Episode 60: Lisa Porter On Innovation, Technology, Security and Lessons in Leadership

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com.

Hello, I'm Bob Gourley, the Chief Technology officer of OODA LLC. Today on the Oodacast we have Dr. Lisa Porter. Lisa is the co founder and president of LogicQ Inc. A company providing high end management scientific and technical consulting services. She has a tremendous background of successful leadership positions in industry and government. Her last government job was the Deputy Undersecretary of Defense for Research and Engineering. In that role, she shared responsibility with the Undersecretary of Defense for research, development and prototyping activities across the entire Department of Defense. In prior roles, Lisa served as Executive Vice President of In Q Tel and also Director of In Q Tel Labs. She also served as the President of Teledyne Scientific and imaging. Previously, Dr. Porter was the Director of the Intelligence Advanced Research Projects Activity IARPA in the Office of the Director of National Intelligence. She had also served as the Associate Administrator for the Aeronautics Research Mission Directorate at NASA and had been a Program Manager at the Defense Advanced Research Projects Agency, or darpa. She holds a Bachelor's Degree in Nuclear Engineering from MIT and a doctorate in Applied Physics from Stanford University. Thanks Dr. Porter for joining us.

Well, thank you for having me.

Great. Lisa, I'd love to hear a little bit about your foundational story, starting with your decision to apply to MIT and pursue a degree in nuclear engineering. What was motivating you back then?

So this will date me of course this is the problem with answering these questions is people immediately figure out how old you are. When I was growing up in the 70s and of course I went to MIT in the mid 80s but growing up in the 70s and Bob, you'll remember this, thankfully I'm talking to someone who will remember along with me the gas lines were a phenomenon. I don't know if you remember that right, but sitting in those gas lines and the country was really worried about energy as a source, as a finite resource and we were very dependent on foreign sources. There was a general sense of this was a major problem of societal impact and national impact. I always knew I wanted to be some kind of scientist or engineer ever since I was a little kid. I grew up in the Boston area, so I knew of MIT and I was always enthralled with that. But I actually walked in the door of MIT knowing that I wanted to major in nuclear engineering and specifically fusion. I was very odd in that way because most people walk in and they don't have that specific a goal in mind of what they want to do. But I was determined to work on this energy source that was going to solve the problems of what we had been facing right. As a nation at that time. So that's how I ended up in that major. Now, I didn't stay there and there are a lot of reasons for that. Excuse me. I should have turned off my phone and I've got a ringer going there. Sorry about that.

No worries.

I just realized, wow, I didn't turn that off. So, yeah, there's a lot of reasons I didn't stay in it. Most notably that it turns out fusion is the energy source of the future and always will be is kind of the joke that turns out to be really true. So. But it was a wonderful major because, of course, it combined physics and engineering. Right. You had to know. You had to understand nuclear physics. You had to understand plasma physics, which I loved. You also had to understand all of the mechanical engineering and aspects of system engineering that design of reactors entails. So it was a great major to pick.

And then you went on to get a PhD in Applied Physics from Stanford.

I did.

Well, what is applied physics? Could you help us here? I know it's not theoretical. It sounds like an engineering kind of focus.

Yeah. So this is another. This is funny because you're absolutely right. The department was primarily focused on, some people might call it engineering physics. It had a very strong focus and strength, I should say, in solid state physics. So that merging of, again, solid state modeling, but with the applications in mind around a lot of electronics, a lot of great minds came out of that. That domain. But here's the funny part. There was also a component of applied physics that was solar physics and astrophysics. And that's actually how I ended up there. Because my plasma physics background, which I still enjoy very much, even though I decided I wasn't going to stay in fusion specifically, I said, wow, I can take all of these different courses in the regular physics part of Stanford. I can get a lot of these applied classes, but I get to still do my plasma physics. So it was this great little combination, but I have to confess, my thesis was not applied. It was a solar physics thesis focused on plasma physics and the heating of the corona. It was a lot of fun, but it was not applied, even though I got to take a lot of applied courses from there.

You moved closer to the defense sector, I guess is one way to put it. Right. You worked at IDA and in Logos Technologies.

I did, yeah.

World.

Yes, Yes, I did, yeah. I went and postdoc for a Few years at mit and then I said, what am I going to do with my life here? I got to figure out. And I had always had that national security interest. And so, yes, I moved down to Washington, D.C. area and took a job with Ida, which I loved. And that's a great place to work and get cut your teeth and learn about national security problems. And then I worked for Logos for a little while because I got to be more directly tied to darpa. So Logos was supporting darpa and it was this great way to sort of jump into the fray of what DARPA does. So.

Yeah, well, both of those, I think, are interesting points that I think people should take note of if they're at the earlier stages of their career. Great way to learn the defense establishment and a great way to move a bit closer to darpa.

