National Security and Technology Expert Lewis Shepherd (Part Two)

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com welcome back to the Oodacast with Lewis Shepard. Thanks, Louis. Good having you back.

Great to be back, Bob. Thank you.

All right, so kind of as a segue between the crisis to technology is, we've all seen rapidly the move to work from home because we had to, and that is causing many people to change the way they work. And it's causing many enterprises to have to rapidly adjust to serving employees remotely. And these remote employees, if you're a big company, have to access your corporate resources, your treasure, remotely in order to do their job. So we've seen a great testing of previously just plans for remote workforces. And then the smaller the business, all small businesses are also doing this kind of thing when they can. So everybody's working from home. And then the families at home are doing things like getting education delivered via video telecollaboration or Zoom, for example. Others are getting music lessons delivered or even taekwondo lessons by Zoom. So everybody is transitioning from the small business to the very large business. And I wanted to ask your thoughts on not just this instantaneous move to work from home, but what impact is that going to have on the course that technology was taking us?

That's a brilliant question, Bob. And as you intimated, many people were on this track anyway. Right. So the company that I work for, VMware, big part of VMware's core business is, you know, the VM stands for virtual machine. And one of the fantastic beneficial aspects of running technology on platforms of virtual machines is you wind up being able to power things like virtual desktop interfaces. And so VDI has been a big business for not just VMware but others for years, for more than a decade. And what we have found is that a lot of enterprises and home users are realizing that when they said, well, you know, this isn't really for everybody, it's because they really weren't trying it out with everybody. And I think actually people are coming to just in the last month or so, as they've really given these things a very robust trial by fire. Is that this kind of communication, you and I talking like this, it's actually quite natural. It can be very engaging and compelling and attractive for people to be able to. It has its own virtues as well, which we don't have time to go into. But there are a lot of things that are really attractive about having this beyond just it keeps us from spreading viruses back and forth to each other. So, you know, We've seen really good business with this and it's a great thing to be able to help people to continue to perform necessary functions in a time of crisis, to continue to be able to do their work and to reach out to colleagues and to their loved ones in a virtual way at a time when there's no other alternative. And so, you know, when we have standing solutions that we turn on for 35,000 desktops across an enterprise that never tried VDI before, that's a great feeling. But where I as I think with your question, what you're asking is where else is this going to take us? What I think there are three aspects that I think of the technological advances that we're going to pay more attention to after proving to ourselves that this new approach of remoteness as an abstraction that it brings to us first is really concretely the importance of remote sensing and the two aspects of remote sensing, near and far. So far, remote sensing is one that you from your intelligence background, really familiar with. You've got companies right now like Planet and Maxar that they've been doing activity sensing and activity based intelligence for national security uses for a long time. But now they can use those same techniques, typically space based for activity and population based analytics on epidemiological spreads and things like population scale movements and refugee movement, all the kinds of transnational and within nation analytic aspects. But there's also the notion of remote sensing that's near remote. And what we've seen, particularly in China and in some western urban centers, is the use of remote temperature sensing, heartbeat sensing at a distance in micro movements visible, using kind of tweaking facial recognition software to be actually be able to detect heartbeat. And when combined with temperature sensing and other kinds of observational remote sensing, you can actually develop really quick diagnostic information on individuals. So these are visible but subcutaneous realities that we're actually able to sense at a distance, which in this current climate is really, really helpful. So that's one thing, remote sensing, secondly, supercomputing. Now, supercomputing is used widely. National security and a few elements of the economy at large, the world's most power. I know you're a fan of the top 500 annual list of supercomputers, Bob, and as you know, the list is going to be blown away this year or next by the rollout of the massive monster El Capitan which is being built for our nuclear national labs and Lawrence Livermore and Los Alamos and Sandia is troika. El Capitan is a two exaflop computer. So that's more than ten times the speed of today's number one world's fastest supercomputer. So it's just going to vault way over. It's, it's the, the speed and power of the top 200 supercomputers. Now, why bring this up? The anticipated use of El Capitan has been for modeling of nuclear weapons and the actual physics of what goes on within a nuclear weapon so that we can simulate and test the safety and reliability of our nuclear stockpile without actually having to fire them off. And we've been doing that for years. It's an extraordinary computational load and challenge, which is why it's driven this great advance for all Capitan. But what I think this will do is possibly offload some of the demand for some of our existing and soon to be rolled out conventional non exascale supercomputers and they can be devoted to medical and biopharmaceutical kinds of explorations. And that's really what's needed. Obviously over the next year there's no certainty that we're going to get a vaccine for the coronavirus.

