Transcripts For CSPAN2 National 20240703

Cybersecurity landscape, emerging threats and competing with the private sector for recruitment and retention of workforce talent. This discussion was part of the 14th annual billington cybersecurity summit in washington, d. C. Good morning. Thank you all for joining this session and thank you for having a discussion with us today. Is my pleasure. General nakasone, after he was here for the opening we had a meeting later that day and he was saying i got to open, it was so much fun and he was talking about the conversation he had and he said you are closing it and we will have its really exciting frankly conference for us because we focus so much on these issues and so its frankly an honor for me to be here. You really got the best of it from paul so its all downhill from there. Thank you. Lets jump into the topic of an workforce. We recognize the importance of a talented and Diverse Workforce and cybersecurity particularly given a lot of the challenges we face. Theres been some amazing tools and technologies being developed. We frankly see in our adversaries take advantage of those tools to influence our friends and state actors. What sorts of skills is Intelligence Community looking for foril the workforce of today and tomorrow . I i mean, were all busy focs on stem, that is among the great priorities and the wholeness of sort of degrees in areas of expertise were interested in but ill tell youte that whats most important to us at the end of the day honestly is really the skills that are sort of inherent in these different areas, which is Critical Thinking and judgment, and really excelling at what you do. And, frankly, bringing integrity and ethics and all of those things, given the extraordinary responsibilities that get people in the Intelligence Community. So those are the kinds of things were especially focused on. We also tell people that honestly no matter what it is that you study chances are weve got a job for you in the Intelligence Community because we do so many Different Things. We can be riding analytic work on Food Security or Environmental Issues or scarcity of Natural Resources inf different areas. We have somebody who is a water expert. In as weight its the interconnections that they make between the different fields that they have that are very special for us in helping us to understand the complexity of how the world works and that so much a part of what we do. So please anybody should apply. Www. Intelligence careers. Gov. Advertisement. Exactly. This is what im good for. Perfect. Some were later to lot of those skillsja also appears some of te i see this been a reprioritization, right, of some National Security focus particularly from counterterrorism to one focus tn defending against nation state actors. We think about that come is that a bit of a Fair Assessment . If so are their challenges in adapting the workforce to some of those changes and prior . I think its mostly fair. In the sense that theres no question that the Threat Landscape has changed over the last 20 years. Certainly when institution that i run was established it was very much a conversation about counterterrorism and it is shifted largely toward strategic competition as you note. And yet also transnational threats continueio to be a fundamental piece of our work and increasingly complex part of it. In manywa ways its again the kd of connections between these different threat streams, which is ato space where constantly trying to understand and better predict and effectively provide policymakers with a senseli of w things are likely to develop and what are the opportunities and the challenges ahead. But the other aspect i i wouly that is really shifted is we are increasingly broadening the definition of National Security. For us, Climate Change or health and Human Security is such a big part of it, emerging and Disruptive Technologies of course. E i just a whole series of other types of expertise were bringing in and different issues. Its first giving the expertise into the Intelligence Community so we can take advantage of them, understand it better, bring into ourur work but also integrating it so we can bring it into places you dont normally think about it. How does certain negotiations in Foreign Policy affected, forol example, Climate Change issues that are beingth worked on in other parts of the government and so on . So its a complex landscape obviously but its also to say that counterterrorism remains an issue for us. Terrorist threats have nothr goe away andwa went to continue to e vigilant about it but we also to understand how it connects to all of these other issues. Thats a great point. Im picking up two things, the connectedness and expanding scope of National Security at a think thats an interesting pivot to the next topic in question would usually around a shift in the way the ic thinks back to mitigate what collects and assesses, and what kind of learning you really have to think about and take place or move away from culture, one that is trained for compartmentalization to one that is open and willing to share . So heres i would think about it. We have to be transferable and ascents. The compartmentation peace remains critical to us. When that kind of people do our job unless we can keep secrets in a sense and recognize thats a part of our work. But exactly as you say jason, it is, we also increasingly recognizing the importance of sharing across a range of actors. The most obvious in our National Security strategy that the intelligencety community suppors focuses in on the importance