Transcript
Mike is, of course, the former director of the National Security Agency, and we are here at RSA Conference. And don't forget, don't cheat the men and women at U.S. Cyber Command. Absolutely. I'm sorry. You're absolutely right. U.S. Cyber Command as well. And at the conference this week, there's going to be a reunion of former NSA directors. The last four directors on one panel. That's awesome. I think it's great. It's a very intriguing panel discussion. I can't think this literally this will be the first time the four of us have been ever been together as former directors. It's great. All four of us. Unfortunately, as we're recording this, the panel hasn't happened yet. So I can't ask you about what went on, but I need to know. Do you guys have a group chat? No, we don't. Wow. I intentionally I have seen two of the of the four of us. I have seen, you know, two of the other three. And all I said to them was, hey, let's just no scripting. No, let's just see where it goes. This is what people want to know. I'm like, hey, let's just have a conversation. Absolutely. No, it is great, though. I mean, it's a small fraternity of people. Yeah. And, you know, it's it's a Ted Schleen who convened it is. I brought him on the advisory board at NSA and he knows all of us. So, you know, as I will say to Ted, when we see him later today, you know, there's very few people who could have convinced the last four living directors to show up in one place at one time. And I mean, all kidding aside, do you guys regularly talk? I mean, I will interact. Right. We'll interact. Yeah. I haven't seen General Alexander for a little bit, but General Hawk and General Nakasone, the three of us interact all the time. And we you tend to run each other. Davos, Munich conferences, you know, it's a small ecosystem we run it. So the private conversations are the ones they are the most everybody wants. They are the most interesting. How much does that job change from administration to administration? Well, it always reflects the priorities of a particular administration of a particular time. It reflects the challenges of a particular time. But the fundamentals really don't change all that much. And many of the issues don't change. I mean, we've been focused on Iran as an example for decades. So this isn't a new challenge, so to speak. What are some of the fundamentals that kind of guide that? So you're always trying to generate as much knowledge and understanding as you can of challenges to the United States and our friends and allies. You're always trying to make sure you get a sound group of men and women to help you do that. So personnel management, how you create, recruit, retain, train, educate the workforce always gets to be very is always huge. You're always thinking about what do you need to do today to position yourself for the future? You're always asking yourself, hey, how do I maximize the resources I've been assigned or allocated? You know, you're always asking yourself, what's the right mix of resources against what priorities that, you know, balancing money and people against priorities never changes. You're always trying to make sure that you're aligned with your key partners, whether that be both the United States as well as globally, both within the government and within the private sector. That that's a dynamic that hasn't changed, never changes in my experience. And a lot of that sounds like kind of relationship building and just kind of building a team. Yep. But then you have real work. I mean, behind the like, how do you how do you prioritize? Well, right. For you personally, you are particularly because you're running two organizations simultaneously. Cyber Command, which is a four star combatant commander command and the National Security Agency, which is the largest intelligence organization in the U.S. structure. If we're honest, it's the largest in the free world. Sure. So it's big. And so you're trying to run two global, really significant organizations simultaneously. So one of the things you got to do is sit down with both the deputy director of NSA and the deputy commander at NSA and have a discussion about, OK, how are we going to make this work? How is the four star going to allocate their time? What's the sense of how the four star wants to work the relationships? The way I always did it was I told the deputy director, the deputy commander, look, the only way this is going to work is if you guys function as the chief operating officer. She can't wait for me to approve everything. If we do that, this it just grinds to a halt. So as a commander and as a director, that means one of your core jobs is to make sure you have clearly articulated what in the military we call commander's intent. What are the priorities? What's the strategy? Once everybody's on the line on that, then it's all about execution and oversight and you're counting on others for the execution piece while you're trying to do an oversight kind of thing. And then as the four star, you're very focused on engaging with key partners, whether it's other combatant commanders, whether it's the members of the Joint Chiefs and the service chiefs and the chairman, whether it's