The Metaverse has cybersecurity, intelligence and national security implications, here they are...

Informing your decisions with intelligence analysis and.

Insight brought to you by the team@ooda loop.com hello.

I'm Bob Gourley, the chief technology officer of OODA LLC. And today on the OODaCast, Randall Fort Randy had spent nine years as the director of Global Security at Goldman. I met Randy when he was enticed to come into government where he led one of the most highly regarded teams of analysts in the world, the Department of State's Bureau of Intelligence and Research. And Randy, you later worked at Raytheon and now at Quirks. Q W E R X and have been very active in the community. You speak frequently and you're engaged in things like the AFC Intel Committee where I work with you. And so thanks, thanks for coming on the oodacast.

My pleasure to be here, Bob. Thank you.

Randy. There's so much I want to talk to you about, but I wanted to start at the beginning and get a bit of your foundational story. How did your career start?

Well, I actually came up in politics. I grew up in Cincinnati, Ohio, and got involved in local politics back there when I was in my late teens and it started college, I took a leave of absence to work in a reelection campaign for the local congressman and ended up working for him for four years, two of his campaigns and a stint in the Washington office as a legislative assistant while I was going to school at gw, getting my bachelor's degree and then upon graduation went back to Ohio, worked in his reelection campaign that was going on that year, and then stayed for another 18 months as his representative title, district representative, sort of serving as his chief point of liaison in the local community. So I kind of cut my teeth in local politics. But I'd always had an interest in history, in particular military history, and that kind of morphed and college to the history of national security. And George Washington had some excellent classes and programs there and was able to get a kind of a very thorough sheep dip into some of that. And that became a focus area. And, you know, I took advantage of an opportunity that George Washington was one of the schools could nominate Henry Lu Scholars, which was a relatively nascent program at that time. But I received one of the fellowships, went to Japan for a year and served as a member on the staff of a member of the Japanese parliament. So I was the first foreigner ever to work in the office of a parliament member in Japan in the Diet. And that was a fascinating experience along with a lot of travel in Asia, came back to the states and early 82, I managed to land A job at the White House doing a junior staff member on the then reconstituted President's Foreign Intelligence Advisory Board, what is now called just the President's Foreign Intelligence Advisory Board. And that led to a nice long run doing intelligence and national security related work. And then I'm a little bit of a hybrid in and out of government. So I did about 12 years in government, then I had about 15 years in the private sector. TRW Goldman, as you mentioned, and in 06 was offered the opportunity to go back to State Department and serve as Condoleezza Rice's Head of Intelligence. And I took that opportunity and served her for three years.

Great, thanks. And Randy, let's talk a little bit more about your time at Goldman. You were Director of Global Security. What was that?

Well, I had two roles at Goldman. I was first hired in 1996 while they were still a private partnership to be the Chief of Staff for the firm's then cfo, a guy by the name of John Thain, who later became President co chief Operating Officer when the FIR went public. So I helped. They were on a growth curve at the time. And I think when I started at the firm it was maybe 8 or 8,500 people or something like that. When I left in 2006, there were 25 or 26,000 people. So they realized they needed to have more staff infrastructure because there's basically zero. I mean this isn't like Washington where there was the assistant to the assistant assistant. I mean there was nobody. So I was helped to sort of pioneer the chief staff concept for Goldman in 1996. I did that for five years after 9 11. The guy that had been the head of Global Security was a former senior FBI official. He decided to retire and long story short, they offered me to the opportunity to serve as the Director of Global Security. So I did that from 2002 until I went back into government. 2006, right.

And at Department of State, as you mentioned, working for Condoleezza Rice as head of the inr. But would love your context on what INR is because although I have a deep respect for that organization, I wouldn't call it actually a household name. What is inr?

Well, INR is one of the three letter trigraphs that they use at the State Department to describe a bureau. Since the bureau names are a lot long. Bureau of European affairs is EUR and the bure of Intelligence and Research is inr. So everybody has a three letter appendage next to their name. It shortens its own little local bureaucratic dialect. So it is a. Was actually one of the remnants of the Office of Special Services OSS from World War II was the analytic group got folded in the State Department and became the in house intelligence research and analysis function. And as the US intelligence community formed in 1947, 46, 47, 48 it became one of the founding members of the intelligence community. So its mission was to do all source analysis for the Secretary and other senior government officials, contributes to the PDB and the President's daily brief and all the other national estimates and all those kinds of things. In addition, there's a coordination role which is not readily understood. But any intelligence activity that takes place anywhere in the world falls usually within the orbit and the ambit of U.S. ambassador. And the Ambassador is the President's representative, extraordinary and plenipotentiary as the words go. But he's the President's direct representative in any particular country. And nothing theoretically is supposed to happen in any country. Nothing unless the ambassador has approved it. So we needed, you think about all the intelligence operations that take place globally. All of those had to be coordinated to make sure they were taking place consistent with U.S. foreign policy goals, objectives, activities, taking into account local conditions, et cetera, et cetera. So INR played that coordinating function and that, that's a, that's an activity that is not generally understood or. But it's very, very important and keeps everything, you know, the surface going smooth, you know, despite whatever may be happening under the waves.

And you mentioned the history of the INR being a descendant from the Office of Strategic Services of World War II fame. And that's pretty neat. I like that connection. And there's my impression of that outfit is it was always small, agile, and you may just have a couple experts on one country, but those couple experts have been doing that for years and have a lot of extensive continuity on, on the people and the culture and the dynamics and the desires of the leaders of that nation making it high powered group.

