[00:00.000 --> 00:04.000]  If you flew out to DEFCON, you certainly interacted with someone at TSA.
[00:04.000 --> 00:13.920]  But do you really know who TSA is, and what those employees and many more really do to maintain the safety and security of our nation's aviation, surface, and space systems?
[00:14.240 --> 00:19.960]  In this fireside chat with David Pekoske, you'll hear it straight from the administrator himself.
[00:20.080 --> 00:33.440]  He'll cover the TSA's role among many government agencies addressing these issues, and how TSA partners with hackers to maintain the trust we all have in these vital systems and build a more resilient transportation system.
[00:33.700 --> 00:35.680]  All right, thank you.
[00:39.520 --> 00:45.740]  I want to complain and be unhappy for the 30-minute flight, but these are pretty darn comfortable.
[00:45.960 --> 00:47.440]  But you had no waiting.
[00:47.440 --> 00:50.620]  Yes, I think it was the boarding process that made it that much simpler.
[00:50.960 --> 00:52.860]  Well, thank you all for being here.
[00:52.860 --> 00:56.260]  For those of you who don't know, my name is Steve Luzinski.
[00:56.260 --> 00:57.900]  I am part of the Aerospace Village.
[00:57.900 --> 01:06.460]  I'm the board chairman working on the nonprofit side with the smart volunteers that you see around here who are running everything you're seeing today at the village.
[01:06.460 --> 01:08.580]  And we are very happy.
[01:09.680 --> 01:16.140]  I have the privilege of having David Pekoske, and I practiced that because Luzinski.
[01:16.140 --> 01:17.220]  I didn't want to screw that up.
[01:17.220 --> 01:26.140]  So David Pekoske, TSA administrator with us today, share his thoughts, perspectives on the work that they're doing in the aerospace sector.
[01:26.140 --> 01:31.760]  So thinking about both aviation that we typically think about, but there's also space elements and more.
[01:31.760 --> 01:34.440]  So, again, I appreciate y'all's time coming here.
[01:34.720 --> 01:42.680]  For those of you who don't know your full background, I will throw out the distinguished career in the U.S.
[01:42.680 --> 01:48.480]  Coast Guard, ending with being the 26th Vice Commandant of the U.S.
[01:48.480 --> 01:53.820]  Coast Guard, followed by moving over to TSA as the 7th Administrator.
[01:53.840 --> 02:01.300]  60,000 people across TSA, and has been serving in that role for some time now.
[02:01.300 --> 02:02.600]  And so thank you for being here.
[02:02.600 --> 02:04.520]  I really appreciate having you on stage.
[02:04.520 --> 02:04.580]  Thanks , Steve .
[02:04.580 --> 02:05.340]  Great to be here.
[02:05.340 --> 02:06.100]  Absolutely.
[02:07.000 --> 02:20.800]  So, you know, I've been thinking about this, and as we've been coordinating, and I want to come up with this big, fancy, you heard in the introduction, we think about TSA, we think about, well, what do they do?
[02:20.800 --> 02:24.500]  It's like, well, it's just the blue shirt screeners, and I know there's more.
[02:24.500 --> 02:39.180]  So I want to start off with getting a better idea of why, beyond just that part of aviation, what's the full extent of what TSA does, so we understand that background and context in this discussion.
[02:39.180 --> 02:40.560]  Okay, great question.
[02:40.560 --> 02:45.680]  And, you know, TSA is the Transportation Security Administration, not the Aviation Security Administration.
[02:45.680 --> 02:50.080]  So that tips off that, hey, there's a lot more to this than aviation.
[02:50.080 --> 02:53.360]  But aviation is by far the biggest aspect of what we do.
[02:53.360 --> 03:01.080]  And, Steve, to your point, what you see in screen checkpoints is the most resource-intensive and people-intensive part of our operation.
[03:01.120 --> 03:08.020]  But we also have a significant role in air cargo security, in aviation security within the airport environment.
[03:08.020 --> 03:18.540]  We do a tremendous amount of work on the intelligence and analysis side, the vetting side for all the passengers that go through our screening process or transit through U.S.
[03:18.580 --> 03:19.600]  airspace.
[03:19.600 --> 03:26.740]  Additionally, we have a good number of people assigned overseas because we're a presence in many, many embassies around the world.
