What's Working in Washington - Ep 307 - OODA: both a philosophy and a company on the rise - Bob Gourley and Matt Devost

Welcome to what's Working in Washington. I'm Jonathan Aberman. Today, cybersecurity experts give us insight on what we should be afraid of.

We're saying let's build security into these machine learning and narrow AI approaches that are being used now. And because we are starting to eliminate the humans from the process, and as we implement machine learning, we might reach a point where we don't really even understand how the technology is working. So let's start with a very strong security foundation at the beginning.

Our next guests are on my own shortlist whenever I need to have a cybersecurity technology explained or a technology trend unpacked. And I'm far from alone in having that opinion. Bob Gourley and Matt DeVoe are entrepreneurs and government technologists who've recently announced the formation of a new technology consulting business and venture fund called ooda. I'm going to talk with them today about their new venture and also some current cybersecurity trends that are important for all of us to keep our eyes on in the coming year. First of all, gentlemen, congratulations on your new enterprise.

Thank you, John.

Thank you.

What the heck is an ooda?

OODA really is a tribute to a concept that was put out first by a guy named Colonel John Boyd. He was a military fighter pilot who had a reputation for being unbeatable in dogfights. And that attracted the attention of the Pentagon and DOD officials. And they brought him to Washington, D.C. and they made him figure out what it was that actually allowed him to outperform all of his peers in that space. And he came up with this concept of observe, orient, decide, act as being the decision cycle that was kind of guiding his abilities in, in being able to engage in these tactical fights. And it turns out that OODA is just an incredible framework for thinking about all sorts of issues. National security issues, technology issues, technology security issues. It's been applied as a framework over the past 20 to 30 years in all sorts of domains. So we thought it was a great tribute for what we were trying to accomplish with the company to kind of name it after that concept.

How does this supply? Bob Gurley? How does the supply in the private sector? I often find when I deal with CEOs and companies, particularly in cybersecurity, it's more ready, fire, aim.

Right, right. Well, frequently you might need to explain it at first and as soon as you do, generally a CEO really gets it. And they say, I've been doing the OODA loop my entire life because a good, actionable CEO realizes that even the best strategy is only good temporarily. Your strategy, if you don't change it and update it based upon new information, will cause you to fall behind in the marketplace. So the great CEOs know it's a dynamic world out there where you have to take in information and change based upon the dynamics, especially if you're in a competitive environment.

So as you were going around your business and both of you have been involved in cyber technology, technology different ways, why did you decide to start this company and a fund, a venture fund at the same time? You don't have enough to do. I mean, what's the market? What's the opportunity? Why did you decide to take the entrepreneur risk and do this?

Well, so first of all, let me say Matt and I have worked together for decades now. First heard of Matt when he published a paper 1995 called in the Age of Digital Terrorism. Can you trust your toaster? So how prescient was that? He won the Sun Tzu contest at the National Defense University. I won the next year, by the way. So we met each other and then we started working with each other. When I was in Department of Defense helping raise the defenses of DoD networks, he was running red teams that was cutting through our defenses like a hot knife through butter and have worked together ever since in some capacity or another. So in many ways we've worked together well. And we know that we have this dynamic. We know the threat is only growing and the need for cybersecurity services is growing. The technology landscape is changing. We've seen the rise of cloud computing and artificial intelligence, and there's just a dire need for more work in this area.

It's fascinating to me, knowing what you all have been up to. You're so emblematic of what I see as one of the biggest strengths and opportunities in our region is, is coming out of a national security background now dealing with something that, frankly, is a huge private sector problem. Is that why here and where you're going, is this an enterprise play, is this a business play, or is this a national security play?

I think it's a combination of all three. Right. We're initially focused obviously on the enterprises to help them address this threat. And I think our national security background is, gives us just a great framework for understanding the cyber threat environment, but also being able to look towards the future. One of the things that we're trying to address is to get folks thinking about future issues, future risks, future threats, and developing approaches now that will help them address those. And the national security DNA of the company Definitely contributes to that perspective.

Now, I've been in the venture industry for many years myself. I'm interested how you're going to work the inherent conflict between being a consultant, being arm's length looking things objectively, but yet by the same token, as an investor, you want to invest in things before anybody else figures out that they're worth investing in. So have you given some thought to how you're going to manage that? When you find a really cool technology, what are you going to do with it?

These problems are greater than any one company is going to address. Right. So we're going to play our role, which is going to be on the advisory and really trying to engage new markets, talking a little bit greater detail about some of the stuff we want to do around AI security. But really the approach with the OODA Ventures is we encounter all of these great entrepreneurs, including folks that come out of that national security space, who have great DNA in the technology space, understand the security threat, maybe don't know a lot about entrepreneurship or we know from the hundreds of CISOs and CTOs and CIOs that we interact with what the enterprise pain points are, what is not being addressed in the enterprise, and the idea with UDAventures that we'll select those technologies and opportunities that we see will fit the gaps that exist in the market and where they don't have the entrepreneurial experience, we can bring some of that expertise to them from an advisory perspective as well.

Yeah, My sense is that that is really the missing ingredient in our region right now is the. We have a lot of really, really smart people who are dealing with highly complex problems around AI, cybersecurity and in particular big data. But we don't have a lot of product people, we don't have a lot of people who have commercial experience. So that's your hypothesis that you can brid.

We do believe we'll be able to bridge that. Yeah, that we'll find some of those kind of entrepreneurs in waiting that can be encouraged to bring their expertise, technologies, approaches to the market.

