Unspoken Security Ep 46: Redefining National Security

I fundamentally believe that we don't center humans in national security, or at least in the way we think about national security in this country. Traditionally, we've thought about the military, about our defense industry and intelligence, and that is for a good reason. And of course, you and I grew up in that. We've been a part of that. But as I think about the ways in which people are threatened and potentially harmed, and we have to really widen that lens, widen that aperture to then be able to not only talk about those things, but also and also find ways to address them for more people. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. Been building and maturing intelligence programs in the private sector for about 10 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! So I continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. It's not your typical polished podcast. My dogs have made appearances on the show. I don't think we'll see anybody today, but who knows. People argue and debate. We even swear here. I certainly do a fair amount of that. And that's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences that most of us attend. These are the conversations we usually have when nobody's listening. Now today I'm joined by Lauren Zabrik, Senior Vice President for the Future of Digital Security at the Institute for Security and Technology. She works on Secure by Design. She's also the president and founder of LZX Consulting, LLC. Most recently, she served as a senior advisor in the cybersecurity division at the Cybersecurity and Infrastructure Security Agency, better known as CISA, where she co-led the Secure by Design movement, stood up the Cyber Response and Recovery Fund program, and led an effort to improve operational collaboration across the agency. Now, if that isn't enough, Lauren also has a stack of degrees. She's got a bachelor's in economics from UNH. She's got a master's in international relations from Troy. She's also studied at Georgetown and Harvard, where she has a master's of public administration. So as everybody who knows the show well probably knows, Lauren's way too good for this show. So I'm just excited that she was able to make some time to talk with us today. So Lauren, anything you want to add to that bio and profile?

No, AJ. Thank you though. That was incredibly kind of you. And it's really good to be here to talk about this stuff with you today.

Well, yeah, I'm super excited to have you on the show. You know, I— do I say that about all guests? Yeah, I mean, I guess I do.

Of course you do.

I like all the guests, but really, this is a special episode in my opinion. Like, you're— you bring some amazing background and some amazing knowledge. We can talk about some really challenging things that really affect everybody right now, whether they realize it or not. So, you know, the topic today is redefining national security. So, you know, a nice, light, easy topic. We're just gonna, you know, tackle this in a few minutes and fix the whole world, right? I think it'll be—

we're gonna solve everything.

That's right, that's the plan. So this is, you know, everybody else just strap in for, you know, however long where we are, and then after that, your whole life will be better. So listen, before we jump too far ahead, you know, we're gonna talk about redefining national security. Let's figure out a little bit more about, you know, where we come from, right? So I don't know about you, but I like, you know, comic book, uh, movies basically. I don't read the comic books much, but I like the movies. And heroes, we always talk about what's their origin story, right? Where they come from, what's their background. So, so I mean, you're a hero. Let's talk about your background in national security. What's your origin story, AJ Nash?

As I was thinking about this I just want to say I really haven't seen a lot of movies, but I generally know what you're talking about with origin story.

Very cool.

But essentially, my life has really been punctuated by national security failures. And really, yours has too, you know, especially if you're, you know, Gen X, millennial, et cetera, our generations, ours has too, right? And so I've been driven by this idea that we need to do better for the people in our country. But I also know that we've had a lot of national security successes, and that's what tells me that we can do better.

Hmm. Okay. I mean, I think that's, that's very interesting. I think you're right. You know, it's having grown up in national security, as you said, you know, I was, I was Air Force for 9 and a half years and I was a defense contractor and spent most of my time at the agency, as I said. And, So I've seen all sides of this, right? You know, the easiest one to talk about would be something like 9/11 in terms of, you know, this obviously life-changing event for everyone involved across the country and really around the world. And certainly for those of us who were in the intelligence community at the time, you know, this, this was labeled as a massive national intelligence failure. And there certainly were things that should have and could have been done better in retrospect. But it also was really heartbreaking, you know, for me personally, and I'm sure everybody, you know, around us. In that it, it's just hard, right? We talk about these things like they're, they're huge failures, and obviously 9/11 was a disaster. And again, when you piece everything back together in retrospect, you go, well, we had all these pieces in all these different places. And, you know, as a result, we launched ODNI to try to, to unify things. But it's always easy to do it after the fact. And what people don't know is all the successes, right? Because there's nothing we can do. We can't go on TV and talk about all these classified operations and all these hor— you know, all these horrible things that didn't happen. And that's fine. That's, you know, that's the quiet professional, you know, that, that we are when you're in the intelligence community. But it does make it really heartbreaking, you know, when something massive and terrible happens. And, and obviously, you know, I'm sure you and many others, myself certainly, we, you know, take it personally, right? You know, feel responsible that, you know, I wish we had done a better job. But at the same time, it's, it, there were a lot of obstacles and there were a lot of challenges and, and we had all this, all these divisions. Now in your case, you know, with your origin story, you were Air Force and then NGA and then, you know, in the private sector, you know, do you want to talk a little bit about the path and how that was, where you were, for instance, you know, in timeline so we can figure out where you were in terms of national security when some events happened?

Absolutely. So, you mentioned 9/11, obviously that event, I think, really pushed so many of our generation toward a career or an interest in national security issues. And as I've been thinking about our generations a lot, I kind of think that we're the ones who run towards the problems, right? And so I think a lot of us did that. I know I certainly did. I was in Air Force ROTC at the time, so I had already signed, you know, on the dotted line. But at the time, my father was a pilot and he actually flew that route a lot from Boston to Los Angeles. And so, but for a scheduling change, right? Could have been him. And so that event, of course, made me want to choose the intelligence community because again, the word on everyone's lips or the, the set of words on everyone's lips was never again. Yep. Right? So we, we run towards the problem and we say, you know, what can we do to help fix this? Was this, you know, a, a function of, you know, intelligence community issues and organizational structure. And I know that's something that you've studied probably a lot in, in your role. Was it, you know, different policy and, and how did policy influence those particular structural issues, for instance? So I served in the Air Force for almost 5 years. And so this was right at the be— you know, we, we had entered Afghanistan and then we started in the Iraq War. And then, you know, I remember sitting there watching the casualties starting to tick up, especially in Afghanistan.

