Thank you all for coming here. We are acutely aware that we are the first session after you have come back from lunch. We will try to keep you awake and lively as well as we can. We have a terrific group for this discussion today. To my leimmediate left your rig isnd comaer Steven Fogerty of the United States army Cyber Command. Rick howard, old friend, key Security Officer at palo alto networks. Jeannette mantra, the assistant director for Cyber Security at the department of Homeland Security and of course is its still relatively new agency sissa. And Tanya Ugoretz the deputy direct for cyber at the fbi. This should be a great discussion. Tonya, let me start with you and ask you to just describe, if you can, the rfbis role in cyber space and the threat environment, how you think it has changed over the past year. Sure, thank you, david, and thank you to insa for hosting us today. As we at the fbi look at the threat environment from a macro level it is not necessarily the best news story in the world. But it is certainly complex. We are looking at an environment where there is no shortage of vulnerabilities and opportunities for malicious actors to exploit those vulnerabilities. We see that landscape only growing in complexity as we consider the number of devices that are going to become connected, in the billions over the next few years, many of which dont have security built in. We live in a world where we see nation state actors conduct wholesale theft of permanently identifiable information targeting not just our Government Networks but our citizens as well as Health Care Information and intellectual property. Then we have a growing universe of actors who are growing in their capability, a proliferation of tools that are available for them to use. And at the fbi we look at both the National Security and the criminal space. So we increasingly see crime and cyber crime as an economy, crime is a service. The growth of organizations and individuals who are marketing different elements that are necessary to conduct cyber crime at scale that only kind of embolden and enable more actors. And apart from this, you have the complexity that apart from federal Networks Much of what we care about is in the u. S. Is in private hands. Whether thats Critical Infrastructure or also as we see for example, with ransom wear targeting of other potential victims such as municipalities, et cetera. And then the wild card in all of this is adversary intentions which is where we rely on the Intelligence Community to help us prioritize and make sense of this complex space, who is it that we really need to worry about, who is most intent and most capable of causing the most harm to us . So thats the big picture for us. So as i mentioned, thats a complex picture. And we feel that often, especially in government, but throughout our society, we reflexively look for a simple answer, even to address as complex a system and problem as i just described. But how we see it at the fbi is that it is only through a woven fabric of the authorities and capabilities of all the entities i just mentioned, whether its u. S. Government, foreign partners, the private sector, who have to come together with their authorities and capabilities in an agile way to be able to counter that environment. So thats a longwinded wind up to where do i see the fbi in that . We see it squarely in the middle. I wont speak for other agencies but i will say generally we look to partners like siza who are in the lead in assessing risks to our networks and helping to support through mitigation and defense. We look to our right and we see our partners in the Intelligence Community and d. O. D. Who are taking the fight to our adversaries overseas both seen and unseen. Then we see the fbi in the middle enabling the activities of the whole range of partners plus the private sector are our unique authorities and presence. And briefly, that comes from a long history, 100plus years now that we are building on in cyber of having presence in our communities throughout the countries and global where we are engaging in our communities before something happens so that we are ready after something happens to engage victims with the response that they need to conduct investigations and operations focused on two things, attribution, finding out who is responsible, and accountability, whether thats through our own tools in the criminal Justice System or providing those nuggets of attribution to other partners who can use their tools to hold our adversaries accountable. Tonya, we will came a little bit later on to the ransom wear issue which you just alluded to. One question coming out of your scene setting there. Of the four big state actors we often talk about, china, russia, iran, and north korea, are you seeing a significant difference in the level of activity among those four over the past year or so where we have had a obvious low geopolitically a changing environment with all of them . I always hesitate to rank because i think it is a pretty fluid situations and different adversaries are focused on different things. Different things and have different capabilities as well. For example, i think we continue to see china quite active in terms of economic he is espnage which our director has been very forthright in speaking about alongside other agencies. Russia certainly continues its malicious cyber activity. And its no surprise that there has been a fair amount of attention to the potential for geopolitical tensions in the middle east, particularly with iran to perhaps manifest themselves in the cyber arena. Are you seeing any evidence that the rnaians are doing that right now . I dont want the speak to particulars. Jeannette, you heard from tonya where the fbi sits in this. My guess is that siza, which is just about ayearold now, right, is probably a little less wellknown in their role just because it is a newly created agency. Tell us a little bit about that. And also tell us how your responsibilities differ from the fibs. Sure. I think tonya set things up very nicely. In where we sit is there is a lot of people in the government and in the private sector increasingly that are very focused on how do we understand the threat . And for us, we believe that threat is just one component of what we need to understand. And you talked a bit about geopolitical dynamics. Oftentimes i think we have cyber conversations in a bit of a silo and not thinking about the broader geopolitical dynamics which has been that over the last few decades weve created technologies and ecosystems that have allowed the United States to be at at least potential to be held at risk