Inman's Rules: The enduring principles of operational intelligence

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com Admiral Inman, welcome to the Oodacast.

Thank you. Delighted to join you.

Well, Admiral, I wanted to ask a bit about your foundational story before we get into the meat of this because from my understanding, you joined the Navy in 1951 and I just wanted to ask why did you join the Navy? What motivated you to go into service like that?

Because I was about to be drafted time of the Korean War, my local draft board had told me I was going to be drafted. So I went scurrying and talked to both the Air Force and the Navy and the Navy came through first. So I signed the documents on 29-10-51, got my draft notice on the 4th of November. So I'm essentially a draft dodger in Newport on the 18th of November, 51, commissioned on the 26th of March 52 for what I expected to be a short three years and turned into almost 31.

Right. And then when you were commissioned was that as a surface line officer?

Reserve surface line officer. And I stayed that. I once I'd augmented, I stayed surface line but went to intelligence school. So I was indicated I was a subspecialist and but I did a briefing tour working for Admiral Arleigh Burke, which was one of the great highlights of my early life. And Admiral Sam Frankel, who was the ranking intel guy at that time, wrote me a letter asking me to apply to be a Teltra specialist in 61. Shortly after, I'd been picked up early for Lieutenant Commander, largely cause of the briefing tour. So I accepted and that led to pretty interesting career.

This was the early days of Naval Intelligence as I understand it. The community had been around for a while, but professionally it didn't seem like it was under much of a central management until World War II. There was a big focus on intelligence and then there was a big drawdown after that. And it seems like it was a chaotic time.

Rear Admiral Mac Showers, later, Rear Admiral Max Showers, who had been on Admiral Nimitz staff, who'd stayed on. He was sort of the early and I think he was probably the first flag officer selected. Frankel was second and third was Rufus Taylor, who went on to be Vice Admiral and Deputy Director of Central Intelligence.

Right, right. Thanks. And then in your career in Navy Intelligence, you rose to the position of Director of Naval Intelligence.

I, I had had the briefing tour after I shifted to be a specialist. I had a tour at the Navy Field Operational intelligence office at NSA for Meade for three years, then Assistant Navalad Shea in Sweden two and a half years. Had a current intelligence Pacific Fleet for 21 months. Seventh Fleet intelligence officer for two and a half years, all consumed by Vietnam. And for that National War College. Got pulled out of intelligence to be the executive assistant to the Navy's Vice Chief and then went back the Assistant Chief of Staff for Intelligence. But a month after I got there, to my great shock in January of must be at this point we're at 74. Yes, I was told I was selected for flag. Didn't even know they'd had a slot for 1630 and they'd lowered the eligibility rate for two years in grade as Captain. So I slipped in under that line. My third vice chief moved up to be the CNO on General Holloway on the 1st of July and he brought me back that September to be the Director of Naval Intelligence.

I'm going to ask a question about this because I know it sounds like a career where you have spent a lot of time helping provide intelligent support to operational decision makers, real decision makers. You had to make a shift though to support policymakers. Now sometimes a senior person is both. But does it require a mental model shift between this attitude and approach of serving operational decision makers to serving policymakers?

Time is probably the biggest difference when you're supporting the war fighting capability. The speed with which you can provide information, the speed with which you correct it if you discover you are wrong in the process key in the policy making. It's a much slower process. Time is less a significant factor in what you're providing. What I found in the policy making arena, if my recommendations agreed with their preconceived views, I was told how smart I was. And if my recommendations countered their preconceived views, it was how did you buy that brochuremanship?

You know that sounds. That resonates so much with me and things I saw in my life both in intelligence but also in the commercial world. And I think you must have tapped into some sort of human dynamic there that's still in play.

I agree.

Which brings up another point I would love to discuss with you and that is this thing that today we call Inman's Rules. For my entire career I have seen this list of Inman's Rules. The people who looked up to you as a mentor that you mentored mentored me. And they continue to influence using these list of principles and policies. And just last week a senior executive with the office of Director of National Intelligence emailed a list of people this List of Inman's rules. So they're still at play today, and I wanted to discuss some of those with you, if that's all right.