Right.

And this was even before the influx of IEDs into the country. And I just remember thinking, okay, this, this does not portend anything good. Eventually I got out, but then I realized I want to keep serving, right? There's just something about us that, that want, that drives us to serve. And so I went back into the intelligence community as a civilian. Now, around that same time, a couple months later, my little brother was killed in action. He was an Army Ranger. And so once again, right, I was like, oh, I have to go and fight for him. So again, like what, what led us to that point? But then again, what, what sort of drove me to again, want to run towards that problem? And, and I did. But then, you know, even beyond that, right, we're looking at things like the financial crisis and the disinformation, and then of course the pandemic, right? There's so many different things in our— that have punctuated our lives that it's not about ascribing blame. It's more about what can we do better? What are the lessons that we can learn from these experiences that can help us to change policies or help us to change structures so that we can do better. That's, again, that's, that's like the other part of this is like, I know we can. I've seen examples that we can. And one of them in particular, I think about the moonshot in the '60s with President Kennedy. I mean, to marshal all of those ideas and resources and, and harness the power of American ingenuity to get us to the moon. I'm thinking of things like public safety programs, right? That the rate of car— or deaths due to car accidents has plummeted over decades because of public safety efforts. It's made aviation not only possible, but safe. Same thing with food and drugs and driving down childhood diseases and things like that. So those are things that that show me that it's possible. It's just, you know, I think having the expertise as well as the will and of course the political windows to make those changes.

Yeah, I mean, those are excellent points. You know, it's, as you talk about, obviously car fatalities have gone way down. You know, child mortality is down. You know, our quality of life, our healthcare, our healthcare system has just an enormous amount of problems. We could run episode after episode probably just on that discussion. But overall, certainly our life expectancy has gone up. You know, we, yeah, when we as a nation or as, or as a, as a species for that matter, humanity, when we want to get things accomplished, we're certainly capable, right? The technologies are there. The, I think you, you make the right point that it comes down to a lot of it's the motivation, right? And the, the ability to unify, you know, 9/11 was atrocious, of course. I mean, I remember it like it was yesterday. It's interesting, you were, you were ROTC at the time. I was active duty Air Force, so I was, I was actually at the 94th Intelligence Squadron, which is at Fort Meade, right next to NSA. So I obviously have some access to some things that were live at the time that I can't talk too much about, but I can say it was, it was a lot of bad times. And it's interesting that you mentioned your father's flight route. My sister was supposed to be flying into New York that morning. So I spent a chunk of that morning trying to find out if she might be on a plane that wasn't going to bring her home. She was not, thankfully.

But, yep.

Yeah. That, that was, but it also showed you know, right after 9/11, there was that brief window where Americans almost universally seemed to unite, you know. And, and we haven't really since, frankly, you know, politics aside. And, and listen, we had just come out of a really contentious election, you know. Half the country certainly didn't agree with, with who, you know, was sworn in. That's just— I mean, that's how it works pretty much all the time. But it was a very contentious election, as, as contentious as we'd had in history at that point. We've certainly since then decided to, you know, show that was nothing. But, you know, everybody united at that point, right? We had a unified cause. We had been attacked and Americans, you know, can come together on things and get a lot accomplished. And then we, of course, fell apart and fractured and we also fractured our war efforts as we were doing quite well in Afghanistan while you were still in college. By the time you were active as an officer, things weren't going as well because we'd split our forces with going after Iraq at the same time, which was a terrible strategic move. But anyway, I think it's interesting you point out that from that point forward, like I hadn't really thought of it until you and I were talking briefly in the planning stages of this. Yeah, our whole life really has been almost constant chaos and, and conflict, you know, and I hadn't thought much about it. I mean, you know, we had the Cold War growing up, you know, I remember, you know, being, having bomb drills as a, as an elementary school kid, you know, getting under your desk, which is, you know, comical when you think about it as an adult, that's not gonna do much good if it was really a nuclear attack. But, you know, from that day forward though, you know, it's been, a steady drumbeat of either domestic issues or then international issues. It's been war after war. We got decades, you know, between Iraq and then Afghanistan and then Iraq again. You know, it's, it's endless conflict. And now we have nothing but endless conflict at home domestically due to political divisions and misindis and malinformation and all sorts of things that are going on, which probably explains why I have bags on my eyes and I always look tired.

I was just gonna say, AJ.

Yeah, no wonder everybody's exhausted in our generation because You know, at the same time, we're the first generation in American history that has a lower standard of living than our parents because, you know, the boomer generation, better known as the locusts, pretty much ate up all the resources and have made things more difficult for us. So yeah, it's a, it's a great day, but I, I want to focus more on the positive that you started talking about, about things we can do, right? I mean, these are all the horrible things we've had to deal with and things we're working through, but you know, there's a lot we can do. And I think that's a, an important point you've made. And it's, you know, it's good to see that We have people that are pushing forward and saying, "I want to do more." So, you know, as we start looking at it, what are we getting wrong today, though, when we talk about national security right now? You know, that there's a whole lot to that discussion. What are most of us getting wrong right now in that discussion, do you think?

I fundamentally believe that we don't center humans in national security, or at least in the way we think about national security in this country. Traditionally, we've thought about the military, about our defense, industry and intelligence, and that is for a good reason. And of course, you and I grew up in that. So we've been a part of that. But as I think about, you know, the ways in which people are threatened and potentially harmed, then we have to really widen that lens, widen that aperture to then be able to not only talk about those things, but also find ways to address them for more people.

