CIA Deputy Director for Digital Innovation at OODA Salon

This content is from a recent OODA Salon with Jennifer Eubank. Jennifer is the Deputy Director for Digital Innovation at the Central Intelligence Agency. She goes into topics like her office and her responsibilities, as well as her views on the emerging threat landscape. She specifically discusses things that she thinks business leaders need to be aware of regarding this threat landscape. Additionally, Jennifer gets into some new responsibilities that she and others have at the CIA for working with industry. I believe what she says is something that anybody who wants to work with the CIA should pay attention to. For more information on this and other related topics, please visit us@ooda loop.com I'll put a link below. Welcome ladies and gentlemen, to today's OODA Salon. I'm Bob Gourley, the Chief Technology Officer of OODA LLC Technology. Today in the OODA Salon, Jennifer Eubank, the Deputy Director of CIA for Digital Innovation. Jennifer, thanks for coming today.

It's my pleasure to be here. Really looking forward to our conversation.

Great. And I want to give folks a feel for your bio and what jumped out at me as I read it. And then I give you a chance to fill in what I may have missed. 1. You are a career government professional. You spent time at the State Department where you were in the Foreign Service.

That's right.

And for me, as someone who's been around government for so long, when I hear of the Foreign Service, I think of the professional cadre that really makes diplomacy work. These are the State Department professionals that work overseas to interact with our partners and our adversaries even. So, that's the Foreign Service. And I hold that in the highest regard. And I was just wondering, did I say that right? What is the Foreign Service?

That's absolutely right. So it is our cadre of diplomats and specialists who deploy around the world and work in our embassies overseas. And we engage with the local governments and then we engage in various multilateral fora think the United nations, think regional gatherings to advance U.S. interests and to partner with allies around the globe.

And then something else jumped out of your bio at me, and that is you went to CIA where you worked largely in the Directorate of Operations. And that in itself, when I meet people from the Director of Ops, these are professionals themselves. But the very top tier gets selected for these positions of trust called the Chief of Station that works in the embassy. You did that four times.

Yes, that's right. Can you tell us what is the best job in government?

Is that right? What is a Chief of Station?

