Matt Devost on Hacking Entrepreneurship and Identifying Threats and Opportunities

Informing your decisions with intelligence, analysis and insight brought to you by the team@ooda loop.com hi, everybody. Welcome to Oodacast. I bet you don't recognize this voice. That's because we've turned the tables this week and I'm going to be interviewing OODA co founder Matt devoe. My name is Jen Hoare. I've been working with Matt for quite a while now. I'm in the OODA Expert Network, and I've had the joy and pleasure of conducting two trainings through OODA in these past couple of months. And today I'm here to practice what I preach. And I am going to interview Matt. And I have so many questions that we could be here till 2021, which actually sounds like a huge relief because talking to Matt is extremely enjoyable and informative and we could all use that more in our lives. So with that, thank you, Matt, for allowing me to put you in the hot seat. And this will be hopefully a very pleasant experience.

I hope so. And thanks for doing this. This is fun. I mean, this, as you said, came out of the training where some of the attendees were asking and some of our members were asking, hey, why haven't Matt and Bob been interviewed? So look forward to the discussion.

Great. Well, I'm glad to have the opportunity. I would like to start. There are so many places to start, but I'd like you to share with the listeners and audience members a little bit about your home office, which I think is such a great reflection on you and your eclectic interests and talents. And I'd like to hear a little bit about how you devised your home office and what are some of the components that you thought through to include in it.

Yeah, that's the first time anybody's asked that. I do get a lot of comments. I've built nice home workspaces for myself over the past 20 years, and it has kind of evolved to the current iteration. With this office, I had the opportunity to kind of start from scratch. We built this house six years ago. I had the space that I knew was going to be my office. So design to spec. Some of the interesting elements obviously have the brick wall that's not faux brick, that's actually reclaimed brick that's been cut in a third from a warehouse in Boston. The books, obviously, are a central piece for me. Do a ton of reading, read about 100 books per year. Always put out a top 10 list every year and include a book review every week in my global frequency list. The War Games poster, actually, if you go back and Read some of the earliest media interviews with me where somebody came to the office and interviewed me for a magazine or feature. They make reference to the War Games poster. So it's a little bit more stylized than my original one. But to date, I've always had a War Games poster in my work office. And in my home office I have a poster of Miles Davis as well, a little picture of John Boyd, the namesake of ooda. And then in the backdrop I have the Banksy print that's kind of downlit with a nice good scotch. I have a fully standing desk, which is where I am right now. I'm actually sitting on a drafting stool for these interviews to keep me from pacing around. And then I have a couple of comfy chairs for when I do want to sit down, watch something on the big screen TV and whatnot.

That's a great description, but I think you're leaving something out, which is the intrigue on one of your walls.

Which intrigue would that be?

That there's more than meets the eye?

Oh, yes, there is a concealed element to the office, but, you know, I saved that for in person visits only.

Okay, well, I was the beneficiary of one of those, which is how I became so interested in the components of your office about which you have a story for each thing. So that's really cool. And I think it's such a great reflection of you and all of your components of your career and your varied interest. Which brings me to my first, more serious question, which is that you've had such an interdisciplinary, multidisciplinary, multi part career with various elements all playing with each other. How did all of your jobs and roles and hats that you, that you wear get you to where you are today? When you reflect on that, I have.

Very eclectic interests as it is, and they were a little bit. The interests were a little misaligned or a little bit of a misfit early on, especially my academic career. You know, pulled out a box from my father's house a couple years ago of things that I had saved from high school. And interestingly, I had saved the covers of like Time and Newsweek during some of the major aviation hijackings from when I was growing up and had saved the Run magazine, which was a magazine that came every month that had some basic code in it that you could replicate or play with on your Commodore 64. And that pretty much aligns the two interests that I had going into college. I was very interested in national security issues as it relates specifically to what we call kind of non state threat actors or gray area phenomena. So terrorism and global organized crime and things that represented a strategic threat.

But then I was also a hacker.

I loved to computer program. I had a Commodore 64 and then later in college got involved in some of the mainframes and obviously the PC and the commercialization of the Internet greatly accelerated that. And those interests were, as I mentioned, always misaligned. You couldn't be a computer scientist and also political science, national security person, or if you were, they tried to put you in this very narrow bucket of. You're going to look at statistics, you're going to look at numbers and how they relate to political science. And I had this aha moment really in about 1991, where I had a lot of friends that were in the hacker community, bulletin boards and Frack magazine and kind of all this craziness happening there. And I saw what was happening with regards to their ability to intrude into large commercial and governmental entities. I knew as a computer scientist also that was studying virtual reality and all these other great technologies, that our dependence on technology was only increasing over time. And I had this aha moment where I said, well, wait a minute. The threat actors that I'm interested in right now, the criminals and the terrorists and kind of the gray area phenomena, they're going to exploit the vulnerabilities that the hackers are finding. And the stakes are going to be that much higher because these computers and information networks are going to be so much more important to our society, to our economy and to our national security. And so I started writing about that topic and that for me was kind of the creation of my cybersecurity career.