the White House and the president, whether it's the Hill and your congressional oversight committees. Whether it's intelligence and cyber counterparts all over the world, but particularly in the five eyes structure, as well as, you know, Israel is a key player. Always has been. You're seeing that in the whole with the Iran issue. That's always important. So I spent a lot of time with eighty two hundred. And Mossad was in Tel Aviv, you know, personally trying to work with them. They would come to see us personally. What do you think was the most important thing that got you ready for that job? Nobody walks in on day one. I got this. I mean, something had to prepare you. Something had to tell you you were. Well, it's different for everybody, I would assume. Sure. For me, the thing that I like that I had, I thought was an advantage for me was I was a signals intelligence officer by profession. To be honest, I am the first and only director of the NSA who was a professional SIGINT officer. That's what I did in the Navy. Navy's different than the other services. We differentiate between intelligence and signals intelligence. While I had general intelligence billets, when I became once I became a one star as the director of intelligence for the Indo-Pacific Command and I was the director of intelligence as a two star for the Joint Chiefs of Staff. I had while I'd been in traditional intel jobs, I was a signals intelligence officer or a cryptologist, as we call them in the Navy. So I came in, I had been a part of the NSA team for for decades on and off, so knew the culture, knew the structure, knew the processes, knew the technical aspects of the operational aspects of how you do. SIGINT, I used to kid the team when I first got there. The processes that we have developed over time that address oversight, control and broad authority to do different things are something we call usage. OK, and most directors of NSA, when they become the director, you won't have any you won't have had significant exposure to the usage, right? You won't have gotten down for most, not all, but for most, you won't have spent much time in your career digging down into the execution level. Now, every director of NSA has had some signals intelligence experience within their tours. I was the first one who that I was a professional. That's what I did for a living. So the funny thing was, when I first got there, I thought that the organization was a little flummoxed initially by as we were sitting there, I'm going, hey, you want to bore down on the usage? You want to get into the technical details of how this is what I do for a living. I thought that was an interesting challenge for the team, even though, look, that's not my focus, right, as the director. And it's all about those men and women. They, oh, man, they generate the value. They do the good things. So I went to get back to your question that the positives I thought I had were, number one, I was a signals intelligence officer by background. So I really felt comfortable in the mission. I knew the mission from the technical side to the operational execution side. Secondly, I had been the when I was a three star, I worked as the component commander to both NSA and US Cyber Command for the Navy. So I had worked with General Alexander, my predecessor. I was his support as a three star. He was my four star boss. So I had had a chance to see him, to see his views, to see his strategy. You know, I had supported that as a part of the team, so to speak, that supported NSA. So I just I felt very comfortable. I guess the part you're not, at least for me, at least. I had dealt with presidents, but only when I was involved in the project during the war in Iraq, which with that ultimately ended up with a small group. We ended up doing some work for the Joint Chiefs that President Bush came over and spent some time with us going over and kind of recommendations to the Joint Chiefs on their way ahead for the war in Iraq back around 2007, what ultimately became the surge. But I'd never been to the Oval Office. I'd never really interacted other than to have a one particular professional discourse with the president. And now you find yourself sitting in this room, sitting in the Oval Office, having a like this, having a conversation across from each other. And he's you know, I worked for President Obama, President Trump and then Vice President Biden. So I knew him and then the team. So that was the part I found was a little different, almost surreal, where you're just why am I sitting here? Why am I sitting in the Oval Office? And, you know, several times it was just the president and I and you're and we're just having a conversation like this, at least for me. I'm thinking, well, this is a bit surreal, but he wants to know what, you know, but you just do your job. You're there to do a job and you're there to try to generate, you know, the support that those men and women in the organization need. And you're trying to represent their hard work and their insights. You know, are there is a great job. So they were both great jobs. Oh, I love them. Is there a moment or a situation you're particularly proud of? I don't know how much in