So our chiefs of station lead CIA teams overseas. We're dual headed as also the representative of the Director of National Intelligence. So we have two roles. One is to lead a CIA team, often with our engagements with the local government, our partnerships on, you know, threats of common interest, think counter terrorism, counter proliferation, these kinds of things. Looking to advance US Interests overseas. Doing so, I guess like the Foreign Service, but with a very different toolkit, if you will. And then as Director of National, the representative of the Director of National Intelligence, the job is to help, let's say, encourage integration and cooperation across the intelligence community, entities that are represented in an embassy overseas, and, and to ensure that we are focused on things that matter and that we're leveraging each other's capabilities and resources and operating as a team rather than as individual players. Thank you again, Bob, for the introduction, for the opportunity to participate in your UDACAST event. It's really a pleasure for me to spend time with you today. Clearly, I'm not in my office, I'm at home. And it's a great opportunity for me. I hope to share some of my views, my perspective on this evolving digital landscape and what it means for the intelligence community. We just talked about the intelligence community overseas a moment ago. What it means for the organization I lead at the Central Intelligence Agency and the future of the intelligence business. I thought I'd start by outlining why we created the Directorate of Digital Innovation and explain what it is. I should back up just a tiny bit more to. To explain to your audience, your viewers, your partners, that CIA is comprised of five directorates. You hear about some of them more than others. Our Directorate of Operations, where I grew up in the organization, is that that we just discussed, working around the world to advance US Interests and protect our national security. We have our Directorate of Analysis, which provides all source analysis and objective insights to policymakers to help informed decision making. We have our Directorate of Support, which is most amazing. Support professionals anywhere in the world, doing everything from logistics to medical services, you name it, that keep a large, complex organization that's worldwide running smoothly. We have our Directorate of Science and Technology. The Directorate is probably closest to the one I lead, which is the Directorate of Digital Innovation. If you think of the two, it's perhaps not the perfect way to describe it, but think about technology with a physical manifestation and technology with a digital manifestation. And that's largely where the lines are drawn. DDI as we call it, Directorate of Digital Innovation is our most recent creation and it was the first new directorate created in over 50 years in the agency. And you only have to read the papers to see that the cyber forces and other threats we're now confronting in the digital landscape are really formidable. And though it's not something that most people think much about, all these forces are changing the very nature of the intelligence business. They represent. I hope it's apparent to everyone a real danger to our national and economic security. But sometimes people might seem a little bit surprised. I don't think we should be surprised. Certainly you are not, Bob. Probably our participants are not surprised, and certainly the CIA is not surprised by the rise of all these forces online. Six years ago, the CIA created this first new directorate in over 50 years. And it was really a move to redesign the intelligence enterprise to meet these emerging threats in the digital domain and to leverage all these new capabilities for operational advantage and analytic insights. Now I'll take just a slight detour and bring it back. I just want to share because, again, not many people work in this business. But the espionage business, as I see it, is fundamentally all about the art of the possible. Success requires a lot of creativity and ingenuity, a fair amount of determination, and all combined with a really healthy dose of optimism. Our officers around the world have to believe that they can achieve what others might think simply impossible. The Directorate of Digital Innovation, or ddis, as I mentioned earlier, is our acronym. We attempt, we're trying to chart the course for CIA's Art of the possible in this evolving digital and cyber domain. Coming back to what DDI is, DDI today represents this multidisciplinary, multifaceted fusion of cyber and cyber defense, open source collection, which is really important data science and artificial intelligence and enterprise information technology, all of which are increasingly essential for CIA's success in this new world. Right? A world of ubiquitous sensing, growing cyber threats, and the exponential increase in data. And so our mission within CIA is to integrate CIA's human, technical and digital operations at scale to counter our foreign adversaries, as we would say, at the speed of mission. And to make this happen, we have another really important responsibility. We are charged with raising the digital acumen of CIA's workforce as a whole, helping to position the agency for success, we hope, long into the future. And now this might be DDI's mission, but we do none of this alone. Partnerships, whether within the agency, with other members of the national security community, or with patriots in the private sector, are really critical. And that's one of the reasons I love so much speaking at events like this one. So thank you again, Bob, for the invitation. Our workforce in DDI is really capable and highly skilled. I would say they're amongst the best in government. They work as integrated, multidisciplinary teams each day tackling some of our most daunting challenges. I mean, daunting in many different ways. Daunting technologically, operationally, and analytically. This workforce sits at kind of the nexus, if you will, of technological threats and the data explosion. And I see our work becoming only more critical to the Agency's success and, by extension, our national security each day. So, as you mentioned, Bob, I come from a different background in the organization, and it's been both a revelation and a privilege to lead the Agency's digital workforce, which, again, I find tremendously talented, creative, and dedicated. That when we talk about threats and opportunities in the digital landscape and what they mean for our mission and our national security, I speak as more than, let's say, the head of a large government organization in Washington, D.C. as we've just talked about briefly. I have spent most of my own intelligence career running operations overseas. And I've seen firsthand what our adversaries are capable of, as well as the power of integration, indeed the increasing necessity of integration for our own success. I've been there when we have woven together new types of digital expertise with our traditional strengths in science and technology, and all in partnership with our core human intelligence trade craft. The kinds of stuff that people remember from spy movies, most of which is fiction, but a little bit of it is true. And in the process of all these years overseas, I've certainly been part of victories both both large and small. And like anyone in an extreme career that's all about risk, I've certainly seen my share of setbacks. And so when I speak today about what's happening in the digital landscape, this explosion of data in a highly connected world of ubiquitous sensing, the frankly unrelenting onslaught of cyber threats we face from hostile actors, and how we as a service and a country respond is. It's more than just a theoretical or academic discussion for me. It's intensely personal. And so the mission of the CIA is changing as a result of all of these forces. CIA's mission has never lacked for clarity, and it's evolved and changed constantly in the many years that we've been an organization. And it's done so in line with changes in the world as a whole. And when the CIA was established back in 1947, our principal rivals were the Soviets, later joined by their surrogates across Eastern Europe. And for decades, we sought to prevent the spread of Communism, which threatened the American way of life. And after 9 11, which was already a decade after the collapse of the Soviet Union, we pivoted and we placed greater emphasis on counterterrorism, and rightly so. And I give our organization, the intelligence community, the US Military, and lots of patriotic Americans tremendous credit for keeping large scale international terrorist attacks from our shores all these many years. What's different today, perhaps, is that our mission is more complex than ever. So terrorists continue plotting to attack our interests and those of our allies around the globe. That hasn't changed. We see the rise of these more autocratic regimes around the globe. And we're now in this new great power competition, as people like to say. In essence, we live in this kind of multipolar world, and at times it's a relatively dangerous world. And some of the most consequential threats we currently face are now in the digital domain. In recent years, we've experienced just a complete transformation in that environment. For us, our mission responsibilities become progressively more and more challenging due to the high threat environment that we see out there, at least in the information arena. Just look at last week's log4shell vulnerability. A few lines of code, and there is pervasive impact all around the globe. Like many of my colleagues in government and industry alike, as we try to navigate this new digital domain, our agency has been grappling with just how to manage, right, how to manage the explosion in both volume and variety of data that's been fueled by this technological change. It's transformed the intelligence business in many of the same ways it's transformed the commercial marketplace and our global economy. So I don't fool myself. We're not the only business in town. Challenges found for everyone, of course. But. But for those of us in the intelligence arena, sometimes