Mitre Futurist Charles Clancy on Operationalizing Technology

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology officer of OODA LLC. And today on the Oodacast, Dr. Charles Clancy of MITRE. Hello Charles.

Hi. It's great to be with you.

Yeah, thanks for coming. I've wanted to talk to you for the longest time for a lot of reasons. One is your current position. You're a Senior Vice President and General Manager at Microsoft, Mitre Labs and Chief futurist, which is exactly the kind of guy I like talking to on the oodacast.

Yeah, it is a fun title. When MITRE went through a little reorganization three years ago and we created Mitre Labs out of our technology centers really to elevate the role of the technical depth of the company, I got this additional title as Chief Futurist and it's really fun to grow into.

Yeah, it's fantastic. And also I've run into you several times through the years. I see you on YouTube, see you in periodic conferences. We were on the AFC intelligence committee together. You were widely known during your time at Virginia Tech, but would love to hear from you, your background and how you got to this position. Charles.

Sure. So I started my career at the National Security Agency as a summer intern back in the late 90s and continued working there every summer through grad school, through my PhD and then when I finished school I started full time at NSA working out of the Laboratory for Telecommunication Sciences, leading wireless R and D programs. Really had the opportunity to get involved with great universities and national labs and startups funding all kinds of really interesting work, but really found that I liked the academic connection and the university environment. So decided to switch gears and become a university professor that started a decade long career at Virginia Tech where I led the Hume center for National Security and Technology, which was endowed by Ted Hume of intelligence community fame and also was a professor of electrical and computer engineering while I was there. And then after 10 years of that, was kind of looking for the next challenge and was recruited by MITRE to come lead first the intelligence community portfolio here at mitre and then three years ago really lead the formation of Mitre Labs. So it's been quite the adventure through government, industry and academia. Cool.

Would you, for those who don't know mitre, what is mitre?

Sure. So MITRE is a nonprofit nonprofit research institution. Our primary business is operating federally funded research and development centers or FFRDCs. We currently operate six of these. They span everything from defense and intelligence through Homeland Security, healthcare, transportation, commerce, treasury and kind of everything in between. And it gives MITRE this really important viewshed across really whole of government and ultimately whole of nation challenges. So at mitre, as an ffrdc, we're a trusted advisor to the government, deep technical Experts for the U.S. government. We support everything from research and development through systems engineering, acquisition and policy, depending on the needs of the sponsor and the structure of the individual ffrdc. So within mitre, we're a matrix organization. So I lead the science, technology and engineering half of the company with all of our deep technical talent. And I have the opportunity to work across all six of our FFRDCs really to bring that deep technical expertise to bear for the U.S. government, kind of regardless of, of department or agency.

So that's the job of MITRE Labs.

Yes, exactly. Cool.

Awesome. Well, with that as background, can I start diving into some technical topics and get your views on them?

I would love to. I wake up every morning hungry to talk about emerging and dual use technology. It's, it's, it's my passion.

Awesome. Because so much of this is interrelated and I think sometimes we can't understand individual pieces until we understand more about the whole big picture. But one that is really exciting right now is the proliferation of 5G and things that I hear are coming in 6G and would love to get your views on this because to many you hear 5G and you just think, okay, that must be faster cellcoms, because 4G was faster. But it's much more than that, isn't it?

Yeah. So each generation of cellular networks, they don't always know ahead of time what the killer app is going to be. We didn't realize that when we built 4G, it was going to be the underpinning of the smartphone and social media, the ubiquitous mobile broadband and the social. Mobile Internet was not something we were thinking about as we were envisioning 4G. All we knew is we wanted faster data to the edge. But because we created that capability, it really unlocked the tech industry that we have today. The hyperscalers that really run the Internet are a byproduct of 4G and ubiquitous mobile broadband. And it's interesting, with 5G, we were hoping for a similar sort of significant industrial GDP level impact. And so people began focusing on industrial applications, industrial IoT, everything from autonomous vehicles to drones to factories. And so in the design of 5G, we focused a lot on reliability and low latency, which were not necessarily key drivers of 4G. 4G, we just wanted to make sure, the network was responsive enough to handle voice communication, but now if you want to do command and control of safety critical stuff, you need a whole level of additional quality of service in your network. And so 5G was really designed for that use case. Now, we haven't really seen one. We've been sort of slow to Deploy full blown 5G here in the US in particular, and there's only been limited industrial use of all these cool new features in 5G, although there's a bunch of different constituencies that are trying to take advantage of it. For example, DoD has a whole bunch of trials underway to try and take advantage of use some of these for tactical applications. NTIA is about to start rolling out $1.5 billion in grants to help fund U.S. companies to really get involved in new access network technologies and try and drive use cases. So I think we're still on the early days, but of course in the midst of that we're already starting to think about 6G. Yeah.

So what is 6G?