[03:26.740 --> 03:36.020]  We inspect last-point-of-departure airports, those airports that have a direct flight to the United States, to make sure they're complying with the requirements that we have put in place.
[03:36.020 --> 03:40.080]  And, importantly, we have a role in surface transportation security.
[03:40.080 --> 03:58.060]  And if you think back to the Department of Transportation, if you go back to 2001, pre-911, the DOT had a number of modal administrations, like the Pipeline and Hazardous Materials Safety Administration, like the Federal Railroad Administration, like the Federal Aviation Administration.
[03:58.060 --> 04:09.540]  When 9-11 happened and TSA was established in law, the Secretary of Transportation, Norm Mineta, literally took the security functions of all those modes and moved them over to TSA.
[04:09.540 --> 04:17.400]  So one of the things that TSA has responsibility for is security for pipelines in the United States, oil and natural gas pipelines.
[04:17.400 --> 04:19.760]  Most people wouldn't assume that.
[04:19.760 --> 04:22.320]  Or for train systems, mass transit systems.
[04:22.320 --> 04:39.840]  So the remit is quite large and getting larger all the time because, as you may have seen, we have gotten into the cybersecurity regulation end of our responsibilities, and that really started off in pipelines following the May 2021 ransomware attack of an East Coast pipeline.
[04:39.840 --> 04:43.620]  So really, it's a big agency, a lot of scope.
[04:43.620 --> 04:52.440]  What I would offer to all of you at the very beginning of our talk this afternoon is, I'm here and I've got about 30 of my colleagues here at DEF CON.
[04:52.440 --> 04:53.700]  It's my first time.
[04:53.700 --> 04:56.280]  For many of my colleagues, it's not their first time.
[04:56.280 --> 05:01.740]  And what we endeavor to do is to really solicit your help and your expertise.
[05:01.740 --> 05:11.400]  We're doing a lot of work where we could use another perspective, another point of view, to make sure that we're looking at things in a comprehensive and complete way.
[05:11.400 --> 05:28.320]  And so as we look at cybersecurity, for example, and I'll talk a little bit more about that later on, but we've changed the way we approach our relationship with the stakeholders, with the regulated parties that exist in the surface transportation and the aviation systems.
[05:28.320 --> 05:46.100]  We really need your help in helping us define risk and scenarios for cybersecurity because you're in a better position, I think, than certainly I am and than most to say, hey, if I wanted to get into this system, how would I do it?
[05:46.100 --> 05:50.860]  And we want to make sure that we understand that perspective, benefit from your expertise.
[05:51.000 --> 05:56.960]  The other thing is that you all represent a lot of talent, and TSA is hiring talent.
[05:56.960 --> 06:03.200]  So if you go to our booth over in the exhibit hall, you'll see a TSA booth there.
[06:03.200 --> 06:07.160]  And really, if you're interested in a position, please visit that booth.
[06:07.160 --> 06:11.800]  There's a quick QR code that will take you right to our open job positions.
[06:11.800 --> 06:16.480]  And I will tell you, as Steve mentioned, I've been in TSA now for six years.
[06:16.480 --> 06:19.200]  I spent 33 years in the Coast Guard.
[06:19.200 --> 06:22.280]  Both tremendous organizations.
[06:22.280 --> 06:26.960]  I enjoyed immensely my time on active duty in the Coast Guard.
[06:26.960 --> 06:30.320]  I really, really, really enjoy working in TSA.
[06:30.320 --> 06:39.380]  I work with an incredible team of people all around the country, all around the world, and we do meaningful national security work every single day.
[06:39.400 --> 06:45.760]  One of the things that sometimes you hear is, well, TSA really isn't detecting everything.
[06:45.760 --> 06:50.300]  Let me tell you, we are detecting a lot every single day.
[06:50.400 --> 07:02.200]  And I know that the aviation system is much more secure as a result of our efforts and getting more and more secure each and every day as we bring more technology into our operation.
[07:02.200 --> 07:07.360]  And we'll talk about a couple of our technology initiatives where you can also be a tremendous help for us.
[07:07.360 --> 07:11.400]  So please, we're looking for your expertise to advise us.
[07:11.400 --> 07:17.140]  And we're open to any opportunities you see that might fit your own personal needs.
[07:17.140 --> 07:27.720]  And, hey, I think it's a really good thing for somebody to have some time in government, particularly in an agency that I think is one of the most agile agencies in the government.