the stakes are particularly high. So our longtime strains continue with Russia. And you just need to read the newspaper these last few weeks to see that tensions are very high in the region even as I speak to you today. And China, of course, has emerged as a significant strategic challenge. And beyond this great power competition, plenty of other state and non state actors alike are, are vying for power and influence on the world stage. And all of these forces are leveraging technology in support of their causes and leveraging the digital landscape as their domain. So when I think about our work, when I think about DDI, and I think about the CIA and the intelligence community, in the final analysis, at least in my final analysis, our own competitiveness as an intelligence service and a community will depend on how fast, relative to our adversaries, we turn the evolving digital landscape to our own advantage. And so I'll maybe back up a little bit and talk just a bit more, just a little bit more about what that landscape looks like. Anyone who reads papers knows that foreign states have leveraged their cyber capabilities to steal information, influence foreign populations and to menace private industry when physical and digital infrastructure being really favorite targets. Although an increasing number of others are dabbling in cyber, China, Russia, Iran and North Korea remain, I would say, the core antagonists on the global stage. Each is at the controls of a pretty well developed and well resourced cyber programs that are laser focused, let's say, on US interests at home and abroad. Joining this club of late are criminal ransomware outfits who have monetized hacking and are plotting frankly as we speak every day, all day to hold US networks hostage at some kind of digital gunpoint, just as they did earlier this year with the colonial pipeline and JBS attacks. Now what's little new is that or what is developed almost below the radar. Hackers operating in and from China are becoming really formidable players in the digital underworld and barely concealing ties to cyber elements of criminal enterprises, some known criminal enterprises. The Chinese government views its competition with the west as a zero sum equation where China's rise must come at the expense of America's decline. At times that has prompted or fueled some pretty bold cyber aggression, saturating US networks with disruptive intrusions designed to undermine our security and our competitiveness. China's systemic, almost, I would say, industrial scale theft of our personal information and intellectual property is both shameless and unrelenting and part of a concerted campaign to chip away at America's prosperity and diminish our economic might. And again, I make reference to my previous statement, their conviction that China's rise can only come at our decline. Now the People's Republic of China presents a prolific and very effective cyber espionage threat, a growing influence threat, and it possesses pretty substantial cyber attack capabilities. China's cyber espionage program is particularly noteworthy or formidable in two regards I would highlight. One is its sheer size and two, its there's this vast contract hacker ecosystem. Now Beijing also sees cyber as a primary means for conducting political warfare. It's a loose concept, but it can include virtually any means short upward to achieve national objectives. One aspect of China's influence campaign that's particularly noteworthy, referring back to this theme of scale, is the tremendously broad array of languages and media used to disseminate Beijing's kind of influence messaging around the globe. And we've seen this in recent years as vast Chinese spam networks have posted videos on YouTube in order to influence audiences both in the US and around the world. And these sorts of foreign influence operations, I think they don't get the attention that they deserve. We think of them as not very effective or not very professional. And certainly the quality of some of the videos has been, has not been fantastic. But these sorts of operations play out pretty regularly and they do have real intangible impacts on the US and on our allies around the globe. But even with China's rise in this digital landscape, we can't forget Russia, which remains a really significant cyber threat. It has unleashed increasingly sophisticated espionage, influence and attack capabilities against the west and some of Moscow's regional rivals. The Russians consider cyber attacks a pretty acceptable tool for deterring adversaries and prosecuting conflicts. And they view large scale cyber intrusion cyber collection as pretty routine business. We saw this in the cyber supply chain operation earlier this year against Solar Winds, where Russia's foreign intelligence service executed a cyber espionage campaign against the US by placing malicious code in broadly distributed software products. And this was a pretty powerful demonstration, or reminder, as if anyone needed it, of Moscow's capabilities and proof that public and private organizations in the United States remain clearly in Moscow's crosshairs. But they're not alone. Moscow and Beijing are hardly alone in any of this. Iran's technical expertise and enthusiasm for aggressive cyber operations further jeopardize the integrity of US and allied networks. Particularly worrisome, I would say, is the Iranian track record includes attacks on critical infrastructure, as demonstrated by their multiple cyber attacks last year against Israeli water facilities. North Korea's cyber program remains troublesome. North Korean hackers have long posed a threat to the integrity and stability of the international financial system itself. And they've engaged in a variety of illicit activities to include cybercrime to generate revenue for the regime. Speaking of cybercrime, last but certainly not least, are cybercriminals motivated by simple financial gain. Their goal is to compromise our personal and financial data and leverage it on underground black markets. Now, ransomware is just the latest incarnation of this threat. And US consumers and businesses alike remain susceptible to all forms of online fraud and theft. And proving that even criminals are leveraging digital innovation. The recent appearance of ransomware as a service has made ransomware available on a scale simply never seen before. And when we consider the potential impact of aggressive ransomware attacks on, say, critical infrastructure or government networks, well, you know, the potential impact is pretty darn clear. Now, taken as a whole, our national and economic security are put at risk by these threats. But As I said earlier, you know, we're pretty optimistic bunch, it's not all doom and gloom. Technology, as always, is kind of a two way street, right? It provides windows of opportunity for our organization and others in the intelligence community to strike back, to turn the tables on our rivals and competitors and gain the strategic advantage we will need to succeed in the 21st century. And so. But how do you do that? Right, how do we do that? Certainly a central pillar of our strategy to outmaneuver adversaries in the digital sphere must be a wholesale embrace of the power of innovation. Now I get it, it's probably a greatly overused term, but innovate we must. In a rapidly changing digital world, each moment we are standing still, we're actually falling behind. And so in ddi, innovation is more than part of our name. It's. I don't know what I'd say, it's our mantra. Well, let's just say it's the essence of who we strive to be. An adaptation to the shifting intelligence landscape has long been encoded in CIA's organizational DNA. And I made reference to how the CIA has changed its mission focus so many times over the decades. And this adaptability, this flexibility for us in ddi, it's really foundational to everything we do in this constantly evolving, I use the term euphemistically, battle space. We simply must embrace risk and experimentation as key to innovation, each an essential step in the process of unlocking new insights. And these are the new insights we're going to need to succeed in this 21st century digital landscape. Now, it's fair to say that the coming decade will bring an unprecedented set of national security challenges. They're going to demand an unprecedented response. And to ensure CIA's readiness for long term success, we've recently made some kind of minor but really smart and important adjustments in our top priorities as an organization. And those are China, People's Republic of China, technology, our workforce, and partnerships generally. And we've done this in order to optimize the Agency's ability to confront future threats, all while continuing to focus on the really important and enduring challenges that we face, including Russia, Iran and terrorism. And perhaps our best guiding principle at a time like this, which is tremendously challenging, almost unprecedented in some ways, you know, our best guiding principle comes from a famous Latin proverb, right? Made famous by the Roman poet Virgil 2000 years ago. Fortune favors the bold. And indeed, if we want to prevail against 21st century foes whose technical mastery is matched only by their malign intent, it's imperative that we develop new cutting edge tradecraft, new platforms, new tools, new new technological solutions that provide a decisive operational advantage. And every day we fail to innovate, every day we fail to take chances, fail to challenge ourselves and conventional wisdom, we risk mission failure or worse, obsolescence. Now, innovation is not just the core of our mission in ddi. It's frankly the lifeblood of American industry. And it's the lifeblood of any organization endeavoring to adapt and triumph in this new digital world. And there's a simple and very well known example that I think illustrates the point quite well. Think about your old neighborhood Blockbuster Video store. Well, at least those of us who are old enough to remember that the collapse of this one time empire is a cautionary tale, frankly, for all of us, revealing the fate of any organization that fails to innovate in a hyper competitive and data driven world. Digital World