Yeah, tell us a little more about. I remember your senior thesis was quite prescient where you combine. I haven't read it to, to be fully transparent, I'd like to get a copy. But your senior thesis that you wrote, tell us about some of the components of it that you've seen to be proven true. I sort of consider you an oracle in a lot of regards. And this was probably your earliest instance of that. Tell us about some of the major insights from your thesis.

Yeah, so there are a couple elements.

A, the thesis is available online, so anybody can go and read it. Just go to devoe.net, and it was entitled National Security in the Information Age. That was my graduate thesis in 1992. I actually wrote a paper called the Digital Threat that talked about cyber terrorism and cybersecurity. That was kind of my first piece that I ever wrote. On the topic. Interestingly, when I got to graduate school, I told the political science professor, because I was getting my graduate degree in political science, that I wanted to focus on this topic of information warfare and cyber terrorism. And they told me it was invalid. I couldn't do my research on that, it was not a valid thesis topic. But I persisted, and there's a great story there around that persistence and eventually got it accepted and wrote a thesis called National Security and Information Age. And really what it acknowledged was that we were fully entering into the information age, that our economy, our concept of money, the way that we worked and our national security were going to be fully transformed over the next 20 years. And then also acknowledging that that infrastructure on which we were going to be building this new economy, new society, was highly vulnerable because it wasn't being built with security designed in. So I anticipated a world in which cyber conflict became an issue. Information warfare became an issue where criminals and terrorists and state actors would move into this domain and use it for strategic advantage. And that we were going to have to get in front of this, that we're going to have to secure those networks, we're going to have to foster collaboration between the private sector and the public sector, that we're going to have to figure out a way to use hackers as a national resource. That was actually a very controversial aspect of my thesis because I was stating that the hackers were the good guys. And at the time you had had a thing called Operation Sun Devil and there was a lot of high profile hacker cases where hacker had a very negative connotation. It was used as almost interchangeably with cyber criminal. And here I was saying, no, these are the people that we need to recruit to secure our networks. So, you know, anticipated that transformation into the digital age, anticipated how different threat actors would work into it, anticipated some of the tools from a diplomatic and technical perspective that we would have in order to manage that risk. How concepts like deterrence, et cetera, come into play. Because I was getting a political science degree, I had to do the classic kind of liberal versus realist approach to information warfare. So that was kind of an interesting academic exercise as well. And then proposing these solutions to improve our national security and make sure that we didn't get caught off guard by this risk. When it was finally released, my thesis was very popular. It was republished as a book over in Europe and I think I sent out about 300 copies. I had 300 sitting requests from generals, admirals, CEOs, best selling authors. I had a whole Rolodex of people who had reached out to me and asked for a copy of the thesis as it was being written.

Well, it sounds like the seeds of entrepreneurship and facing rejection and resistance to your visionary ideas. That seed was planted at a young age. And your willingness to see things differently and persist in, dare I say, promulgating that vision despite resistance from others who kind of maybe stood firm in the present tense where very forward looking.

I do owe it, I mean, for the persistence.

I think there's just a great lesson here, so I'll expound on it a little bit. I had that first paper that I had written and I sent it to be as a speaking topic for a conference called Computers, Freedom and Privacy that was going to be held in Chicago that year. I think this was 1994 and I didn't get accepted. The paper did not get accepted. And this was my digital threat paper that I had submitted. And the organizers reached out to me and they said, hey, there's this new organization that was actually called the Electronic Frontier foundation, eff, you know, which is doing great things today that have stood up with some benefactors. Mish Kapoor, the guy who had invented spreadsheets on the PC. John Perry Barlow, a lyricist for the Grateful Dead, who had become a guy who had written about digital rights and you know, pursuing some of these interests of digital liberty and what does it mean to move into cyberspace. They had created a very small scholarship program for students and they said, hey, since we know you're a student, we're going to fly you out here, we're going to let you attend the event for free. So that was kind of break number one was that there was an organization and some individuals who saw some promise in me looking at these topics while I'm at the event. On stage there was a former, recently retired CIA officer who was running an open source intelligence company. And he was on stage and he made this comment. He said, hey, when we catch a hacker, we throw him in jail. And when the Israelis catch a hacker, they give him a job working for the Mossad. We have to figure out how to use these hackers as a national resource. And of course, introvert Matt had a very tough time going up to him after. But I said, hey, I need to send you a copy of this paper I wrote because it has a chapter called Utilize Hackers as a National Resource. And so he took my card, I took his, I sent him off the paper and that was that. And now I'm in grad school and have had my thesis topic denied and we're in the second semester of my master's degree program and I go into the office and the admin for the political science department says, what did you do? What did you do? As I walked in the door and I was like, whoa, I didn't do anything. What's going on? I said, what's happening? And she said, we received hundreds of phone calls for you over the past few days, all asking for a copy of this paper that you wrote. I was like, really? Okay, that's kind of odd. And then letters started to come in and more phone calls came in and there was just all of this interest in this paper. Well, it turns out that that former CIA officer had a newsletter that was literally something that he did on a Xerox copier and mailed to people, stapled and mailed to people. And in that newsletter he did a little brief review of my paper. And it said, hey, you've got to read what this kid is writing out of his basement at the University of Vermont. It parallels the deepest, most classified thinking in the US Government. For a copy of the paper, please call or write. And since I had printed out my own, like, you know, University of Vermont Department of Political Science business cards, I had put the switchboard number on there and I put the university address. That was actually the catalyst for the chair of the political science department to pull me in and say, okay, we're sorry. We had, you know, very short sighted. Obviously this is a real issue. We got people, you know, staff from General's offices and all these folks reaching out, asking about this topic and getting a copy of the paper that we're going to let you pursue your thesis.