6G, well, one more G, obviously. So 6G is really the focus on again. So again, we don't always know what the killer app is until we really start building it. So 1, 6G is going to deliver. I think on all the unrealized promise of 5G, oftentimes what we find is sort of it's like the Star Trek movies, right? The odd ones are all not so good and the even ones are the good ones. And you sort of see the same thing with generations of mobile technology. 5G is really kind of a transition G. And 6G is going to fully deliver on the value and opportunity of 5G, but it's also trying to support even more immersive use cases like AR and VR, like extended reality, the Metaverse. Right. These are all some of the things that are driving the data rate requirements for 6G. And in order to accomplish that, the technology under the hood is going to leverage AI really at every layer of the network stack in order to accomplish that. Plus there's some new spectrum they're looking at. But again, we didn't really take advantage of the 5G spectrum, particularly at millimeter wave. And so some of the 6G spectrum perhaps is a little premature. Maybe, maybe 6 and a half G will start really getting into the new spectrum now.

Charles, one of the promises I always heard about 5G was that you'd be able to communicate not just from your device to a cell tower to another device, but, but device to device. Is this being delivered in 5G?

Yeah. So the whole device device community one, it's the commercial users don't really care about that. It's really the public safety and the tactical users who care about it because they're worried about in some sort of disaster scenario. If the cellular infrastructure is down, then you need to be able to do device to device. So FirstNet, for example, which is public safety broadband network here in the US plus some of the DoD users are very interested in it. But because the market is kind of small, it's been slow to actually deliver and be operationalized. There are pilots underway. I mean, some of the handsets do support it, but it's not sort of as ubiquitously available as perhaps the PowerPoint might suggest. Cool.

Got it. And there's also a lot of talk about cellular communications from space, including some prototype satellites launched which do something that I thought would just be totally impossible just a few years ago, which is accounting for the, the many different Doppler kind of shifts to spectrum as things are flying around the earth.

Yep, so. So there's been a lot of interest in cellular to space. Many people thought it was impractical. We had Starlink really as the first proliferated Leo constellation that gave a hint that it could be possible and one web before them. The use cases today, of course, are still to have a more traditional satellite terminal on the ground and then have a 5G base station or a WI FI access point attached to it that does local sharing. But indeed 6G in particular is looking to do direct device to space. I think the Doppler is manageable. The challenge really is latency. So we're trying to drive down latencies as much as possible in the edge network because again, things like safety critical, closed loop control of industrial systems, or even just 50 milliseconds latency in a voice call as an upper bound mean that we want to try and minimize latency. And so the protocols have all been designed to be very, very fast. The problem is when you're going to space, you've got a minimum latency of about a quarter of a second, 250 milliseconds. Right. So you end up with, with much higher latencies depending on what orbit you're going to. And all the protocols need to account for that in the design of how they, how they move data back and forth, how the error correction works. And so that's all going to be part of the new, the new systems. Cool.

Thanks, Charles. Can we shift topics? I know all of this is going to be related when we come back to it at the end but would love to get your views on quantum computing broadly. And let me tell you, what I hear from a lot of people is, yes, I've been hearing from Quant about Quantum computing for 20 years now. It's always 10 years out in the future. Yes, I understand there could be some use cases there, but it seems like there'll be future use cases. What do you think about quantum computing?

Well, I think quantum as a whole has. His reputation has suffered because it's failed to deliver on some of the exuberant timescales that people have discussed. But it's also important to realize that there's multiple segments of quantum and that much of the research in quantum over the last 20 years is yielding really interesting results. In quantum sensing, where we're doing electromagnetic field detection systems with exquisite capabilities, there's new quantum timing and quantum position PNT type solutions that are coming online, all of which are much more effective than their counterparts. And so a lot of the research into the quantum science is yielding advances in quantum sensing. But of course, what most people are interested in and they think about sort of front and center, is the computing angle. And, and so again, there's been continued progress on quantum computing as well. One way to measure that is just the number of qubits that are available in quantum computers on the market. And they've been sort of following a Moore's law type pattern where the number of qubits available is doubling every 18 months. But the. There's a bunch of caveats to that, right? So it depends on how many qubits you can locally entangle. So if you've got a very sparse, you can have lots of qubits, but they can be sparse in your ability to entangle them. And you may not be able to solve the same problems as if you had fewer qubits that were fully entangled in a full mesh. And so there's this a lot of people pushing for maybe quantum volume is a better metric than number of qubits. And so there's all this back and forth about exactly how you measure our progress. But regardless of the measurement, for the most part, we're still sort of following a Moore's law trajectory. The challenge really, though, is that at any minute we could hit another brick wall of physics, right? Superconducting qubits. And it's costing more and more money to double the number of superconducting qubits just because of the laws of physics. And the science isn't quite there yet. Meanwhile, you've got other types of Qubits like trapped ion qubits or photonic qubits that are making more rapid progress but are further behind in terms of the sort of maturity of the technology. And so you've got multiple competing technologies that are all kind of moving together in parallel, different companies and different countries investing in different ones. And it's going to be exciting to see how the technology continues to mature. Yeah.