COVID19 yeah, but one certainty, Louis, is that there will be viruses after this one absolutely coming. And another certainty is we've woken up every citizen in the United States the importance of this kind of work. So I'm with you on this and I think there's going to be a lot more technology focused on medicine, medical outcomes, medical research. The 20s could end up, in fact will end up, I'm sure, being the age of biotech.

Yeah, I think so. And one really interesting aspect of that that you'll appreciate is one thing I notice is that many of the techniques and tools that have been pioneered for a decade or more and are still current for cyber and cyber security and cyber research, many of those actually have a kind of dual use potential for health. So think about the analytics and modeling and simulation in things like cyber ranges, but being used to model and simulate second and third order effects of virus behavior and preventative measures, social scale, population scale, analytics, modeling and simulation for propagation. I find it interesting that we're going to potentially be able to make use of a lot of the things that you and your friends in the cyber field have been able to pioneer and use.

That's interesting. It would be kind of fitting because we stole so many ideas from biology and life and how things work there. Yeah, and another point you raised. So let's talk about quantum computing, because everybody talks about quantum computing use cases and the ones they quickly gravitate towards is, oh, the Chinese will be able to break asymmetric encryption using Shor's algorithm. And therefore it's a security issue when actually I'm most excited about the use cases, about modeling physics at the smallest scale. How do atoms really work and how do they combine to molecules and how can you assemble those molecules better and what's really going on? And so I've always been excited about that use case and now we start to think about the biology and biological sciences. And it makes me want for a quantum breakthrough even more because it will help in developing the medicines and treatments that we need for things like this and who knows what else.

Yeah, very, very, very true. I agree with that entirely. And it also underscores the importance of being able to do two things. Number one, focus, as some of the software companies have been doing, focus on the programmability of a quantum computer, which is difficult to do before we have true quantum computation. But once we do, we're going to need to be able to actually write the software that controls and drives that, that kind of a quantum computer. And that's going to be dramatically different, obviously from, we don't know exactly what it needs to look like, but we know it's not going to be using today's kind of software or operating systems. So there's a lot of great, exciting work on that front. And then secondly, you do have still therefore to be cognizant of if there's a fantastic drive for and push to deploy quantum computers for this particular kind of biogenetic research imperative. The side benefit or the side cost is you're going to get quantum computers that can still do that kind of quantum decryption. So we still need to focus, as NIST has been doing, on, you know, what's pqc, what's post quantum cryptography look like? So that we have quantum resilience. And we can absolutely work on that. Now we've got people in VMware research who are working on quantum resilience right now.

Great. Yeah, it's a critical, critical topic. And another one of our future proof sponsors is Quintessence Labs, which uses quantum effects to generate high entropy keys and then they have a key distribution method and they're building, you know, quantum safe security as well. So we've set up a conversation with them for next week.

That's great.

I wanted to ask you a couple other questions, Louis, before we run out of time. One is about technology. You and I years ago used to work in Support of these, the knowledge workers at the, in the defense intelligence establishment. These people have this hard task of looking at overwhelming amounts of data, a lot of it contradictory. Some of it is lies that the bad guys are telling and they need to sort all this stuff out and figure out what's going on. And over the last decade, it's gotten even harder for them to do their jobs. And analysts everywhere in the intel community are having even harder challenges because of the overwhelming amount of information and because there's fewer and fewer people who are trained to do all of this. And there's not enough, what I mean to say, there's not enough who can do all of this for all of the data. We just can't keep up thinking that thought and then thinking about this massive digital transformation that occurred in a matter of days because of the virus. I wanted to start writing again on this topic of what the analyst needs in a workstation. So one of my next posts, I don't know when to be done, but it's going to be on the intelligence workstation of the future. And my view is to write about the technology that analysts can have in place today day. You know, extremely high resolution screens for the data into the eyes, of course, keyboards for input, but over the last several years, so many other input methods into computers. The, you know, gesture sensing, the voice, the other inputs, and then the tools that can run on these workstations. And so with that, just as a brief thought, do you have any feedback for me on what should go in this article and what, what we should bring people's attention to as they think about what will the analysts of the future want on their desktop? Oh, and include in your thoughts please, how we can deliver that desktop to an analyst to work on classified information in their home or at a coffee shop or in an airplane.