Yeah. Looking at them, they look sometimes a little arrogant along the way, but they were my sort of shorthand way of applying some basic principles.

So one of the first one on the list I see is conservation of Enemies. Now, what did you mean by that?

That came from then Captain Rufus Taylor. I'd walked into Intelligence Plot, and I was mad. I uttered a few oaths and this big hand came down on my shoulder. And then Captain Taylor said, ask if I had a minute, that he'd been watching me. He thought I had a lot of ability, but he also noted I was a little quick to anger. And he wanted to give me his theory on the conservation of enemies, that when you feel you started to get angry, stop for a second and say, is this a matter of principle? If it was a matter of principle delivered blows, they wouldn't remember. If it wasn't a matter of principle, set it aside, come back to it. You might do that 8, 10 times and decide it wasn't that important or would go away. And the corollary was when you had a new idea, stop for a moment to say who might be opposed to it and figure out how you either could convert them or go around them. I talk about that still in commencement speeches, process. And I tell the students, I can't say I always followed Admiral Taylor's advice, but I can say I always regretted it when I didn't.

All right, thanks. And now I see why that's number one on your list. You know, another I want to discuss is second on the list, which you so succinctly put when you're explaining, you're losing. And I feel like I know what that means because I see so frequently our policymakers extensively explaining something in a way that just makes it seem like they should just stop. Another way I heard you say it was when you're in a hole, stop digging. Is that what you.

Yeah, well, you. If you tend to try to justify your actions, then there's a good probability that you were wrong or that. Or else that you're not going to be able to persuade the individual in any case, so you're wasting energy in the process.

Right. And then third on the list was you say something too good to believe, probably is just that untrue. You must have seen that a lot in the intelligence business.

I did, a great deal.

And, you know, I think that's another. That also Impacts us as individuals. You know, that's the way scams work. A fraudster will try to convince you that you have riches coming. It's just too good to be true, and it probably is untrue. So there too, I think you're tapping into something enduring in human nature that we need to remind ourselves about this bias to think things that are too good to believe.

When you skip down to five, which was wisdom in Washington is having much to say but knowing when not to say it. And that really came from Admiral Burke. I was a young lieutenant. If I briefed an item in the morning that got his attention, he'd send for me my map boards and go brief the National Security Advisor, go brief an assistant Secretary of State, go brief a senator in the process, and his instructions for the first time now, Bobby, don't tell them everything you know. Leave them wanting to ask questions.

You know, another that really resonated me was seventh on your list. The only one looking out for you is you. And to me, I mean, I know it takes big teams to accomplish big things, but we also have to have a lot of personal responsibility and understand that we're responsible for our own actions. Is that kind of what you meant by that?

Yes, very much so.

Right, right. So another enduring principle that I think applies not just in intelligence, but everywhere but intelligence is about adversaries. And the eighth one on your list is if you think your enemy is stupid, think again.

We often discount what we see happening or what we see said is just implausible. In fact, frequently it's the first indicator you get of a new problem, a new challenge coming your way.

Right. There's also this type of. Too frequently, I find maybe it's our human nature. We tend to underestimate our adversaries or think they just couldn't be as smart and brilliant and all knowing as we are and just think that they're not going to be able to keep up with us. And that arrogance frequently leads to a problem.

Bob, you trigger something that's not on this list, probably should be, and that's beware of mirror imaging.

Right.

I spent a lot of time in my active service not patting myself on the back for how good we were, but trying to understand if things had not gone well, lessons learned. And what I learned was over and over again where we were fundamentally wrong. It was because we mirror image how we would act and presume that the adversary, the subject or interest, would think the same way, would act the same way. And I think we've just seen the conclusion of 20 years of frustration that a good deal of it was mirror imaging how we thought you ought to have a central, democratically elected, strong central government with that everybody would elect, follow, be prepared to support when you're dealing with a society with one of the lowest education levels in the world who had never experienced a strong central government that hadn't been imposed authoritarian. And the whole premise that you could take that society and lead them to a democratically elected central government that they would sustain, which is fundamentally false.

