On cspan leading to a senate trial. Live, unfiltered coverage on cspan. On demand at cspan. Org impeachment, and listen on the free cspan radio app. Joining us at the table, ofeel jaffer is the founder the National Security institute at George Mason Universitys law school, also Vice President of a firm called iron net cybersecurity. Good morning. Jaffer. We will get started talking about cybersecurity. Guest it was started by keith alexander. We do Cyber Defense, so we look behavioral threats on not just one company, but an ecosystem. Host lets talk about Cyber Defense. We saw the commentary piece you wrote, iranian Cyber Attacks are coming. Considering where we are in this situation, what are you expecting in the area of Cyber Attacks . A the it looks like escalatory de situation. We responded with the death of emstom soleimani qass soleimani and then they had a debate internally. How big do we go. My assessment was they would come back with a response, but it would not be so big as to provoke further response from the United States and that is exactly what we saw. We saw them come back with a missile attack on u. S. Facilities, but done in a way either intentionally or partially intentionally to avoid a big u. S. Response. That was a smart move. Now the question is what are they going to do next . Do they think further response is necessary or will they conduct our level attacks and one of the things we think remains is the cyber arena. You can dynamically adjust how tough you are being in cyberspace and you can do things that are nuisances. Denial of service attacks, slow things down and you can go in data. Stroy it is not as binary as blowing up a building, launching a missile, the like. Host we are talking about irans cyber capabilities. Our guest was white house associate counsel to president bush and worked for the house intelligence committee, the Senate Foreign relations committee, clerk for neil gorsuch in 2017 and here is he is here to talk about cyber capabilities. Lets do some 101. What is a cyberattack . How do Something Like that work . How would it originate in a place like iran and who would the targets be . Challenges isthe we use it to describe a lot of things. It can be used to describe the acts of a thief who goes in and tries to steal credit card data or somebody going into conduct surveillance. It can be used to describe somebody who lets you destroy data and break your Computer System and make it unusable or do something more aggressive. We use it to describe a lot of things. People get confused. Was this a cyberattack . Was this hacking . Was it theft . In this array, we are talking about nationstate cyber activities in order to achieve a strategic tactical goal, something that has to do with Foreign Relations or the like. Collectinto intelligence, that is the most common type of cyber activity, breaking into a Computer System of your enemy. In the case of iran, the United States and russia and the United States and the United States does the same thing. We go after nationstates to learn what their plans might be. That is one colloquial term we. Se on the low end they went into a slot machine and they were able to obtain credentials and went into the main las vegas credentials. They were not able to get into the Gaming Systems or change the results they were able to get information about who was staying in the hotel, they could delete computers unusable and that was in 2014. It is about a decision of a nationstate to act. We know nationstates make mistakes. We saw that happen tragically in the case of the ukrainian airliner the iranians shot down. There is serious risk of miscalculation. That is something we might want to talk about. Host that may read the phone number so folks can call in for jamil jaffer. Democrats, 2027488000. Republicans, 2027488001. Independents 2027488002. Facebook postings, we will read for everyone else. I thought i read there may be as many as 10,000 attempts every. Inute by iran put that in perspective for us. Guest one of the things about doing things on Computer Systems all of thesetomate activities. Take data out without people knowing or manipulate data so people do not know it has been modified. There you probably want someone on a keyboard working on it. A lot of Cyber Attacks, we talk about a range of things. Toot of those are attempts slow things down, distributed denial of service attacks. Where they take control of a number of devices, whether your own ios devices or your thermostat and control devices in an effort to put pressure on another device. Basically a lot of, i am here, talk to me. If you have 1000 voices coming in, that slows things down. I dont know if you have been watching your tv and think slow. Own and start getting grainy that is because there is traffic and noise on the internet. A d dos attack does that intentionally to slow things down. Host tell us more about what happens inside iran. Devoted to allis of this . Iran has a strong military. We saw that in the 1980s. , me and the north players weree top us, the chinese, the russians, even the french and israelis were good about this capability. The iranians were an upandcoming player. E have seen them up their game the reason that matters in cyberspace is because like we were talking about earlier, using missiles, using bombs is a binary situation and you get yourself in a lot of trouble. There for a while before you take action and you can ratchet up and down what you are going. With iranians and north koreans, who are less the terrible eterable, were