WEBVTT 00:00.280 --> 00:02.760 - [Announcer] He's Lieutenant General Bob Wood 00:02.760 --> 00:06.030 US Army retired, Executive Vice President 00:06.030 --> 00:09.960 for National Security and Defense, AFCEA International 00:09.960 --> 00:12.423 who will introduce our speakers. 00:12.423 --> 00:14.750 (Audience applauding) 00:14.750 --> 00:17.560 - Wake up. (laughs) 00:17.560 --> 00:19.160 All right ladies and gentlemen, 00:19.160 --> 00:20.920 welcome back from your break 00:20.920 --> 00:22.700 and the opportunity to be out on the floor 00:22.700 --> 00:25.130 and meet some great solution providers 00:25.130 --> 00:26.670 as we call them here. 00:26.670 --> 00:28.290 We're very thankful you're back with us 00:28.290 --> 00:31.070 and we have a great fireside chat 00:31.070 --> 00:33.250 here to talk through the issues 00:33.250 --> 00:34.820 that I think we're teed up beautifully 00:34.820 --> 00:37.070 by Admiral Norton at lunchtime. 00:37.070 --> 00:39.500 We're glad that we have you with us 00:39.500 --> 00:41.160 and we're glad as well that our sponsors 00:41.160 --> 00:44.750 have provided a good dessert, I saw a lot of eatin going on. 00:44.750 --> 00:47.160 I'd like to remind you all as we enter this session 00:47.160 --> 00:49.480 that you can text your questions 00:49.480 --> 00:52.740 to AskMeTechNetCyber, AskMeTNCyber 00:53.661 --> 00:57.324 which will be flashed up here in a moment at gmail.com, 00:57.324 --> 00:58.840 and so we'll be able to centralize the questions 00:58.840 --> 01:01.770 and ask 'em from the back that's AskMeTechNet, 01:01.770 --> 01:05.350 TNCyber at gmail.com. 01:05.350 --> 01:08.690 Well it was a great set up as I mentioned Admiral Norton 01:08.690 --> 01:11.230 talking through the many things that have gone on 01:11.230 --> 01:13.070 in DISA for the last year, 01:13.070 --> 01:15.160 the accomplishments, the challenges 01:15.160 --> 01:18.070 and I think a great framework for discussion 01:18.070 --> 01:20.210 that we'll proceed with this afternoon. 01:20.210 --> 01:23.740 Certainly with Joint Task Force-DoDIN 01:23.740 --> 01:27.410 and missions that this is accomplishing around the world, 01:27.410 --> 01:29.460 it really did show the magnitude 01:29.460 --> 01:31.530 of the not only the challenges 01:31.530 --> 01:33.270 but the capabilities of DISA, 01:33.270 --> 01:34.650 and now we have the opportunity 01:34.650 --> 01:37.150 to talk about the department and CYBERCOM, 01:37.150 --> 01:39.553 with the perspectives of the key players. 01:39.553 --> 01:44.553 It's now my pleasure to introduce these participants, 01:44.740 --> 01:48.990 we're very happy to have with us moderator Francis Rose 01:48.990 --> 01:50.250 which many of you know, 01:50.250 --> 01:53.310 award-winning broadcaster, journalist, speaker and writer, 01:53.310 --> 01:55.910 host of government matters on Washington DC, 01:55.910 --> 01:57.820 and he's covered all three branches of the 01:57.820 --> 02:01.694 federal government as a broadcast journalist since 1998. 02:01.694 --> 02:04.100 We are ready to go if you're ready to hear 02:04.100 --> 02:05.270 let's go ahead and begin. 02:05.270 --> 02:07.170 Ladies and Gentlemen please give a warm welcome 02:07.170 --> 02:09.510 to Francis Rose, Mr. Dana Deasy, 02:09.510 --> 02:11.596 and General Paul Nakasone. 02:11.596 --> 02:14.640 (Audience applauding) 02:14.640 --> 02:15.790 - Thank you very much 02:15.790 --> 02:18.940 and a great thanks first to the AFCEA team 02:18.940 --> 02:20.730 who puts together this event every year 02:20.730 --> 02:22.030 and it's always excellent, 02:23.030 --> 02:25.256 my only point of contention is 02:25.256 --> 02:29.917 as hard for me to prepare for a fireside chat with no fire. 02:29.917 --> 02:33.307 Oh terrific we'll get right on that thank you. 02:33.307 --> 02:35.500 On a more serious note, 02:35.500 --> 02:37.890 I have an opportunity to do a lot of these 02:37.890 --> 02:42.010 and very few of them are with people 02:42.010 --> 02:45.610 who are really on, literally at the tip of the spear 02:45.610 --> 02:46.850 as these two men are, 02:46.850 --> 02:48.580 and so I'm very pleased General Nakasone, 02:48.580 --> 02:49.770 to see you again, 02:49.770 --> 02:51.990 Dana it's good to see you again as well. 02:51.990 --> 02:54.410 You both have been on the job for about a year, 02:54.410 --> 02:56.260 and I'm interested to explore 02:56.260 --> 02:59.560 the collaboration between your two offices. 02:59.560 --> 03:01.991 Dana in particular coming from the private sector 03:01.991 --> 03:04.820 where you operated at the very highest levels 03:04.820 --> 03:06.142 of the financial services sector 03:06.142 --> 03:08.360 but probably hadn't seen anything 03:08.360 --> 03:12.110 quite like you're seeing inside the department right now. 03:12.110 --> 03:13.513 - That would be a fair statement. 03:13.513 --> 03:17.050 (Francis laughs) 03:17.050 --> 03:20.210 You know I think Secretary Shanahan summed it up one day, 03:20.210 --> 03:22.870 we were in his office we were having a conversation 03:22.870 --> 03:25.437 about some of the stuff that General Nakasone 03:25.437 --> 03:26.640 and I were working on 03:26.640 --> 03:28.647 and he just looks across to me and he says, 03:28.647 --> 03:31.539 "Did you ever think when you left the private sector 03:31.539 --> 03:33.100 and you went into retirement that someday 03:33.100 --> 03:34.320 one of your very dearest friends 03:34.320 --> 03:36.865 would be the head of the NSA and US Cyber Command?" 03:36.865 --> 03:38.640 And I remember thinking no, 03:38.640 --> 03:43.030 I haven't quite put that together so yeah. 03:43.030 --> 03:44.830 - And I think I would just pile on with that, 03:44.830 --> 03:48.060 so Dana and I started about the same time last May, 03:48.060 --> 03:51.250 within a week we had already talked 03:51.250 --> 03:55.069 and I think we had a general sense of 03:55.069 --> 03:57.480 we have about the same DNA 03:57.480 --> 03:59.710 we were really focused on outcomes, 03:59.710 --> 04:02.408 I was intrigued because he had come 04:02.408 --> 04:05.320 from the private sector and we were very very 04:05.320 --> 04:06.370 interested in what he had done 04:06.370 --> 04:08.630 and I think for a large degree, 04:08.630 --> 04:10.660 Dana was interested you know to find out hey, 04:10.660 --> 04:12.520 what's going on in* the role of government. 04:12.520 --> 04:14.660 And that has been I think the starting point 04:14.660 --> 04:17.387 for where we have done policy operational work 04:17.387 --> 04:19.920 and more importantly planning for 04:19.920 --> 04:21.700 and executing the vision for 04:21.700 --> 04:24.000 Secretary Shanahan and our department. 04:24.000 --> 04:25.390 - There is a perception though Dana 04:25.390 --> 04:28.329 that if government could just do 04:28.329 --> 04:29.610 what the private sector is doing 04:29.610 --> 04:31.500 that's kind of a Holy Grail 04:31.500 --> 04:33.020 and I'm not sure that's always fair 04:33.020 --> 04:36.940 what did you see coming in from the private sector 04:36.940 --> 04:38.160 and seeing what's going on, 04:38.160 --> 04:40.210 not just in General Nakasone's command 04:40.210 --> 04:42.860 but more broadly across the department, 04:42.860 --> 04:45.360 did you see the big split that we kind of 04:45.360 --> 04:48.360 in this community make out to be this big difference 04:48.360 --> 04:49.517 between what the private sector is doing 04:49.517 --> 04:50.990 and what the public sector's doing? 04:50.990 --> 04:53.144 - You know there's no doubt that 04:53.144 --> 04:55.460 there are things I have seen where you kind of go 04:55.460 --> 04:57.679 really this shouldn't be that hard. 04:57.679 --> 05:00.320 And then there's other things where you say 05:00.320 --> 05:04.310 I actually understand why the systems, the processes, 05:04.310 --> 05:06.820 the checks and balances are there. 05:06.820 --> 05:09.330 You know everyday you can't help but notice 05:09.330 --> 05:10.983 when you walk into the Pentagon, 05:10.983 --> 05:15.317 that you're dealing with situations where you're about 05:15.317 --> 05:18.373 protecting the men and women in uniform, 05:19.970 --> 05:21.710 didn't ever experience something 05:21.710 --> 05:25.343 quite of that same magnitude in the private sector, 05:25.343 --> 05:28.570 I think the government gets a little unfair rap at times 05:28.570 --> 05:32.378 about if we just did everything like private industry, 05:32.378 --> 05:33.970 everything would work better, 05:33.970 --> 05:35.770 there's no doubt we can learn 05:35.770 --> 05:38.360 and I'm trying to bring in those practices 05:38.360 --> 05:39.500 where they make sense, 05:39.500 --> 05:41.470 but there are truly unique things 05:41.470 --> 05:44.800 that are done inside the DoD specifically, 05:44.800 --> 05:47.820 where I cannot find an application 05:47.820 --> 05:50.640 or a direct translation to that in the private sector. 05:50.640 --> 05:52.250 - Mm-hmm. - And I think I would add 05:52.250 --> 05:53.960 you know if you take a look at a 05:53.960 --> 05:57.040 just a quick snapshot of what Admiral Norton 05:57.040 --> 05:58.840 and her folks have to run on a daily basis 05:58.840 --> 06:00.870 over 1 million different hosts 06:00.870 --> 06:03.440 over every single time zone in the world, 06:03.440 --> 06:05.150 multiple classification levels, 06:05.150 --> 06:07.900 the fact that we are dealing with unclassified email, 06:07.900 --> 06:10.330 all the way to the most sensitive communications 06:10.330 --> 06:11.558 that our government has, 06:11.558 --> 06:15.360 that is a pretty broad span of what goes in, 06:15.360 --> 06:16.770 goes on day in and day out. 06:16.770 --> 06:21.257 And the piece that I think I give great credit to Dana 06:22.210 --> 06:24.040 is the fact that he brought this idea 06:24.040 --> 06:25.816 of okay I understand cyber security 06:25.816 --> 06:28.380 but I also understand the importance of 06:28.380 --> 06:30.990 how do we put cyber security to work? 06:30.990 --> 06:33.130 How do we ensure mission assurance 06:33.130 --> 06:35.680 that our networks run, not only our networks run 06:35.680 --> 06:37.160 but our data's secure 06:37.160 --> 06:39.102 and we have a very very good understanding of 06:39.102 --> 06:41.440 do we have the level of protection of 06:41.440 --> 06:43.420 our weapons systems that's necessary. 06:43.420 --> 06:45.660 That's a broader spectrum than I think 06:45.660 --> 06:48.740 you know perhaps you know Dana had in the private sector, 06:48.740 --> 06:51.340 but again this is part of the process 06:51.340 --> 06:53.520 that we've worked together over the past year. 06:53.520 --> 06:56.335 - What are the major things that you have seen 06:56.335 --> 06:59.440 that are different, that work differently maybe 06:59.440 --> 07:01.790 than you expected the day that you walked in the door 07:01.790 --> 07:03.090 about a year ago? 07:03.090 --> 07:05.670 And then general I'll ask you again to tack on to 07:05.670 --> 07:08.722 how you have helped him understand, 07:08.722 --> 07:11.920 here's what we do, here's what the capabilities are 07:11.920 --> 07:14.170 and here's maybe where the capability gaps are, 07:14.170 --> 07:15.960 that you could use some help 07:15.960 --> 07:18.550 him having him help push that up the. 07:18.550 --> 07:21.130 - I think the one that really hit home for me was 07:21.130 --> 07:23.060 you know in the private sector 07:23.060 --> 07:25.815 when you think about answering the question 07:25.815 --> 07:30.130 is the footprint of how a corporation runs 07:30.130 --> 07:31.990 can you say is secure? 07:31.990 --> 07:33.960 And you say well what does that look like, 07:33.960 --> 07:36.990 that could look like plants, engineering facilities, 07:36.990 --> 07:41.450 sales office distribution, warehouses etc, 07:41.450 --> 07:43.240 and when I got to the DoD 07:43.240 --> 07:46.060 that conversation quickly translates into, 07:46.060 --> 07:49.378 a plane, a ship, a forward command, 07:49.378 --> 07:52.270 and that changes very dramatically, 07:52.270 --> 07:54.460 the dynamics of what you're trying to solve for, 07:54.460 --> 07:56.980 when you start to get into the conversation 07:56.980 --> 07:59.479 and that's where I really leaned heavy on 07:59.479 --> 08:01.580 General Nakasone in the early days 08:01.580 --> 08:03.620 just to help me to appreciate 08:03.620 --> 08:06.473 what do we mean by what that cyber threat looks like 08:06.473 --> 08:08.920 when we're talking about a weapon system, 08:08.920 --> 08:10.443 versus you're talking about 08:10.443 --> 08:12.763 let's say a manufacturing plant. 08:13.850 --> 08:16.670 And I think to really add to that, 08:16.670 --> 08:20.166 we were in 2018 from the time we started in May, 08:20.166 --> 08:22.180 talking with the secretary at the time 08:22.180 --> 08:24.210 about election security, 08:24.210 --> 08:27.710 we were focused on the midterm elections in May 08:27.710 --> 08:30.640 by the end of May we had stood up to rush a small group, 08:30.640 --> 08:32.020 we were working through a series of 08:32.020 --> 08:34.087 strategies, policies, authorities 08:34.087 --> 08:37.260 I had a counterpart at the Pentagon here 08:37.260 --> 08:39.350 that was taking that message 08:39.350 --> 08:41.410 to the senior leaders of the department 08:41.410 --> 08:44.400 but also that also spawned from the idea of 08:44.400 --> 08:46.440 what only is the department defense doing 08:46.440 --> 08:49.530 but broadly we take a look at the 17 sectors 08:49.530 --> 08:51.200 of our critical infrastructure. 