of allies and partners. So we recognize that frankly sharing is a big part of promoting better understanding among partners and allies so that you actually have a shared view of the threat so that you can that actually respond in an appropriate way to that threat in innovative, collaborative way and ultimately sharing is important to the implementation of those responses in a series of ways. But more relevant to the cybersecurity world that so many of you exist in, it is increasingly obvious to everybody that the t sort of, te Threat Landscape requires us to increasingly share intelligence with nontraditional partners. Part of it i i would say is in understanding the Threat Landscape, we recognize and we does these global trend report f the four years or so when we look out about 15 years and we say here are the big Global Trends and we can tell from a lot of folks prevent academia and think tanks and private sector and so on, and one of the key trends you see and a lot of these reports is the growth and power of essentially nonstate actors which in part is a private sector but also other transnational movements and actors in thesn spaces. We as Intelligence Community are typically focus on state actors andst proxies of state action bt increasingly we recognize we have toob think about the Global Landscape in a slightly dipped way, the way to political power now is exercised. So as we move down that road we recognize we need to have a better understanding of frankly the agendas of major multinational corporations, for example, or even cities as opposed to states sometimes ain things like that. Built into how we are lucky and understand what the landscape looks at. Additionally, and this is something that is obvious to all of you, too, which that we recognize that so much of whats outside of government as part of our attack surface so to speak. Whether its Critical Infrastructure that is mostly owned by the private sector or in sectors of our private sector like in the Technology Areas that we need to focus on an order to help them protect themselves because they are of such importance of a National Security perspective that we need to share information with them, help them to see the threat but we also need to bring them further into the decisionmaking cycle so we are able to say how you respond to these things . How do you think it makes sense to respond to these things . Many people in the private sector and other spaces that were trying to work with have a better understanding of what is going to work, whats not going to work, how to think about these issues. Of course you also have an incredible amount of information in the private sector that is valuable to us so we can understand the threat and analyze it appropriately and we work with so Many Companies out to try to do that. But it is, its a very challenging space for us i think to get into the right relationships and to be able to show the right information. Its not just about downgrading and declassification, although thats a part of it. It is about establishing mechanisms that make this part of our routine that make it easier for us to basically partner and to communicate in more effective ways. Its a lot to cover their. I know. Its ridiculous, isnt . No, its quite all right but it sort of m strikes me particularly from the cyber perspective we are thinking about disrupting and dismantling cyber threat actors. You paint a broad landscape of constituents, points of Interest Research so how doso you think about collector and analysis organizations . Thinking how they can be more proactive inun countering what theyre studying . There so much to cover. How do you focus in the that . Yeah, and its something, you know, with all these, i know less about this than you do, for example, jason and probably all of you if that most of you in the audience as well. One of the things i see is as we look at the cybersecurity landscape, we are in a position where obviously the threat evolves. Cybersecurity has been an issue for decades but ransomware is only in the last few years than something we have been seeing and it is becoming more diffuse as a look in terms of the ecosystem for ransomware. Asas an example in looking at te challenge and trying to understand that threat reach out we got to to pretty nontraditional partners in order to collect the information we need. Now we have negotiators that sit between companies and those who are trying to collect ransom from attacks. We have insurers. We have others. We have a whole series of partners that we need to pull in information from. That is a challenge for us. That something were Getting Better at what we are not what we need to be ultimately and its kind of like a characteristic i think ofis this area that that s something when you do in order to do the collection and analysis that allows us to be in a position. Another challenge i find is that it is often you have actors in this space that are relevant to state actor threats and also to criminal threats. There are sort of two elements to that. One is we are the Intelligence Community can focus on National Security. On therere are other parts of our government that to lawrc enforcement and we support Law Enforcement but we can focus our resources on what is sort of the most critical threats for thehe nation. We have to sort of figured out, we know some of the ransomware threats that exist are actually of such intensity or are so important, ultimately that we needma to actually think about them as national a security threats in part, and so provide intelligence to office work that through