You're absolutely right, Bob. I can think of a couple of instances. I remember we had an office of Political Military Analysis and I had one guy in that shop that was responsible for military analysis of the entire Middle east. And he told me he went to a meeting, an interagency thing. He was sitting next to the guy to a guy from CIA who was their Libyan SAM6 radar expert. So CIA could actually slice the salami so thin that they would have a single person whose sole job in life was to look at Libyan SAM6 radars. That's it. That's all he did, my guy covered everything from Morocco to Pakistan, 100% of everything. Whether it was SAM6 radars or order of battle or whatever it was, that was kind of the difference. We were thin, but we were deep. Another story, I remember when Germany was falling apart in 89 and there were a lot of meetings going on. The director, our German expert, was a guy named Bo Miller. He had been doing Germany for, I don't know, 25 years at that point, something like that, spoke the language fluently, had traveled there, new generations of leaders, and, you know, he was going to the center Agency thing and they're like, you know, 25 guys from CIA there. We said, yep, Bo's got him surrounded, you know, because he was, he was like literally the only guy in the room who spoke fluent German, who had seen generations who knew, you know, could actually read the German newspapers. And that was just a difference. We would have experts that would, that, you know, if you were the China guy or one of the one on the China team, you were expected to be flowing in Chinese, at least, you know, one of the least Mandarin, and have traveled there and have extensive contacts and other agencies would, you know, after 24, 36 months in a role, well, we're going to rotate you out and we're going to send you to do something else. And so the ability to go deep and develop that lifelong experience and deep feel for the cultures and the history and the politics was sometimes a challenge for other agencies, but it was part of the bread and butter for I.

And R. It seems like there's some lessons here for any organization, including commercial organizations that want to have an intelligence activity. You're going to need your own people. But will you need those kind of people who are the super deep experts? Or you may want to outsource that to someone else or you may decide, depending on your business that you have to have that deep internal expertise and if so, you need to resource for it because you'll need.

Yeah, I think you're right. I think that's. There's no one size fits all right. It really. If you have a core business and critical, no kidding, interests in a particular part of the world, then maybe you want to have that kind of expertise in house, but you certainly want to have access to it if you decide to outsource it, to know that you've got a group or a company, a function that you can turn to, or your own stable of academic experts or something like that that you can source for key markets. When I was at Goldman, we Used to do that, sign up consultants in different areas, find the expert guy on Country X or Capability Y or Technology Z, whatever that might be, and sign them to, you know, a contract with all the NDAs and everything. So the fact that we were, you know, asking questions about Country X or, you know, Technology Y would not, you know, royal the markets. And, you know, I think everybody has to decide, you know, for themselves, every enterprise, what, what are those capabilities, and then make those resource allocation decisions.

Randy, I also want to ask your views on the cyber threat because you, like me, have watched this grow. Somewhere between your time at Goldman to your time at inr, cyber became a serious threat to the large financial institutions, the governments. Now it is like the dominant way of conflict, it seems. And would love your view on the nature of the cyber threat right now.

Well, I got my first. I mean, I was aware of cyber from, you know, having read the Gibson novels back in the 90s and Cuckoo's, Cuckoo's Egg and all that Cuckoo's Nest, all that stuff. And when I was at Goldman, I remember this is before I became Director of Global Security, I was in a meeting where the CISO was reporting that just kind of matter of fact that the firm was being subjected to like 10 million intrusion attempts against our network a day. And I kind of fell out of my chair. I thought, wow, that's a very big number. And when I became Director of Global Security, I developed a very close working relationships with the guy, Phil Venables, who was then the CISO at Goldman, because we realized that we could not have silos, were ignorant of what each other were doing, because the way information moved between virtual to physical and maybe back again, we had to have a comprehensive and strategic approach to security. And so I got very involved in the fsi, the financial sector, government sponsored ISAC back in those days, trying to bring the physical dimension to the virtual and to create a more cooperative kind of environment. When I got to INR in 2006, I started getting briefed up and I had one very memorable visit to another government agency and got briefed on what was going on around the world and digitally in cyber. And I was astonished. I was, as the British would say, I was gobsmacked. You know, almost fell out of my chair on a couple of the points of information I was being briefed on. And I realized that there was this extraordinary level of activity. This was orders of magnitude, just huge exponential orders of magnitude change from when I'd last been in government in 1993. And I went back to the building, to State Department. And I started asking around, well, who has cognizance for the policy responsibility to understand the implications and help provide guidance for what was going on by other government agencies to make sure that those activities were consistent with overall US foreign policy goals. The answer was a lot of crickets chirping. There was literally nobody that was involved. After spending several months asking, nagging, cajoling, including conversations with secretary and the deputy secretary pointing out the, you know, the seriousness of this issue and that it was growing, they finally decided to put me in charge. And I kind of, I tried to demure because I said, look, I mean intelligence guy, I'm not supposed to have policy responsibilities. And I'm like, yeah, yeah. So it was a kind of a case of, you know, the old. One of my favorite sayings, in the land of the blind, the one eyed man is king. So I became the one eyed man at the State Department on cyber policy and established the first cyber policy position, an activity and tried to get resources aligned and identified and who had what authorities and what people were working on cyber and what were the issues and what would a coordination process look like. And you know, just, we dove into that. So in effect was dual headed. Chris Painter succeeded me in the, in the Obama administration got the formal designation. I actually did a review and recommended after a couple of months for, you know, how cyber should be organized as an apartment. My first recommend was create a cyber bureau because that's the fundamental organizational building block. The if they didn't want to do that, then I said you should create a special ambassador for cyber and S Cyber, as it was called. And third was if you don't want to do any of that, then at least have a Cyber Policy Council committee and appoint somebody to chair it. Well, they didn't want to create new bureaucracy at the time and so nothing happened. He said, well, you just set up that Cyber Policy Council and you be the chair. So that's what we did and it was better than nothing. But here we are now that was in 2006, here we are now in 2021 and they're just kind of getting around to thinking maybe we need to have a cyber bureau. So the wheels at the State Department grind slowly, but they do grind and eventually they'll get around to creating some form of an infrastructure that will enable them to be a little more facile and capable to deal with these cyber issues.

Now this may be a hard question because I know you're not there right now, but I wonder how those Analysts at INR had to shift their mental models to compreh in cyber because again, if a lot of these guys have been there for decades, it hasn't been their job to be computer scientists or learn the technology or understand how this stuff really works. But now cyber is such an important part of international conflict in relations and opportunity. And I'm just wondering, do you take guys like that and train them in cyber or do you try to bring some cyber blood into the mix?