and Blockbuster Story is very well known. So I'm not going to repeat the whole trajectory here, except to highlight one thing, and that was that is its rapid collapse from the top of its industry to complete irrelevance in the span of just six years. All because it failed to innovate as others aggressively leveraged new technology and rapidly expanding digital infrastructure. And in some ways, maybe I'm stretching it just a little bit, but in some ways, the Blockbuster story reflects the crossroads we in the intelligence community have reached today. But it's not a choice between, I don't know, complete and utter Blockbuster style failure or following some proven route already mapped out by others. It's about our willingness to be kind of explorers and experimenters ourselves and to chart out a new course and think about industry. Right? We're government, but we think about industry a lot. We work with industry very closely. For certain teams of designers and engineers at our largest tech companies and entertainment companies, think Netflix, Apple, Disney, Amazon. These teams of engineers aren't just tinkering with their existing platforms and trying to optimize meeting the needs of their customers today. And nor in the Blockbuster example, is modernization the act of what, Upgrading an existing inventory from VHS tapes to dvd. I mean, they did that and they failed. Success in this digital world hinges on the ability to project, to anticipate requirements and to envision solutions well into the future, to anticipate and gamble on the future, as uncertain as it may be. And the same holds true for the art of espionage in a world of dramatically fewer real secrets. Think about social media, online digital news platforms, ubiquitous sensing, commercial data collection on land at sea in the air, and frankly, the very Internet itself which provides the backbone for so much of it. All of this together means that we no longer lack for at least some insight even in far flung corners of the globe. Think the price of fuel in Siberia, or the conditions at a port in East Africa, or the size of a pro democracy demonstration, well, anywhere on earth. All pretty much available at our fingertips on our mobile devices. While secrets, real secrets, the plans and intentions of of hostile governments and international terrorists, for example, the events that have yet to happen, all of this becomes ever more difficult to uncover by traditional means. As with any really complex problem, success can be unlocked, at least in part, through real innovation and effective partnerships. We in the CIA are not alone in pursuing tomorrow's solutions. And yes, I would argue being first does matter. It always matters. Ask those who led the Manhattan Project. Ask NASA, ask Netflix, Ask China. Do they aim to be first to lead in the digital world? The Chinese government has answered that question itself and has said that it seeks world dominance in the field of artificial intelligence by the year 2030. Now, the secret Service has a saying about schedules, and I think everyone's heard this one, but if you're early, you're on time. If you're on time, you're late, and if you're late, well, just don't even bother coming in. So similarly, the United States, and I mean United States, whether we're talking about government or industry, we can't simply aim to catch up to the Chinese, the Russians, the hackers, the cyber criminals, and everyone else who might present some challenge to us. Because the moment we've caught up in this ever developing digital landscape, we are already behind. And the race for decisive advantage in the digital realm is not about keeping pace with our competitors. It is about outpacing them and beating them to the finish line. Again, real innovation and effective partnerships will at least ensure that we can do that. So if I think about the future and what's next, what does that look like? Safeguarding the national and economic security of the United States? I hope I can say it's paramount to all of us. Right? But we can't do it on our own. And that's why the CIA places such value on smart partnerships with fellow patriotic innovators in the private sector. These partnerships promote greater exchanges of information and more efficient use of resources, and they bring broader range of expertise to problem solving. And while our specific equities occasionally differ, I mean, I get that there's business, there are business priorities, and there's national security priority. You know, we can each say without hesitation that we're on the same team. You know, we all want to see the United States succeed and flourish and remain a global leader. And do so, do so while still reflecting the Western democratic ideals we all hold so dear. Now, the private sector has always been America's engine for innovation and change and is one of our single greatest strengths as a nation. And certainly government can and must be a partner in innovation. But in the 21st century, technological innovation is mostly emerging from the private sector. Look no further than the artificial intelligence and machine learning technologies that are enabling us to harness the power of data. More than any other development in this fourth industrial revolution, where the boundaries between the physical and digital worlds are blurring, artificial intelligence holds one of the keys to the future of espionage. It will help us manage this data tsunami at machine speed. And it will free up humans for the higher order cognitive functions, the sense making, if you will, only possible with a biological rather than a digital brain. Now, in the artificial intelligence arena, and unlike previous technologies and previous eras, we, the intelligence community, must now become fast followers rather than primary creators of leading edge technologies. And that's just one reason why deep and sustainable partnerships with private industry and academia are so very vital. They allow both sides to best serve America's interests while adapting to these constantly changing waves of new technologies. And so you might reasonably wonder what steps DDI has taken to strengthen our collaboration with industry. Now, one major component of our approach to industry partnerships is our creation of what we call innovation hubs, focused on identifying best of breed commercially available solutions, especially in the artificial intelligence and machine learning realm, and then exploring how we can rapidly leverage these solutions to meet our increasingly challenging mission requirements. At these innovation hubs, we work in an unclassified and collaborative lab space and we're able to bring new technologies to mission more rapidly, therefore enable faster investment decisions about digital technologies and ultimately reduce the the time from, from idea to solution. And as I've said to our own workforce on numerous occasions, occasions too numerous to mention, and I'm sure people are tired of hearing it at the office, our goal is to end the government's practice of bringing you yesterday's technology tomorrow. So. So therefore, an enduring aspect of our mission as CIA's digital workforce is to stay informed of the newest commercial technologies and to position the CIA to be that, you know, fast follower with industry. So in 2017, we opened CIA's Silicon Valley Innovation Outpost, which which facilitates engagement with companies in the tech sector and leading academics in the heart of Silicon Valley. As you might have gathered from the name. And just last year, at the height of the pandemic, we launched the Northern Virginia Innovation Exchange, which is the space for. For knowledge sharing and problem solving, where we work side by side with industry partners. Now, despite these advances, these efforts and programs, and I hate to admit this, but we are, despite our best intentions, a large government agency like any other. And so we must address the major impediments that stand in the way of bringing new technology rapidly into the CIA. And this involves everything from how we acquire new technology to how we test and accredit it for use on our sensitive networks. And we are making strides in this area, I'm glad to say. And our engagements with industry across the investment spectrum also have proven very valuable to CIA in other ways. They've helped us gain a better sense of the marketplace, which is important, and they've helped us promote a culture of continuous innovation. And for ddi, the newest directorate at CIA, you know, that's part of our name, and it's really important, part of our mission. And through our outreach to companies, we're able to discover new technologies in the marketplace that meet the agency's mission needs today and in the future. And I would suggest it all represents pretty good progress in our first six years, but we're far from finished, right? Innovation is a process. It's not an event. And despite what I just said a moment ago, there technically is no finish line to cross, because the end of any innovation journey, as people say, signifies the beginning of a new uncharted course. And therefore, in ddi, we value in our offices sort of an entrepreneurial spirit. It's our foundation for the future. And it's a future that the DDI, as a transformative element of CIA and the digital age, eagerly embraces. So, Bob, I'll finish up where I began. You know, the challenges ahead are truly formidable. But with the whole of nation approach encouraging closer partnerships between government and industry, I remain very optimistic. America can and will defend her values against adversaries who wish us harm. And for ddi, we can do that in part by promoting a culture of continuous innovation and deep, meaningful partnerships with US Industry. And that approach will enable us to accelerate the adoption of emerging digital technologies and integrate them effectively with CIA's traditional strengths in human and technical intelligence, all to counter threats to our nation and the shared interests of our allies. So, Bob, thank you again for the opportunity to share my thoughts. I'm super enthusiastic about all of this, as you can tell, and I'll leave it there and look Forward to a couple of questions.

