Transcripts For CSPAN Road To The White House 20121119

The fy tall part of the answer. But winning abroad actually begins at home. Our country will only rise if we let our people rise. If we break aspiration and those who wanted to get on in life that means sorting out our welfare system and education because the most powerful Natural Resources we have are our people. I took the whole cabinet today to an Academy School in bristol to show the transformation we need in our Education System right across country. We need schools with high standards and High Expectations so all our children get a proper start in this new competitive world. Of course, we also need to deal with the deaf so it we can safeguard low Interest Rates and give businesses the confidence to invest in britain and to create jobs for our people. And we need to reba lance our economy, to expand our private sector. That is why were Cutting Corporation tax rates to the lowest. Its why weve introduced system of the most generous tax breaks in startups available anywhere in the world and its why weve got a paid in box so you only pay 10 tax on intellectual property you exemployed here in the u. K. But building a truly aspirational economy requires Something Else even more fundamental to restore our competitiveness. I have long believed together with michael hassellcline and others that reducing tax, cutting regular collation thats not enough. We need a more strategic, modern approach to maintain our global comparive advantage and make the most of it. We need what i call a modern industrial strategy. Not keeping dead industries on life support like the industrial strategy of the 19 0s but supporting companies where we have a Competitive Edge and encouraging the High Growth Industries and companies of the future. Creating an ambitious, coordinated and muscular approach to government which allows them to fluorescentish. Let me give you a couple of examples. We have a comparative advantage in pharmaceuticals in life sciences. So weve created 180 Million Pound to bridge that gap between the laboratory and the market to create the next generation of world beating fecknologies and medicines and our actions are drawing millions of investments from the private sector. We have great resources in energy. So in energy, weve committed a billion pounds for Carbon Capture and storage one of the key technologies of the future. Weve created the worlds first Green Investment bank. Were pioneering a new incentive for renewable heat systems in peoples homes. And were putting in place a robust framework to incentivize renewable electricity. As a result more than 12 billion pounds have been committed to new renewable projects in the u. K. In the past 18 months alone with the potential to support around 20,000 new jobs. Weve also created new incentives to squeeze more oil and gas out of the north sea including from those marginal fields. Look at the way we got behind tech city right here in london. Two years ago, they were arent around 200 Digital Companies in shortage. Today there are 1,200. And with Major Tech Companies like amazon, and facebook developing developing centers this has been the Fastest Growing Technology Cluster all around the world. Well be publicish publishing articles next year with more to come this Government Action is vital if britain is to win in the global race. But a modern industrial strategy will only truly work if it addresses a number of vital issues. First, pursuing a modern industrial strategy does not mean being antifinance. Tell me this which sector, which single sector of our economy contributed from all government revenue even from the recession . Which sector has a balance surplus with the rest of the world world more than 600 Million Pounds . And of course, it is our Financial Services. Terrible mistakes were made and they immediate to be addressed properly so they can never happen again. But those who think the answer is just to trash the banks would end up trashing britain. I say recognize the enormous strength and potential of our financial sector, regulate it properly then get behind it. Now, that is why were taking tough action. Tough, civil and criminal penalties for those who break the law. The most transparent rules of any Financial Center anywhere in the world. And a Proper Program that clear up the regulatory mess including Retail Banking to protect it from the risks of investment banking. Put simply as marvin king has said we need a regime where banks can fail without the need for taxpayers to bail them out. We are also standing up for our Financial Services sector in europe. The city of europe someone of the e. U. s biggest assets. And it play as crucial role in fueling the whole of the European Union economy. So we will fight for rules which deliver open markets, competitiveness and new Market Access opportunities globally. And yes, while we support the need for greater integration within the euro zone including through a Banking Union, make no mistake, we will never allow Banking Union to compromise our fair access to the single market. So modern industrial strategy must utilize our greatest strength and that includes our Financial Services. Second, we must support all sectors of the economy where we have a comparative advantage and that includes defense. Now, i understand why some people are a bit squeamish about ministers flying off around the world to help our Defense Industry do deals abroad. But let me say this britain has the most rigorous arms export licensing regime in the whole world. And that is how it will stay. But there is a more fundamental point here. Every country in our world has a right to selfdefense. And you cannot expect every country to be selfsufficient in providing the tanks and ships that are required. Some when britain has a very strong Defense Industry with 300,000 jobs depending on it, its righting that we should be at the forefront of this market supporting british jobs and british allies. Thats why last week in the gulf, i was pushing for null contracts for typhoon jets worth billions of pounds and thousands of british jobs. That is vital new business for britain and i make no apology for going out there and trying to help win it. Third, the modern industrial strategy cannot just be about backing the incumbents, the established companies. It needs to unleash the power of the insurjenlts, the new kids on the block. 