in the homeland. Oftentimes that manifests itself through cyber means. Not completely. And so my organization, while siza, the Cyber Security, Infrastructure Agency was created last year by legislation last november is nearly ayearold, we do have a legacy going all the way back to the founding of the department with many authorities that were given actually dealing with the counterterrorism issue. And in thinking about what happened with 9 11 and that there wasnt anybody and this also picks up on tonyas point about the coordination, is there we didnt have somebody who was focused on engaging with the private sector exclusively. Not in Law Enforcement. Not intelligence, not from a defense perspective, but somebody who could think about risk, bring government partners together, not be the one to execute, because as tonya mentioned everyone has a lot [ no audio ] but being the one who is bringing everyone together letting the Intelligence Community understand what would be useful for the private sector to take actions and being in a position to be able to alert and warn when we do learn thing. There was a lot of Lessons Learned from counterterrorism. And about two years ago now we have started to think about well, how has cyber, and frankly, even the terrorism, bass we actually have physical security responsibility as welt. How has that dynamic and the threats to the homeland really changed . What we realized is that woe ourselves were missing the Bigger Picture a little bit by focusing on what are we doing for the Financial Sector . What is i. T. Doing . What is coms doing . And really adversary what is they want to do is hold functions of our society at risk. And we learned this through elections. Weve learned this through energy engagements, is its not and the interconnectedness of course makes it sometimes easier. So if they want to have a situation where we have a loss of Public Confidence in our financial markets, there is ways that you can affect that outcome potentially. If they want to take out our ability to generate electricity there is ways that you know you can contemplate going about that. But it cant be just a conversation with the utility owners or the Global Capital market banks. You have to have the Service Providers in the conversation. You have to have the broader internet ecosystem owners and operators in the conversation. So we have switched to a functional approach. And we released our National Critical functions the first time we have ever done this, in april, i believe, it was. And what we are looking there thats the foundation of what we believe we are, is understanding what is the risk to the country, help inform the threat with information that we are able to gather, help drive and ask questions of those who collect on the threat to better understand the risk, but also to understand vulnerabilities, and really importantly understand the consequence. If you have a very capable actor who has an intent and there is a vulnerability and the consequence isnt a big deal then we have a way to mitigate this. If you have a very significant consequence but nobody is looking the see if there is any actor who can actually affect that consequence then we should probably be pivoting resources to be looking at that as a potential. It is forcing not just us but all of government to think very, very differently, whether this the Intelligence Community or those of us here on the stage about the role of government and the private sector and the federal government and state and locals, the u. S. , and our partners and having much more open conversations about what do we know . What do you know . And how do we share that information and not just hear some i. O. C. S good luck. It is really getting into much more contextual conversations is i think we think that russia might be doing this. Actually i dont know if it is russia, but we think that somebody is trying to do this here to your systems. Are you in the private sector willing to share what could be happening there back with us, back with nsa, fbi, d. O. D. , all the different components coming together. Thats where we see that we are sitting. We are not going the ones who are going to have every single tool to solve all of these problems but we are positions to be that risk advisor, to understand how is the homeland at risk and what can we do about it . What are the levers that we can pull . Who has those levers . And how did we take actions . Thats why we are focused. The National Critical functions are the core of what is going the drive us and prioritize. We have had success in all of government in thinking differently about the u. S. As a target. How do we orient ourselves to drive down that risk. I am glad you mentioned that. And when you said before that its different than just handing people the i. O. C. S, the indications of compromise and say good luck, there was a bit of that going on for a number of years. And usually companies would say to me when they got those warnings which either came out of dhs or fbi, they would say this is great, we saw this four months ago and dealt with it. Which takes me to rick, because one of the big changes, it strikes me has been the creation of the Cyber Threat Alliance so that this sharing is much more of a twoway thing. You are going to see things that jeannette or tonya may not see first. Or you will see them from a different angle. So tell us a little bit about how that works and a little bit about how it has got to speed up. It is still a pretty manual process. Before i answer that question let me plug your book. Before i read davids book if you would asked me what is the book i would want you to read i would have said skifrd stoles cuckoos egg book . Still read that book. After i read davids book, its davids book, perfect weapon we know most of the things he talks about this there but we dont understand it until you read his back. The takeaway i have from it is we have been in a continuous low level cyber conflict since 2010 and we are just now starting to get our hands around it. I did not pay rick for any of this. I didnt know we were supposed to suck up to the moderator. I also want to plug him. I will give you a cut of the check. From the commercial perspective, david is right. The thing that the commercial world has realized is that the adversaries have automated their attacks and most of us in the commercial space and the government space we are trying to deal with that manually. If you have an Information Sharing Program you are sending it around in spreadsheets and in email. If your organization has the time to even consume those things you may get around to