Well, Jennifer, thanks for that. Some things just jump out at me right away as you go through all this stuff. One that was a great explanation of your office and its responsibilities and its importance to the nation. Another thing that came right through is your optimism. And I think that's important in our line of work here because if you have anything to do with cybersecurity, you better be optimistic or else it gets really gloomy and glum first. And so I appreciate your optimism.

Another thing, I'm very comment there, Bob. Yeah, just very quickly. So you know, in many fields I imagine cybersecurity is one of them and the intelligence business is one of them too. The easiest answer to any challenging question is no. And you have to fight the urge. You have to come up with yes and how. And that's really the secret certainly for our business.

Thanks. Another thing I really appreciate you talking about was your innovation hubs. Because now if I see a company that says I have this great thing, I think it's going to serve CIA missions, I'm going to be able to steer them. All of us should steer into these innovation hubs. Right. And how do we find out where in the right innovation hub. Is this on the CIA website someplace?

It's a good question. So we have an office that we call Digital Futures and it is responsible for deepening that partnership with industry, for scanning the horizon to find new companies with new technologies that can help us meet our requirements. Breaking into, if I, if I own a company, right. And I've got some great new tech. Breaking into the US government kind of acquisitions process is no easy task. It is very complex. It requires a fair amount of study steps and steps and steps and steps and steps and steps that you've got to navigate. And you know, it is, it's pretty onerous. And I say that notwithstanding the fact that it's onerous for good reasons. Right. It's intended to ensure that the US Government that we're good shepherds of the taxpayers money and that's important. But you know, these are processes which developed over decades in, let's just say I'm oversimplifying hardware world. Right. It's a software world now and the same practices need to change. And so we are working on that, thinking about how we can leverage the unique authorities we have, find new acquisition methodologies that allow us to tap into what's happening in industry more effectively. So Digital Futures is our office. We have the two innovation hubs. But I want to share one piece of What I think is really fantastic news. So the CIA recently conducted at Director Burns instruction a strategic review where we reviewed four major topics that I touched on very briefly in my discussion. So China, technology, our workforce and partnerships in that final bin. Actually, frankly, in the technology and the final bin, what we recognized was that there needed to be a new approach to working with the private sector in the United states. Certainly since 9 11, there's been broad recognition that industry brings tremendous power. I mean, industry is the engine of America's democracy. And we need to do a better job of figuring out how to partner, how we respect and account for different equities of our partners in industry, but how we can leverage the best that American industry can offer for our mission. And so we are soon setting up a new mission center, and one of its major missions will be technology and engagement with private sector and academia in America. And so I don't have, let's say, an answer for what number you call to contact the new mission center, but there should be some really, I think, great developments, lots of ideas out there about how we're going to do this, how we create a more intuitive front door for the agency, if you will. And I'm hoping that that'll be one of the first things in the strategy for our new mission center, which will form in January.

Sounds really exciting.

Watch this space and I will definitely follow up with you to give you details.

Thank you.