95 of all new jobs in america come from companys that are less than five years olds. U. K. Research shows that the 6th of companies with the fastest growth rate, they generate over half of all the new jobs. Yet government policy here has long bin laden stacked against the high growth startups. When i became Prime Minister yet government policy here has long been stacked against the high growth startups. I. T. Spending went to seven multinational companies. Now, we are changing all that, tearing up the rules and opening up Government Procurement to startups, spending hundreds of millions with Venture Capital investments and were working with the London Stock Exchange to make it easier for insurgent companies from right across europe to float here in london because that is is a vital part of how we attract the entrepreneurial businesses and investors who will generate the job and the growth that we need. Now, fourth, there are those who think that a modern industrial strategy is just about empowering the regions. Yes, our country has become far too centralized. And with city deals and proper business partnerships, were changing that. But we need Bold National decisions too. Whether it is cross rail, high speed too, new Nuclear Power stations, all the process weve established to make one of the biggest decisions of all how best to get the airport capacity we need for the future. We also need National Decisions to kick start in key sectors just like with the Green Investment bank and the Business Bank to get lending moving for s. M. E. s. At the heart of a modern successful strategy is the veening power of National Government to get behind what works and to position our key sectors. So they have the best chance of winning in the global race. Now finally, we must never let as some countries do a modern industrial strategy be a cover for protectionism. I know that some people look at, for instance, tartar taking over jaguar or land rover and ask shouldnt we do something to stop it . The answer is no, we should not. One of britains great u. S. Piece, one of our great sales proposition is our openness and this openness is a vital part of our modern industrial strategy. The fact that we are such an open economy is a calling card for britain all over the world and internationally recognized. Foreign investment creates jobs and wealth and growth. And far from weakening our base the investment actually strengthens it. Look at our car industry. Japanese investment. Foreign investment is positively beneficial for british jobs in manufacturing and for the reba lansing of our economy that is so essential. And there is a similarly positive story on trade too. More free trade will mean more growth thats why im determined to leading new International Trade agreements that will benefit britain inincluding e. U. Deals with the u. S. And japan in the next year. Free trade in in our d. N. A. And with all the institutions and Legal Expertise here in london, were not just a great country to trade with, we can also be a country of choice for others to trade in creating yet more growth and jobs for britain. So here we are in the heart of the city of london which has always been brilliant at innovating, which has always stayed one step ahead from lloyds of london the worlds first Insurance Market frp trading in the 17th century. From the developing of Global Equities trading to the biggest Islamic Finance Center outside the islamic world. From the western hop to the remnant b to the social investment fund. Youre always one step ahead and thats the way it should stay. Time and again the city of london has led the world and i know you can do so again. And frankly, it is this pioneering, buccaneering spirit that will define the success of britains industrial strategy. Playing to our strengths, working out our advantages, unapologetic about backing business big and small. This is how together we will ensure that britain thrives and wins in this global race. Thank you. [applause] thele average new facebook use ser in indonesia, india or brazil right now. Theyre using a mobile phone primarily to access it because they havent had an access to a broadband p. C. Or laptop. There isnt an infrastructure of media that you have in the u. S. So a lot of americans will meet me and say facebook is combreat for gossiping and see what my friends are eating for lunch. But if you were to talk to somebody in the middle east youd hear a different story which is that facebook was providing access to news to people that had unique access to information that they werent able to get it otherwise and you get a much more sort of meaty story about what facebook means to them. More from facebook engineer chris cox with an insiders view of the company, thanksgiving day on cspan. At 12 00 chief Justice John Roberts and at 10 ooh, we pay tribute to Neil Armstrong just before 11 00. Live coverage here tomorrow on cspan. Well look at immigration policy at the American Enterprise institute. Speakers include richard lamb of the sournl baptist convention. Thats at sock a. M. Eastern. Then the c. E. O. Of the new york Stock Exchange talks about the fiscal cliff. Hosted by the brookings intuition thats at 1 00 p. M. Eastern. Tomorrow night former abc News Reporter and anchor ted koppel talks about the future of network news. This is part of the series and its on at 8 00 p. M. Eastern. Next c. I. A. Security director Mary Rose Mccaffrey talks about Cyber Threats to National Security. Shes the first female director of security for any u. S. Intelligence agency. Her remarks are about an hour. All right. If we could make our way to our seats, please. All right. Welcome back to if eighth annual Global Security symposium here at the arnott Call University in prescott, arizona. Im an assistant professor anded with the studies. Its my distinct pleasure to introduce an important woman not just because shes a woman but because of her position in the intelligence and security world today, ms. Mary rose mccaffrey. She was named the director for the Central Intelligence agency in 20111. Prior to this she was the director for the c. I. A. , not the Culinary Institute of america, of course but the Central Intelligence agget sit. Director of the Intelligent Unit in the National Reconnaissance office. She has had many tours and stops from the d. O. D. Of the department of defense, United States navy and the director of national intelligence. She has worked matters related to security, policy analysis, operations, you name it the litany of the security business. She went to a smalm school in vermont st. Michaels college if im saying that correctly which means she is a purple knight. Please give her a warm round a very exciting moment for our university for miss mary mccaffrey. [applause] well, first can everybody hear me . Yes. I was asking mr. Finston if everybody thought i was giving out halloween candy. First i want to thank each and every one of you today. Know that school is more important than listening to me. Two who came from the industry, thank you for taking time out of your busy day. I have had an absolutely extraordinary moment with your students. First and foremost i am very optimistic about our future because each and every one of you give me great faith that whatever challenge is the Intelligence Community, the National Security of the United States is safe. We are well poised and postured to deter them and figure out a solution. So thank you very much for the invitation. Second point for those of you is even in the Intelligence Community, they actually are getting to a point in time where the gender bias is being corrected. I am after 65 years the first female director of security for any Community Intelligence agency. So [applause] so as many of you had asked, you know, that when we were asking you what you wanted to do with your life just two words of wisdom. My parents died before they knew i had a real job because i kept moving jobs. So when i tell you its just a stop on the way if you give whatever your employer is 100 of your passion of your work ethic and contributing to their mission you will always be happy and your next job will find you brve you find