it in weeks to months to never. What we decided to do in the Cyber SecurityVendor Community is automate the threat of information sharing between security vendors. Heres the reason. Every security vendor out there worth anything is a giant intelligence collection engine. Palo alto network says 70,000 customers all with ten to 200 devices deployed on their networks. We can deliver controls automatically to those devices because they are our customers. Unit 42, how many people have heard of unit 4 . Marketing ducked for us. Totally free intelligence if you want it. But when they discover something new we can convert that into multiple prevention controls for our product set and deliver it to 70,000 customers in five minutes. Five minutes amazing capability. All of the members of the cyber lines, 26 in there, at the all have similar capabilities. Ours is better. Thats the best joke i have. If you guys are not laughing now this is going to be a long panel. They all have similar capabilities. What is not happening from the government side is trusting that system so they can if we got information from lots of governments around the world, say we saw this thing and it is very damaging. If you just got it into the Cyber Threat Alliance we could get prevention controls and protect almost everybody on the planet very quickly. We have the fix that going forward. We will let you guys defend yourselves in just a minute. I understand the reasons why we cant. But . We will get to that in a second. General fogerty, of course before you were in your current role and you succeeded general knack sanny who we will be hearing from later this afternoon, check czech you were at Cyber Command as well. So you come at this from a bit of a different perspective. And the phrase we have heard since your concept of operations changed just as admiral rogers was leaving office was persistent engagement which is perceived by most people as being largely overseas, in the networks of adversaries, so that you can see a threat gathering before it is delivered, before rick sees it show up in the Cyber Threat Alliances networks. Presumably, before jeannette and tonya see them as well. Tell us how this works day to day. What does this look like . And in a world where people are concerned about sovereignty, how do we explain to the rest of the world why we can be in their networks and yet we get so upset when as jeannette points out we have got foreign operators sitting in our electric power grid . First of all, persistent engagement, i think the big idea there is that we are going to start using the entire operational depth of the cyber domain as wields frame it or the information environment. So we are not going to see red space. We are going to goet the right actors, olympianing, preparing, testing rehearsing. They are trying to defend themselves. We are not going to see grace face so that i am allowing it to maneuver out of their sanctuary get into an attack position and start to pummel us. If you think about where we were just a couple years ago thats what it was. It was shields up, we were principally focused on blue space and we were trying to shoot the arrows or block the arrows from penetrating us. Tonya said it well, the volume, the velocity, the variety of the threat, it just continues to improve. Rick said they have automated this. You are going to be in a defensive crouch, you are just going to bleed out. You are going to get knicked by a thousand arrows or a million arrows. The big idea is that we will manipulate in all of those environments. We dont act by ourselves. We engage with foreign partners, we engage with commercial partners, we engage with our interagency partners. It is really building that irk no. Now this is an intel audience, what i would say operations in the cyber domain in the information environment are like operations in any other operational domain. They are driven by intelligence. From cyber coms perspective, nsa is its most important parter in partner. All of us on the stage have different responsibilities and different authorities. The idea is bringing all of that together. We are not operating, we are not ceding space to the adversary. I am not necessarily crawling through a partners network. The partner is actually sharing. Im sharing with them to enable them to defend better, to doe detective, verify, to share back with me. I wasnt suggesting you were in a partners network, i was suggesting you were in an adversarys network. As we should be. Come out of a 2016 experience, what i was struck in doing the reporting on the book was the number of people in Cyber Command, nsa, certainly at dhd and fbi who were saying the reason we were taken by despise want because we had radars off, it wasnt a pearl harbor kind of situation it was that we hadnt built the radar to be able the actually it. As now you have been through the experience of the midterm elections where i think john bolton at the white house and director nakasoni have talked about this are you persuaded we have at least built the radar network, that we would see that information again on the cyber side and on the Information Warfare side. So i think the most important part of our response was we had the radar. It just wasnt tuned properlily. Can you give us an example operationally from 2016 . Yeah. I think frankly we werent camped out on social media. We certainly werent will being domestical domestically, i dont think we were partnered as well as we should have been. The Lesson Learned is first of all you better open your aperture. You better look at your partners, understand with a their capabilities and limitations are. And then you better build sustainable mechanisms that allow you to partner effectively. As rick said i think what we are finding is you have got to automate as much as possible. Because we still put a lot of human sweat equity against problems that i think i mean, i go back to when we were really sucking a tremendous amount of sigant in iraq and afghanistan. I would say i need more linguists. He said you need to ask better questions and we will give you tools so information is not falling on the floor. It is being collected. You can access it. But you better you better know the question that you have to ask. And that will allow to you access it. I dont think there is an issue of recognizing the adversaries ukt canning influence operations. I think we all get that. The question is do we have a way to counter them . I dont see that. Are we working on that . Again, i think it is the partnership. Its combination of Law Enforcement. It is a combination of working with our foreign partners. But the other thing