Simply Solving Cyber - Bob Casey

All right.

Thanks for tuning back in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with Bob Casey. I've actually known Bob now for probably at least a decade. Both worked together at a large pharmaceutical company. And before that, Bob was in the FBI, Houston Police, and of course, then joining the corporate security side, leading corporate security, global security at the large pharma. So Bob, welcome to the show and maybe give us the quick Bob story.

Thanks, Aaron and Cody. Great to be here. Great to be with you guys on this podcast. Excited to be a part of it. Yeah, I'm an Indianapolis kid. I graduated from Indiana State University where today, unbelievably, I'm on the board of trustees. Moved to Houston and went on the police department. As a young man and spent 5 years there, 3 years in patrol on the midnight shift. That's when all the goblins come out.

Midnight shift in Houston.

Midnight shift in Houston, the infamous Central Division. And then transferred to the Criminal Intelligence Division, to the Organized Crime Squad. And my portfolio there was the Asian gang and Asian organized crime portfolio. So I primarily did Chinese and Vietnamese gang and organized crime activities and ended up working with the FBI there and was impressed by the agents I worked with and they encouraged me to think about applying to the Bureau. So after clearing it with my wife and getting her approval, I applied and of course went through a lengthy process taking a year, you know, to get through the process and was offered an appointment. So entered the FBI Academy in 1986 and spent the next 25 years years in the Bureau as an agent, going through the ranks as an investigative field agent in Phoenix, Arizona, and then promoted to FBI headquarters in Washington as a junior-level program manager in the European Asian Unit of the Criminal Enterprise Branch. And then on to Chicago as a squad supervisor of a gang squad, gang task force and then a drug squad. Then to Miami as Assistant Special Agent in Charge. That would be the number 2 level leader in the field, in the FBI field division, and supervised the organized crime, drug, and intelligence programs there for 2 years. 9/11 attacks happened while I was there, and of course we were heavily involved there in Miami because of the connections in South Florida to a number of the hijackers. Wow. So I was involved in that. And really, those attacks changed the course of my career because the FBI then began to focus on transforming its intelligence capability. I had intelligence experience in a large urban police department and in the FBI's earlier programs in intelligence. And consequently was promoted by the Director of the FBI to the Senior Executive Service. So that's the more senior leadership ranks in the federal government. Transferred back to FBI Headquarters and really began a very transformational journey in examining what happened in those attacks, what were the intelligence failures and deficiencies, and how could those be improved? And the FBI and the CIA were primarily, in my view, examined most closely, you know, for what happened and what needed to happen, you know, going forward. So a lot of my work at FBI headquarters obviously focused on the second part is don't let it happen again.

Yeah.

Which really was the admonition from the White House, from Congress, and from the American people. Stressful, long hours, long commute, a lot of pressure.

No traffic.

Yeah, traffic everywhere. My office was right down the executive hallway from the FBI director and the other executives. So on any given day, if you walk out into the hallway, you could run into the FBI director. So you have to have your act together.

Like in a very—

24/7.

Yeah.

But when you're there, but a number of very interesting projects. I led the FBI team that did a new memorandum of understanding between the FBI and the CIA to coordinate our activities globally, helped design the new field intelligence program for the FBI, which was then put in place in all 56 FBI field divisions in the US.

So actually, I want to double-click on that, and I'm sure we talked about it together on the corporate side. But for all the cyber practitioners listening, obviously threat intelligence is a form of practice within the cyber community as well. Having built that, what are some tips for some maybe early career threat intelligence analysts within cyber? Like where would they start? How do they get better?

All that. Yeah, absolutely. Key. I'm glad you brought it up. First of all, let's talk about intelligence. What is it?

Yeah.

Intelligence is information that fulfills a need to make decisions. It clears up things that might have been unclear, although it is often cast in ways that intelligence itself, the work of intelligence or a threat intelligence analyst, is about the unknown, the unclear, and the deliberately deceptive. So one has to understand that that's the world that they will be in. It really comes down, I think, heavily to a good requirements management structure. And what I mean by that is that whether you're the United States government, the President of the United States, the US government, the Secretary of Defense, whether you're a CEO, whether you're a police chief, you really need to know what your intelligence requirements are. What are the essential items of information that will help you make good decisions in your operating environment. And there has to be some sort of structure to that. And those who are in a position to collect that intelligence or that information need to know what those requirements are. And when they do, you can do a couple of things. First, you can actually aid in your decision-making. And secondly, you can determine whether or not you have a lot of gaps in your collection mechanisms and you need to improve those, need to shore those up.

Sounds like a lot of governance and process and policy.