Well, we basically had to create an entirely new unit and there were a couple of people that were able to sort of repot, particularly on the, on the coordination side. But we basically had to go bring some, you know, go out and find some new, some new folks that were younger and a little more fluent with the technology and the capabilities and who were not, whose thinking had not been calcified by, you know, however many years of, you know, thinking about things in the way they were. So we did establish a new, a new cyber office within the bureau. And you know, not large, like nothing in INR was large, maybe a half a dozen people or something like that. But, and they were mostly. There were, there were a couple of people that, that were brought in. There was a woman, Michelle Markoff, who had previously done critical infrastructure in a different bureau. And then when they decided to get out of that business, I brought Michelle in to handle some of the cyber policy related issues. So she was a veteran, but there were a lot of, a lot of other young, young folks that just, you know, were, were eager and ready to go and weren't hidebound by, you know, all the way. Well, this is the way we've always done things, which is, you know, that always kills me when, you know, people are using that, especially at an institution of bureaucracy that culturally is antagonistic towards technology as the State Department is. I mean, they've always been that way, decades, centuries. They've, they've been resistant. I actually was there in 1990 when the then executive secretary who sort of, you know, runs the, runs the building, sent out an email or sent out, not an email, sent out a memorandum, hard copy memorandum, ordaining that the State Department would not use email In 2000, in 1990, we would not use. And why? Because it would disrupt our cable system and all of the matrix of all the boxes and all the little, the legacy system that they had. They, you know, and, and I remember reading that hard copy and just being stunned because, you know, email 1990 wasn't a huge thing, but I've been using it for Years. And I just couldn't. I mean, it's like, you got to be kidding me. Well, of course that, you know, that didn't last. That was King Knuth putting his scepter in the stand and telling the tide not to come in. But that was the. That was the. You know, the first. The first reaction to anything is when it comes to technology and that culture in that building is no, you know, their first reaction to anything is hire more foreign service officers. And not like, well, could we take the entire consular bureau and get rid of half of them with a handful of apps? Because you think about it, you want a visa to the United States, download the app. We're going to read your phone. We're going to do a deep electronic probe and make a decision about whether you're suitable to get a visa to come to the United States. That could all be done by apps in seconds, fractions of seconds at zero marginal cost. And you'd have all those visa people out there stamping visas and stuff that, well, find something else for them to do. They don't need to do that anymore. But that mentality just, you know, it doesn't exist. So they were always very slow to change ecologically.

It's interesting, now that you mention it, I'm so glad I have my passport, because when it's time to renew, you're thrown into this uncertain world of when will I get it back? Or, you know, I want to travel in three months, so I need to apply now in the hopes, and I got to do a rush on it to get it in three months.

Right? Well, I mean, you can pay. You can pay double or triple. And then, you know, if it's like suddenly you're, You're. You're, you know, got a relative overseas that's sick or died, and you got to do something. They have some workarounds that they've created. But, you know, you're right. All those procedures are, you know, firmly mired in the 20th century. The mentality and the outlook is firmly 20th century. When I was there, the then undersecretary for management, we were at a senior staff thing. It was a staff retreat out at the early house. And he was moaning about all the mandated annual reports that the department had to make, and it was costing, like $50 million a year to get these reports produced and printed and bound and shipped and blah, blah, blah. And I was like. I raised my hand, I said, well, let's not do that anymore. You know, silence in the room. Could I hear a pin drop? Everybody looks. What are you talking about? This 2007. Let's just turn them all into wikis. Just turn everything into a wiki. Why would you produce written anything if there's a report on juvenile delinquent activity in Bangladesh? Fine, just make it a wiki. And put whoever was going to have to write that report in charge of that wiki and let them keep updated. It won't be 18 months obsolete by the time the, the written things. It'll be up to date every single minute and it'll save your 50. I've just saved you a quarter of a billion dollars over the next five years because it'll cost nothing. Well, what was the first reaction? We can't. We've never done that before. Well, you know, I always do the regression analysis on that and to save time, I say, okay, let's do the regression analysis. And now we're sitting in a cave and you're trying to argue with me. Tell me why I shouldn't rub two sticks together. Because we've never had Fireball. So where do you want to go in the history of technology between the cave and now about why we shouldn't try something and then, you know, well, Congress and every step, of course Congress will accept that. They'll have up to the minute information right at their fingertips. You want to wait for, you know, get something that'll be obsolete, but no, they wouldn't do it. It just, it heads explode. We've never done that before. We can't, we can't comprehend that. So it is what it is.

You know, you also remind me, there's an old saying, Maslow said, he who's good with the hammer thinks everything is a nail. I see that a bit. In fact, there was just an editorial published by a ambassador, smart, great diplomat, well written, well thought, who says essentially all of our cyber woes can be solved through an arms control treaty.

Well, no, I saw the same op ed and Joe is a wonderful guy. And I actually wrote a rejoinder in an email to some other folks and said, sorry. The foundation of any arms control agreement when we were controlling physical objects like missiles and radars and that kind of thing was verification and compliance. And verification in cyber is absolutely impossible because one single smart kid with a laptop and an Internet connection can become a weapon, a cyber weapon, and that cannot be controlled. And you times, you know, eight times Albania to Zimbabwe, the nation states, every single nation state has that capability. There is zero way to verify, therefore compliance is zero. Therefore any agreement that you reach is absolutely worthless. Because there is no way whatsoever to verify and therefore enforce the terms of the treaty. We are, because of our leaks and our breastfeeding and woe is us and we're terrible and blah, blah. The usual American, let's go put on sackcloth and flail ourselves and the, and the media sniffing around with, you know, and the leak mentality. Any, any violations that we have would be out in the New York Times, the Washington Post or whatever, instantly or near instantly. China, Russia, not so much. You know, don't have to quite worry about that. So not to mention the North Koreans, Iranians, and, you know, everybody else that's out there pulling that stuff.