Charles, one issue I have seen, which I would love your views on. In the quantum computing world, it seems like you almost have to have a PhD in quantum effects of some sort to understand what can be real or not. And I certainly don't have that. I can listen to people who have that, but how can I really test if something is valid or not? And this is important because in computer science science, where I have most of my background, you can test things.

You can.

If someone claims something, you put it in your lab and check and see how it will work in your enterprise. In health sciences, you can test stuff. For example, Theranos should never have been able to continue their fraud for so long. People should have been able to test that. When it comes to quantum computing claims we have no way to test that, do we? How can we know what's real and what's not?

Yeah, that's the challenge, right. It's not as though the average user can go off and try out an algorithm on in the cloud, even for the most part. I would say, though, that access to quantum technology is improving, particularly if you think about it from a computer science perspective. There's a variety of SDK software development kits that are now abstracting away the physics and giving you a common set of tools to program any quantum computer. And it will compile it down into an intermediate representation that can then target to the specific instruction sets of the individual quantum computers. And so Microsoft has something called Q Sharp now, right. Which is an extension of C Sharp, which is their quantum programming language. And you actually can run in Azure, Q Sharp. And it will either target a simulator that I guess an emulator can't simulate, you can emulate the quantum algorithms, or they are now adding more and more actual quantum computers connected as accelerators into Azure, where you can actually run it on real hardware. And so the cloudification of available quantum processors is continuing to increase. And I think as you have this abstraction layer that's above them, it'll make it more accessible to program them and begin to experiment.

Cool. Would also love your thoughts on quantum effects for cybersecurity and as context defcon, you know, the Annual Cybersecurity conference Hacker conference had its first ever Quantum Village at DEFCON 30 this last year. They'll do that again this year. So they brought together hackers and quantum experts, gave them time on a quantum computer, went through several presentations, had a great debate at the end on whether or not enterprises now should be getting ready for the future of a quantum computing enabled world. And the general consensus was due to the threat of these harvest now decrypt later attacks, it's important for organizations to start preparing for the quantum future. Do you concur?

100%. So in fact, Teresa Shea and I just published an op ed on this topic as part of some work that Sandboxaq and Mitre are doing together. We have indeed the harvest now decrypt later vulnerability such that adversaries can can vacuum up encrypted Internet traffic. And once they have a quantum computer, they can crack the encryption keys and decode all the data. And that's a real concern, particularly if you think that we may have quantum computers 10 years from now and you're a national government that's sharing data with a declassified date of 25 years. You already know that you're not going to be able to uphold the sort of declassify by date that is in the data that you're sharing because of this threat. So there's a couple different camps of how we solve this problem. Early on, people were investing in quantum key distribution, which was actually to derive encryption keys using quantum effects. There's a lot of challenges with QKD in terms of how you build it at the systems level. It will secure individual point to point links, but it doesn't secure end to end links. So it gives you confidentiality but doesn't give you authentication. And so it really doesn't give you systems level security. And so here in the US in particular, NSA and NIST have been promoting post quantum cryptography as the solution to this. And NIST has had a design competition ongoing for several years now, has finally released the candidate ciphers and is going through the final stages of standardization of a new encryption algorithms that would replace RSA and elliptic curve as the primary ciphers for public key cryptography that would be quantum resistant.

Another thing that I have heard them talk about is quantum agility for encryption algorithms especially. And that phrase actually made it into the cybersecurity strategy published by the government in March. And here it seems to be a recognition that even after you have good algorithms that the whole community says are quantum resistant, you really don't know, and you might need to swap those algorithms out in the future. So you have to be Agile, is that 100%?

And so there's kind of two camps right now that are pushing for hybrid approaches to cryptography that use a combination of quantum resistant and legacy ciphers. And one camp is saying we need hybrid because we can't trust the quantum resistant ciphers yet because they're too new and they're not tested enough. And we've found other ciphers that have been ended up becoming vulnerable because of bad math, basically. And then you also have the other crowd that's very concerned that quantum is right around the corner and, and that our legacy ciphers are all in jeopardy and we need to have hybrid so that if the legacy stuff breaks, we're still secure. So I think both sides of the debate think we need hybrid, but for very different reasons. And so right now there's a lot of work going on in the standards community to try and figure out how we have basically hybrid certificates, hybrid authentications, what, what the policy should be. If my web browser is connected to a web server and it doesn't support post quantum ciphers, should it still allow the connection or does it require both? A lot of that debate is ongoing right now in the standards communities as we prepare to begin this migration that intends to be agile, right, where we can swap in new ciphers down the road without having to do these massive replacements. Because shifting to post quantum crypto is going to be a huge undertaking for the software community, for the Internet community, for everyone. It's akin to flag day on the Internet when we switched to TCP IP back in the 80s. There's a massive cutover that's going to be required and a huge overhaul of software to incorporate these new encryption algorithms.