After all of that.

After all.

What a sweet victory. Well, I want to move to a topic that's close to how the two of us have collaborated, because as you know, I'm not very high tech. But to your credit, you have always seen the fusion and collaboration between the low tech, such as source inquiries or human intelligence, and how that interplays with the technical. And I'd like to hear a little bit from you, and I think our audience would benefit to hear about how you see those two components of intelligence gathering and analysis and in the case of the work that we do in the private sector, how the interplay of those two components help and benefit clients.

Yeah, absolutely. I think it's part of my multidisciplinary approach and kind of having lived in both worlds of understanding the human dynamics of kind of national security issues, counterterrorism and crime coupled with the computer security, computer science component. So I think I did an interview with Kevin Roberts on oodacast last week and would encourage everybody to go listen to it and watch it, which is fantastically fabulous. But in his book he has a quote where he says, hey, you can't rely too much on the data. Data reads the lines, but people live in between them. And I think that's a perfect summation of kind of the issue here. There's a lot that you can learn from the data, the online investigations, but to really get the ground truth, you have to have that people component because we haven't developed the software to date that can interpret the human emotions, human disposition, human intent, goals, actions, right? So you have to be able to get to that nuanced layer that can only be done in the human to human interaction. Now you can augment that with a technology analysis and investigations approach. You can better understand the person that you're dealing with. But we can't rely on the technology because the technology does not have the capability to understand us as human beings and derive that real meaning. There is something that you might get as a human investigator in the way that somebody responds to a question, whether it be the body language or the pause or the qualifier to a sentence that they put in place that a machine is just not going to pick up.

I've also found in our work together that the human intelligence piece augments, enhances, refines what we see in data to be able to go back and look at it differently or to ask new questions on both sides. And I found that the collaboration between, let's call it your side and my side has been very fruitful in a way that, and I'm going to brag about you for a moment, but I really credit you with seeing that because. Because as someone on the more traditional side of talking to people to learn from them about whatever the topic at hand is, you were really the one that introduced me to this notion of how the technical and, dare I say, the old fashioned can interact. And that's been a really powerful combination, I think when we've worked on client matters together. Speaking of technology, you wear a number of hats and have a number of professional identities and areas of expertise. But at the end of the day, you're a technologist and I've always wanted to know, what do you consider the most formative, meaningful, innovative, technological development of our lifetime?

Of our lifetime? I mean, I would have to say.

That it's the commercialization of the Internet, because that has been what has brought the pieces together, Right. And when you think about personal computers and just even voice communications, the ability to exchange information and represent information and our lives digitally, that has all been facilitated through the development of the commercial Internet. So I think that's kind of ground zero for baseline technical contributions over our lifetime.

What do you think is the scariest innovation?

The Internet?

I'm very serious.

I mean, this is one of those technologies. I have a great quote that I use when I give presentations to executives that says the invention of the ship was also the invention of the shipwreck. And I think that's a great analogy for thinking about the commercialization of the Internet. It provided these great benefits the same way that our ability to take to see, explore new continents, expand trade routes, et cetera, benefited.

But we have to build in the.

Safety and the security elements to it as well. Today you can navigate the sea rather safely because you have advanced weather data. We have GPS navigation. We have mapped out the coastlines and know where the coral reefs are and have put lighthouses, you know, where appropriate. We need those same types of elements from a cyberspace perspective. And we need to be able to derive the great benefits that that technology brings us while managing the risks. Because one of the key catches is that as we've become more dependent on the Internet, it's become more valuable to us, and thus the risks have greater consequence. So it even exacerbates the fact that we need to make sure that we have a secure, functioning, and open Internet.

Speaking of challenges, tell us about some of the most interesting challenges that you and OODA more broadly are tackling for clients.