Right. Clear example and I've captured that one for the show notes here the 31st Inman's rules because it is so critically important and it also flows directly into the next one. Number nine on the list was never try to fool yourself. And I want to ask you what you meant by that. But to me it's the same example you just mentioned. Maybe we tried to fool ourselves.

You think things have been are going better than they really are. You believe you're on top of a problem and have all the elements of it. And then comes a surprise, something you either haven't thought of or sadly poor performance of one of your peers or subordinates which in fact caused you to head off in the wrong direction. And I just want another lesson that's not here. Bad news does not get better with age. And when you have made a mistake, the faster you can identify that and tell everybody and make the change, the better off you're going to be. In my long relationship with Congress telling them I didn't know in response to a question, but I'd get an answer and getting it back to them within 24 hours ultimately earned a lot of credibility trying to sort of bluff your way through when on something where you really aren't sure of what the right answer is, it's just a long way to go, right? So.

Intelligence, you number 12 on your list. You say intelligence is knowing what the enemy doesn't want you to know. Very succinctly put, is that what today does that still hold? Intelligence is knowing what the enemy doesn't want you to know.

I believe it is that if it's something that the enemy is publishing, it's not really intelligence, it's just news. And when you have managed to access something that we're trying to deny, you know, then you've got the fundamentals beginning of intelligence.

Right. So that you know, Bill Studeman later rephrased some of these as he taught many of us. And he would say the number one objective of intelligence is to achieve deep penetration of your adversary. And I think that is he was getting at this point about finding out things that the enemy doesn't want you to know.

Absolutely.

Now there's a big debate today, and there has been for decades about open source intelligence and the role it should be playing. And to a lot of us, open source is fine as a fundamental baseline of understanding, but open source intelligence almost by definition is not telling you things that your adversary is trying to keep from you.

When I began my first job as a watch officer and A briefer back in 58, open source was the FBIs Foreign Broadcast Information Service. CIA ran for the all services and it was listening to radio broadcasts around the world, translating them, putting them out on teletalk, and that often would be the first alert you got of a problem going on. So Radio Baghdad had gone off the air, came back on the air three hours later with Marshall Music. There had been a coup. 1958, the as you as the world has changed. First with the collapse of the Soviet Union, where you went from Izvestia and Pravda to suddenly 15 different countries, 200 different, more different news sources. And so suddenly the challenge wasn't this sparse nature of open source. It was you were overwhelmed by the amount of it and the amount that needed to be translated. That was minor compared to today's world of social media. Right. What's the new problem? Misinformation, falsehoods. And you know, as much as I fuss at the normal print media, they at least usually would on page two, do a small box of corrections from some store the previous day. Social media, there are no corrections, but it goes into the database, it pops back up and so it, it's replicated innumerable times. So. So open source is a far more complex issue now than it was in my early days where you are, people are deliberately out to deceive with flooding with misinformation along the way.

Right. And that's a very good point. And also there's the point that the way the Internet was built, it's optimized to deliver advertisements to narrow groups. And that same ability to deliver advertisements can deliver this misinformation and disinformation information, whether it's from social media or some other bad actor. Cause so it's really been weaponized by.

A lot of our adversaries, sadly with great effectiveness. Right.

Admiral, I want to ask another question because I want to come back to one on your you said nothing changes faster than yesterday's vision of the future. I want to come back to that one In A minute is first. Number 14. You said intelligence users are looking for what is going to happen, not what has already occurred. And I want to say that you must have felt it was important to put that here for a reason. But through my career I would hear people like Jake Jacoby had to hit this again and again to keep the workforce focused on what's going to happen. General Pat Hughes, an Army military intelligence professional, General Jim Clapper hit this again and again and again and again. And even today our intelligence leaders have to keep mentioning this because it seems like we always fall in this trap of wanting to just report on the past and what happened behind us.