Exactly, exactly. Yeah.

Later. Did join darpa.

I did.

This is one of the most famous organizations in the world, and I don't think anybody needs an introduction to darpa, although people probably have different views of it. I think most people understand that's a place where they're creating things that are required for Department of Defense but have spinoffs into the nation as a whole. And they've really done some incredible things. The list goes on and on and on. The most famous being the Internet.

Yes.

Today people are talking about what they've done to facilitate vaccine creation with.

That's absolutely right. Yes. Yep. Yep. The Moderna virus vaccine has a direct descendancy from DARPA's research. Yep.

Yeah. So, you know, clearly, I hope that DARPA always attracts the best and brightest and that people always try to pursue what you did in joining darpa. And I guess what I want to ask is, any tips for the person who wants to become a program manager at darpa? How do people get started there?

Well, you know, everyone has their own story, so there's not one little recipe to follow. Interestingly, you know, I always said I wanted to support national security, but I never wanted to work for the government. Right. So I actually had a real concern about becoming a, quote, government bureaucrat. I'll be honest with you. I, you know, I just, I just was like, no, I like the freedom that the private sector gives and the flexibility. So I like supporting Right. On the outside being an advisor and helping. And then 911 happened. So that was a changing moment for a lot of us, of course. But I started rethinking my mindset about this and the never say never became. Well, maybe I should think about it. And to be perfectly honest, Dr. Tether was the director at the time.

Right.

We know him. And as the sita, I had been asked to look at some specific things and sort of, again, remember, 9, 11, it just happened. So it was, what would you do if you were a bad guy? Kind of thing, you know, that prevent the surprise is a big part of DARPA's mission. And I came up to his office, I remember, and I briefed him on things that I thought I would do, and he hadn't heard those things before. And so he basically. He's really good at this. He convinced me I just needed to join the government. He's like, you need to join the team. And I even resisted. I said, well, I don't know. I don't know about this. Joining the government. He said, come on, Lisa, it's time. And I just remember that conversation. He was really good at looking you in the eye and just calling you out on what you needed to do. And I thought, okay, he's right. I got to do this. So that. So for me, that was my story. Right. Everyone has a different way that they get to darpa. Some people have a desire to be there, and they live across the country, and so they have to go through a sort of interview process and all that. For me, it was very serendipitous, and I happened to be right there, kind of doing a Hal Meyer presentation without realizing it. Right. By showing what could be done by the bad guys and what I thought we needed to do to. To prevent it and therefore kind of going through the process that a lot of people go through.

You said a Heil Meier presentation.

Yeah, it wasn't formally that, but I was answering the questions by explaining the problem and what should be done.

I think a lot of our listeners and viewers may not know what that is at all. And let me see if.

Oh, that's a good point. Yeah.

That's a series of questions that was come up by an icon in the research community which essentially says, what are you trying to do? How is it done now? How would you do it differently if you. And how will this make a difference? Those kind of questions.

Right, exactly. And when you say that, it sounds so, so obvious. Right. You say, well, those are obvious questions, and they are. But that doesn't make them easy to answer. Turns out right. And the reason I, you know, Hallmark is just a hero of many, many folks. Right. In terms of a lot of different reasons. Right. He was. He was a giant. He ran DARPA during the have blue time, which led to stealth technology as you know, he was a Texas Instrument fellow and all these other things. But that framework is probably the thing that he's most famous for because he insisted on it. And he insisted on it. The story. That's funny. And you can Google this and find this interview that he gave. It was because the artificial intelligence community at that time, right, the AI community in the 70s, was basically arrogantly telling him, you just have to fund us because we're brilliant. He was saying, well, you know, that's not a good enough reason to give you money. I need to at least know what problems you're, you know, what problems are you solving and how are you going to tell me if you're succeeding or not? And what metrics are we talking about here? And they were mad at him about this, but he wouldn't back down. He said, no, if you can't answer these questions, I'm not going to fund you. And that became the basis of. Every director since then has used them as a way to discern does this program manager and does this team have a good idea that's worth putting money behind taxpayer money? Right. So it's an important question.

Well, I'm going to post those questions in our show notes for this recording.

Because, yes, they're great.

People who haven't encountered them before will appreciate them because they're so. Simply put, I think an elementary school student would understand them.

That's right. But answering them is not so easy. People think, oh, yeah, those are obvious. And then you say, okay, well, let's, let's walk you, you know, walk me through the answers. And they, oh, wait a minute. That question shouldn't apply to me. I'm special. That's a lot of it, right? No, no, that, that's a nice question, but I don't need to answer that. No, you do need to answer. Yeah, yeah.