Mm-hmm. Yeah, I think that's a really excellent point, right? I think you're right. National security, and I think most people, myself included, frankly, when you hear the words national security, you immediately see the flag, you see uniforms, you see, you know, tanks and artillery and aircraft and, you know, the agencies and the government. And that's what everybody thinks about, I think, with national security. And I think you're right that that's a pretty narrow focus in a modern world, right? We're not in the 1920s anymore or the 1950s or even the 1980s. You know, national security now, I, I think you make a great point that it's, you know, we gotta have this wider aperture. We gotta take more people into account. It's, I don't wanna be cliché, but it seems a little bit like when we talk about corporate security and we say, well, corporate security is everybody's job, right? It's not just, it's not just IT's job or the physical security folks' job. It's everybody's job. I'm starting to wonder if national security isn't sort of the same thing, that we have to start figuring this out to the individual because everybody is a target. Everybody has risks now, you know, in a world where we're all so interconnected through, you know, social media. You know, we're all much more susceptible to influence campaigns, for instance, that can result in people making, you know, bad decisions. You can have lone wolves that come out of nowhere. They aren't, they aren't tied to an international terrorist organization. They aren't, you know, on a radar anyplace. It's easy to be radicalized. So, I mean, is that sort of part of your thought when you're talking about focusing on the people aspect and the individuals? Is it getting to the point of saying, hey, national security is everybody and we got to work on that level?

It's more about protecting everybody, right? So what are the things that you or I feel very troubled by, for instance, right? It's more than just the threat of an external attack, right? It's other things such as cybersecurity, right? It's things like healthcare. It's things like parental policies. It's things like climate safety, right? These are all things that, you know, really can harm us or really reduce our ability to thrive. And actually, I'd love to unpack the word security, right? So what does it actually mean? And I'd love to read you a quote by an author named Prabhakaran Pillai. And he says, "Humans not only want to survive, but also want to live their lives too." to the utmost. It is within this struggle for existence, somewhere between despair and hope, that the concept of national security hides in a world divided by nations. So I think that quote is really powerful to really unpack not only the idea of security, which he also says is, you know, the state of being untroubled by danger or fear, and it also unpacks the idea of a nation. And, and that's you know, how we as a people divide ourselves. But ultimately, what is a nation without its people, right? And so we have to make sure that people are secured, that they're safe. And I've actually boiled this down to our ability to survive and to thrive. So they rhyme. So that's easy to remember.

I like it. Yeah, it's good.

It's good to— So what are the things that allow us in this country to survive and to thrive. And that is, you know, that encompasses national security to me.

Well, that's a really interesting point. And I, and I, I've made bits and pieces of that point in other conversations. I, I never stitched it together this well. But it does make sense. You know, you talk about, you know, climate change is national security.

Mm-hmm.

Right. And, and so, yeah, I'm gonna use that as one example. I'll, I'll, I can talk about a couple others you mentioned there, but it's a challenge I think that I haven't really thought about until this moment. Right now when we talk about national security, again, people tend to look at the external threats from other nations. You know, China is a threat, Russia is a threat, Iran, North Korea, whatever you might say, right? And there aren't too many detractors in that. I don't think many people think that North Korea is a friend of the United States, for instance. I don't think that's a big matter of debate. I think most people think North Korea is an adversary, whether they're a genuine threat to us, a direct threat or not, you know, perhaps debatable to some, but I don't think anybody doubts that they're an adversary of ours. I don't think many people doubt that Iran is adversarial to the US, for instance.

You know, there's the government of those countries, right? Yeah. To be, yeah.

To be clear, the government.

Yeah.

Absolutely. Not the people themselves. Yeah. This is government to government. That's correct. Yeah. And it's a really important point to make, but I don't think there's, there's much debate on those. Whereas when we talk about, say, climate change, there's a large segment that doesn't even believe climate change is real. Now, you know, science I think has made a pretty good case here, but there's a large group of, of people who don't even think climate change is real. Nobody doubts that North Korea and Russia exist. Let's go with that one. And yet there's people who doubt that climate change even exists, which means it's hard to discuss it as a national security threat if people don't even think it's real. You know, so that, that's a huge obstacle we don't normally have to run into. And then you talk about things like healthcare, in my opinion, is national security, especially based on the definition you, you just gave, right? If national security is, you know, being able to feel a lack of, and I'm gonna get the quote wrong, but you know, a lack of, of the stress and the woe and the, and the fears and the frustrations basically. Well, we've, yeah, I don't know anybody who doesn't have that when it comes to our healthcare system. Right? Healthcare is national security. Yeah. You know, it's childcare is national security. Education is national security. Like, an uneducated populace is a much easier populace to overthrow or to dominate, right? So, you know, I think you talk about this.

And I've written about each of those things in the Substacks that I've created. But yes, all of those. And yes, each one of those things are national security. Exactly.

Well, that's a really interesting point. And I'd like to see a way We won't solve this one today despite what I said in the opening, but I'd love to see a way for us to help push that as a national message because that would change, I would hope, a lot of people's perspective on some of these things. You know, we don't fund education in this country nearly well enough. I don't, I don't know if there's any people even disagree with that. There's people may disagree on what education we should be doing, et cetera. But I don't think anybody doubts that we're not funding it well enough. There's, I've never seen teachers yet saying, I'm just, I have too much money. I don't know what to do with all this free time and, and money I have. And I have all these resources available. You know, they're not living large in, in the education industry.

Right.