It's easier and you're not taking a risk of your own reputation by speculating or predicting what's going to happen in the process. So much easier just to report what did happen along the way rather than. And that one's driven a lot by the years I spent in direct support of ongoing military operations where it's what's likely to happen. What do you believe is going to happen, not what happened yesterday.

Right. Well, let's talk about another human bias. When you say it's much harder to convince someone they are wrong than than it is to convince them they are right, what did you mean by this?

Well, it comes back to my earlier assertion that in dealing with policymakers, if my proposition supported their preconceived views, I heard how bright I was and if it did not, if it contradicted their already held views. And I found it was often very hard in the middle of combat. Things were changing, they were moving every minute. And so that was. It was not the same problem. But leading up to combat, it could be what were you going to encounter? What were you likely to encounter? And preconceived views had a different view with the policymakers. This was far more prevalent in the process of where they already had a set view that they brought to the problem in the process. And persuading them without offending them that they were wrong was a challenge. That's where again, one of Admiral Taylor's advice to me was to say, you know, well, you may be right, but and offer a different opinion as opposed to abruptly saying you're wrong.

I think this does take some ability to understand human nature and have a good high emotional intelligence to be able to convince people to move their position instead of just getting in their face like that.

Yeah.

Another you mentioned that I would love to get some context on is you say by the time intelligence gets back to a user with the Answer, answer the question usually has changed. This kind of implies the dynamic nature of operational intelligence.

And if this is exactly right. Yeah, you're exactly right. This is very much focused on the operational intelligence side where events move fast and you have to be able to move at that same pace, are a little faster.

Meaning you really. The model has to be closely integrated with your decision maker. So you're right there as they're making the decision.

That's when you're at your potentially your most advantageous and your most helpful.

And when you wrote this list, another one you captured was always know your blind spots and get help to cover them. Another that sounds extremely important today, but what did you mean by this?

So don't believe you know everything. Surround yourself with bright people who may have different views or at least different ways of thinking that they've come to. And that's the way you cover the blind spots, things you where you don't really realize you're blind. So don't be afraid to have very bright people working for you who hopefully feel free to tell you when they think you're wrong.

Right. Number 19 is the first report is usually wrong act, but understand more is to come and it will be different.

Fog of war, first report coming out. Obviously something has occurred, but the first report of it done hastily may in fact not actually reflect whatever I think of Gulf of Tonkin. And were there patrol boats that were trying to attack destroyers off? Turns out the first day they were 2 August. On 4 August, it was simply high seas radar reflection, wave tops and no PT boats.

Right. You know, this is one. By the time I became an ensign intelligence officer, about the time you're retiring, they were teaching us at the schoolhouse that there are these things called flash precedence messages. And they told us we would be in a position where we would get a flash precedence message on a classified circuit. Someone would hand it to us and it's our job to brief it to our commanding officer. But before doing that, read it and take a deep breath and think about it and let the boss know that more will come. And this could very well be wrong. And I did have that experience as an ensign. I got a flash message on the USS Saratoga as one of the Air Wing intel officers. Russian tanks had crossed into Germany, essentially starting war in Europe. And we're like, this cannot be true. But show it to the boss, put it in context. And sure enough, the correction was issued. It was an exercise message just on the wrong circuit. So this kind of advice, I think it was Important back then is still very important today also in a business context. In this incredibly dynamic world we're in, you're going to get information that changes and we need to keep things in context.

The ability to question as you get new information. Is this true, is this accurate? Are there potentially flaws in it? Do you need to dig further before you act? All right.

Now another one that you mentioned was you can never know too much about the enemy. Now this is interesting and I really wanted to ask what you meant by this because to me there's a danger here of actually information overload and becoming buried in data about the enemy. But what did you mean by this?

It is valid that you can get buried in the data, but the reality is that you may be missing elements in the process and the enemy's efforts or the enemy's intentions may be obscured in the fact. So you want as broad a look, broader spectrum of observation as you can get.