i think we have got to be very careful about this idea that cyber v cyber. You have got to look at the range of operations that a nation state has. So you can impose sanctions, you can hurt them in the pocketbook. You can prevent actors from traveling internationally. So i think two things. Sometimes we can narrowly define the roles. And that will limit our ability to see the problem. And then it will limit the amount of tools we have to apply against the other problem. But i dont see this as just a cyber problem or a Cyber Response to the problem. I think we have to be much more sophisticated than that. We will come back to that in a moment. In the generals answer about 2016, on theian and jeannette you are both intently focused on 2020. Tonya, i think you and i were at an event earlier in the summer where everybody agreed that whatever it is the russians and other actors are going to do in 2020, the one thing for sure is they are not going to follow the same playbook they followed in 2016. So tell us a lint about what you are doing to begin to think out ahead to what kind of investigators of attack you think you might see and how he would get ahead of it, ahead of the election, both on the social media Information Warfare side and on the election manipulation si side. I think this issue is one of the great areas of growth for probably the government and how Government Works with the private sector in the time i have been working cyber. As you would hope, we learn and we get better in response to everything we experience the nature of these problems requires a coming together of what have traditionally been quite separate areas of responsibility. So i will speak just specifically for the fbi. The issues of foreign influence traditionally are handled as a counterintelligence issue looking at how Foreign Intelligence Services are looking to conduct their influence activities. Whereas the cyber related intrusion activity is looked at as a cyber investigative and an intelligence manner. And that was not only the case for the fbi. But multiply that really in different ways across the government, including focus on functional issues like sidebarer and then regional adversaries li like cyber and then regional adversaries. What everyone is looking at and marry that up with what insight the private sector has. I think the great growth since 2016 has been in building those structures and Communication Networks and capabilities where we are now having that conversation all the time lest you think we are just responding to the last thing that happened, i wont go into detail, but it is more expansive than just look at the nature of activity of what happened in 2016. So there is also a level of imagination injected there, too, and analysis of how we think thing might be different in 2020. Jeannette, let me give you a specific example of that, as we all over the summer heard this because it has been the summer of ransom ware for a number of cities and towns and School Districts and all of that. A lot of your colleagues have been looking at the question of what if you had a ransom wear issue around election machines in the future . Or forgetting election machines, just the registration systems which risk outward face asking on line and therefore a little bit easier for somebody to go and get into. And thats just one of a half dozen scenarios i have heard play out. Tell us a little bit about how you are all thinking about getting ahead of these. Similar to what tonya said i think not just for our agencies but really for a lot of government elections, it was very much a forcing function not just to think about how do we protect our electoral process but how are we thinking about this overall activity where you have adversaries who are thinking across multiple different ways to achieve an impact. And one of the first things that we did on elections was to work with Election Officials to actually understand what the election system looks like. And to make sure that everybody actually understands it. We published something called a risk characterize igs. It is a simple sort of info graphic that says this is what happens before election day, this is what the types of systems are that different organizations will use and walk people through that. And the reason thats important and we are taking this model and applying it to all of these different critical function is what is that end to end process look like . Not the technical system yet. You need to get to the technical system. But what does that end to end process look like, what does that business look like to deliver this final outcome of a voting result in the case of elections. And then actually assess the risk. And what that started is really a an iterative process. And say okay, well, you know, Voter Registration databases was something we were concerned about in 2016 because we had some some evidence that that was happening. Well, why was it happening . And so there is a lot of questions that now start the come and you can have people this the Intelligence Community start to look for those answers. And based off of the answers it now informs maybe we didnt understand their everyall intent. You go through this process, no different than every other problem we have to work on. Just that this one happens to be on cnn every day. So we think where we learned our biggest lesson is really getting everybody on the same page and understanding and being very public about it, too, is everybody should understand how your countrys electoral process looks like. And then we also wanted to be very public and say heres how an actor could you know maybe cause some problems. And sometimes it is not even an actual problem, which for cyber people started to get us uncomfortable because there is no actual cybery thing happening. It is a perception that a cybery thing has happened or Something Like that. But we felt that we had to take in that full realm of possibilities. And then really focus on okay Voting Machines, there it turns out it would be actually really, really impossible probably to have any sort of wide scale impact that was undetected but you could cause chaos by injecting something or somewhere in this process. And knowing that that was probably their intent that allowed us to focus. If you take that model we are still taking that model for elections and will continue to row fine that you can start to and you start to understand well heres the company that provides this system and thats companies have since allowed us to take apart those systems. The companies that make the registration systems. And the Voting Machines nsa d others and say i