[07:27.720 --> 07:29.400]  There are many that I would put in that category.
[07:29.400 --> 07:35.300]  I would put us up there as well because we've done some pretty incredible things in relatively short time.
[07:35.300 --> 07:38.440]  And oftentimes very visible to passengers.
[07:38.440 --> 07:40.940]  So that's a quick thumbnail.
[07:40.940 --> 07:41.180]  Thanks.
[07:41.180 --> 07:42.140]  That's awesome.
[07:42.140 --> 07:53.940]  And one of the other things in learning, because of the work that I do at the village and talking to your folks, all of those things, and there's still a spaceport element to all of that because that is new and emerging.
[07:53.940 --> 07:59.260]  So think of all those aviation issues and add the space part of it that's growing.
[07:59.800 --> 08:16.240]  One of the things, having been in government, worked at the Pentagon while I was in the military, but then also working at CISA, looking at these aviation cyber issues, if you could give a brief, what is the difference in roles and responsibilities?
[08:16.440 --> 08:18.200]  Because we don't think of TSA.
[08:18.640 --> 08:20.160]  We think of FAA.
[08:20.220 --> 08:23.700]  Or we may think of all the things that CISA is known for.
[08:23.700 --> 08:30.240]  How are the three of you dividing up where you have those shared equities when it comes to aviation and space cybersecurity?
[08:30.260 --> 08:30.820]  Thanks.
[08:30.820 --> 08:39.200]  And actually, I would add a fourth, and that would be the FBI, with the great work that FBI does in cybersecurity and investigating cyber incidents.
[08:39.800 --> 08:59.060]  When I talked about the Department of Transportation modes and them retaining safety responsibility and then us picking up the security responsibility from them, many, many times when you look at an issue and you look at it, something's going on, some particular process you're looking at or some technology you're looking at,
[08:59.060 --> 09:03.520]  that technology oftentimes has both a safety and a security impact to it.
[09:03.520 --> 09:09.780]  And so we want to make sure that we're very, very closely connected to our safety co-sector risk management agencies.
[09:09.780 --> 09:17.420]  So an SRMA is an agency that has regulatory authority for elements of the critical infrastructure in the country.
[09:17.420 --> 09:23.040]  So for aviation, the FAA and TSA are the co-sector risk management agencies.
[09:23.040 --> 09:30.420]  For rail systems, for example, TSA and FRA are the co-sector risk management agencies.
[09:30.420 --> 09:40.400]  CISA, relatively new as CISA, but really not new necessarily because they were largely in existence, although not quite to the degree they are today.
[09:40.400 --> 09:52.760]  In the Department of Homeland Security's structure, they just moved over to an independent agency, has been an incredible partner for us as a source of expertise, as a source of looking at cross-sector issues.
[09:52.760 --> 09:54.780]  I look at the transportation sector.
[09:54.960 --> 10:00.460]  The transportation sector relies on the electricity sector for a lot of its support.
[10:00.460 --> 10:03.800]  And so we need to make sure that we're looking at cross-sector issues as well.
[10:03.800 --> 10:05.520]  That's where CISA comes into play.
[10:05.520 --> 10:15.940]  And CISA is an agency that can provide help, advice, context to owners and operators of critical infrastructure in the country.
[10:16.780 --> 10:28.300]  Relatively new but incredibly valuable role, particularly nowadays where cyber is much more in the forefront of owners and operators' calculations with respect to the operations of their companies.
[10:28.840 --> 10:34.340]  And then finally, the FBI does investigations of cyber incidents and does victim notifications.
[10:34.340 --> 10:41.360]  And that's an important thing that all of the sector agencies that I mentioned are really closely aligned with each other.
[10:41.360 --> 10:58.320]  Last thing I would say is that as we look at response to an incident as an agency, one of the things that we're all trying to do very, very hard is to present more of a unified position to the owner and operator of a piece of critical infrastructure.
[10:58.320 --> 11:10.020]  You can imagine if you are attacked and you're dealing with several different agencies, and they're all calling you at different times, asking sometimes the same question or somewhat different questions.
[11:10.020 --> 11:13.120]  And in your mind, they're not coordinating with each other.
[11:13.120 --> 11:20.200]  That's creating for you a lot more work, and it's taking you away from the response to the incident that you're facing.
[11:20.200 --> 11:25.880]  So part of what we are doing very diligently now is making sure that we coordinate amongst the agencies.
