InfowarCon: Matt Devost, An Overview: I/O-IW, Russia, ISIS, Perception Management

All right, we're going to go ahead and get started. All right, let's hear a round of applause. That was great, Matt. Somebody pour me a scotch.

You got recording notice.

You just. This is a different type of. I don't know if I should be lecturing or lap dancing.

I didn't bring enough singles, man.

No. I see the dog. Everybody caffeinated, ready to go. All right, well, welcome, and you know, thanks again to the Schwartau family for hosting us all here. I mean, what a great venue in order to bring a bunch of us together. My experience at InfoWarcon goes back over 21 years, which is kind of scary when you think about it, right? Legally old enough to drink and skipped a few years in between, but I've been probably at just about every one that's been held, I think, at this point, and spoken at most of them. And for a couple of years when. And I actually combined InfoWarcon with my TRC con, which was really interesting because we got the terrorism folks talking with the information warfare folks. And how do you probably remember that session when we had General Downing and guys like that, that we were learning a lot of lessons on both sides of the equation. I give a lot of presentations, probably like when, you know, in the prior 30 days, the next 30 days, I'll speak in front of 20 audiences. Those tend to be very corporate presentations. I'm presenting to boards of directors and talking about risk and talking about risk management. But for me, InfoWork, comma, is always something beyond that. It was kind of pushing us to that kind of next level of discussion and thinking about these issues. And so to kick this off, what I decided to do is something completely different. You notice the viewfinder? My slide presentation is all photos. And really for me, what it is is basically to set up a couple of markers with regards to what I think we need to be talking about not only at this event, but at future events in order for this to be successful, as well as throw down a couple of markers with regards to where we've been and where we're going. So with that, we'll tune into the View Master. The first thing I want to recall is we were talking about these issues over 20 years ago. And when we were right, I mean, there was definitely the emergence of conflict in this space. Our critical dependencies on infrastructure that was inherently dependent on the use of information technology and increasingly utilized by information technology. Want to get scared? Talk to Chris. It's great to see Chris here. But, you know, I was amazed the other day when my team showed me the SCADA control system for one of our large oil customers, and I was used to Chris hacking in and the command line into these SCADA systems and they brought up a nice point and click display. They had me worried that they were going to shut off a refinery valve just by an errant mouse click. Right. Not only have we adopted these technologies, but we've adopted them in full scope. This will be familiar to many folks. Presented this at InfoWarcon 20 years ago, presented it subsequently with Sweden. So I just thought it'd be interesting to think, you know, well, where did we see targets, you know, across this matrix? And of course, I think we can check all the boxes at this point. Right. Which is kind of interesting. We've seen the physical on physical, obviously the physical on digital, the digital on physical with things like Stuxnet and then of course the digital on digital. We were seeing the emergence of 20 years ago. So interesting to say, you know, we thought about how is this how our infrastructure is going to be attacked in the future? And put this real simple 4 cell matrix together that Neil Pollard and Brian Houghton and I did for our infamous toaster paper. I just told I couldn't go through the session without mentioning the toaster paper. If you want to go back and read it. We talk about the Internet of things. We talk about active defense, we talk about the emergence of these issues in these four quadrants. Here's the other one. Twenty years ago, we were begging for the attention of the policymakers. We have their attention. Now we have to figure out what to do with it. And if you follow any of the legislative activity that's taking place in the US Et cetera, we have the full attention of the folks not only in the political domain and the business domain. In the past three years, I've briefed more boards of directors than I did in the prior 15 years combined. Right. So we have their attention. I think there's a key mission there that now that we have the attention, what is the message that we want to convey? We don't want to go back in time and convey the message we were conveying 20 years ago. We need to figure out what are the new things that are important, and not only important right now, but what is going to be important in the next five to 10 years. And we'll talk about that a little bit more later. I think we can all agree there's been a kind of a fundamental failure in security, and not security at the practitioner level, I would say security at the management level. And the reason why we've kind of accepted this model as secure. Right. Technically that chain is held together.

Right.