Yeah, Zun. It's operating on multiple spaces, but at its core, we founded OODA really to help people with their decision making. What we wanted to do was bring more clarity to their decision making, and that means that we want them to understand what is happening in the world around them better. Being able to make these decisions, being able to understand kind of the multidisciplinary approach, being able to educate our clients on the benefits and the risks of adopting and deploying new technologies. But then firmly rooted in that is that, as you mentioned, the kind of the prescience and the one foot in the future. We also want to be talking about and exposing them to new ideas, new concepts, new technologies that we think are going to be meaningful so that they can start to understand and plan for them. Now, a perfect example of that is the work that we do around AI integrity. We don't have real general AI as it exists today. We have a Lot of very specialized machine learning. But every Fortune 500 company right now likely has a team of people or consultants or contractors that is focused on on how they bring and enable AI in their enterprise. It's going to be as key a technology as something like the Internet was, yet we haven't thought through the security implications of that. Part of our job is to get them to understand the advancements in AI, grounded in truth, where we are, where we're going, what we can expect. But get them to start thinking about how they secure those systems. Now, how do you ensure the integrity of the platform that you're building the AI upon? It's just kind of basic cybersecurity. How do you make sure that the algorithms that you're developing don't have some sort of inherent bias or some sort of inherent risk associated with them? If your algorithms have the capability to engage in learning, how do you ensure the integrity of the learning data that you're using to enable those algorithms? I always like to say that as it relates to machine learning and bad data, it's like compounding interest in a bank account. The machine learning on bad data just starts to become more machine learning on top of bad machine learning on top of more bad machine learning. Because in most instances, this AI is what we would refer to as unexplainable AI. The system is operating and we can't account as humans for the decisions that it's making. Having that bad training data and the bad machine learning over time means a reversion back to zero. So do you want to go and take everything you've accomplished over the past two to three or four or five years and revert back to zero or introduce some sort of risk to your organization? And then the last category around that topic as an exemplar is we want people to understand how there might be malicious activity against the AI and the machine learning that they're deploying. Is there malicious data that I might inject? Are there ways that I will exploit your algorithms or your AI to get you to engage in decision making that is counterintuitive or counterproductive to your organization?

Have you encountered in your professional life, in all of its facets, the type of resistance to the kind you faced with your senior thesis? And if so, how did you push your vision and, dare I say, predictions, well, informed predictions forward in situations where you were challenged?

Yeah, I learned early on not to become too, you know, too confronted with the Cassandra dilemma where you have these predictions and nobody listens. I found that what is important Is that if you have thoughts about what is happening or where we're going, that you reasonably articulate those in a way in which people can consume and then let you know, history play out as it will. I had that early issue where I encountered friction associated with my thesis was a great learning exemplar, but I've had that over time. When you think about going into the cybersecurity field as a professional, in 1995, the field really didn't exist. I was the third information security person hired into SAIC, one of the largest defense contractors in the world. So we're just at the emergence of that being an issue and encountering the resistance of yes, we should Red Team. You should let me hack into the entirety of the DoD so we can better understand how to defend it from outside attackers. That was definitely something that was not thought of at the time. When we started the Terrorism Research Center. I have great rejection letters from the Department of Justice for grants that we were applying to that said domestic is not a terrorism is not a domestic United States concern. When we started the first cyber threat intelligence firm, same thing. People were saying, well, how are we going to have threat intelligence? It's only about cyber threats. So is that issue of being able to persist and to continue to articulate where you think things are going, what the implications are, what it means. But I don't get too caught up when nobody reacts immediately because I found over time that history eventually catches up. And you're judged on those predictions based on, you know, what happens over time, not the people's ability to determine what you think will happen at the time.

Right, right. Got it. In terms of what you enjoy working on and the types of projects or the topics that you're most enjoying digging into right now. And I know you have a lot of interest, so I'm going to ask you to narrow it down to one or two that are really top of mind. Insofar as you're enjoying thinking through those problems. What are they?

Well, we just had a discussion about.

The AI integrity type stuff. That's definitely a huge one for me, spending a lot of time on and enjoy just because I think we are making some of the same mistakes that we made with the commercialization of the Internet. Dr. Steve Lukasik was a friend. He and I worked together for many years. He's not well known, but he was the founder of, or not founder director of DARPA at the time that the Internet was kicked off. So I've got a poster from him of the first map of The Internet, not in this office, in the side room. And he wrote on there, it wasn't my brilliance, but I did sign the checks. So he was kind of there at inception and I remember having a conversation with him and I said, well, what would you do different? What would you think about knowing what, you know, 25 years later? I think at the time he said, had we known how critical this was going to be, we would have thought about security upfront. This was an experiment in transmitting data over resilient networks. It was not meant to be the foundation of our global economy. I think now and say, okay, what technologies exist where we face that same implication where it is going to be the foundation of something great in the next 10, 20, 25 years and what decisions should we be making about securing that now? So that is a key area of passion for me because that's an area where expertise and experience come into play. Other areas that I'm interested in constantly dealing with what I would call cyber threat type issues. Helping customers navigate very hard problems as it relates to advanced attackers have developed an ability over the years to kind of do this mirror imaging where you can see yourself from the perspective of the attacker and design almost the decision tree or what the attacker will do from their perspective and then build defenses around it. So I've been very engaged in helping companies with threat modeling and advancing their concepts of threat intelligence. What does this all mean then I get very excited. On the growth and strategy side, there are a couple of companies that are working very closely with who are building a capability in the market, who are building teams, who are building service lines. It's very entrepreneurial. I like doing that work. We have an UDA Ventures investment fund. We've invested in seven or eight startups I think at this point. So it's always fun to get the briefings from the startups, find the ones that we think are going to deliver real value in the market and make an investment and then work with those teams to be successful. So that's a lot of where I apply my time and resources these days.