[11:25.880 --> 11:39.160]  I think a really good example of that is when we issued our cyber regulations across the sector, the reporting for a significant cyber incident, which is required by our regulations, doesn't come to TSA.
[11:39.160 --> 11:40.200]  It goes to CISA.
[11:40.360 --> 11:44.360]  And then CISA sends it out to, in the case of aviation, they would send it out to the FAA.
[11:44.360 --> 11:45.860]  They would send it out to the FBI.
[11:45.860 --> 11:58.060]  They would make sure that everybody who had an equity in the issue was getting, importantly, the same information, stated the same way, so that there's no daylight between reporting at the same time.
[11:58.060 --> 12:00.240]  That's really, really valuable to all of us.
[12:01.240 --> 12:08.040]  So in the context of these things that you're doing, if you could provide some more detail, I think that would help.
[12:08.220 --> 12:13.660]  What's driving these what seem like new actions that I think the public's seeing?
[12:13.660 --> 12:16.880]  And then what are those?
[12:16.880 --> 12:18.540]  What's the objective?
[12:18.540 --> 12:19.920]  What's the full extent?
[12:19.920 --> 12:25.620]  Because there are so many things and initiatives that you all are enacting, I think that'd be very useful for everyone.
[12:25.660 --> 12:25.960]  Sure.
[12:25.960 --> 12:29.040]  And what's driving it is the intelligence information we have.
[12:29.040 --> 12:30.640]  And it's significant.
[12:30.640 --> 12:31.800]  It's concerning.
[12:32.000 --> 12:34.700]  I've issued emergency amendments.
[12:34.700 --> 12:40.080]  You don't issue an emergency amendment to a security plan unless you feel like we're in an emergency situation.
[12:40.080 --> 12:42.840]  So the intelligence is compelling.
[12:42.840 --> 12:44.060]  It's consistent.
[12:44.060 --> 12:47.800]  It's getting consistently more concerning over time.
[12:47.800 --> 13:00.260]  And one of the things that we did, and I think that it's really important for any government entity to be viewed by the American public and by the companies that we work with as a trusted partner.
[13:00.260 --> 13:04.120]  Being a trusted partner means that you share as much information as you can.
[13:04.120 --> 13:06.140]  You share it in a timely manner.
[13:06.160 --> 13:13.880]  And you respect company proprietary information when you're receiving information from that particular owner and operator.
[13:13.880 --> 13:30.340]  One of the things we did when we first went down this journey to increase cyber preparedness and cyber resiliency was to bring the CEOs of the companies that we regulate in for a high-level classified briefing on the why.
[13:30.340 --> 13:43.380]  Why were we about to ask you to do certain things in a relatively quick fashion, generally inside your own company budget cycle, so we shored up some vulnerabilities that we thought were incredibly concerning.
[13:43.380 --> 13:49.680]  Some CEOs looked at that and said, hey, you really need to talk to my CIO, not to me.
[13:49.680 --> 13:51.840]  And we said, oh, we will talk to your CIO.
[13:51.860 --> 14:03.120]  We just wanted you to have the context before we had that conversation, because your CIO most assuredly will be coming to you with a request for resources, for policy changes, things of that nature.
[14:03.120 --> 14:12.620]  But what we did, and I would credit the industry and our partners for helping us with this in a really substantial way.
[14:12.620 --> 14:19.820]  When we first started out with cybersecurity regulation, we did what we have been doing for 22-plus years.
[14:19.820 --> 14:23.380]  Other agencies have been doing for hundreds of years in regulations.
[14:23.380 --> 14:31.360]  And what I mean by that is you see a problem, you try to make sure that problem doesn't recur again or anything similar to it.
[14:31.360 --> 14:38.080]  And so you require a whole host of activities to be performed by the party that you regulate.
[14:38.080 --> 14:40.500]  We initially did that with pipelines.
[14:40.520 --> 14:48.480]  And the pipeline industry, which was not regulated by us previously, asked us to take another look at that.
[14:48.480 --> 14:55.980]  They thought that they were being asked to replace what they thought were really good mitigation measures with the specific ones that we were requiring.
[14:55.980 --> 15:04.840]  So in some cases, their feeling was that we would actually be taking a step backward in security, not a step forward.
