1
00:00:04,080 --> 00:00:16,140
Thank you, so one December day in the middle of a global pandemic the world

2
00:00:16,140 --> 00:00:21,660
learned about a fairly sophisticated intrusion into an enterprise management

3
00:00:21,660 --> 00:00:28,640
software system known as SolarWinds and when we discover that the media

4
00:00:28,640 --> 00:00:32,980
environment and the cyber security community, national security community

5
00:00:32,980 --> 00:00:40,160
went into overdrive talking about this intrusion. One senator called this

6
00:00:40,960 --> 00:00:50,020
equivalent to an armed attack. One commenter summarizing all of this said

7
00:00:50,020 --> 00:00:54,480
that this incident hit every single one of our nightmare scenarios.

8
00:00:57,100 --> 00:00:57,900
Hmm.

9
00:01:01,020 --> 00:01:10,320
That commenter was me, commenting from my lockdown living room in the middle of the pandemic.

10
00:01:10,580 --> 00:01:17,600
I'm Mika Ouyang. I used to be a think tanker where I did a lot of work writing about cyber

11
00:01:17,600 --> 00:01:28,080
crime and cyber security and after this, with all of this hype, a few weeks later I came into government

12
00:01:30,280 --> 00:01:30,800
and said my country is a good space to be.

13
00:01:30,800 --> 00:01:37,200
I'm Mika Ouyang the Deputy Assistant Secretary for Cyber Policy, I am the Senior Civilian

14
00:01:37,200 --> 00:01:42,780
Policy official in the Department of Defense, you might have heard of us. And I had to deal

15
00:01:42,780 --> 00:01:48,540
with this incident, how the government was going to respond to it and subsequent attacks

16
00:01:48,540 --> 00:01:55,860
like the Hafnium intrusion and Microsoft systems and colonialism pipeline, and one of the things

17
00:01:55,860 --> 00:01:58,620
that I had to wrestle with was the consequences of that.

18
00:01:58,640 --> 00:02:04,060
rhetoric that we had talked about in the national security community to describe

19
00:02:04,060 --> 00:02:10,940
cyber incidents and one of the challenges that I discovered is that a

20
00:02:10,940 --> 00:02:15,880
lot of the mental models that we use to describe cyber incidents don't actually

21
00:02:15,880 --> 00:02:21,660
map to our lived experience in the cyber domain and so you know really start

22
00:02:21,660 --> 00:02:25,800
wondering like why are we so off why are the ways in which we talk about these

23
00:02:25,800 --> 00:02:31,900
things so different from the reality that we experience and and frankly that

24
00:02:31,900 --> 00:02:37,340
rhetorical difference inhibits a useful policy conversation about how we respond

25
00:02:37,340 --> 00:02:43,460
how serious and big these things are and one of the things I realized is that

26
00:02:43,460 --> 00:02:48,240
national security people tend to talk about these things in the frames that

27
00:02:48,240 --> 00:02:54,220
they understand and so you know I did that too I had been a professional staff

28
00:02:54,220 --> 00:02:55,600
member on the House Intelligence Committee

29
00:02:55,600 --> 00:03:00,740
I had responded to the buckshot Yankee operation buckshot Yankee which some of

30
00:03:00,740 --> 00:03:05,800
you may remember from 2008 I thought I understood cyber and the ways in which

31
00:03:05,800 --> 00:03:12,440
we as a national security community talked about it but as I said the ways

32
00:03:12,440 --> 00:03:17,220
in which we've talked about it have not actually been that helpful and there is

33
00:03:17,220 --> 00:03:24,620
a huge difference between cyber war and then cyber in war

34
00:03:25,600 --> 00:03:28,300
so I want to talk to you guys today a little bit about where those mental

35
00:03:28,300 --> 00:03:33,560
models came from how that differs from our experience and how we see that and

36
00:03:33,560 --> 00:03:38,840
then what that means for us going forward so let me start at the beginning

37
00:03:38,840 --> 00:03:45,500
beginning some of you may be familiar with this screen grab for those of you

38
00:03:45,500 --> 00:03:53,860
who are not ask your parents about the movie war games war games was a movie