You know, our healthcare system isn't properly funded. I have no answers for this. So yeah, I realize that for anybody who's, you know, gonna poke at me, yes, I haven't solved these problems. I'm just pointing 'em out in this case. But, but we're not funding these well enough, perhaps in part cuz we're not thinking of 'em the same way. It seems like the, you know, defense budgets haven't had a problem getting money. Boy, our defense budgets have gone up and up and up over the last several administrations. It's become one thing that both parties seem to agree on is we're gonna spend more and more on the military. Which is because I think the national security message, the concept of national security, the populace gets and they agree with it. And the world, you know, the American population believes the world's a dangerous place and it's out to get us. You know, since 9/11 forward, we've had a lot of threats. So it doesn't take a lot to convince people to spend more on their taxes. Is there a way for us to help in your— in your mind to get a national message across to people, say, hey, listen, these are all national security, you know, and maybe we have to talk about how our budgets are structured. If you really wanna be safe as a nation, it's not just more tanks and bullets and guns and planes. It's being healthier. It's being more educated. It's, you know, it's all these other components that we, you know, it's, it's climate change. Again, that's gonna be a huge national security threat to us. It's gonna result in, you know, droughts and, and famine and all sorts of things. You know, food security is national security. It, how do you think about that right now? You know, getting that message to more people is, are there any thoughts on that? I know it's a huge question to ask, but just solve this for the world, please, and we'll be done for the day. But how do we, how do we help people see this as, as national security?

I wanna help start that conversation. I, I think we're in a position right now where we'll just say there's a lot in flux. And I think hopefully there'll be opportunities in the future to help sort of rebuild certain institutions and I am hoping that the concept of national security can be a part of that, that again centers people as, you know, the main element, you know, who are we securing? What are we securing? So I really, I want this to be the start of the conversation, whether it's among listeners and or whether it's where, you know, listeners may have conversations with local lawmakers, state, federal, et cetera. Um, because I think it's also one idea to be able to name those issues, but it's also one to start thinking about ideas and policies to address those as well. And in the, the Substack that I've, I've started, I, I list some things that we can think about, some potential policy ideas. It's not everything. It's not exhaustive. Right. And if we're going to center more people, then we need more people to come to the table with these ideas and ready to talk about them.

So it's, we've gotten this, we're getting more and more extreme, it seems like. And I wonder how we're going to be able to have those direct connections and conversations regularly enough to get past that initial, you know, dysfunction and start seeing all the things we really do agree on. Right. And I think still most people on, on all sides have a lot of things we have in common. We all want our kids to be safe. And healthy and happy and I think smart, whatever we define that as, and productive. You know, we all want to have clean water and clean air. I'm pretty sure nobody wants to die of toxins. You know, we all want to have reasonable healthcare costs and we all want to have a good standard of living and, and have, you know, home security and food security and all these things. The vast majority of the things we care about as a country, everybody cares about. And yet it's all buried behind this other stuff. And again, maybe if we can talk about it in terms of national security, that's everybody's national security, maybe we can get back to it. But I don't know how we're going to get there. I don't know how we get those in-person relationships at scale to make it happen. I hope we can figure it out though.

Well, I think you make an interesting point there with the idea of being face-to-face with people, right? When I think, I could be wrong, but when you're having that discussion with someone and I don't know if they're going to go out and say, well, you're not such-and-such enough. Right. I don't typically have those conversations in person. Right. It's more of, you know, bids for connection and trying to, you know, establish ways to work with each other, basically. I'll tell you, whenever there's an in-person event, whether it's a conference or, you know, an event or just an opportunity to get together with people, I get so excited.

Yeah, me too.

You know, to your point about where the, the pandemic just really, I think, forced so much online, and I think that we're, we're still there. And I love getting together with people now, and it's kind of hard when you're kind of face-to-face, you're like, I kind of forget how to actually interact with people. But I— but we have to flex those muscles and, and rebuild those neural connections and pathways and figure that out. I think for humanity, for humankind. It's, it's something that I think we, we ought to be intentional about.

Yeah, no, I agree. I, I, I jump at the chance to go to the conferences and it's almost always the same. I get excited to go, then I'm, you know, complaining about all the things I have to do while I'm there and I'm too busy and all the things I didn't get accomplished I said I would. And then I get back and I'm tired and then I want to go again. You know, it's this overwhelming— yeah, it's all this endless cycle. But, but I always do. And I, there, it's rare that I'll turn down any opportunity to go to a conference, an in-person thing, because I I think there's importance to it. I think there's challenges in industry specifically because almost everything is tied to a return on investment, right? Yeah. So if you want to go to a conference, well, what's the ROI on that? And it's hard to explain connectivity is, is my ROI for this. Like, yeah, I guess getting to know people, making more connections, building a network, building some shared understanding so that when I send that email 2 weeks down and I foolishly word it poorly, it doesn't become a spiraling argument cuz they know who I am cuz we've talked. It's like, oh, I had, I worded that poorly. You know, the ability to spend some time in a room with somebody, to break bread with somebody, changes your perspective of them. You give them more grace later on if they say or do something, you know, out of line, because you know who— you think you know who they are and you can correct them, and they take that correction differently as well. Whereas if it's all online and we've never talked, we've never seen each other, it's just one, one spitting, you know, sentence at another, at each other, and they get ramped up and ramped up and everybody's one-upping each other. And actually, you know, it's, you know, on the verge of threats and all sorts of horrible things, and you realize this person wouldn't probably be this way in person with most people.

Yeah, or, or that, or, or think about like during a crisis, right? I'm sure you've heard this phrase, never exchange a business card during a crisis. So, you know, from a security perspective, I think you can make the argument, right, to go out and make those connections because so you know who to call or, or her to go see when the crisis demands certain action or certain, you know, communication needs or something like that. And so I, I think there's that element to that, the need for connection too.