This kind of leads to another topic I want to ask you about. At darpa, in all places where there's technologists, some people are great individual contributors, and we need people like that, the big brains that create. And then sometimes they're not so good at leadership. Unfortunately, some people can never make the transition from independent contributor to a leader. Heilmeier clearly was a leader and a technologist, and there's so many others, including you. And I wanted to ask, what is it that makes the difference? Why can some technologists make that transition to a leader and. And others can't?

What's the difference there?

Well, first of all, thank you for the compliment. I think. I don't know If I'm a good leader or not. It probably depends on who you ask, to be honest. So let's talk about others that we know are great, like Hallmaier. I think someone said to me, so I've had the benefit of wonderful mentors throughout my career. So I think a lot of what makes someone good at something is having people help you and be willing to be honest with you about your own strengths and weaknesses so that you get better. I'd like to think I'm better than I was 10 years ago and 20 years ago. I may not still be good enough, but I'd like to think I've at least improved. And I think we'd all like to think that. And I think the way you improve in part is by seeking out people who are going to tell you, okay, this might be a way you want to think about doing something differently. This is your strength. Do more of this, that kind of thing. When you look at someone like Hallmaier, again, the word that comes to mind to me for a great leader, including him, is the word courage, the courage of your convictions, the courage to say, this is what I, as a leader believe has to be done. This is why I'm going to be very transparent and open with you guys about why I think this is the right thing to do. I will be open to listening to rational, logical points of view that may differ from me. I don't want to hear emotion. I don't want to hear arguments from authority. I don't want you to tell me how, in Halmayri's case, I don't want you to tell me how brilliant you are and how stupid I am for not realizing your brilliance. Those are not credible arguments. But I am open to those conversations, always opening to change my mind. But until you've changed my mind, here's the path forward. I'm going to be very open, and I'm going to stick to the courage of my convictions. That sounds really easy, right? That's just like, okay, that sounds good. The challenge is you have to. If you're going to do that, you have to be willing to accept that some people are just not going to like you. Right now, how Meyer pissed off a lot of people in the moment, in that time, I can't tell you how many people I've pissed off. I mean, I just, you know and I know it. And it's not like you enjoy doing it. It's not like you enjoy having people be frustrated with you because you're not willing to acquiesce and accept mediocrity and accept people not doing what they should do. It's that, you know, the consequence of not setting the standard and sticking to it. Right. That outweighs the fact that somebody might be upset with you for setting that standard. It's a lot about courage, honestly. It's the courage of being willing to say, okay, I know some people aren't.

Going to like this.

Some people are going to say really mean things about me. Some people are going to work behind my back to get rid of me. All of that is part of being willing to take on the mantle of being a leader. And I think people like Hallmark, in the hindsight now we just look at them and all the perfection. Right. Of like, oh, he was able to do this and in the moment. That's why the interviews are so fun to read. It wasn't easy for him. People of high esteem were mad as hell at him for daring to challenge him, you know, and, and, or them. And I find that to be comforting in a way. Right. Because it reminds you that it's never easy to take the mantle on of a leader because, you know, you've got to get people to agree. These are the standards. We're not going to compromise. This is where we're going. We've all agreed. You can be mad at me, but you got to get on board that kind of thing. Yeah. And some people don't want to do that, Bob. Some people, like, you know, that's just not for me. I'd rather just, you know, what I'm really good at is going over here and you give me the hardest problem and I'll work on it. But the whole thing about getting other people to do good and hold them to standards and deal with them being mad at me. No, I don't want that. And that's fine. By the way, to your point, it takes all kinds. The problem you run into is when somebody in the latter camp decides they want to be a leader. And then what happens, of course, is they're so afraid of people being mad at them. They don't want to deal with people. They don't want to deal with the challenges that come with having to confront when someone isn't meeting the standards. And that's when you get a whole bunch of mediocrity. And we see that every day. Right, right.

You know, Lisa, everything you said is.

So totally applicable to technology leadership and leadership in general.

I mean, it resonates with.

Good military leaders are thinking of the same thing. Good leaders in industry. It's just so relevant. So I appreciate your context there, and it leads to the next part of your career.

I want to talk about.

You went to NASA, where I know you must have had to apply leadership principles there because you were in charge of an organization. You were associate administrator for aeronautics. Well, first, what is that organization?