it. So fear not. Theres a long road ahead of you. Most importantly, i am absolutely thrilled to be here to your National Security, symposium. Aplaud academic institutions like embry riddle for sponsoring such an event. Many of you know that Cyber Intelligence is just a new world of intelligence for the community. National security is absolutely critical to the United States defense, to our ability to operate globally and at universities like this will help us get to where we need to be. The skills we need tomorrow are very different than the kills we have today. And than the skills we have today. And thats exactly why i was asked to join you today. You will develop us help us develop the next Cyber Security. And you will help us protect our infrastructure. Cyber attacks have increased over the last decade. I can tell you for a fact that the c. I. A. Gov gets a million hits a year thats a lot of people trying to come into your system for bood or bad purposes. These happen to be not so bad purposes. Your development of becoming a professional in this business will absolutely be fundamental to our future. So when youre having a hard time with the professor, with the course, everyone of your professors is there to help you success. Youre internalships your coops and you keep looking for the stars because you will find it. So let me step back a little bit because were talking about cyber today. And were talking about National Security in the 21st century. But i need to give you a little bit of history of why cyber is so critical. If you remember world war ii was the turning point for us. You know, december th, 1941 was the day of infamy. Mest of you in this room are too young to remember when your parents or your grand parents probably are not too young to remember when we used to have drigged. The alarms would go off and you would get into your desk. This thing called a Nuclear Threat was a problem. But the cold war focused on russia and the United States. So fast forward. You have vietnam. Vietnam san adventure on to itself in terms of north and south vietnam. Many of you in this room may have served in vietnam. Then you moved fast forward and we were going have russia. The berlin wall came down and we were going to get some benefits of that peace dividends. Peace was not big run rush it was a multiple stand. Pick a stand. They became a challenge in stability of government, stability of resources and stability of the data we knew about those particular companies. Move on forward, 9 11 happens. Every one of you remember when you were. I was on the steps of the pentagon. I little literally walked out of the building that day. I was there for a meeting. I remember hearing on that gorgeous blue day an absolute eerie sound. It was like a plane had taken a wrong turn. I didnt know it was a plane because planes go up and down the potomac river. I am of the bottom of the stairs. The plane hit the building. I did not know where i was sitting that two other planes could have hit the world trade center. We have cnn or cspan trailing but we didnt visit on. Well, my first reaction, funny, we all have selfreservation. I just ripped my panty hose. My second reaction is holy smokes theres a lot of smoke coming out of that building. One of things i dont like about if pentagon is you have very few parking. From that point on, ladies and gentlemen, our world and the United States and around the world has changed. Thats where we move forward to todays event because cyber has taken a huge role and place in that world since. So very soon after 911, the United States started a global war in europe. Started in afghanistan went to iraq, and is now in the military. There are huge challenges about stabilities of government and stabilities of our roles in those countries. We will continue to address what needs to be done in that environment. None of that is done without our dependence and our environmentment in the cyber world. The cyber domain and each and every one of us have become inseparable. Tegnonk drives everything we do. Technology drives everything we do. It resides in private sector. Let me repeat that. The vast majority of our infrastructure in the United States resides in the private sector. The National Security risks and the Economic Risks are still with the private sector. Remember the government doesnt do it alone. Our partners are the private sector. Whether you work for the government or you work for private sector you can contribute no matter where you are. In whatever professional desire is. Its private sectors, holds as lot of data. And theyre protection to the United States priorities is of a national important. The president declared recent lip and i quote. This is in the top five. The cyber threat is one of the most serious economic and National Security challenges we face as a nation and americas Economic Prosperity in the sunshinery century depends on that. We have more information than most countries of the world. Well hear why thats important a little bit later. The c. I. A. s primary job. If you ask the new james bond movie is out. Its not quite like that. The c. I. A. s primary role in the protection of our own systems is paramount. But our real primary world in the sishe world is to inform the policymaker and to enform the Decision Makers on what theyre to do next. We determine capability, intent and we conduct analysis in classified and the cyber environment to enforce the policymakers. In the u. S. Government there are four big players. D. H. S. , department of Homeland Security is responsible for the intrastructure. The fibble does have the Law Enforcement peace. You know exactly why that have the Law Enforcement line peace. He has the psycher command to drive the infrastructure by which were going to deploy there. C. I. A. Doesnt do that work but we cant do our work without collaborating and working with them. Despite the fact no matter what the news says, we dont do this alone. We co it with the private partners. C. I. A. Does partner with our agency. We partner with all of these agencies to get the best match for the person because remember, were investing in the future and the future is you. At some point i will say im going beat us. Its important to get the officer we can for the challenge we have. We recognize that we dont hold all the chris cal information and we recognize that the partnership in government, public, private, Law Enforcement. Many of you probably never heard those words prior to 911 because for all the facts we didnt necessarily worry about that. Nba did stuff really well. D. O. D. Does stuff really well. But now we cant afford to separate differently. Having been in the business, i can tell you that the partnerships have been absolutely critical to each of our individual successes. We have to operate in a fed rated approach to ensure we secure the infrastructure. We have to support Corporation Education awareness. Any time there is a crisis around the world did they communicate with one another . Did policymakers and Ticket Agency as sha van said, did that talk to one another. And theyre talking pretty regular liss. We have to rely upon one another because theres not infinite money, infinite opportunity to put the problem set in front of every agency. But if you put the problem set in