Thanks for that. Very exciting. A couple other questions, one I wanted to ask you about is this third wave of Internet technologies called the Metaverse. And for context, the way many of us look at it is the first wave of the Internet was connecting all these computers together and hyperlinks, the web, communication by mostly hardwire. The second wave about 10 years ago was the mobile phone revolution and the video revolution. Lots of mobility connected by the old wires, but also cell and wi fi. And now this third wave that people are calling the Metaverse is all of the previous stuff, plus advanced virtual worlds, better faster connectivity, and an ability to immerse yourself in collaborative environments that are infinitely scalable. So the Metaverse really is coming. A lot of us view that it will be a trillion dollar market over the next three, four, five years. If it is this third wave of Internet technologies, I'm wondering what your view of this is. There's indications already that both China and Russia are moving into the Metaverse and we'll be using that for advantage. And I'm just wondering what we should be thinking about regarding the threat and ways to mitigate the Threat. And if you have any advice for us there.

Wow. So big question and I have a couple thoughts. I would offer one. So. Right. I love the way you've characterized this as sort of the fourth wave of Internet technologies, Internet backbone and the technologies. And I would say that we are firmly in wave 3.5, which is this kind of the advent of 5G, the rapid proliferation of sensing all around the world, totally ubiquitous. And with that comes some, I won't say the end of, but certainly risks to the very existence of privacy as we know it. And so these are all things we're grappling with. There's technology, there's philosophy, there's a lot of other issues in that. And the metaverse, we will approach the metaverse as it takes shape in the same way that we approach technological change, massive technological change with strategic impact at any time in our history. And looking at it as both threats, what threats might that pose to our national security and what opportunities might that present to us in our very unique business? And so rather than having. I don't have a lot of answers, but I would kind of throw out a few questions. These are the kinds of things that we're thinking about. I think industry is going to be thinking about. And I encourage thought leaders like yourself in this space to continue to message. The first. And then you've touched on is really security, right? So how secure will this be? Will there be any level of privacy? How will the metaverse, what role will it play in this continuing degradation over time in the very concept of privacy as we've known it, and how will it empower the surveillance society? So we've got. You hear a lot about this in the United States. People think that social media is following them, their phones are following them, and they're kernels of truth and all that. But, but let's just talk frankly about, you know, despotic regimes around the country, around the world, excuse me, who are leveraging these technologies to control and monitor their own societies. And you only have to see, you know, the, the number on it, but the numbers of their own citizens in prisons and in labor camps as a result of their governments leveraging these new technologies to control and monitor their population. So what happens in, if it's the metaverse, right, where you've taken this kind of two dimensional information environment and you've exploded it into this kind of totally immersive state. And so I worry about that. I worry about the power that it will give surveillance states, surveillance governments around the world. And in any country, frankly, that lacks privacy protections for its own people. I worry about other things, too. If you think about. I know many people will have read. I keep making references to newspapers. Does anyone read a newspaper anymore except me? But let's just say digital newspapers pass, too. But I worry about the effects of social media, as we've seen in studies, the effects of social media on teenagers in particular, young people whose brains are still not fully formed, and the impacts that particular brands, particular types of social media are having on them, the negative impacts on their mental health, the rise in depression, lots of other issues. And so what happens when you take that environment and you amplify it, right? It's richer, it's in more dimensions, it's more immersive. What does that mean for the mental health of America's youth in particular? I don't know. But people need to be thinking about this as we're developing the technology. And I think we're at a stage where we cannot or should not simply develop the technology in a vacuum, because we can, okay, there's going to be commercial application, There may be lots of other beneficial applications for society, but we need to be looking really carefully at kind of the ethical framework, the privacy framework, the security framework, for sure, and the impact of all of this on our citizens. I think I would add two quick things, and this really wasn't in any order, but how are criminals, criminals and hostile nations going to leverage this? So it's hard we can imagine what that might look like. But, but man, would that simply just explode the possible vectors for either hostile attacks against the U.S. certainly. Collection. Think about ubiquitous collection against biometrics, wearing no haptic vests, whatever you're wearing to do this, that's all data. That's all information that a hostile government can use. And data is the fuel for artificial intelligence. And artificial intelligence algorithms are things that can and are going to be used against the United States. And so we need to think about all of that. And the last thing I'll mention back on security is I would just, if I had the power today, I would suggest for industry to really, really, really be thinking today about the security aspects, security and privacy. Because this whole shift left or shift anywhere in security to ensure that it's baked in from the beginning and not something that we come back after new technology is developed and we sprinkle it over the top and we think, voila, it's secure. It needs to be encoded literally and figuratively into the very foundations of these new technologies. So that is not a whole lot of answers but it's a whole lot of questions.

Well, thanks. It's great questions and great leadership. And with that, I want to turn it over to a couple of our OODA network members who've asked questions in the chat and promote a couple up as a panelist so they can ask you live. The first one I'm going to promote up. Let me see if I can click the right button here. Junaid Islam. And by way of introduction to Junaid, he is a real American patriot. He worked with your agency as a very young man overseas helping establish networks. He also came back and worked as you guys helped do things like create what would later become the Zero Trust networking concept. And Junaid has also worked commercially to establish open protocols for communications. Now he's doing some work with NASA where he's helped them come up with the protocols for how space based assets communicate, including for this project Artemis. And I get to work with Junaid on a lot of commercial engagements as we help companies try to become more secure. So.

Wow, fantasy. Very nice to meet you.

Great, great. Can you hear me okay?

I can.

Oh, great. Thank you. So anyway, thank you for your presentation. It was wonderful. You know, my questions are really around a partnership outside of procurement. So you mentioned your Silicon Valley Center. I believe I was one of the first people in it because they actually used me to test your security system. I was kind of like set up and I did actually present at your first two workshops on Zero Trust.

Sorry I missed it.