08:51.200 --> 08:53.320 So how do we ensure that the capacity 08:53.320 --> 08:55.620 and the capability of cyber command, 08:55.620 --> 08:57.140 the National Security Agency, 08:57.140 --> 08:58.918 can be applied appropriately to 08:58.918 --> 09:02.390 you know the financial industry or the energy sector 09:02.390 --> 09:04.523 or others that are important to us. 09:06.148 --> 09:06.981 That's, that has really been a 09:08.145 --> 09:09.707 I would tell you the big advancement 09:09.707 --> 09:10.550 that we've had over the past 12 months. 09:10.550 --> 09:12.870 - How do you view your job as having changed 09:12.870 --> 09:14.430 in the year that you've been on it 09:14.430 --> 09:17.120 and what's driving it whatever that change is 09:17.120 --> 09:20.200 is it the threat landscape, is it technology, 09:20.200 --> 09:22.870 is it what the bad guys specifically 09:22.870 --> 09:24.940 want to do to us or what we want to do to them. 09:24.940 --> 09:27.035 What's behind all that General? 09:27.035 --> 09:29.470 - Three areas first of all I would say 09:29.470 --> 09:30.720 it's certainly the threat 09:30.720 --> 09:33.290 the threat is more adaptive, the threat is more capable 09:33.290 --> 09:34.830 and the threat is more pervasive 09:34.830 --> 09:36.560 all of the things that you've heard 09:36.560 --> 09:38.180 in so many different spectrums, 09:38.180 --> 09:40.093 the barriers to entry remain low, 09:40.093 --> 09:42.000 the capacity and capabilities 09:42.000 --> 09:44.100 of our adversaries are improving. 09:44.100 --> 09:46.867 The second is that our national security strategy, 09:46.867 --> 09:48.260 our national defense strategy 09:48.260 --> 09:51.450 talks about an air of great power and competition, 09:51.450 --> 09:54.178 so our targets have also changed to a degree. 09:54.178 --> 09:57.290 For 17 plus years, our department 09:57.290 --> 09:59.087 I would tell you that the National Security Agency 09:59.087 --> 10:00.570 and US Cyber Command had been focused 10:00.570 --> 10:02.410 on violent extremist organizations, 10:02.410 --> 10:04.511 we're very proud of the work that's been done. 10:04.511 --> 10:06.240 At the same time, we also know that 10:06.240 --> 10:07.300 our adversaries have changed 10:07.300 --> 10:08.970 and so the targets that, 10:08.970 --> 10:11.150 what we have to be concerned about for the future 10:11.150 --> 10:12.960 are obviously there as well, 10:12.960 --> 10:15.155 and then there are other pieces, technology, 10:15.155 --> 10:18.990 we stand on you know the verge of 10:18.990 --> 10:22.260 fifth generation wireless in the next 12 months, 10:22.260 --> 10:24.500 both Dana and I have been very very busy 10:24.500 --> 10:25.800 with regards to machine learning 10:25.800 --> 10:26.870 and artificial intelligence, 10:26.870 --> 10:28.440 how do we ensure that you know 10:28.440 --> 10:31.040 the power of data that we know is there 10:31.040 --> 10:34.054 can be applied to utilized and leveraged by our department. 10:34.054 --> 10:37.810 Those are the things that are driving us right now, 10:37.810 --> 10:42.810 so those technologies Dana are buzzwords to some degree, 10:43.395 --> 10:45.233 what are the most important things 10:45.233 --> 10:47.150 that industry can help you do, 10:47.150 --> 10:49.530 to peel that buzz away 10:49.530 --> 10:52.240 and help you understand 10:52.240 --> 10:55.910 or learn more about how they can actually deliver capability 10:55.910 --> 10:58.830 to war fighters or to back office people too 10:58.830 --> 11:01.363 who will use them to do important things 11:01.363 --> 11:03.290 to feed the mission of the department? 11:03.290 --> 11:06.120 - You know this is where something's not that different 11:06.120 --> 11:08.761 coming from private sector into government, 11:08.761 --> 11:12.630 insofar as I think CIOs generally 11:12.630 --> 11:14.413 one of the responsibilities they have 11:14.413 --> 11:16.710 is to make sure that 11:16.710 --> 11:19.580 industry understands what we're looking for 11:19.580 --> 11:22.800 can explain it in a way that makes it accessible 11:22.800 --> 11:25.430 for them to describe products and solutions. 11:25.430 --> 11:28.451 So one of the things that I've tried to do, 11:28.451 --> 11:31.950 is to continue to share with the Department of Defense 11:31.950 --> 11:35.380 across all the principles the importance of 11:35.380 --> 11:37.530 we need to think about the traditional defense 11:37.530 --> 11:39.860 industrial base and supporting our needs 11:39.860 --> 11:43.470 and we need to think about non-traditional players 11:43.470 --> 11:45.300 and then there that's all about 11:45.300 --> 11:46.770 how do you access them, 11:46.770 --> 11:47.900 how do you make them aware 11:47.900 --> 11:50.280 that we're interested in conversation with them, 11:50.280 --> 11:51.300 how do we make them, 11:51.300 --> 11:52.935 how do we get them to think about us 11:52.935 --> 11:56.120 as not being so complicated and so hard 11:56.120 --> 11:58.270 to come and have a conversation with. 11:58.270 --> 12:00.570 So it's breaking it down in a way where 12:00.570 --> 12:03.278 they feel like we're accessible 12:03.278 --> 12:07.060 and they can grab hold of a portion of something 12:07.060 --> 12:09.860 we're trying to solve for and help us solve for them. 12:09.860 --> 12:12.640 - That's not probably the right discussion 12:12.640 --> 12:14.490 to have though at the CIO level 12:14.490 --> 12:16.710 that has to happen at lower levels 12:16.710 --> 12:19.330 for those companies and people 12:19.330 --> 12:22.190 to be able to touch the right people, 12:22.190 --> 12:25.670 are you happy with the infrastructure that exists right now 12:25.670 --> 12:27.290 within the department to get those people 12:27.290 --> 12:30.900 to the right people or would you like to see 12:30.900 --> 12:32.940 something that you're doing facilitated 12:32.940 --> 12:34.540 or would you like to see something 12:34.540 --> 12:36.590 that you're not doing start, 12:36.590 --> 12:38.020 what would you like to see 12:38.020 --> 12:40.670 to make sure that you're not missing anything out there 12:40.670 --> 12:42.800 in that landscape that you're describing? 12:42.800 --> 12:44.720 - So one of the things we're trying to do for example 12:44.720 --> 12:47.730 when we created the Joint Artificial Intelligence Center 12:47.730 --> 12:50.110 was to set up an entity of people, 12:50.110 --> 12:53.720 to teach them how to just scan the universe 12:53.720 --> 12:56.380 of what I call the art of the possible out there, 12:56.380 --> 12:59.240 and just to teach them in kind of ways 12:59.240 --> 13:00.340 that were maybe were different 13:00.340 --> 13:02.550 than our normal acquisition approaches 13:02.550 --> 13:04.691 to how we scan for technology, 13:04.691 --> 13:07.670 and that's been really an importance. 13:07.670 --> 13:09.920 A just to teach them how to scan. 13:09.920 --> 13:12.610 B how to hold conversations what I'll call 13:12.610 --> 13:14.734 with non-traditional players. 13:14.734 --> 13:18.630 C, how to make it accessible for them to come in 13:18.630 --> 13:21.860 and start to show us what they can do for us 13:21.860 --> 13:23.713 and create pilot opportunities, 13:24.810 --> 13:27.923 this is where I think we can help 13:27.923 --> 13:30.780 private sector help it out and teaching 13:30.780 --> 13:33.640 new ways for us to do these things inside of government, 13:33.640 --> 13:36.730 where you have to do them with a great deal of speed, 13:36.730 --> 13:39.760 and I'd say our Joint Artificial Intelligence Center 13:39.760 --> 13:42.440 has been one of the early spaces 13:42.440 --> 13:45.440 where we've been adopting this mantra of, 13:45.440 --> 13:47.220 do we always want to start with the bias 13:47.220 --> 13:49.200 that we have to build everything, 13:49.200 --> 13:50.620 or can we start with the bias 13:50.620 --> 13:52.583 that maybe somewhere out there in the world, 13:52.583 --> 13:56.510 maybe at a university level or it could be a small start-up 13:56.510 --> 13:59.810 or it could be a very large established supplier, 13:59.810 --> 14:01.030 that we can reach out to, 14:01.030 --> 14:03.170 and it's learning how to reach out to them 14:03.170 --> 14:04.003 in a different way. 14:04.003 --> 14:06.250 - Yeah we've had some experience with that 14:06.250 --> 14:08.920 and this is where Dana has been invaluable. 14:08.920 --> 14:10.183 If you take a look at 14:10.183 --> 14:13.020 we have a long tradition of working with In-Q-Tel 14:13.020 --> 14:16.640 at NSA and developing and looking at 14:16.640 --> 14:19.750 companies out there that might provide us great insights. 14:19.750 --> 14:21.620 Secondly you know DIUx 14:21.620 --> 14:25.117 which is now a Defense Innovation Unit 14:25.117 --> 14:27.680 is another area that we have been able 14:27.680 --> 14:29.700 to work very very closely 14:29.700 --> 14:32.050 and now I would say even DDS 14:32.050 --> 14:35.640 and we take a look at you know Defense Digital Services 14:35.640 --> 14:37.870 under the direction first of all Chris Lynch 14:37.870 --> 14:40.230 now with Brett Goldstein at the head, 14:40.230 --> 14:41.660 these guys are at the Pentagon 14:41.660 --> 14:43.430 I mean they're working at the Pentagon 14:43.430 --> 14:44.790 doing a number of different projects 14:44.790 --> 14:46.480 that we find of great interest 14:46.480 --> 14:49.400 and as I think has been pointed out 14:49.400 --> 14:50.520 turning us on to the areas 14:50.520 --> 14:52.730 we should be thinking about and looking at. 14:52.730 --> 14:54.020 - What are some of those 14:54.020 --> 14:56.703 that are particularly useful to you 14:56.703 --> 14:59.480 that aren't AI and some of the other 14:59.480 --> 15:01.410 real high-profile buzz words, 15:01.410 --> 15:02.420 what are some of those 15:02.420 --> 15:04.260 that are useful to you now General? 15:04.260 --> 15:06.660 - Yeah so I think a number of analytic tools 15:06.660 --> 15:07.500 that we're looking at 15:07.500 --> 15:09.610 that have the ability to call through 15:09.610 --> 15:11.062 tremendous amounts of data, 15:11.062 --> 15:13.640 I think some of the early work 15:13.640 --> 15:15.460 that has been done on malware and forensics 15:15.460 --> 15:17.640 that we can apply to our defensive teams 15:17.640 --> 15:19.250 are of great interest to us, 15:19.250 --> 15:23.200 I think that another area that that certainly 15:23.200 --> 15:26.318 piques our interest is the ability to 15:26.318 --> 15:31.004 you know to be able to look at ways that we can 15:31.004 --> 15:33.430 develop you know almost self-healing networks 15:33.430 --> 15:36.270 based upon the the early identification of threats 15:36.270 --> 15:38.560 and how do we get to that more quickly. 15:38.560 --> 15:40.090 - You're nodding as he's talking about 15:40.090 --> 15:42.900 self-healing networks in particular Dana. 15:42.900 --> 15:46.240 - Yeah I mean I don't think it's far-fetched 15:46.240 --> 15:47.970 to believe there will be a time, 15:47.970 --> 15:50.051 so first of all how we're kind of organized 15:50.051 --> 15:52.650 is I think quite important here 15:52.650 --> 15:54.560 so when General Nakasone and I 15:54.560 --> 15:56.350 first started working together, 15:56.350 --> 15:59.160 very quickly I saw and I think he saw as well 15:59.160 --> 16:01.730 how quickly we could lean and create this very 16:01.730 --> 16:04.240 symbiotic working relationship. 16:04.240 --> 16:06.700 And he's clearly the world-class expert 16:06.700 --> 16:09.220 of the offensive mission, 16:09.220 --> 16:11.210 he clearly has the baton 16:11.210 --> 16:13.510 and the ownership of the defense 16:13.510 --> 16:16.450 but then you have this entire surface space 16:16.450 --> 16:20.000 called every place that an adversary will look 16:20.000 --> 16:23.470 to try to get in from an endpoint 16:23.470 --> 16:25.360 all the way through an application 16:25.360 --> 16:27.180 through data, through networks, 16:27.180 --> 16:29.870 through a weapon system etc. 16:29.870 --> 16:32.040 And so I worry about the resiliency 16:32.040 --> 16:34.420 how do we make the Department of Defense 16:34.420 --> 16:38.020 more resilient, we fix the sins of our past. 16:38.020 --> 16:40.820 But I look to him to answer the question, 16:40.820 --> 16:42.280 do you see us every day 16:42.280 --> 16:43.580 as you defend our networks 16:43.580 --> 16:45.550 that we're becoming more resilient? 16:45.550 --> 16:49.430 And so there's this very strong tendency 16:49.430 --> 16:53.380 for me to say I am gonna rely on my partner here 16:53.380 --> 16:56.580 to point out where our deficiencies are 16:56.580 --> 16:59.440 where I should be spending more time and energy in, 16:59.440 --> 17:01.900 and that leads to such things as 17:01.900 --> 17:05.070 do we need to build networks differently in the future, 17:05.070 --> 17:08.159 do we need to build applications 17:08.159 --> 17:12.250 in a world where they are self-aware of what's going on, 17:12.250 --> 17:13.970 they're aware the network's degrading, 17:13.970 --> 17:16.730 they're aware that this path of communications 17:16.730 --> 17:17.970 has been degraded, 17:17.970 --> 17:20.020 and be able to smartly know 17:20.020 --> 17:22.243 other channels of how to still communicate. 