less likely to use traditional tools to affect their behavior and they may see cyber as a way of using an asymmetric tool. They dont have to put their full military against us. Their goal is to test the boundaries with the United States, see how far they can go, push as far as we can and remain at that level of activity. Tens of millions of dollars to this effort and in cyber, they made a commitment and have been successful. Host are there any particular cases you can point to we might remember from watching the news where they were successful with a cyberattack against this country . Guest we talked about the attack against the casino in las vegas. There are also wellknown ddos attacks against u. S. Banks. These are more historic. More recently, we have seen a lot of activity around iran looking at dissidents and the part of the iranians who have left iran. There is a lot here in the United States and many of them are opposed to the regime. They left in 1979 and they are opposed to the current revolutionary regime so we have seen a lot of activity about iran following researchers, academics, activists in the United States and those are upsetting and we have seen indictments talking about activities to get into american structure. We saw an effort to get into a. Am in new jersey, new york that shows an interest in what the powerrt of infrastructure and that means they are trying to create a capability to stay in for a long time and potentially take action. We dont see them taking action now, but there has been a lot of reporting about russian activities when it comes to american critical infrastructure. We think this attempt might have been a mistake. It might have been a case of mistaken identity. We think they may have been trying to go into a dam at the in another part of the country. It is a concern and something we need to keep a close eye on. Host lets get a call in for our guest. William from pennsylvania. Independent caller. Good morning. Caller good morning. You sound like a trump hack. That is what you sound like. Russia is more than of a threat than iran. We have an election coming up soon and we dont want to go through the same balderdash we went through before. Guest i think the caller raises a great point. You are exactly right, the russians are a huge threat to the United States. There are active efforts to undermine the elections in 2016 and our confidence in our electoral system and rule of law, the fbi, our intelligence agencies, the cia and the like. They are likely to target the 2020 elections. We need to be vigilant and stop that activity and you are right to say the president has failed by not calling out that activity and by not addressing that very serious concern. I think the u. S. Government has taken serious action to address it. The department of Homeland Security with the cyber Agency Within dhs, they are doing a lot of work with the states to get them to up their game and be prepared. Elections are primarily bound by the states, so we have to work with the states to do this. One thing states might think about doing is working together with one another, sharing information in realtime about Cyber Threats coming together. Dhs has taken substeps in that direction. A lot more can done and as we lead up to this election with russians targeting our country and maybe even other nations like the chinese trying to manipulate the views of americans and the conversation in this country, they did it successfully. If i am in russia right now, i am thinking we have done a great job and really succeeded. Republicans, democrats are chairing are tearing each other apart. Democratcontrolled house and Republicancontrolled Senate is unable to function effectively. The work of the American People is not getting done and that is due to the fight amongst ourselves the russians have generated. Host bruce in michigan, republican. Caller how are you doing today . I have a concern about the internet of all things in Cyber Security. I was reading an article in the free paris press and they said just Like Computers can be hacked, these Driverless Cars are Like Computers and they can actually a terrorist could hack the cars so they would all disable their brakes and increase their accelerator. Thatuld do so much carnage i dont understand why we are going to this internet of all things. It seems to make us more apt to be attacked. What do you think about that . Host guest thank you. There are definitely concerns about the huge explosion in connected devices we are using. I walked into this room with an ipad, iphone, smartwatch. At my house i have a nest thermostat and cameras and alarm systems and alexa devices. We all have even our refrigerators are talking to us now. You are exactly right to raise the point about all these connected devices and the fact they may have vulnerabilities and they all access the internet to give us that benefit. There are a lot of benefits Smart Devices have given us. I was in an uber with someone yesterday with a tesla and his got anr in his car update it is amazing the benefits and that is a small perhaps not so important benefit, but perhaps the benefits we gain from this Technology Insertion into our economy and the conductivity at the same time does introduce vulnerabilities. It is something we have to be on top of, so manufacturers need to Work Together to think about a secure Development Lifecycle as they develop code, in a way that addresses security. Cyber defense is important. We have an interesting theory about Cyber Defense. When