front of them all and they all work their piece you get a better end product. You have to what we share, how we share it and when we share it is absolutely just in time. You can motte afford to have somebody find out information after the fact. Monday morning quarterbacks are absolutely famous in washington. You also have to remember that each of these agencies in the direct tor of National Security. There are 16 agencies who all have a specific punks specific missions to do. Oftentimes one of the questions i will get from audience is in the business of intelligence since specifically for her being the director, what keeps you up at nine. Well, theres a lot. Lady revlon is sa wonderful thing but the reality is im always worried about people because it doesnt matter what you do. Everything we do involves people. And so im always worried about people in harms way. My second big worry, i will tell you is cyber. In the last 10 years, i have been called out of bed more times because somebody had every one in a while we have to figure out. Cyber worries me. Every one of you has least one stone. Its a wonderful tool. But i will tell youll those tools can be used to our benefit. So we are worried about that. We spend a lot of time and effort protecting our met work, protecting fat which we consider the crown jewel because in c. I. A. s business which is collecting human intelligence. If it does get exposed people are affects. And thats not a good thing. So she might come. Probably meteorologist a gold. But its probably growing as fast. You got to put it in perspective. Potentially profiting business. If youre a Banking Industry why work about your competitor. And you can put something on their essence. It is just an extension of espionage for us. This is the clan december tinl con sen bration. Our integrity and the availability of our systems and our data. I think we all know and no matter what movie youve seen if youve never seen any movies, how devastating. The impact to our national would be. If certain information fell into the wrong hands and happened post wikileaks. We also mo the challenges we face in protecting this information. It is not an e easy pete given the level of both the technology or adversaries. Something is having a good day. Lets see if i can do this. So who are theired a vowskerees. They can be single and have we talked about we have four teams or the special agent was talking about this morning about damn nouse. Theyre like an abieba. They can change deposit pendsing spon, whats the words i want . Depending upon the sflaver of the day. Thats probably the best way you can say it. How much money do you think would be lost if the drug carpels cartels went out of business . Its a very proisting business. The cyber stuff. We have nonstate sponsored organization. Think about the air of upriding last summer. Start it with a fruit vendor and tuna, a single fruit vendor. If he was tired of getting shaken down by the local, what i would call guy on the corcher because he had the same spot, he supported a family. His father had been killed and he supported his candy by selling prute every day. You know what, they took more money. Every time they got a bad take they would put it in the bill. And he got tired of it one kay. And this is the power of one. And he lit himself on fire and he started an uprising. And every one of those countrys that figured if he could do it, we could do it. Did. Fear later. Think about it. You know, awe catic government. Were overthrown by the power of one. And it was all via cell phone. So think about that. Some of the folks didnt have Running Water. So its really porcht to important to understand the power of what technology can do both for good and for back. We have a lot of these folks trying to disrespect u. S. Networks. And thats not just thats u. S. Networkings. Every one of the country, honeywell, raytheon, pick a big defense company. The information is protected on those networks. They build things. Everyone in knows it was a capability. They can leverage and repackage publically available tools. Some of the students were showing us some of the tools that theyre available. We can do a combreat deal of harm. They have an under Ground Community thats better than mote. They make system of the luggage loads new exploits to things that any whether the u. S. Government has been able to defend and deter. As the speakers this morning told you, the reality is our job is to anticipate, but when you cannot it you have to figure out how do i get joined whether its a signature base, a tool base, a spear fishing. How do i get behind it. And if i cant get onit how do i defend against it at my mex work. They use a lot of information that we produce. Your companies, the Intelligence Community, the open source information, social media on facebook and twitter. I have a 23yearold niese who just got out of college and just got a jofpblet and i sent her a message on facebook and she said thats so lame rosie. Its instagram. Oh, man am i getting old. But think about it. You dont call your parents. And your parents sure as heck dont call you. Right folks . I seed some nodding heads. Remember alaska using facebook, twitter and instagram as a wonderful recruiting tool. Do you know who youre talking to on those networks. Just think about it. When the special agent said were anonymous, can we play . Just think about it. They use forms like this. There is not one dale where i dont get ooh lengthing in request. If i dont know you i ant clicking. They use technology. The mini little ipad just came out. Thats a good deal. Think of all the people that were in that room that may not have been part of apple. People like apple, google, face book. Man, they protect their tech nology. They were tell meg that when a new product comes out they dont see it until the day the rest of the world series. Then they hurried to get the guy out of the street that necknology is go ahead. They have to pay real close attention for protecting it. They use academics. A far number of people we have the best School Systems in the world ladies and gentlemen. They use commercial enterprises. Theres a lot of Shadow Companies out there. A lot of people who think youre buying something but youre really buying something es. Or theyre buying your information and then selling it. They stay on the speck trupt most motives. They can be technology. Can you imagine if somebody got this technology that they wouldnt have to spend the bills onon defense and intelligence and just commercial products. Ment in the end, how is it . All in much. They were talking about the ok buy wall street. I have a tendency to have a fair amount of time at the white house. There are times that its not a great play to go through. It was literally right across from there. So you had to go buy these poem before you went to work every day. And it was just it was an adventure. And there are, you know, their gold may start very intent but december instruction. The damages to the infrastructure of the city of washington, d. C. Was greater than their on occupation. Population that thesed a ver zaireries go after, but they also go after people. Last week we had an event at c. I. A. Whether we all got notified that you know, our names and our c. I. A. Government. Had been