But as if you can't see, just a zip tie holds two links together. And that's kind of the model that has been allowed to perpetrate at least, you know, and I'm doing much more in the commercial side, in the commercial sense, as we focused on things like compliance based security and standards based security and allowed it to be kind of a checkbox approach. Well, the box can be checked that this gate is locked, but it's not anywhere near secure. And there's going to be a lot that we need to discuss to kind of address some of those failures that have been instituted over the course of time. Time. This is another one I wanted to address as well. We were talking about information terrorism and things of those sorts going back. I mean, even in Wynn's first book we're talking about cyber terrorism. But I really feel like in this domain we're starting to enter into the age of asymmetric threats, right. Where there are going to be individuals that are bad actors that are, that have a disproportionate power to have an impact on us through their attacks. If you followed the story of the attack against Sony, from what I've read in the open sources, literally the team had to leave North Korea because they didn't have the infrastructure. They went to a hotel and then they downloaded all the tools and technologies that they needed to perpetrate that attack. Right. So kind of a rogue nation, state sponsored type of attack. The terrorist organizations have certainly ventured into the cyber domain for propaganda recruitment. We know that there's interest in engaging in attacks. It's just a matter of time. So I want to make sure as we focus on these state sponsored attack issues that we also start thinking about the asymmetric aspects of it. And I know there's several folks that will be speaking to that over the course of two days. But I think it's important to remember the fact that we have a lot of threat actors out there that are kind of super empowered to engage in attacks. We also have a huge strengthening of capability in kind of the organized crime space. Any of the folks that spend time studying some of the Russian organized crime, some of the Eastern European, they are formally associated, affiliated with and protected by traditional organized crime, which is formally associated and protected by the state security apparatus, makes for interesting kind of hyper criminals that can exist out there. I first wrote a paper in 1999 about trying to utilize commercial almost kind of Mercenary teams in support of cyber conflict. But I can tell you now, just based on things I've witnessed over the past 12 to 18 months, the mercenary private contractor angle as it relates to engaging in offensive information warfare is here. We're going to have to be addressing that reality in the very near term. So it's no longer just a white paper, it's no longer a joke. That logo with the, if you don't recognize it, the Blackwater instead of the paw, we put a computer in there and printed those TV T shirts for DEF CON four years ago. And we put the word who Hacks wins. Right? So a play on the who dares Wins? And then put a website that we just lured people to that was called Information Outcomes, which is a play on Executive Outcomes. Mercenary outfit. It was a joke. But the reality is we're going to have these very financially motivated, maybe affiliated with states, maybe not kind of mercenary type actors that are going to get very active in the computer network offense domain. And so we need to be thinking about the implications of what, from my perspective, is kind of a new actor. If you have very wealthy foreign governments that maybe are closely aligned with some of our countries that want to hire specialized skill sets to engage in offensive attacks, how are we going to deal with that reality? Hear a lot about the, the Internet of things, and obviously that's a growing security concern. But I'm also very curious and interested in kind of the sky. If we look at what's been happening, and I know this is something that you guys covered last year as well, with the emergence of all of the things we're just allowing into the sky, the amateur drone initiatives, the fact that we can have a helicopter or a whatever. I forget what the. The solo copter land on the lawn of the congressional lawn in D.C. drones being used for delivery, drone platforms being used by governments. I think that becomes a very curious area from my perspective, that we're going to have all of these things flying above us and what is already, you know, you could argue a fairly crowded space. Another one with regards to our conception of time. I got asked two years ago to go and Red Team, the chairman of the Joint chief strategy for 2020. And it was a great honor. There were eight of us on the Red Team. And the first issue that I raised was why are we only thinking about 2020, which at the time was, you know, eight years away, when we have adversaries that are thinking in a much longer time. Spanish I think one of our great failings in this space and I Think one of the highest value propositions of InfoWarcon is that this should be the space that we're projecting out. Thinking about the future, thinking about some of the grand strategy implications, because for certain, our attackers are. When I'm asked most often about what I'm concerned with in cybersecurity right now the most, I don't talk about intellectual property theft, I don't talk about DDoS. I talk about a concept they call strategic penetration for future exploitation. And the best way to explain that is to say prior to World War II, that you're the President of the United States and somebody comes to you and says, we've got this great plan, we're going to clandestinely install explosives in the ball bearing plants of the Germans and we can do it without attribution. You don't ever have to push the button. But if we do wind up in conflict with them, being able to push that button is going to be, you know, hugely strategically advantageous to diminish that capability in their war making machine. Do you say yes? How many people say yes? You raise your hands, what year is it? We'll just say prior to, prior to conflict In World War II, we sold Saddam HP printers. So similar type of concept. So the realist in me of course says, yes, I can do it. I don't ever have to push it, so I don't have to blow things up. I can do it without attribution. It will give me advantage in the future if I need it. You have to think about the adversaries attacking our critical infrastructure in that same context. Do the Chinese have the intent to take down a power grid in the United States right now?