It's pretty boring. But so two kind of observations. One, I think the Innovation center from a procurement perspective is definitely the right thing to do. In fact, if anything, I think CIA should enlarge it and open it up even more because, you know, buying, getting to know the vendor is so powerful because they'll say things in person that will never be on a website. And it helps both parties. My question is really around. If you look at our threats to national security, a lot of them are actually outside of what CIA would ever procure. You've identified two areas just on this call. One you mentioned log 4J. I mean, CIA is not a big user of untested open source code, but you know, most of America is another thing you tested.

Open source code is embedded in virtually, you know, so much. Right?

That's right. That's right. And then the other area, there's two other areas. The other is the 5G supply chain where, you know, China has basically infiltrated the supply chain. And the third is social media. So my question to you is if we take the innovation center model, which is around using procurement as a way to create good behavior. There's a vast array of technologies where CIA will never procure anything. I mean, you're not going to buy a 5G network. How do you envision setting up a positive dynamic with industry when you're not going to be the buyer ever? In fact, this might bring cost to making, say, 5G secure. So, you know, kind of would love your thoughts on that. And again, thank you for your taking the time to speak with us.

No, it's my pleasure. So it's a tough question, right? So CIA does engage with, does have partnerships with industry, with academia, with national laboratories outside the framework of procurement. Right. So we buy stuff for sure. We're like any other big government agency and we buy capabilities, we buy hardware, we buy stuff. Right. We buy desks, we buy computer programs. But we do have engagements outside of that framework as well. We have a great deal of outreach to experts in their various fields so that we can better understand an issue. So 5G is a great example. Right. So we've got tremendous minds in America thinking about 5G and what the implications are both for national security, for commercial business. Certainly we learn a lot about the debates between, or at least let's say the tension between an end to end Chinese model with access by the Communist government in Beijing versus an open standards model and how that might play to other strengths. We do have these engagements with industry, with academics, with national lab experts, both to understand what's happening in the environment. But we also have another responsibility and that is to help, you know, and this is fundamentally what we're created to do, which is to protect our country. And so where we see threats to industry, we have an obligation to make that information known somehow so that American industry can protect itself from fill in the blank. And so we do have those kinds of engagements as well. That becomes a little more challenging at times because we are an intelligence service. Right. So we work very closely with partners in the US Government, with law enforcement to kind of convey some of that information, to share it in a way that.

And since you mentioned that, I do have a quick question. And that has been the declassification of vulnerabilities in the past. Both CIA and NSA have not disclosed vulnerabilities. And this has really hurt American industry. Where. And you would know this, they've known about things for a long time. And there's been the classic view of not disclosing methods and sources, but I think it has hurt America vastly. I would love your Opinion on speeding up the declassification?

Yeah, that's a fair question and certainly it's really topical. Right. Because we've just seen this wave of computer network exploitation and attacks, particularly over this past year. I'm glad to see I'm not the only person with a dog in the background. So that's a really fair question. And it is something that we do talk about a fair amount. Certainly the administration is looking very carefully at a holistic cyber strategy. How do we both protect America but also collect when needed overseas to understand our adversaries intentions and plans? And there's this really difficult balance in there. But I take your point 100% and it is something that's really critical for us to explore more kind of in depth and to ask, you know, hard questions about whether vulnerabilities should be exposed immediately to protect.

Thank you for, thank you for your time.

Yeah, thank you, Jennifer.

One other question I want to promote up as a panelist here, my friend Lewis Shepherd. And Lewis, by way of introduction, you may have run into in the intel community. He's been around for quite a while. After 911 he was one of those at Silicon Valley that heard the call to service and, and joined us at the Defense Intelligence Agency. And you know, he's the kind of guy that once we pulled him into the intel community, we could never let him go. And he's been in service ever since with a couple of companies commercially. Right now he's with VMware. Lewis is also one of these deep thinkers who actually I believe reads the newspaper every morning. Correct, Louis?

Two newspapers. Yeah.

Awesome. Nice to meet you, Louis. Yeah, likewise.

Shall I?

Go ahead, Bob, please do. Please let me interrupt that crazy introduction. Thank you very much. Thanks so much, Jennifer, for your presentation. Fascinating. And for all the work that you do. And thanks Bob, for putting it on. So yes, I'm a technologist. However, I started life as a lapsed political scientist and I would started like a lot of people as a Soviet analyst. And my question really is more on a couple of things you touched on. You mentioned the United States government. We're bureaucratic and I loved your, you know, the challenges that you face in DDI with how you're trying to accelerate something Bob worked hard on as DIA cto, accelerate innovation. You know, the US Government has been critical, criticized as heavily bureaucratic since the 50s. And yet from the 50s forward we fought and won the space race, we fought and won the Cold War, we invented the Internet, all with heavy significant US government and DOD and IC involvement and Leadership. So I want to ask really along the spirit of that phenomenal Virgil quote that you say you use as a mantra. I love that. Let me ask if you were to assess the vulnerabilities of the Chinese and Soviet regimes and maybe even kind of political cultures, their vulnerability to the same kind of digital offense that as you well demonstrated we wind up facing, how would you assess your directorates and the agencies and the national security establishments? How can we be optimistic about what we're doing on digital offense as well as necessarily defense?