pulled together by a particular thing. They started to tie to do some target target me. But for some other people thats a real problem. Theyll gol after the easy stuff but theyll also go after the hard things. Theyll go after delsh they think they can get a big bang for the buck. So theyre going to gather everything they can. Its easier to scoop it up. Its only until the exploit around the bottom tells you whats on that sat light but these guys can scoom um a lot of information. So private industry supports the government in information we do. Nowtial we have a whole series of laws, directors that require us to protect our data. By the way theres the bottom line. They do go after industry. They go after political groups. They go after on the news, its political season. Seven days away grr an election and the worlds just crazy on that. Theyre going to go after single individuals if they can fert something. They went after a kingle individuals a day. So they went after them that becomes a real problem because theyre family. It starteds innocent but it doesnt always end innocent. Some of the ways that c. I. A. Has to worry about is two primarily. We worry about Computer Network and exploitation. The reason i said that the network exploitation, i spent a lot of time and money. They equate Computer Network at our espionage. That becomes a port. They want to break in, steal, or mad fy the information that we have on our. Is they seek, you know, not attributed about. They have access to our data. Wouldnt it be nice if someone knew what the director or the president were going to do before he was going to do it. Technology shift give every one of the companies who build aplineses who build operating system. Heres always the first. And in every version there is a vulnerability. So sometimes those vulnerability ability provide wonderful opportunity first disruption. You can well nadge the u. S. Government works very closely with Companies Like apple. Primarily because everybody uses the technology. Much like when they do. Im try the problem isnt abc. We fixed it. So we have a very robust we have a robust system of network defense. Youll have to get through the line more than normal. We worry about it pretty dramatically. The number of the vices such as your smartphone, your lap to be your ipad. Theyre going to literally exteed 5 combl by 2015. Im not sure that a lot of intrastructure is going to feed that. But those devices well. Motte only in how we ornte and how we work, where we work. Our Computer Network attacked folks. Theyre winning the intel city of our sg or the data. And they share information athe community network. That Commuter Network has like any network somebodys always looking if a whole in it. So they can take that information and use it to a benefit thats not necessarily its intendsed purpose. We get lots of figuring attacks. Here fell you, you know what, you may yall, and everybody who thinks, hes olds. We do fishing and taxes to my employee. Its very often to me but every year click on it. The first year i send him a reminder descending whos who. I want to use the two by four, are you student. For any organization is strong. You know, dont give me bad board. They have to have a strong password. They get a whole set of laundry and how to work in that environment. We manage to have more about people who seem to miss it. System of them are the rocket scientists and theyre busy reating smm. I just didnt any. We have spear fishing that hit a lot of our principles. You all know that d. V. D. H. Petraeus has been our director for a little over the year. He spent a hes so visible that literally every day we scan his computer because he has classified computers and un classified. How does he condition tpwhect all the buddies. He always gets one from some person. He has no idea who they are. Well say, tir, just remember dont click on it. They need me. Im like boss. You just have to everybody gets educated. He has been so educated in this new job. And he is so smart and so busest but even four stars have their own to learn. Half of our populationly overseas. Thats we have a lot of i pads and they kind of put a lot of pieces of data. That may not in and of itself be classified but its their buddies, hidden in the embassy. Its that buddy in the foreign service. Thst theyre buddy that they work with. Attach something to that i phone. Its not something to do. And we and everything on that system then becomes suspect. So we unfornl haughtily have lost. I just killed your sledge huh . Someone got to be a personal friend and somebody picked up in the local government and killed it. You have to understand that our business is not about its a nice vehicle. Thats really important. Everybody is worried about the Service Attack. The biggest impact of the nile Service Attack lately were to the u. S. Financial institutions. Early in october there was a whole bunch of the institutions. They thought it was just a fishing account but it was a pretty concerted denial on multiple banking institutions. Might have been an hour or a couple of days. But those Service Attacks, the backes were not so worried about them because as a bank is not concerned about its own but collectively it has a huge impact. So now all the banks have gone very similar things ha the Intelligence Community hasty. How many of you could not imagine getting to a. T. M. And getting money out or more importantly paying your bills. And thats a real thing. Middle of october. The suspected attackers behind this, theres reporting all over the map. It is a state sponsor. So theres no definitive answer. Were talking trillions of dollars. Each and every one of you probably has aven account. Fargo bank of america, you know, city bank every one of them got affected. Not all of them but they all got affected. Abc recently reported a targeted mall wear attack which were calling minnie fling. So it will go after our director. It will go one of our director who is does a lot of work outside the conversation. And in essence those two kids i talked about, it took about four or five different tools kit. Then it was able to dake screen shots and everything they were doing on that computer. In an environment like this, nobody really cares about it. Thats a pretty big deal. Every day to give the president the daily grief on what world events happened last night. The last thifpk he could adepord is to have someone with that audio capable. So it really in essence takes everything on that computer. So we have some really smart people looking at this. Fortunately for c. I. A. We have ha very good defensive operation. So we have, you know, your best defends is what you learn from europe. And so weve had the luxury of good offenses folks who help us with the defense. And to the military members in the audience you know the same scenario. We have no other concern. We were talking about this at lunch. July june, july, we had a big big storm. Came across the midwest. It was called the low ray rainfall. There was so much wind it was like being in kansas, you know . It was like the wizard of oz movie. What happened late rally the power went out in the midatlantic to three Million People. Thats a lot of people. Now think about this. I work at a pretty prestigious organization. I worked at an organization