So another thing, if I think about all these other domains, like, if I wanted to have some international regime to cover chemical weapons, nerve gas is a horrible, horrible thing, I think I'd bring in some experts on nerve gas and how it works. Or if I wanted a regime that's a nuclear test control treaty, I'd bring in some experts on how nuclear tests are done and how they're detected or et cetera, et cetera. Whatever the regime, I'd bring in some experts. So it seems like if we're going to talk about cybersecurity, the people who talk about that should at least bother to learn what it is and how it works.

Yes, and, you know, the other thing is, and we have to be careful talking about this, Bob, but the fact of the matter is, you know, there's the old saying, people live in glass houses shouldn't throw rocks, right. So if you read there was in the last month or so, I don't know if it was the double I double S or Jane's or somebody came up with their list of cyber powers. And the US Is far and away number one. So we have a lot of cyber capability. A lot, A lot. And so how much limitation do we want to put on ourselves? How much hamstringing do we want to put on those capabilities and the strength and the security that those capabilities give us? And I think a lot of the people that are talking about the arms control aspect, a lot of those people are former arms controller. It's what these. Go back to your hammer and nail thing. Well, we did. You know, I spent my career on ICBMs and MRBMs and the Glictums and the P2s, and we can, we can whip this thing. No, you can't. Sorry. It's a completely different thing. It's, it's air and water. It's. It's oil and water. It's, they're, they're not at all, you know, interchangeable. They're completely. Nope, sorry. Oh, and by the way, you mentioned Chembio. And we found out in the 1990s when the Soviet Union collapsed, how utterly feckless the CB CBW treaty was and all the stuff the soaps had put together and it amassed and the tons of bioweapons, and they had an SS17 that they were going to put some biological agent on so that after the rubble had bounced, they'd lay down biologicals to kill anybody that crawled out of the rubble. I mean, we had no idea what they were doing. All in total violation of the 72 biotreat. So even with the best attempts of the US intelligence community at a zenith, we utterly missed the Soviet cheating on cbw, cbrn. And so that's always a challenge, and I think it's a great sentiment. It'd be nice to sing Kumbaya and have everybody come together at the UN and, gee, let's come up with some norms and so on and so forth, that's probably worth discussing. At least leave hospitals alone. You know, we can all kind of agree that that's not, you know, something that anybody would want their hospitals messed with or, you know, child pornography is a bad thing. Just about any culture, any country, nobody stands up and says, well, no, we're, we're, you know, we love that. No, nobody does. So we all should, you know, there, there should be a couple of very baseline things that we would all come together and agree, well, those are things that we simply won't, we will not allow. But pretty much everything else is fair game, and that's just the way it is.

Yeah, right. So let me ask you this then, because I agree with you on so many of these topics. How would you, what actions would you take to really mitigate the risk of cyber attacks? And maybe there's two parts to that question. One, in the federal government, what would you do to really reduce the exposure to risk and the vulnerabilities for the federal government? And then, of course, we ought to talk about infrastructure, too.

Well, I think there are the basic things like can you talk about the cyber hygiene and based on the current infrastructure and the current way of thinking about the Internet and digital information and so forth, those will take you to a certain level that is at least kind of de minimis. But at the end of the day, if something is in ones, in the form of ones and zeros, that is digital, and if there's a human being within 1,000 miles of those ones and zeros, then it's vulnerable. It can be accessed in an unauthorized way by an unauthorized party. And so I think what's going to need to be there's the old definition. It's not Einstein who said it, but it actually came out of apparently an Alcoholics Anonymous meeting in the early 1980s. Doing the same thing over and over again and expecting a different result is definition of insanity. So we keep doing the same things over and over again with cyber only, you know, do it louder, do it harder, do it more and expect that we're going to get security and we won't. So I think at the end of the day, what's going to have to happen is we are going to have to reimagine the entire approach to cybersecurity and start thinking about what we think are fundamental, fundamental building blocks and fundamental pillars are, are not, are not sustainable when you know, they might have been sustainable in the 70s or the 80s when a lot of this stuff was being generated and thought of for the first time, but nobody was thinking that there were going to be trillions of, you know, interconnected objects on a global network that looks like a, if you ever see some of the illustrations of it, it looks like a living, breathing organism from, you know, what was in the 1969 or the Internet was, you know, Caltech and you know, two lines in California and another line and that's it, that was the Internet. And then, you know, what it's become today. And you know, I think we need to spend, you know, go back, draw back a little bit, take a, take out some clean sheets of paper and start thinking about what can we do that we will not be, you know, continually beholden to this legacy architecture, legacy infrastructure, legacy way of thinking about things. And there has got to be an open minded approach to thinking about how we can retool a lot of this.

Yeah, I like that, Randy, I do. Because everything I see that's positive, that's currently going on. Yes, let's continue that. But that's going to get us some incremental benefits. We also need this team that says, all right, clean sheet of paper, what would you do? Here's a goal. And the goal may be a two order of magnitude reduction in the number of incidents or some other measure like that. And what do you do? Unless.

Right. Well, you know what the single biggest vulnerability in cyber are? The people. I mean, so why, when we're dealing with digital and electronic and all of this virtual, why do we have people in the loop whatsoever. Why shouldn't we be thinking about how to archive, protect a system that removes people from any of the decision making and make it as. As, as is automated. And you know, fine, it's got to be auditable and you know, there's got to be checks and safeties, but anytime you. So many of these hacks that we've seen have come about it as a result because, you know, the underlying certificates were compromised, somebody was, was phished. Somebody, you know, somebody's identity was stolen and then an attacker was able to use that to move laterally inside of a system and exploit it. And there's the irreducible minimum. I mean, you could done all these tests on this. I remember when I was at State Department, they went around and did the cybersecurity briefings at different embassies and just literally beat people over the head about. Do not put thumb drives of unknown provenance into the network. Do not do this. Do you understand? Yeah, I understand. Here, sign in blood. You understand? Okay. Okay. And then they'd go away in two weeks. Somebody would come out, throw around a few thumb drives in the parking lot, in the fitness center, at the cafe or whatever and sure enough, somebody would pick one up, stick it in. The thing happened every time.