Yes. One should be careful not to make it too complicated or too convoluted, but the people who are in the best decision to articulate requirements are those who have responsibilities in the organization to advance it, to sell, to market, to defend it, to defend the country. And so without a really robust requirement structure, which then feeds a collection management structure, which then feeds an analytic structure, which then feeds a production structure to go back to that requirements holder and say, here's what we found. Does this help? And if the requirements holder says, well, this helps a lot, or this only helps halfway, I need to know these other things now. Or now that you've given me this, I have additional questions and those become requirements. And it's a cycle and you have to think of it in a cyclical fashion. So that would be my advice to anyone talking about the intelligence game in the corporate world, a business firm, or a young intelligence analyst or intelligence manager. But I would say be careful because intelligence is more than just analysis. It is about a requirement structure. It's about collection management. It's about analysis. It's about production. And it's about feeding that cycle back around again.

Nice.

So I know you also had a corporate stint as well too. We do a lot within cybersecurity, but talk about the relationship between the physical security and your background and working with global cybersecurity.

Sure. I always felt like it should not be a competition and you should not be trying to hide the ball. You should not be trying to one-up each other. The integration of physical, personnel, facility security, and information security or cybersecurity is critical to have a really good, strong handshake and complement each other. Now, the physical security folks, in my experience in the corporate world, they're really good at understanding human behaviors because they see all kinds of behaviors. They probably came out of law enforcement or a national security career in the government, and they understand human behavior, and they can inject that knowledge into physical security protective measures, physical security consultation, and integrating their work or partnering with information security and cybersecurity. I mean, I have a real strong belief that threats to probably the companies and firms that are listening to this podcast originate from a human being. Yes, you could have a threat that is a natural disaster. Sure. That could disrupt your information technology infrastructure and the security of your information network. But generally speaking, the origin of a threat is gonna start with a human being. It could be a lone actor, that is a criminal whose motivation is economic. They wanna steal money. It could be a nation-state where it is a collection of human beings being guided by the policy and objectives of that particular government, where they're trying to steal technology and innovation. So you really have to think about who would be the adversary, what type of person or people, what capabilities do they have, what opportunities do they have, and what do you have that they would want it, whether it's sabotaging you, whether it's stealing from you, whether it's recruiting some of your people to, to do all those things to you as well. So really think about, you know, what you're trying to protect and understand what the adversary would be interested in. Don't just stop at what you want to protect and not think about the capabilities of an adversary or what their motivations would be, because you may end up spending a lot of money and investing a lot of time in building protective measures that are not going to be needed.

Sure.

Because the adversary is really not interested in that. They may be interested in something else that, you know, haven't thought of. So just remember that the threat picture coming at you by an adversary is going to be what intent do they have to hurt you? What capabilities do they have to hurt you? And what opportunities are there to employ those first two things to hurt you? In your job, you know, you may not be able to change the intent of the adversary, and you might have limited success in degrading the capabilities, especially in the private sector of an adversary. But you do have a lot of ways to close off opportunities. And that's one way to think about building a cyber defense or a physical and personnel security defense.

Yep.

I remember probably 10 years ago, Bob, you were coaching me on kind of nation-state or even run-of-the-mill online cybercriminals versus— and I liked what you said earlier, departments shouldn't be competing against each other, but sometimes like competing for what's most important, even if individuals aren't trying to compete, they can end up feeling competitive or being competitive. And I know you were coaching me on like insider threat of think about intellectual property that, you know, takes proprietary knowledge to know the means, like you mentioned, or the, the capabilities to do something with it. And like connecting that with maybe an online cyberattack with even if they got some of the things we're worried about, would they be sophisticated enough to know how and what to do with that? And then also every outside attack usually has some human element involved, like whether it's a co-opted insider or tricking a non-suspecting individual into helping them with their mission. Any additional thoughts on kind of that full connected human factor when it comes to all types of cybercrime?