So tough question to grapple because it's pretty broad and I would say a couple things. One, rather than let's say assessing kind of China's capabilities in the space, I will just make a couple of observations. One is that, and there are advantages. They are advantages that come with being with having a top down control in society and clear obligations of the citizenry to abide by the rules. And so we are a country founded on principles such as some version of, as teenagers say, you're not the boss of me, right. And a constitution which fundamentally is about protecting individuals from overreach by the state. And so that's not the case in a place like China or Russia. And so I say advantage, but not in a complimentary way. It's an advantage that there's a top down expectation of a whole of government, a whole of society, commitment to things like achieving AI supremacy by 2030, things like the Made in China 2025 plan, which will strive to have indigenous versions of technology that the Chinese are dependent upon the west for today. And so you know that we have to, as I often say to people, if we try to play man to man with China, we lose. Right? There's a scale issue. There's a scale issue. We have to play zone. We have to play to our strengths, to our values, and write the rules of the game that we can play. We have tremendous advantages, we have tremendous advantages in technological innovation, in creativity, in that kind of creative thinking. It's the reason that countries all around the world send young engineering students to America. That is a huge advantage. We have the advantage of our values as a society. We have an advantage that China and Russia do not. And that is tremendously close partnerships with governments all around the globe who value and respect that America is a force for good generally on earth and they want to be part of that. And so I think if we look at it differently, we think about the strengths that we have, innovation and creativity and technological developments and partners who can be our voices and support us in International fora in engagements with foreign government, other foreign governments. I think we have a lot in our. We have a lot of arrows in our quiver too. And so that's not a very satisfying answer, but I think it's really about playing to our strengths and not playing the game as kind of written or the rules as written by China. And the last thing I'll say on that note is, and this is kind of. It's a little bit down the weeds, you don't read much about it in the press. But it's really important as we get into these new types of technology, these new waves of technology, whether it's the metaverse or the constituent technologies that will make that up, we need to be really cognizant of international standards. Right? The norms, the bodies that will govern standards. Certainly in the 5G world, we're thinking a lot about that. And we want to ensure that those standards are written in a way that will promote freedom, independence, democracy, sovereignty, all of these things, and will ensure that the United States and close allies all around the world who similarly respect those values are not disadvantaged by the next waves of new technologies, and certainly not with standards that are written by partners that may not have our interests at heart.

Thanks very much, Jennifer.

I hope we haven't busted your schedule. I do have one final question for you if that's all right. So just noticing the bookshelf behind you. I can tell you're an avid reader. Wondering if you had any advice for us. Do you have any advice for us? What are you reading these days that we. We should consider diving into ourselves.

So I have next to my bedside, you know what I call the stack of shame. You know, the books that stare at me each night when I should be reading and, and I do, but I reading a couple, just finishing up a couple books that I think a lot of your, your folks, your partners there probably are reading anyways very popular at the moment. So one is Christian Bros Kill Chain. And so that one I will clarify that one is. I'm listening to and on commutes and long drives, even though it's largely about the defense industry and weapons and platforms and systems, any number of moments throughout that I'm like hitting the steering wheel, saying yes, yes, right. And there are a lot of really great lessons in there challenging us to kind of stop thinking about the existing kind of system platforms, think about interoperability, think about how it all works together. And certainly in. In the digital world, that is key. That is really key. We've got to get all this stuff to work together. If we're ever really going to kind of realize the potential of AI and machine learning, we have to be able to get it all to work together. And it also. One of the lessons I've taken away is it really challenges us to think hard about the legacy stuff that we're dragging along with us. And certainly in the digital world, that is an issue too. Right. It's, it's kind of ballast. At some point you want to throw it overboard so that you can, you know, kind of fly more freely. So that, that's one. I'm reading another one, and this, this gets to the earlier question about vulnerabilities. And this was Nicole Pearl Roth's book on cyber.

This is how they tell me the world ends.

This is how they tell me the world ends. Exactly. So raising a lot of really great questions to ponder about, you know, what do we do when vulnerabilities are identified? How do we strike a balance between leveraging a vulnerability for US national security benefit versus the risks that that might pose to industry in America? And I believe firmly, as I've said earlier, industry is the engine of our democracy. We can't look at the two things separately. And so I'm heartened to see that there's a really robust kind of dialogue at the moment amongst policymakers in Washington on this topic. And I think it's really timely. Her book kind of made that accessible to a lot of people by presenting it and kind of spy thriller style, I think made it really accessible. And I'll add one more if I can. Yeah, so. So those are the ones I'm reading. But, but I, I have a. One of my very favorites that I don't know that particularly a bestseller, but one of my favorite books ever and has nothing to do with cyber and has nothing to do with, you know, the kill chain and weapons, but it's a tiny little volume called Seven Brief Lessons on Physics. I don't know if you've read that one. It's Carlo Rovelli, an Italian physicist.

I'll look for that.

Right. So in less than 100 pages, right. He provides the clearest kind of introduction to modern physics ever written. Right. And I say this as a liberal arts graduate, right. It's physics describe by someone with the heart of a poet. And it leaves you there in stunned silence at moments, just contemplating these huge questions of the universe. And there's a tiny chapter, a couple pages on the idea of loop quantum gravity and trying to bring together these irreconcilable things. You've got the ideas of theory of relativity and then quantum mechanics and thinking about how it all fits together. And I say I find myself. And I reread this pretty regularly. I find myself sitting there thinking about, well, how is that, how is the idea that space is a void? It's all false, right? It's pieces of space. It's pieces or quanta or grains of space. Really, really fascinating stuff.

So.

So if anyone just wants kind of a mind blowing book that raises lots of questions and does so and some of the most beautiful and effective language I've ever read, I recommend that one.

Thanks, Jennifer. Really appreciate it. And I also appreciate you taking time today to tell us about your office and your mission and how we can be a part of it. So thanks again.

Well, it's my pleasure. It's something I enjoy talking about and I appreciate the opportunity to share, you know, our mission and what we're trying to accomplish and to give a little hint of what I hope will be even more changes to come in terms of our partnerships with industry and really strengthening those. Thank you for the opportunity, Bob.

Thank you, Jennifer.