After i was elected, i had the privilege to be appointed to a task force on combating terrorist and foreign fighter travel. For six months, our Bipartisan Task force looked at this very threat. What we discovered is that 30,000 individuals have traveled from over 100 countries to iraq and syria to join isis. We know about 4,500 are from western and visawaiver countries. And 250 of them are from america. Those are the ones that we know. We realize there are probably so many that we dont know. In addition, Law Enforcement has isisrelated investigations in every single state right now, with cases increasing at an alarming rate. And isis is employing a sophisticated and unprecedented propaganda, recruitment, and socialmedia campaign. They use it to inspire or direct people to travel to isiscontrolled areas to join the fight or remain where they are and commit terrorist attacks at home. Theres an estimated 200,000 proisis socialmedia posts per day. They are acting at the speed of broadband, while we are acting at the speed of bureaucracy. After our sixmonth investigation, the task force laid out 32 key findings and made over 50 recommendations in the report that we released in september. And the number one finding the most glaring weakness of all is that this administration does not have a strategy to combat this dangerous threat. I have been focused on National Security for over 30 years, and i can tell you that isis is the most potent terrorist movement we have faced. They showed this month the apparent capability to take down the first airplane since 9 11 and conduct the deadliest attack on french soil since world war ii. France and russia have shown resolve in response, but the world is waiting for americas resolve and leadership and a comprehensive strategy to win. The administration has been leading from behind. In the military, we would call that following. Their reluctant approach is only emboldening isis to recruit more fighters as they claim they have been attacked by u. S. Airpower for 15 months, yet the momentum is theirs. Our strategy must include utilizing all elements of national power. We must unleash american air power to destroy their leadership, command and control, logistics, and their means of financing their terror. For 17 months, isis has been exporting blackmarket oil to fund their operations, and we just finally started striking the fuel trucks with the mighty a10 warthog, the airplane i flew. The aircrews have been doing the best they can under overly restricted rules of engagement. We need to take the gloves off, let them do their jobs now to destroy isis capabilities in iraq and syria. Next, we need to show leadership again in the broader middle east. Our close ally israel and our sunni arab allies are rightfully confused and dismayed by this administrations myopic focus on a nuclear deal with the shia state sponsor of terror and their biggest security threat, iran. The strategy must ensure actions against isis dont strengthen iran. A broader strategy includes partnering with the nearly 20 countries that have an isis presence to deny safe haven and counter the extremism ideology. It must step up our efforts working with our allies, especially in europe, to share information and close loopholes that facilitate terrorist travel. And it means countering the radical extremism that were seeing in our own neighborhoods. We have around two dozen people focused on countering violent extremism in the federal government. But we have roughly 10,000 irs agents making sure you dont take an improper charity deduction. Where we are putting our resources simply does not match up with the threats we are facing. This week, we sent the president s desk a National Defense bill, for the second time. It requires the president to put together a real strategy to defeat isis. We also give him all the tools he will need to execute that strategy. Second, we passed a bill calling for a new standard of verification for those fleeing conflict in syria and iraq to ensure isis isnt posing as innocent victims, as they said they would. This is the first step to close one gap highlighted by the fbi director and our own security officials, and there are many other vulnerabilities we have identified that must be urgently addressed. In short, were telling the administration to step up. Take this terrorist threat seriously. The fight against isis is a generational conflict, and we must lead now more than ever. Thank you. Best access tohe congress. Over thanksgiving, watch our conversations with six freshmen members of congress. Congressman carter, republican from georgia. At 10 30 a. M. , represented norcross. Eastern, a0 00 a. M. California democrat and former restaurant owner. 30 10 and congresswoman mimi waters, former state senator who interned as a college student. At 10 30, a massachusetts democrat, harvard graduate, and marine. Isr best access to congress on cspan, cspan radio, and cspan. Org. Louisiana will choose their next governor tonight in a Runoff ElectionJohn Bell Edwards and tter. Vi million have been spent by the campaigns in what could become the most expensive governors race in louisiana history. Polls close tonight at 8 00 central time. We will bring you the results and candidate speeches this evening on cspan. The communicators is next with isight partners ceo john waters, talking about efforts to four attacks before they happen. Cases, focusing on the 1952 decision on the separation of powers. Later, a group of political cartoonists discuss their work and its influence. Cspan, created by americas Cable Companies 30 years ago and brought to you as a public service. We will introduce you to john