but thats a kind of decision that has to be made about my california down you go in terms of the support you are providing . The second sort of challenge to it is this issue of we didnt tend to be traditionally focused on her state actors so if dprk, like cyber threat of russia or china obviously, iran, thats our business to wee know how to do that. We have thehe right group to sot of focus in on it but when it comes to look at an ecosystem of factors that are out there that might sometimes combined with, be used by a state actor come sometimes be used in a criminal, might be in different spaces. Its a little harder organization to go after so these are some of things were focusing on. How do we get better at the center organized ourselves source graph of the threat most effectively and tap into the talent and resources we need. Thats kind of what i want to go next is on resources. With covert strategy, cover the landscape, some of the challenges. The first question i have around talent is where is the ic at today in terms of garnering the type the Technical Work skills that are required for a lot of the challenges in the landscape you described . I think were moving in the right direction and still work to do but i think of it, and you should tell me, jason, if you think this is right way to think about it. But it think about it as not just the talent that is in the u. S. Government in this area. I think about it, as laura who runs our Cyber Threat Intelligence Integration Center at odni and she does a lot of the coronation across the ic and shes talked about circles where you have your focus on the workforce within the ic and with the u. S. Government, and then frankly in the private sector and in other spaces around the u. S. Government. I want to see that be more porous. In other words, where we can have people going inop and out f these different spaces moredi effectively so that we can take advantage of those opportunities to learn fromse each other as mh as possible. I also think that theres all kinds of advantages to that, not just in terms of the sharing of learning that we are doing across these different borders but also for the individuals who are thinking about their own professional development. And want to have an opportunity to be in different spaces in order to see where the greatest learning can occur in these different areas. So that is a part of it. I think, so to answer your question, obviously we are focused on other things were trying to do to try to increase the opportunities for folks and, of course, i am biased but i believe in the government is just the most extraordinary job you can have in the sense of the nation, the feeling that you can actually do something that s important for society but also the people are spectacular. When it comes down to it i realized as the older i get the more i come to work for the people that i get to work with, you know . And they are really just so exceptional in so many different ways, and it also the adventure. You get an o opportunity to do things that often, and to sort of move in different spaces in government and flexed a bit because we do so many Different Things in these areas. I think thats great. I recognize the pay is not what it is in the private sector, that there are other disadvantages to having to work in a skit sometimes with no windows, that pretty muchth suc. Weve all been there, right . But so there are different reasons, and i think the fact is there are different models in different ways tonk think about these issues. I hope we are able to take advantage of where there is real expertise that we need to make we dont have to have it home grown in other spaces and that were able to exchange. Absolutely its interesting to make the concentric circle analogy. I think of it the same way, you have your core talent. Where can you pull tab from the Light Industry public and private sectors as well. Further out, where do you get along tale of candidates and skilled workers some . E education, opera, Higher Education reason for the into the area. Definitely a way to look at it. You mentioned pay for a second side want to jump it and maybe bring that up from him because we know someus federal agencies are incentivizing recruiting talent to increase pay. I see agencies are doing that as well. What is your perspective on leveraging higher pay . Is that effective, needed . Where does he ic set on that . Look, i think itav is importt in certain circumstances, no questions. I think its that just about recruiting. Its also aboutt retention. Just thinking through, we are never going to compete with certain aspects of the private sector for just the pay that you will get plus bonus or whatever it is that your focus on. But he can compete in other ways in terms of benefits insecurity and other issues that relate. It is also a different proposition. As i was alluding to before, i do support and santa fe under certainum circumstances and we think about how we do that in these spaces. I also think though it has to be paired with sort of this greater capacity to see movement between and partly what is talking about before is a value of that but also recognizing that this generation doesnt think about their career typically in the context of im going to spend 30 years in government or in the private sector or at one company or right . Of recognition of that is critical to our system and theres been effort to try to change the way in which we deal with personal benefits and so on to make that more realistic for folks so they can enjoy some of the security and benefits you get in