Do they have the intent or the capability?

Do they have the intent? Do they have the intent right now to take down.

No.

Right. Economic interdependence, fear of escalation, fear of global condemnation. There's all these kind of classical deterrents that are in place. The Chinese can envision though a time in the future. If we talk about time shifting intent now, right? They can envision a time in the future where they might want to take down a power grid, over a regional security issue, over an economic security issue, over just some sort of traditional conflict. So if, you know, if you put yourself in the perspective of that time shifted intent, saying, hey, I might want to do this, what do you need to be doing right now?

Owning.

Oh yeah, you need to be owning that critical infrastructure, right? So when I think about security threats and security risks, and in this concept of time shifted intent we need to be thinking about if our adversaries are considering that they might need to take critical infrastructure down five or 10 years from now, what do they need to be doing? And that should be guiding some of our stuff. And then on the corollary, what do we need to be doing over the next 8, 10, 20 years in this space? And I think we did a really good job of that 20 years ago of projecting forward. I don't think we do as good a job of it today because we're so overwhelmed by, by history catching up with us. I'm going to throw this up here for this is a difficult space for me to talk to in the kind of open source sense. But I'll just say more Russia, less China, right? With regards to what we should be thinking about, there's been an incredible level of attention paid to China, China sponsored activities, a lot of that surrounding intellectual property theft. I've gone on the record in other events saying that I think the intellectual property theft is a short term problem. Right? You can only steal so much before you start to achieve some sort of parody where the money that you spend in stealing, the incremental improvement in IP is less valuable to you than the money that you can spend on innovation in your own country. We're already starting to see that shift within China with venture funds being stood out, focused on specific industries, et cetera. Now they've got the backbone of all the IP that they've previously stolen from us. But it doesn't mean that this is going to be as widespread an issue. I also think it gives them an opportunity to acquiesce in the diplomatic space on some issues. And that's one area where they can start to diminish their activity, claim to be cracking down on others. The other thing is that the, you know, with the, the Chinese sponsored attacks, it again is more strategic, more overt, whereas the Russian stuff to me is much more visceral. Even just the attitude that are out there with the, you know, resurgence of some of the nationalist movements. So there's just a much more visceral, clandestine feel to it. So it's one of those things I worry about a lot more now. And in talking with a lot of my colleagues both in and out of government, I've been posing this question for the past year and they've all been weighting their concerns over Russia as being greater than those over China. This is what I like to throw out. I'm a huge OODA loop advocate, as you'll see later. But I use this slide actually with a bunch of Marines a couple of years ago, I resurfaced. It's the only non original slide except for the Matrix in here. Thinking about the fact that we're going to have to be automating a lot of these technologies and that that OODA loop is going to get compressed pretty significantly and is also going to have to happen at machine speed. Right? So I love to see and hear some discussion on kind of how do.

We deal with that, how do we.

Turn over.

Aspects of, you know, what.