Yeah. Usually because they had a job to.

Do and it helped or just, it's just curiosity. I mean, you could have the link that, you know, if you click on this link, you will destroy the planet Earth. Oh, let's see what happens when I get. I mean, people will do it, right? There's the irreducible, you know, idiot factor. There's always going to be 1% or some 1 or 2% or even a fraction of one particular. There's always going to be one. One person, one guy, one gal that is going to be like. And that's all you need if you're the attacker. You just need one. So, you know, the. As it's constructed today, the defense has to be 100% perfect all the time and the offense just needs one. And that's not a sustainable. That's not a sustainable model.

Yeah, yeah. Well, you have me thinking about a lot of actions we should be taking to reduce risk and improve things. And you mentioned people. And I have to agree, people are extremely important. Let me try this thesis out on you. Of all the people, there's one that is most important in any organization and that's the leader. In fact, if you find an organization like OPM and the head of OPM just doesn't care there's no hope. Now, if the head of OPM does care, there's a lot of hard work to do, but at least there's hope. And then same in industry. If you have the CEO of Colonial Pipeline and he just doesn't care, there's no hope. If he does care, there's still a lot of hard work, but there's hope. So of all the people that matter, I think that the head of the organization is the one that really, really matters.

Bob, I completely agree with you. And just to the, you know, apparently Colonial Pipeline did not even have the ciso. I just heard that. I heard that anecdotally, I don't know for. I've not checked that out myself directly, but I heard that and was astonished that that would even be asserted that opm, I know for a fact the person was ahead of it, was, was offensively, offensively ignorant. I mean, like, not even ignorant of her ignorance, but was like, told about the problem. My former employer actually went in and tried to give for free cybersecurity technology, and it was rejected because they didn't think they needed it. They were offensively stupid and offensively ignorant. So, you know, that's, you can't, you know, we, you know, that's going to require a culture change. And maybe as the next generation of people that have, that are not digital immigrants, but are digital natives and have, have had digital and cyber in their, in their mother's milk, will understand the importance of it and will. But I, you know, I think that also falls to, you know, boards of director and shareholders and superior officers and so forth. Oh, you screwed that up yet. You're really good, you know, you're really good director of whatever, you're really good secretary of whatever, you're really good EVP for whatever. But you didn't. You screwed up the cyber. You're out. Goodbye. And, you know, if that happens enough across the board where people then sort of, you know, all the marmots out there kind of, you know, peep up out of their hole and go, whoa, whoa, whoa, you know, what's going on? They'll, you know, suddenly get an idea that maybe they better take that seriously. So, you know, one of my former bosses used to say, people's behavior correlates precisely to their incentives. So what is the incentive structure or alternatively the disincentives that you put in place so that cyber becomes a priority? And at this point, I think the fact is, and some of it is, if you're the CEO and your ciso, your CIO comes in and says, we got to do this, this and this. And it's like, well, will I be secure when we do? Well, so what's the worst that happens if we. And they're doing cost because they've got a lot of, they've got a lot of different equities and a lot of different things. They have to weigh and balance. And you know, you could literally spend every, every penny of a Fortune 500 companies profit 100% on cybersecurity, and guess what? You're still not secure. So if you're a CEO, you're going, well, if I'm going to spend 100% of our profit and I still don't have the desired result, then why would I do that? And the answer is, of course you won't. And so that's where I think we have to get back to what I said earlier. We have to start rethinking this and coming up with some different approaches that will actually yield a real security outcome for the resources that are being expended.

Right. Hey, Randy, I also want to spend some time getting your thoughts on technology because we've talked about some of this stuff before and I just really appreciate the way you look at technology overall. Maybe it's an unfair question to ask, but I would love your view on the future of technology, what's coming tomorrow, because you look at all the exciting stuff we have today across multiple fronts, from cloud computing to mobility, artificial intelligence, the Internet of things, and just so many benefits. And then other domains too, like the biological sciences, quantum computing, and quantum security. All of these are interesting separately, but as they all converge, it's just mind boggling the kind of future that's being built for us. And so first I want to ask, where do you think all this is taking us?