need you to look and see if anybody it maybe looking at this company or this machine. And now they know its a high priority alert. Are people that i need to get information to with the right context so they can do something. That is the sort of cycle instead of a generic list of hey, theres an advanced atp out there messing with windows. That is very different. I remember going to dhs last year of the Obama Administration . The summer of 2016 while this is going on. And they had secretaries of state that wouldnt return the phone calls. They were afraid the federal government is taking over the system. Thats one thing they were unified on. If you ask people about the makers of that software, we engaged with them. Let me ask you the next step on this. You cant say very much about what the u. S. Government did or didnt do during the mid terms last year but i believe what i read in the New York Times, you know, the failing New York Times that makes up for the book plug. Yeah. We understand there were messages based on the cell phones and individual actors in russia. And so forth. They found the system shut down for a while. While you cant discuss the specifics, can you tell us if youre seeing this kind of if were seeing this kind of out ward warden gaugement, is there any evidence you with cite that this kind of action which is intended as deterrents is actually working, recognizing the nakt ev fact that it is difficult . I already think cold war deterrents, it was a success. We didnt annihilate each other with Nuclear Weapons. This is different environment. Do i think theyre going to come into this space in 2020 . Absolutely. The big idea of, again, persistent engagement is not the sank wary. Make them compete throughout the entire ma and throughout the entire environment. I dont know a single thing question do that would prevent them from competing in that. But i want to impose as much cost on them as possible. And again it goes back to if we restrict this to a cyber v. Cyber operation or activity, then that becomes pretty challenging. But if i use everything thats available to me as a government, a whole government approach to this, then i think you have a lot of options. And so that so, again, thats much larger than Cyber Command. For mid terms, we did persistent engagement. We acted throughout the entire operational depths so in red space and gray space and in blue space. And we imposed cost. Now most of our adversaries, we know, theyre pretty adaptive. They learn. And i think your point about, you know, are they going to, you know, pull the same play from the 2016 election where it was effective for them . Maybe they will. I think its going to be, you know, they will have taken lessons or likely have and theyre going to work very hard to evade our defenses. Theyre going to try to limit the cost thats were going to attempt to impose upon them. I think its going to be rather sporty, actually. They dont differentiate between cyber and Information Warfare. And you just read the doctrine. You read all of the rest of their materials they have done. And yet we do. And its a very different approach. Youve been pushing pretty hard to get the United States into the Information Warfare side which is difficult thing for democracy to do. Tell us a little bit about the concept of that is. So you look at our mission for cyber. I have responsibilities. I operate, defend and attack when directed. I have responsibility for Information Operations. I have responsibility for electronic warfare. When i look at that, if i look at them as stove pipes, then i can certainly create effects. I can impose costed. I can engage in all three of the areas. We think they have to be able toi to integrate the capabilities and really erase those seams and when i look at cyber io and ew enabled from the great Intel Community, that allows me to start what i would call Information Warfare. And so we are pushing very hard. Were spending a lot of time right now in developing the concepts for that. But what i find is i support my commanders around the globe, army commanders. Its very rare someone comes to me and said, look, i need this cyber capability. They describe the problem theyre trying to solve of. And maybe theyre trying to get information to an audience. I have a way to deliver that. But i would argue that its a cyber delivery is probably Information Operation that im conducting. Can you imagine the United States openly saying that it conducts Information Operations . I think we should, absolutely. So if you look at the idea of persistent engagement where im contesting, that is that creates first of all, thats an operation. I think that creates an idea that were not going to just get pummelled without imposing costs on the adversary. It could be traditional range of adversaries down to criminals. And again, i think what we found, whether its criminals or its nation states, you know, our partnership with fbi, with industry, is what has allowed us to get after this in a very different way than we did in 2016. I any that is important. Sometimes its like, hey, look, theyre ten foot tall. Theyre having their way with us. And what i would tell you is as they have learned and adapted, they developed capabilities, we have done the same thing. And it is a very competitive space. Rick, you made the point of the framework. Youve got maybe 50 groups, maybe 250 techniques. That doesnt sound like a huge universe for general foor dhs a fbi to be dealing with. Like you said, it sound really big because the bad guys automated their attacks. The members of the cyber criminal lines, they believe that there are no more than 100 active Cyber Operations going on in any given day. Right . Only 100. Half of us thinks its less than 50. The if you go by the minor attack standard, they went and captured every technique and tactic and procedure that bad guys use and most people think there is a bazillion. If there are 50 adversary groups operating every day and they can do 250 things, that is a math problem even i can solve. The trick to this is automate it. We forget that spectrum of Information Operations, there is a defensive component. The reason were talking about the election infrastructure is because the cities and the counties and the states run it and they have no resources to defend themselves. Most of those folks are two dgus and a dog in the back room. They have a printer and fire wall and they get coffee in the morning. They have no capability to do anything. Thats where ransomware is so successful against them. There are over 250 successful Ransomware Attacks against counties and cities and states in the last five years. Most