[15:04.840 --> 15:12.700]  Many, many companies, whether it's in aviation or surface, also said, hey, listen, my business operates in a certain way.
[15:12.700 --> 15:23.360]  You probably don't really fully understand how my business operates, but I'm willing to achieve whatever end goal you want, but I want to have some flexibility in how I get to that point.
[15:23.360 --> 15:31.940]  And so what we did for the first time in our history, something that's called for in the national cyber strategy, is we went to a performance-based regulation.
[15:31.940 --> 15:41.340]  So rather than say and do all these specific things, we said, hey, these are four outcomes in cybersecurity we'd like you to achieve.
[15:41.340 --> 15:52.400]  Come back to us with a plan within a certain amount of time that will tell us how you, an individual owner-operator, is going to achieve that particular set of outcomes.
[15:52.480 --> 15:57.120]  And so these cybersecurity implementation plans were all submitted to us.
[15:57.120 --> 15:59.520]  We looked at them, kind of went back and forth a little bit.
[15:59.520 --> 16:03.840]  In some cases, in other cases, they were very comprehensive when we approved them.
[16:03.840 --> 16:09.820]  We finally, on the pipeline side, because that's the furthest ahead in all this, approved all these cybersecurity implementation plans.
[16:09.920 --> 16:26.240]  But the next step was, and this is an area, too, where you can be of tremendous assistance to us, is when you go to an outcome-based system, you have to be able to objectively conclude that the outcomes you have established are being achieved.
[16:26.240 --> 16:40.100]  And that can't be just a simple roll-up of all the activities that are being performed, because those activities are certainly just that, they're activities, but are they actually contributing to the achievement of the outcome and to what level?
[16:40.100 --> 16:44.640]  So we require what are called capability assessment plans.
[16:44.640 --> 16:55.280]  Basically, you take your implementation plan and then tell us how you're doing against that plan, and then, importantly, how that collectively is doing against the outcome.
[16:55.280 --> 17:08.020]  And so one of the things that's really important in looking at outcome achievement is, one, prioritizing the threat, because when you're looking at an outcome, some threats are going to be ones that you want to make sure that you've addressed more so than others.
[17:08.020 --> 17:23.660]  So prioritizing the threats and then looking at different scenarios that are very realistic, that all of you would have a very good idea of what some of those would look like, given your work in hacking or hacking research.
[17:23.660 --> 17:40.680]  For example, if I wanted to hack into an aviation, let's say an airport badging system, how would I do it and develop a scenario that would allow us to test that with individual owners and operators so that we can kind of look across the sector and say,
[17:40.680 --> 17:50.600]  hey, to be able to control access, this is how you're doing based on a very realistic and high-priority scenario that you've given us assistance in providing.
[17:50.600 --> 17:51.860]  So we have a project.
[17:51.860 --> 17:53.780]  It's called Project Chariot.
[17:54.160 --> 17:56.920]  Chariot as in the horse-drawn chariots.
[17:56.920 --> 18:01.860]  Kind of appropriate because we're here at CSER, so it's in the moment, if you will.
[18:02.680 --> 18:12.820]  But Chariot stands for Critical Infrastructure Hardening Achieved Through Risk Reduction in Information and Operational Technology.
[18:13.160 --> 18:27.340]  And this project is a project that's between the Department of Science and Technology Directorate, our team at CISA, as well as, in the case of pipelines and rail, FRA and PHMSA.
[18:27.380 --> 18:39.420]  We're working with the Pacific Northwest National Laboratory to really look at, hey, if we prioritize risk, what would that risk prioritization look like from an objective standpoint?
[18:39.440 --> 18:54.320]  And then secondly, working with all of you, validating that and saying, hey, I see that, you know, given my ease of being able to access some systems, for example, or when I do what I see and what potential might be there, I might change that priority.
[18:54.320 --> 19:09.000]  But then give us some scenarios, like I said earlier, that are realistic scenarios, because we want to test those scenarios with each owner and operator to see how they perform against those scenarios to really be able to answer this very simple question.
[19:09.000 --> 19:17.040]  If this specific company is the subject of a successful cyber attack, how well are they equipped to be able to respond to that?
[19:17.040 --> 19:22.560]  And how well are they equipped to be able to prevent most of the attack from affecting them?