That is at the time, and it's still true today. It is the organization that's responsible for all of the aeronautics research throughout NASA. Most of that research is done at four different centers. Research centers. They're not called research centers anymore. They're just called NASA centers. Langley, Glenn, it used to be Dryden. It's now Armstrong and NASA Ames. There were over 1,000 researchers, 1,000 staff, I should say, spread among those four very different centers who were doing aeronautics research in the name of NASA, doing it for the benefit of the nation for a variety of reasons. That was what I walked into and was asked to leave. So that's kind of what it is. When I walked in there. I mean, it was one of those, okay, there's real change that has to be. Has to come about here. The OMB Office of Management and Budget at that time, before I came in, it had nothing to do with me. It was because of where NASA had gotten. They were very unhappy with aeronautics. They didn't see a vision, they didn't see a plan. They didn't understand what. What was going on. It wasn't being articulated. So they cut the budget 20%, which was a huge cut for the smallest part of the overall NASA budget to begin with. Aeronautics is just a tiny fraction in terms of the budget of NASA. So the morale was low. There wasn't clarity of what NASA aeronautics should be. What should it be about? Mike Griffin was the administrator. I had never met him before. I was asked to go and interview. And so I walked into his office, sat down and said, here are my thoughts at first blush, just sort of very broad. And he said, all right, I'm willing to take a chance on you, and we'll bring you on board and we'll see what we can do. And so I ultimately had to go through a process, but I was hired as the administrator to, I would argue we returned NASA back to pursuing the excellence that it's really known for. For aeronautics. So across all of those mission. Sorry, all those centers engaging more broadly with the private sector, pursuing really the cutting edge of aeronautics that had led to all this great invention and creation in the prior decades, we need to return to that. It was a hard thing to do. It wasn't the linear story I just told. It was a lot of bumps all along the way, but I learned a tremendous amount, for sure. And, you know, I learned a lot, I think, about how challenging it is to deal with a large organization with lots of different perspectives. Some people were really willing to embrace change, some people really weren't, and how you deal with that. So it was great learning. It was a great experience.

That must have served you well at iarpa.

It sure did. Yeah. It sure did.

Iarpa, the Intelligence Advanced Research Projects activity.

Right.

Which most people I think quickly will say, well, that rhymes with darpa. It must be DARPA for the ic. And I know it must be different, but that's the.

Oh, that is actually exactly what it is. That's exactly what it is. And, you know, when I was at darpa, I had had interactions with the ic, as many people at DARPA had, because DARPA sometimes did research and projects that had relevance to the IC, obviously. Right. As well as DoD there. So the problems are so similar in many cases. But we all wondered at DARPA at the time, why doesn't the IC have its own DARPA? Because there are some problems that the DoD can't really take on. They're just much more intelligence focused. So the 911 Commission actually made that recommendation. It actually had recommended an ir, but now it took several years between that recommendation and its standup, of course.

But by the time you were named, not really exist yet. Right. You're the first.

I was the first one. So it didn't exist. It existed for a few months. They had established an organization. There were people who had done a lot of the political elbow, you know, fighting, if you will, to make it happen. It would not have happened, nor would it have survived, frankly, if it weren't for Congress and specifically for the sissy, the staff and the. And the senators themselves. I mean, they really understood why it needed to exist and they frankly protected it. So, I mean, I got to give nod to that because people don't know that. They don't understand the history of IARPA and how contentious it was. You can imagine there was a certain organization that felt very sort of frustrated that they thought that was their mission.

Right.

And they weren't really happy that this IARPA was being stood up and it wasn't theirs.

Well, if it was theirs, why weren't they doing it?

And that was the counter argument. Well, you know what? You've had plenty of years to figure out. You need to be doing this, and you weren't doing it. So snooze, you lose. So. Just kidding. But the point is, it was a tough environment, right? There were. There were people who really wanted it and they understood it and they backed my play, but so to speak. But there were a lot of knives out, a lot of knives. And I learned a lot about the knife fights that happen, that have nothing to do with technology, but everything to do with what I was talking about earlier. The courage to keep fighting, right? The willingness to be as open as you can be, clarity and transparency of what you're trying to do. And that means that people are going to take you down. But as long as you're open and honest about it, you know, you're like, this is what we're doing. You get. You get enough people to say, okay, that makes sense. That makes sense. Let's. Let's support that. And fortunately, there were some wonderful people who supported. I will tell you, every DNI I worked for, ironically, I worked for three because there was a lot of turmoil in the early days. They were all wonderful supporters of iarpa. Once they understood it, you know, I had to brief the new person as they came in. Of course they got it, and they said, we'll back you. We'll back your organization. We're going to back what you're doing. And they did. And they're deputies as well. So without that support, they wouldn't be around today for sure.

I also want to ask you about your time at In Q Tel, which is, in my opinion, another very virtuous organization. I just love that place and always have. Every interaction I have with them is something that's intellectually stimulating for me. I learned something new, and I'm on the outside. I can only assume your time there was very serious and productive, but also intellectually stimulating, and you're probably learning every day.