17:23.110 --> 17:26.810 - Do you see improvement that Dana's talking about, 17:26.810 --> 17:28.590 and how do you measure that, 17:28.590 --> 17:30.100 how do you measure the improvement 17:30.100 --> 17:32.030 of the resilience of a network? 17:32.030 --> 17:35.800 - So I think I measure the first measure of success with 17:35.800 --> 17:39.490 do we have awareness of what we're facing? 17:39.490 --> 17:40.330 We do have awareness, 17:40.330 --> 17:42.230 I mean there is clearly a delineation 17:42.230 --> 17:44.400 of the most important things that we're going to address 17:44.400 --> 17:47.040 based upon the vulnerabilities that we're seeing. 17:47.040 --> 17:48.040 Secondly I would measure 17:48.040 --> 17:50.710 do the senior leaders of our department 17:50.710 --> 17:53.620 listen, care, understand, they do, 17:53.620 --> 17:55.940 I can tell you that we brief them regularly, 17:55.940 --> 17:57.660 there is interest in it 17:57.660 --> 17:59.300 and I think that you know as 17:59.300 --> 18:02.610 we take a look and say can solutions be had here, 18:02.610 --> 18:05.210 yes because you have leadership that says 18:05.210 --> 18:06.753 we're going to fix this 18:06.753 --> 18:09.329 and the third piece is, at the end of the day, 18:09.329 --> 18:11.070 are you resourcing the areas that you are showing 18:11.070 --> 18:12.290 there are capability gaps 18:12.290 --> 18:15.250 and based upon last year's success 18:15.250 --> 18:17.300 I think the work that's being done, 18:17.300 --> 18:19.800 to get ready for the 21 budget build, yes, 18:19.800 --> 18:22.010 those are all very very good areas. 18:22.010 --> 18:23.800 - You mentioned the national defense strategy 18:23.800 --> 18:26.040 earlier General and the shift 18:26.040 --> 18:29.000 from fighting violent extremism 18:29.000 --> 18:31.443 to a great power competition, 18:31.443 --> 18:33.840 what difference does that make 18:33.840 --> 18:35.920 in the way that you position the NSA 18:35.920 --> 18:37.630 and you position Cyber Command 18:37.630 --> 18:40.550 and the tools that you need to have at your fingertips, 18:40.550 --> 18:44.160 thereby what those conversations with industry are like, 18:44.160 --> 18:45.690 the kinds of things that you're talking, 18:45.690 --> 18:48.680 is there a shift has there been a shift 18:48.680 --> 18:50.460 since the NDS has rolled out 18:50.460 --> 18:52.997 and that people have started 18:52.997 --> 18:53.830 to understand what's required? 18:53.830 --> 18:55.290 - Yeah no doubt I think if you come in 18:55.290 --> 18:56.930 and you take apart the NDS and you say 18:56.930 --> 18:58.260 hey what are the three major ideas 18:58.260 --> 19:01.050 lethality, partnerships, better business practices 19:01.050 --> 19:03.050 apply them to your command 19:03.050 --> 19:05.400 or apply them to your agency, you'd see that. 19:05.400 --> 19:06.690 In terms of our lethality, 19:06.690 --> 19:09.670 we look at lethality across the spectrum, 19:09.670 --> 19:11.650 are we resilient, can we ensure 19:11.650 --> 19:12.690 the security of our enterprise, 19:12.690 --> 19:13.640 the security of our networks, 19:13.640 --> 19:16.720 are we able to develop accesses 19:16.720 --> 19:19.860 and do we have the capabilities to either create effects 19:19.860 --> 19:21.420 or gather intelligence. 19:21.420 --> 19:25.740 On partnerships I think the partnerships start with 19:25.740 --> 19:28.120 the idea of what's a partnership between 19:28.120 --> 19:30.560 the National Security Agency and US Cyber Command, 19:30.560 --> 19:31.850 pretty strong partnership right now 19:31.850 --> 19:34.410 based upon the work that was done in 2018, 19:34.410 --> 19:36.390 it's a developed, I think it's one that 19:36.390 --> 19:40.140 that we find very very comfortable now to act within. 19:40.140 --> 19:41.310 And then I think the last piece 19:41.310 --> 19:42.858 on better business practices, 19:42.858 --> 19:45.690 I'm a believer in task force 19:45.690 --> 19:47.966 and so my experience throughout my career has been 19:47.966 --> 19:52.240 when we have an issue whether or not it's Isis or elections 19:52.240 --> 19:53.590 I like to stand up task forces, 19:53.590 --> 19:54.900 so we had the Russia small group, 19:54.900 --> 19:57.230 that was a task force we stood up it's still there 19:57.230 --> 19:59.610 still operating I think that was effective to get 19:59.610 --> 20:01.800 speed, agility, and unity of effort. 20:01.800 --> 20:03.490 So those were areas I think that's 20:03.490 --> 20:04.870 really kind of driven our thoughts at 20:04.870 --> 20:07.651 both the command and the agency. 20:07.651 --> 20:09.810 - I think when the NDS came out Dana 20:09.810 --> 20:11.930 there were some folks surprised 20:11.930 --> 20:14.350 by the emphasis on the business practices 20:14.350 --> 20:15.920 I know the work that's gone into the audit 20:15.920 --> 20:19.746 over the last decade or longer at the department, 20:19.746 --> 20:22.720 how was that impressed upon you, 20:22.720 --> 20:24.950 this is something we are focused on, 20:24.950 --> 20:28.860 when you came in and what successes or accomplishments 20:28.860 --> 20:31.710 can you point to regarding the business practice 20:31.710 --> 20:36.150 of the CIO shop at DoD as a result of that emphasis. 20:36.150 --> 20:37.660 - Yeah you know first of all I'd say, 20:37.660 --> 20:41.360 the way you go about reforming 20:41.360 --> 20:44.210 or finding opportunities to be more efficient, 20:44.210 --> 20:46.010 maybe that in your practices 20:46.010 --> 20:48.890 or in lowering your operating cost 20:48.890 --> 20:51.323 are not that different between 20:51.323 --> 20:54.120 private industry and government, 20:54.120 --> 20:57.110 you still always look at simple things like 20:57.110 --> 20:59.580 how many people does it take that run X 20:59.580 --> 21:01.410 why do you have ten of these things, 21:01.410 --> 21:03.783 can you have five, can you move to one, 21:04.700 --> 21:06.760 so you know our focus has been on 21:06.760 --> 21:08.840 all those classic traditional things 21:08.840 --> 21:10.770 you would expect any CIO to focus on 21:11.730 --> 21:13.980 from number of data centers to the number of helpdesks, 21:13.980 --> 21:18.650 to number of internet access points 21:18.650 --> 21:22.695 to number of servers, can you virtualize more, 21:22.695 --> 21:24.780 can you move more things to 21:24.780 --> 21:27.250 cloud-based computing technology, 21:27.250 --> 21:29.980 can you change your development practices, 21:29.980 --> 21:32.559 so that whole array of things 21:32.559 --> 21:33.910 that I just kind of rattled off there, 21:33.910 --> 21:37.640 are all ones that we have active programs under 21:37.640 --> 21:40.760 and we are making significant improvement on 21:40.760 --> 21:42.770 you're both in a great power competition 21:42.770 --> 21:44.900 of another sort, my term for it 21:44.900 --> 21:48.010 and that competition in some respects 21:48.010 --> 21:49.810 is with a lot of the people in this room 21:49.810 --> 21:51.073 and that's for talent. 21:52.144 --> 21:55.600 Everybody's competing for the kind of talent 21:55.600 --> 21:56.550 that you both need, 21:56.550 --> 21:58.740 what does the talent landscape look like 21:58.740 --> 22:01.330 both for finding new people 22:01.330 --> 22:03.590 that you need but also for keeping the people 22:03.590 --> 22:06.620 that you have that are really good in an environment 22:06.620 --> 22:08.650 where the broader economy is strong, 22:08.650 --> 22:11.730 the economy within the IT and cyber community 22:11.730 --> 22:14.670 in this region of the country is very strong 22:14.670 --> 22:18.880 and yet you have a continual need, 22:18.880 --> 22:22.540 as everyone else does to try to find and keep 22:22.540 --> 22:24.040 the right kinds of people general, 22:24.040 --> 22:25.870 take that one first. 22:25.870 --> 22:28.873 - In terms of the spectrum of recruit train and retain, 22:28.873 --> 22:33.190 I give high marks the services for recruiting I continue to 22:33.190 --> 22:36.100 see the ability for, Army, Navy, 22:36.100 --> 22:38.440 Air Force, Marines to recruit, 22:38.440 --> 22:40.130 the number of people that need to be part 22:40.130 --> 22:42.030 of our cyber forces on the NSA side, 22:42.030 --> 22:44.520 we'll hire over 2200 people this year, 22:44.520 --> 22:46.640 we can continue to still hire those folks 22:46.640 --> 22:49.660 on the training side really high marks, 22:49.660 --> 22:52.010 we have as the services, 22:52.010 --> 22:53.790 I think gotten to a level of training 22:53.790 --> 22:56.872 that is where we need to have our young people 22:56.872 --> 22:57.705 as they come into our force 22:57.705 --> 22:59.240 and imprint them and make sure 22:59.240 --> 23:00.900 that they're ready to operate when they come 23:00.900 --> 23:02.340 to US Cyber Command, 23:02.340 --> 23:05.260 and I say that is truly a strength of what we do. 23:05.260 --> 23:07.586 Now let's talk about retention 23:07.586 --> 23:10.010 that is the number one area of the spectrum 23:10.010 --> 23:11.533 that I'm focused on today, 23:11.533 --> 23:14.710 there is a reverse correlation 23:14.710 --> 23:16.870 when the unemployment numbers are low, 23:16.870 --> 23:18.800 you know attrition is going to be higher. 23:18.800 --> 23:20.773 We track it through you know, 23:21.743 --> 23:23.879 some very very specialized skill sets both at cyber 23:23.879 --> 23:25.700 come in and in NSA we are in a battle 23:25.700 --> 23:28.490 for it and I think that we have had 23:28.490 --> 23:32.250 success with the you know the assistance 23:32.250 --> 23:35.330 of Congress for select pays I think that 23:35.330 --> 23:37.300 the approach of you know hard problems 23:37.300 --> 23:40.282 that attract a number of this within this generation 23:40.282 --> 23:41.917 and the idea, that you know there 23:41.917 --> 23:44.960 are very very few places that you can come 23:44.960 --> 23:45.793 and do what you're gonna do 23:45.793 --> 23:48.000 at a place like NSA and Cyber Command 23:48.000 --> 23:50.173 with all that being said there's still 23:50.173 --> 23:53.050 there's still every single day work, 23:53.050 --> 23:56.650 that we have to do to maintain and keep our very best. 23:56.650 --> 23:58.190 - What are the most difficult things, 23:58.190 --> 24:00.410 what help could you use the most 24:00.410 --> 24:02.248 to keep the people that you need 24:02.248 --> 24:06.130 the people you already have to get them to stay? 24:06.130 --> 24:08.684 - I think aren't internally one of the things that 24:08.684 --> 24:11.480 that would help us a lot and we're working towards 24:11.480 --> 24:14.490 is how do we improve the public-private partnerships 24:14.490 --> 24:17.730 that are out there that we might be able to leverage 24:17.730 --> 24:19.550 right now those are really buzzwords 24:19.550 --> 24:22.330 for a large degree so what does that mean 24:22.330 --> 24:23.940 when we're trying to get 24:23.940 --> 24:26.160 folks that we want to work classified projects 24:26.160 --> 24:27.640 in different parts of the country, 24:27.640 --> 24:29.680 we don't I think do that as well as we could, 24:29.680 --> 24:32.310 that would be something internally for us, 24:32.310 --> 24:35.320 I think externally, we need a larger supply, 24:35.320 --> 24:36.680 we need a larger supply 24:36.680 --> 24:38.800 of science, technology, engineering, mathematics 24:38.800 --> 24:41.280 folks to come up and we're working at that 24:41.280 --> 24:43.410 in a number of different programs at NSA 24:43.410 --> 24:45.423 but this is an issue for the nation. 24:46.340 --> 24:48.510 Our pool has got to be much larger 24:48.510 --> 24:51.090 because I think everyone out here feels the same way 24:51.090 --> 24:53.090 that if there's one thing 24:53.090 --> 24:54.550 that we could use assistance on 24:54.550 --> 24:56.780 that's making sure that more of our young people 24:56.780 --> 24:58.952 see that as an opportunity 24:58.952 --> 25:00.510 and see that as a career path forward. 25:00.510 --> 25:01.343 - Yeah I you know, 25:01.343 --> 25:02.180 I would just add to that, 25:02.180 --> 25:05.990 so I agree with all the things the General said, 25:05.990 --> 25:08.110 and I've made comments in the past on this 25:08.110 --> 25:12.810 but I truly believe that part of what we have to do 25:12.810 --> 25:15.400 is not only get a larger pool of folks 25:15.400 --> 25:17.620 but how do we make sure that 25:17.620 --> 25:19.670 as that pool's being created 25:19.670 --> 25:21.960 that they're thinking about government 25:21.960 --> 25:24.800 when they're thinking about career opportunities? 25:24.800 --> 25:27.470 I continue to beat on this drum 25:27.470 --> 25:31.620 because when I continually meet young people 25:31.620 --> 25:35.950 who have never served a day in any government agency 25:35.950 --> 25:38.590 or those who have only served, 25:38.590 --> 25:40.590 one of the common themes you always hear 25:41.440 --> 25:43.430 is for those who are serving is 25:43.430 --> 25:44.951 I came across the government 25:44.951 --> 25:47.800 I was captivated by the mission, 25:47.800 --> 25:49.030 and for those who haven't 25:49.030 --> 25:51.730 they'll say I just never came across anybody in government, 25:51.730 --> 25:53.750 I've never been presented or shown 25:53.750 --> 25:56.540 what that could look like in terms of career 25:56.540 --> 25:58.310 we're gonna have to solve for that, 25:58.310 --> 25:59.970 we're gonna have to spend more time 25:59.970 --> 26:04.500 on how do we intersect young people's career decisions 26:04.500 --> 26:06.650 to even make them think about the government 26:06.650 --> 26:09.370 as optional opportunity. 