:11:00,920 --> 00:11:05,680
seems like the stakes have been raised the maybe the value that we can contribute has increased

104
00:11:05,680 --> 00:11:10,480
but something has really changed in the last 10 years i would say i'm not sure i'm not sure i'm not

105
00:11:10,500 --> 00:11:19,500
sure well i'll let you speak to whether the value that you uh can provide has increased i would say

106
00:11:19,500 --> 00:11:27,760
my reflex to that is the value that you can deliver is better recognized that's yeah um i'll

107
00:11:27,760 --> 00:11:32,980
tell you a quick quick story and i'm sorry so this is the second time i've spoken at defcon the

108
00:11:32,980 --> 00:11:39,240
first time was when i was a deputy secretary and it's a tradition when one speaks for the first

109
00:11:39,240 --> 00:11:40,480
time to take a shot when i was a deputy secretary and it's a tradition when one speaks for the first time to take a shot when one speaks for the first time to take a shot

110
00:11:40,500 --> 00:11:47,840
at that time it was jack daniels it was 10 in the morning and and i i said listen

111
00:11:48,460 --> 00:11:54,240
i got a lot of stuff to do i can't sorry can't no can do and they said you know what

112
00:11:54,900 --> 00:11:58,780
we'll give you we'll go on stage we'll give you a shot but it'll be water and i said

113
00:11:58,780 --> 00:12:05,980
we have a deal so they came out the the subject of my speech was building trust

114
00:12:08,660 --> 00:12:10,420
so so i took

115
00:12:10,500 --> 00:12:16,720
i took the shot of water and then i i continued with my remarks and then i looked out

116
00:12:17,560 --> 00:12:25,240
and i said you know i i gotta i just took a shot of water and here i am talking about trust

117
00:12:25,240 --> 00:12:32,580
and building trust and there's there was more significantly a bigger deficit then there remains

118
00:12:33,300 --> 00:12:40,480
uh deficits understood and it's our job to close them and for your hopefully for you to

119
00:12:40,500 --> 00:12:46,780
be open to having them closed but then i said listen bring it on and so i wrote off the afternoon

120
00:12:46,780 --> 00:12:56,960
and had a good shot of jack daniels at 10. right on so i was lucky i was you know a little skeptical

121
00:12:56,960 --> 00:13:01,520
i was in the back of the room watching and soon as you did that and the audience was

122
00:13:02,140 --> 00:13:10,420
and it's like okay he's one like you know rooting for my demise yeah but i mean that goes to a very

123
00:13:10,500 --> 00:13:16,940
important um aspect here on community building community i mean dhs is what you're up to 300 how

124
00:13:16,940 --> 00:13:22,480
many how big is the department now 260 000. 260 000 and i do want to give a shout out you might

125
00:13:22,480 --> 00:13:31,740
not realize this tsa is here tsa is at defcon right on right here this guy and um dave pakoski

126
00:13:31,740 --> 00:13:39,260
please stand and be recognized an innovator yeah so when we heard that tsa was coming i'm like do

127
00:13:39,260 --> 00:13:40,480
they know what the fuck they're going to do it goes on because we've done this a ton

128
00:13:40,500 --> 00:13:46,780
going? I mean, like, that takes some courage. But TSA does a lot of cool stuff with technology.

129
00:13:47,080 --> 00:13:51,940
We just always hear about the screeners. But it's a big department. And it makes me think

130
00:13:51,940 --> 00:13:56,960
FEMA does a lot in disaster response. I'm sure you're on the phone all day today with

131
00:13:56,960 --> 00:14:03,020
FEMA in Hawaii. And there's all of these communities that DHS essentially is stitched together

132
00:14:03,020 --> 00:14:08,000
and you can't function if you don't have the trust of those communities. You know,

133
00:14:08,000 --> 00:14:13,240
CISA, Building Communities in the Technology Space. So really, if you think about it, your

134
00:14:13,960 --> 00:14:19,840
power or your authority or your motivation is like more of a grassroots, bottom-up, kind

135
00:14:19,840 --> 00:14:24,240
of community driven. You're not necessarily top-down, intelligence community, DOD style,

136
00:14:24,380 --> 00:14:26,800
right? So the way you operate is different.

137
00:14:27,280 --> 00:14:36,340
We, I speak of our department as a department of partnerships. You know, we, our job is

138
00:14:36,340 --> 00:14:37,380
to make life better.

139
00:14:37,380 --> 00:14:46,080
For people to understand where we are falling short. And to close gaps in our

140
00:14:46,080 --> 00:14:53,380
own ability to deliver. But we can't do it alone. We cannot do what we do alone. Which

141
00:14:53,380 --> 00:14:59,200
is why, frankly, I have come to ask for your partnership.