that has generator, power plants. Our power went out for 24 hours. Now, cant really afford to have the president s eyes and ears power go out for 24. What happens was virginia power who gives us the primary seed had lost power everywhere. And youve come back in an order of priority. Hospitals come first and then theres the whole bunch fortunately, we have the capacity. We have lots of ups. Part of the workforce could work but the others couldnt. And they were working around the clock. I dont think we. I just got power for 10 days. That refrigerator . Gone. The damage in about an hour was pretty devastating. She ought to be cooling. Youre all dependant upon a Computer Network. Every one of you are dependent that operating your system. If somebody wanted to do arm to those, what would be the impact. So think about that. We have a whole population who wants to bring their own desires into the workplace. We dont let you. Yours stay in your car. So we spend lots of now were doing a lot of things to try to overcome that. We have a whole number of wireless things. We have gaggles of i pads. But we do that. We are looking at a mobile environment. But the challenge is when youre taking that ipad what happens to him. Do you trust that the person not handing to someone does not have ill intent. Theres a lot of things that theyre working through. But you think about that which operates your home. Your heat, your power. Theyre pretty critical. You know, they were very concerned a couple of years ago about alaska coming after the power alqaeda coming after america. Theyre they didnt necessarily say that. You know, ive given you a lot of doom and gloom but its not all that. I will tell you and i see some of you in the room, you are the best and the blightest and you are the future. But fire not theres a lot of really smart people that when you will decide both in traditional ways, non traditional ways, and in innovation and technology that will help us develop new defensive platforms and we also have to look at the personnel. The folks we hired 10 years ago are not going to be the folks we need for the future. The folks who got tired when i got hired we all grew up with precomputers, wangs, remember those boxes, and then a series of different technologies. Early days they were just a word processor. That is all it was. I am speaking to each and every one of you today. I will rely upon your talent, you are an annuity, your being able to think and outside the box. Just remember, you can think bedside the box but you have to work in to insure what you are doing balances with the mission of whomever you are working for. It really does matter, let you are building planes for boeing, software for apple, or an app somewhere or working for the u. S. Government. The ability for us to operate securely will be dependent upon you. And it will be dependent on what you bring to the table to inform those that you work for how to get beyond the problem at hand. There is a lot of intelligence partnerships going on today. Are they all they need to be . Nope. There is a lot of private industry sharing today. Is it all it needs to be . Nope. Every time we have an incident, and that is what we call them i have a team that spent a lot of time figuring out a post mortem how did this happen, what was the impact, how do we make sure it does not happen again . To each and every one of them. The real lesson is not that we are not going to get hit, it is that, when you get hit, what do you lose and what do you learned from that . How you ensure you do not hit the same way . Each one of you has learned that lesson in multiple ways in non cyper environments. Noncyber environments. The first time he did not something not so smart and your parents taught you, what did you learn . The first time what did you learn . It is really that what did you learn question that we take from everything we bring to a problem set. We continue, we have to look every attack as a new attack, even if it is an attack we have seen before, we look at it as a new attack. We work across the u. S. Government to ensure that it does not come in waves. Some of our wonderful folks working if you look at some of the activities going on in war zones, bonds due to come in threes. A suicide truck comes up, a bomber comes up, to have to worry about the third. It is it a symbol of that . What do we do to learn from that event . Weekend conduct multiple damage assessments to ensure whether our methods of protection and defense are actor adequate. Sometimes we find out they are not and have to do something about it. Furthermore, we have to strengthen every link in the chain. We were chatting today for 10 years, the supply chain has been a concern to u. S. Government because everything got out sourced in the 1990s and a lot of it outsourced to china. Do you know where the piece comes from, and you know if andfirmware in it and do you know if the firmware in it was modified . We have lots of people working on supply chain. We put our supply chain people, our network defenders, all in a wonderful, what i would call red team black team environments. I was laughing earlier when they showed the lab with the computers. My laptop is not that fancy, but they are the same kind of thing. By attacking ourselves we learn more to be able to defend ourselves. We have to adapt as the u. S. Government in a corrective intelligence based approach by mitigating the element of surprise. I mean, i am not sure we could have never planned on the derecho. The nature is a pretty powerful character, but all other elements of surprise, most of the problems we have are because people do not pay attention. We were talking about passwords there are so many simple things you can do to protect yourself. Encryption, insuring your network is strong, igor links are strong, your links are strong, then when you have a problem you can identify patterns. We informed our partners dhs, fbi, nsa, we sit on all these policy boards so that we can all addressed the problem that is going to take us into the next century. As i said earlier, and i cannot say this enough, our best defense is going to be understanding the offense. As an Intelligence Organization we spend a lot of time in the offensive mode. We collect human intelligence. As we consider ways to address the threat in the 21st century, we have to also understand it is not all technology base. Even out here you all have legislation that drives what you do every day. I would anticipate this year senator collins introduced a Cyber Security bill it was geared toward single owner of all things cyber. Kind of hard when you have a couple Million People working for the government. Working through variations upon a theme, but i think in the end you will see legislation that addresses standards of operating performance, standards of protection, and how each agency does it will be very different but there will be a standard. Like a common definition lexicon there will be standards. Laws that can define acceptable behavior in cyberspace every person on the face of the earth goes to a website that may not be what that website is. They are to checking that out. Sometimes those website can cause a great pose a grave danger. We had to strengthen Law Enforcement possibility to prosecute cyber