Yeah, that's a really good point. Like, it's always helpful, even if you only talk to somebody once or twice, it's better than cold, you know, reaching out out of nowhere and saying, hey, we're total strangers, but here's a thing. And, and I think that's a really good point. It's part of the reason I, I probably, part of the reason I like connecting so much. I like people sometimes, But I, I say I like people and then sometimes I say I don't, but, but I do like building these connections and these networks. And then you have the ability to reach out and say, oh, hey, I, I know somebody who needs a thing. Oh, I know somebody I talked to. I mean, I talked to 'em like 3 years ago.

Yeah.

But, but they'll probably remember me. And at least I'm not a complete stranger. You know, I'm not asking for a thing. A lot of times it's connecting people. I do a lot of, I don't know about you, I imagine you're similar. I do a lot of connecting people to people for no benefit of my own.

Totally.

Right. Hey, I know somebody.

Yeah.

I know somebody. You guys should talk to each other. I think you, you'd get along well, or I think you could help somebody, et cetera. You know, and that makes the world a better place, but it only starts if you actually knew the people to begin with.

Yeah.

You know, it's hard to just connect people you've never talked to at all. You know, I'm not gonna connect two people on Twitter with each other and we've never met in person. They don't have a reason to believe I'm who I am, let alone believing who each other is. It's a weird way to do networking, right?

But it's challenging. I also, yeah, I also think it's really important for getting things done even in the steady state. You know, I think about going back to you know, sort of an interagency construct, right? When you know the person who's in that other agency and you kind of have that professional relationship, it humanizes each other. Even when you may disagree on the path toward a certain outcome, I think you're more likely to get to the outcome because you have that understanding and that relationship. And so I just think that it's so valuable for, you know, these, these really big ideas and these really big goals.

So we've talked a lot about, you know, the past and, and some of the challenging problems and a really, you know, big discussion about what national security is and kind of that wider aperture. So let's get into what you and your team are working on right now. So how are you guys, what are you working on? What are you creating to address some of the issues we've talked about when it comes to national security?

So one of the issues that I mentioned in this whole plethora of X's national security, and for a long time, I've said cybersecurity is national security.

Absolutely.

But really, if we take a step back and really try to look underneath the hood of cybersecurity, it's really a function of software security as well as, you know, the way that software is configured. And so my team, myself and Bob Lord, now at the Institute for Security and Technology, are continuing on the work that we built at CISA on Secure by Design. And we are continuing that work. And I, I should also mention that Jack Cable was, he rounded out the, the trio there at, at CISA. He is an adjunct fellow at IST as well. But really it's Bob and I are continuing this work at IST and it's really focused on, we have a couple lines of effort and I can get into that in a second. But, but really Secure by Design is, at its core about changing incentives so that we can change behavior, right? So we can shift the behavior of software companies to make safer software, more secure software. And, excuse me, our premise is fourfold. So number one, our security, our economy, our daily lives are really run on software. 2, with few exceptions, that software is built insecurely. Now, 3, the root of that unsafety and insecurity is not because, you know, the companies are inherently bad. In fact, they are working within an incentive structure that prioritizes speed to market and features, right? They're acting rationally. And so, it's really about the market forces and the incentive that lead to that unsafety. But number 4 is that we know how to make safer software because we can look to history for historical models, such as aviation, automotive, food and drug, to do better, right? We have those models to help us get there. So that's the hopeful part, right? That we can do this if we want to. And so the, the way our theory of change, right, the way that we're going about tackling this is to continue to drive adoption of secure-by-design principles. And that's through things like policy reform and, and guidance and things like that. Strengthening the institutions around software security, and that's looking at things like the open source software, open-source software security ecosystem, CVE, incorporating security into coding education, whether at universities or even self-taught pathways, looking at measurement and economics, right? How do we quantify the cost of insecurity versus security? How do we move software from what's called a credence good? A credence good is this very esoteric economic term, but essentially, when you go to, when you choose a doctor, for instance, you don't necessarily know the quality of care you're going to get. You can't really do that research. You can probably look at some, you know, reviews. But until you, and you might not even know if that ex, you know, the, the experience of going to that doctor was, was quality. Same thing with car repairs, right? Do you actually know if that service did the job? Do you know if your car was actually fixed, right? That's what we mean by a credence good. So how can we move it so that software can become either an experience good or a search good? And what that means is, okay, now that I have the experience of using this, I know it's a quality product. Or even better, do I have some benchmarks that tell me that this product is quality, right? We don't— we, we're not there. We don't have those yet. And that's something that we'd like to get to. And then finally, we really want to act as the hub. Between government, industry, academia, nonprofit, both domestically and internationally. And, and we especially think that this international coordination is going to be extremely important, especially where, for instance, Europe is working on the CRA, the Cyber Resilience Act. And, you know, we in the United States, you know, are looking at other things too. So that's the theory of change. We're really excited about how we're going to continue to drive software security and safety further.

I mean, that's all fascinating and obviously noble, you know, and I agree with—

thanks.

I agree with the vast majority, if not all of it. And the stuff I might not is probably because I don't understand it. But no, no, I think it's— I think it's—

you want to get into it?

I don't need to expose my ignorance to the whole world. All 12 of my listeners will leave. But I think— I, I mean, I think it's, it's noble, but I'm gonna ask what I think hopefully others would think is an obvious question, I guess, is for me. So You, you talk about the, the challenge we have is the motivation, right? It's, it's, I, and I don't know how to address that. So you talk about the, the, it's been more about speed to market than security, and it has been for a while, right? And we've seen this, was it, I was just talking to somebody the other day about this. This has become normalized. Microsoft, in my opinion, started all of this when it just became common that they would put on operating systems that were not good. And then the world became the, the testers of those things. We all became beta testers for, you know, Windows, I don't know which one was the first one. Probably Millennium was probably the worst one they ever put out.

And, and we're the crash test dummies, right? That's what we are.