waters, who runs a Company Called isight partners. We work with governments and Large Enterprises to protect themselves against Cyber Threats. Mr. Slen what kind we looking for . Mr. Waters cyber criminals, ists, and Cyber Espionage operators trying to gain strategic advantage. Do you look at all three of those categories . Mr. Waters thats correct. Mr. Slen what kind of clients you have . Mr. Waters we started off with government and financial services, the most targeted. Oriented with the some government concerns around espionage and other events. Years, business has expanded dramatically to , industrial, retail manufacturing, energy, and you can follow the hack. It used to be limited to financial services, then the target reach, health care breaches, sony breach, so it has expanded dramatically across all sectors. Mr. Slen do work with the federal government . Mr. Waters yes, they are a client. Is this consulting or do you do the actual investigations . If something happens, you try to figure out who is behind it and how they did it. We sell annual subscriptions to our Cyber Intelligence research. That research is conducted so we build an intelligence collection plan that are relevant to abc company xyz agency. We have people look for threats in their Development Cycle as building. We analyzed those threats in our threat Fusion Center in chantilly, virginia. We come in here and put together the puzzles and say this looks like this presents a real issue from a cybercrime perspective against the following sectors. We deliver written and analytical content, but also the artifacts. They are fighting the fight at a data level. Andcant understand risks less you understand what theyre trying to do, so we say here are the data connections. If you see this piece, then its that puzzle. Serve datais help elements that say these are bad pieces of data, but they indicate this threat is being action against you. Thats how customers drive privatization. Mr. Slen in a New York Times article on your company, it said that Companies Receive up to 17,000 alerts on a regular basis. How are your alerts different than what they are receiving . Mr. Waters great question. The problem is not to increase the problem, but to shrink the problem. How do you shrink the alerts and find the ones that present the biggest risks to your enterprise or agency . Ceo of aa panel with a Large Company and someone asked a question. About 1d they have billion and a half alerts a day. Have a significant amount of resources we can apply and shrink that to about 10,000 alerts a day. We get to about 1000 critical alerts a day. They say you must have a huge security team. We do. We can handle about 10. Have less odds of picking the right 10. How do you figure out which are the biggest risks . We take the 1000 critical alerts, hit your api, interface into data sets, and then we can look at what threats and say these are the top 10 risks, go work on those. You have to shrink the problem rather than try to increase resources to meet the demands of the alerts. You have to decide which are the biggest risks to the enterprise. If you can only pick one thing to do today, what would you work on . You would work on the one that created the biggest threat to your business or agency. Thats what we do. We help them reconcile the alerts and pick which ones present the biggest risks. Mr. Slen when you look at what happened to target, the office of personnel management, where the warned but missed risks. Mr. Waters i will say generically that we were public by default on the target series of breaches, related breaches, because there was a Warning System in place there. The code base that was developed that was used against the retailers was developed six months before it was started. It was sold in underground forms. If you are active in those forms , you can gain access to that code base that allowed you to gain access to the credentials from the time they went to the card swipe until they are encrypted. In the clear before encrypted. If you plot the tool or gain access to the tool, you could reverse engineer it and say this is a tool that can target retailers, pointofsale, here are the artifacts. If you are a retailer and have 100 critical alerts that day and have only time to do with one, if you hit the intelligence database, it pulls up that report. You know what they are trying to do. In cases of nation on nation, traditional nation sponsored activity using proprietary tools, infrastructure, never been seen before im not saying that was what opm was, but sophisticated attacks, government on government, very difficult for any commercial party to fight that fight. That is truly a National Resource to be in that space. The vast majority of Cyber Threats conducted against government and the commercial ,ector develop in the open using common infrastructure, common tools, reusing tools, reusing strategies, and there is a way to get ahead of the threat if you are forward leaning. Mr. Slen how is isight partners different than another company, and inhouse Security System . Mr. Waters the focus who manage attack surface have technology that sits three inches in front of the problem. Here come all these packets setting off alerts. They use their a normally detection routines and say this doesnt look right. Or, this is a bad piece of malware. They dont have that context. They start off with things happening in their environment, the final mile of the attack. Then they do forensics and say this came from this commandandcontrol server, so theyre trying to work their way out from things that happened to where it came from, but very rarely can find who is behind it and