142
00:15:00,300 --> 00:15:07,240
And so with that dynamic, the bottom-up versus sort of the top-down. Isn't

143
00:15:07,240 --> 00:15:13,400
that sound a little different than the foundation the founding of dhs after 9 11 right i mean do you

144
00:15:13,400 --> 00:15:18,500
imagine that what the department has become or had to do to adapt i mean it was fundamentally

145
00:15:18,500 --> 00:15:23,180
a counter-terrorism organization or conceived that way and now what we're talking about is not

146
00:15:23,180 --> 00:15:34,500
counter-terrorism right well the um a few things the threats evolve i mean in 20 years ago we're

147
00:15:34,500 --> 00:15:42,240
in our 20th year in 2003 when we were first stood up people were not talking about the cyber threat

148
00:15:43,040 --> 00:15:49,240
vector as prominently as we are now that's just the reality and so we evolve

149
00:15:49,750 --> 00:15:58,660
as the threat landscape evolves and frankly we build service delivery as communities needs

150
00:15:58,660 --> 00:16:03,760
evolve as well so uh so give me an example what's what's like the latest service delivery or what's

151
00:16:03,760 --> 00:16:04,480
a new a new

152
00:16:04,500 --> 00:16:17,880
um look you know i i the first thing that comes to mind you know what new means but i think that

153
00:16:17,880 --> 00:16:27,600
adverse nation states exploitation of the divide in this country is something i speak of

154
00:16:27,600 --> 00:16:34,400
as a homeland security threat you know the that we've had our disagreements in

155
00:16:34,500 --> 00:16:40,100
this country for ever since its founding of course and they have led to horrific

156
00:16:40,100 --> 00:16:49,580
results born I think of horrific practices at times the residue in some

157
00:16:49,580 --> 00:16:58,280
regards still exists the divide the rhetoric now is so sharp the divide is

158
00:16:58,280 --> 00:17:03,400
so becoming so extreme it creates a vulnerability that's one thing that I

159
00:17:03,400 --> 00:17:09,800
think of as well but we have to we have to change the way we do things sometimes

160
00:17:09,800 --> 00:17:16,120
I will tell you there was a scathing piece in the Washington Post a couple

161
00:17:16,120 --> 00:17:22,620
years ago about our provision of assistance to natural disaster victims

162
00:17:22,620 --> 00:17:30,160
and the criticism was warranted you know I say to colleagues let's not shrink

163
00:17:30,160 --> 00:17:33,080
from criticism let's just work really hard not to deserve it

164
00:17:33,080 --> 00:17:33,380
you know I say to colleagues let's not shrink from criticism let's just work

165
00:17:33,380 --> 00:17:37,020
really hard not to deserve it we deserved it a black community a very

166
00:17:37,020 --> 00:17:41,940
poor black community in the south was devastated a small community was

167
00:17:41,940 --> 00:17:51,600
devastated by a hurricane a tornado and in order to receive assistance one had

168
00:17:51,600 --> 00:17:57,160
to present documentation of one's home ownership mortgage documents deed of

169
00:17:57,160 --> 00:18:01,680
trust or whatever and this community these poor homes

170
00:18:03,400 --> 00:18:07,140
people had received their homes they had been passed down from generation to

171
00:18:07,140 --> 00:18:11,440
generation they didn't have the documentation and we disenfranchised them

172
00:18:11,440 --> 00:18:18,500
by reason of our lack of understanding of their reality and therefore what we

173
00:18:18,500 --> 00:18:22,700
needed to do and we did do in response to this criticism was we changed our

174
00:18:22,700 --> 00:18:27,740
policy if you don't have those documents do you have a utility bill can you can

175
00:18:27,740 --> 00:18:32,320
you attest to your ownership of the home we've got to reach people where they are

176
00:18:33,380 --> 00:18:41,200
that's what good government right yeah it's very refreshing to hear you say that because half of

177
00:18:41,200 --> 00:18:45,620
it is just acknowledging the problem I mean if you listen to my talk earlier I'm acknowledging

178
00:18:45,620 --> 00:18:51,340
the problem we screwed up on badge manufacturing I wish I could change it I can't I'm doing

179
00:18:51,340 --> 00:18:55,240
everything I can to improve it we have people on airplanes flying from the warehouse you know

180
00:18:55,240 --> 00:18:59,240
the manufacturing we're doing everything we can can't go back in time and fix it but by

181
00:18:59,240 --> 00:19:02,740
acknowledging it and trying to be transparent right that's

182
00:19:03,380 --> 00:19:07,540
that's all you can do to help right communicate with your community that you brought up a point

183
00:19:07,540 --> 00:19:13,940
though about the new attack vectors um that's perfect I have that question right there see

184
00:19:15,320 --> 00:19:22,080
Russia invasion of Ukraine right information operations from China you're finding yourself

185
00:19:22,080 --> 00:19:29,820
more in the countering nation-state game um which has been traditionally viewed as more of