Are kind of national defense initiatives to two things that are going to have to operate within this compressed OODA loop. This is my. Yeah, I almost posted this to Facebook and said, yes, I did do that. Winter is coming. I do feel like for multiple reasons that, you know, we are going to have some critical infrastructure failures associated with cyber attacks. I'm not a doomsday scenario, folks, where people laughed about this earlier. I don't believe we're going to reach the state where it's going to be such a catastrophic failure that we're going to be eating our neighbors children. But I do feel that it's going to be fairly disruptive one for multiple reasons. There's so many entities playing around in critical infrastructures right now that there just could be some inadvertent failure. Right? I call it the equivalent of a million monkeys and a million keyboards will allegedly type the great works of Shakespeare over time just based on the randomness of sequences. Well, a million hackers, you know, in the infrastructure, do they eventually do something that causes some sort of cascading failure that we're not prepared for. The other aspect of this is I think that because we've got the attention now of these political leaders and they've seen, you know, we've had stuff then and we've seen attacks like that. I think it's just going to be too attractive not to try it. Right? There's that huge appeal of being able to wage that first. Even if it's just a micro war, that first conflict in cyberspace is just going to become too appealing where you're going to have entities that are going to try it, they're going to try and limit the impact. They might try and do it anonymously without attribution, although that hasn't been working out well for folks recently. But I do feel that we will see some sort of isolated infrastructure failure as a result of cyber conflict here in the next, you know, let's call it the next five years. This is another one that's a pet peeve of mine. We've had the active. Sam. Yes. I'm putting kind of a much more US Western centric perspective on this right now. It exists out there and we have capabilities that exist. I think that we just don't utilize them to the extent that we should. We get bogged down and what's that, or we don't talk about them. Well, if they were getting utilized, I think we'd see it a lot less bad things happening out there in the net. But I think that's one area where, you know, I'd love to see a resurgence of the real debate. What does it mean to take a criminal botnet down with, you know, the US based authorities on systems that are hosted overseas that we know are doing bad things? And can we declare something where it's, you know, the thing is getting taken down in three days instead of three years? Right. It's hard to declare success when you already have millions of victims and ton of intellectual property stolen. And I think we have analogies that we can apply with regards to boarding of vessels and piracy situations and things of that sort that, you know, can equally apply in the cyber domain. We just haven't had a real active debate about that. Yes sir. The challenge in this business is that. I think, you know, there are indicators if you talk with any of the, you know, again, I'm taking a very US centric approach because I tend to work with US Companies. The carriers are seeing a lot of activity that are early indicators. There are intelligence firms, JD and I work together on one where we saw lots of early indicators with regards to emerging botnets that you could even associate with particular actors. So you knew what they're trying to do, what they're going after. That information being fed into a kind of real active defense. And in our toaster paper we Talked about that 20 years ago, we wanted to create what we call digital integrated response teams. Dirt teams had a cool name too, where that can be fed in and somebody can, in the cyber domain, go and check out the command and control infrastructure, maybe recapture that command and control infrastructure. Yes. It might be owned by a private entity in an international area. We have to be willing to accept that others might do that to us if that infrastructure gets stood up in our space. But you don't try and harm if it's, if it's owned by another entity, not as a sort of bulletproof hosting provider. You have to be very careful with regards to not impacting that box. But it's already being used for purposes that are outside the original owner's intent.

Yeah.

So you mentioned you have to be careful about what you do to that box.

And I think that's part of the, part of the problem with the debate. You know, the concern is that there's always a law that is going to stop you from being able to defend yourself. We'll talk about it this afternoon. Great. But I think that's one of the areas where the real concern exists.

There's always the.

It's the province of government. Sure. And I don't think that this needs to be, in my opinion, a government activity.

Right.

I'm not a. I'm not saying we need to commercialize this or the companies need to be defending themselves. I think we need to address it at the government level. Yeah.

Just as a, just as a thought lawyer. And the Geneva Accords, the inherent rights of self defense. If there is an attack that's feeling for so aggrievous or stealing such a level of intellectual property, if that corporation actually responded by hiring a hitman to go slap somebody, that might actually be proportional because it was the continued existence of that corporation of that person that was at risk and they responded in a way to preserve their continued existence.

With respect to everybody, this is the topic when at beer o'. Clock, if you look at the schedule, this is the. This afternoon we get to really get into this mess and all of the full spectrum of. Yeah, that's why we're doing it as.

A debate in that.