Yeah, this is exciting stuff, at least for nerds like me, because this is really neat. There's capabilities coming from our understanding of the universe that we're applying to our compute power and our security. One I really like is the approach from Quintessence Labs, which I think is important even in the pre quantum world. I don't know if you know them, but they do the quantum. They use quantum effects to generate extremely high entropy keys. And it's, you know, quantum tunneling is their approach. And that interests me because quantum tunneling sounds really neat and modern, but it was invented in 1956. It's in all of your microelectronics today. What they add on top of that is the ability to measure the randomness at when a effect tunnels, when something tunnels across that barrier and from that build random encryption keys, which I think contributes to security today and helps us in the post quantum world as well?

Sure. No, it's the more we understand the world of quantum physics, the less random our universe is. The less random our universe is, then the more in jeopardy our random number generators may be. And so actually harnessing quantum randomness is part of the solution space.

Well, yeah. And I also believe that. Here's another thesis I want to try on you because this could really be a screwy idea. I think CEOs today generally benefit from having an understanding of physics and the way the world works, the realities of things. At this scale, a certain segment of CEOs really needed to understand microelectronics and how circuits work and chips work, because it's a very technical world. In the Future, will all CEOs need to understand more about the quantum world and quantum effects, those things that many people learn in high school but quickly forget because you don't really need to apply it anywhere.

What do you think? That's a good question. I think in general, the world requires us to be more and more tech savvy. I think we see that in the evolution of university curriculum for college degrees, the proliferation of more advanced degrees, particularly in STEM and. But I also think that we also have new tools from the Internet now to generative AI and large language models. They can help us more readily access and synthesize and understand that than we did in the past.

Can I shift topics again, Charles, in the interest of time? I know you have a deep background in cybersecurity. You mentioned your time at nsa, that place foundational pioneering work in cybersecurity. You also did a lot of cybersecurity work at Virginia Tech. Now you're at mitre, which is also famed in parts of the community for cybersecurity work. And I was wondering if you can tell us what MITRE is doing these days when it comes to cybersecurity.

Sure, certainly. So mitre's kind of core brand in cybersecurity is the mitre, ATT and CK framework. This is something that we released several years ago and has gained, I know, international adoption and recognition as kind of a key. I don't know, Rosetta Stone, if you will, for understanding threats, cyberspace. And at a basic level, the notion is that traditional cybersecurity are point solutions looking to address specific vulnerabilities which actually are parts of a larger adversary campaign. And the mitre, ATT and CK framework says well, if, if you actually realize that a human adversary is behind the scenes here and they have a whole bunch of steps they need to go through to identify your network, surveil it, exploit it, establish a presence, move laterally and exfiltrate data. If you begin to look at the patterns of each of the stages or life cycles of an attack, you can learn a lot more about the adversary and figure out better how to block them, because you don't necessarily have to block every single one of those stages. You just have to break the kill chain, if you will. And so the Mitre ATT and CK framework really tries to map out that full lifecycle of an attack and map specific adversaries into different combinations of tools and tactics, techniques and procedures that they use as part of the end to end life cycle. And now that has been really used to help better understand how different security products fit together, how to better systems engineer security for large scale networks. And that's again been kind of key to mitre's brand identity and cybersecurity. I'd say where are we headed into the future? A few different things to point to. One would be the MITRE Engage framework, which is all about adversary engagement. Adversary engagement is part of a broader collection of activities under active defense. But it's this idea of actually engaging adversaries as they attempt to or penetrate your network in a way to one identify that you've got an adversary who's exploiting you. This could be things like trip wires essentially in your network that a normal user wouldn't, wouldn't trip over, but that an adversary would. That's what's known as deception for detection. We also can establish sort of halls of mirrors that adversaries can get lost in, thinking that they're tunneling further and further into your network, when in reality they're just bouncing around inside a virtualized environment and not actually accessing anything real in your network. This is very useful for slowing adversaries down, but also allows you to observe the adversaries in a highly instrumented environment to better understand their tactics, techniques and procedures and develop defenses to them. And so while it's right now the tools are cumbersome, I would say, to build convincing deception environments and environments for doing adversary engagements. AI is, I think, in the process of transforming this whole landscape where we can use a lot of the new sophisticated AI tools to create these halls of mirrors that are much more convincing, because as soon as an adversary thinks they're in a fake environment, they immediately back out and try somewhere Else the longer you can keep them engaged with a convincing environment, the more data you can get and the more you tie up their resources and prevent them from attacking real targets, your network. So that's a whole nother set of activities. Also we're very involved in the world of zero trust, trying to figure out what that is a conceptual thing means as put forward in the executive order last year, how agencies, agencies can actually operationalize it. And then of course, on the more legacy front, we're very focused on securing critical infrastructure because the threat there continues to grow. And we see adversary nation states beginning to view cyber attacks against critical infrastructure really as a force protection and strategic resource in sort of the larger sort of DIME model. Right. So I know Russia could sanction you or they could could hack you. And people are feeling more comfortable about these sort of non kinetic cyber attacks as increasingly routine. And again, they can be very destructive. We need to be better able to defend against them.