[19:22.560 --> 19:42.980]  And so your perspective, your help, is going to be valuable, not just to us, but to those owners and operators as well, because they're looking at their own team, they've contracted, I'm sure, with other countries, but getting that additional validation there will make us all feel much more confident that what we're doing is really the right thing to do to protect this critical infrastructure.
[19:44.340 --> 19:57.300]  One of the things I know, when I was working with Tim and the idea of having you up here and bringing you in for the talk, that was very interesting, just the simple question, why is TSA here?
[19:57.440 --> 20:03.660]  And you covered that a little bit before, but I think the important part is the background is not just the why.
[20:03.660 --> 20:09.720]  There are plenty, what we've seen, just the work that the village does, the aerospace village.
[20:09.720 --> 20:16.540]  We've seen the changing attitudes where government and industry, why would I go talk to those hackers?
[20:16.540 --> 20:18.480]  Why would I talk to somebody dressed like that?
[20:18.480 --> 20:26.520]  All that kind of stuff that, in some respects, it's true, but the stereotypes are on both sides.
[20:26.520 --> 20:27.600]  Why would government be there?
[20:27.600 --> 20:31.140]  Why would I go listen to government come up and do this?
[20:31.140 --> 20:49.480]  And so what I'm interested in is your thoughts on, as we see this changing attitude, and clearly it looks like exactly what you all are thinking too, how are you trying to engage, other than coming to events like this, what are the other things that you all are doing to make sure you're able to reach,
[20:49.480 --> 20:52.760]  to get past those stereotypes and dispel those rumors?
[20:53.160 --> 20:55.840]  The first is, why are you doing it?
[20:55.840 --> 20:57.420]  I would come back and say, why not?
[20:57.420 --> 20:59.160]  You've got all this talent.
[20:59.160 --> 21:00.140]  Why would you not?
[21:00.140 --> 21:03.960]  Because you're going to come up with a less perfect solution.
[21:03.960 --> 21:12.500]  Not that any solution is perfect, but if you don't tap all the talent that's available, you're not going to be doing the best job that you can.
[21:12.680 --> 21:34.040]  Secondly, the how and how this gets sustained is, I think events like this are the beginning of building trust, of understanding better how you see things, you understanding better how I see things, really establishing that personal relationship, starting to build that trust,
[21:34.040 --> 21:44.060]  so that when things come up, we feel like we can actually have a good conversation, where we can share some information that's of incredible value to both of us.
[21:44.060 --> 21:54.340]  The other thing, and I hope you've noticed this when you've gone through our screening checkpoints, is we're working really hard to embed more technology into the work we do in our screening checkpoints.
[21:54.340 --> 22:05.420]  You see the new credential authentication technology, that technology where, rather than having somebody actually look at your driver's license, it goes into a machine that validates its authenticity.
[22:05.600 --> 22:19.420]  One of the things that always concerned me when I first got into this job, and even beforehand, was I'd hand off to the TSA officer my driver's license, let's say back in 2020, or even a little bit earlier than that, I'd hand them off the driver's license,
[22:19.420 --> 22:25.540]  and they would actually physically look at it and try to verify that that's a valid, whatever state you have a driver's license in.
[22:25.540 --> 22:43.560]  I don't know how you possibly do that across 56 states and territories and be accurate all the time, or you're looking at a very small photograph and visually trying to compare the two, and people's facial features can change to a degree over time, licenses last for eight years,
[22:43.560 --> 22:46.540]  and a technology assist on that would be hugely beneficial.
[22:46.640 --> 23:03.600]  Additionally, when the pandemic hit, we wanted to reduce the amount of physical contact that we had with anything that was owned by a passenger or with the passenger themselves, because in the pandemic, everybody was trying not to have physical contact to the greatest extent we possibly could.
[23:03.600 --> 23:08.600]  Inserting your own card into the machine is a way to do that, but there's a better way.
[23:08.600 --> 23:27.160]  You can download, in many states now, your driver's license into your Apple wallet, your Google wallet, your Samsung wallet, and then use that digital ID, which is a different kind of transmission, much more secure to our technology, and has some significant privacy benefits to it,
[23:27.160 --> 23:39.280]  because it shows you, when you pull up your mobile driver's license, exactly what fields in your driver's license that we are going to look at with your driver's license.
[23:39.520 --> 23:49.420]  Before, I've had some people say, I think you're tracking my movement in terms of home addresses, because I know you're ingesting my home address every time you look at my driver's license.