Absolutely. And as again, these slides are kind of the things that I'm hoping that we're going to talk about and be thinking about at least coming out of this. So I'm glad that I have hit on at least a couple of touch points. This one I just couldn't resist because it's InfoWartcon and we're going to talk about UFOs and all sorts of other fun stuff as well. We talk about information overload and you know, the kind of the future shock and the kids, the being attached to their phones. We haven't seen anything yet. I mean, I don't know if you're following what's happening with the augmented reality and virtual reality and all that sort of stuff. But I mean the next 10 years are going to be massive technological advancements. They're going to be very interesting to watch. And then the last slide, just to prove that I'm not always a pessimist, you know, I am encouraged by some of the things that are being invested in on the defense side of the Equation as well. Well, right. Not that they're going to provide any near term value, but again, when you start to look at three to five years out, there's some very interesting things that are being done with behavioral analytics and machine learning and swarming technology, AI, things of that sort. So there is hope. I don't want to be the pessimist in the room. I have caught myself being. You were there at the Atlantic Council where I was the only optimist around the table. Because I really do feel like we'll be empowered to make things better over time. It's just going to take some work to get there. That's all I have. Yes.

Does anybody think of all these cyber things as being part of the greater strategy or. Because all I've heard has been cyber for cyber's sake.

Yeah.

Has anybody thought of combining it with other means?

There's been discussions about that and that was kind of one of the key things. When we looked at the Chairman strategy, obviously there was a cyber components. There's some integration happening there. But does the cyber strategy for the US need to be a standalone cyber strategy? It should be. Should it be integrated as a part of a larger grand strategy? I think we do grand strategy very poorly right now and part of that might be because we intentionally, you know, break things into chunks that might maybe should be integrated together. If anyone wants it, I'll give you admin. I've got the user group on LinkedIn, happy for you to admin it and join and discuss this continually if that's of use to you. It's free. Yes. Without getting into anything classified or anything like that.

I just would like your opinion.

You mentioned that you felt Russia was more dangerous in China in the hacking game. Yeah.

I was wondering if you just elaborate on that.

Yeah, I think for a. There's obviously great capability there. Again, they. They're much more kind of a mirror image, you know, to us with regards to cyber operations and that it's much more clandestine, classified. Obviously the, the integration and kind of corruption issues that they have, not only the nation state but within the security apparatus is a huge concern. But then the other metric there for me, and it's a real touch point, is just studying the resurgence of kind of the, the nationalist movement there, where we are really being demonized. And Joel, I hope you'll speak to this today. You know, it's one of the reasons I put it in there from a Psyops perspective. They are running a very effective psyops campaign against their internal population. And it was something that I was watching.

Are you talking about Russia or China?

Russia. Okay. Yeah. Yeah.

Because honestly, what you just said, you can swap.

Yeah. But I think. I don't know. And we can talk about this this afternoon. The stuff that I see on the. The China side is, again, not as visceral, not as kind of warmongering as we see in the Russia side. And it's an area I've been tracking that. It really struck home for me a few months ago. I have a person I went to college with here in the United States who's Russian, who we've interacted with and maintained connectivity over email and Facebook. And he came online on Facebook one night and said, do you agree with these sanctions that the Obama administration has instituted? And I was like, you know, why are we having this discussion? You know, like, how are you? How are the kids? Type stuff? And he's like, these are criminal sanctions, and you've declared war on my children. So now I'm declaring war on your children. And he said, my children will be stronger than your children because yours are being raised by homosexual couples and mine are being raised by real families. And just went on and I looked at it. So, you know, if somebody that says, you know, Western, educated, lots of Western friends, is now willing to go on Facebook and start, you know, attacking people verbally based on some of this activity, there's got to be something much deeper. And this is your area of expertise more than mine. But it certainly has struck me that there's a kind of reinforcing, much more, you know, demonizing factor that exists there.

If I could touch on this for just a second, and I won't talk about this during my presentation tomorrow. One of my jobs was going to China and talking about cyber warfare. And it struck me when I was sitting there, and so I talked to them about Chinese capabilities in cyber war. And I said, you know, I said, you guys hack, we hack. We break into your systems. You break into our systems. We spy on you, and you spy on us.

But. And.

And this is what I told the Chinese seniors. I said, you don't scare me as much as. As Russia does, because you get caught all the time, and.

They don't mind getting caught.