186
00:19:29,820 --> 00:19:32,660
an intelligence you know until I I see

187
00:19:33,380 --> 00:19:40,200
function how does the department work either with partners or Ukraine or how do you

188
00:19:41,140 --> 00:19:45,880
you're domestically focused here but to be domestically focused you have to be outwardly

189
00:19:45,880 --> 00:19:54,960
focused to try to counter these foreign threats how do so um I have spoken about the fact and we

190
00:19:54,960 --> 00:20:01,640
have spoken about the fact that Homeland Security has converged with National Security right it is

191
00:20:01,640 --> 00:20:03,300
not um the lens the

192
00:20:03,300 --> 00:20:10,980
the aperture is not exclusively domestic by any stretch I know that Jen Easterly the leader of

193
00:20:10,980 --> 00:20:20,720
sisa spoke earlier with her counterpart from Ukraine the cooperation between the United States

194
00:20:20,720 --> 00:20:29,920
and Ukraine in assisting Ukraine in defending its systems against Russian attack I think is a success

195
00:20:29,920 --> 00:20:32,740
story Rob Silvers is here our

196
00:20:33,300 --> 00:20:39,620
secretary for strategy policy and plans leading our international efforts along with Ann Neuberger

197
00:20:39,620 --> 00:20:46,260
of the National Security Council Homeland Security and National Security have converged in this

198
00:20:46,260 --> 00:20:52,220
environment and there's um are there models um are we sort of following a UK model or we we have

199
00:20:52,220 --> 00:20:56,240
our own unique model and other people are learning from us because it seems like we're all trying to

200
00:20:56,240 --> 00:21:02,760
figure this out at the same time is it sort of like um I I think here I would use the

201
00:21:03,300 --> 00:21:07,940
word partnership again and I would just broaden it to say we have to work very closely with our

202
00:21:07,940 --> 00:21:14,160
international partners and in the work that we do in this in this realm what is the um what is the

203
00:21:14,160 --> 00:21:23,300
relevance of a physical border um so then uh so so then you're building these actually international

204
00:21:23,300 --> 00:21:31,400
communities yes and so um which I'm I'm really glad to see because you know it's a it's kind of

205
00:21:31,400 --> 00:21:33,060
like we're fighting like a two or three

206
00:21:33,300 --> 00:21:37,240
strong battle right you've got the hard the physical we're actually under ransomware attack

207
00:21:37,240 --> 00:21:44,120
things are actually being deleted we're in sort of an information hearts and minds kind of you know

208
00:21:44,120 --> 00:21:51,260
wedging communities in America against each other um and then we're also in an influence game and

209
00:21:51,260 --> 00:21:57,800
this is where I think United States until recently was kind of behind where standards bodies IETF

210
00:21:57,800 --> 00:22:02,800
other communities America that helped build these like the companies that helped build

211
00:22:02,800 --> 00:22:02,980
them

212
00:22:03,300 --> 00:22:07,720
where so successful they just kind of moved on and that created a gap for other countries

213
00:22:07,720 --> 00:22:13,500
um China Russia to show up and basically co-opt a lot of these standards bodies

214
00:22:13,500 --> 00:22:20,740
um and now I see DHS Sisa and others representing sending officials showing

215
00:22:20,740 --> 00:22:26,060
this is American perspective this is the DHS person this is and it's so refreshing to see

216
00:22:26,060 --> 00:22:33,020
us out and engaging again that was really missing for years and the problem is that takes money and

217
00:22:33,020 --> 00:22:38,200
time to build trust you need some consistency and a lot of times that

218
00:22:38,200 --> 00:22:41,640
that's not present in some of our institutions I think it's very very

219
00:22:41,640 --> 00:22:48,120
difficult to build trust if one is not present right one you know look I you

220
00:22:48,120 --> 00:22:55,360
know the last time I was in the department in 2010 I shared with a

221
00:22:55,360 --> 00:23:01,260
colleague very he was very reticent to go into the community and get his teeth

222
00:23:01,260 --> 00:23:07,820
knocked out and I said look you know what you got to get out there you're

223
00:23:07,820 --> 00:23:15,340
gonna get your teeth sorry I can't see you over there yeah you got to get go

224
00:23:15,340 --> 00:23:19,980
out there you got to get your teeth bashed in and then you know what you

225
00:23:19,980 --> 00:23:24,940
come back and then at least people see that you're willing to get your teeth

226
00:23:24,940 --> 00:23:30,720
bashed in you will maybe realize when you pick up

227
00:23:30,720 --> 00:23:35,860
your teeth that some of them deserve to be on the floor others deserve to be put

228
00:23:35,860 --> 00:23:39,480
back and you learn and you get better but you got you how do you how do you

229
00:23:39,480 --> 00:23:45,000
build trust if you don't engage right and it's painful right you can't always

230
00:23:45,000 --> 00:23:49,100
you can't please all the people all the time so you have to really focus on what