Well, Bob, I think you just, you sort of, you sort of just took some of the sound bites that I've been using for the last dozen years or so when I've given talks. I try to like, level set people's understanding because we are and have been in the midst of a technology level five, maybe even level six hurricane, you know, for the last, well, 40 years, but in particular, say less the last 20 years, at least this into this century. And you know, in a real hurricane, you know, if you're level five, the winds are going at, you know, 200 miles an hour. If you're, you put your arm out in that wind, it'll rip it off and, you know, send it through a wall. But if you're in the eye of a hurricane, it's calm and you look up and it's, oh, blue sky. And it's the waters aren't roiling and it's okay, we're in the eye. And so we've been in the eye of this virtual technology hurricane. And on any given day, it's like you look up and, well, there's no big deal. It's calm and you know, so when I do these, when I, when I do various lectures and things, I always try to lowest I said, we're going to do a math exercise. We're going to count to 30, 31 arithmetically. Okay? So 1, 2, 3, 4, 5, 6, 7, 8, 9, you know, 28, 29, 30, 31. Fine. Okay, 1 to 31. Now we're going to count 1 to 31 exponentially. 1, 2, 4, 8, 16, 32, 64, 120, et cetera, et cetera. Where do you get. When you're at 31, you're over a billion. And so it's the doubling of Moore's Law that we've become, I think, one of the most profound and important laws in the history of the universe. This technology, which is dynamic and if you believe Ray Kurzweil, it's accelerating. So, so the doubling of this capability that's been happening originally was focused on computer chips. But it's everything, it's all the things you talked about. And a lot of these things are on kind of what they call the hockey stick curve, where the development is. You remember back in the 80s, well, it was like a 16 bit computer. Okay, that's our 32 bit. Okay, well that's nice. 64, the old 64. Commodore 64 computer. Woo. 64. And then, whoa, I got the 128 and then the three, whatever and on it. And now, you know, we're at Terra. We're, you know, at Terra and Giga and PETA and billions and trillions and quadrillions and the data sets have gone. I mean, all the history, all the information in the history of the world up until about 2006 or 2007, I think maybe 2008, all of human history was like 0.8 zettabytes of data. Well, as of 2020, there are like 33 or 34 zettabytes of data. So, you know, that curve goes vertical at a certain point. And I think our ability to absorb that and to understand the implications and it's any one of those technologies is astonishing. I mean, you think about the smartphone that didn't exist in 2006, came along in 2007, and now it's ubiquitous and we kind of take it for granted, but we have the power in the, you know, in a little palm sized thing like that, we have the power of nation states in our hands. We have, this is the entire US intelligence community circa 19, you know, 85 in the Palm of my hand for a couple hundred bucks. You know, I mean, you want to call it digital imagery anywhere on the world, you want signals intelligence, you want human, you want analysis, you want. And not only that, but I have. This also gives me a global megaphone. I can literally talk to the world through Twitter, Instagram or anything else. I don't need to own a newspaper, a TV station, a radio station, and the millions and billions of dollars of infrastructure. I just download an app and what I say, and this is one of the problems with this, to get attention, I have to be outrageous. Because if I'm boring and bland, nobody pays attention. But if I say something really outrageous or extreme, well, oh my God, what did he just say? And then, oh, let's share retweet and blah, blah, blah. And so we're in the midst of these technology developments and as you said, any one of them is extraordinary. But when we take all of those technologies and when artificial intelligence meets 3D printing meets Internet of Things meets whatever, and creates some entirely new combination that we never imagined, it's hard enough to kind of just parse any one of those technologies and try to understand what the implications and what the impact of those are going to be. It's when they mix and match and combine. You mentioned biotechnology. You know, when you start thinking about nanobots and the enhancements that are coming, there'll be a lot of good there. I mean, give me, if I've got a tumor, send in the nanobots and chomp, chomp, chomp, and it all goes away and flushed out and I'm healthy as a horse and, and no surgery and no chemo and blah, blah, blah. That would all be great. But you know, what about somebody taking nanobots and injecting them into a network and then freezing up, you know, air defense over, you know, North America or something. So, you know, there's, there's the technology is, I like, is, is neutral. You know, it's morally neutral. You can, you can, but, but that's always been the case, right? The scalpel can go in and sever out a malignant tumor. It can also, you know, you can jam that in somebody's heart and Kill them. It's the intent behind the use of the technology that is the issue. But the capabilities are growing and super empowering. What used to only be the capability of nation states to now, even weak and otherwise, you know, ridiculous countries like North Korea are, you know, playing the big leagues when it comes to cyber. And some of these technologies, they don't, you know, you know, you don't need, well, they have nuclear weapons, but you can now have disproportionate capability, strength, leverage without a huge investment. And that's unprecedented too. So we don't, you know, trying to assimilate all of this into some sort of coherence is socially, politically, militarily. This is all a very big challenge. Yeah.

And I think part of the, one of the ways to address this channel challenge is through informed imagination. It's, I think very important to try to understand where everything is today and then use our imagination in focused scenario based ways to come up with what this may mean in the near future. Another way is, and you already mentioned this, well, Churchill had a favorite saying, something like the further back in history you look, the further out into the future you can go. And you mentioned a couple old books you used to read, the science fiction Neuromancer. The idea in Neuromancer of cyberspace, which he called a consensual hallucination shared by billions or Snow Crash came out just a few years earlier, maybe it's 94 or 95. Talked about this thing called the Metaverse, which was beyond this world and it was a virtual world occupied by humans, but also bots and AI and this.

Kind of Mark Zuckerberg. And Mark Zuckerberg just spent like half of his earnings call or whatever the other day was just reported and I was reading an article on CNN business and the Metaverse was mentioned like two dozen times in the space of an hour. That's an entirely new realm that Facebook apparently wants to get in and dominate because their view is in the future we'll all be in the Metaverse will be blobs sitting in our Barca loungers, our chairs or whatever, couches and jacking in. As Gibson used to talk about, jacking into the Metaverse because it'll be so much, it'll be so much better than boring real life and you can do anything.

And that as we were talking about, is really built upon a convergence of many technologies. There's the display technologies, mobile technologies, the communications to get to the Metaverse, all the applications. It's all this stuff is being focused on this Metaverse. And it's going to.

And, you know, that raises, I think, raises a major geopolitical problem and challenge who's going to control. And it's very, very basic who will control reality? We always just think about controlling the high ground. You know, in the physical world, if you're on the high ground, you have the advantage over an attacker and who will control reality. And what we've seen now with all of the. The disinformation that the Russians and the spamming and the attempt to sow confusion and dissent and so forth in the west that I keep calling themselves, I mean, Russians to meet, still interchangeable. A bunch of KGB thugs are still running that country. And what the Chinese are doing, but, you know, the Iranians and a lot of others, you know, we're. We're vulnerable to that. And people. It goes back to early on. Well, I read it on the Internet, it must be true. And people, I don't know, there's this willingness to accept what people get off these websites, no matter how preposterous or specious or whatever, with very little critical thought. And then we get into the whole education system and is critical thought even allowed to be taught anymore? No, we're not going to teach critical thinking. We're going to teach you what to think, and you can be a little PC zombie and be woke and that's sufficient without asking hard questions and thinking hard thoughts. So, you know, again, that we can. And I don't know how to. I don't know how to hold back the tide on this, Bob.