You have to ask the hard questions, don't you, Bob? Yeah, I do have some thoughts. And you're right. These are things that we've been working on together for many, many years. And so I don't think the most important thing to realize is that I think a lot of developers, a lot of business development people, and a lot of corporate leaders and even agency leaders in government. One thing to keep in mind is there's never going to be an end state. There's not going to be the perfect deployment, the perfect system. You don't want that because you'll always be able to improve. So you want to think of this as a continuously iterating improvement cycle anyway. But a couple of things Number one is it goes back to something we were talking about an earlier question and that is how things have changed. If you think about how we are dealing with each other right now, I have, you can't see it. I have a TV screen with CNBC going on and marketing information and news scrolling headlines and stuff. And I'm trying hard not to look at it.

Bob.

But that's an input, right? I've got several windows here. I can see my actual spatial environment because we're all working from home now. I have family members here in the house and every now and then I can hear them or one of the dogs. I've got books, I've got a lot of physical, tactile information around me. I've worked previously on virtual reality systems. I've worked on augmented reality systems. I like the term of art that's come to be used in that industry of mixed reality. Mixed reality where sometimes you're fully immersed in a VR environment and you have no input from the outside, only system input. And that's how you virtualize a completely different environment that you're in. And many, you know, analytic exchanges and analytic experiments or research projects really wouldn't be amenable to a straight up strict VR environment. Augmented reality. You know, I know you were an early adopter of Google Glass and you used to eagerly wear your Google Glass around augmented reality where you're going through your normal day and you have embedded on top of or within the viewable frame of reference that you have an actual screen or running scroll of information or something that's particularly relevant to the thing that you're looking at, a mixed reality environment where you have access to everything in whatever scale and frame of reference you actually want to consume it in at that moment. And you're able to actually go through your day, traveling wherever you are and have access to whatever kind of information you want and access to the kinds of people that you want. So this is what I find to be most missing in most of these kinds of analysts, workstation of the future kinds of planning. So I hope you'll, you'll deal with this aspect in your blog piece in what you're writing. And that is, to my mind, like you, I used to wander the halls of intelligence agencies talking with straight up analysts, political scientists as I had been, who were domain specialists or country area specialists and who spent their time thinking hard about these problems and becoming a world class expert on it. And yet they spent a lot of time talking with each other, their colleagues. Now, if we embed Someone in a digital virtual cocoon with access to feeds of information from outside. But we remove from them the ability to essentially phone a friend to reach out in touch and talk with another human being. Then we're missing an enormous amount of, we're leaving something on the table, I think we have to have within these systems. And it's not always just, you know, a chat window or, you know, having people being able to. There are a lot of Silicon Valley firms where you walk into the developers environment and you walk through the halls and these open plan environments and everybody's on a headset. They are, I don't want to use any product names, but they're, you know, in a, in a long day, long running series of chats with their colleagues and never interacting with the person next to them. I think that would be criminal in an intelligence agency. That's a very good point.

And it also, it brings me back to something you said earlier when we first started. And you're talking about the newspaper and the joy you get from reading that. And I sensed that part of that was because you discovered things that you weren't necessarily looking for every single day.

Serendipitous discovery. One of the, you know, you and I are big fans of the old Bell Labs, the hallmark, the Tiffany, the ideal of 20th century innovation and invention in American science and global science. Bell Labs purposely designed their headquarters to actually encourage serendipitous hallway encounters among the scientists. So they put the cafeteria in one far flung spot and forced people to walk by each other's offices and workspaces so that they would engender hallway conversations. And the notion of being able to have exactly what you said of serendipitous discovery for an intelligence analyst, I think is just absolutely critical. The kinds of, you know, you can design in situational awareness into systems, but you can't easily design in kind of psychosocial situational awareness. And so that's something that I hope you consider and you'll probably be able to.

I will. Thanks, Louis. And one final question I'd appreciate your thoughts on. And that is another enduring one, a conversation that you and I have had for 10 years. But it turns out people have heard.

This law, your failed prediction that Moore's.