Charles, all of that is exciting and I'm going to link to ENGAGE in the course of mitre, ATT and CK Framework in our show notes here. And we'll be personally diving much deeper into the ENGAGE Framework. That just really sounds exciting and I know it's critically important and you're working critical infrastructure. Let me ask you this, should space be treated as a critical infrastructure?

Yeah, mitre's been pretty active in the space cybersecurity domain and we're one of the founding members of the Space ISAC out in Colorado Springs. It was great to see their SOC go live this past month as a really cool milestone and we've been very supportive of efforts on the hill to promote space as another critical infrastructure domain. I think there's open questions as to what agencies should be the sector specific agency responsible for it. Sort of pros and cons across the different agencies out there as none really have this consolidated responsibility for the cybersecurity issues that we're seeing. But in particular, given the proliferation of commercial assets in particularly low earth orbit, and the potential for cyber attack to not only disrupt the service of those individual systems like we saw in Ukraine, but also you can imagine hijacking one and taking over its propulsion and causing it to crash into other satellites, causing a significant amount of space debris, these are all real concerns that we need a systematic approach to addressing.

Yeah. In preparation for this, I was doing a little homework and I asked myself how many launches have there been through history, pulled up a graph that shows huge amount of launches every year. If you're a space nut, like me and just slowly growing. And then all of a sudden, three years ago, it's the hockey stick and it's just amazing. And I think next year is going to be even more. And you mentioned space debris. There's this theoretical point called the Kessler Syndrome or the Kessler Effect, where things start crashing into each other at such a rate that the debris is continuous and never ending. A cascading effect that essentially then locks humans to the earth, prisoners of our own planet forever. So we don't want the Kessler effect.

Right.

And we need good solid policies that help anybody who launches anything into space be part of the solution. Get rid of your own debris. And I have seen draft language on the hill for the last two years. Never seems to make it into law. That kind of pushes that kind of thought forward. I know we have to deal with this stuff and I mention it in the context of cybersecurity also because if space debris means we can't communicate with our own satellites, that's a cyber threat as well.

I'd say 100% agree. Those are all sort of the asymptotic concerns we need to be looking at. Some of the more near term issues that we're trying to tackle are really more the air traffic control of space. As if you think about driving 495 here in Washington D.C. traffic's moving along at a steady pace. But you get to a point where one additional car caused a non linear slowdown because of congestion in basically how close cars feel comfortable being to each other. And we've hit that point in space where we've got the point of congestion. And we measure there's all these sort of close calls of satellites getting too close to each other. We call this a conjunction. When two satellites are less than a kilometer away from each other and a kilometer is a pretty big distance. There's no real jeopardy of something that's only a few meters wide hitting something that's a kilometer away. But the issue is we don't have precise knowledge of every everything's location. And many of them are using GPS for tracking their location, which maybe gives you good latitude. Longitude doesn't necessarily give you good elevation when you're in, in low Earth orbit. And so there's, there's noise in their position knowledge. And particularly as you're observing from the ground, there's noise through the ionosphere of our ability to track with radars and everything. And so one of the big efforts right now is can we get improve the fidelity with which we know the Precise location of every satellite so that we can better do space traffic management. And I don't know if we, if we cut the reporting down to only 500 meters instead of a kilometer and it would dramatically reduce the number of potential collisions that have to get reported and handled and managed and deconflicted. And so again, there's a lot of routine stuff like that that's pretty far away from the Kessler syndrome that we've got to deal with today.

Cool, thanks. Very good context. And I also want to mention there's a company I'm an advisor to and a small investor in called Turian Space and they have plans to contribute in this domain. They're launching a satellite this year that first does just space situational awareness, taking good pictures and capturing location, that kind of information. Next year they launch one that will be able to move satellites, put them in a better orbit or throw them to the ground if it's time for them, if their time has passed. And I think companies like this will help make the world more sustainable, make space more sustainable.

Yeah. Yep. Great.

Let me keep moving in the interest of time. We already talked a tiny bit about the cybersecurity strategy that was issued in March and wanted to ask if you have any opinions about that. But first let me bias you with my opinion. I think this is the greatest government strategy on cybersecurity I have ever read and I've read every one of them. I like it because it's a clear articulation of a vision that I think all of us should get behind. It's got some rough edges, it's got some parts that were clearly written by committee because that's the way the government works. You know, you can't mention this group unless you mention my group or else my boss will non concurrent that filtered its way into there. And another thing I don't necessarily like is there's no real metrics so nobody has to do anything. But I love it. I love the vision and wanted to get your context on this strategy.