231
00:23:49,100 --> 00:23:56,400
your priorities are it is really painful to not be trusted yeah so let's talk

232
00:23:56,400 --> 00:23:59,520
about that a little bit more right you mentioned two things that I'm proud of

233
00:23:59,520 --> 00:24:05,440
of the department the privacy office office of liberties maybe just talk a

234
00:24:05,440 --> 00:24:09,200
little bit about that and if maybe there's a story when privacy officers

235
00:24:09,200 --> 00:24:12,940
shut something down or the civil liberties wrote a report that wasn't the

236
00:24:12,940 --> 00:24:16,320
most glowing like you have these internal functions that not all other

237
00:24:16,320 --> 00:24:23,340
departments and agencies have I think DHS is slightly unique in that area so

238
00:24:23,900 --> 00:24:26,300
you know that I think what we are doing now

239
00:24:28,300 --> 00:24:29,340
more than ever

240
00:24:29,340 --> 00:24:29,500
you know that I think what we are doing now more than ever

241
00:24:29,520 --> 00:24:35,520
is our office for civil rights and civil liberties Shoba who leads it our office

242
00:24:35,520 --> 00:24:43,220
for privacy they have a seat at the leadership table they are involved in

243
00:24:44,140 --> 00:24:51,060
all of our discussions you know we have an office of intelligence and analysis

244
00:24:51,060 --> 00:24:59,140
that shares Intel with our partners around the country our office of civil

245
00:24:59,140 --> 00:25:03,520
rights and civil liberties reviews those products to make sure that they

246
00:25:03,520 --> 00:25:09,280
are sensitive to our principles our values and have they ever axed something

247
00:25:09,280 --> 00:25:15,360
or is it no things are pretty good they they're not having yeah they're not

248
00:25:15,360 --> 00:25:22,860
passive good because one of the things I worry about maybe is you know you

249
00:25:22,860 --> 00:25:29,120
touched on AI a little bit and it seems like the potential for abuse of

250
00:25:29,140 --> 00:25:35,600
human rights is is greater with AI and I think the pressure on companies on

251
00:25:35,600 --> 00:25:40,260
people on governments is to use I AI everywhere to become more efficient and

252
00:25:40,260 --> 00:25:44,860
it seems like when the government uses AI it's different than maybe a

253
00:25:44,860 --> 00:25:49,500
university uses AI so I think the potential for harm or for potential for

254
00:25:49,500 --> 00:25:54,380
benefit is greater in government and that means looking we're using Jeff

255
00:25:54,380 --> 00:25:58,320
we're using AI now in the context of facial recognition

256
00:25:58,320 --> 00:26:01,960
something that our office for civil rights civil liberties is taking a

257
00:26:01,960 --> 00:26:05,180
this is the TSA when you're when you're boarding a plane you're screening so

258
00:26:05,840 --> 00:26:11,420
yeah yeah well there I think we were explaining what we do and what we don't

259
00:26:11,420 --> 00:26:17,720
do but in other arenas as well you know there are significant concerns with

260
00:26:17,720 --> 00:26:27,660
facial recognition recognitions ability to discern individuals with different

261
00:26:27,660 --> 00:26:28,300
colors and colors and colors and colors and colors and colors and colors and colors

262
00:26:28,320 --> 00:26:35,620
skin different tones especially concerned about youth and like and

263
00:26:35,620 --> 00:26:41,100
these are challenges that we have to tackle we have to confront and work

264
00:26:41,100 --> 00:26:45,860
through it do you see will be sort of an AI oversight board or is that just

265
00:26:45,860 --> 00:26:48,780
going to be merged in with the civil liberties and the privacy or does this

266
00:26:48,780 --> 00:26:53,040
constitute a new thing or will you task every one of your departments and

267
00:26:53,040 --> 00:26:57,940
agencies and say you need to have an AI report or you need to have a you know a

268
00:26:57,940 --> 00:26:58,440
report about the to the public and then you have to have a data security report

269
00:26:58,440 --> 00:27:04,800
so I I think one of the things that we are looking at and I don't I get too far

270
00:27:04,800 --> 00:27:11,160
ahead is you know to have a like a safety safety review board just like our

271
00:27:11,160 --> 00:27:19,480
cyber safety review board that is now issued you know very significant reports

272
00:27:19,480 --> 00:27:26,720
the first one was log 4j the second one with lapsus and now we we we just

273
00:27:26,720 --> 00:27:34,500
announced um you know lessons to be learned uh with respect to um uh uh identification you know

274
00:27:34,500 --> 00:27:39,900
identity authentication uh in the cloud-based environment so that we just announced that i

275
00:27:39,900 --> 00:27:45,660
think there's just a lot of a lot of things and by the way what's what distinguishes that board

276
00:27:46,120 --> 00:27:54,780
in addition to just its groundbreaking work it it is um security researchers talent your talent