government but still have flexibility in the sense. Needless to say, it takes a while to change, we are working on it. So it is part of the process, but all of those are i think important to it. Ii also hope people recognize, i mean it is another value i think we have is you can come in with different degrees in different areas frankly andt then be, find that you let something else, and have that degree or that education matches against it is important. I think increasingly i feel as if ten years ago we were talked about how we needed to have more in a sense Technology Knowledge among senior leaders, right, and tech folks at the table. The conversation shifted at some point in myin view to we need to help Technology Folks understand more about Foreign Policy and National Security in our leadership in this space because really the interchange is a crucial. When i look at my Senior Leadership team come and i will give you i a number of folks asn example. My Principal Deputy Stacey Dickson has a doctorate in the master degree in mechanical engineering. Ourr cio, remarkable woman, adele, she has a phd in mathematics. Our National Intelligence manager for global issues and climate and that as well as Public Health Security Issues also has a science degree. We have the person who runs our counterproliferation center, she has a medical degree and Public Health masters in different spaces. Theres a variety off different like remarkable and sort of education that comes through. And i think hopefully that combination of things is useful to folks. Its interesting to hear the diversity you described there. In my career i started as a Software Engineer and i was always impressed by probably the best Software Engineer paperwork with, had a degree in philosophy. Not even the background, just the person was amazing. Diverse ways of thinking. We talked aboutwa recruiting and we talked about retaining workforce and in thinking through pay period may be want to shift back to the existing workforce is the approach you have for upscaling that existing workforce different than what weve talked about so far . I mean, in terms of upscaling the existing workforce, it is upskilling were trying to create opportunities for folks to sort of learning across disciplines in effect. And sometimes that is by giving them the opportunity frankly to bring the discipline that they have into another area so they are able to bring that knowledge and experience and have effect with it here but as a do so, so if youre somebody who happens to be a cybersecurity expert and now you are suddenly working in China Missions that you will learn about the region of age and understand better some of the geopolitical issues associated with that, and vicee versa. Iha think that, that sort of mixing and matching is very helpful. We doo also have opportunities for training that we try to create within the community, both inside the community, in other words, with an Agency Departments and National Security agency obviously this quite a bit of this and the context of cyber issues. But also outside in. With academic institutions and providing opportunities for us to do that together. Th i think just to circle back to something you said before inth terms of her last concentric circle. One of the things we do think about is how much should we be spending on trying to actually develop demand for certain skill sets and knowledge thats in educational bases in the country and thats are kind of interesting. We do some things over try to expose high schools and two more what we do so we can give opportunities for them to see how they could use the skill sets in the future. But also to try to support some of the Educational Programming in those areas such to kind of create to what it is were doing and hopefully allto about then comes together in no way that produces the workforce of the future. Absolutely. So we have talked a little bit about the threats that we face, the priorities and strategies and certainly the people. The piece to me that is always probably the most influential a lot of times in Successive Technology transformations or organizations can be culture. Maybe if you could talk about what you think is cyberculture is within the Intelligence Community and i think that goes about informing how we have strong unity of mission and focus on the outcomes that you are looking for. Yeah. You talked about mission and adventure before. Im all about that from a culture perspective but maybe you can expandec a little bit. Absolutely. Im sure many of you are familiar with the Intelligence Community but i would just say a few words about our sort of world. There are 18 elements of the intelligence e community. Its a lot and many of them are ones you would be for my were such as cia and fbi and nsa, and so on but we also have, maybe youre familiar with the National Space intelligence agency, the National Reconnaissance organization where they develop Space Capabilities for the and Intelligence Community. We have elements in basically every military service that exists. So coast guard and marines and navy and air force and army and someone. We have Intelligence Community elements in treasury department, in commerce and across different places, sorry, we dont have it in commerce but we actually have in working with them to develop liaison opportunities. And so as you look across this enormous kind of ecosystem of the Intelligence Community, one of the things we think about and talk about is so what does it mean to be part of the Intelligence Community . We are in so many different pieces of what we