26:09.370 --> 26:10.882 - One of the things 26:10.882 --> 26:12.860 that I know is on the mind of Suzette Kent, 26:12.860 --> 26:14.480 the Chief Information Officer 26:14.480 --> 26:19.120 is attracting those kinds of people, 26:19.120 --> 26:20.820 and not just young people, 26:20.820 --> 26:22.350 but mid-career people 26:22.350 --> 26:25.940 who have never considered government experience 26:25.940 --> 26:29.210 as someone who did that, how, 26:29.210 --> 26:34.210 what sells Dana DZ ten years ago maybe, 26:34.460 --> 26:38.180 not at a retirement phase of his or her career 26:38.180 --> 26:40.890 but when that person still has 26:40.890 --> 26:43.380 five, 10, 15, years of service 26:43.380 --> 26:46.460 in in some job in mind, 26:46.460 --> 26:50.040 what makes government service attractive to that person, 26:50.040 --> 26:52.210 when it's obviously not going to be 26:52.210 --> 26:54.153 the financial piece of it? 26:55.306 --> 26:56.850 - Yeah honestly one of the things I'll say is 26:56.850 --> 26:59.801 and it's not because he happens to be up here 26:59.801 --> 27:01.531 on the stage with me, (Francis laughs) 27:01.531 --> 27:04.224 but I was fortunate enough earlier in my career 27:04.224 --> 27:08.280 that I met some incredibly impressive generals 27:08.280 --> 27:09.910 and I just remember thinking, 27:09.910 --> 27:12.576 these are some of the smartest people in the world 27:12.576 --> 27:14.300 they're so committed to the mission, 27:14.300 --> 27:18.280 and if I could duplicate a General Nakasone 27:18.280 --> 27:21.700 and send him out to start talking to midsize 27:21.700 --> 27:24.570 to larger size corporations, 27:24.570 --> 27:27.030 about the challenges and the opportunities, 27:27.030 --> 27:29.630 remember how I got exposed to all this was, 27:29.630 --> 27:32.700 I was asked to host in my previous life, 27:32.700 --> 27:34.510 folks from the DoD for a day 27:34.510 --> 27:37.392 and just expose them to what we were doing 27:37.392 --> 27:38.225 in the private sector, 27:38.225 --> 27:39.700 if I had never had had that meeting 27:39.700 --> 27:42.820 or that opportunity or got to meet some really smart 27:42.820 --> 27:44.770 generals like General Nakasone 27:44.770 --> 27:48.160 I wouldn't have left there with this discussion I started 27:48.160 --> 27:49.887 holding with myself and said, 27:49.887 --> 27:53.267 "Wow I never knew the talent that existed out there 27:53.267 --> 27:56.430 "the common problems and challenges they're facing." 27:56.430 --> 27:59.247 So if you could mint me about 50 General Nakasones, 27:59.247 --> 28:00.700 and we can start sending them out 28:00.700 --> 28:02.660 to talk to corporations that'd be awesome. 28:02.660 --> 28:05.960 - But I'm sure General Nakasone can identify 28:05.960 --> 28:07.790 if we put him to the test, 28:07.790 --> 28:10.510 40 or 50 not generals necessarily 28:10.510 --> 28:13.010 but people who would be terrific ambassadors 28:13.010 --> 28:14.210 in that kind of an environment. 28:14.210 --> 28:17.200 - Francis I think your question really goes to 28:17.200 --> 28:19.874 a piece that we've talked about before which is, 28:19.874 --> 28:23.290 so we need to continue invest in training with the industry 28:23.290 --> 28:25.890 in other areas were that provides the exposure 28:25.890 --> 28:29.330 to a broader base of what's going on in America 28:29.330 --> 28:30.370 to our young people, 28:30.370 --> 28:32.750 so having them go out and work for six months 28:32.750 --> 28:35.010 in the private sector, being able to see that 28:35.010 --> 28:37.802 being able to understand what this changed, 28:37.802 --> 28:38.720 a couple advantages, one, 28:38.720 --> 28:41.470 I think we're able to show off what we have 28:41.470 --> 28:43.630 but I think two particularly in the field 28:43.630 --> 28:45.170 that we work today, 28:45.170 --> 28:47.370 not all the ideas come within our department 28:47.370 --> 28:50.025 and there is a tremendous amount of investment 28:50.025 --> 28:51.566 and a tremendous amount of work 28:51.566 --> 28:52.399 being done in private industry 28:52.399 --> 28:54.371 that you know quite frankly, 28:54.371 --> 28:55.810 we want to make sure that our young folks see. 28:55.810 --> 28:57.900 - I have one more question for both of you, 28:57.900 --> 28:59.960 before we start to take questions from the audience 28:59.960 --> 29:01.980 and that simply is, 29:01.980 --> 29:06.670 on the landscape six, 12, 18, 24, months out, 29:06.670 --> 29:09.640 what are the things that you're thinking about 29:09.640 --> 29:11.380 as your biggest potential challenges? 29:11.380 --> 29:12.964 General. 29:12.964 --> 29:13.797 - I'd begin with data 29:13.797 --> 29:17.440 and I think that we are on the verge of a data explosion, 29:17.440 --> 29:19.860 the data is so critical for us now to 29:19.860 --> 29:22.740 not only discern insights on the intelligence side, 29:22.740 --> 29:26.010 but understand on the cyber command side 29:26.010 --> 29:27.956 our options and opportunities 29:27.956 --> 29:30.430 this data being able to move through it, 29:30.430 --> 29:32.530 particularly as we move to the Internet of Things, 29:32.530 --> 29:36.680 5g you know a broader capacity and capability 29:36.680 --> 29:40.320 for us to store that data, is tremendously important for it 29:40.320 --> 29:43.330 so that I would say that's idea one on my mind. 29:43.330 --> 29:46.870 - Yeah it's, it's this idea that I call 29:46.870 --> 29:48.736 we're gonna have to parallel 29:48.736 --> 29:50.170 a lot of big activities at the same timing, 29:50.170 --> 29:52.550 we're bringing online you know 29:52.550 --> 29:54.500 massive scale cloud computing 29:54.500 --> 29:57.860 it's going to change the entire way we build applications, 29:57.860 --> 30:01.120 we're bringing on AI to a massive scale, 30:01.120 --> 30:04.470 the center of all of this is gonna be data 30:04.470 --> 30:08.380 in this kind of multi domain, fighting environment, 30:08.380 --> 30:10.080 that we're gonna have to solve for 30:11.391 --> 30:12.893 it keeps coming up time and time again 30:12.893 --> 30:14.170 in each and every conversation. 30:14.170 --> 30:16.210 I think some of the things we're putting in place now 30:16.210 --> 30:19.270 are gonna help us to get after that conversation, 30:19.270 --> 30:21.790 but we still got some pretty heavy lifting to do, 30:21.790 --> 30:23.750 when it comes to integration data, 30:23.750 --> 30:26.120 what are the components that will make that, 30:26.120 --> 30:28.191 that will facilitate that for you, 30:28.191 --> 30:29.860 I think, I think two things will happen 30:29.860 --> 30:33.170 one is as we start to build out 30:33.170 --> 30:35.260 our enterprise cloud capability 30:36.130 --> 30:38.880 we're going to start to see more accessible data 30:38.880 --> 30:42.004 clearly already seeing that as I'm now talking 30:42.004 --> 30:44.330 to the services about what they want to do, 30:44.330 --> 30:45.490 what are they're next problems of work 30:45.490 --> 30:46.720 and how they want to use much 30:46.720 --> 30:49.120 more integrated interoperable data. 30:49.120 --> 30:51.660 I think two things like AI 30:51.660 --> 30:54.300 are gonna just scream out when I look at, 30:54.300 --> 30:55.900 what will slow us down, 30:55.900 --> 30:58.150 it will be the accessibility to the data 30:58.150 --> 30:59.360 the formats of the data, 30:59.360 --> 31:01.140 how we ingest the data, 31:01.140 --> 31:03.780 how we get intelligence out of that data 31:03.780 --> 31:06.110 and I think sometimes that's what you need, 31:06.110 --> 31:07.670 you need an event to occur, 31:07.670 --> 31:09.700 where you could put a spotlight on the problem, 31:09.700 --> 31:12.210 in a way where it's accessible to people to work, 31:12.210 --> 31:15.050 I think AI is gonna be one of those big problem sets 31:15.050 --> 31:16.490 where it's gonna put a big spotlight 31:16.490 --> 31:18.280 on this data conversation, 31:18.280 --> 31:20.590 that's gonna get the department to think about, 31:20.590 --> 31:22.000 working in a different way. 31:22.000 --> 31:24.646 - General, the rapidity with which you answered data, 31:24.646 --> 31:27.680 indicates the reason why you thought analytic tools 31:27.680 --> 31:30.300 were so important earlier on I imagine it is, 31:30.300 --> 31:32.982 and I think I would add to that high-performance computing 31:32.982 --> 31:37.372 for us whether on the crypto-analytic side for NSA 31:37.372 --> 31:39.140 or if it's on the vulnerability exposure side 31:39.140 --> 31:40.580 for US Cyber Command, 31:40.580 --> 31:41.660 the high performance computing 31:41.660 --> 31:43.700 that we're investing in today's 31:43.700 --> 31:46.120 is you know as essential as Cray Computers 31:46.120 --> 31:48.310 were in the 1970s and 80s 31:48.310 --> 31:50.520 to what was being done for our department, 31:50.520 --> 31:52.547 that's that's important stuff for us 31:52.547 --> 31:53.620 and those are investments 31:53.620 --> 31:55.519 that we're making now for the future, 31:55.519 --> 31:59.620 questions from the audience they'll be giving them to us 31:59.620 --> 32:00.913 from the back I believe. 32:03.580 --> 32:06.410 - [Man] You briefly mentioned new ways of reaching out 32:07.260 --> 32:10.290 are there any is there any way industry 32:10.290 --> 32:12.680 or academia can help more, 32:12.680 --> 32:15.140 are you satisfied with the channels you have 32:15.140 --> 32:16.975 to seek new solutions? 32:16.975 --> 32:20.680 - So one of the ways that at on the CYBERCOM side 32:20.680 --> 32:23.410 we are looking to expand is our intern program, 32:23.410 --> 32:25.442 we have to build a broader bigger 32:25.442 --> 32:28.570 more expansive intern program, 32:28.570 --> 32:30.220 let me give you just an example 32:30.220 --> 32:32.530 on the NSA side every year 10,000 people apply 32:32.530 --> 32:34.090 for a series of internships, 32:34.090 --> 32:35.930 we take those numbers down to about 2,000 32:35.930 --> 32:38.140 of the 2,000 we get down to 300 32:38.140 --> 32:39.730 that actually become interns for us 32:39.730 --> 32:41.360 for a period of the summer, 32:41.360 --> 32:43.280 we will hire the vast majority of those folks 32:43.280 --> 32:44.740 into our workforce, 32:44.740 --> 32:45.940 the great thing about it is that 32:45.940 --> 32:47.420 they've seen what we what we do, 32:47.420 --> 32:48.960 they see the opportunities 32:48.960 --> 32:52.050 but we also have an opportunity to see how, 32:52.050 --> 32:53.600 how they work within our environment 32:53.600 --> 32:55.880 that's the same thing we need on the cyber command side. 32:55.880 --> 32:57.641 We are in the midst of looking for you know, 32:57.641 --> 33:00.320 employees and I think there's no better way 33:00.320 --> 33:01.153 than intern programs, 33:01.153 --> 33:03.210 to bring in that fresh talent. 33:03.210 --> 33:06.100 Is the 10k to 2k to 300, 33:06.100 --> 33:08.210 is that just a capacity issue 33:08.210 --> 33:12.380 or if you had room for 600, 33:12.380 --> 33:14.440 or a thousand, are there 600 33:14.440 --> 33:16.370 or a thousand good people 33:16.370 --> 33:17.980 who could take those jobs 33:17.980 --> 33:19.070 if you had the room for that. 33:19.070 --> 33:21.500 - Certainly I mean there's always a cap 33:21.500 --> 33:24.900 based upon the ability to work through 33:24.900 --> 33:26.610 in a period of time to clear those folks, 33:26.610 --> 33:28.310 all those type of things that come into it 33:28.310 --> 33:30.354 but that's roughly what we're at. 33:30.354 --> 33:31.970 - Dana, any thoughts? 33:31.970 --> 33:34.530 - Yeah I would say, you know, it's interesting 33:34.530 --> 33:37.600 in the last year as we've worked with 33:37.600 --> 33:39.140 private industry and it's not necessarily 33:39.140 --> 33:41.410 technology companies, they could just be 33:41.410 --> 33:45.115 various industries, this conversation keeps coming up about 33:45.115 --> 33:48.010 is there a better seconded model 33:48.010 --> 33:50.708 of how we can bring people in for periods of time 33:50.708 --> 33:54.030 to work on problems where they have an expertise 33:54.030 --> 33:56.760 or maybe they solve for it in private industry 33:56.760 --> 33:58.260 and in doing that we obviously 33:58.260 --> 34:00.824 give back a great deal of knowledge 34:00.824 --> 34:02.273 that these folks could take back 34:02.273 --> 34:03.240 to their respective companies 34:03.240 --> 34:05.570 or the respective technology companies 34:05.570 --> 34:08.093 so you know for all of you out here 34:08.093 --> 34:08.940 who have been asking that question 34:08.940 --> 34:10.260 the gentleman asked, 34:10.260 --> 34:11.620 I always say, you know, 34:11.620 --> 34:13.580 where is it that there is opportunities 34:13.580 --> 34:16.910 to share the talent in a way that 34:16.910 --> 34:18.909 and we have to figure out how to make that 34:18.909 --> 34:21.170 accessible to us under what conditions 34:21.170 --> 34:22.930 that we return that talent 34:22.930 --> 34:26.480 and what's the give back that we can give back to 34:26.480 --> 34:29.570 folks that be willing to entertain that idea with us. 34:29.570 --> 34:31.723 - And you have a strong partner there 34:31.723 --> 34:33.500 because the need of Blair knows exactly how to 34:33.500 --> 34:35.610 pull all the levers to move people in and out 34:35.610 --> 34:37.770 as appropriate what you can and can't do 34:37.770 --> 34:38.910 to be able to do that right? 