Yeah. And I mean, Patch Tuesday is accepted. They put out something that is a, a almost ubiquitous system. Almost everybody uses Windows in some fashion. And, and we all know that every week we're going to have new patches, new things, and they're not alone, right? I'm not trying to pick on them. I think they were a large company that did this first and it became kind of a normal. And you see lots of software that comes out and it's just endless patching and updates and changes, right? And you go, well, listen, I realize there's nothing's going to go perfect, but boy, it seems like there's an awful lot of flaws in this thing that went out the door. Where's, where's the QC process? And most recently, it's occurred to me that we're seeing this with AI so that we have all these AI platforms coming out and they're, you know, people believe them and trust them because they're, they're humanized and they're wildly flawed a lot of times. You know, I've spent hundreds, maybe thousands of hours at this point working on, you know, prompt engineering. You know, I didn't mean to, I just sort of fell into, you know, working with AI. And I've actually interrogated some of, some of these platforms and had them tell me that, yeah, I didn't follow the instructions. You know, I, I, I defaulted to speed instead. You know, I was kicking out quick answers. If you ask AI a question, you get an instant answer. Bam. Just, you know, pages and pages, you know, volumes of information coming back. When it's going that fast, it's not 'cause it processes the entirety of human knowledge quick enough to give you that right answer. It's pulling segments and pieces and then kicking out what, you know, is good enough perhaps. And, and that's because they've figured out, in my opinion at least, that their number one priority for users is speed. If I ask AI a question and it took 12 minutes to gimme an answer, I'm probably not very engaged with that platform and I may walk away. If it gets me a terrible answer that's flawed in many ways but looks good and feels good and they do it in 12 seconds, at worst I'm gonna go check those sources, go, oh, this is garbage, and I'm gonna keep interacting. And it's just another round and another round and another round. And that's the most important thing for most, uh, software companies, you know, and platform companies is interaction, that you continue to work with it in some form or fashion. So how do we get the motivation to change? You know, right now the motivation is profit. What was the other piece? You know, speed is more important than security. And I've written extensively and talked extensively about generational shift in that we're reaching generations that don't care as much about security. You know, boomers, Xers cared a lot more about our personal security, about our information security. We don't have that anymore. You know, Zoomers, millennials, these generations don't. I mean, they live publicly, you know, data breaches don't affect them. They don't feel it the way, you know, others used to. They just assume all their stuff's already compromised. So how are we going to be able to— how are your plans for shifting that piece to change it? You mentioned it's about motivation. How do you motivate companies that are, you know, motivated almost entirely, certainly primarily by profit margin, to shift from what is fast and will get it in people's hands and start generating revenue to what is going to be slower but safer at probably, you know, exceeding what they want it to cost and therefore driving down their profit margin?

Well, remember how I said we can look toward historical models, right? We have some examples in history that give us clues about how we can do this. And I will draw on the automotive example. In the 1950s and '60s, cars were designed for speed and for style. Sound familiar?

It does. And— Those are my favorite cars.

And at that point, customers were actually courage to go get a magazine and go sort of in the back and look for pieces of equipment to help make their car safer, right? So there is something called the camber compensator, for instance. And I think at that point it was $20. And I don't know what that would be in today's money.

Sure.

But the customer was expected to go and do this research and say, okay, I will get that. And I don't— so I can put it on my car, I can bolt it on after, right? So that my car doesn't swing in the wind or it doesn't flip over. Now, what happened was a number of people, but I'll just say specifically Ralph Dieter, did some research and really found out that it was a lot of times the design of the car and not just quote unquote the nut behind the wheel that led not just to this higher number of accidents, but also to, you know, some really horrific injuries and deaths. And he saw that problem as a real issue for our national security, right? He might not have said that back then, but for the safety and the security of the people in this country, saw deaths were increasing at an unacceptable rate. And so he wrote this book called Unsafe at Any Speed, and that prompted some congressional hearings. Now you might imagine what the response of the automobile manufacturers were. They didn't like this, and they actually sent some private investigators and tried to get him in compromising positions and things like that. But that actually served to galvanize public support for this and outrage to understand that, you know, he was being targeted like this. But ultimately, his testimony and showing data, I think really convinced Congress to create the National Highway Transportation Safety Act, which also created the administration of the same name. And I think it was Lyndon B. Johnson who signed that into law. And so having that law to compel auto manufacturers, like really from the beginning, I think within maybe a year, maybe 2 years, I can't exactly remember, to put seatbelts in, to put in anti-lock brakes or collapsible steering columns, things like that for that tranche of cars rolling off the lot. But it wasn't just that that led to increased safety. It was our ability to collect data, so doing crash tests. So we mentioned crash test dummies before. It was the ability to collect crash reports. So there's a really cool podcast called The 99% Invisible, and there's an episode in there called The Nut Behind the Wheel. And it talks about how this guy went along with police to understand how they collect information for those reports, because those reports feed a database, right? And it helps researchers to understand the systemic unsafety, right? The systemic issues that are causing different accidents. And what are the ways that we can actually prevent those or fix those in automobiles? And then the other section of data is defects, right? So automobile makers have to tell the government about defects in their product. I'm sure you've gotten a lot of letters from your—

Sure, you get recalls, yeah.

Exactly, right? And they have to do that because if they know that a piece of equipment is going to cause you harm, In fact, there is, there is a, an example where there is a piece in my car that, like the automated start, you know, when you stop at a light and your car kind of stops for a minute.

Sure.

And then it's supposed to come back on.

Yep.

Mine stopped in the middle of the road. It was so traumatizing. And of course later on I get, I get a recall notice for this. But it, but that's again from these incident reports that lead them to say, okay, there's a systemic issue here. And so our ability to collect this data so that we can understand, again, those issues to then come up with mitigations and guidance to then push out to the manufacturers and of course even to the states and the way that road safety is constructed. So there's a whole ecosystem of safety so that we can have more confidence enhanced in, you know, in driving, for instance, and survive more crashes. Because what is this about? Again, it's our ability to survive and walk away. Just like, you know, again, for national security, it's about our ability to survive and to thrive.