Speaking of that, I know you have a lot of talents and skills and you complement that with an interest in, in self improvement. And you do a lot of reading. And I wanted to ask you what skill are you working on to improve and refine these days?

That's a great question for me. I think it really is of late, Ben, about finding focus in a highly distracted world. So, you know, I've been reading a lot from a personal professional development in effective strategies to Kind of combat the fatigue that we have from kind of the always on world and the always something happening to be able to sit down and do the thoughtful analysis that's required for my line of work. So from a personal perspective, I love technology, I love multitasking, I love engaging on lots of different projects. You mentioned reading. I always have four or five books that I'm reading at any one given time, but I found that I need to find some focus around how I apply my time and making sure that I'm taking the time to have undistracted, thoughtful attention to an issue. Part of that also for me has been finding the tools that help facilitate that. I've collected data, information, contacts for over 25 years now and did not have a way to kind of capture and centralize and have what is referred to in the community as a second brain. So I've also been spending quite a bit of my free time on working on this concept of a second brain. What does that look like? What does kind of the knowledge engine look like for Matt DeVoe to capture what I'm thinking, ideas that I have, people that I'm talking to, meetings that I have, knowledge that I have, and a kind of one central searchable repository.

And what have you found for your second brain and that knowledge engine? What can you share with us? Give the rest of us some ideas about how to capture our compendium of knowledge and relationships outside of our own heads?

Yeah, I'm using a tool called Notion. Actually that is a web based tool, has an application for your iPhone, your iPad as well. Really what it is is a relational database with a very user friendly front end in front of it. What I did is I sat down and thought through how should I be categorizing knowledge, what makes sense, how do I want to cross reference data? And once I built that architecture, I've been just dumping it all inside of Notion. So if I have a meeting, my meeting notes go in there. It's linked to the contacts that I had the meeting with. The contacts are obviously linked to the meeting notes. I'm using tags so that I can give a frame of reference that I have this conversation because they're interested in becoming an OODA customer or is it an investment that we're thinking about making from OODA Ventures or did it advance my understanding of the market? Whatever it may be, I've had great success. I've only been using it for a couple of months, but I've found that it's been really sticky for me and the Fact that it's got the relational database built in, I think introduced a component that was missing and that was the ability to relate records to each other. I've found over the years I meet so many people and I'm known to so many folks that I have a hard time remembering context. So bringing context to how I know people or how I addressed an issue or how I discovered it has been an important thing for me to capture as well, and I do so within that tool.

Well, as somebody who talks to people for a living, I can't agree enough about the importance of context. A conversation with Matt DeVoe is incomplete without talking about books and reading. And I joked to you a few weeks ago that I think you give Bill Gates a run for his money when it comes to books consumed per month or year. My question is not what are you reading now? My question is, in the past six to 12 months, what book has really stayed with you and why?

In the past six to 12 months. Okay.

And it could be for any reason, good, bad, neutral.

Yeah, I really enjoyed the book if then recently and I can't remember the author, but I'm sure people will find it. Or since I'll be doing the show notes for this, I'll put a link to the book in the show notes. It was a fascinating look at the emergence of human based analytics. So as a company that was using what was the emergence of super compute power, IBM mainframes, et cetera, to do advanced analytics on people as it relates to political persuasions, cultural dynamics, et cetera, it was a failed company. So you get this fascinating dichotomy of very eccentric founders, very eccentric backgrounds. So it was interesting to watch not only the rise of the discipline, the way they incorporated technology, where it worked, where it fell flat, but it also for me served as a great precursor because this is all happening, you know, 35 to 40 years ago. It is a great precursor for the analytics that we're doing on platforms like Facebook today and the emergence of Cambridge analytics and other companies, which basically are the vision of the company if then realized in the modern age. So I found that one to be very sticky with regards to the thoughts that it provoked, but also the implications that I think it had for the world that we live in today. Mm.

The election is coming up and you taught a course at Georgetown for I believe maybe almost 15 years about information warfare. This is a very open ended question. I would love to hear what rises to the forefront of your thoughts, which is what are you thinking about? What are the risks that are most salient to you from a cyber perspective, from an information warfare perspective that is on your mind. And then what are the risks that you think can be mitigated?

Sure.

So here's my key concern with the.