34:38.910 --> 34:40.600 - It's just trying to figure out 34:40.600 --> 34:43.167 how can you make that model work at scale. 34:43.167 --> 34:46.600 - Scale I think is the operative word there 34:46.600 --> 34:47.560 in what you're talking about too, 34:47.560 --> 34:49.580 it's the same thing that the general just talked about 34:49.580 --> 34:51.477 because 300's a great number 34:51.477 --> 34:56.477 but 300 doesn't, isn't the ceiling it's, 34:56.700 --> 34:58.970 it's a floor I imagine and in his case 34:58.970 --> 35:00.600 and I would think the same thing for you. 35:00.600 --> 35:01.530 - Yeah. 35:01.530 --> 35:02.723 - Okay, next question. 35:04.580 --> 35:06.500 - [Man] How can you better leverage 35:06.500 --> 35:09.183 Guard and Reserve excesses? 35:10.336 --> 35:11.530 - I think, first of all, 35:11.530 --> 35:13.890 my lesson learned from working with 35:13.890 --> 35:15.205 the Guard and Reserve 35:15.205 --> 35:18.228 is better understand the state Partnership Program, 35:18.228 --> 35:21.710 it is among the most important things 35:21.710 --> 35:23.310 that I think our Guard and Reserve do 35:23.310 --> 35:25.430 to assist in our warfighting capability, 35:25.430 --> 35:27.046 the State Partnership Program 35:27.046 --> 35:29.030 is a program by our Guard 35:29.030 --> 35:31.870 to work between select states 35:31.870 --> 35:35.590 and select countries to empower those countries 35:35.590 --> 35:37.877 based upon the experiences of the Guard 35:37.877 --> 35:41.220 so when I look at that I think, hmm, 35:41.220 --> 35:43.340 Minnesota, Minnesota's working with Kosovo, 35:43.340 --> 35:44.910 there's a number of people there that have 35:44.910 --> 35:47.218 cybersecurity experience there, 35:47.218 --> 35:49.480 why don't we work with the Minnesota Guard 35:49.480 --> 35:51.300 and train those people on cybersecurity 35:51.300 --> 35:54.270 and as the European commander looks at it, 35:54.270 --> 35:55.520 he has an ability now 35:55.520 --> 35:58.442 for a greater force that is able to 35:58.442 --> 36:01.304 train with the folks in Kosovo 36:01.304 --> 36:03.180 to build greater resiliency 36:03.180 --> 36:04.520 and that's just one example, 36:04.520 --> 36:06.930 I mean there are other State Partnership Programs 36:06.930 --> 36:08.871 that are out there, it's a piece that 36:08.871 --> 36:11.330 we came a little bit late to the game 36:11.330 --> 36:12.730 and understanding and I, you know, 36:12.730 --> 36:14.580 that's on me as the commander 36:14.580 --> 36:17.530 but I see that now and I see that 36:17.530 --> 36:19.477 this is really, really important for us 36:19.477 --> 36:22.242 and our theater security engagement plans, 36:22.242 --> 36:24.700 it makes a lot of sense and the countries want it as well. 36:24.700 --> 36:27.480 - Over the years there have been a number of conversations 36:27.480 --> 36:29.797 about establishing a possible separate 36:29.797 --> 36:33.260 Cyber Reserve or something along that lines, 36:33.260 --> 36:34.840 that's something that you see 36:34.840 --> 36:38.120 as viable at some point in the future 36:38.120 --> 36:40.820 or not necessary given the kinds of 36:40.820 --> 36:42.550 opportunities that you just described 36:42.550 --> 36:44.180 that you can kind of build and see those 36:44.180 --> 36:45.640 wherever they are appropriate. 36:45.640 --> 36:49.410 - We have 133 teams within US Cyber Command 36:49.410 --> 36:52.903 that include active Guard and Reserve elements, 36:52.903 --> 36:55.700 we also have 20 new defensive teams 36:55.700 --> 36:57.460 at the Army's building, 36:57.460 --> 36:58.740 that's a tremendous amount of capacity 36:58.740 --> 37:00.500 that we're building, 37:00.500 --> 37:02.680 as for the future I think there's going to be more capacity 37:02.680 --> 37:04.810 and certainly within the guard I think 37:04.810 --> 37:06.490 there's room for it but right now 37:06.490 --> 37:08.640 I think our focus has been 37:08.640 --> 37:11.380 let's make sure that those 133 plus 20 37:11.380 --> 37:14.000 are operating at their peak capacity. 37:14.000 --> 37:15.390 - Well how will you assess 37:15.390 --> 37:17.290 whether they're operating at peak capacity? 37:17.290 --> 37:18.860 - Well we have a number of different assessments 37:18.860 --> 37:20.850 that we do whether or not that's 37:20.850 --> 37:23.790 through our ability to evaluate an individual 37:23.790 --> 37:25.630 and then the collective training 37:25.630 --> 37:27.740 or it's through their ability to contribute 37:27.740 --> 37:29.060 to ongoing missions, 37:29.060 --> 37:31.040 that's something that is done continuously. 37:31.040 --> 37:32.380 - And when they hit the level 37:32.380 --> 37:33.880 at which you think they're appropriate 37:33.880 --> 37:35.010 is that when you'll consider 37:35.010 --> 37:36.630 whether it's time to scale? 37:36.630 --> 37:38.710 - No, I think we'll consider it 37:38.710 --> 37:39.543 when it's time to scale 37:39.543 --> 37:41.184 when the demand signal's clearly there 37:41.184 --> 37:42.970 that we have the data that shows 37:42.970 --> 37:43.803 that it makes sense 37:43.803 --> 37:45.130 and then the department obviously 37:45.130 --> 37:46.870 makes a decision that this is an area 37:46.870 --> 37:47.900 that we need to invest in 37:47.900 --> 37:49.100 based upon our strategy. 37:50.080 --> 37:51.020 - What have you seen as you look at...? 37:51.020 --> 37:54.150 - Yeah, you know, in general Nakasone's case, 37:54.150 --> 37:57.410 he is talking about large hiring, you know, 37:57.410 --> 38:00.890 mine is more particular, unique, niche skills 38:00.890 --> 38:03.890 and so it's trying to figure out 38:03.890 --> 38:05.450 how do you look at the full array 38:05.450 --> 38:08.450 of what's out there in the world of the reservists 38:08.450 --> 38:11.900 and then how do you match those particular skills 38:11.900 --> 38:13.520 to a very set of unique skills 38:13.520 --> 38:15.120 that we're trying to solve for 38:15.120 --> 38:17.300 so where he's trying to solve for 38:17.300 --> 38:18.673 maybe kind of a large scale, 38:18.673 --> 38:20.440 I'm trying to solve for some very unique skills. 38:20.440 --> 38:22.700 - But I think, you know, if I had to add to that piece, 38:22.700 --> 38:24.140 there are some things that we have now done I think 38:24.140 --> 38:25.730 that are really important, 38:25.730 --> 38:27.728 we, first of all, we need to be able to track 38:27.728 --> 38:31.320 the capabilities within our Guard and our Reserve 38:31.320 --> 38:34.290 so we track foreign languages, okay, 38:34.290 --> 38:35.990 so how many different computer languages 38:35.990 --> 38:37.270 are we tracking in, 38:37.270 --> 38:38.670 oh by the way, do we understand 38:38.670 --> 38:40.490 who out there are capabilities develop 38:40.490 --> 38:42.250 or have malware and forensics experience 38:42.250 --> 38:44.240 or those are things that we move to it 38:44.240 --> 38:45.640 and being able to identify 38:45.640 --> 38:47.184 and be able to track that I think 38:47.184 --> 38:49.700 that's been a tremendous step forward for us 38:49.700 --> 38:51.310 so to the to the question, 38:51.310 --> 38:52.940 that's another example of ways 38:52.940 --> 38:53.980 that we can improve. 38:53.980 --> 38:55.500 - What have you learned about 38:55.500 --> 38:58.890 your force, civility and in uniform, 38:58.890 --> 39:01.558 now that you have access to that kind of data? 39:01.558 --> 39:04.630 - What I've learned is that they are 39:04.630 --> 39:06.060 engaged every single day, 39:06.060 --> 39:07.700 it's not as though we have, 39:07.700 --> 39:09.790 hey we'll put this force into sanctuary 39:09.790 --> 39:11.770 and their weight every single day, 39:11.770 --> 39:13.360 we are operating on networks, 39:13.360 --> 39:15.390 we're operating with data we are operating 39:15.390 --> 39:18.150 and looking at the resiliency of our weapons systems, 39:18.150 --> 39:20.041 there is no shortage of work, 39:20.041 --> 39:22.170 the second thing I would tell you is that 39:23.083 --> 39:27.400 we are a rapidly capable and growing capacity force 39:27.400 --> 39:29.812 that I think has proved itself 39:29.812 --> 39:31.231 in a number of different operations 39:31.231 --> 39:32.711 to include the security, 39:32.711 --> 39:34.625 the midterm elections and the last piece, 39:34.625 --> 39:36.814 this is like a startup, I mean, 39:36.814 --> 39:39.280 I kind of joke sometimes with Dana about this, 39:39.280 --> 39:42.100 this is in some ways running a start-up organization, 39:42.100 --> 39:44.890 we're nine years young as a command this week 39:44.890 --> 39:48.111 and with that I have seen the evolution of, 39:48.111 --> 39:51.067 you know, good, better, best, and in many ways 39:51.067 --> 39:53.680 and I think that that comes a lot of times 39:53.680 --> 39:55.670 where we say, hey we started out this way 39:55.670 --> 39:58.110 but really we need to think about it differently. 39:58.110 --> 40:00.146 - You know, one of the things 40:00.146 --> 40:00.979 we don't talk about too much 40:00.979 --> 40:03.279 but I think is actually important to share here is 40:03.279 --> 40:06.360 some of the talent that we need 40:06.360 --> 40:07.880 is unique and sometimes 40:07.880 --> 40:10.450 we just need it for a specific period of time 40:10.450 --> 40:13.920 so actually one of my best recruiting arms is right here, 40:13.920 --> 40:16.150 you know, I'll reach out to NSA 40:16.150 --> 40:17.600 on particular programs that work, 40:17.600 --> 40:20.060 particularly problems that we're solving for 40:20.060 --> 40:22.420 and we will actually bring people over 40:22.420 --> 40:25.010 into the DoD CIO organization 40:25.010 --> 40:26.650 to help us solve this particular problem 40:26.650 --> 40:28.830 so I have a number of people right now 40:28.830 --> 40:32.290 that are working in my organization 40:32.290 --> 40:33.960 that are actually from NSA 40:33.960 --> 40:35.690 but we're just detailing them over 40:35.690 --> 40:39.010 that's fantastic because it gives those folks 40:39.010 --> 40:41.350 an opportunity to understand what I'll call 40:41.350 --> 40:42.910 how do you horizontally solve 40:42.910 --> 40:45.200 for problems across different services 40:45.200 --> 40:47.910 in a common way and that in itself 40:47.910 --> 40:49.220 creates some big challenges 40:49.220 --> 40:50.830 and you have to think differently 40:50.830 --> 40:53.546 and then obviously they bring a mindset 40:53.546 --> 40:54.820 into my organization around some very 40:54.820 --> 40:57.630 unique, exquisite knowledge they have of skills 40:57.630 --> 41:00.490 that then we can share across the broader population. 41:00.490 --> 41:01.650 - One of the things we emphasize 41:01.650 --> 41:03.840 and I think Francis you understand this very keenly 41:03.840 --> 41:07.160 is the fact that the way things get decided 41:07.160 --> 41:09.200 and you know the Pentagon is through policy, 41:09.200 --> 41:13.300 it's the policy that really drives what we do 41:13.300 --> 41:15.950 and so if we're working within, you know, 41:15.950 --> 41:18.190 CIO what better place then to work 41:18.190 --> 41:19.360 within the policy arm of that 41:19.360 --> 41:21.750 so that's been very helpful for us. 41:21.750 --> 41:22.619 - Next question. 41:22.619 --> 41:25.990 - [Man] Admiral Norton mentioned to the 41:25.990 --> 41:28.390 increasing emphasis on interoperability 41:28.390 --> 41:31.050 across COCOMs as conflict becomes 41:31.050 --> 41:33.930 less regionally confined and more global 41:33.930 --> 41:35.980 especially in cyberspace. 41:35.980 --> 41:38.150 What challenges have the two of you faced 41:38.150 --> 41:40.640 in this area and what are you doing 41:40.640 --> 41:42.210 to overcome them? 41:42.210 --> 41:43.590 - It's a very nice way of saying 41:43.590 --> 41:45.300 how are you breaking down the silos 41:45.300 --> 41:46.390 among the branches. 