277
00:27:54,780 --> 00:28:03,220
is involved in the analysis of incidents and in the recommendations that are made it is a board

278
00:28:03,220 --> 00:28:08,760
that is not about accountability it is not about blame it is about learning and strengthening

279
00:28:08,760 --> 00:28:15,380
it's sort of that what's the the the near miss the the pilot uh faa one where if you if you make the

280
00:28:15,380 --> 00:28:20,380
contribution and point out the problem you're basically insulated from liability but if you

281
00:28:20,380 --> 00:28:24,460
don't reveal the problem and it blows up in your face now you're in trouble right you want to

282
00:28:24,780 --> 00:28:29,240
incentivize this collaborative environment where people aren't pointing fingers at each other

283
00:28:29,240 --> 00:28:37,380
yeah we're it's it's all about um identifying uh well understanding the treasure the open source

284
00:28:37,380 --> 00:28:44,420
environment uh understanding how to make it more secure and like and rob is is the chair of the

285
00:28:44,420 --> 00:28:50,920
board yeah so that and and uh heather atkins from google is the vice chair it's a public private

286
00:28:50,920 --> 00:28:54,720
partnership and we use uh security researchers to really draw

287
00:28:54,780 --> 00:29:02,200
together and drive the best results so on that open source question um this is a hobby horse of

288
00:29:02,200 --> 00:29:08,720
mine is to beat up companies that they take a lot from open source in the sense that they build

289
00:29:08,720 --> 00:29:16,180
products they innovate a lot but they don't upstream their code changes they don't fund the

290
00:29:16,880 --> 00:29:22,140
communities of which they get their software um and the one i like to point out that does a really

291
00:29:22,140 --> 00:29:23,200
good job of this is netflix

292
00:29:24,780 --> 00:29:31,560
changes um on the networking for freebsd and every change they make ends up they fund code

293
00:29:31,560 --> 00:29:40,160
optimization and freebsd the operating system is way better because of netflix and netflix is way

294
00:29:40,160 --> 00:29:47,240
better because of this relationship that's a very positive uh ecosystem yeah ecosystem give and take

295
00:29:47,240 --> 00:29:52,440
but that's rare that doesn't really happen much and and so it almost feels like um a tragedy of

296
00:29:52,440 --> 00:29:54,760
the commons kind of social dilemma problem where

297
00:29:55,170 --> 00:30:02,980
um the the the backs on which we're built all this is built they're not getting kind of rewarded

298
00:30:02,980 --> 00:30:08,220
and in tragedy the common problems or social level problems a lot of times the solution is

299
00:30:08,220 --> 00:30:14,200
government right government does not exist in a purely commercial function they're filling the

300
00:30:14,200 --> 00:30:19,980
gaps for what the needs of society are which are maybe not commercial needs and so i'm really

301
00:30:19,980 --> 00:30:24,760
excited here when you talk about open source are there ways we can support open source

302
00:30:24,780 --> 00:30:29,540
fund open source identify critical pieces of opens it's like anything that makes open source

303
00:30:29,540 --> 00:30:36,120
more healthy you're raising the boats for everybody in the planet not just you know a state

304
00:30:37,420 --> 00:30:43,360
so uh i mean i know that we have reached out with respect to

305
00:30:43,360 --> 00:30:53,320
how you can help us secure uh that environment um jeff if there are other ways in which you know

306
00:30:53,320 --> 00:30:54,320
other aspects

307
00:30:54,900 --> 00:30:59,940
as to which we should reach out yeah uh then let's let's talk about that and let's do that

308
00:30:59,940 --> 00:31:04,480
yeah i think one of the things i think fema would have grants um i've been talking with director

309
00:31:04,480 --> 00:31:10,060
easterly you know are there ways you could identify and do a summer of code a grant to

310
00:31:10,060 --> 00:31:14,580
improve the security feature that we all need but there's no the company's not interested in

311
00:31:14,580 --> 00:31:20,280
adding it you know are there kind of commonalities where we can help improve the system but i don't

312
00:31:20,280 --> 00:31:24,400
know the grant process i don't know how you know i don't know how that part of government works

313
00:31:24,780 --> 00:31:29,220
but i do know if something like that doesn't happen if it's not philanthropic or government

314
00:31:29,880 --> 00:31:35,380
or you know it's probably not going to happen so we um so a couple thoughts one we have a

315
00:31:35,380 --> 00:31:45,760
cybersecurity grant program um two uh our grant process um is not a model of simplicity

316
00:31:49,060 --> 00:31:52,540
it is something that we are working on

317
00:31:54,780 --> 00:32:03,380
tasked a private sector advisory council to make recommendations maybe we need to take a look at

318
00:32:03,380 --> 00:32:16,580
how we can deliver grants to non-traditional um recipients uh and maybe and maybe that'll help

319
00:32:16,580 --> 00:32:22,980
build the partnership um that i request as well yeah i know i think one of the things maybe we