Yeah, well, first there has to be a belief that I could be tricked, that I could be victimized. And, you know, we had a case in Texas when I headed up the FBI field office in Dallas where our national security cyber intrusion squad, that's all they did. Detected an intrusion into a business in Texas, a firm, fairly large firm. And the agent went and paid a visit to the firm, the cyber squad agent. Yeah. And the firm produced the general counsel to come outside and talk to the agent. And the agent, you know, gave his spiel, said, you've been intruded upon. And the general counsel was in denial and said, no, no, no, no, we have great cybersecurity here. And there's no way because we've never noticed anything. We haven't seen anything. No one's report anything, and I'm the general counsel and I would know. So this comes up to me because we knew that this was going to be a pretty serious matter. So we sent the supervisor of the agent and the agent back and asked to speak to the CEO of that company. And so they went and they showed— they laid out the case on a technical basis. And of course, that's when everybody sat up straight in their chair and said, uh-oh, eyes open. Yeah, we've been had. So as it turned out in this case, the nation-state adversary that we attributed this to used this firm as a hop point to go to a major research university in the United States and conduct an intrusion there. So this particular firm was not the end victim, and we figured out that they were just hijacked, to use their IP address identity, because they happen to be in a line of work that did business with universities and colleges around the United States. And we knew that research taking place at this university was of interest to this particular nation-state for their military weaponry capabilities. So, we kind of closed the loop there, but you have to be really careful with being overconfident that one of your employees will not be of interest to a sophisticated adversary. And then you have to do enough in the employee awareness and education space to make sure that they understand, I could be targeted and I really need to be careful and be vigilant and pay attention to the defensive mechanisms that hopefully your cybersecurity group in your company or firm like Reveal Risk, if you're doing business with a company, would— advice that they would give and you need to follow it.

Yeah, I think a lot of times there's a lot of focus on the intentional insider risk and not the unintentional.

Yes.

So I— so actually, that kind of makes me think about some things, you know, looking at, you know, career advice for early opportunities, but those interested in FBI, and we'll kind of get that into a second, but I kind of want to start off with thinking of Bob Casey now you get to make a phone call and you call Bob Casey 30, 35, 40 years ago and you get to have a 2 to 5 minute conversation with him. What things are you telling him?

Yeah, I would tell him, be careful about when opportunities are presented to you, unique opportunities in your career. Be careful about believing or convincing yourself, well, it's not the right time. 'Uh, it would take me away from my permanent duties to go on this temporary assignment.' Um, stop yourself, because there's a number of opportunities and assignments that have been presented to me that I chose not to pursue or tried to talk them out of having me do it. And had I done it, I think my career maybe even would have expanded in other ways. I would have had some very interesting experiences. Now, I had a lot of great experiences and I had things come my way that I felt was not the right time. And in some of those cases I was told, well, you're going to do it anyway. And it turned out to be okay. There were some challenges there, obviously. And, you know, depending on the line of work you're in, family challenges that come with those opportunities. But I would say in that phone call, I would say, hey, don't dismiss. Even though it may not be the right time, you may not think you're exactly qualified. Why would they be calling me? Possibly stop yourself and then maybe think about leaping and taking advantage of those things.

That's excellent.

You can grow.

Yeah, I know I do a lot of mentoring to some young individuals, both men and women, here in Indiana, and a lot of things they ask me is, what's next? What should I do next? And so talking to those who are interested in cybersecurity, corporate security, or maybe even in an FBI or FBI partnership, what's some kind of advice for early careers as far as what to get engaged with, who to talk with, or what are some things to be thinking about if that's the right path for them?

Yeah, well, obviously the pursuit of a bachelor's degree at least is important. It opens so many doors. And I say that being affiliated with Indiana State University and my wife and I endowing a scholarship beginning this year at Indiana State University.

Congratulations.

For students in the School of Criminology and Security Studies, which by the way has a cybersecurity program as well. And we're very glad to be able to do that. And I also have spoken to and mentored a number of of students at Indiana State going into those careers. You really need to, as a basic launching pad, you need that bachelor's degree. Understand your field of interest and what they are looking for to hire, and even entry-level. Understand the attributes and the skills and the qualifications that the potential employer is looking for. Don't think you know understand what they require and what they're seeking. So I would say do a lot of research. Ask yourself, am I willing to move around? Am I only comfortable staying local? Would I be willing to move? Would I be willing to move around periodically?

Yeah.

Would I take a foreign role somewhere? Don't sell yourself short in terms of doing the right kind of research. I think in— for some careers the type of degree makes a difference. And in other careers, the type of degree doesn't necessarily make a difference. And I also am not sure that which school makes a huge difference because I don't ever recall being asked what school I went to hardly at all once I got started my career. What my supervisors and leaders were more concerned about was what kind of performer was I?

And if you knew Larry Bird—

and if I knew Larry Bird, went to school when he went, he was a year ahead of me. But no, I did not know him. So yeah, that would be my advice. And in terms of, of course, the government, the FBI, whether it's the National Security Agency, CIA, FBI, you know, you're going to be required to hold a top secret clearance. And with that comes, you know, how have you lived your life? What sort of character do you have? Reputation? What sort of associates did you have?

Be careful what you put on social media.