41:46.390 --> 41:47.790 - So we have absolutely no problems 41:47.790 --> 41:49.030 working at the 4-star level, 41:49.030 --> 41:50.390 I would tell you that, you know, 41:50.390 --> 41:52.113 when I talk to my counterparts, 41:52.113 --> 41:53.944 they clearly get it 41:53.944 --> 41:55.740 but you know between myself 41:55.740 --> 41:57.170 and in the action officer level, 41:57.170 --> 41:59.340 there's about, you know, three different layers 41:59.340 --> 42:01.980 that have been trained at Leavenworth 42:01.980 --> 42:03.670 and have understood their training 42:03.670 --> 42:05.040 from the Army War College 42:05.040 --> 42:06.970 and National Defense University 42:06.970 --> 42:08.650 and it's a little bit different sometimes 42:08.650 --> 42:11.340 and so I think to Admiral Norton's point, 42:11.340 --> 42:13.806 one of the ways that we have to continue 42:13.806 --> 42:16.590 to emphasize this is, you know, 42:16.590 --> 42:19.580 change is honest and we have to ensure 42:19.580 --> 42:22.060 that we understand how do we apply, you know, 42:22.060 --> 42:23.940 non-kinetic power in a way 42:23.940 --> 42:27.170 that we haven't done before, we're very very familiar with 42:27.170 --> 42:28.500 understanding the planning process 42:28.500 --> 42:31.811 that goes to kinetic operations, non-kinetic operations, 42:31.811 --> 42:34.870 I would tell you sometimes as important 42:34.870 --> 42:36.074 and needs to be done 42:36.074 --> 42:38.564 and we are working our way through that right now. 42:38.564 --> 42:41.480 - Yeah I would say that 42:42.683 --> 42:44.330 one of the conversations I continue to have with 42:44.330 --> 42:46.077 the secretaries of the services 42:46.077 --> 42:50.330 and the unders is show me the curriculum 42:50.330 --> 42:53.270 that a young cadet takes 42:53.270 --> 42:54.730 that starts to teach them about 42:54.730 --> 42:56.220 how to think about data 42:56.220 --> 42:57.400 and the importance of data 42:57.400 --> 43:00.353 and data as an offensive, defensive, 43:00.353 --> 43:04.690 there's a lot more that we could be doing there 43:04.690 --> 43:06.660 that I don't think we're doing enough of frankly 43:06.660 --> 43:10.220 and I think this is a really big opportunity is 43:10.220 --> 43:14.210 we need to start introducing some new skill sets 43:14.210 --> 43:16.600 into people when they're very young coming in 43:16.600 --> 43:18.020 and at the opposite end 43:18.020 --> 43:20.940 is we need to make accessible these conversations 43:20.940 --> 43:23.890 that may be uncomfortable or not natural 43:23.890 --> 43:27.220 with some of the flag officers around this topic 43:27.220 --> 43:28.750 and I think so we have to attack 43:28.750 --> 43:31.385 kind of both ends of the spectrum 43:31.385 --> 43:32.670 of creating that education and awareness. 43:32.670 --> 43:34.020 - That's an excellent point 43:34.020 --> 43:36.300 and if you take a look at and the military members 43:36.300 --> 43:37.500 of the audience here will understand 43:37.500 --> 43:39.870 when we look at our military planning process, 43:39.870 --> 43:42.330 we identify named areas of interest 43:42.330 --> 43:44.430 in targeted areas of interest, 43:44.430 --> 43:45.990 data could well be one of those 43:45.990 --> 43:46.920 named areas of interest 43:46.920 --> 43:48.080 that we have to focus on, 43:48.080 --> 43:48.990 that we have to watch, 43:48.990 --> 43:51.025 that we have to have an understanding 43:51.025 --> 43:52.660 of how it's changing, 43:52.660 --> 43:54.010 we didn't think about that, you know, 43:54.010 --> 43:55.920 when I was going through the military schools 43:55.920 --> 43:58.290 and now we need to and I think that's an important piece. 43:58.290 --> 43:59.710 - Is there? I'm sorry go ahead. 43:59.710 --> 44:01.251 - Yeah when, I being in them, 44:01.251 --> 44:02.300 just in the last three or four months, 44:02.300 --> 44:04.880 I've had just about every service come to me 44:04.880 --> 44:06.750 with incredibly high energy on a 44:06.750 --> 44:09.470 multi-domain mission, problem-solving, 44:09.470 --> 44:11.520 forward data is screaming out in the center of this 44:11.520 --> 44:12.410 and what I always ask them 44:12.410 --> 44:15.490 what's holding them back, it's never technology, 44:15.490 --> 44:17.680 it is finding enough people 44:17.680 --> 44:20.340 who can actively engage in this conversation 44:20.340 --> 44:24.062 in a way where they can kind of move things forward 44:24.062 --> 44:25.710 and that's the challenge I think we face. 44:25.710 --> 44:27.230 - Is the Jake the model for that 44:27.230 --> 44:31.360 is that applicable in other areas of specialty? 44:31.360 --> 44:32.950 - I've always said, you know, 44:32.950 --> 44:34.540 Jake will help a couple things 44:34.540 --> 44:35.420 for the Department of Defense, 44:35.420 --> 44:37.000 I think it will be the place 44:37.000 --> 44:38.460 where we'll develop some 44:38.460 --> 44:40.260 really good AI solutions 44:40.260 --> 44:41.870 but I think it's going to be the place 44:41.870 --> 44:44.930 that really spotlights this problem of data 44:44.930 --> 44:47.370 and I think it's gonna make it accessible 44:47.370 --> 44:49.830 to people to have a conversation in a way 44:49.830 --> 44:51.670 that historically if all you ever said to 44:51.670 --> 44:53.270 the Department of Defense leaders was 44:53.270 --> 44:55.770 we need to focus on data management, 44:55.770 --> 44:57.620 people's eyes would just glaze over, 44:57.620 --> 44:59.320 roll in the back of their heads, 44:59.320 --> 45:00.680 you start to say the reason 45:00.680 --> 45:01.860 we haven't been able to solve 45:01.860 --> 45:03.720 for this particular AI problem 45:03.720 --> 45:06.150 is getting access to this type of data 45:06.150 --> 45:07.820 and the reason it's so hard to get access 45:07.820 --> 45:10.460 to this type of data is x, y, and z; 45:10.460 --> 45:12.300 people can work that problem, 45:12.300 --> 45:14.260 they can't work a problem called 45:14.260 --> 45:15.830 we need to solve for data management. 45:15.830 --> 45:18.520 - Yeah well the other aspect 45:18.520 --> 45:19.920 of what you're talking about, though, 45:19.920 --> 45:21.270 the reason that I think that Jake 45:21.270 --> 45:23.941 has such potential is because historically 45:23.941 --> 45:27.960 some technology or challenge would come along 45:27.960 --> 45:29.880 and the services would agree 45:29.880 --> 45:32.910 this is something that we need to understand 45:32.910 --> 45:35.250 and the army would stand up an office 45:35.250 --> 45:36.780 and the Navy would stand up an office 45:36.780 --> 45:38.240 and the Air Force would stand up in office 45:38.240 --> 45:40.838 and that didn't happen with artificial intelligence. 45:40.838 --> 45:44.137 What in that respect, 45:44.137 --> 45:48.390 how will you consider the Jake a success 45:48.390 --> 45:53.050 separate from AI that you have learned 45:53.050 --> 45:54.940 in trying to prevent that from happening 45:54.940 --> 45:56.615 in the future? 45:56.615 --> 45:58.540 - That we will have smarter people, 45:58.540 --> 46:01.517 smarter tools, smarter solution sets, 46:01.517 --> 46:04.320 smarter ingestion engines 46:04.320 --> 46:06.430 and that people will want to come 46:06.430 --> 46:08.240 because we will be able to solve for problems 46:08.240 --> 46:10.964 more rapidly and that we're gonna have, 46:10.964 --> 46:11.967 you know, 46:11.967 --> 46:13.350 I have to refer to it as the secret sauce 46:13.350 --> 46:16.770 of being able to work data issues better 46:16.770 --> 46:17.890 than people trying to go off 46:17.890 --> 46:19.150 and solve for the market, 46:19.150 --> 46:21.010 if we don't do that well, 46:21.010 --> 46:23.300 I think we'll always struggle to the extent 46:23.300 --> 46:24.697 that we can figure out 46:24.697 --> 46:25.640 how to be it 46:25.640 --> 46:27.300 because if you think about AI, 46:27.300 --> 46:28.840 it's all about finding the data, 46:28.840 --> 46:31.770 ingesting the data, cleaning up the data, 46:31.770 --> 46:34.300 training the data and through each of those, 46:34.300 --> 46:36.850 there will be smart technology solutions 46:36.850 --> 46:39.089 and processes we'll create 46:39.089 --> 46:40.200 and that we can create those at scale 46:40.200 --> 46:42.380 and then make them accessible, 46:42.380 --> 46:44.000 that's how I'll define success. 46:44.000 --> 46:44.860 - So general... 46:44.860 --> 46:47.258 - But I, you know, I think I would add to that, 46:47.258 --> 46:49.479 I mean I think he will also build on a model of 46:49.479 --> 46:51.880 we're gonna make sure we drive momentum 46:51.880 --> 46:54.030 and momentum is established by solving 46:54.030 --> 46:56.430 some problems early that show relevance 46:56.430 --> 46:58.630 and utility to the department for the 46:58.630 --> 47:00.300 investments that have been made 47:00.300 --> 47:01.700 among the most important things 47:01.700 --> 47:03.040 and I think early success, 47:03.040 --> 47:04.470 nothing is better than success. 47:04.470 --> 47:06.840 - Yeah, so that's kind of what I was gonna go to 47:06.840 --> 47:08.670 which is I think the most important thing 47:08.670 --> 47:10.230 that he said about all of those things 47:10.230 --> 47:11.610 is creating something that 47:11.610 --> 47:13.100 people want to come to 47:13.100 --> 47:15.240 and my question to you is going to be 47:15.240 --> 47:18.500 given that you've been watching this for 47:18.500 --> 47:19.631 your entire career 47:19.631 --> 47:22.900 what makes someone not about AI in particular 47:22.900 --> 47:26.640 but whatever the topic happens to be 47:26.640 --> 47:28.280 what makes someone in uniform 47:28.280 --> 47:31.610 want to come and participate in that collaboratively 47:31.610 --> 47:33.850 rather than, we're the army, 47:33.850 --> 47:35.930 we're the Navy, we're the Air Force 47:35.930 --> 47:38.010 and we want to solve our problems. 47:38.010 --> 47:40.253 - So I mean I think I come back to just the idea 47:40.253 --> 47:42.785 of taking any of the hard problems, 47:42.785 --> 47:45.818 let's solve one of them, let's show the relevance, 47:45.818 --> 47:49.180 you see the impact that can have on your service 47:49.180 --> 47:50.660 and their resources will flow, 47:50.660 --> 47:52.430 we saw from the perspective 47:52.430 --> 47:53.840 at the National Security Agency 47:53.840 --> 47:55.820 of when we brought our tools, our technology 47:55.820 --> 47:57.720 and our talent to Iraq and Afghanistan 47:57.720 --> 48:00.330 and we started taking big data in this sense, 48:00.330 --> 48:03.340 you know, tremendous amount of communications 48:03.340 --> 48:04.800 and from that we're able to pick out, 48:04.800 --> 48:06.830 you know, key information 48:06.830 --> 48:08.330 that led to the location of insurgents 48:08.330 --> 48:09.590 on the battlefield. 48:09.590 --> 48:11.370 It didn't matter everyone wanted to come then 48:11.370 --> 48:12.670 and everyone wanted to be a part of it 48:12.670 --> 48:15.799 and I think it's the same thing we'll see with Jake here. 48:15.799 --> 48:17.580 - Yeah I think about it Francis, 48:17.580 --> 48:19.553 I just think that last year 48:19.553 --> 48:23.580 we have this standing Wednesday meeting 48:23.580 --> 48:26.680 with the deputy secretary, 48:26.680 --> 48:29.660 all the principals in the building 48:29.660 --> 48:33.030 and all the mills CIOs etcetera 48:33.030 --> 48:35.050 and what we purposely do 48:35.050 --> 48:36.920 and the way we run those meetings is 48:36.920 --> 48:39.010 we'll state this what we're gonna come back 48:39.010 --> 48:40.110 and talk about next time, 48:40.110 --> 48:42.440 we'll have hard core measurements 48:42.440 --> 48:43.560 that show success 48:43.560 --> 48:44.760 and people are starting to 48:44.760 --> 48:47.010 really get momentum around this idea 48:47.010 --> 48:49.300 that there's an expectation we have 48:49.300 --> 48:50.840 when we're gonna drive something that 48:50.840 --> 48:52.770 we A, hold people to account 48:52.770 --> 48:55.250 and we have a hard, empirical evidence 48:55.250 --> 48:56.540 and that's what people want to see, 48:56.540 --> 48:59.044 they want to see that hard evidence 48:59.044 --> 49:01.389 and as we start to be able to give them that, 49:01.389 --> 49:05.000 we see people more and more starting to come our way. 49:05.000 --> 49:07.550 - We also use that evidence for the building of our 49:07.550 --> 49:09.470 21 budget as well as ice. 49:09.470 --> 49:10.440 - Yes we do. 49:10.440 --> 49:13.103 - Good, next question, please. 49:14.610 --> 49:17.523 - [Man] Do you see the cyber accepted workforce 49:17.523 --> 49:19.850 as a way for cyber professionals 49:19.850 --> 49:23.030 to transition to and from government 49:23.030 --> 49:25.060 and commercial entities? 49:25.060 --> 49:26.980 - I would tell you that we have data 49:26.980 --> 49:29.110 on the cyber accepted workforce, 49:29.110 --> 49:31.254 cyber accepted service at US Cyber Command, 49:31.254 --> 49:34.545 it has cut our time from 49:34.545 --> 49:37.450 well over a hundred days down to forty days 49:37.450 --> 49:39.430 in terms of being able to process 49:39.430 --> 49:42.250 someone from applying to getting them through 49:42.250 --> 49:46.000 and being able to get to the job officer 49:46.000 --> 49:48.350 and a job office, job offer 49:48.350 --> 49:50.430 and then complete their security clearance 49:50.430 --> 49:53.340 so the days that it has shaved is impressive, 49:53.340 --> 49:54.530 the second thing is is that 49:54.530 --> 49:57.430 being able to do that on the spot job officers 49:57.430 --> 49:59.232 at a series affairs, 49:59.232 --> 50:02.010 you know, it seems like a no-brainer to everyone 50:02.010 --> 50:03.690 but now that we have that, 50:03.690 --> 50:04.970 we're utilizing it all the time 50:04.970 --> 50:07.380 and being able to put those requirements 50:07.380 --> 50:09.840 rapidly out to people that were interested and helpful. 