It makes a lot of sense. Then you know another, your number 21 on the list was used by my mentors again and again and again and again about how to interact with leaders when you have information. You said tell what you know, tell what you don't know and tell what it means. Very helpful advice, I think to anybody, any intelligence professional dealing with a dynamic situation where you need to brief a senior decision maker.

The challenge too frequently is that you act on fragmentary information and the recipient, the policymaker, the war fighter acts and what you haven't done is convey what don't you know. Where is the uncertainty which may cause them to be a little, hold back a little. Don't act instantly until you try to fill the gaps or tell them you can't fill the gap and therefore you're going to have to act on fragmentary information.

Well, I tell you, this advice here served me so well through my career, including on 9 11. Now on that day I was intelligence support to cybersecurity operations at a joint task force where my two star boss was responsible for operational network defense. So his mission is cybersecurity. We have this horrible event of 911 occur and within minutes I had my boss on the phone. I told him what I knew, which was that these attacks were coordinated, very likely a well resourced adversary and I think it's someone like Al Qaeda. But I told him I don't know that and I don't know what's coming next. But the part about what it means I put in the context of his job of cybersecurity for Department of Defense networks and that just serves me so well to have that rapid framework that I knew to put in place when things were so dynamic and unfolding like that.

Right.

Another point I wanted to ask you about, because I hear this again and again by intelligence professionals. Number 26, the absence of evidence is not evidence of absence. This is another big mental bias problem of humans, I think. But I want to ask what you meant by that and do you have any examples of why this was so important for you to capture in your list?

I'm trying to pull out from ancient memory why I put that in the. What you don't know in this case does not necessarily ensure that there is something there that's happening. You simply have a void in your knowledge in the process. And I think that's what I had in mind.

That makes a lot of sense.

We're talking the things here now that are 40 years old, so getting a little dull.

You know, every single one of these just seems to endure. And if, if they've been good for 40 years, you know what they're going to be good for 40 more years. That's just the way these work. This is. They call it the Lindy effect. Something that has lived that long is going to live that long longer. But two others that I want to mention, two others I think are very closely related. You say boredom is the enemy, not the time to any briefing. And kind of the written version of that would be if you can't summarize it on one page, you can't sell it to anyone. I think both of these are tightly coupled, that if, if you, if you bore a consumer, you know, you're not getting the message through. And if you write volumes about something that you should have said in two paragraphs, you're not serving your customer either.

And we go back to Admiral Burke's early guidance when he was sending me off to brief. Don't tell them everything you know. Leave them wanting to ask questions and drowning them with info to show how smart you are is not likely to win their confidence over the long term.

Right. Then another extremely important for intelligence professionals. But I would also say any CEO out there who's in a competitive environment, you say, always allow time to consider what the enemy wants me to think. Is he succeeding or am I? This is absolutely important to sit and reflect. Correct? You mean like, is the adversary manipulating me and wanting me to believe something I should not believe?

Right. The whole issue of deception is a big issue. And the. Particularly the Russians. So we're just far better at it than we were. The Brits were also pretty good at it through centuries of running an empire. In the process we were far less successful. And we had the added problem when you were trying to deceive, when you planted a story in a newspaper in France, it would get picked up on the wire services and played back. And so you ended up corrupting your own story by trying to deceive elsewhere. So it was not something we did well. Right.

You know the, the last on your list before we added the one about mirror imaging. If you can't add value, get out of the way. And what do you mean by that?

That's when things were moved. That's again very much when operations were ongoing and the orders have been given to go execute. If you didn't have anything else to add, stand back, observe, watch it. Something might pop up that you realize you hadn't told them or that you needed to point out. But if you are not contributing firsthand, get back out of the way. Let the people who are in fact driving doing it. What you remind me Bob, as we go through this whole list, how much of this list is influenced by operational support op intel as opposed to long term policy development. Right.