Yeah, absolutely. I hammer that home to students that I speak with, because young people, I think in some cases, not just young people quite frankly, have this tendency to believe that their social media persona is separate from their real persona in life.

Yeah, that is not true.

That is absolutely not true. All I did was follow the person or like the posting, or just all I did was repost it. I didn't Comment, sorry. That's all going to be viewed in terms of your character and your reputation. Yep.

We've got time for about 2 more questions. One question that I have is one of the topics we always talk about is people and process. And a lot of times in cybersecurity, technology takes the front billing and almost to a fault, like we bought a bunch of tools and we don't, yeah, can't put 'em all in place. We don't have enough people, we don't have processes to scale anything. Both of our reveal risk practice as well as this discussion, we talk a lot about like making sure that's emphasized. Give us an example of a project that you were on— could be corporate, could be in the FBI— where process clarity, humans in the right place doing the right thing, made the big difference.

I would say that in the FBI, for an example, we acquired evidence against a person who was building an improvised explosive device in the United States and planned to detonate it. And we had to sequence our investigative activities properly. So you're talking about process, you're talking about compliance because you're having to follow, you know, legal requirements. And so how do we sequence, build, and integrate surveillance, physical surveillance of the person? How do we sequence entering into his residence to acquire evidence surreptitiously without him knowing it? How did we do all of those things? And it really requires some experience. It requires, I would say, adherence to tried and true processes and not let a special circumstance deviate you too much from those things, because that's when you run into problems, failures of your operation, of your task, or even compliance issues. You can run into compliance issues as well. So when you look at a case like that, that's an example that comes to mind in terms of people. Do you have the right people who understand what they're trying to do in the investigative work? How are you going to speak to witnesses and others without surfacing knowledge of the case prematurely? How well do you understand the process you have to go through to obtain evidence and make sure that it can stand up? In court. In the corporate world, the corporate security world, we had a major theft in the company that I worked for a dozen years ago of our product, a very significant theft, tens of millions of dollars, where a physical security system was defeated.

Wow.

And what was learned in, in that case is there was a lack of security standards put forward in the company, a lack of compliance environment telling the sites and facilities, you have to meet these standards. These are minimum standards, security standards, and you have to meet them. And then processes by which they could internally review and understand if they were meeting them. And then process for us in the security department to do compliance reviews. So things like testing the security cameras. Developing a process to do that so they don't fail on you and you don't know it. Or testing the alarm system and the sensors, testing the badge access system.

Yeah.

Having a process to reissue badges that are lost and things like that. So all of those being very fundamental process activities and they need a rigor to them and a culture, cultural environment to comply with them.

Well, you, I'm sure you fixed all that, but going back to the the process on the law enforcement side. Are you saying that Beverly Hills Cop is not a realistic depiction on how you should run your game?

Well, I remember seeing that movie many years ago for the entertainment value.

No, there's a new one that just came out, 2024. They ran it all the way back and it was the same damn movie, like same music, same soundtrack, same Eddie Murphy.

Don't fix it, man.

If in that movie I see them doing 6 or 8 hours of paperwork for every 5 minutes of action, then I'll believe it's true.

There you go. Okay, well, that just wouldn't play well in Hollywood, I guess.

No, I guess not, man.

One question to close this out, I want to ask all of our attendees this one here. And again, this is interesting facts. If someone— for those who may not know Bob Casey personally, uh, interesting facts or hobbies that very few people would know about you.

So in the big reveal, interesting facts.

Yeah, interesting facts.

In Dallas, I met the Dallas Police homicide detective Jim Lavelle who was handcuffed to Lee Harvey Oswald when Jack Ruby shot and killed him in the basement of Dallas Police Headquarters after Oswald had been arrested for the assassination of President Kennedy. Wow.

Can we talk about a second shooter?

Uh, there was no second shooter, I assure you of that. So I heard the whole story from Lavelle. I also met the Secret Service agent Clint Hill, who climbed up on the back of Kennedy's limousine after he was shot. Wow. And rode to the hospital. And the third fun fact is also while in Dallas, it was an interesting time. I personally briefed George W. Bush, former president of the United States, about 6 weeks after he was out of office in his temporary office in Dallas. I gave him a classified briefing of a matter that concerned him after I was sent there by FBI headquarters to do that. And that was a very interesting experience, just me one other guy and former President Bush in his temporary office with the door closed at 10 o'clock in the morning. Wow.

Well, I'll tell you, man, we've had quite a few conversations and lunches and stuff, and never ceases to amaze me, man.

But always a new story. Appreciate it, Bob. Thanks for coming out and have a good rest of the day.

Yeah, happy to be here. Thanks, guys.