of those leaders elected to pay the ransom because they dont have the resources to prevent it from happening in the first place or to install backup systems to they wont be affected by it. So they pay the ransom so the bad guys said, oh, thats going to be work. I have to keep hitting the cities. The theyre going to pay it. We have to find a way as a nation to provide those cities, counties and states resources to prevent these kinds of things from happening. I want to take this moment just to remind everybody that send in your questions. Well be taking some questions from all of you. That will be magically appearing on my little ipad here. Come back to ricks point before that some of what is seen in the private sector doesnt immediately trusted and acted on by the u. S. Government. You as well. In other words there are two ways of sharing a operation. Well, so i would say theres not full trust both ways. The and i would also try not to lump up every type of information under a broad information sharing umbrella and say that the same sort of criticism applies to all of those. I think that you talked about the radars which i love. Ive been on a soapbox. Its not just the radar of our Intel Community that we need to develop. Its the radar that we need to get the private sector and government to take action and they also have a radar for learning us. And how do we kind of coordinate that . When we were first developing our automated indicator sharing system, everybody sort of went into it with this, well, you know, its cyber. We have to do, you know, they use different terms. Machine speeds, cyber speed, super fast. And real time. And if we just find a way to automate indicators, well get rid of all of this noise that everybody has to deal with. If you think about it, if im delivering a feed, which we are now, we deliver the automated sharing feeds to hundreds of organizations, the amount of trust that organization has to have in my feed to automate, not just the injust but the actual action, the blocking action of a my feed, thats a lot of trust. And so when were talking about automation, i think theres a lot of improvement that has been made in were talking about some of the contextual questions. Will you open the systems to dhs and fbi so we can understand and better understand whats going on . We open up and have conversations with the Intelligence Community and the private sector. Those are actually significantly advanceded. I feel like with he have mutually learned a lot as a result. The automation one is really going to take a lot more work to build the trust in the system. Were going to make some changes in ours because we got good feedback. Heres some, you know, specific tactical things that will be useful so we can know how confident are you about this . What is, you know, os are you concerned about . Those sorts of things. With he can make some changes in it. But really when we Start Talking about automation, you really have to get into the weeds with your partner and you have to really have honest conversations about what would it take. I dont just need you to automate the injust. I need you to automate the actual actions and i need it to start to spread to as many people as possible so that were all blocking whatever it is one person put in there. So its actually much more complicated than i think anyone envisioned. I think theres the Cyber Threat Alliance worked really, really closely with and were trying to push the bounds on the things the government shares. Theres still a lot of lawyers that get involved in conversations. So there is still a lot of things that the government has to push beyond in order to be fully open in this kind of Public Private partnership that were trying to get to. St. We have this argument all the time. We want to limit the things with he share. It gets easier to do. Were talking about 50 groups, 250 techniques. With he dont care who you think it was. We dont care. None of that matters. What mat serz that subset of intelligence so that the security vendors who we all have in our networks can actually deploy the prevention controls automatically. We actually also attack framework for those not familiar, it is really g were using it internally. And were starting to align much of our products and capabilities against it because it really allows you to start to narrow down if this thing is happening and very prevalent, could i deploy Technical Solutions . Should i depli a policy . What are things i can do against that . And the more people that start orienting around this framework and the Cybersecurity Community at least, i think it provides us with a common lexicon for how were passing that and that will help the automation. The take way, please use the minor tack framework. I will tell you that the cities, states and counties, stle no th no controls. This gets to a question i was going to ask tonya what stru. What struck me in texas and the cities and states that have had these Ransomware Attacks, so far do not look to us to be state attacks but rather individuals, maybe foreigners who are in this for the money. When you went to the states, we went to the municipalities or the School Districts or where ever it was and you say let me talk to your cyberSecurity Officer so that we could, you know, discuss how you might have the automated response here. We would say, we dont have an id person. Or we have a part time it person. Or in the texas case, it actually looked like it was spread to a Law Enforcement network that seemed to be a trusted network. So while were up here discussing automating it, you got, as rick points out, a set of targets out here who dont even have the basic infrastructure. Right. That is another target. Theyre the target. Right. What was your question . What is the victims you have of automation when someone calls the fbi and says can you come in and help us and the crowd said what can cities and counties prevent from being frozen out of the networks by hackers seeking ransom . Right. So what might actually surprise you is that if you look at the statistics from the fbis ibt net crime complaint center, i see three. The sheer number of Ransomware Attacks has gone down year over year. That is an incomplete statistics. Were relying on what victims actually report into us. But the trend line were seeing is that theyre becoming more sophisticated and targeted and less open opportunistic. A profit motivated criminal may have just targeted any opportunity, anyone with weak network security. Now theyre being much more targeted and looking at from what we can tell, the victims who are most likely to pay, who have the highest