39
00:03:53,860 --> 00:03:55,580
where a young and trapped bit hacker from the United States was killed by a

40
00:03:55,600 --> 00:03:55,640
bunch of huge tyrants and they were all killed by armed forces and one of the

41
00:03:55,640 --> 00:03:56,860
racist thugs and then the film for those of you who were too young to

42
00:03:56,860 --> 00:04:00,720
remember this breaks into the Department of Defense's nuclear command and control

43
00:04:00,720 --> 00:04:04,860
systems and demonstrates that the world could be destroyed through Mutually

44
00:04:04,860 --> 00:04:10,140
Assured Destruction this movie is really sort of the start of not only

45
00:04:10,140 --> 00:04:12,600
cybersecurity but a number of other things for the Department of Defense

46
00:04:13,640 --> 00:04:17,320
including when President Reagan saw it a recognition that we had to engage in

47
00:04:17,320 --> 00:04:19,560
in arms control negotiations with the then Soviet Union,

48
00:04:19,780 --> 00:04:21,740
but also his recognition that, hey,

49
00:04:22,770 --> 00:04:24,340
some of our sensitive DOD systems

50
00:04:24,340 --> 00:04:26,320
might be vulnerable to hacking.

51
00:04:27,710 --> 00:04:30,600
And so when the Department of Defense

52
00:04:31,090 --> 00:04:32,740
stood up its first cyber command,

53
00:04:33,760 --> 00:04:37,160
we stood it up as subordinate to US Strategic Command.

54
00:04:38,090 --> 00:04:41,300
And that subordination meant that the ways

55
00:04:41,300 --> 00:04:43,040
in which Strategic Command thought about

56
00:04:43,040 --> 00:04:44,300
the management of nuclear weapons,

57
00:04:44,400 --> 00:04:45,380
which was their main mission,

58
00:04:45,880 --> 00:04:47,680
infected a lot of the ways in which

59
00:04:47,680 --> 00:04:49,460
we thought about the cyber domain.

60
00:04:50,020 --> 00:04:52,840
So concepts like mutually assured destruction,

61
00:04:53,320 --> 00:04:55,760
some of these concepts about mutual hold at risk,

62
00:04:55,800 --> 00:04:58,240
the idea that you could do something to the adversary

63
00:04:58,240 --> 00:05:00,160
the same way that he would do it to you,

64
00:05:00,810 --> 00:05:02,820
really guided a lot of the thinking

65
00:05:03,490 --> 00:05:09,000
around how the department approached cyber.

66
00:05:09,800 --> 00:05:11,680
And I know that term is like fraud.

67
00:05:12,600 --> 00:05:14,420
But it really shaped a lot of the ways

68
00:05:14,420 --> 00:05:15,260
in which we thought about it,

69
00:05:15,260 --> 00:05:16,900
and so as time went on,

70
00:05:16,940 --> 00:05:20,860
we still tended to view the cyber impacts

71
00:05:21,700 --> 00:05:25,300
at the high end of the national security threats

72
00:05:25,300 --> 00:05:26,160
that we experienced.

73
00:05:26,540 --> 00:05:28,560
You heard language and DOD officials talking about

74
00:05:28,560 --> 00:05:31,440
a cyber 9-11 or a cyber Pearl Harbor,

75
00:05:31,620 --> 00:05:34,260
thinking that it was going to be this kind of big attack

76
00:05:34,760 --> 00:05:39,840
that would change society and leave everybody in darkness.

77
00:05:41,300 --> 00:05:43,960
And so we thought about it in those terms.

78
00:05:45,700 --> 00:05:49,060
We thought it was going to be like the end of Mr. Robot season one,

79
00:05:49,180 --> 00:05:50,540
like everything goes dark and there's chaos.

80
00:05:52,880 --> 00:05:55,020
And then also for the Department of Defense,

81
00:05:55,140 --> 00:05:56,340
as we thought about that activity,

82
00:05:56,600 --> 00:05:59,180
we thought about it in terms of war.

83
00:06:00,180 --> 00:06:02,760
Which meant that we were thinking about it

84
00:06:02,760 --> 00:06:04,980
just in terms of what crossed the threshold

85
00:06:04,980 --> 00:06:08,640
for the Department of Defense as an armed attack.