I don't either. But let me ask it this way, because both of us have time in the intelligence community, and I could hypothesize or theorize that the intelligence community never adapted fast enough to the Internet revolution. They're still trying to figure out the Internet revolution. Now we're layering on top of that, this metaverse. How long will it take the intelligence community to adopt and adapt to what they need to be in this world of the metaverse? Do you have any views on that?

You know, I've been a part of the intelligence community one way or the other for, you know, most of, you know, the past 40 going on, I don't know, 45 years, something like that. And I haven't quite given up because the one thing I know is from my experiences, there's always another door beyond which something is going on which would really stun and amaze you if you actually knew what it was. So setting that aside that there's somewhere there's a, there's a little group, small group that actually gets in, is working on something that will really be significant. But the mass is. The intelligence community is a 20th century construct. It still is. I think the kindest thing that could happen to the intelligence community would be for the President or the DNI or whatever to say, you know what, you've got somewhere between a 25 and a 50% budget reduction and you've got 18 months to put that into place. And as a result, they would instantly be forced to go out and start using commercial tools and apps and things that they have denigrated or ignored. And the security clearance process is a perfect example of that. You know, you fill out an umpteen page long form, it goes to somebody, they take it out, they make phone calls, they knock on doors, you know, blah, blah, blah, versus reading my phone. You could. What you could do in a second. There's actually companies out there lending companies that have come up with algorithms. There's one called, I think Tala read about it a few years ago. They look at 10,000 data points on an individual's phone and you agree. I mean, you know, you download. Yep. Yes. I hereby consent and permit this electronic, you know, search and analysis to take place. Disclosure and consent. We are going to digitally probe you. And you are okay with that, right? Yes, I am, because I want, I want to get my loan. So they probe 10,000 data points and in less than a second you get a decision about whether or not you're worthy of having a loan. Well, I submit that that's not too far removed from whether or not you're considered suitable to hold security clearance. Maybe there's a different set of data. The intelligence community is even, you know, curious about this. I've been saying for like a decade, where is the R and D to focus on the digital fingerprints and the digital profile of individuals and how that should be thought about as suitable for holding security clearance. Crickets. Nothing. So I, you know, there's the intelligent, and that's just one little aspect, but that's also, it's a black hole. Billions of dollars have been wasted on a system that doesn't give you, you know, a useful outcome. There are billions of dollars of foregone the opportunity cost to people sitting on the bench who haven't gotten their clearances because they're waiting for this specious and utterly obsolete medieval process to take place. And there's just, well, that's the way we've always done it. You know, that's, you Know, we've slaughtered the goats and we look at the entrails and, you know, why would we want to change that? And so I think unless forced by something as draconian as a major resource reallocation, then, you know. Well, you know, because the answer in the intelligence community is the government in general. The answer, any problem is we need more money and more people. And it's never. Maybe we need to introduce some technology that would actually take costs out of, which is what any company would do. We need to introduce some technology that will remove costs, speed up efficiency, give a greater roi, a better outcome for our customers, et cetera, et cetera. No, it's. What's the question? I don't know what. I don't care what the question is. The answer is more people and more money. So, I mean, recently there's been this thing about we need a Bureau of Cyber Census information, cyber data, really. We need another office. How many hundreds of thousands of people work at DHS right now? They can't take 25 people out of the couple hundred, 300,000 people at DHS and say, you, 25 are now going to be responsible for compiling cyber information data. I mean, why does that require more bureaucracy? And, well, we're going to need to go out and hire more people. We'll need a new budget line for that. And. No, no, just go find some people that know how to crunch numbers and, you know, if they can't do it, I'll write it up on an envelope. Here's what you need to be looking for. This isn't hard, but the first reaction is, you know, more bureaucracy. Big surprise in the land of government here inside the Beltway, the answer is always more bureaucracy.

Yeah. Which means if I. And everything you're describing, by the way, makes a lot of sense, but that makes sense for what we currently have and is not even positioning us for going forward.

Absolutely, absolutely. And so the incentives to be open to the changes and the new way of thinking and so forth, I mean, again, there are pockets. I mean, we saw the Air Force a year or so ago now state we're able to actually create a fighter plane in one year. Why? Because they utterly devoured. That was an entirely black SAP program that they utterly divorced from the regular bureaucracy. And they went off and they did this great thing and it would have been absolutely killed and throttled in the cradle had the regular procurement bureaucracy ever heard about it, you know, So I think the intelligence community as it stands, is almost unfixable. You know, it's Just, it's too much built into the legacy architecture, the legacy personnel system, the legacy mentality and cultures. Cooperation is always forced. The ints have their sigint human imagery, they have their silos. They're relatively impervious. There's some lip service at least to joint and cooperative and blah, blah, blah. But it's always the exception and not the rule. I just think if we were creating an intelligence community today, if you and I were to sit down with that proverbial blank sheet of paper, what we would come up with to deal with the data sets that I was, you know, talking about, the zettabytes of data that's, you know, septillion bits. So we got 33, and it's growing exponentially. It's not going to. Well, that's all the more data we're ever going to have. Just 33. Nope. There was 33 zettabytes last year. And it's going to double and then double and then double. And there will be Yottabytes and Geo Bytes and Bronhobytes and, you know, that's 10 to the 24th, 10 to the 27th, 10 to the 30th bits of data are going to be out there. And how do you, you know, if you're the intelligence community standing in front of that exponential fire hose, how do you begin to, you know, to assimilate that? And the current system will not allow that. So that's why I think it just needs to be fundamentally reimagined. And if I were king, I would actually, you know, I would go, I would take, like, create a whole new thing. I wouldn't even put it inside the beltway, put in like Austin, Texas, or, you know, somewhere Chicago or St. Louis or somewhere.

But the metaverse.

Yeah, think about that. But at least initially cited somewhere else and hire about 500 people and say, you know, you're the, you're the intelligence community. All of it, sigint, imagery, spies, whatever, you're it go figure out, come back in a month and tell me what that, how that should be structured.