So are you suggesting we're going to have to get to the point where we have like a National Highway Traffic Safety Administration or an NTSB for air? Are you saying we're going to need something like that for software, for, you know, for technologies, which by the way, I don't think is a bad idea. I think it's actually a great idea. My concern would be, well, twofold, I guess. One, you know, we're the government, we're here to help. There's gonna be plenty of people who don't love, you know, that idea of another agency in oversight. But more importantly than that, I think, is just we're currently, I think at least in politics, shift from side to side, but our current political structure is very anti-regulations, you know, it's, uh, and that the pendulum swings a little bit and we're talking about a, a a whole lot more regulatory control, which, which by the way, I've advocated for when it comes to cybersecurity. I think it's going to be a requirement. Companies will only be as secure as they are required to be because the market isn't dictating it. You know, breaches aren't, aren't resulting in losses of, of customers and revenue and things like that. So if, if the market isn't going to dictate it, then the market doesn't care. You and I consumers don't care, and therefore companies won't because they're about profit. So it is going to take regulation, in my opinion. But is that what you're suggesting? We're going to need sort of a, a national, you know, agency of some sort, like the National Highway Traffic Safety Administration, for software development, for technology development?

Well, look, ultimately, this is what has led to safety in other industries. And so I think it's really worth looking at the different structures and authorities and, you know, policies that we've put into place in those industries to make people safer. Now, understanding that there may be headwinds right now, but every, I think, effort to make things safer and more secure has faced headwinds. So I think what we have to do is really just go back to what works, what works. Now, that might take a while. So what are some of the other things that we can do to shift incentives? One of the things that we talk about a lot and that we really want to continue to work on and really dive deeper on and give people more resources here is this ability to generate demand. So we call it secure by demand. I think there are a lot of people who are, who say, well, I do demand security, but I don't know how to do it. Right. And I think, you know, from a lot of the perspective, a lot of, a lot of software companies, like, well, we're not hearing that we want this demand, right? You, you said earlier, if you are interacting with a particular app, especially an with a chatbot, if it's taking too long, you're like, okay, I'm going to walk away. But ultimately, you know, and that's, that's sort of right, voting with your feet. But so we have to be able to translate that sort of demand into security. And one of the ways that we've talked about this is from a procurement perspective. So how can we help to concentrate that demand signal in procurement decisions such that that starts to signal to these companies that actually these things are being demanded, that they are wanted. And then how do we use that to, again, shift those incentives and change behavior?

Hmm. So, well, it sounds like you're going to have to be the Ralph Nader of change when it comes to technology and cyber. So I don't know if you're— if that's the job you want, but But I do think it's interesting. I, I think this has actually been fascinating because I think you're talking about something that's incredibly important, you know, and, and you have two interesting, well, you have many interesting pieces to this, but I think framing it as national security, I think is, is very interesting 'cause that's where this does fit in. And that changes the discussion a little bit about, you know, how we're gonna do this is that it's a national security issue. Also aligning it sort of in line with, as you said, past experience on how we've been able to regulate other industries to force manufacturers to care a little bit more about things that consumers need to stay safe, to survive, to not, you know, be harmed by the products and services that they're getting. I think, I think those are really fascinating ideas. And then, you know, how to, how to drive this forward. So yeah, this is, this is a really, and we could keep going on, I'm sure about this, but we're going to run out of time. But I think this is a really interesting piece. I'd be interested to learn more about, and you know, we'll talk about it offline. I'd like to learn more about the work you guys are doing and, you know, maybe there's something I could do to help as well, or at least Hopefully this gets out and we find smarter people than myself who, who jump in and say, hey, how do I help? Because—

Well, well, and that's, that's the IST way, right? Is we want to partner with like-minded, or not even like-minded, but people who want to help, right? So IST sits at this nexus between security, technology, and policy, and that involves a whole ecosystem. That involves government, industry, academia, nonprofit, And when I say industry too, it's not only the manufacturers, like the software companies, but it's the consumers of that too. And so, you know, those two groups have different voices and different needs. And so to be able to bring them together to have these conversations, I think just make the policy recommendations and the things that we can do more powerful. And really, you know, looking back to our work at CISA, You know, there were, there were certain things that we could do, some, some levers that we could pull in government and some that we couldn't. And that's, you know, one of the reasons for, for being at IST is, you know, now we can sort of look at things from a different perspective and maybe pull on some different levers. But, you know, at CISO, we had, we created a pledge, a voluntary pledge, and we got over 300 software companies to sign this. And it wasn't just, hey, we pledge to make more secure software. It was actually 7 concrete actions, right? Enabling multifactor authentication by default, having a vulnerability disclosure policy, these sorts of very concrete actions that they would agree to, you know, to work towards over the course of a year, 2 years, et cetera. And I think there, there's a little bit of criticism, like, well, you know, how are you going to effect change through voluntary action. But I think it was a really good first step, right? To get people talking about this, to get people thinking about the things that need to change and to show people and maybe the world of like what's actually possible, right? If we can work on these 7 things to get us closer, right? Because we really need to push this along. Then I think that that is— it shows us that we can change. It shows us that we can really make a difference in this field.