320
00:32:22,980 --> 00:32:28,500
have to step out of the orthodox on that in terms of um grant recipients and um

321
00:32:28,500 --> 00:32:35,940
i want to touch briefly on some of your comments a little bit uh developing the the talent pool

322
00:32:35,940 --> 00:32:42,340
the workforce right how is dhs going to onboard these people and it's fascinating to hear years

323
00:32:42,340 --> 00:32:48,060
ago i was on a task force at dhs on uh developing the cyber skills task force and to see those

324
00:32:48,060 --> 00:32:52,920
recommendations kick in and things to change how would you see you know you're calling from

325
00:32:52,920 --> 00:32:52,960
a different perspective how would you see you know you're calling from a different perspective

326
00:32:52,980 --> 00:32:58,260
people to come to dhs how has it changed in your perspective you know onboarding offboarding the

327
00:32:58,260 --> 00:33:03,460
idea that maybe people don't enter government service for their career maybe now they're

328
00:33:03,460 --> 00:33:08,140
entering for a period of time and coming in and out of private sector like the way people work

329
00:33:08,140 --> 00:33:15,600
seems to have changed so so absolutely and it doesn't it doesn't need to be a commitment you

330
00:33:15,600 --> 00:33:22,500
know in perpetuity you'll you'll decide the duration uh that you would want to stay we will we

331
00:33:22,500 --> 00:33:28,840
would love your talent to bring in your talent for whatever period of time uh you'd be willing

332
00:33:28,840 --> 00:33:37,360
to do that you know we have um we have models where it's actually um uh we we almost like borrow

333
00:33:38,220 --> 00:33:45,400
um your time your your talent for a short period of time for six months uh or or so

334
00:33:45,400 --> 00:33:52,100
i will tell you um and jen and i have talked about this i have a i have a mixed feeling about

335
00:33:52,500 --> 00:34:01,720
um some of one aspect of our recruitment of of cyber talent um it's tough to recruit because

336
00:34:01,720 --> 00:34:09,160
in the private sector the the we can't compete from a financial perspective and uh we have

337
00:34:09,160 --> 00:34:16,500
been able to kick up um the income of incoming cyber talent and i've got very mixed feelings

338
00:34:16,500 --> 00:34:20,760
about that because i have to tell you you don't come to the government for the money

339
00:34:21,620 --> 00:34:22,260
and

340
00:34:22,500 --> 00:34:32,660
there are people that have dedicated their lives to public service and the reward the reward is um

341
00:34:32,970 --> 00:34:43,840
a more fundamental reward than the than financial and i know that a the vast majority of you if not

342
00:34:43,840 --> 00:34:50,980
all of you i don't know your community well enough to to say but the the reward that you seek

343
00:34:51,720 --> 00:34:59,140
is you're not you don't do what you do for for money you do you do it for its consequential

344
00:34:59,740 --> 00:35:07,080
nature what it means what it means to you what it means to you well so you're talking

345
00:35:07,080 --> 00:35:12,660
right the sense of mission a sense of mission right a sense of i would say a sense of purpose

346
00:35:13,840 --> 00:35:20,780
and um and so i think civil society can provide that government can provide that

347
00:35:20,980 --> 00:35:27,440
um our communities right we provide that for each other um and so once you recognize that you

348
00:35:27,440 --> 00:35:32,160
you need to you need to have a really clearly defined sense of mission you need to be able

349
00:35:32,160 --> 00:35:36,480
to not have one part of your department destroy the sense of mission from another department right

350
00:35:36,480 --> 00:35:43,860
it gets very um and in the social media age you you need to be nimble and be able to respond so

351
00:35:43,860 --> 00:35:50,960
i was going to say um how fun is it for you that um eight years ago or so as a as a

352
00:35:50,980 --> 00:35:54,360
Now you're S2, now you're S1, or you go from,

353
00:35:55,460 --> 00:35:57,940
how do you make that transition and how does it go,

354
00:35:58,180 --> 00:36:00,260
I guess what I'm getting at is like,

355
00:36:00,300 --> 00:36:02,120
what excites you, right?

356
00:36:02,960 --> 00:36:05,300
Fun wouldn't be the first word that comes to mind.

357
00:36:05,960 --> 00:36:09,520
Right, so it's the sense of mission that's the motivator.

358
00:36:14,140 --> 00:36:15,060
100%, 100%.

359
00:36:16,640 --> 00:36:20,280
But my greatest source of pride is the people

360
00:36:20,280 --> 00:36:24,920
with whom I get to work, and the purpose that we all share.

361
00:36:25,100 --> 00:36:26,760
That is my greatest source of pride.

362
00:36:26,900 --> 00:36:32,980
I have to tell you, you know, we came to this country

363
00:36:32,980 --> 00:36:36,700
in 1960 as refugees, political refugees,

364
00:36:39,620 --> 00:36:42,360
escaping the communist takeover of Cuba.