incentive to pay, who cant afford down time because the files and networks have been incrypted and that is municipalities, hospitals, targets like that which of course, raises the impact of the threat. We have a history of looking at not just individual criminals but criminal enterprises. How do you target the key nodes that are enable criminal activity at scale thaernrather focus on the low hanging fruit which may give you impact but doesnt have the larger impact you want on the overall threat. Thats how were approaching the ransomware strains. This is where we had to adapt our traditional model where we have 56 field offices scattered throughout the country that focus on a range of crimes in their geographical area with Cyber Threats and Something Like ransomware, that doesnt scale. You cant have 200 investigations open across the country on one strain of ransomware that is infecting that many victims. So what we do is we designate a single field office that is subject matter and expert and lead in investigating and finding those responsible for those most prevalent strains and then all the intelligence and information feeds into that main office and with support from headquarters, they get with other partners in the Intelligence Community, thats how we identify what is responsible. And then sequence actions among us which could be with our partners here. It could would be foreign Law Enforcement it could be with the about it coin wallets that theyre using and we look at what sequence of actions is most likely to disrupt and take down this activity . Tonya, do this by example if you can. I understand its on going. Youre limited. But in the texas case that youve seen, there seemed to be a single strain that you saw here. It was a strain that we have only seen since april. Tell us how you dealt with that. Ill tell you an example i can talk about in more detail, the Samsam Ransomware which 2015 to 2018 infected hundreds of victims worldwide. Exactly that type of victim that i mentioned, the city of atlanta was one. They got the most press. Because the amount it cost them to remediate far outstripped the ransom that was being charged. Let me just can i take an aside here. I keep seeing in the press that there is confusion over what the fbis position is over paying ransoms. So let me be unequivocal. We do not recommend paying the ransom. You dont know who the money is going to. You dont know what type of additional criminal activity it might fund. There is no guarantee youll get your files decrypted. And it encourages this activity. You saw a town in florida announcing they were paying the ransomware and in baltimore theyre up to 18 million and climbing and far in excess of, as you say, what the ransom was. Yes. While i hear the fbi washing, i would way the economic signal is running in the other direction. Hopefully its highly regrettable for those municipalities and other viction that faced at their very difficult position. But that is a signal with regards to defenses which is part of your original question in terms of making sure youre maintaining off line backups so that your backups that youre creating of the networks are not connected to your system and those cant be incrypted as well. Educating your workforce on the common ways in which ransomware is enabled through spear fishing and other means, to educate them to prevent those types of infections. And then coming back to your question about how we organize around it. So in that samsam case i mentioned that had such a global impact, we had the individual offices responding to particular victims. Were collecting evidence. Were trying to gain the nuggets to help us identify how the ransomware is working. There were foreign victims as well. So were using our oversea cyber leg groups to engage with those victims. Long story short, all of that information comes together and then we turn to our partners to help us with the puzzle. In this case, we worked with private sector Virtual Currency experts who were able to help us trace the bitcoin wallets being used by the adversaries and we identified two individuals who looked to be responsible. They happen to be located in iran this is around the time when the u. S. Government was decide wl deciding to stay in the jcpoa. There was a high level of interest knowing whether these iranian individuals that had had impacted u. S. Cities, a port, and other targets were acting as individual criminalors on behalf of the iranian government. This is where we turn to the other ic partners. What do we collectively know about the individuals . And there is a back and forth. Based on the nalgs of that collective of agencies, were able to determine a few key things. Much of the activity is conducted in off hours. So likely not part as someones day job. They also had some extravagant travel. And they just come into a lot of money personally. And one had recently been fired from a government affiliated job job. So that led us to the conclusion that they were acting as individuals. Treasury and through sanctions against the individuals. As well as some of the entities that were enabling the Virtual Currency and use bitcoin wallets. With uns thonce that indictment publicly announced, all the malicious activity ceased. So that is a snapshot of not only how we deal with ransomware but how that woven fabric i mentioned at the outset each of the different pieces and private sector and government bringing their capabilities and authorities and expertise can blend together. Thank you. We have two questions from our audience here that are related and directed to you. The first one is will cyber warfare eventually lead to the demise of the war . Because why would you place ones forces athe risk to destroy an adversary when can you use cyber tools to paralyze it . And then a relateded question that came in. Asks whether or not well, cyber conflict is portrayed as a short of war operation f the u. S. Was to engage in a shooting war with an adversary, what kind of Cyber Attacks could we anticipate as a compliment to battlefield operations . How would the fbi be prepared to fix critical information . So i cyber gives options. Its additional options to a commander. And as we looked at some of the cyber offensive Cyberspace Operations weve conducted, some cases you could have conducted a strike. Some cases cyberspace operation was conducted in conjunction with a kinetic strike. My responsibility is to provide my commanders that i support the full range of options. And then make recommendations on how to best integrate the capabilities that i provide. Some cases unique capabilities to compliment what theyre trying to