[23:49.420 --> 23:52.860]  We never did, but at least this way, you get to see it for sure.
[23:52.860 --> 23:59.440]  So getting to digital identification, and then eventually to biometric identification, is really where we want to go.
[23:59.800 --> 24:02.920]  Biometrics is an area that we could use your help in.
[24:02.920 --> 24:06.080]  How do we make sure the biometric system is secure?
[24:06.080 --> 24:14.940]  How do we make sure that the biometric system does not disadvantage any demographic group that travels through our system in any way, shape, or form?
[24:15.040 --> 24:17.960]  We've done a lot of great work on biometrics.
[24:17.960 --> 24:28.580]  They are much more accurate than a human verification of identity in our own testing, and in testing done by the Science and Technology Directorate in the department.
[24:28.740 --> 24:32.760]  They're also much more efficient, and we don't transmit that data anywhere.
[24:32.760 --> 24:34.360]  It stays right on that machine.
[24:34.360 --> 24:40.120]  As soon as you, as a passenger, leave, and the next passenger begins their process, your data is erased.
[24:40.120 --> 24:40.880]  We don't keep it at all.
[24:40.880 --> 24:42.140]  It never leaves that machine.
[24:42.240 --> 24:46.020]  So that's an area where we could use some help and advice.
[24:46.060 --> 24:58.500]  The other thing that we're doing is we'd really like to get to the point where all of our technology is developed using open architecture principles and have open architecture requirements in our contracting vehicles.
[24:58.500 --> 24:59.840]  Because think of this.
[25:00.340 --> 25:09.940]  If you look at those big x-ray machines in our screening checkpoints, the original equipment manufacturer owns all the software that's in those x-ray machines.
[25:10.340 --> 25:18.200]  Whenever we want to make a change, we can only go to those vendors, and they're looking at the entire code set whenever we're making a change.
[25:18.200 --> 25:21.360]  It takes a lot longer to get changes put in place.
[25:21.400 --> 25:35.700]  You all might remember about three or four years ago, we had a threat stream that talked about people attempting to bring large quantities of powders onto aircraft and then mixing them with liquids and have it gas off and create a toxic environment.
[25:35.700 --> 25:42.320]  So we needed to detect large quantities of powders, and so we had passengers take out powders out of their carry-on bags.
[25:42.320 --> 25:51.920]  A much better way would be just to add a software layer onto our existing software technology for detection and have it detect that particular threat.
[25:51.920 --> 26:04.160]  So if you think of how agile we have to be, whenever you need to be agile, having to revert to a manual process for a long period of time is not good for passengers.
[26:04.460 --> 26:06.460]  It's really not good for us.
[26:06.580 --> 26:12.420]  So open architecture is another thing that we're very, very interested in and want to move forward on.
[26:12.420 --> 26:23.900]  So those are just a couple of examples of things that, from a technology perspective and from making it as error-free and as cyber-secure as we possibly can.
[26:23.900 --> 26:28.960]  And then the elephant that you talk about a lot here is artificial intelligence.
[26:29.140 --> 26:32.640]  Think about when you go through a screening checkpoint.
[26:32.640 --> 26:36.660]  First off, you see officers sitting next to every single x-ray machine.
[26:36.660 --> 26:41.740]  There's no technological reason why that has to occur because they're now in the noise environment.
[26:42.160 --> 26:45.520]  They're only able to look at images from that particular lane.
[26:45.520 --> 26:47.260]  It's a bit inefficient.
[26:49.420 --> 27:04.800]  The second part of this is that we would really like to take them and put them off in a separate part of the airport and be able for them to have a quiet space and be able to operate any lane in that airport or maybe even in an adjacent airport.
[27:04.800 --> 27:14.000]  And so what we're looking to do is to have the image for a carry-on bag only be visible to the operators if it alarms.
[27:14.000 --> 27:17.740]  Right now, they look at every single image that comes up.
[27:17.740 --> 27:20.780]  Just take a guess at how many images we see in a given day.
[27:20.780 --> 27:22.140]  Just take a rough guess.
[27:23.340 --> 27:24.580]  How many?
[27:24.940 --> 27:26.200]  You're very close.
[27:26.200 --> 27:27.740]  It's about 5.5 million.
[27:27.740 --> 27:30.280]  So 5.5 million images come up.