Election, and maybe I should say concerns, because I'll probably discuss a couple of them. The first is that I don't view the election systems as the target. For example, I don't lose a lot of sleep about a foreign national hacker breaking into an electronic voting system and changing the tally for the election. I just think that is a boundary that some of these nation states don't want to cross. I think it's kind of counterproductive to the overall objective. So what I'm really concerned with is the fact that they can sow the discord and the distrust in the institution of elections. So you don't have to change votes in order for people to say that an election is compromised or to question the integrity of it. And I think so. My biggest concern is that that's the target. Trust is the target. The election systems are not the target. It is our trust in the institution of democratic elections that is the target. So once you acknowledge that, then that gives you a little bit of a different worldview. It gives you a different worldview and how you think about the cyber threat to those election systems. Right. We should still be securing them. We should still be operating in a high integrity election, but maybe not concerned that an election is going to get quote, unquote stolen. And we should be very concerned with the messaging that reinforces that sense of distrust in the institution of elections. So the ultimate outcome here is not that a particular candidate wins and a particular candidate loses. The outcome is that the American people, almost equally divided, fight amongst each other over the legitimacy of the election. So what I always tell folks is let's focus our attention in the right area. Let's focus it on the faith in the citizenry and the form of governance that we have today. Let's allow it to be a little deliberate. Let's be patient and wise. Let's not expect we're going to know who won the election, especially in a year in which we have a pandemic taking place on election night, or that you might not wake up Wednesday knowing who won the election, but let's keep it from being contentious in saying that the election is fraudulent. Let's focus on the issues and the resiliency of that institution of elections.

That's really insightful. Thank you for the context. When you and Bob started UDA and it's prevailed and grown and the family has expanded. There may be listeners who are new to OODA and would love to understand better what you focus on and what you're working on these days. What would you want our audience members to take away from this conversation as it relates to what OODA does?

Yeah, what we really want to be.

Is that trusted advisor, consultant to what are your hardest problems? Where you want to apply great expertise and experience in that domain. So we've built, and this will come no surprise after hearing this interview, we've built a rather eclectic business. So at the forefront we do direct client advisory. So a client that calls up and says, matt, for the past three years, my red team hasn't really reflected the reality in the world. Can you sit down and develop a red team that is reflective of the risks that we face as an organization that's going to resonate with the board. Right. So we'll sit down and do that type of what I call kind of direct client consulting. Then we do work on what we call the advisory side. And the advisory is the growth and strategy. Can you help us understand an emerging market? Can you help us with our message to market? Can you help us interpret the market requirements? What do customers need now? What will they need in the future? How is the world going to change and bring that into our decision cycle? So that's kind of one element of the advisory practices on the growth and strategy side. The other element is on the M and A advisory side. And we get pulled into doing a lot of due diligence to help people understand, okay, I'm thinking about making this acquisition a what is your feeling with regards to the security, the cybersecurity of the entity that we're acquiring?

But also, more importantly, we answer that.

Question around the viability of the business. What is the viability of the solution or service that they're offering? What would you do from a growth and strategy perspective to help make that more implanted in the market over the next three, five or 10 years? So we treat each of those engagements almost as if we've been hired as the CEO post acquisition and now it's our job to go make the company successful. So we're helping identify risks, but also help identify opportunities. And then the third piece really is kind of an altruistic and recognizing the power of eclectic networks. We operate the OODA loop.com, which is a membership forum where we provide what we like to say is unbiased subject matter, expertise and perspective on a variety of issues. That's where we write about AI and cybersecurity and quantum computing. It's where this interview series resides, but then also provide a mechanism by which folks interested in those topics can network and facilitate conversations amongst themselves. So we operate the site basically out of frustration that we had in the market where either a journalist didn't quite bring the right perspective or their editor feels like they need to write a link bait headline and attract views was one kind of market dynamic. The second dynamic was content was being put out there by vendors and kind of a pay to play type, you know, so there was that inherent bias. We said, well, what about if we built a model where the members are funding the content? That the only. There's no bias whatsoever. Right. The only perspective that we're bringing is kind of this ground truth, the expertise that can be applied to all of these issues. And we focus on what they're interested in now, but what they should be interested in the future. And then in bringing in, you know, like we did the training with you on interviewing human subjects. We did a misinformation training session, we run an annual conference, we do meetups. You know, we'll be getting back to those in person, I hope, during RSA conference and the Black Hat conference and you know, big event of our own in the D.C. area. So also very heavy on facilitating the network connectivity. In fact, once a month we hold an open member research call where we talk about the stuff that we think is interesting, but then it always goes where the members start talking with each other. What are you seeing? What are you thinking about? What's your perspective in this issue? It's Chatham House rules. Very collaborative, tremendous amount of expertise you'll have on the call. Someone who was former number three in the Department of Defense under Obama will have a former Director of National intelligence. You'll have CISOs of very large companies, you'll have CEOs of startups and security companies. So very eclectic crew coupled with the academics and the researchers, etc. Collaborating on what they think the topics of the day should be.