Yeah. I think I'll just point out one part of it that I think is most disruptive and interesting and perhaps difficult to implement. And that is the suggestion that software vendors have liability for vulnerabilities in their systems. Right. So today if I produce a software product and I sell it to the world, the world buys it and deploys it into their networks. If someone then discovers a vulnerability in that software, I don't have any sort of legal liability for that. The group that has deployed it will end up Having to deal with the implications and any potential liability. And the, the cybersecurity strategy suggests that we begin shifting more of that liability to the vendor that developed the software, which for the first time would create real incentives for those who are developing software for the Internet and the world as a whole to actually deal with security vulnerabilities within their software. I think it could transform the cyber insurance market as well as, as companies that are deploying software are, are buying insurance insurance. The insurers could look at whether or not the software they're deploying and meet certain metrics around safety and security. And like I said, I think for the first time it could really move the needle on motivating software developers to really take security into consideration when they're developing it and hopefully would reduce the number of zero days out there. I mean, there's lots of tools like software, bills of material s boms that are now part of the ecosystem that could help contribute to understanding what's inside pieces of software and being able to localize and identify where there might be vulnerabilities and would expedite remediation of those from the vendors.

Oh, thanks. Next question. Do you track the Web three world and cryptocurrencies and blockchain? Do you have opinions on those?

I have many opinions. So I was a pretty serious cryptocurrency skeptic for many years. When I was at Virginia Tech, I had a couple grad students who were very into crypto and one of them in 2012 was explaining to me how he was taking a paper bag, like a lunch bag full of cash to a street corner in Georgetown to buy bitcoin. This was before the exchanges existed. And he selected his apartment based on the fact that he had free utilities so he could not worry about the cost of energy and mining bitcoin in his apartment because he probably also didn't need to worry about heat because it was generating enough heat from his mining rig big. So this was sort of the early days of Bitcoin and it was sort of fascinating to see a disruptive community kind of looking at for new solutions. 2016, 2017, we began to saw sort of the increase of awareness and visibility into cryptocurrency. Part of it as a, as a kind of a counterculture hacker, open source response to the hyperscalers and the centralization of compute and data ownership. Right. Web3 began to sort of separate itself from cryptocurrency, with crypto just being one application of Web3. Of course, through the pandemic, we saw cryptocurrency prices skyrocket and then collapse, mostly due to really discovering some of the insecure and fraudulent underpinnings of certain major pieces of the crypto economy. But my hope is we've kind of gone through the whole hype cycle here now and we can start actually building Web3 technologies out of all the building blocks that have been sort of thrown off by this ecosystem over the last decade that really are decentralized. And one of the cool things I think I really like about Web3 and this whole notion of decentralization is from a US perspective, it could be a really good technical offset strategy to China's Belt and Road initiative. Right. So China's very interested in exporting its very vertically integrated cloud 5G surveillance technology tech stack to other countries through Belt and Road. And I think that as we shift towards these decentralized technologies, it is inherently anti authoritarian in the way that the technology works and works together. Right. You've got this whole notion of democratic control of services under the hood. No one entity controls any of these different things. And so I think there's a real opportunity to invest in web3one because it's a cool set of new technologies. This decentralization is really interesting from a technology perspective, but I think from a policy perspective it is the natural answer to authoritarian tech stacks that we're seeing in other parts of the world. World.

Charles, there's parts of that argument that I have never heard before that you put extremely well. And I've been tracking Web3 a lot and tracking China a lot. I'm going to need to think about that and I'm sure I'll be writing more on that very topic because it just, it resonates with me. And I also believe, like you do, that there's a lot of potential here. I just didn't hear it so well put before, so. Thanks.

We have a paper we published maybe eight months ago on the topic. I'm happy to. Happy to share with you.

Please do. I'll link that so everybody can get their eyes on it.

Great.

And another thing we're seeing with Web3 is we track every major incident at OODA loop. We have a database and we post it online every major security incident. And we look at root causes and some of them are the same old root causes of every other cybersecurity incident. Credentials stolen, deception, social engineering. And then there's new root causes, poorly written contracts or other things unique to the crypto space. So I think.

Or broader financial engineering. Right. We're Seeing this interesting blend of cyber exploitation with financial engineering, which is really looking at if all of these smart contracts and web3 tokens are a bunch of differential equations that sort of all plug together in cyberspace and no one's in control of any of them. People who can sort of map out their behavior can engineer in the same way that a hedge fund might manipulate financial markets. Yes, you're right. You've got people who are able to follow the rules but still manipulate things, cause a crash here, take out a short position over here and make a bunch of money.