50:09.840 --> 50:11.580 - So the flexibility of having someone 50:11.580 --> 50:13.010 be able to come in leave 50:13.010 --> 50:17.230 and come back is something that all areas 50:17.230 --> 50:20.218 of the government have been chasing for a long time. 50:20.218 --> 50:24.740 Are you seeing people who are there and leave come back, 50:24.740 --> 50:25.990 what's your data showing you 50:25.990 --> 50:28.610 about their interest in learning and industry for a while 50:28.610 --> 50:31.380 and eventually coming back and joining you again? 50:31.380 --> 50:33.320 - Too early for that, I mean the program is less than 50:33.320 --> 50:36.310 eighteen months old, I would still say, you know, 50:36.310 --> 50:38.750 honestly I think the coming back portion 50:38.750 --> 50:40.300 is not where we need to be yet, 50:41.640 --> 50:42.820 I think the other piece of it 50:42.820 --> 50:45.300 is that we just need a few more years 50:45.300 --> 50:47.580 to see this, it has not been instituted across 50:47.580 --> 50:48.860 all of the services yet 50:48.860 --> 50:50.951 and once that's done over the next year, 50:50.951 --> 50:53.940 I think we'll have a better feel for where we're going. 50:53.940 --> 50:55.405 - Yeah I would say that 50:55.405 --> 50:58.253 I haven't met somebody yet 50:58.253 --> 51:00.650 who didn't come in through cyber accepted service 51:00.650 --> 51:03.010 who had nothing but a great story to tell 51:03.010 --> 51:04.730 was I was shocked with the speed, 51:04.730 --> 51:08.030 the creativity, the initiative the departments showed 51:08.030 --> 51:09.430 and how they hired me 51:09.430 --> 51:12.550 but when I go and have a really hard conversation 51:12.550 --> 51:14.420 with my own organization 51:14.420 --> 51:16.810 it still feels like we've kind of forgotten 51:16.810 --> 51:18.510 the scale is much faster 51:18.510 --> 51:21.520 and we have to do this like General Nakasone said 51:21.520 --> 51:23.390 across all the services 51:23.390 --> 51:25.130 so the answer is yes, 51:25.130 --> 51:29.340 resoundingly CES is giving us exactly 51:29.340 --> 51:31.020 what we're hoping to get from it 51:31.020 --> 51:32.430 but am I happy where it's at 51:32.430 --> 51:34.774 in terms of the scale, no. 51:34.774 --> 51:37.200 - What's holding you back from growing it faster? 51:37.200 --> 51:38.500 I think there's a lot of things, 51:38.500 --> 51:39.840 there is a process, 51:39.840 --> 51:41.590 there is learnings, there's trainings 51:41.590 --> 51:43.923 you have to send people through, you know, 51:43.923 --> 51:46.730 it is a different way of working 51:46.730 --> 51:49.040 and you know one of the things I've learned 51:49.040 --> 51:50.960 inside the Department of Defense, 51:50.960 --> 51:52.320 you can't automatically assume 51:52.320 --> 51:54.696 just because you say this is the way you work, 51:54.696 --> 51:56.610 it's automatically going to translate 51:56.610 --> 51:58.510 into how people just naturally going to come to work 51:58.510 --> 52:00.330 and work differently the next day 52:00.330 --> 52:02.960 so it's getting people to work in that different way 52:02.960 --> 52:05.040 and it's a very large organization of people 52:05.040 --> 52:06.840 we have to train how to work differently. 52:06.840 --> 52:09.730 - Do you at least though see positive signs 52:09.730 --> 52:11.750 about a willingness to work differently 52:11.750 --> 52:14.940 because historically that cultural issue, 52:14.940 --> 52:18.520 people get the process, they get the people, 52:18.520 --> 52:19.650 they get the technology 52:19.650 --> 52:23.680 but that cultural kind of fourth thing on the side 52:23.680 --> 52:25.520 has been the real tough nut. 52:25.520 --> 52:28.590 - Yeah absolutely, but I will probably stay 52:28.590 --> 52:30.404 completely impatient on this topic 52:30.404 --> 52:31.237 (laughing) 52:31.237 --> 52:33.160 and I will continue to push people to say, 52:33.160 --> 52:34.380 you know, we got to learn faster. 52:34.380 --> 52:36.918 - That impatience is probably to the benefit 52:36.918 --> 52:38.553 of the department, the next question please. 52:39.612 --> 52:42.440 - [Man] Given the varied attack vectors 52:42.440 --> 52:44.220 what is the combined attained vision 52:44.220 --> 52:46.210 for defending the nation's assets 52:46.210 --> 52:47.793 and moving toward the future? 52:49.810 --> 52:52.510 - Well I think the first portion 52:52.510 --> 52:55.210 is the fact that we now have a national strategy 52:55.210 --> 52:56.750 for cybersecurity, that was among the most 52:56.750 --> 52:58.630 important things over the past several months 52:58.630 --> 53:00.659 is that our nation does have a 53:00.659 --> 53:03.860 national strategy, second thing is that 53:03.860 --> 53:06.170 we continue to work and through a partnerships 53:06.170 --> 53:07.670 between the Federal Bureau of Investigation, 53:07.670 --> 53:08.800 Department of Homeland Security, 53:08.800 --> 53:10.610 Department of Defense that we have 53:10.610 --> 53:12.750 unique and important roles to play for it. 53:12.750 --> 53:14.770 Where we have focused our effort over 53:14.770 --> 53:16.840 the past year as I've mentioned is 53:16.840 --> 53:19.121 developing the series of partnership programs 53:19.121 --> 53:21.160 how do we as the department 53:21.160 --> 53:24.180 working with the Department of Homeland Security, 53:24.180 --> 53:27.120 working with the sector specific agency 53:27.120 --> 53:29.840 ensure that whether or not it's the financial industry 53:29.840 --> 53:33.020 or energy or transportation telecommunications 53:33.020 --> 53:36.170 how do we understand what they're doing, 53:36.170 --> 53:39.460 how do we understand what their key defensive concerns are 53:39.460 --> 53:41.810 and then and how do we make sure that, you know, 53:41.810 --> 53:43.210 if required, if authorized, 53:43.210 --> 53:45.498 we can bring our capacity and capability to it 53:45.498 --> 53:48.180 this is a new way of thinking, 53:48.180 --> 53:50.282 it's based upon an agreement between 53:50.282 --> 53:51.910 the previous secretaries for 53:51.910 --> 53:54.080 defense and homeland security 53:54.080 --> 53:55.160 and it's been helpful for us, 53:55.160 --> 53:58.187 I think that at least my experience has been is that 53:58.187 --> 54:01.180 it's a way forward that we collectively understand 54:01.180 --> 54:03.230 that we've got to make sure we work together. 54:03.230 --> 54:04.700 - I think actually this was 54:04.700 --> 54:07.396 the initial piece of work that brought us together 54:07.396 --> 54:10.800 was I remember I think it was week one 54:10.800 --> 54:12.930 we were both in the meeting with the Secretary Menís 54:12.930 --> 54:15.807 at the time and I got very vocal 54:15.807 --> 54:20.160 about, you know, the outside view in about 54:20.160 --> 54:23.120 how private industry and the various critical sectors 54:23.120 --> 54:25.530 are struggling to be able to get access 54:25.530 --> 54:27.080 and have the right conversations 54:27.080 --> 54:29.245 with folks in government 54:29.245 --> 54:32.110 and how it's very very confusing of 54:32.110 --> 54:33.690 who do you work through 54:33.690 --> 54:35.380 do you work to your agency, Treasury, 54:35.380 --> 54:36.800 if your financial services 54:36.800 --> 54:38.000 do you work through DHS 54:38.000 --> 54:41.920 how do you get access to DoD US Cyber Command 54:41.920 --> 54:44.270 very frustrating, very hard 54:44.270 --> 54:45.980 so part of what I think where 54:45.980 --> 54:48.400 we started working very well together was 54:48.400 --> 54:52.770 I brought the view in of how private industry saw government 54:52.770 --> 54:54.370 and how hard it was to work 54:54.370 --> 54:57.860 and then General Nakasone was able to help creatively 54:57.860 --> 55:00.070 think about how do we solve this problem 55:00.070 --> 55:02.163 with our partners in this case DHS. 55:04.690 --> 55:06.350 - That question was interesting to me 55:06.350 --> 55:09.530 because it, half of it was very focused 55:09.530 --> 55:11.380 and half of it was more amorphous, 55:11.380 --> 55:14.340 defending the assets, that's a pretty clear vision 55:14.340 --> 55:15.920 and it's pretty easy for I would think 55:15.920 --> 55:17.481 for each of you to define 55:17.481 --> 55:19.480 how you want to do that, 55:19.480 --> 55:21.470 moving toward the future strikes me 55:21.470 --> 55:24.483 as a little bit more existential 55:24.483 --> 55:27.011 and I guess that depends on 55:27.011 --> 55:29.060 what you think the future is 55:29.060 --> 55:33.090 and what it, so then how you move to that 55:33.090 --> 55:36.057 becomes determinant of what you think that looks like. 55:36.057 --> 55:39.720 Is it as simple as the national defense strategy, 55:39.720 --> 55:41.430 is that the future that we're moving toward 55:41.430 --> 55:42.980 or is there more to it than that? 55:42.980 --> 55:44.480 - Well I certainly think that our 55:44.480 --> 55:45.470 national security strategy 55:45.470 --> 55:46.520 or national defense strategy 55:46.520 --> 55:48.700 give us the vector that we're moving towards 55:48.700 --> 55:50.610 but to your point Francis, you know, 55:50.610 --> 55:52.440 the threat gets a vote, 55:52.440 --> 55:54.730 the way that our adversaries continue to 55:54.730 --> 55:57.050 operate whether or not it's within our infrastructure 55:57.050 --> 55:58.910 whether or not it's from outside 55:58.910 --> 56:01.280 that will drive a series of discussions on, you know, 56:01.280 --> 56:02.150 how do we get after that 56:02.150 --> 56:03.740 are there authorities policy changes 56:03.740 --> 56:05.228 that need to be made I think 56:05.228 --> 56:07.860 that those are ones that we will 56:07.860 --> 56:09.290 continue to work through with 56:09.290 --> 56:11.010 within the department and I think the department 56:11.010 --> 56:13.340 more broadly within the interagency 56:13.340 --> 56:15.430 but that's the first portion I think 56:15.430 --> 56:17.010 where we've got to make an understanding 56:17.010 --> 56:18.799 that you know our threats are not, 56:18.799 --> 56:20.560 they're not standing still, 56:20.560 --> 56:22.070 they're dynamic and they're moving 56:22.070 --> 56:24.502 and they're looking for new ways to 56:24.502 --> 56:27.210 achieve access to us. 56:27.210 --> 56:29.200 - I had a chance to talk to Under Secretary Modly 56:29.200 --> 56:30.890 in the Navy last week 56:30.890 --> 56:34.690 about the the concept of fleet architecture 56:34.690 --> 56:35.766 that they're undertaking 56:35.766 --> 56:38.150 and one of the things that he talked about 56:38.150 --> 56:43.150 was the importance of getting the dynamic correct 56:44.110 --> 56:46.470 as far as he phrased it this way, 56:46.470 --> 56:51.470 trying to not kill a multi-million dollar threat 56:53.220 --> 56:56.240 with a multi-billion dollar piece of equipment. 56:56.240 --> 56:59.740 How does that translate in the cyber realm? 56:59.740 --> 57:03.270 How do you think about scale as far as 57:03.270 --> 57:05.390 what you're applying against a threat 57:05.390 --> 57:07.510 that's presenting itself, General? 57:07.510 --> 57:10.343 - Well I think that one of the things 57:10.343 --> 57:13.317 that we continue to focus 90% of our efforts on 57:13.317 --> 57:16.050 is, you know, the bottom 10% capabilities of 57:16.050 --> 57:18.630 our adversaries because to, you know, 57:18.630 --> 57:20.210 to Dana's point, we have to make sure 57:20.210 --> 57:22.850 that we get you know our house in order 57:22.850 --> 57:24.790 in many ways and we continue to do that, 57:24.790 --> 57:25.690 we continue to do that hard 57:25.690 --> 57:26.920 and I think that's something 57:26.920 --> 57:28.760 that we're making progress on 57:28.760 --> 57:31.690 that being said, you know, I also think that 57:31.690 --> 57:33.387 we are also looking at, you know, 57:33.387 --> 57:37.088 how do we effectively achieve capability access, 57:37.088 --> 57:39.950 different vectors in terms of what our adversaries are doing 57:39.950 --> 57:42.170 and that's not always with, you know, 57:42.170 --> 57:44.480 the most expensive capacities and capabilities, 57:44.480 --> 57:45.910 sometimes it's, you know, 57:45.910 --> 57:50.910 with very, very relatively low cost initiatives 57:51.670 --> 57:52.620 that we have. 57:52.620 --> 57:53.670 - You know, one of the things 57:53.670 --> 57:56.432 you asked us earlier was challenge as we see outbound 57:56.432 --> 58:00.220 clearly and the theme of what we're talking about right now 58:00.220 --> 58:02.205 what I keep trying to iterate to everybody is 58:02.205 --> 58:04.710 when we get into this conversation 58:04.710 --> 58:06.740 called cyber remediation 58:06.740 --> 58:09.820 whether it be weapon systems or endpoints 58:09.820 --> 58:13.190 because I say it's not like one and done, 58:13.190 --> 58:15.710 we've got to move to a different conversation set 58:15.710 --> 58:18.040 that says continuous assessment, 58:18.040 --> 58:21.980 continuous remediation and this is a mindset change 58:21.980 --> 58:26.690 this is the idea that you never fix something permanently 58:26.690 --> 58:29.500 that the adversary is gonna constantly pivot 58:29.500 --> 58:32.010 and so we're gonna have to change into this 58:32.010 --> 58:33.220 cycle of thinking 58:33.220 --> 58:35.220 that says we're gonna assess, 58:35.220 --> 58:36.430 we're gonna remediate 58:36.430 --> 58:37.960 and we're gonna have to constantly test 58:37.960 --> 58:41.110 and we'll probably back at some point remediating again. 