And one of the benefits of that is the nurturing of entrepreneurs, which is something that you've been advocating for and supporting throughout your career because you are the consummate entrepreneur. And I would posit that that began with the selling of your thesis to your college.

I would posit that it probably began a little earlier. Right. I grew up in a very, very small town, 150 people went to a one room schoolhouse. You know, not a lot of economic opportunity. But I watched how my grandfather and my father and my uncle created a business. And it was one of those where, you know, they worked very hard. We're very entrepreneurial, very self sustaining because we live so far away from everything. They had to learn how to maintain all of their own logging equipment. They had to learn how to build dams and roads and you know, do all of these interesting projects in order to self sustain the business. So I got that bug early on, you know, through exemplar of seeing my family kind of build this logging and construction business, you know, up in the most rural area of Vermont. And then even in high school as I started to understand computers and saw computers coming online, I started to offer classes for local business persons. And I used to write Software. Prior to 1990, I think 1989, I was writing point of sale software for a garage that was doing repairs because they were just having a horrible time managing and maintaining their parts. So it was very entrepreneurial. I think even from before that thesis perspective and just kind of seeing demand in the market and going and trying to fill it about, especially if the demand is something I was passionate about. The thesis encounter taught me about persistence and kind of sticking to my guns. I mean I could have said hey, no, I don't want to go to this conference, I can't do my thesis on this topic. I could have said, hey, I'm not going to go introduce myself to this former CIA operative who turned out to be turnkey in establishing support for the brand of Matt DeVoe and the research that I was doing. I could have given up multiple times along the way. Same with the Terrorism Research Center. We could have given up when the Department of Justice was telling us that there was no need for domestic US terrorism research. But we persisted and we found an audience of people who were passionate about the work that we were doing. We found projects to work on that greatly contributed to the national security of the United States. Then as I mentioned earlier, history eventually catches up. You have the attacks of September 11th and now all of a sudden we're positioned from the Terrorism Research center perspective with all these great programs in incubation. I mean we were basically building in six cities what would become the DHS fusion centers. So we ended up, once DHS was formed, getting the contract to build those 56 fusion centers. We had created a responder knowledge base. We'd created a terrorism knowledge base. We built a global fusion center alerting clients on these issues. So a horrible event happens. But we were positioned and we had the credibility in the market because we had been focused on the issue prior to it being an issue. So a lot of people focused on the issue after September 11, but in some instances it was almost seen as trying to take advantage of the circumstances, take advantage of something bad happening. Whereas ours was no, we were prepared, we were passionate about this issue. Then something bad happened and so we had a lot of credibility with our position in the market and what we were able to do at that point.

Reflecting on that totality of experiences from your young childhood through now, what practice or habit, not quality, do you think is most important for an entrepreneur? For anyone that's listening, that is engaging in some entrepreneurial venture. If you could distill down one habit, practice, ritual, something that you've done that you found to be consistently effective and that has aided your success as an entrepreneur, what would it be?

Yeah, I'm going to give you a couple because I think it's impossible to separate a few of them. The first is you have to have that deep gut instinct that what you're doing is the right thing, right? You have to have that inherent passion. I have a lot of entrepreneurs that will approach me that are still employed and they got a side hustle and they're thinking, does my side hustle become the thing? And I will always tell them, if you have to ask the question, the time isn't right.

Right?

If you wake up and you're conflicted, the time isn't right.

Like you.

From my perspective, it's not that you can't do it and that people won't be successful, but from my perspective, you have to be kind of all in from the get go. You have to believe. And as a result, that means that you are inherently a risk taker. God bless my wife, I mean, she married me. I was a corporate executive at one of the largest defense contractors in the world. And I jumped ship for half the salary to start this cyber threat intelligence company. And then just as we're having our marriage, I'm jumping ship again in order to start the terrorism research center, right? So we're taking a lot of risk. Same with the Fusion X. I mean, when I built Fusion X, I completely bootstrapped it and I self funded it out of our bank account to get the company going. So there's that inherent risk taking. So I think that's kind of component number one. The second I would say is the reading and the writing. I think you have to consume a lot to understand how to frame the world, to understand what ideas are, not repetitions. I mean, I see A lot that emerges in the market where people think they've invented something and know they haven't invented something. What they're really just bad at is history. They don't understand what's come before them. Cybersecurity is notorious for that in our space, where people constantly think, oh, I started doing Cyber threat intelligence 10 years ago. I'm the godfather of cyber threat intelligence.

It's like, well, you know, knock, knock, knock.

Welcome to 1999 when we started the first cyber threat intelligence company. So I think reading gives you that framework for how to think about, how to think about the world, understanding what's come before you, understanding other solutions and perspectives, and then the writing. And I don't think it has to be written. You know, I'm not saying that you have to be able to write a novel, but I think you need to be a great storyteller. So you need to understand how to convey your vision of the market, your solution in the market, to the buyer. I always tell people, sales is storytelling. You have to have that ability to develop a compelling narrative that resonates with folks and that storytelling is somewhat iterative. Because I think another key component is that you can't go in and have this kind of like, forcing function of, this is what I offer and this is my view of the world. And you should be being telling a story with your ears open for weaving in how the story reflects based on the customer's perspective and the customer's problems. We were infamous at Fusion X for not having a sales PowerPoint deck. I loathed the idea of selling via a PowerPoint presentation. I insisted that every time we met with a customer, it was a conversation and we had our story and they had theirs. And where the stories met in the middle, that was the opportunity.