Yep, yep. Through things like flash loans. Yep. And everything is working the way it was designed to work. But someone figured out how to manipulate it to their game. Let me keep moving because in the interest of time, I definitely want to talk about artificial intelligence. And then if we do have time, I want to talk about this great trend of reshoring and friend shoring, which is going to be very significant and would love to wrap it up with questions about what executives should do to better track the future. So can we start with your views of artificial intelligence? This is such a big domain, it's hard for me to get my head around and I try to study it every day.

Yeah, it's been really exciting to watch the last decade of progress in AI, really, since deep learning was demonstrated to be feasible in 2012 with the ImageNet competition, the last 11 years have really been a roller coaster. If you look at the number of parameters in these deep learning networks, again, it's exactly tracking Moore's Law and Moore's Law is exponential. Right. And so, so we're now starting to see the hockey stick effect as AI really evolves faster and faster and faster. So the last, I'd say year, maybe even more Narrowly, the last six months have been pretty amazing as OpenAI has released GPT3 and then GPT 3.5 in the form of Chat GPT and then Microsoft adopted it through Bing. And I think one of the important factors there was just the public visibility into how far AI had come. Much of this had all been sort of happening and happening at Moore's Laws pace behind the scenes. But once you make it publicly visible, two big things happen. One, there's a lot of attention and media focus and enthusiasm around it, but you also get a lot of opportunity for human feedback and reinforcement learning that can go in to help improve the AI for the next generation. So in particular, I'm just fascinated by some of the early challenges that Bing had with people being able to circumvent the alignment safeguards that were kind of the front end of Bing. And if you, if you could cause an existential crisis in the AI model, then you could kind of pierce through its, its alignment, which is the attempt by the creator to align it to human values. You get beyond that and there's sort of this dark underbelly that represents really the collective values of all of society as reflected by all data on the Internet, many of them divergent. And the ability to interact with that is just fascinating. And I guess recently we've had tech executives call for a six month pause on AI. I think that's a impractical idea. I don't know if it's a bad idea, but it's an impractical idea. I think it's impractical because of the economic pressures that all the hyperscalers have right now on continuing to advance AI to stay ahead of each other. I think nationally it's bad because if we stop for six months and China doesn't, then China catches up, right? And so if you look at China's large language models, they're not as sophisticated as ours are. And if we can continue to maintain even a six month advantage over them moving forward, then we'll continue to have some ability, some economic opportunity, sort of marginal value and capability above them.

What do you think that the coming age of AI as demonstrated by GPT and OpenAI means for our workforce? Should I be concerned that I'll be replaced by some version of AI?

Well, we get you a talking avatar now, right? So I think my view on this is, so for example, the software engineering community here at MITRE sort of has asked me this question, like, are we going to be obsolete because AI is going to write code? And I guess my response to that is how many people sit down at a terminal and just write code from scratch with no aids, right? Over the last 30 years there's been layers and layers of additional augmentation to software developers to help make them better at their job and able to more quickly innovate. Nobody's writing an entire program in C from scratch, right? We have all these different libraries that we use with all kinds of support functions that implement many of the different things that we use we have. And of course that's the motivation for SBoM, right, is that writing code is more about assembling Lego blocks than it is about writing all code from scratch. We have the Internet, right? So Stack Overflow, anytime you have a question, right, you just go to Stack overflow and copy paste someone else's code, which is kind of interesting because vulnerabilities in stack overflow then find themselves into perhaps hundreds of different projects that we have to track down when someone finds a vulnerability. We've had Copilot now for the last year that's, that's supporting Autocomplete. And so I think it changes the nature of what it means to be a software developer. I think it also dramatically increases the sort of effective lines of code that you can compose each day because you are AI augmented in your ability to do it. But I think if anything, it just sort of shifts where the programmer's attention is and it's more to the business logic and the functions that you want to execute, more so than the nitty gritty details of every single algorithm and how to optimize it.

Okay, well, let's talk about other job fields though, however, because like, I agree with you there, that makes total sense to me. And I'm not a developer, but I can use development tools and I've used GPT to help me write code. And I believe you, the humans are going to be still so very important here. But what about lawyers? There are two examples in the past month where I have gone to GPT and asked questions that kept me from having to send something to a lawyer who would have charged me 750 an hour for two hours. Now, GPT is not a lawyer, I'm not a lawyer, but it was able to provide information to me that reduced my risk in a situation and I decided not to talk to a lawyer. Well, these things evolve to the point where we need fewer and fewer lawyers and it's not a good career path for people anymore. For example.

Well, you might look at the historical trends. I think the accountants and the rise of spreadsheets is an interesting case study here. Right. If you look at the number of accountants and bookkeepers that we had a century ago and what they did every day, which was mostly tabulating data and using adding machines and calculators and manually managing the books. Spreadsheets came along and reviewed as the thing that was going to put the entire accounting business out of business. And what you saw was over time, a reduction in the number of accountants out there. But then you saw an elevation of the level in the intellectual stack that they were operating. They were no longer doing math by hand anymore. You had these systems to handle it. I suspect other professional fields will see similar trends over time, lawyers included, where, again, lawyers will spend less time researching, I don't know, case law and how it applies to this particular thing or some regional code issue, but can really focus on the more strategic level of the law and fewer lawyers over time. But regardless, they'll be operating at a higher level of sophistication.