Law was going to die. That one exactly on target. No, this is the one about make versus buy. There's a famous Defense Science Board study of 1984 which said the Department of Defense is no longer leading in the creation of software. We need to adopt the methods of the commercial world. And whenever possible buy our software instead of making our software. And sure enough, the government is not making their own word processor. They actually buy a commercial word processor, and the government no longer makes operating systems. They actually buy commercial operating systems or use open source and on and on and on and on. Most of these applications, the commercial applications, the government realizes it's better to buy. And 10 years ago, when we were having this conversation, there were a whole bunch of analytical tools that actually we had to make because nobody else was doing it. Now there's more that are commercially available, and just in almost every aspect of government business, there's now commercially available software. So why is the government still making its own software? Or maybe I should ask that a different way. How do we get the government decision makers to really realize that the policy their bosses have put in place is there for a reason? They should acquire commercial software before trying to create their own, wasting government money and end up not delivering anything. How do we get more adoption of commercial software? I guess is question.

Yeah, I do think it. I think a big part of it is you started with a generous little bio of me. And one of the things I'm an exemplar of is the revolving door, right? I've been in and out of both government and commercial software development organizations for decades, and I think that's highly valuable. I think a big root of the problem you cite is government employees who are career government employees. And so they don't know that dynamic as you described it, and they know only I'm a government technologist. That's what I do. I build technology for the government. And so I'm going to do it. And they haven't really lived through the kind of differential in speed and scale of deployment that the commercial world really offers. And so, you know, it kind of sets up this adversarial relationship, something that you and I have both tried to diminish and lessen among both the government side and the business side, private sector side. So that's a big part of it. I do think it's valuable to have a kind of rule of thumb, particularly for national security and, you know, defense and intelligence realms for that sector. If you're an agency and you can honestly say that the goal of your project, which may require technology, that the goal is to achieve some true significant advantage over adversaries, some hidden advantage, some secret advantage, some novel advantage. We have the first and second and third offset programs in our history eras where the United States dedicated significant resources to building technological advantage and achieving an offset against nation State peer adversaries. If that's actually your goal, then it may actually be necessary to build with commercial contractor. But traditional kinds of performers. Because that world of commercial makers, people who are, as you said, who are spinning out innovation out of Silicon Valley and Austin and Boston and India and China and everywhere else in the world, all competing with each other, a massive world of makers, almost all of those are making their software available to the open market. So it's, you know, aside from price and cost, you're not really regulating access to that kind of advantage. You just want to be an early market mover or first to market. So if you're in defense or intelligence and you want true significant advantage, okay, you may have a case for we need to make this behind the green wall. Otherwise I think it's ridiculous. I think it's a fool's errand to try and you know, make, make a government hammer or a government nail. I just don't find that compelling at all. And I argue against that all the time. Just buy. Just buy. Now. One, one last thing is I think a really positive movement just in the last couple of years really has been the kind of DevSecOps movement and that's becoming much more popular in defense circles, technology circles. Air Force, U.S. air Force has been a real leader in this, but your United States Navy is trying hard to catch up and even the Army, Army Futures Command these approaches on DevSecOps where you've got not just the, you know, like Kessel Run in the Air Force where you've got the tools and the libraries, but this paradigm of continuous ATOs and continuous certification for not just the, not just the tools and libraries, but the platform and the development to deployment paradigm where that itself is accredited. So you've got inherited accreditations. You know, Pivotal has been a real leader in that. The Air Force has loved using them for Kessel Run and so forth. It's just serendipitous again that my company, VMware, we acquired Pivotal last year. And so I've now seen firsthand the value that those teams bring to the government developers who use that paradigm. So there you have perhaps, you know, a really pinnacle of the blend between commercial speed software innovation and development and government ability to make itself. Because just final point, you and I have been and have known government employee technologists and many of them have struggled at not having access to outside tools and outside best of breed development libraries for machine learning and so forth. And now we finally have ways of being able to make those available to people and so, you know, we don't want to leave them behind. And frankly, some of them are smarter and more talented than many of their commercial peers, and so you wouldn't want to foreclose the possibility and opportunity that they're going to achieve advantage within those government labs using commercial tools and libraries.

Louis, thanks for this. I really appreciate your time and your context on all these topics. And my final question is, can I invite you back soon to continue the discussion?

I'd be happy to. Thank you very much, Bob. I enjoyed it.

Thanks Louis.

Thanks for listening to this. Ooda Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.