specifics you could talk about and maybe one you wish you had back. In general, I was always proudest of when it went, when it had gone wrong and the team flexed and overcame. That to me always was the part I felt the proudest about. And to be honest, it was always the part where I thought when everything's going great, they don't need me. I'm everything's going smooth. They're happy. Everything's going well. I thought it's when things aren't going well that the power of leadership, not just mine, but the whole organization. Yeah. When things aren't going well, you really see the power of leadership. You really see the ability to bring a team together when it's dealing with something really difficult, really challenging. In many cases, maybe something it didn't anticipate or something that has bitten it in the butt. Now you're trying to figure out how you overcome it. I love that. My attitude was, hey, I, you know, at this stage in my career, when I'm in those jobs, I literally have trained 32 plus years. I'm thinking to myself, this is why I spent three decades getting ready for this. You know, it's not quite. I loved it. It's not quite never waste a crisis, but no, it is. I always felt, hey, never wait, because I would always tell the team I have zero interest in returning to a status quo that failed us. So don't come back to me with, well, here's what we're going to go to back where we were. Zero interest in that failed already. Here's what we're going to do to get better. Here's what we're going to do to come out stronger. Here's what we're going to do to create a stronger, broader team out there. I said, this is opportunity, guys. Let's not. Sadly, the team, I'm sure, got so sick of Roger saying to them, never let a good crisis go to waste. We're coming out of this stronger. Well, as I said, the panel, I wish it had happened already, but, you know, I'm sure it's going to be a fun. I look forward to it because, you know, there are three great individuals. They were all teammates. We have all known each other for, you know, 10, 20 years. It's a small little world. So just a last kind of question about the role of director, just the toll. I don't know if it's a toll is the right word, but like what happens to your personal life? Do you I mean, do you sleep well? Life is just work. Yeah. I mean, I for me and I'm I was the worst of the four of us. Part of it is just the way I'm wired. I love hard work. It's just it gives me energy. I don't look at it as, oh, how how terrible, how tiring. I mean, I would be at my desk at zero five every morning and I would work until seven or eight at night if there was no crisis. And you would do that almost seven days a week. And for me, for about four and a half years. So I loved it. So I never thought it was onerous. I mean, you're tired. Don't get me wrong. But the flip side is and I had this discussion with my family. Look, this is just a window where I'm going to have to focus. I'm going to have to prioritize. Doesn't mean I don't love you and I'm not going to forget about you because you're the most important thing in life to me. But I do acknowledge that, hey, look, this is not just any other job I've had in my career. And the fact that it's two jobs, not just one, it's and the nature of the job and the expectations that the leadership of the nation and the leadership of the department and that your congressional oversight has for you, it just requires a real total commitment. Now, I love that. And I had no issue with it. I thrived on it for me, as I often kid my peers. I'm the only guy who left the job with no gray hair. So if you look at the three others. Don't jinx yourself. I'm going, hey, man, I left with a full head of hair and none of it was gray. I loved it. That's a win, right? I just I felt energized. That's a win. I'm lucky. I'm lucky, man. All right, let's talk about some boring stuff. Cybersecurity is never boring. Come on, Michael. Okay, what did I leave this poorly? The National Cyber Strategy that was recently released, right? Um, just before we dig into it, how much does something like that come across your desk as director in the past? In the previous life, you would be one of the principals. You know, there's different levels within the government structure as the director slash commander. You normally function at what they call the principals level. That's the cabinet kind of cabinet secretary kind of level. You participate in discussions with the president and the vice president, our security advisor and the chief of staff. And applicable members of the cabinet, and you're heavily involved because you are. It's interesting. It's one of the things I really enjoyed about cyber in the sense that in in those jobs, you are treated as both an operational commander because you have to execute. But you're also perceived to be a kind of technical expert, at least in the sense that you understand cybersecurity, you understand the policy implications. You understand how you create cybersecurity frameworks. So one of the things I enjoyed was I you'd be sitting at the White House talking about what should broad policy be for the United States and our friends and allies around the world on