crime. My colleagues from the fbi and the department of justice will tell you it is a hard thing for them. Yes, they were very successful with anonymous, but cyber crimes are very hard to prove. We have to focus on the defensive posture. We have to focus on people. It is not a robot doing this. It is a human. At c. I. A. I spent a lot of time investigating people. Everyone who works for us has a security clearance. I have embassies you name it. We have a pretty protected enclave. You do not. Industry does not. From a standpoint of humans, their behavior and the trending when you see people we had a young man a couple years ago who went to what he called whitehouse. Gov his employee. If you ever go to a computer it says is monitored that is not in our jobs said. We have to focus on the people. It is the people who put in the keystrokes. We depend upon a trusted work force, secure facilities around the world, and networks that efficiently and robustly get information from point a to point b, and it does not matter whether it is in washington, d. C. , some foreign country, or a mud hut in a war zone. The data has to move, and it is critical that we move it securely and safely. We have to have a robust system of defense. You would be amazed what people do want computers that they do not think anybody is watching. As i tell my employees, nothing a human does will ever surprise me. They think i have seen it all. It is amazing what audits will tell you. You cannot ever have a zero risk. I will tell you you will never be able to mitigate all risk. Because in the end you have to consider three things. What is it you are doing . What is your mission . What is the threat against your mission . How are you going to balance the posture of security in whatever form it is against those two other things . It will never be zero. The United States government and National Security depends upon many agencies doing work they put themselves at risk every day. Every day. To close, we all have a shared responsibility to help reduce the risk of Cyber Attacks personally, professionally, and across the u. S. Government. This means each and every one of you, as one of our speakers this morning said, you are using all the same passwords go change them. If you literally think nobody cares what is on your system, change that mind. Because they do. We are going to need each and every one of you, we are going to need industry, we are going to need academia, we are going to need security and intelligence professionals, and the general public, to help us. We will always be better to gather then we are individually. And to increase our effectiveness as a nation we will need to foster a community, how to deal with this malicious cyber activity. Because it is not reducing. I am honored to have been able to spend time with you. I will take some questions now we have some time. It is my Career Ambition to silence the cia for one second. If you have questions up to this microphone so we can get you clearly on here. Please make your way that way. I left and speechless. [laughter] i knew i could count on somebody. What do you think are the chances of a cyber attack actually leading to a real war . That microphone did not work what do i think that a real cyber attack will lead to a war . I will tell you, the u. S. Government, there will be Cyber Attacks. Will it lead to a war . I do not believe so. There are enough elements of the u. S. Government across the entire government that will help thwart that. There is just war is never the answer if you can do Something Else. Yes, sir . Do they need to be as offensive as you are defensive . Is that a question or is it a comment . How about the rest of the world . Yes, and they are pretty capable at its. That drives a fair amount of the offensive capacity. The rest of the world, as i said, there are countries where there is no Running Water and electricity but there are computers. So stable nation states, you have some posturing. We have lots of allied partners, a liaison partners, but you have to understand what your audience is. For the audience you have to understand what the nation capacity is, there nonstick capacity. That is how we use that. And nonstate capacity. That is how we use it. [inaudible] the u. S. Government does work in partnerships. Although there are lots of media highlights out there that tell us we knew about an attack, we knew about a series of threats we did not know about an attack. There is an accountability review board under way by the department of state that will identify what we knew when, the true facts, and then those will be released. Do you see move from conventional military forces to cyber military forces in the coming era . I would say you are going to see a change you are seeing a change from conventional to a combination of all sources of capability. Will you replace one with the other . Absolutely not. I do not believe will ever replace one with the other. I can tell you that clearly you have so much of the Defense Budget and lots of other tools and you have to use them all. First of all, thank you vey much for being here. Congratulations to an agent at the cia and intelligence who i believe using tiny bits of human intelligence was able after five or six years to locate bin laden. I believe her name was jan. This new legislation concerning Cyber Security does the congress have enough intelligence to go to people like you, industry, the fbi, to listen to what you actually need to improve our cyber defenses, or do they just make it up with a bunch of lawyers and politicians . I am a little sarcastic. You can be sarcastic. I believe that the current Cyber Intelligence has not been able to get through the house and the senate, which then leads you to say that one side believes they do not have the intelligence they need and they will need to compromise. That is not a word that is easily done right now. I will tell you that it will not get signed this year but they are working through 8 and have access to all the information to make a smart decision. In the end. You are more optimistic than i am. Thank you. Get page to be optimistic. I get paid to be optimistic. Yes, sir. My question is, how would you rate the United States cyber offensive and defensive capabilities compared to those of china and the other Major Players in the cyberworld . Are we talking on a one, two, three rating . [laughter] i would say that with the exception of sheer numbers, remember, china has 2 billion people, that our china, russia, both of them spend a fair amount of time on the cyber challenges and the cyber opportunities. They just have a lot more people. It is a baseball game. They have a lot more innings. Yes, sir. You dont have a question, or are you telling me to shut up . You can do that. [laughter] i did not know if there was someone else before. Is it correct that under the current patriot act any kind of information that is in a private company can be accessed from the government for security purposes . Under the patriot act, in that scenario for security purposes, usually the fbi has the lead on that and has the ability to ask the company. In the event of an arrest or prosecution they have the ability to subpoena that information but do not just walking and say i want to all your data. There