do. Cybersecurity is a a perfect example of some of the challenges, but also the opportunities that are created through that. Every agency as you might imagine has its own kind of character and culture. For those of us in the ic, we can joke about what those look in different spaces here and it is, in many ways i think personally you want to promote that. I think thatss fine. You have different cultures for different types of mission sets and that is an appropriate thing to encourage and to cultivate. At the same time, increasingly, integration amongst the intelligencece agencies essentially that exists is what action allows us to do the most remarkable things. If you look at Something Like the conflict in ukraine and consider how many different forms of intelligence it took him how many different pieces of the Intelligence Community had to come togetherll in order to bring that picture together so that we can provide policymakers with the kind of indications in warnings that we provided, its absolutely remarkable. And never before have i seen the degree to which we have to rely on each other in order to even collect. We talk about signals intelligence that essentially human intelligence come human intelligence that does the same for signals intelligence, how we looked at, for example, commercial imagery in the context of ukraine to look at the to be able to present a picture to the world. We looked at upper right of Different Things that have to come together as you think about these issues. And so we recognize the value of integration and culture so muchf a part of trying to produce and if im in which you all recognize that by leveraging each others skill sets wereil going to be t able to move forward. Forward. In the context of cybersecurity, what i have noted is increasinglyei we are seeing fos that we have this joint duty Assignment Program where you can basically go up at nsa but then dodo a joint assignment for cia, for example, or vice versa or two different departments. Sase a fair amount of movement in that space and theres a lot of competition for frankly a cybersecurity, that exists in government. So there are those opportunities for folks and that creates extraordinary opportunities. So thats one way to affect the culture and create that Community Across the different elements so you can see how it is that these different intelligence sources by help you even inev the context of cybersecurity. I wish i could gosh in more detailsde but sometimes we haven classification issues. In any event the are many ways you can do that. Its fascinating. Another thing we do is we do these Strategic Investments where we bring together ant grop and usually its one element that said we think this is a gap, this is an issue we need to get after that were not doing well enough and they come up with this areaat of over try too is pull together a number of folks who are experts on these issues from different elements and we get them into room and we say how cano you all Work Together to create something that would get after this most effectively . In those moments its completely fascinating connections theyre able to make and the way in which they are able to see opportunities that they wouldnt have seen at their looking at the picture from a different perspectives and with different tools and that sort of thing. And then finally the other thing i would say and it is part of this question of how do you think about sharing with other entities in i a way more effectively for the ic and other helps our work. The reality is we in the Intelligence Community tend to be somewhat insular. By nature of our work we are constantly working in classified environments. We are not talking to other people. That is dangerous in the sense that what were supposed to be doing is better understand whats happening indi the world, and being insular and understand whats happening in the world can have its challenges. So getting out and talking to the private sector, talking to academia, talking to partners in other countries and so on is criticalin to us actually testig our thinking and theories in creating innovation in the sense in these areas which is so fundamental to our ability to thrive for the future. Those are all different pieces that we use to try to pull together a culture but its not a uniform culture. It is rather one that i hope incentivizes the kind ofnt integrationin that we know that allows us to be greater than the sum of our parts in these different areas. I think thats probably a fantastic know to stop on. We think about the culture and the greater the sum of the park any pack weg can have going forward, the challenges we face. Thank you very much free time today to talk about Building Workforce of the future and ic. We all truly appreciated. Please everyone, a round of applause for dni haines. [applause] general hayden is very graciously hear to be for dni haines. Lets please give general n a very, very warm brownle applause. [applause] and his wonderful wife jeanine whos who is with us here as well. Thank you very much. [applause] dni haines, thank you so very much. Jason, thank you so much for moderating a wonderful our side chat. What aanfo wonderful way to ende program. We are thrilled and honored to have you, so thank you very much again. Thank you. [applause] cspanish cspan if government. We are funded by these Television Companies and more including comcast. Are you thinking this is just a Community Center . Its way more than that. Comcast is partnering with 1000 Community Centers to create wifi enabled a lift zones so students from low income li