Yes, it is a really special place. I'm pleased to hear you've had interactions with them. I actually didn't know that you had. You had mentioned that to me, and I thought, wow, that's great. It is a very special place. Chris Darby, as you know, is the CEO. He's done a phenomenal job. He's been there for quite a while, and I think a lot of the credit just goes to him and his team over the years and being very, very judicious and careful. Just the way DARPA is, by the way, and the way I'd like to think IARPA is in selecting who works there, very, very particular. They pick people who are just really bright, really Hardworking, really inquisitive and creative. A little bit contrarian. All those pieces you want and it's magic. Honestly, the people there are what make in QTEL so amazing. I was blown away when I got there because there's always A's, B's, C's and these in any organization. But I'm telling you, the Cs there are like the A minuses in other places. So I got to run the labs, which didn't exist before I got there as an entity. Thank you, Tel Labs. Chris was kind enough to say, lisa, I think I know what you can do for us and for the country. And he understood me. He and I are very similar in our desire to serve. He said, let's see what we can do. We've got this young team of guys who are really gung ho about space and commercial space. They want to start Cosmic as a lab. He said, here's what I think that means. We were figuring it out, what can we do? And we ended up doing amazing things. And by the way, I really mean the team that I led, they were doing all the hard work. Fantastically smart team, really tiny. Five guys. I used to joke, it's me and five guys and it's not a hamburger, but you know, still pretty good. And then, and then we did other things as well. So there were other labs that were going on. There was analytics out in Menlo park that was going on had predated Cosmic. But this notion of really having a focus on the more challenging technology areas, what's coming right around the corner, not the iarpa, darpa way out, not what the in Q Tel was investing in right this second, but sort of that bridge, what's coming right next that we need to be paying attention to. That's what I was responsible for. And it was a lot of fun.

Right.

Well, I have a question for you, and maybe this is a hard one. I know you interacted with a lot of CEOs, there's a lot of startups, a lot of pitch decks come to in Q tel, all these CEOs with great ideas, and I know you can't fund all of them, but do you have any general advice to a CEO? It doesn't have to be about in Q Tel in particular, but say there's a CEO that has created something that. And she or he thinks that this is going to really help in the national security space. How do they get the attention of people who can evaluate that product and procure it and bring it into the intel community? Or dodge.

Right. So in Q Tel is one of those ways.

Right.

Thankfully, think about before in Q Tel, it was an even harder proposition if you were one of those people. And in Q Tel does try to make it easy, at least for people to submit their idea and get on the, on their, you know, their radar screen, if you will. And they've always, I think, been very approachable in that way, but they're just. But they can only do so much to your point. They're only going to select so many. They've got a fairly small staff, and not every good idea is going to make it to their attention. I think this is one of the big challenges that everybody talks about. So how the, how does the intelligence community and the DoD, frankly, create more avenues for that creativity to come in and be, you know, have that exposure? DARPA is great if your idea is, you know, really kind of out there. And DARPA is probably one of the best places because they put out baas and they're very all about, frankly, the full and open competition. They don't care who you are. And the same with iarpa. It's like, I don't care if you're a Nobel Prize laureate. It doesn't matter if you don't have a good idea, go away. If you're a young person that's got a small company and you've got this great idea, no one's ever heard of you, but the idea makes sense, well, we'll fund you, right? That's. That's kind of the culture you want to then emulate, I think, across the ic. And people need to have confidence. You know, Bob, that's a lot of it. I talked to a lot of folks now that I'm on the outside, little, little companies, and they just kind of. There's a cynicism a little bit, right. Like, if I propose, isn't it hardwired already? Isn't it. Isn't it going to be going to one of these folks who already has all these clearances, you know, and when you don't establish that transparency of, hey, this is how we're going to engage, we are serious about wanting new ideas. We are going to be full and open in everything we do to the greatest extent we can. If you don't establish that trust with them, they're going to, you know, they're going to say, well, I don't know if I, if I can waste my time on this. That's a big part of it that people don't talk enough about. They talk about process. Right. Oh, we got to use OTAs, and we gotta. We gotta have all these app works. Something works. There's like a million works on the end. And that will solve the problem. Okay. But you still have to really make sure you're transparent and how you're making your selections, what you're doing and why you're doing it. Because people have to have that trust that their time is worth spending. Right. To you. Right. And I've noticed that in talking to a lot of folks, there's a hesitancy because time is money, as we. As we know on the outside. Right?

Yep.

If I spend my time chasing your opportunity, that's something I don't get to do over here. And if I'm wrong on making that bet, that hurts me very deeply in my company.

Right.

So, yeah.

Lisa, this also gets into your experiences in the Department of Defense in your last tour. And obviously, another thing that you had to apply there was your leadership skills. This is one of the most senior positions in the entire Department of Defense. And it's. If I had to tell people what it was who had no real DoD experience, I think, would it be fair to say that that is the role of the Chief Technology Officer for the Department of Defense?