And since then, though, I've amended that a little bit, because I. In my mind, I think there's three stages of hackers. There's the script kitties that go in and they make a lot of noise, and they change things, and they get caught. Then you got the people who are pretty good, and they get in there and they can make up code on the fly. And those are the ones that we mostly worry about. Then you got the really good people that you never hear them, you never see them, but they probably do the most damage to us because of their surgical capabilities. And so I won't tell that to the Chinese, but that's just something that I've developed through, through multiple chips in China and Russia. And Tim Thomas is here and he could probably speak a lot to that also. I don't see you, Tim. Okay, so he's not a good expert, Richard.

Yeah, couple points orthogonally speaking. One is there's a meta communication in your presentation, which is that every single slide, I believe every single one had an interview mixed science fiction one way or another.

Well, that's probably me. My personal bias.

No, it's more than that.

My last talk at DEFCON last year.

Was fiction is the only way to tell the truth. Like National Security Stage and a lot of this on YouTube. But that has been my experience. Fiction is the only way you can be safe about certain things that you can disclose. And the result is that the impact on the mind of society, of fiction and non fiction, is more than blurred. We live in a hyperreal environment. And to keep the conversation and discourse clear, sometimes that distinction is helpfully made in order to have people understand what's really happening. Because in my experience, even with the most sophisticated people, because seeing films is identical to experiencing reality in terms of how our memories and brains parsing and people don't realize by getting Leo citing Jack Bauer as case law.

He really.

Did a fictional character. The other thing is, and I have to throw this in because I'm half crazy, is that you mentioned UFOs and the raster is always indicative of how effective the response has been from the 50s on. Just to say if anybody is interested in going beyond what has been done to the mind of society on that important subject. This book is called UFOs and Government A Historical Inquiry. My name is on the COVID because.

I was part of the team that.

Worked for five years after 50 years of backup gathering, literally over half a century by moles who have done dug out everything they possibly could. What we document in this book, the historical inquiry focuses on the government, not on the speculative fly by night guesses about what the phenomena is, but on the government responding to what they knew was a real phenomena from the 40s on why they set policies in light of national security in the 50s and maintained them into the 80s, despite the intermittent impact on the mind of Society by the phenomena itself, which has been distorted and cover and deception uses ridicule and delusion and misdirection routinely in order to confused people as to what it was about. But that was an intentional decision. We have the documents here from CIA, Air Force in the 50s which established that policy. So if anybody would like to look at this, it's in over. The book is recognized as the only one legitimately belonging in university libraries. It's over 50 now because it's a rigorous historical analysis. And I just throw that out because I understand that laughter often does attend even even the mention of the subject. But we've known the phenomenon is real and have been trying to deal with what it is, what it represents, and.

We don't know yet. Sure, we'll do one more. One more question then to stay on schedule.

I don't have a book to sell, but. You mentioned some of the difficulties with regard to the horizon talking about eight years out. I know that in the Navy we used to do things trying to project out 25 years, 50 years and things like that. Have we gone back and taken a look at the effectiveness of those long range projections? Because when you look at something as simple as cell phones, seven years ago the most common operating system was Symbian. They sold more Microsoft Windows CE phones than Apple and there were zero Android phones. So with a tech to shift in that short period of time and the acceleration of the rate of change, can we really do a good job of projecting in the cyber world beyond maybe only one or two generations, which is at most three years?

I think we can at least try. I mean, you could. I'm willing to best that. A lot of those projections identified the importance that mobile devices were going to play and the capabilities that would be introduced to mobile devices. They're definitely not going to get the.

Platform right and things of that sort.

But I think we're at least obligated to try. And it's one of those things where you're obviously not going to be right all the time. But by forcing yourself through that function and thinking about those issues, the question I always ask is, you know, if we could go back in time 20 years, what would we say differently at Infoworcon? So if we project out 20 years, what would we be saying now? You know, what would be our regret? The stuff that we should have covered or addressed or pushed on?

Let's go back and look at what we said back then. Score, keep. And then we can see are we on the right track.

I've started digging through the archives for sure. The folks that are friends on Facebook have seen me then posting some stuff from the originals. I think I was at Infoworon too with the first the entire library I gave it I guess years ago.