86
00:06:08,780 --> 00:06:11,000
What would be the trigger in cyber

87
00:06:11,000 --> 00:06:14,860
that would bring the rest of our capabilities to bear?

88
00:06:15,260 --> 00:06:18,600
And in doing that, we didn't really think as carefully

89
00:06:18,600 --> 00:06:19,860
about a whole range of activity

90
00:06:19,860 --> 00:06:23,440
that was happening every day in the internet domain.

91
00:06:24,320 --> 00:06:27,840
Espionage, criminal activity, hacktivism.

92
00:06:28,300 --> 00:06:29,920
There were all kinds of things happening

93
00:06:29,920 --> 00:06:31,800
that were not rising to the level

94
00:06:31,800 --> 00:06:32,660
of the Department of Defense,

95
00:06:32,800 --> 00:06:33,300
and everyone was like,

96
00:06:33,400 --> 00:06:35,240
when is the Department of Defense getting in the game?

97
00:06:40,000 --> 00:06:43,660
But our experience in cyber war,

98
00:06:43,760 --> 00:06:45,240
and the people who like very, you know, the cyber war,

99
00:06:45,240 --> 00:06:46,960
you know, we're working on thinking these things through

100
00:06:46,960 --> 00:06:47,680
sort of a hypothetical.

101
00:06:49,580 --> 00:06:51,940
The hypothetical didn't match the reality

102
00:06:51,940 --> 00:06:54,300
of what we were experiencing,

103
00:06:54,580 --> 00:06:56,140
what we have subsequently learned.

104
00:06:57,000 --> 00:06:59,880
So, if you think about 2017,

105
00:07:00,740 --> 00:07:04,820
and the cyber attacks against Ukraine by Russia,

106
00:07:05,220 --> 00:07:08,420
that were significant disruptions to their electric grid,

107
00:07:08,740 --> 00:07:11,020
there were significant disruptions

108
00:07:11,020 --> 00:07:12,100
to their critical infrastructure,

109
00:07:12,300 --> 00:07:14,660
and people said, this is cyber war.

110
00:07:14,660 --> 00:07:16,180
This is the kind of attack

111
00:07:16,180 --> 00:07:17,820
that we are expecting in the cyber domain.

112
00:07:20,560 --> 00:07:23,820
What we learned in 2022

113
00:07:26,040 --> 00:07:31,960
is that cyber attacks are actually not the same,

114
00:07:32,080 --> 00:07:35,520
like cyber war is not the same as cyber in war.

115
00:07:36,340 --> 00:07:37,440
And the cyber attacks

116
00:07:37,440 --> 00:07:39,140
against Ukraine's critical infrastructure

117
00:07:39,140 --> 00:07:41,980
were not nearly as devastating or impactful

118
00:07:42,360 --> 00:07:44,640
as the kinetic attacks that Russia, Ukraine, Russia, Russia,

119
00:07:44,660 --> 00:07:46,060
Russia launched against Ukraine

120
00:07:46,060 --> 00:07:48,940
in their attempt to take the entire country, right?

121
00:07:49,140 --> 00:07:51,980
Kinetic war and cyber's use in kinetic war

122
00:07:52,340 --> 00:07:54,100
is very different than the ways

123
00:07:54,100 --> 00:07:56,080
in which we were talking about cyber war.

124
00:07:56,340 --> 00:07:57,420
And I don't know if you remember

125
00:07:57,420 --> 00:07:58,320
at the beginning of the conflict,

126
00:07:58,420 --> 00:08:00,260
everyone's like, well, where's the cyber war

127
00:08:00,260 --> 00:08:01,040
that we were promised?

128
00:08:01,240 --> 00:08:03,380
Like, is cyber the dog that didn't bark?

129
00:08:03,640 --> 00:08:05,280
And part of the challenge of that is like,

130
00:08:05,300 --> 00:08:07,140
the national security rhetoric around this

131
00:08:07,140 --> 00:08:09,960
meant that we had been conditioned to expect

132
00:08:10,420 --> 00:08:13,920
that when that dog barked, it would blow out our eardrums.