It is. In fact, that is actually what was in the language. The NDAA language, I believe was. Was that it is the cto. And so therefore, I was officially like the Deputy cto, if you will. And that responsibility is, as you can imagine, is significant. So there's kind of two things, two aspects to it. Right. You're overseeing, frankly, all of the, if you could think about it, all of the R and D. So darpa, mda, diu, they were all direct reports to us. You have your own staff that's funding a lot of basic research. Right. A lot of things that go on that the DoD funds, you don't necessarily realize, you've heard of them here and there. They all have to be coordinated somewhere. A lot of that came under that office. But then to your point, and you know, you've been a cto, you have to be current and aware of what's going on in the broader acquisition community, because you'll get called in to various reviews and you'll be asked for the technical perspective. What's technically credible about this or that, or not technically credible. Right. And so one of the things that we did that I think was actually, ironically, I look back, and now that I've had a breather, I say it was fun. In a strange way, we were Asked by Secretary Shanahan at the time to say, all right, I need you guys in R and E to take the lead on figuring out what the DOD's 5G plan.

Plan is.

What should we be doing? What's our strategy? What's our execution plan? He was smart enough to know we got to go fast. We got to figure this out. Things are moving really fast. I don't even know what the DoD's role should be versus the commercial sector. But you guys all have to figure this out, like now. And we did. Now, it wasn't just us. Our job as being the point person was bring the entire department together, figure out who was smart enough to work on it with us, who had the, you know, sort of that hard work ethic to say, let's work it out, let's figure it out. And we did that. And so if you. If that's an area that some of your audience is tracking, you'll know that the DoD now has a very robust 5G plan and it's executing.

I have seen that.

I've also seen there's a 5G consortium of some sort. The National Spectrum Consortium.

The National Spectrum Consortium was part of that. It was literally about two years ago now. It was February 2019. So a little over two years ago, we started down this journey. There was no budget, there was no plan, there was no program of record, blah, blah, blah. None of those formal things. There was me and a team of folks who were just willing to say, let's figure this out. And they were from the cio, they were from all the services, they were from usdi. I'm not naming all of them because I'm forgetting, but it was literally a team. And we got. And I didn't. I said, look, no tents on the table. I don't care what your title is. That's irrelevant. Right? I don't want anybody to be worried about who should be here because I happen to wear a four star title. Who cares? Like, we are in this together and we busted our butts. I will say. And now what you're seeing is these large experiments at many bases coordinated with a National Spectrum Consortium as well as with the Navy's equivalent OTA structure. We put a lot in place. We got funding. Congress. Thank God for Congress again, I got to tell you, when. When you need them to do something and you give them kind of the vector, they can get stuff done with you. They were great. They were great. All of them. All four committees, by the way, had to approve for, for our early days of getting us funding when there wasn't any. They were all there with us. And now you look at it and you go, wow, that looks like you guys had that planned all along. Really linear, right? Oh, yeah, look at that. No, was. Nothing is ever linear except your story.

Because had I not heard your story, I would have thought, oh, it must have been easy. They just did it.

Yeah, no, it was like all things, it's hard. It looks really messy when you're in the middle of it. That's one of the things I tell young people today when they ask me, I say, you know, it's never easy. First of all, don't stress when you're making the sausage. It looks really ugly, right? It does. And when we were in the middle of that, again, what's your role as the leader? Quote, unquote. It's really to just allow the team to succeed. And you're the umbrella. That's what I told people. I said, my job primarily is the umbrella. I keep the shit from raining down on you. And sorry, guys, for me using that language, I am from Boston. And you guys go do what you're good at and I will protect you and I'll kind of keep us focused and going along the right vector. But everybody in the room was smarter than I was. My job, again, that courage to say to, to the higher ups, let my team do the work. We've got to run really fast. I'm not creating a cft. I'm not creating a da, da, da. I'm not doing this. I'm not having tents, I'm not having none of that crap. We're just going to get stuff done. And in hindsight, again, people were like, how did you get all that done? To the point where now you have in the president's submission, as you know, a significant amount of money, a plan, executing all the services, engaged, nobody fighting over each other. How did you do that? I said, well, this is what happens when you just empower the right people and you tell them you will cover for them if they go and run fast. Honestly, that's what it takes, right? And that's when you get higher and higher up and you lose all your specialty skills. That's what you end up doing as a leader. You say, all right, you guys are all smarter than me. My job is to protect you so you can go run fast.

That's great.

I have another.

A couple other topics I wanted to hit before we end today.

And one is I wanted to ask.