365
00:36:43,020 --> 00:36:45,120
It was the second time in my mother's life

366
00:36:45,120 --> 00:36:46,520
that she was a refugee.

367
00:36:46,840 --> 00:36:50,040
I have, I grew up with a profound,

368
00:36:50,280 --> 00:36:52,800
profound sense of gratitude with respect

369
00:36:52,800 --> 00:36:57,620
to what this country was able to give to my family, and me.

370
00:36:57,800 --> 00:37:02,460
And that's what led me in 1989 to join the government

371
00:37:02,460 --> 00:37:04,140
as a career employee.

372
00:37:04,660 --> 00:37:07,440
And that was, you had become a lawyer by then,

373
00:37:07,580 --> 00:37:08,280
or this was after?

374
00:37:08,280 --> 00:37:09,840
I was a lawyer at that time.

375
00:37:10,740 --> 00:37:14,880
And so, that perspective, the legal perspective,

376
00:37:15,000 --> 00:37:19,920
your background, I think that helps you connect

377
00:37:20,520 --> 00:37:22,460
you think with people in these communities,

378
00:37:22,560 --> 00:37:26,640
because you understand what it is to maybe be in their shoes.

379
00:37:26,800 --> 00:37:32,400
That empathy, that we don't see in a whole lot of leadership

380
00:37:32,880 --> 00:37:36,040
in companies, right, where it's a lot about bravado.

381
00:37:37,240 --> 00:37:38,160
Can I?

382
00:37:38,300 --> 00:37:40,240
Yeah, how do you leave that behind?

383
00:37:40,580 --> 00:37:44,840
Can I, let me, can I share a quick story?

384
00:37:45,060 --> 00:37:45,560
Yeah, please.

385
00:37:46,000 --> 00:37:50,260
Because you say, being in people's shoes,

386
00:37:52,780 --> 00:37:55,720
I have to share this, even though it's,

387
00:37:55,740 --> 00:37:58,440
I'm gonna stand so I can see.

388
00:37:58,600 --> 00:37:59,260
Sure, sure.

389
00:37:59,380 --> 00:38:00,660
It's too personal for me.

390
00:38:01,320 --> 00:38:05,980
So, I grew up in a home where my parents really

391
00:38:09,040 --> 00:38:12,540
made sure that my sister and me understood

392
00:38:13,200 --> 00:38:15,360
what it means to be displaced.

393
00:38:18,660 --> 00:38:24,200
My father left the country of his birth,

394
00:38:24,440 --> 00:38:30,060
he did not get a chance to be by his mother's side

395
00:38:30,060 --> 00:38:31,820
when she passed.

396
00:38:32,160 --> 00:38:35,340
He had to take us out.

397
00:38:36,040 --> 00:38:40,100
And I grew up with a really profound understanding

398
00:38:40,100 --> 00:38:42,980
of what it means to be a refugee, a political refugee.

399
00:38:43,280 --> 00:38:45,340
Then in 2004, I went to the United States and I was,

400
00:38:45,340 --> 00:38:50,880
I think it was 2011, I was the director of U.S. Citizenship and Immigration Services.

401
00:38:51,200 --> 00:38:57,580
We administer the legal immigration system, and we have our refugee affairs officers who travel

402
00:38:57,580 --> 00:39:02,500
around the world and interview people to determine their eligibility to come to the United States

403
00:39:02,500 --> 00:39:10,460
refugees. And I visited the refugee camp in Dadaab on the Kenyan-Somali border. We traveled by

404
00:39:10,460 --> 00:39:19,620
a small jump plane from Nairobi to this camp. And the entire flight, all you see is sand.

405
00:39:20,920 --> 00:39:29,500
All you see is sand. And these individuals had traveled from Somalia to this camp

406
00:39:30,400 --> 00:39:36,140
hundreds of miles. I don't know how they made it. And the camp was designed for 90,000 people,

407
00:39:36,240 --> 00:39:38,500
and at the time I visited, there were 300,000.

408
00:39:40,460 --> 00:39:45,740
There were people who were sleeping on the sand, and they were covered by either plastic or paper bags.

409
00:39:46,220 --> 00:39:51,560
And I said, there's nothing. And they shipped food in. They shipped food in twice a week.

410
00:39:53,780 --> 00:40:01,880
And I sat in on an interview of a family. Parents, father and mother, and four children.

411
00:40:02,700 --> 00:40:10,040
And our refugee affairs officer spoke first to the eldest of the children.

412
00:40:10,460 --> 00:40:15,620
A 17-year-old young woman. And asked her where she had been born.

413
00:40:16,800 --> 00:40:25,440
And she looked down, and then she looked at my colleague, like puzzled, and said, I was born here.

414
00:40:28,220 --> 00:40:32,400
She had known nothing else but this camp.