58:41.110 --> 58:43.000 - Yeah whether adversaries are trying to 58:43.000 --> 58:45.210 achieve vectors remotely or it's, you know, 58:45.210 --> 58:48.130 within insider threat or a supply chain 58:48.130 --> 58:49.660 these are all different elements 58:49.660 --> 58:50.620 that we've got to consider 58:50.620 --> 58:53.530 and certainly within our work with weapons security 58:53.530 --> 58:55.240 and working with the services here 58:55.240 --> 58:56.960 these are points that we emphasize, you know, 58:56.960 --> 59:00.870 are we assured that based upon 59:00.870 --> 59:03.870 whatever vector that our adversaries might come at us 59:03.870 --> 59:06.780 that we have the confidence that we have both 59:06.780 --> 59:10.610 the resiliency and reliability of our weapon systems. 59:10.610 --> 59:13.823 - We have time for a couple more questions, another one? 59:15.510 --> 59:18.560 - [Man] What can DoD borrow from the commercial sector 59:18.560 --> 59:20.703 to push network access to the tactical edge 59:20.703 --> 59:22.930 in contested conditions 59:22.930 --> 59:26.533 and what must DoD develop that's unique? 59:31.790 --> 59:33.775 - So a couple conversations here, 59:33.775 --> 59:37.840 one is, we have to assume that 59:37.840 --> 59:41.729 no matter how we think about next generation C3 59:41.729 --> 59:42.920 and that's whether it's 59:42.920 --> 59:47.194 satellite, P&T, terrestrial communications 59:47.194 --> 59:49.360 that our adversary is gonna 59:49.360 --> 59:51.440 constantly be contesting us in this space, 59:51.440 --> 59:53.600 trying to disconnect us to greatest, 59:53.600 --> 59:56.340 spoof us whatever it might be 59:56.340 --> 59:57.930 so there's a constant conversations 59:57.930 --> 59:59.630 with the services that says, 59:59.630 --> 01:00:02.530 you know do we know how we're gonna fight through 01:00:02.530 --> 01:00:03.890 on the day in the event that 01:00:03.890 --> 01:00:05.730 you can't always depend on 01:00:05.730 --> 01:00:07.510 the command and control of communications 01:00:07.510 --> 01:00:10.900 and that's something services will continue to look at. 01:00:10.900 --> 01:00:14.310 For me it's kind of a little bit of a throwback in time, 01:00:14.310 --> 01:00:15.720 do you remember years ago 01:00:15.720 --> 01:00:19.090 when we first moved from mainframes to client-server, 01:00:19.090 --> 01:00:20.930 there was this idea of store it forward, 01:00:20.930 --> 01:00:22.760 the idea that you're going to be disconnected, 01:00:22.760 --> 01:00:25.920 how do you capture, how do you allow 01:00:25.920 --> 01:00:28.340 the endpoint to continue to operate 01:00:28.340 --> 01:00:31.810 but disconnected so to speak from the, 01:00:31.810 --> 01:00:36.810 from the main, in this case it'd be the main data center 01:00:36.860 --> 01:00:39.438 and we're spending a lot of time looking at 01:00:39.438 --> 01:00:43.015 technologies that are emerging into the marketplace 01:00:43.015 --> 01:00:47.610 where the idea of being able to give the warfighter 01:00:47.610 --> 01:00:49.730 on the tactical edge everything they need, 01:00:49.730 --> 01:00:51.480 whether it be on the plane, on the ship, 01:00:51.480 --> 01:00:53.300 or in the forward command, 01:00:53.300 --> 01:00:55.490 that allows them to have enough intelligence 01:00:55.490 --> 01:00:57.260 and enough decision-making 01:00:57.260 --> 01:00:59.040 that if they cannot communicate 01:00:59.040 --> 01:01:00.190 and they can't get any more 01:01:00.190 --> 01:01:01.440 than what they're working with, 01:01:01.440 --> 01:01:04.200 that they can still fight successfully. 01:01:04.200 --> 01:01:06.360 I think some of that we will probably have to build 01:01:06.360 --> 01:01:08.400 inside the DoD and some of that 01:01:08.400 --> 01:01:10.950 we'll look to partnerships in the private industry. 01:01:12.000 --> 01:01:15.220 - So the idea of building versus buying 01:01:15.220 --> 01:01:17.400 this is something that's been challenging for 01:01:17.400 --> 01:01:19.690 not I'm not gonna pick on DoD 01:01:19.690 --> 01:01:22.030 this is the whole government has done this, 01:01:22.030 --> 01:01:23.690 one of the most significant things 01:01:23.690 --> 01:01:27.530 that I think I have read over the last year 01:01:27.530 --> 01:01:30.030 since you've been at the department, 01:01:30.030 --> 01:01:33.190 I'm not giving you credit or blame for this by the way 01:01:33.190 --> 01:01:37.616 and it got almost no coverage was the fact 01:01:37.616 --> 01:01:39.811 that the department contracted with SAP 01:01:39.811 --> 01:01:44.811 to adapt their travel system. 01:01:44.870 --> 01:01:48.310 Very mundane, but not something 01:01:48.310 --> 01:01:49.390 the department needed to be 01:01:49.390 --> 01:01:51.870 in the business of owning and maintaining. 01:01:51.870 --> 01:01:56.260 Are you seeing or are you driving success 01:01:56.260 --> 01:02:01.040 in getting people maybe in the not frontline stuff 01:02:01.040 --> 01:02:03.530 to understand we don't need to build that, 01:02:03.530 --> 01:02:05.130 we don't need to own it, 01:02:05.130 --> 01:02:08.470 it might exist or it might exist closely enough 01:02:08.470 --> 01:02:10.430 that we can use somebody else's. 01:02:10.430 --> 01:02:12.600 - Yeah I mean yes and yes, 01:02:12.600 --> 01:02:15.770 we have seen it and helping to drive it 01:02:15.770 --> 01:02:17.580 and I think there's two parts of that. 01:02:17.580 --> 01:02:19.410 There's part one of 01:02:19.410 --> 01:02:24.250 why do we need to build the next HR recruiting system, 01:02:24.250 --> 01:02:26.329 HR knowledge management system 01:02:26.329 --> 01:02:28.600 and the number two is, 01:02:28.600 --> 01:02:32.670 can we now find a common solution partner 01:02:32.670 --> 01:02:35.770 to help us with that and then not take that 01:02:35.770 --> 01:02:37.700 and then create 10 copies 01:02:37.700 --> 01:02:40.240 of which we then create 10 variants 01:02:40.240 --> 01:02:41.860 over the next 10 years for. 01:02:41.860 --> 01:02:44.750 So to me it's not only trying to solve for 01:02:44.750 --> 01:02:47.390 how do you institutionalize thinking 01:02:47.390 --> 01:02:50.040 where you take a bias in business systems 01:02:50.040 --> 01:02:52.360 towards commercial offerings first 01:02:52.360 --> 01:02:53.400 but more importantly, 01:02:53.400 --> 01:02:55.809 if there's one thing that private industries learn 01:02:55.809 --> 01:02:56.880 time and time again, 01:02:56.880 --> 01:02:58.994 one thing to get everybody to come on 01:02:58.994 --> 01:02:59.827 to a standard solution, 01:02:59.827 --> 01:03:02.065 another thing that you don't allow that over time 01:03:02.065 --> 01:03:04.510 to start to spread apart 01:03:04.510 --> 01:03:06.110 and you wake up one day and you find out 01:03:06.110 --> 01:03:08.110 you have ten variants of that. 01:03:08.110 --> 01:03:10.950 I'm spending as much time trying to push this idea 01:03:10.950 --> 01:03:13.690 we can't allow variation over time 01:03:13.690 --> 01:03:15.370 as much as the bias towards 01:03:15.370 --> 01:03:17.370 why aren't we just buying to begin with. 01:03:18.300 --> 01:03:19.133 - And I think that that's, 01:03:19.133 --> 01:03:20.300 I mean we talked about it before 01:03:20.300 --> 01:03:21.407 that's where I think DIU 01:03:21.407 --> 01:03:23.880 and that's where I think Defense Digital Services 01:03:23.880 --> 01:03:25.763 plays a very hopeful role right. 01:03:26.886 --> 01:03:27.719 And you know they come in, 01:03:27.719 --> 01:03:29.971 and they do get these cries for helps that tell 'em, 01:03:29.971 --> 01:03:30.950 why are we doing this, 01:03:30.950 --> 01:03:32.730 you need to help and they can take a look 01:03:32.730 --> 01:03:34.830 and end with a, you know with a scans tyke 01:03:34.830 --> 01:03:36.320 and say hey this is probably something 01:03:36.320 --> 01:03:38.820 we should look other there places for. 01:03:38.820 --> 01:03:40.340 - We just have a couple of minutes left, 01:03:40.340 --> 01:03:42.060 and cardinal sin number one 01:03:42.060 --> 01:03:43.450 of every moderator is 01:03:43.450 --> 01:03:46.660 you never are late 01:03:46.660 --> 01:03:48.560 between either a meal or the booze, 01:03:48.560 --> 01:03:50.360 so I will just ask you General, 01:03:50.360 --> 01:03:53.070 to give a minute or so on anything 01:03:53.070 --> 01:03:54.720 that you want to get out there 01:03:54.720 --> 01:03:56.740 that we haven't had a chance to talk about so far. 01:03:56.740 --> 01:03:58.770 - We didn't talk about persistent engagement today, 01:03:58.770 --> 01:04:00.920 and persistent engagement for us 01:04:00.920 --> 01:04:02.690 is part of this idea of 01:04:02.690 --> 01:04:05.240 how do we operate in cyberspace effectively 01:04:05.240 --> 01:04:06.850 to both enable and act. 01:04:06.850 --> 01:04:08.380 Enable our partners whether or not 01:04:08.380 --> 01:04:10.410 we're sharing information, intelligence, 01:04:10.410 --> 01:04:12.100 understanding of the threat 01:04:12.100 --> 01:04:13.620 or its acting when authorized 01:04:13.620 --> 01:04:15.520 to deal with our adversaries, 01:04:15.520 --> 01:04:17.270 whether or not that's through defend forward 01:04:17.270 --> 01:04:20.200 or it's through a period of being able to 01:04:20.200 --> 01:04:23.220 identify and take on malware 01:04:23.220 --> 01:04:24.990 that might be of threat to our nation. 01:04:24.990 --> 01:04:26.920 This is where our command and our agency 01:04:26.920 --> 01:04:27.753 have moved towards, 01:04:27.753 --> 01:04:29.290 we think it's a very very effective model, 01:04:29.290 --> 01:04:31.810 it's also been a model that we that we worked 01:04:31.810 --> 01:04:35.010 and perfected during the recent midterm election. 01:04:35.010 --> 01:04:37.080 So I would close with the idea 01:04:37.080 --> 01:04:38.540 of the importance of persistent engagement 01:04:38.540 --> 01:04:40.860 where our adversaries continue to operate 01:04:40.860 --> 01:04:42.770 below the level of armed conflict 01:04:42.770 --> 01:04:45.750 to continue to attempt to steal our intellectual property, 01:04:45.750 --> 01:04:48.249 leverage our personal identifiable information 01:04:48.249 --> 01:04:51.160 or attempt to, attempt to interfere 01:04:51.160 --> 01:04:52.380 in our democratic processes. 01:04:52.380 --> 01:04:53.848 - Are you please, 01:04:53.848 --> 01:04:54.681 excuse me one moment Dana. 01:04:54.681 --> 01:04:57.920 Are you pleased not pleased or neutral 01:04:57.920 --> 01:05:00.180 about the capabilities of the partners 01:05:00.180 --> 01:05:02.480 that you interact with on that particular issue? 01:05:02.480 --> 01:05:04.250 - I'm pleased and I would say that 01:05:04.250 --> 01:05:05.650 not all my please but I'm heartened 01:05:05.650 --> 01:05:07.430 in terms of where we can go with it. 01:05:07.430 --> 01:05:08.290 - Dana. 01:05:08.290 --> 01:05:10.620 - Yeah I would say it's what I continue to talk about, 01:05:10.620 --> 01:05:13.090 we have a digital modernization program 01:05:13.090 --> 01:05:14.590 inside the Department of Defense 01:05:14.590 --> 01:05:17.674 that consists of foundational cloud as core, 01:05:17.674 --> 01:05:21.250 layering new technologies such as A on top of it, 01:05:21.250 --> 01:05:22.710 having robust C3 01:05:22.710 --> 01:05:24.780 for next-generation command and control 01:05:24.780 --> 01:05:27.420 and that needs to be wrapped with SmartCyber, 01:05:27.420 --> 01:05:32.130 and in every one of these areas I have seen 01:05:32.130 --> 01:05:33.530 that the importance of having 01:05:33.530 --> 01:05:35.420 a strong working relationship 01:05:35.420 --> 01:05:38.250 between General Nakasone and Maya's office 01:05:38.250 --> 01:05:40.190 is very symbiotic, there are things 01:05:40.190 --> 01:05:43.040 that he's gonna wanna use that we're developing, 01:05:43.040 --> 01:05:45.290 and I need him to help ensure 01:05:45.290 --> 01:05:46.410 that what we're developing, 01:05:46.410 --> 01:05:48.380 we're doing in a smart and secure way. 01:05:48.380 --> 01:05:50.890 So I think I think the relationship 01:05:50.890 --> 01:05:53.040 that our two organizations has formed 01:05:53.040 --> 01:05:56.510 over the last years doesn't get a lot of press 01:05:56.510 --> 01:05:58.040 but I have to tell you, it has been, 01:05:58.040 --> 01:06:00.080 what I think has been one of the big breakthroughs 01:06:00.080 --> 01:06:02.630 that allows us to move with a lot more pace today. 01:06:02.630 --> 01:06:04.350 - Foundational for us. 01:06:04.350 --> 01:06:07.030 - I am very pleased, very honored 01:06:07.030 --> 01:06:09.210 to have the opportunity to explore that relationship 01:06:09.210 --> 01:06:10.280 with both of you gentlemen, 01:06:10.280 --> 01:06:11.550 Mr. Deasy, General Nakasone, 01:06:11.550 --> 01:06:12.740 thank you very much for your time, 01:06:12.740 --> 01:06:14.325 my thanks to the AFCEA team 01:06:14.325 --> 01:06:17.093 and thank you very much for your attention. 01:06:17.093 --> 01:06:18.821 (Audience applauding) 01:06:18.821 --> 01:06:20.060 - Thanks Francis. 01:06:20.060 --> 01:06:21.290 - Well I'll ask, 01:06:21.290 --> 01:06:23.090 Francis thank you for your moderation. 01:06:23.090 --> 01:06:25.214 - Where's my fire? - Huh your fire? 01:06:25.214 --> 01:06:26.410 - I still don't have my fire. - I was looking for a gift 01:06:26.410 --> 01:06:28.810 to put up on the screen and you know just run it on, 01:06:28.810 --> 01:06:30.810 but thank you for.