is a provision that allows them, if they believe the ifa hasnt formation that can help them, if any prosecution, they can subpoena the information. Hello, and thank you for being here. My question is, in recent years Cyber Security has taken a forefront in terms of even in the media. You have the stuxnet taken media by storm, iran, now a nation states are starting to throw it up and forth does that change the way that the Intelligence Industry is operated . Or is it still business as usual, even though it is more in the limelight . I will tell you that it does not change how they do it as much. Literally cyber is another part of the intelligence business. There is a lot in the media there really is a lot in the media. Everybody is informed by that information. Some situations may cause them to change decisions, postures, practices, policy. Some do not. It is really dependent upon the event, who was involved with it, what the issues are. Like the newspaper reporter. You take the event, compare it against that, and you have to make a decision as an organization. To followup, has it at all changed, that it is more small scale attacks . Or potential largescale attacks . Not saying the United States did stuxnet, but largescale attacks in that nature. I would say there are multiple largescale cyber activities in the federal government. My question is, the expanding network we are going to need for our future cell phones, future computers, much of the technology will provide the capacity to provide all this information flowing between those devices is currently provided by not so friendly countries, namely china and countries of that nature. Is that something you guys are actively aware of, and what are some of the things being done about that . Yes, we are completely aware of that is all part of supply chain issues. What are we doing about it . A host of things, none of which i am willing to share in this forum. Good try. [laughter] we have one right there. Your also clean cut. When i went to college, people were not so cleancut. Would you consider the cyber ron to be the greatest threat to our National Security, or would you also consider other things to be of equal importance or equally as threatening . I would tell you is not the greatest threat to our National Security, actually. If you want to know the president worries about, you can go on to the white house and there are a number of parties the consensus of with. At the white house determines priorities we determine priorities. Cyber is not at the top of that list. Ok. One more. Ladies and gentlemen, it has been a pleasure and i thank you very much. [applause] [captioning performed by national captioning institute] [captions Copyright National cable satellite corp. 2012] we continue our look at Cyber Security with professor richard finston. This is an hour. Are right. We are going to continue right along the schedule. Our next speaker is mr. Richard finston, a professor here at embryriddle an aeronautical university. His talk for us is the threat landscape. [applause] ok, you have just seen in the very beginning of what a cyber attack might look like. [laughter] before i start, i have to, aside from this is a really tough act to follow, following the presentation, she was also very insightful. She mentioned to me about an hour ago that really all those people who came in and filled the auditorium were not really coming early to hear me. She was right. [laughter] but okay, there has been a lot of great discussion today so far. A number of things have been brought up. I actually have some data to share with you that might answer some of the questions that popped up before. You have seen the president ial debates so far, all the data and back and forth, there is no one here to argue i think we all feel a little safer. But anyway, with that i would get into it right now. What i will be talking about is the threat landscape. What you are going to see for the next few minutes is the kind of a offering more presentation describing what we are up against. As we get deeper and deeper into it, you will get more and more depressed. But then, toward the and i kind of offer a solution. The first boss i had when i graduated from college and went to where after being there, this was at Hughes Aircraft when Howard Hughes was still alive. I had been working there for two months. , walked in to my bosss office the secretary in front of his office, a Senior Engineer was in there talking to the boss, laying out all these problems and issues. And he felt very proud of himself and sat down and just waited. The department manager, my boss, went right back at him and said, i cannot stand that. It is your job to bring the solutions, not problems. If i have to solve all your problems, i do not need you. Just a word of advice as we move into the industry and our next life, your boss is going to be looking for solutions. Articulate the problem, but no matter what, try to end on a positive note and articulate the solution also. It does not have to be the perfect one or the right one. Many times it will not be. I will and this end this with an upbeat way of what we can do about this big threat. If you walk away with anything today other than the lights going out and coming back on, kind of a basic paradigm that could stick with you it would be of immense value drug or life. Throughout your life. A lock will only keep out an honest man, and that is particularly true in Cyber Security. I was very fortunate as i was asked to construct this presentation here the Government Accounting Office when they were not giving out awards and las vegas were actually doing very good work. One thing they did was reveal Cyber Security threats across the u. S. Government. This is a very recent report. This was published by the gao in april. It is on the internet. You can read it in its totality if you like. They have reports even more current on specific industry segments. But the gao went and looked at the u. S. Government, if you will. Look at the weaknesses at 24 agencies. They are listed here. A bit of an eye test, but it is basically the department of agriculture, education, defense, Homeland Security, energy, commerce, state those major departments. Data was collected from those. Skip ahead for a second . The agency is not recorded are the white house, the Central Intelligence agency, the office of the director of national intelligence, and also 15 other members of intelligence agencies in what we call the Intelligence Community. Those agencies. Mil mail addresses, the dia, the Defense Intelligence agency, the National Reconnaissance office, on and on those agencies typically, we can understand why, i do not report portabilitys because that would be of vulnerability is because that beginning way too much help to those who would want to do us harm. That data is not included in what we will talk about now. But i will go from there excuse me for one second. I just realized i forgot my notes here. As we look at the 24 agencies reporting weaknesses they were categorized into five categories. First is Access Control, configuration management, contingency planning, and finally, security management. All 24 agencies reported problems and weaknesses in Access Control. What is Access Control . What is Access Control