And I would add to that as it relates to the training we did. That's very much at the heart of the application of human intelligence skills to sales and business development is going into a client meeting or engagement of any kind, seeking to learn and understand rather than see, seeking to pitch and persuade, at least in the beginning, and certainly something that you've practiced and I both practice and preach because it really takes a lot of pressure off of both sides because it's more of a conversation with the goal of learning what the pain points and challenges are rather than offloading a set of capabilities. And the client is left to feel, well, where does this apply to me? There's more of a. I like how you framed it as storytelling in my world or the way That I think of it is where the questions and answers unite.

If you're listening well, the customers will influence your company as well. Right. There are decisions that I've made as an entrepreneur that were reflected, input that I got. So the market always has a voice, the customer has a voice. You can paint yourself into a corner and say, my vision is the only vision, or if you have that adaptive perspective and you can iterate that feedback. So it's all about OODA loops. You can actually design a better company based on that feedback loop from the customers. And we did that at Fusion X. There were service lines that we launched. There were things that we did that was specific to feedback that we got from having customer, prospective customer conversations in the market.

You said a moment ago the importance of reading and writing, and you use the broader term of consumption of history and context and knowledge of your market and of your customers. And I would add to that that asking a lot of questions of your customers will add to the consumption of the universe of knowledge about the market in which you operate.

I go through these thematics in reading as well.

Right.

Which I think you have to be multidisciplinary in your approach and I think understanding the history. So there's the understanding the history of your field. But then I've also gone and looked at the history of all these other fields. As a technologist, I'm obviously very interested in the emergence of technology. But when I sold Fusion X to Accenture and realized I was going to have to exist in this 450,000 employee entity, I went and looked back at the foundation of McKinsey and of Boston Consulting Group and a red kind of all these histories about how the world of consulting came about, how they solved problems. And this is kind of one of those interesting dynamics there was. When I was at Accenture, I ran the cyber defense practice. And the cyber defense practice in of itself as it relates to cyber defense was very eclectic. I had a lot of parts to it, and it was becoming increasingly difficult to reflect kind of our status and maturity of all these different service offerings to the leadership team. And I was reading a book about one of the early consulting companies and a framework that they came up with for looking at markets that was 45 or 50 years old at the time that I read it. That was a perfect match for what.

I was trying to do.

So guess what? I framed my cyber defense practice in the context of this kind of old, original methodology. And when I briefed it, the leadership team loved it. I mean, it was easy to consume. So I didn't have to reinvent or become a genius at how I convey my internal business. I had to understand and adopt the best practices. I'm reading a book right now on Mary Quant, the Woman who Invented the Miniskirt, because I'm very curious about what happened in periods of innovation and cultural shifts outside of cybersecurity, outside of technology. And it happened to be a book that Kevin Roberts cited as being inspirational to him from his work. So you would think the Woman who Invented the Miniskirt has no applicability to cybersecurity and AI and quantum computing, but in reality it's about transforming and innovating as a society or culture shifts, which I feel is where we're at right now as well.

Matt, I want to end on a note of inspiration because God knows we could all use some I made an avid weekly consumer of the global frequency which you put out and it always concludes with a quote. And I've sometimes texted you and said, oh, I love this quote or that quote. I know this is asking a lot because you have to pull from your brain something from this massive list that you keep, but I'd love for you to wrap up this very robust conversation with your favorite quote.

My favorite, I think, is that there's a quote from one of the plank holders of the original Delta Force, again, applying discipline outside of cybersecurity or entrepreneurship.

Where he said.

Some people say planning is everything and for those that never execute, maybe it is. For me, I think that just highlights that perfect perspective of it's great to have a plan, but at the end of the world it is all about execution. There's another quote that says that ideas are just multipliers of action. So I've always been very action focused and just getting out there and driving.

Forward and doing it.

So kind of the Nike Perspectives Another great book from a business perspective is Shoe Dog about the founding of Nike, that persistence. But it's not just all about ideas. It's about actioning ideas and executing against ideas. That is the essence of anything, including entrepreneurship.

Amen.

That was Eric Haney, by the way, the Delta Force quote. I don't think I cited that.

Well Matt, thank you so much for allowing me to crash your podcast to assume the role that you normally play. I for one have learned a lot and I've known you for a long time and I I appreciate your detailed and candid answers and I hope that all of our listeners found it informative and beneficial and entertaining.

Thanks Jen.

This was fun to do.

And we'll have to get you with Bob Gourley next.

Great. Thank you so much.

Thanks.

Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.