accomplish. So i dont, again, i think this idea this is a binary, you know, capability, you have cyber and you can bring your adversary to your knees i often remind people in the early days after the invention of the airplane, people thought air war was going to be separated from everything other kind. And we learned otherwise. But we find against some targets that cyber gives very good capabilities, creates very important effects for a commander. And in competition short of war, short of conflict, then i think cyber as part of, again, that whole range of capabilities of a nation state and diplomatic information, et cetera, et cetera, right on down the line. That i want to be able to provide leadership options and sometimes they may choose cyber option. Sometimes they may not for a variety of reasons. Dhs has primary responsible for cyber protection. Until we hit a magic point where an tack is so big, you get to call the general and say its your problem now. The question is where do you step in in protection of infrastructure when youre actually moving from the day to day low level conflict to something more heightened . I would say this is not yet clearly defined. I think there is preparedness, bucket of pro vengs aevention a of them need work. And how does that actually work within the government . We issued some doctrine, all of us together, putting that out. But on the preparedness side, it is understanding from an adversary perspective, what do we know if year in escalation of tensions. How would they seek to target . What functions . What entities . And so how are we with that knowledge focused on and building more resilience and hardening the systems . And then that gets into more of what i call on the prevention is how are we tuning our collective and warning capabilities and when things happen differently on the geo political side and tensions start to escalate, we know how to shift our, again, pointing to rick as i have a private sector representative. Sort of collectively everybody who is involved in having visibility or ownership over the critical functions would sort of, you know, escalate in the level of alertness and how are we getting that information . So that if whether it is cyber com or other intelligence entities or partners are able to say okay, you and whatever country are starting to get towards a war. Heres the sorts of alerts and warnings with he need to start putting out. Weve seen them try to do something. Lets go act. Then something does happen. En that youre talking about everything up to an actual declared war and something does happen. An adversary has done something within the United States. Were still the lead for leading the response within the United States. We have a National Response plan. But we have now done several xer s exercises. There are a lot of gaps in seeking emergency doctrine from a cyber perspective. Im just being very blunt. This is something we really to work on. Now when were in a state of war and our soldiers are out fighting overseas, were still in the homeland working with north com to protect the United States. So there is really no sort of its not my problem, its now your problem. At that point its everybodys problem. Still everybodys problem. Rick, were going to give you the last word here because somebodys asked what are the cyber function thats are most right for auto make but which today are not . It strikes me that this situation were discussing would be one of the most right. Its very practical and its coming up with the standard of how you put the information together. The Cyber Threat Alliances come up with the adversary play boom which is basically the minor attack techniques and procedures plus indicators of compromise plus a little context. Written package so six helps you automate stuff. So we share that with each other. We can get the entire world on that standard, it becomes easier to automate these kinds of things. Well, we are not out of questions but we are out of time. I want to thank all four of you for whats been a really rich conversation. And really appreciate it. I thank all of you for your great questions. Awesome. Thank you. Week nights this week, were featuring American History tv programs as a preview of what is available every weekend on cspan3. Tonight, gary adelman of the American Battlefield trust covers the whole civil war in 56 minutes. This talk kicks off a nice of programs from a getiesberg heritage center. You can see it tonight at 8 00 eastern here on cspan3 and enjoy American History tv this week and every weekend on cspan3. In his first public remarks since leaving the trump administration, john bolton talked about north korea. He said military force needs to be on the table. One is the possibility limited though it may be of regime change in north korea. Second, we should look at and zous zus with china and we should have done it long ago aiming toward the reunification of the peninsula under a freely elected government like that in south korea. And third, if you believe, and you may not, that it is unacceptable for north korea to have Nuclear Weapons, at some Point Military force has to be an option. Now this is obviously the most controversial subject and many people say its just unimaginable. Unimaginable that you would use military force. So let me quote to you the words of general joe denfer, the chairman of the joint chiefs of staff on his last day, i might say as chairman. Hes done an outstanding job. He said this to the Aspen Institute seminar in the summer of 2018. On this question of whats unimaginable. General said, as i told my counterparts, both friend and foe, it is not unimaginable to have military options to respond to north Koreas Nuclear capability. What is unimaginable to me is allowing the capability to allow Nuclear Weapons to land in denver, colorado. My job will be to develop military options to make sure that doesnt happen. I think general dunnford is completely correct. You can see the full speech in washington, d. C. Well visit for you tonight starting at 8 00 eastern on cspan. The house will be in order. For 40 years, cspan has been providing america unfiltered coverage of congress. The white house, the supreme court, and Public Policy events from washington, d. C. , and around the country. So you can make up your own mind. Created by cable in 1979. Cspan is brought you to by your local cable or satellite provider. Cspan, your unfiltered view of government. Zblfr t the center is recommending how the u. S. Should respond to smuggling migrants into the u. S. For work. The panelists discuss policy changes to address the issue through governmental and ngo