Well, I definitely appreciate that and I tell you personally I appreciate have come from that OpIntel environment myself. It has served me so well through my career. And I wanted to ask your views, I mean beyond this list of any other advice for decision makers today, perhaps you can give us your context on strategic decision making. I know you taught a course at University of Texas for years. One of them focused on the topic of crisis management in federal policy circles. And I read some of the course descriptions and I saw that you would frequently emphasize the need for people to be ready for an unforeseen crisis. And I would love your view on what could be the next unforeseen crisis. Any insights into what we should be preparing ourselves for?

One of the things we do poorly is draw lessons learned. One of my bosses at Summer Fleet and Vice Chief and at St Pac, Fleet Admiral Mickey Wiesner, constantly was railing about that we weren't capturing lessons learned and applying them going forward. And I, I've carried that on through to my life in the civilian world and the academic world as well. The challenge here is to be alert for what else is going on that you may be missing or where are your vulnerabilities that somebody may want to exploit. And you may not get much warning. So here is where. If you've gone through scenario planning, if you've gone through Excise of drills. They will point up things that you may not have thought of, that you may have vulnerabilities. My favorite story here, not favorite, but most dramatic story. In 2004, there was a tabletop exercise on a Category 4 hurricane hitting New Orleans. And what that demonstrated was that there was 25% of the population that had no personal transportation. And so if you were going to order evacuation, you had to do it early and take advantage of school buses. Didn't run that again in 05. In 06 when the real hurricane hit Katrina. Slowness to act for different reasons by the governor and ticket by the mayor in the process. The head of the National Oceanographic, where they're tracking hurricanes, urged the mayor to declare evacuation now. And Nagin didn't do it. He waited another 30 hours. By that time it was too late to get the school buses moving and to get people out. So we had thousands of casualties that could have been avoided had we followed what the tabletop exercise taught. When you've got a large population that does not have personal transportation, you got to act early. You may be wrong, but you're better to have gone through that than to lose the lives.

Thanks. That is a clear example and I like the way you put that. It underscores the need for scenario planning. This should occur at the national level, of course, but businesses too. There's a growing need for businesses to do their own scenario planning. What possible scenarios could occur in the future that we need to make decisions for today?

There are two areas that are high on my list. One is cyber. What if you're a victim of the cyber attack in the process? How do you act? What do you do? How do you recover? And the other is terrorism. While we've shifted our focus appropriately, the more attention to Russia and China. Not only are there a lot of. It's almost like franchising operations as ISIS is scattered around the world and Al Qaeda is still alive. Who else is out there? Taliban, Pakistan. That would do us harm in the process. But there's a new factor here, and that's a domestic terrorist. And the ability, I think we need legislation, frankly, to authorize tracking. If there is an organization that's advocating violence, then there should be an ongoing collection activity, FBI, whoever. But to track so that you're not surprised, as we were on the 6th of January in the process, and that's probably not the last time we're going to get that kind of activity from would be domestic terrorists.

I agree with you there. I really do. One question I have for you on that is I've heard from some in the intelligence community saying this is extremely important. But the intelligence community itself is probably not the right entity to do that. This should be domestic law enforcement with FBI, Department of Justice lead. And the intelligence community needs to stay foreign focused or it risks being pulled into internal political disputes. How do you view that?

Well, first, I think you do need legislation specifically authorizing the FBI and local law enforcement. Key word here is violence. When the organization is advocating violence, it's not their opinions, the rest of it, that's a totally different matter. But if they're advocating violence, then you should pursue tracking, collection, understanding how that violence might unfold. The role for the intelligence community is to look for foreign inspiration, foreign efforts to accelerate it. We know at the time of the riots in Ferguson, Missouri that the Russians misinformation used active measures to both sides, both to the leftist, to get them to go out and fight to the right wing, go defend your principles. That's not the only time we've seen that kind of activity. So what the intelligence community needs to be focused on our foreign efforts to influence or direct the domestic would be domestic terrorists. Right.