Makes sense. And then I hope as a user of lawyers, that brings their rates down a little bit somehow.

There you go. Well, if they're more efficient in their job, in theory, it's not that their rate changes, but the number of hours required to support you goes down.

Yeah, yeah. All right, Charles, we're almost out of time. I definitely want to get your views on reshoring and friends shoring. This trend has been underway for a decade. The pandemic accelerated it. The lockdowns in China accelerated it. The war in Ukraine accelerated it. And it seems like so many businesses are doing anything they can to shift their supply chain to where they have more confidence that their supply chain will continue to deliver for them. Do you have views on this, Trinh?

Yeah, I think there's been a couple different. You highlighted many of the inflection points. I'd say that globalization and the globalization of our supply chain was designed to have very little slack in the system. And it was highly efficient with very precise schedules and the ability to move parts and materials upstream through the different supplier networks from the tier 2 to the tier 1 to the OEMs. And I mean, I've seen. I forgot the numbers now, but the statistics of the number of times components for an iPhone went back and forth across the Pacific Ocean from sort of inception to delivery of a device was. Was astronomical. But we had built, we used the Internet and real time connectivity and cloud is a key enabler here to drive sort of this huge amount of efficiency into our supply chain. But then we have these catalyzing events that basically disrupt this system that has no slack in it. Some of them are geopolitical, some of them were pandemic related. All of them, though, basically throw a wrench in the gears of this finely tuned machine with no slack in it. So, as you mentioned, we're seeing companies looking to manage their risk if they can't sell their products because they can't get the component technologies they need a solution to that. And having a globalized supply chain is perhaps not the best solution. Now, independent of that, there's been this other threat around microelectronics and concerns about China and Taiwan and the geopolitics of all of that. And as a as from a US Perspective, how do we reduce our risk on the unavailability of Taiwanese semiconductors? In the market. And part of that is more US or US ally fabrication of semiconductors. There's another piece of it, I guess. I think all of this makes sense. I guess a concern that I have though is this disruption is creating, I think, new monopolies almost in the ecosystem. So if US Trade policy is going to dictate made in America requirements in new industries, then you need a US Supplier base who is going to provide those products where no such supplier may have previously existed. It we're seeing that in 5G today with a lot of investment in rebuilding our domestic telecom manufacturing ecosystem after we sold it all to Europe in the 2000s. And that's a lot of opportunity for investors. So a lot of the private equity investors are excited about it. There's all kinds of federal programs. Federal programs can't pick winners and losers, though. And so we kind of are in a situation now where kind of private equity is leveraging this trend to pick the winners and losers. And to a certain extent, it's going to reshape the next phase of the industrial ecosystem in the United States. But if you dig under the surface and say all these investors who are going to be dumping billions to trillions of dollars into onshoring all of these things, where is their money coming from? In many cases, it's coming from the Gulf. So one of the concerns I have is that we've basically got the Middle east investing in US Private equity to accelerate a decoupling with China because it makes them money. And I'm a bit concerned that that doesn't necessarily satisfy our broader geopolitical objectives with China. Maybe full decoupling isn't the best idea. And so there's all these interesting dynamics that are in play. And I think at the local level, companies just want to have resilient supply chains. They can bring their products to market. A national perspective. We want to be able to manage some of these big geopolitical risks, but we're not China. Right. We don't have a planned economy. And so we don't have the same levers. And it creates interesting bedfellows among the investment community, the government, and of course, all the major components of US industry. Cool.

Well, Charles, before getting to my final question, I want to say thanks. You are definitely a national treasure. I'm so glad that the nation is able to tap into all of mitre, and through Mitre, you and I really appreciate you spending time with us. But now I want to ask a question about industry. There's so many leaders of industry, corporate leaders C suite people, boards of directors who need themselves to understand technology and where all of this is going. And I wanted to ask if you had any advice for corporate America on how they can track the future of technology and what it means for them.

Well, I think clearly watching the OODA Loop podcast would be my first. Thank you. That's a tough question right there. I haven't found, really, a distilled single source to go to for really understanding these trends. And some of the trends end up getting very politicized, and there's pretty extreme views that you can find out there on social media. AI is a great example between the accelerationists and the safetyists and who's right. Typically, the answer is somewhere in the middle. And so I would just encourage people to stay plugged in to the trade journals and social media. There's a lot of activity on Twitter and other social media in different areas. And really, again, make up your own mind what you think some of the right answers are, because I don't know that anybody has all the answers right.

Well, thanks, Charles. I really appreciate this.

All right. It was my pleasure. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop.com.