415
00:40:33,580 --> 00:40:39,960
And you cannot describe these individuals as poor, because poor suggests you have, in my mind,

416
00:40:39,960 --> 00:40:42,880
you have something, you just don't have enough. They have nothing.

417
00:40:43,800 --> 00:40:50,560
And I left there, first of all, thinking the world is not civilized.

418
00:40:51,940 --> 00:40:56,500
And second of all, I couldn't call myself a refugee.

419
00:40:59,160 --> 00:41:06,080
She's a refugee. This family, they're refugees. We came with things.

420
00:41:06,820 --> 00:41:09,940
And my father, though he struggled for it, he was a refugee.

421
00:41:09,960 --> 00:41:11,960
For a period, was on his feet.

422
00:41:15,200 --> 00:41:19,580
And I've carried that with me, because I've never been in their shoes.

423
00:41:19,860 --> 00:41:23,980
I've carried that with me. It's just not an opportunity.

424
00:41:24,080 --> 00:41:27,940
It's not an opportunity. It's a responsibility of government to address that.

425
00:41:28,680 --> 00:41:36,140
And, you know, whenever we issue a policy, whether it's in cybersecurity or anything,

426
00:41:36,460 --> 00:41:39,760
that says something about not only who we are,

427
00:41:39,960 --> 00:41:41,160
but who we want to be.

428
00:41:41,520 --> 00:41:46,340
And there are many policies of which I am incredibly proud,

429
00:41:46,560 --> 00:41:50,220
and there are many of which I am not.

430
00:41:50,720 --> 00:41:54,360
And it's sometimes a struggle.

431
00:41:54,600 --> 00:41:56,280
It's always a privilege.

432
00:41:56,920 --> 00:42:03,080
And, you know, making a difference, sometimes a small difference,

433
00:42:03,700 --> 00:42:07,800
sometimes a really big difference, is really why...

434
00:42:08,880 --> 00:42:13,940
You find that that's why a lot of the people are in government,

435
00:42:14,100 --> 00:42:15,800
to make a difference.

436
00:42:15,980 --> 00:42:17,280
It's all about people.

437
00:42:17,420 --> 00:42:22,320
You make a huge difference in what you do.

438
00:42:22,480 --> 00:42:29,520
You can make such a big difference in helping us be proud of everything that we do

439
00:42:29,520 --> 00:42:35,060
and closing the gap in our sense of our own pride.

440
00:42:35,060 --> 00:42:40,400
And I really, I just, if I have one message to all of you,

441
00:42:40,440 --> 00:42:44,640
is, quite frankly, I mean, I do care.

442
00:42:44,740 --> 00:42:46,920
I was about to say I don't care if you trust us or not.

443
00:42:46,980 --> 00:42:48,440
I do care really deeply.

444
00:42:48,740 --> 00:42:55,320
You know, maybe you have to wait till we've built your trust.

445
00:42:55,600 --> 00:42:59,200
Maybe you're willing to give it to us and see if we keep it.

446
00:42:59,260 --> 00:43:04,620
Whatever it is, you know far better than I,

447
00:43:04,620 --> 00:43:07,040
I'm not expert in your work.

448
00:43:07,300 --> 00:43:09,300
I recognize your talent.

449
00:43:11,300 --> 00:43:19,500
You see things, you find problems, you know how to fix them.

450
00:43:19,960 --> 00:43:22,960
That can really make a difference in people's lives.

451
00:43:23,440 --> 00:43:27,560
And I know that that is why you do what you do.

452
00:43:28,240 --> 00:43:30,500
You also, of course, have to support yourselves.

453
00:43:30,840 --> 00:43:33,140
So it's not hack DHS for nothing.

454
00:43:33,140 --> 00:43:35,740
It's a hack DHS bug bounty program.

455
00:43:36,000 --> 00:43:37,860
We all have to make a living.

456
00:43:38,420 --> 00:43:40,800
But there's a sense of purpose in this room.

457
00:43:41,120 --> 00:43:45,740
And we, I want to just communicate that we share a purpose.

458
00:43:56,520 --> 00:43:57,500
Okay, Ali.

459
00:43:57,620 --> 00:43:58,960
We can't beat that.

460
00:43:59,080 --> 00:44:00,580
I don't have a topper question.

461
00:44:00,820 --> 00:44:02,140
That was incredible.

462
00:44:03,560 --> 00:44:08,140
And I really want to thank you for coming out here and talking with us.

463
00:44:10,640 --> 00:44:12,840
And I'm really proud of what the department's been doing.

464
00:44:12,980 --> 00:44:14,320
And that's largely in part to you.

465
00:44:14,380 --> 00:44:16,260
So thank you for coming out and talking with our community.

466
00:44:16,460 --> 00:44:17,400
Thank you all very much.

467
00:44:17,480 --> 00:44:18,000
Thank you, Jeff.

468
00:44:18,100 --> 00:44:18,500
Thank you.