[27:30.280 --> 27:46.140]  But when you're reviewing so many images and every one is presented to you with the same level of concern, if you only imaged on alarm, you would pay a lot more attention to that particular one image that came up that you really had to look at more.
[27:46.140 --> 27:48.280]  And plus it becomes a heck of a lot more efficient.
[27:48.900 --> 27:51.580]  But artificial intelligence can be spoofed.
[27:51.820 --> 28:02.940]  It's not good at deducing context to a bag where a human can look at a bag and say, okay, all these things sort of ought to belong in this bag given what else I see here.
[28:03.020 --> 28:05.180]  But a machine can't yet do that.
[28:05.240 --> 28:06.580]  And it can be hacked.
[28:07.260 --> 28:10.200]  And particularly generative AI, which can learn.
[28:10.200 --> 28:14.880]  If it's learning and we're not tracking how it's learning, it might not be learning what we want it to learn.
[28:14.880 --> 28:18.980]  So your help in that regard would be incredibly beneficial too.
[28:18.980 --> 28:19.580]  Absolutely.
[28:19.580 --> 28:22.380]  And I will put in a plug the talk following.
[28:22.380 --> 28:24.460]  We'll cover the croissant screening machines.
[28:24.460 --> 28:26.460]  As I've learned, that's the name of them.
[28:26.460 --> 28:29.780]  You may be seeing the newer technology that Dave mentioned.
[28:29.800 --> 28:34.700]  In addition to tomorrow, you're talking with Director Isidore on one of the main stage talks.
[28:34.700 --> 28:37.860]  So if you're looking forward to learning more, you've got those opportunities.
[28:38.280 --> 28:39.940]  So I'm going to close up here.
[28:40.580 --> 28:42.960]  Again, more things to learn.
[28:43.160 --> 28:47.520]  Hopefully seeing, understanding better what TSA is doing, why they're doing it.
[28:48.040 --> 28:48.940]  Closing comments.
[28:48.940 --> 28:51.340]  I know you mentioned it before, but please feel free again.
[28:51.340 --> 28:54.760]  Where can we go to learn more about careers and if there's interest?
[28:54.760 --> 28:55.540]  Yeah, sure.
[28:55.540 --> 28:56.820]  Just go into the exhibit room.
[28:56.820 --> 28:57.600]  There's a TSA booth.
[28:57.600 --> 28:58.880]  You can see our logo there.
[28:58.880 --> 29:01.400]  We've got some really cool stickers there.
[29:01.400 --> 29:03.280]  And we just encourage you to do that.
[29:03.280 --> 29:07.660]  Or if you know somebody who is looking for a really meaningful position in TSA.
[29:07.660 --> 29:14.100]  The other thing just to know is, and if you listen to the Secretary's comments this morning, we're looking for cyber talent.
[29:14.140 --> 29:15.920]  If you'd like to spend a career, great.
[29:15.920 --> 29:19.220]  If you'd just like to come in and work for a couple, three years, terrific.
[29:19.480 --> 29:25.460]  Because that back and forth has a hugely beneficial component to it potentially for all of us as well.
[29:25.460 --> 29:28.620]  But finally, just hey, thank you for attending.
[29:29.220 --> 29:35.580]  Thank you in advance for any help that you're able to give us in making sure that we're doing what I think all of you want.
[29:35.580 --> 29:40.600]  Is making sure that when you get on an aircraft, you have the very best technology solutions.
[29:40.600 --> 29:45.260]  The very safest implementation of those solutions that we can possibly deliver.
[29:45.260 --> 29:46.360]  And you're a big part of that.
[29:46.360 --> 29:47.360]  So thank you.
[29:47.760 --> 29:48.060]  And I
[29:51.440 --> 29:57.480]  feel absolutely obligated to make sure your Vegas trip is worth your time.
[29:57.480 --> 30:02.640]  So the obligatory Vegas dice and drink koozie for whatever drink you want.
[30:02.640 --> 30:06.200]  But more importantly, our 5th anniversary of the Village.
[30:07.700 --> 30:09.860]  120th anniversary of the Wright Flyer.
[30:10.100 --> 30:14.000]  Badge, swag, sticker pack for the administrator.
[30:14.000 --> 30:14.320]  Enjoy.
[30:14.320 --> 30:14.780]  Awesome.
[30:14.780 --> 30:15.220]  Thank you.
[30:15.220 --> 30:16.080]  Appreciate it.