About security because you've had a Lot of time in engineering and design and you've worked with a lot of folks in government and I know you have seen unsecure systems and you've also seen secure systems. And we'd just love any context you can provide on your approaches to securing systems.

Right. So I would say, Bob, I've never seen a secure system, nor have you, nor has anyone else. So that's the, that's sort of the fallacy that I think we're all falling into the trap of. Fortunately, I think actually now people are really waking up to this. So that's the first thing is way back when I started iarpa, the whole, you might remember cnci, Right. The whole cybersecurity national Melissa Hathaway. Yes. And the billions of dollars that were accompanying that. And the whole question they were asking is, how do we build security systems? And I was having arguments with a lot of people saying that's not the right question. That's. That's not it. The question is, how do we operate effectively and resiliently in systems that are inherently not secure? I wasn't the only one asking. I don't want to imply that I'm some kind of brilliant person. There were other people asking this, but our voices were kind of suppressed versus those who wanted the. They wanted that easy button that you could press. It says, now I have a system that's secure. I don't care how much money it costs me, just tell me what I need to do and I can press the easy button and now everything's perfect. Life doesn't work that way. We all know that, but we all seem to want that to the point where we allow that to drive us to make decisions that ultimately are not good. So all of this to say what that led to was an approach where if you can build secure systems, great. Now I have this approach where I believe I can trust my system. Once I have trust in my system, now I've introduced a vulnerability because I believe it's trusted. Then Edward Snowden comes along and reminds you why that's not the right approach nowadays. I think you're seeing the community, at least in the networking community, at least in the cyber community, they've really learned from this and they've said, we've got to embrace this notion of zero trust. I'm a huge advocate of this philosophy. It doesn't come from cybersecurity. It comes from the intelligence community and how they operate, when they operate well, which is, hey, I'm not going to trust. Because trust is a vulnerability. I cannot simultaneously say that I am implementing zero trust and that I have a trusted network. That means I don't understand zero trust. I have to embrace the reality that I can operate without trust, but that means I have to approach things differently. I have to recognize that I am either already penetrated or I can or will be penetrated. How do I operate in that situation? Okay, well, now that means I have to think more in terms of resilience versus prevention. Resilience to the fact that ultimately things are going to happen. That doesn't mean you throw out prevention. It doesn't mean you do stupid. It doesn't mean you voluntarily say, I'm going to work with this, with this person or this entity that I know is going to try to hurt me. But it does mean that even if I think I can trust you because you're a good person, I have to stop myself and say, well, what does that mean? That doesn't mean they aren't vulnerable. It doesn't mean that they don't have somewhere in their supply chain that they've been breached. It doesn't mean that everybody on their team doesn't have something going on there. I've got to be smarter and employ a zero trust philosophy. And by the way, Bob, this is important because it's not just networks. So we're seeing the network community, we're seeing NSA come out publicly and say, hey, zero trust is really the way we need to think. Great. But it's not just networks, it's foundries. People love this notion of trusted foundries. Why? Why do you think that putting a perimeter around your foundry makes it secure? All it does is prevent you from accessing the cutting edge and the state of the art. We've put ourselves in quite a box in the DoD and the IC by embracing this notion of a trusted foundry, which is not provably more secure and more importantly has prevented us from accessing the state of the art. Therefore, we're not secure supply chains. Same point. Just because, first of all, you're not going to have everything built in the United States. You just can't. At some point, something has to come in. Whether it's the raw material or whatever it is, something is going to come in. Exactly. And so, all right, so instead of saying, I'm going to make everything secure by building a wall and not letting, quote, anything in, I'm instead going to recognize that there are inherent insecurities and I'm going to try to design architectures and approaches that are data driven and flexible, that allow me to take a risk based approach, to recognize I'm always making that trade and to do it with my eyes open.

Well, let me try this on you then. Let's say the approach, should the approach be yes, use best practices to mitigate as many vulnerabilities as you can, raise your defenses, but assume breach, assume that you will be surprised. So build in detection and automate that as much as you can and seek to protect your critical data separately. So if an adversary inside your system tries to attack that you get even more opportunities to detect and also detect breach, the movement of data out.