133
00:08:14,660 --> 00:08:16,340
But actually when the dog barked,

134
00:08:16,340 --> 00:08:18,060
it barked at the volume of a normal dog.

135
00:08:18,420 --> 00:08:20,620
Cyber did the things that cyber could do.

136
00:08:20,880 --> 00:08:24,680
It just didn't cause the Ukrainians to like roll over

137
00:08:24,680 --> 00:08:26,300
and say, okay, fine, take our country.

138
00:08:26,440 --> 00:08:28,000
It was not going to do that.

139
00:08:29,180 --> 00:08:31,900
There are many other things that affect people's calculus

140
00:08:32,580 --> 00:08:34,520
in the context of an armed conflict.

141
00:08:34,920 --> 00:08:37,060
And indeed we saw, right, the cyber attacks

142
00:08:37,060 --> 00:08:39,080
that the Russians launched against Ukraine

143
00:08:39,080 --> 00:08:39,980
at the outset of the conflict,

144
00:08:40,060 --> 00:08:41,500
even some of the most sophisticated,

145
00:08:41,780 --> 00:08:44,360
like the disruption against the Viasat

146
00:08:44,360 --> 00:08:45,720
satellite communications network

147
00:08:45,720 --> 00:08:48,680
that had spillover effects into NATO countries

148
00:08:48,980 --> 00:08:52,820
was not sufficient to overcome Ukraine's will

149
00:08:52,820 --> 00:08:54,140
to defend its own territory

150
00:08:54,320 --> 00:08:56,560
and the resilient mindset that they displayed

151
00:08:56,560 --> 00:08:59,960
and their ability to look to commercial solutions

152
00:08:59,960 --> 00:09:01,900
to continue fighting their fight.

153
00:09:05,600 --> 00:09:08,780
So what that tells us is that it's not about

154
00:09:09,440 --> 00:09:10,660
cyber deterrence.

155
00:09:11,060 --> 00:09:14,280
It's not about this cyber for cyber, we, you know,

156
00:09:14,360 --> 00:09:16,880
Cyber Pew-Pew, your networks, you Cyber Pew-Pew, ours.

157
00:09:18,880 --> 00:09:21,840
It's now for us about integrated deterrence.

158
00:09:22,180 --> 00:09:24,240
We think about these things in the context

159
00:09:24,240 --> 00:09:28,800
of how can cyber as one of the tools of national power

160
00:09:28,800 --> 00:09:30,720
support all of the other things

161
00:09:30,720 --> 00:09:32,180
that we do in the cyber domain?

162
00:09:33,480 --> 00:09:37,260
So how do we ensure that we can use cyber

163
00:09:37,260 --> 00:09:40,320
to defend our cyber terrain and air, land,

164
00:09:41,560 --> 00:09:44,340
maritime, space, and then what are the tools,

165
00:09:44,360 --> 00:09:49,800
options that we have to use cyber in those other places and it may be that we respond to cyber

166
00:09:49,800 --> 00:09:56,160
things with other tools with sanctions with law enforcement actions with diplomatic demarches and

167
00:09:56,160 --> 00:10:03,600
very very angry letters um but it may be that we also respond with kinetic attacks depending

168
00:10:03,600 --> 00:10:13,240
on the range of things that we have and what is needed at the time so as we think about some of

169
00:10:13,240 --> 00:10:17,120
the challenges and what we've experienced we've learned some things based on our experience

170
00:10:17,780 --> 00:10:20,280
of how cyber is uh different

171
00:10:23,600 --> 00:10:30,300
um and one of those things is about moving at the speed of cyber um we have always assumed that

172
00:10:30,300 --> 00:10:35,600
cyber domain moves quickly because technology moves quickly the attacks come quickly um and so

173
00:10:35,600 --> 00:10:42,720
we often have people asking us like you know can you just give me a cyber option um like tank whistle

174
00:10:42,720 --> 00:10:43,100
me up an

175
00:10:43,240 --> 00:10:48,120
exit and the thing is like you can't just like as you all know tap your fingers on a keyboard

176
00:10:48,120 --> 00:10:55,120
and then have something happen on the other side of the world um it takes time and preparation it