it comes to defending our country and institutions and companies and people, we typically think it is the job of the u. S. Company. We dont expect target or walmart to have search to air missiles to protect against bombers. It would be too expensive to do that and if they did that, you create the risk of miscalculation. In cyberspace, the situation is flipped on its head. We expect companies and individuals, small businesses, Large Businesses to defend against hackers, criminal gangs and nationstates and when you think about it, target and walmart are not in the business of Cyber Defense. They cannot be expected to defend one individual against the whole nation state with unlimited resources. One of the things we have been talking about a lot is the need come togetherto to share information and collect with one another across industries and work with the government to defend the nation and that is a really important cost concept. Host what does the governments Cyber Defense posture, structure look like to the extent you can explain . Guest in the middle of the Obama Administration, the secretary of defense said it is the role and responsibility of the bargain of defense to defend the nation in cyberspace. The challenge is the Defense Department does not have the authority, does not have the budget to do that correct an important mission. E created u. S. Cyber command they have leverage to defend the nation and take the fight to the enemies overseas. Cyber command cannot see what is happening across the bulk of the u. S. Internet because the bulk of it is owned by the private sector and that is as it should be. We dont expect to have nsa or Cyber Command patrolling the boundaries. They have to be able to see what they dont see. They cannot defend what they dont see, so sharing information for the purposes of National Defense can be important and something we ought to do as a nation. Short of that, the government can do more to work with industry. We see that through dhs and nsa and Cyber Command, but we need to do more. Anthere is, at some point, effort by a nationstate to do something more aggressive in cyberspace, i think the American People will look around and say you knew about this threat, what were you doing . It is important for industry and government to get on the same page. One of the challenges we have is there have spent there has been a lack of trust. We need to rebuild the trust and get to the point where we are sharing information, working together tightly coupled together government and industry. Host our guest is jamil jaffer, founder of the National Security institute at George Mason Universitys law school and Vice President of iron net cybersecurity. We have a call from rhonda. Thank you for waiting, you are. N with mr. Jaffer caller good morning. Happy new year, america. My fear with this war escalation and cybersecurity has me with almost like ptsd. I am a mess because of this whole escalation, the 200 children that were killed by accident. Doesnt even have the backup that we as the United States have to protect ourselves. I am trying to say they are careless. They dont have the people we have here, so we dont make. Istakes that arent precise i am just terrified. I am not worried about them hacking my computer, i am worried about the electrical ands and our Nuclear Plants things like that. This is not funny and we need to take it down. We have to take the whole temperature down. They need to put people in there to help trump and his National Security team. Ngpublicans are really pissi me off instead of helping drum, they are watching our country go down in the toilet. Half of the people in the white house, positions are unfilled. Arek kushner and ivanka running our National Security. This is crazy and we have to do something. They have to help trump and go in there and stop talking about him. Lets stop talking about him and lets start helping him. Lets stop this impeachment. I am tired of it. Guest rhonda raises an important point, which is that the president has his National Security team that is weakened by a lot of departures. We have people in place that can help the president make important decisions and i think rhonda raises an important point about this question of how we stop the iranians from making a mistake. How do we deter bad behavior . Was the decision to go after soleimani was it as collateral and did it create attentional for a war in the middle east or did it deter iranian behavior . There was a very hot debate for the last two weeks, we can a half about this question and it turns out in this case, the president might have been right, this sort of very aggressive inyourface activity to take down soleimani may have had the effect of quieting things down until and told the iranians we have been taking it on the chin for a number of years and we are not going to take it anymore. This president will stand up and stop it and you do not want that fight. It did create the risk of escalation and there was a possibility the iranians could lash out and we could have been in a war. The president got it right on this one, but rhondas right to raise this question of what happens when you dont have the that isople in place . An ongoing conversation in this country. Impeachment is about something different, this question of whether the president did the right thing when it came to the ukrainian president and seeking to exchange one thing for another. When it comes to national lostity, i think we have that traditional bipartisan National Security consensus