Yeah, absolutely. And I think then, you know, the other side of that, you know, coin, of course, is to push it on the market side. Market demand still drives everything, right? So as you do that, you know, you made a good point. Like, these companies, as I said, you know, they're all about profit margins, etc. So they're negatively, you know, motivated on some of these things. But there's also the other side, that's customers who also are profit, you know, driven a lot of times, and they don't want to spend for things that don't work. And, you know, if you have to keep shuffling through different software after software after software, and you have breaches because of softwares you acquired, et cetera, you'll, you know, buy less over time. So you don't just have the software companies and, and the manufacturers, you have, you know, the banking industry, for instance, you know, who has a ton of leverage and could certainly lean in and say, hey, we're only gonna go with companies that are secure by design because, you know, this is gonna make it better for us. And, and maybe we don't care about our customer safety or security, but we certainly care about our profits, you know, and, and we're not gonna spend as much time and energy, you know, and deal with the breaches and all these other things. So I'm sure there is some leverage there. So maybe the market will still drive it, even if it's not the individuals in the market. Maybe the, the larger companies will be able to do it. So this is fascinating. I, again, I, I'm so thankful you came on the show. I appreciate you taking the time for this and all the work you're doing at IST. And I hope anybody here who's paying attention, you know, checks out your Substack and, you know, reaches out if, if there's something they want to talk to you about, about how to help with IST, cuz it's fascinating. Now we're getting to the end of the show, so we do need to wrap this thing up, but Like every guest, you got asked, you get asked the same question and you don't get, you don't get a free pass on it. So the name of the show is Unspoken Security. And with that in mind, I need you to tell me something you've never told anyone before. Something unspoken.

Okay. So I recently discovered Cheetos. Cheetos. Do you know about Cheetos?

I'm, I'm aware of them. Yes. It's not a new discovery for me. I think Cheetos is not a, I could Google and find out how long Cheetos have been around. I'm going to guess they've been around 40 or 50 years probably. So yeah, not a new discovery. This is not your You're not Christopher Columbus on this one.

I think that's where my reticence to talk about this comes from, because I know they've been around forever, but I've recently started to eat them. And so my kids begged me to get some recently, I'd say about 2 months ago. And you know, at the end of the day, and you're just like, mm-hmm, fine. This is just a battle I do not wanna fight.

Yeah.

Okay, fine.

Yep. Sure. 77 years, by the way. That's how long Cheetos have been around. 77 years. Okay. Yeah. You're just catching up with, you know, 3 generations, but go on. So your kids talked you into this.

They talked me into it. They said, well, grandma, let us have some. I was like, fine. I'm not gonna fight this battle. Grandma. Fine.

Yep.

All right. So, but let me just say it's the crunchy Cheetos. I don't know anything about the other version of Cheetos. No idea. Never had them.

Okay. So, all right.

We open the bag. They're very excited when we get home and I start eating them. I'm like, have you guys had these before? These are amazing! But what is it? And so now, AJ, I will sneak into my pantry after they go to bed, and I will just have a handful of them. And my husband will look at me and be like, what are you doing? Don't look at me right now, I am eating my Cheetos.

Oh my God, like an addict just sneaking around. I could stop anytime. I could quit anytime.

Like, stop anytime. Absolutely. I keep them up on the top shelf, like, so the kids get—

that's good. You have orange fingers. I didn't do anything. You're out. Cheetos. All right, that's your, your unspoken thing. That's, that's different. It's unique. I've never heard anybody talk about it before. Cheetos. Yeah, 77 years Cheetos apparently been around. I will say, for anybody watching, I— or listening, I don't actually like Cheetos personally. I have had them, but, you know, good for you that you found a, you know, not the worst guilty pleasure. You know, if it was a thing you're hiding in cabinets away from people and sneakily, sneakily consuming, Cheetos is a much better option than many I've heard. So, you know, fair, fair. Yeah. You could eat a lot of Cheetos and probably not have a lot of negative consequences. So, but all right. So, so your, your unspoken, your unspoken thing is that you now are a rabid Cheetos fan apparently.

Thank you for letting me unburden myself on your show with my secret Cheetos obsession, AJ Nash.

I hope you— yes, I hope you feel better. Listen, you know, talking about these things is the first step, you know, towards, towards recovery, I suppose. For anybody who ever runs into Lauren now, feel free to give her Cheetos.

The crunchy kind.

Only the crunchy kind. So you haven't had like the Flamin' Hot or any of the, the other ones that they're working on?

We have. It's fine. It's— but, but there's like the original.

Mm-hmm.

I'm so crunchy.

Okay.

Crunchy.

All right. So anybody knows if you need something from Lauren, you need help from IST, they may, may take Cheetos in trade. If there's anybody out there for, I believe PepsiCo may own Cheetos, there may be an opportunity there as well. All right. Well, listen, that's awesome. That's, I, I appreciate you sharing this. I appreciate you having the courage to, to step forward and share this, you know, this deep secret with the world. But no, more importantly, you know, I appreciate you taking the time for the more serious discussion about, you know, how we're gonna do better when it comes, you know, to national security, right? We had this, you know, this whole chat about, you know, about redefining national security. So, you know, I appreciate it. I'm going to wrap it up here. Any last thoughts for anybody listening or watching, whether it's about things we talked about or how to get ahold of you or, you know, what's going on that you want to chat? Any last thoughts before we close out?

Yeah, if you want to check out our website at IST, which is again the Institute for Security and Technology, it's securityandtechnology.org. And I look forward to chatting with you and, and hearing your ideas. And AJ, just thank you so much for having me on. This was a real pleasure.

Yeah, absolutely. Totally my pleasure. Appreciate it. I'm sure we'll have a chance to get you on again. So listen, again, thank you so much for this. Thank everybody who listens and watches. If you like the show, please, you know, make sure you give good feedback and, you know, likes and stars and all the things like that and share and tell everybody so we can keep growing the audience. If you don't like the show, don't, don't watch, you know, ping me and let me know and I'll try to make it better. But please don't tell people how much you dislike it. Just let me know and we'll see what we can do to improve it. But, you know, with that in mind, thanks again to everybody. Thank you again, Lauren, for coming on today. I appreciate your time. And with that, I'm gonna close it out. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.