177
00:10:55,120 --> 00:11:02,120
takes understanding it takes engineering it takes coding to be able to um to be able to accomplish

178
00:11:02,120 --> 00:11:07,320
things and so it's not what i think a lot of people expect about how quickly we can move in

179
00:11:07,320 --> 00:11:12,300
the cyber domain and in fact i really appreciate the academic work of a guy leonard mashmeyer

180
00:11:12,300 --> 00:11:13,080
who did an

181
00:11:13,240 --> 00:11:17,980
analysis of russian cyber attacks against ukraine in the run-up to this conflict and he talked about

182
00:11:17,980 --> 00:11:26,000
the cyber trilemma and these um concept of speed intensity and control and how these factors play

183
00:11:26,000 --> 00:11:30,140
off against each other and you can't optimize for all three right it's like good fast cheap

184
00:11:30,140 --> 00:11:37,140
pick two it's speed intensity control pick two and so when you see um an incident like

185
00:11:38,580 --> 00:11:42,060
now pecha you see something that was developed relatively quickly

186
00:11:43,240 --> 00:11:50,440
at a pretty large intensity level but spun out of control and so for us in the department of

187
00:11:50,440 --> 00:11:57,680
defense we're going to optimize for control there are elements of control about making sure that you

188
00:11:57,680 --> 00:12:01,880
don't get caught about doing exactly what you intend to do and no more

189
00:12:02,320 --> 00:12:07,160
to not spill over that's one of the things that we optimize for um you know we spend a lot of

190
00:12:07,160 --> 00:12:10,880
time investing in precision precision weapons and all those other things it's not different in the

191
00:12:10,880 --> 00:12:11,400
cyber domain

192
00:12:13,240 --> 00:12:18,800
and so not only are we optimizing for control there are rules that we the department of defense

193
00:12:18,800 --> 00:12:24,700
have to follow there is no cyber asterisk on the rules under the laws of armed conflict there are

194
00:12:24,700 --> 00:12:31,700
certain things that we would not do via any means poison civilians things like that intentionally

195
00:12:31,700 --> 00:12:36,780
trying to inflict harm on civilians if we're not going to do them via kinetic means we're not going

196
00:12:36,780 --> 00:12:42,480
to do them via cyber means unfortunately i don't know how well understood that is globally around

197
00:12:43,240 --> 00:12:47,180
frankly there are some countries that maybe aren't even living up to those obligations in the

198
00:12:47,180 --> 00:12:54,040
physical space um but for us there are rules that we are going to have to live by as we think about

199
00:12:54,040 --> 00:13:02,740
armed conflict and so right we are reflecting all this in our 2023 cyber strategy which we

200
00:13:02,740 --> 00:13:07,480
hope to roll out publicly soon um we've released a classified version of congress so they're

201
00:13:07,480 --> 00:13:12,860
going through it but we hope to be able to talk to you more about it uh shortly um

202
00:13:13,240 --> 00:13:17,900
but another one of the things that's changed for us that that we reflect here is the how we think

203
00:13:17,900 --> 00:13:23,380
about cyber offense and defense um historically the department had thought about cyber defense

204
00:13:23,380 --> 00:13:28,040
and really prioritized it as like how do we defend the networks that we own and operate

205
00:13:28,700 --> 00:13:31,560
um and we would think about how do you defend all the things all the time

206
00:13:32,220 --> 00:13:36,260
but the challenge is of course the number of attacks we experience are so numerous

207
00:13:36,900 --> 00:13:42,040
so pervasive by so many different actors like you can only hold the door for so long before the

208
00:13:42,040 --> 00:13:43,040
attackers make it through

209
00:13:43,240 --> 00:13:49,920
and so you have to adapt a more adopt a more resilience a resilient approach and because we

210
00:13:49,920 --> 00:13:56,280
can't be everywhere all the time we have to think about new ways to defend the nation we are not

211
00:13:56,280 --> 00:14:02,420
going to seek to be on all of the private sector networks all the time frankly we can't afford the

212
00:14:02,420 --> 00:14:07,560
personnel cost to that but also like who wants like an e4 showing up at your network being like

213
00:14:07,560 --> 00:14:11,600
hi i'm here from the department of defense i'm here to help um so like we have to think about