encryption, cybersecurity strategy, 5G, Huawei. And then at the same time, you're back at work and you're talking to the team about, OK, how are we going to execute this? What's going on? You know, you're talking about network structure. You're talking about the day to day mechanisms that you're responsible for. I love that. I used to tell people it's like one at one point of the day. I'm at the coal seam down deep in the mine. And another part of the day, I'm up in the CEO's office talking to him about, OK, what do we want the future to look like? I enjoy that. Yeah, personally. How how weighty a document is this? Like, is this just like step one? And first of all, remember, it's a broad strategy. So it lays out six pillars. It's not a long document. Sure. It's not a comprehensive document in the sense that it doesn't integrate strategy, policy and operational kind of execution. That's not its intent. It's supposed to provide a broad framework that both communicates within the government to the private sector, as well as our friends and allies around the world. This is the way this administration sees cybersecurity, the role of the government, its expectations for the private sector and broadly its vision for how it's going to focus and execute its vision for cybersecurity. But it's not an execution plan. It's not a series of milestones. It doesn't talk about budget or resources. It's just designed to provide a kind of overarching framework. I'm not trying to minimize it, just trying to put it in a kind of context as to what it is and what it does. So the latest strategy, again, the six pillars, as you mentioned, seems like the first one, there's a definite shift toward offensive strategy in relation to shaping adversary behavior. I believe that's how it's. Right. The way I would phrase it, because I've talked to the team about this as they were generating this or developing this. This administration's view is that government should focus on that which is unique to government with respect to cybersecurity. The greatest element, I think, that their view is that's unique to government is the offensive aspects of cybersecurity. You know, Sean, the national cyber director just within the last week has been public about saying, hey, look, this administration's view is that private companies, network owners and operators should not not be conducting offensive cyber. That that's the role of the government. I personally applaud that. I during my time when I was in the jobs and I was talking to President Obama and President Trump, I very much urged them, don't let the private sector get into offensive cyber. I said, we're going to have fratricide. We're going to have second and third order effects that we don't understand, that the companies don't understand. We're going to create huge legal liability for some of these companies. We go down this road. I just thought if we think it's messy now, geez, this would be like potentially this. This would be very chaotic. I said, I just don't think that's the smartest use of finite resources. Is it fair to read it in this version of the strategy that this shift toward offense is coming at the expense of defense? Do you read it that way? No, I don't read it that way at all. OK, the way I read it is they if you look at the six pillars, they clearly believe in technology and the role it's going to play. They clearly believe in people. They clearly think that the private sector needs to take primacy in cybersecurity, that the network owner and operator should focus very much on cybersecurity. They also talk about cyber resilience, which I very much applaud because I think resilience really needs to be our focus. They very much are focused on how we're going to use technology, AI and other elements to potentially negate penetrators ability to access networks in an unauthorized manner or to manipulate data or to shut down functionality or deny access to data or functionality. But you can tell, and I say this having talked to them multiple times, they also, my sense, believe that government needs to focus on that which they are uniquely positioned. So, for example, they are very high on the idea which we've seen previously of government providing threat information, government providing warning, government providing insight and knowledge to help network operators defend. By the same token, this team clearly does not place the same priority on misinformation and disinformation, the cyber components of election security. This just is not something that this team prioritizes in the same way that their predecessors did. So you shouldn't doubt that there are differences and that look, that happens almost every administration. I would say this one is a little more significantly different than its predecessors, for example, but, you know, different viewpoints. A few months back, we did a podcast on mostly talked about deterrence in cyberspace. And the holy grail that we're still trying to get to the major point, I think, that you made during that conversation was ultimately comes down to will and intent. Yep. Do we want to do this? And does the adversary believe we have both the capability and the intent to potentially