I have a feeling the way that Clayton Christensen would tell us to disrupt ourselves. And because that's in corporate America, you either get disrupted or you disrupt yourself.

So, yeah, how's that? Borders Books working for you? You've been to Blockbusters lately, Bob, and, oh, I got a Kodak film thing. No, I don't. Kodak. Bye Bye. So, you know.

Other companies though, like Cisco, understand that, and they keep disrupting themselves.

Right.

You know, we want to get into video conferencing. Can't do it. Let's buy WebEx and disrupt ourselves.

As late as 2009, BlackBerry had over 50% of the, you know, handheld device market in the world. Why change 2009? And then, you know, why would. Well, this is, you know, the smartphone is just, you know, it's not as good a keyboard and blah, blah, blah. But I'm sorry, anybody using the BlackBerry these days, I haven't seen one in years and they owned it. I mean, I had one of the first blackberries. I was at Goldman. We were an early investor in REM. I had one of the first couple of thousand BlackBerries that existed because the senior, the exec office at Goldman had these things. I was an object of curiosity in like 1998, just standing around poking in my BlackBerry and then now it's ubiquitous. Not blackberries, obviously, but. No, there is. But, you know, it goes back to what I'm saying earlier, Bob. Right now, the intelligence community, well, anywhere in government, but we're talking about the ic. There are no incentives to change. In fact, the incentives are all the reverse. The incentives are to be risk averse. Don't rock the boat, don't roil the water, don't take a risk it may fail. That'll be a blot on your record. You're doomed and don't do it. So if we were to change the. I say, you know, if we were to take like find a, you know, a first lieutenant or a captain and look for somebody that does something and then look over. Captain. You're now a colonel. You just went from captain to colonel. You're now an oh6 or your GS9 or something. You're now a GS15, Bob, because you just accomplished. All the other little marmots out there will come up out of their holes and look around. Whoa, whoa. What just happened? He got what you get, what you incentivize. And so if we want to have people be open to these things, we have to peel back some of the layers of the culture and stop incentivizing risk aversion and sloth and unwillingness to change and all of that, and start incentivizing the things we say we want. I mean, the lip service is all, oh, well, we're 21st century. Yeah, but nobody's actually. Once you get past the talking points and the press release and the, you know, the big public announcement by an agency head or something, it never changes. So you change the underlying incentives so that people actually said, yep, you're going to get paid, promoted, moved into better assignments, you know, whatever, figure out what the incentive structure is and what's possible in any particular agency or bureau, whatever that might be, and then actually align that with what you say you want. And then you'll, over time, you'll actually start to see some of those results. Those people are basically economically rational. I mean, they're going to do what they're going to do. They'll be conservative if that's what they're being incentivized to be. But if they think they can get ahead significantly, if I can go from captain to colonel by doing one bold thing. Well, shoot, maybe, I mean, not everybody, but you just need a couple of people that are going to like, hey, I'm going to roll those dice. Because I think being a colonel at like 27 years old would be pretty cool and you know, but I have to wait 20 years to make that rank, right? So, you know, I'm kind of exaggerating for effect here, but there does. It could be done. It could be done. I mean, this is not, you know, just. Well, that's the way we've always done it. That's the reason whenever I hear that, that's, that just sets my, you know, sets a hero. If that's the way you've always done it, that's the first reason why you should think about stop doing it. Right.

Hey, Randy, I really appreciate the time today. You've given us so much to think about and, and I'll be noodling on this for quite a while and we'll be writing up the show notes to capture as much of this as I can. I do have one final question for you. As we think about all of this and this bright future we're building, what would you, what would your advice be for the youth of today? What kind of things should our youth be studying to maximize their opportunity in the future?

Well, there's a couple of ways to think about that. One on a sort of a just nuts and bolts way is I think that any kid today, starting in kindergarten or first grade or whatever the appropriate first level would be, should be getting coding skills taught. Just like reading, writing, arithmetic and you know, any other English. Any other the basic subjects that are, that are being taught. And along with that, then an understanding of how the technology works. And that should be a part of education, not as a nice to have and an add on. Well, when you're in college, take your Fortran course or no, I mean it should be like treat coding like a foreign language and Start teaching it at the earliest possible age. That's sort of a nuts and bolts thing that I think will then orient. And so by doing so then the underlying technology will be less of a mystery to the mass of people that I mean look, some people will be ace coders, others will, you know, just like foreign language or anything else. Some kids are good math, some aren't. Some kids are good in English reading and others aren't. I mean you'll have your bell shaped curve but at least there will be that underlying, I think a better underlying understanding. The other thing is, I think we just have to be encouraging and not, you know, not be so high bound and let kids encourage kids to let their imaginations roll because the best, you know, as we were talking about Gibson, Gibson got it right in, you know, the late 80s and 90s about his imagination and writings are closer to the reality that we're in today than anybody that was in the intelligence community doing their global annual forecast or five years ago. All of which completely missed the boat because in those analyses, well, the future is going to be exactly like today except.005% different.

The Berlin Wall has been up today, so it will be up tomorrow.

Right. Nobody ever programs in, you know, 10 or 20 or 50 standard deviation moves in the market. But sometimes those things happen. So I think being encouraging and giving kids let kids use their mad because kids and imagination are great and just to encourage that and particularly but you know, with some focus. So let's take some of the things like the Internet of things, give them a few sort of background thoughts. Internet of things, artificial intelligence, quantum, you know, give them the ABCs of what any of those things might be and then, and then let them go off to the races and think about. Because they'll. We'll be, we'll be astonished I think at ideas that come out of, come out of. Because they'll be so unconstrained by, you know, well, I'm not allowed to think that that's outside the box and I'll be punished if I, you know, if I dare challenge the orthodoxy, I'll be written out of the tribe. Yeah, kids are like, yeah, great. So you know, having, having that be a part of the opportunity and their education to do that, that I think would be also useful.

Great point Randy. Thanks for all this, really appreciate your time.

Happy to do it Bob. Thanks so much. All right, thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.