Makes a lot of sense. Thank you. In our remaining time, I wanted to ask some thoughts about technology, if that's okay. One of the points on your list was nothing changes faster than yesterday's vision of the future and oh so relevant and timeless forever. But what I want to ask you about is your vision of the future. I know you've been working in a startup world and in a technology world for years and been tracking investments and would love your views on the future. Specifically on this topic that's being called the Metaverse, which is like the Internet. After Next, it's these 3D virtual worlds that you can see when you put on a virtual headset like the Oculus Rift or gaming headsets, or you can interact with through your web browser. And I mention this because it looks like this is going to be a big part about the future of education and entertainment. There's games and videos being delivered that way, but also healthcare is being Delivered now via 3D spaces and commerce is moving into this virtual world. And it seems like the Metaverse is going to be a trillion dollar market segment before long. As far as I can tell, very little thought is being put into how to secure the Metaverse and secure it from adversary manipulation or exploitation, or just secure it from cybercrime. And to me it's like history is repeating itself. We're going to field this great thing and then wish that we had put security in there. And that's maybe it's a loaded question, but I wanted to ask if you had any.

Bob. In my view it's an accurate portrayal of what lies in front of us. And this gets to the divided effort. NSA has the responsibility to protect the government against cyber activities. And the Cyber Command created co headed, double headed to try to. How would you deal with defending in the process or if called upon through offense for the private sector? Responsibility was given to the Department of Homeland Security, a cluj of an organization put together by Governor Ridge in the wake of 911 to try to pull together all the elements that should focus on protecting the homeland. It's long since past time to revisit that and decide what's still pertinent to be in that cluj, what ought to be broken out and returned to different why is the Secret Service there? Why is the Coast Guard there at all? But coming back to the relevant issue here, and that really is cyber in the process, how do we enhance the interaction between the private sector and the US Government, in this case Homeland Security, to anticipate the challenges that are out there and to prepare before the crisis how you defend, how do you go looking for weaknesses? Back in your naval officer days, there was times you get tagged along when you went down to Guantanamo Bay to do fleet exercises looking for all your vulnerabilities and all. Well, that same basic premise applies here. Where is the looking at vulnerabilities? Who does that? How does it convey and how do you get cooperation? I found through my many years that after somebody had been attacked and they recognized they'd been attacked, then they were very willing to get advice and spend the money to protect themselves. But until they had been targeted, clear heart evidence, then they were very reluctant to spend the money or the time to go provide protection. And as we are increasingly relying on the Internet as it advances in so many ways for our commercial activities, our health care, all the rest of it, we just, we're lagging in how do we explore how do we understand the vulnerabilities before they get attacked. And this is the Red Team looking at the activities that go along, which my sense is organizations that now have that responsibility don't have the capacity to do it right.

Well Admiral, I have to tell you there's a lot of metrics around cybersecurity and I've been telling people for a while, my favorite metrics, the one that rolls up all the other metrics underneath it is that red teaming ask a CEO, do you do red teaming? If the answer is no, maybe he's got a defendable thing, but probably not. If the answer is yes, he may still have problems and hard work to do. But at least there's hope. Because if you're doing red teaming and you know things like how long did it take the red team to get into my network? Once they're there, how long did it take them to get discovered? Once they're discovered, how long did it take my defenders to push them out, you at least have hope that you're continually improving.

Accurate and I'm afraid the prognosis is not very bright for how many are actually doing that.

I agree. A very relevant example is the Colonial Pipeline ransomware attack, which of course stretched all the way from Texas all the way up the east coast and impacted the gasoline lines all along here. And the fact is, the CEO of Colonial Pipeline did not care until he was attacked and then he got the wake up call and he cared. Well, Avril, I want to thank you very much for all of this today. I really appreciate being able to dive deep into the rules, the Inman's rules that so many of us have lived by these many years. And it's great getting your personal context on those.

I think what I take away heartening from this is the number of very bright youngsters who worked for me who took those and improved on them and instilled them going forward.

Well, thanks again, Avril.

Pleasure to be with you. Good luck. Good health.

Thank you. Thanks for listening to this OODA Loop Production for the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.