214
00:14:11,600 --> 00:14:12,660
different ways of doing that

215
00:14:13,320 --> 00:14:19,220
and so one of the things that we can do is take the insights that we have as the department of

216
00:14:19,220 --> 00:14:24,780
defense about the adversaries ttps and share them out with the world through partners and so

217
00:14:24,780 --> 00:14:31,260
we work with other countries around the world with our civilian agency partners the fbi dhs and

218
00:14:31,260 --> 00:14:38,360
others to identify this type of uh ttps and then push them out to the private sector so that they

219
00:14:38,360 --> 00:14:43,220
can um defend their own networks and that's actually a really big challenge and i think it's

220
00:14:43,220 --> 00:14:46,280
a really big challenge for us when i started in this business people kept asking us for actionable

221
00:14:46,280 --> 00:14:52,300
intelligence and we're like no it's too secret we can't tell you um we have now figured out how to

222
00:14:52,300 --> 00:15:00,020
be able to share that information and you saw that in um something else that occurred at the

223
00:15:00,020 --> 00:15:04,440
beginning of the conflict um credit to jen easterly who was wandering around here somewhere

224
00:15:04,440 --> 00:15:10,480
the shields up activities that we engaged in to encourage critical infrastructure to raise their

225
00:15:10,480 --> 00:15:13,200
level of defense and the in information that the department of defense has been able to use to

226
00:15:13,200 --> 00:15:21,900
defend themselves and then the technical assistance that we are able to provide through the nsa

227
00:15:21,900 --> 00:15:27,620
cyber security collaboration center we think that this model represents a better way for us as the

228
00:15:27,620 --> 00:15:33,520
department of defense to engage in the defend the homeland mission that doesn't ask us to get

229
00:15:33,520 --> 00:15:40,280
on everybody else's networks um but i think one of the challenges is that

230
00:15:40,280 --> 00:15:40,720
um

231
00:15:43,200 --> 00:15:50,520
we need help and so we have to think about like for us who does cyber um and i know a lot of you

232
00:15:50,520 --> 00:15:59,120
do cyber but like when it comes to offensive cyber we're one of the only organizations that

233
00:15:59,120 --> 00:16:07,960
has the legal authority to be able to go out and disrupt uh adversary malicious cyber activities

234
00:16:08,640 --> 00:16:12,660
without our colleagues at the fbi like knocking on people's doors

235
00:16:13,480 --> 00:16:19,960
um and the challenge for us is that like it's a really big threat space

236
00:16:20,760 --> 00:16:27,820
we have a lot that we have to take on russia is not our only cyber capable adversary frankly the prc

237
00:16:27,820 --> 00:16:35,540
is also highly capable and uh capable and and has demonstrated for those of you who saw the

238
00:16:35,540 --> 00:16:42,620
microsoft volt typhoon announcement uh seeking to disrupt critical infrastructure on which we the

239
00:16:42,620 --> 00:16:48,280
department of defense would rely for our mobilization putting at risk the lives of our

240
00:16:48,280 --> 00:16:53,540
service members and lives of people in guam the lives of people in the indo-pacific region that

241
00:16:53,540 --> 00:17:02,500
we might be protecting but it's a really big challenge for us and we need help we need the

242
00:17:02,500 --> 00:17:07,640
help of people who have the skill set to the people in this room to be able to help us identify

243
00:17:07,640 --> 00:17:12,600
the adversary malicious activity to help us develop the kinds of things that we can use to

244
00:17:12,620 --> 00:17:18,960
to prevent that malicious activity from causing harm to america's americans and we need your help

245
00:17:18,960 --> 00:17:27,040
to be able to disrupt that activity before it causes harm to people in the united states

246
00:17:28,080 --> 00:17:31,400
and we hope that you're you'd be willing to come help us with that

247
00:17:32,040 --> 00:17:36,600
it's a big mission space we are thinking about it differently we are thinking about

248
00:17:36,600 --> 00:17:40,100
it in the context of our rules and we're thinking about it in the ways in which

249
00:17:42,620 --> 00:17:47,520
this campaign actually works so with that ladies and gentlemen thank you