Right. I'm not saying, of course, that you tear down the first line of defense, so to speak. Right. You just have to recognize that that is not doing very much for any kind of determined adversary. So it doesn't mean you don't do it because of course, anything that you can already implement that allows for some protection is fine. But, but this notion that somehow now you're protected is what's gotten us into trouble. And so if you look at what NIST has done in putting out a zero trust architecture document that says, okay, this is our first step at educating the community on how to think about this, you will see, and they highlight themselves. It's not perfect. They actually acknowledge these are areas where this still has to be figured out. Right. Nobody who advocates zero trust, including myself, would say that's the solution that makes you secure. That's the whole point. The thing you got to believe and understand, I should say, is you ain't ever going to be perfectly secure. Life isn't like that. I mean, people who are not technical should realize the analogy here. The only time you're secure against anything bad happening to you is when you're already dead. What the heck point is that? Right? So similarly, if we operate any kind of complex system, of course bad things can happen and probably will. And so the question is resilience. How do you ensure that when the bad stuff happens, you've architected a system. Right. So that allows for resilience, mitigates whatever the bad actor is doing, confines what the bad actor is doing to a local area. Right. To your point, segments what they have access to for most of the rest of the data, make the data distributed as much as possible, encrypt as much as possible. All these tools, but with a mindset of I don't think I'm making it perfect, I'm making it resilient. It's a very different approach.

Right, right, yeah, very good, very helpful. I have one final Question for you, Lisa. And that is what you're reading today. Do you have any books that I do.

I actually just started a book called Sapiens. It actually came out several years ago. You may have heard of it. I think it's called the Subtitles, like A Brief History of Mankind or something like that. It's actually fascinating. I'm always reading, by the way, technical articles, right? And I do that for fun because I'm a geek. So, okay, I'm not going to sit here and rattle off the latest technical articles I've been reading, but for non technical reading, I do enjoy reading things like that. Now I will tell you because I think it's probably worth sharing. One of the books that I have found most useful to me recently is one that I've read and many of us are asked to read in college and then we kind of forget about it because we're too young for it in many cases, at least I was. And that's Marcus Aurelius's Meditations. So I now have that book by my bedside. And whenever I'm having a day where, you know, some of those things I was talking about, where I'm dealing with people who are just, it's like, don't let the turkeys get you down is kind of the subtext of that book, right? It's how do you deal with making sure you're staying true to yourself, staying true to your principles, treating yourself and others with respect to. Right? All of those things that we, we know that we're supposed to do. It's a wonderful book. And of course, why I love it so much, in part is because think about when it was written almost 2,000 years ago. And it kind of reminds you that all the stuff that we deal with today on our own level of personal issues, and we all deal with very much similar things, but so did someone like Marcus Aurelius 2,000 years ago. That's what I think is amazing, right? This is a Roman emperor and he wrote that book, as you probably know, to himself. He was not intending it to be for anyone else's reading, which is why I like it because it's so honest. There's such an honesty to it. But it's so fascinating because he's holding himself to a standard. He's reminding himself every day like, this is the standard you need to hold yourself to it. And I find on days when I've been frustrated, I've got it right by my bedside. I just pick it up, I just kind of go through it's Very simple. For those of you who haven't read it yet, written like in little quotes, almost little books sections. Anyway, I recommend that because it's inspiring. It'll help you do the inhale, exhale on those days where you're just wanting to pull your hair out. So that would be a book I'd recommend to everyone, by the way, and it's one you just read over and over. And Bob, I'm sure you've read it, right?

I have and I think of it frequently. You reminded me of an interview we just did with General Ashley who mentioned a similar book about our founding fathers and how much they relied upon the classics like that as they created our nation here.

Fascinating.

And then one other thing you remind me of, and that is the person I think of as the first hacker. And to me it was Hannibal who had to cross both the Pyrenees and the Alps and was told he cannot do it. Yes, but he did. And he told his generals something to.

The effect of we will find a.

Way or we will make a way. And his persistence paid out. He passes through the, the Alps into Rome. The big firewall that was going to keep him out. That was their trust based system. Yes, exactly that way.

Exactly.

He comes with war horses and war elephants and a whole army.

Exactly, exactly. Yeah. I think history is, is fascinating. You know, the one regret I have, and if I were to go back and tell myself my younger self, what additional courses would I have taken in college? I would have taken more history, you know, in high school. History is boring because it's just memorizing dates and you think, gosh, history is a terrible subject. Can't wait to get then. Then you read books as you get older, like you were just explaining and there's just so much to learn from history. Right. I mean that's such a, that's such a throwaway line. I realize it, but it's really true. And so I would say the one thing I'd recommend, even if you're totally a techno geek like I am and you just really want to get to the business of building, take the time to read. If you're in college, take the time to take a couple courses in history. You'll love it. The analogies are there to learn from. You know, we're all human, so we all kind of go through the same experiences in life. No matter if you're a Roman emperor or you're just, you know, the director of ir, but doesn't matter. And I think that's something to take away. So hopefully you know, our conversation today might inspire a few folks to go back and maybe read Marcus Aurelius, maybe take some history courses, maybe learn a little bit about Zero Trust. Yeah, it would be wonderful. So it's been great to spend time with you, Bob. Yeah.

Thanks, Lisa. I really appreciate it.

Yeah. You're welcome. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.