what they are trying to a commerce. There is the attack surface, thats how Security Companies live. Then there is the attacker surface, so when you click on that spearfish, where are they dropping it from . Thats the attacker surface. You move out a layer, and you have the threat source itself. Someone behind the keyboard with opposed that has an objective to accomplish. Most folks start off here, all the Security Technology companies. We start in the threat environment itself, though playbooks, strip out the. Udibles you can connect to data, in this case an audible, to the playbook at machine speed and ask people to make decisions. Mr. Slen you have been quoted afterters in the desert iraq 10 years ago plus, the first issue people faced wasnt snipers or tanks or machine guns or rockets or airplanes, it was ieds. They fought the fight the same way you fight any threat, stop ,he bleeding, armor everything figure out how to jam and detect these things in close proximity, then move a layer out and say where are they placing these bombs. Finally, somebody says how do we get left of the boom, recover from it. In the cyber conflict, you have the same type of analysis and trajectory. Try to block everything and stop the bleeding, responders, armor everything, layer security devices in front of assets and information, and finally, how do we get left of boom so that we can get ahead of the threat. On entire model is premised getting our customers left of boom, anticipate what is coming, and build protective layers prior to the attack being executed. 24 7 365. At scale that is hard to do. It is a long lead time to build this company, resources, patience, and persistence. That is where we sit today. Mr. Slen we are in suburban virginia in an office park, and people are sitting of computers. What are they doing . Mr. Waters this is our threat Analysis Center. We talk about our researchers around the world. The researchers are gathering information, puzzle pieces, saying here are the things that look like they could be bad. Those pieces come into this facility, where the analyst , they looky the team at those pieces and say using our Data Analytics platform and put together the puzzle pieces and say, this combination with this from this with this person at these targets, here is what is going on. So they did the human analysis that says this is the playbook. With thisis group capability with this infrastructure with these tools targeting these banks trying to compass the following objectives. They create the written analysis and then we take the data element out of that analysis, and from here we deliver that to our customers. We say here are the technical things you should look for, but all of those technical things we give them all link back to that analysis. We never say, hey, this looks bad. You are seeing is this analytical picture so they can read that threat analysis and know what to do. Is the Analysis Center that puts it all together. Mr. Slen you have people around the world. How do you hire them . Do they have security clearances . We hire local people. Im not sure we have people outside the United States with security clearances. We have people in 20 different countries, former cybercrime professionals in their countries who worked inlks response teams, former Law Enforcement professionals, people who worked locally in the government to try to protect their government and National Interest against Cyber Espionage operators. They have the skill set and operating capability, and then we bring them in together to secure our customersi interest globally. ,hey are looking for soft spots the u. S. , korea, australia, or brazil. The adversaries could come from anywhere. Hiredfolks that weve roughly two thirds of everybody we have hard comes from somebody we know. Its deftly word of mouth. We go to Great Lengths to find key people to build teams around. It is definitely word of mouth. Spent timei establishing risk centers. We have a team that manages relationships and make sure we work as a unified team. Mr. Slen what do you look for . A programmer, creative thinker . Mr. Waters we have a variety of skills that Work Together. A lot of folks say i will hire these guys and build everything around them. If you lose that person, you are toast. We built this interdependent system and capability from the researchers, technical analysis, tools development, engineering that builds the workbench, to all of the analysts working together to put together the puzzles. System thatsupport allows us to Work Together as one global team. Its not individual rock stars. It is a rock star system. The individual capabilities are all passionate about what we do. There is so much demand for talent in this space. If and not passionate and love the company, they will work somewhere else and make more money. The people who work your primarily are passionate about our mission and support of our customers. Smart,rily, they are hardworking, and get along with other people. We have a culture of humble experts here. Chemistry orod for teamwork, so we rely on each other to be successful in our rock star system. The output is all customer centric. All of our employees realize the customers pay the bills. Everything we do is for them. Every employee is a shareholder. Our customers know that when they pick up the phone come and they are talking to the owner of a business that has a vested interest. Mr. Slen youre not a Public Company . Mr. Waters no, we are not. Which is a luxury. We can grow the business and make the right Strategic Decisions nearterm and longterm without making a quarterly number. Mr. Slen will you go public at some point . Mr. Waters who knows. We are not in a position or desire to do it today. Comfortable position of making the right decisions longterm for the business, not necessarily what is the best decision to prepare for an ipo or make a quarter in the short term. You always want to present a business trajectory and business stability and business predict ability that you have any option you want in the future, whether it was going public or strategically acquiring other , but this business is built for the longterm. Mr. Slen john waters, how did you come up with the idea of isight partners . Mr. Waters i am a finance and economics guy i background. I managed all the money for the founder of first data resources. I was chairman and ceo of a holding company, managing a fund, set on boards, and as a , financial risk, operational risk, credit risk i was always intrigued by the overall challenge of competing and managing risk better. I spun off on my own and looked at cyber as an investment theme. , and my own capital outside capital is still with me today. We set up a public and private Investment Vehicle and started investing in Cyber Security. Early investments was in a company that had just come out of bankruptcy, bought the company for 10 out of bankruptcy, and they were the ground floor of this building. Very disheartened faces. They had just gone to the ringer soecond grade management, after we continued to invest in the business. , symantec bought several companies. I thought we were in a great place and got more engaged. Of idefense. Ceo ,ery high level threat related so built that business and sold it in 2005, invested in other businesses, than when i took a step back and decided what i wanted to do, i realized Threat Intelligence was the least common denominator of the industry. Nationhe only way that a that we can protect our interests against hackers meant to do harm to our Global Economic efficiencies, trade, relationships, you name it. Intelligenceve an apparatus that was not the government to help you manage the risks to enterprise and governments. If you look at what the mission is at the nsa or cia, they have a unique, tight Mission Funding for and empowerment to do, but they are not loving requirements based on a retailer and save that we will protect this retailer. That is not their mission. They dont get taxpayer money to do that. The same retailers and Energy Companies and banks, intelligence leads operations. And lets you know what you are up against, you have no way to resource against it. I set out to build this business and brought in a great set of people to build a company that could sustainably, repeatedly, and scalability deliver over the horizon Threat Intelligence that allows people to make strategic resourcing decisions, how they want to invest their Security Resources to give them the best chance to efficiently mitigate , howisks, operationally did they detect somewhere that something does not look right, but then comprehensively protect against that attack operationally, then tactically, rather than try to look for things they had seen before, how do i build a systematic way to build indicators that say this is what is coming down the pike, locked these things. The whole business rationale was through an economic lens, how efficiently you can manage Corporate Resources to manage risk and enterprise resources, and how effectively you can line your current Security Resources against the greatest risks to your enterprise. Its built through a rational economic lens. Weve got a good blend here in terms of the Business Purpose behind it. Thats the technical and intelligence flavor of it. Mr. Slen does the u. S. Government and Big Companies think the right way about the right things when it comes to Cyber Intelligence and Cyber Security . Over the past several years, has that thinking changed, the approach . Mr. Waters its a good question. Today, there is a recognition that we are all in the same threat soup. People would say the government has to face these National Threats and things that are sophisticated. We could never protect against those. I make motion pictures. Why would a nation target me. Im a casino. Why would somebody come at me. Im a commercial entity. Marshal entities were focused on regulation, and that was the definition of success. To comply with all the regulatory frameworks, how successful, and the board held them accountable to that, are you compliant, yes. The government on the other hand to always facing severe risk their enterprise and operational ability to work. In the dod spectrum, they spend 10 of their i. T. Security budget on intelligence that leads them to manage the other 90 . Ons their navigational chip how they will navigate the threat environment, so intelligence leads operations in the commercial sector less than 1 . Same threatthe intensity, National Interests are targeted commercial interests. You have to learn from the expense of the government. Now the commercial sector is ledting into a intelligence approach to bring intelligence to the core of how they are thinking about an resourcing against threats. Most important, building an they are looking at the money to deploy resources next year and then revisit next year. That does not work when the threat is changing every day, so you have to have an adaptive constantly shift. They have taken a lot of talent from the commercial sector. Its hard as a security vendor former intel officers, former military intel officers, government practitioners, coming out of the military, into the commercial sector. You have almost seen a complete shift of military capability, a lot of this stuff, into the commercial sector