exact either defeat their ability to be successful, right? Or to create too high a price for that success or to create a measure of pain that the other side thinks is, oh, this just isn't worth it. We don't want to incur this pain. Let's not go down this. Is that what this pillar is about, you think? Well, there's an element of it. This idea that cyber can be used as a vehicle to potentially deter through showing the ability to, hey, we can create pain, we can create disruption. Many of the things we're watching you do to us, we can do those if we want. We can create a measure of pain that we think will lead you to question the value or the benefit of what you're doing. Take a look at Salt Typhoon, you know, as an example, Volt Typhoon. Those are all good examples. Sure. You know, we're just trying to convince the adversary you do not want to engage in these kind of behaviors. Right. But then it's an attribution question, which is, again, another messy area. I mean, how? I'll be honest. Right. I have always found that concern a little overstated personally. OK. In my experience, you take it for what it's worth. Attribution, I'm not going to argue it's always perfect, but I never found it to be as difficult as a lot of people outside argued. What I found at times was a lot of policymakers would argue that they didn't have confidence in attribution, in part because I thought that was a way to just shunt the issue to ground. Because without attribution and without attribution with confidence, generally the policymaker will say, look, if you're not if you're telling me that you don't have confidence in knowing who did this or you don't have a high level of confidence. Hey, look, I'm not going to take action. I'm not going to develop a policy option predicated on, ah, we know exactly who did it and we have really high confidence. And at times, just being honest, I thought policymakers jumped on the attribution issue as a way to so they didn't have to. Right. Develop policy options. But from a from a signals perspective, is it often apparent? Yes. In my experience, more often than not, significantly more often than not, you have high confidence in who the actor was, how they did it, the forensics of the malware, the specifics of their tactics, techniques and procedures. Now, don't get me wrong. Sometimes it can take time to generate that knowledge. Sometimes it can take time to reconstruct. And it takes a great relationship with commercial providers because you want to get their view with a network owner, with your own data. But I always felt pretty confident in our ability to within a reasonable period of time to generate high confidence to exactly who is the actor and how to do it. One more question about the strategy that one of the other pillars about modernizing federal networks, federal networks always seems to be in there somewhere, always seems to get because it's the one areas of government you control without a law, you can't always tell the commercial world what to do. You can suggest you can create frameworks. You can try to make it easier for the private sector to do what you think is appropriate, but absent a legal or regulatory requirement, you can't always compel them. You can compel the government that the executive branch can compel within, you know, within the government. They can compel compliance. Yeah. I mean, but how steep is that hill to climb? I mean, you're talking about a significant. Oh, it's huge. Number one, you're looking at a massive infrastructure. Sure. I mean, if the U.S. government was a company, it would be among the largest companies in the world. Right. It is also a very fragmented and fractured company. It wasn't created as a single integrated entity. We've got so many networks, so many different constructs. There's also a very wide degree of resources within this single structure. Some parts of it, the D.O.D. is a good example. There's a lot of resources, other elements. If you're the Department of Agriculture and you're looking at your cybersecurity budget, you don't have as much. So there's, you know, different parts of the government have a different ability sometimes and different resource level. And in some cases, different priorities. That's another thing that's important about what follows from the strategy. We actually get down to execution where you start to mandate priorities. The challenge always is, in my experience, an administration likes to mandate, but it doesn't allocate resources against the mandate. So generally, you just have to, and that's not your business, that's the same challenge. You know, you're trying to address these priorities within the framework and within the priorities and the budget that you have. That's the fun side of it. It's right, but that's not, your CISOs and CIOs have the same challenge. It's not unique. It's true. It's just the scale is so massive, depending on where you are and what you do. All right, Mike. Thank you so much. Thank you. It's always a pleasure. Great to be at RSA again, as always, and a beautiful day. Michael, thanks for your hard work and, you know, well done to Nexus and the Clarity team. Thank you. Thanks. See you next time. All right.