I'm here with Bob Gurley and Matt Devoe talking about their new company, venture fund, ooda. Bob, this is actually something that we touched base on a couple of weeks ago when the data breach got announced at Marriott. I was really struck that a lot of our colleagues, not people necessarily national security, but just business people here in town that we know. They shrugged. You know, it's almost like they've got cyber hacking. I don't know. Malaise, you know, is corporate America really Not involved in the arms race with hackers that literally can't win.

You have hit on this fact that we become numb to all these attack notifications, breach notifications. There's just millions of records stolen all the time. And so how do you sort it out and realize what is important or not? You look at Marriott and you think, oh great, did they steal my credit cards again? But when you dive deep into that one, this is more significant and serious. They have stolen personal identifiable information on millions of people, including passports. And who is the they? All indications are it was China. So it was groups associated with a serious national security competitor, which is now able to mix that information with other information. They've been acquiring our health and medical records, our OPM records. So this does become a serious national security issue.

You know, when you think about it, talk about it that way, it really does bring to me cybersecurity in particular. It's a national security challenge like nothing we've ever faced in this country. Because previously military force, national security, that was something projected to the edge by our armed services. The private sector, we made stuff so people could fight wars, but now the private sector is the target. You just described Marriott and Sony with the North Koreans and on and on. Does our national security establishment and our private sector, do they really interact the way they should?

No, no. There needs to be far more and far more leadership played not by the government, but by industry. I'm just convinced of that. And another key one that we need to talk about was the Tribune attacks of two weeks ago. The media, newspapers across the country were either delayed or could not publish because of a sophisticated ransomware called rook, which seems to be associated with North Korea. So yet another example of commercial entities being attacked that has an impact in national security with it.

This is something that bears a lot of close consideration. And we better teach people not to use their password. Password. Something that I'm shocked when I see how many people stood to that. Matt, I'm going to turn to you, Matt devoe. You mentioned AI. I know this is going to be an area of interest of Jorg and of uda, both as a consultant and investor. One thing that's been bothering me recently is how often I'm hearing that one of the big issues of AI is not job displacement. It's actually the inherent problems of human bias. What does that actually mean? I hear people talk about, what are they getting at?

Sure. I think that is just one of the key issues that we're going to have to solve as it relates to AI, right. When AI programs are written or algorithms are written, they kind of inherit the bias of the authors. So we've seen this over and over again in the market where machine learning or AI is introduced. And as it continues to build upon the learning in which it was programmed, those biases start to get enhanced. The analogy I like to use is like money in a bank account, there's a compounding interest. So a little mistake might become a very big mistake, compounded over time because it's just reinforcing that bad behavior. That's just one of the issues I think that we're going to have to address, right, Is the algorithmic bias from the authors of these AI. We need to make sure that we are ensuring the integrity of the training data that is being used. We need to make sure that these AI and machine learning systems can't be influenced by external actors. Right? We see increasingly the use of machine learning to process signals from external sources, social media, Facebook, etc. What if a Russian botnet decides that it wants to influence a stock price instead of an election? How do we make sure that we're not building some of these, you know, algorithmic trading machine learning platforms that aren't susceptible to that type of bias that could have a machine learning impact? And then lastly, I think, you know, a key security issue with AI is how do we ensure the integrity of the AI platform platforms? We think of AI as an essential technology, right? We thought of electricity as an essential technology. Then we thought of the Internet as an essential technology because they both have permeated all aspects of society and commerce and national security. AI and machine learning are headed in that direction as well. So should we not sit down and deliberately think through how do we secure these platforms in advance rather than just rush straight into the technology and build on these mistakes or the lessons learned that we could have avoided from the past implementation of some of these technologies?

You know, when I talk with most people who are outside of technology, living it on daily basis, when you talk with them about artificial intelligence, what they're most fixated about is are computers conscious by the time we get to the point where software is sentient, if it ever is, and who cares if we don't deal with these issues, what's going to happen to our society?

And the impact is going to be, you know, much more pronounced over the near term? I mean, we may reach a point where they have some sort of sentient ability, right? I'm waiting for the day when I can upload my brain to a computer.

Computer Or a toaster apparently.

Or a toaster. I threaten my children with that all the time. That I will be following them through their lives. The key is though, that is there are much more narrower implementations of these technologies that we are bringing into every single Fortune 1000 company today. And that is the curve that we're trying to get ahead of. We're not saying, hey, let's secure sentient AIs, we're saying let's build security into these machine learning and narrow AI approaches that are being used now to. Because we are starting to eliminate the humans from the process. And as we implement machine learning we might reach a point where we don't really even understand how the technology is working. So let's start with a very strong security foundation at the beginning. Let's build in the best practices that we know. Let's secure these platforms, use that as the baseline. That is one of the big things that we're going to be pushing for within ooda.

This is feeling more and more like giving a machete to a two year old. You could do it, but it's a bad idea. So AI is out, it's going to be driving our economy. Last thing that I want to touch with you guys on is it seems like we're at a crossroads right now in tech and a lot of people are really questioning the whole business model of giving up the personal data to exchange in for benefits. But by the same token, as we talked about earlier, they're getting desensitized around these hacking issues. How do you think it's going to play out? What are going to happen to businesses depend upon access to personal data in order to function?

I think we were looking for changes in the regulatory environment. I think something is going to happen now in our community. We all know that compliance does not equal security. Some new rule comes out, you comply with the rule, the hackers don't have to comply with the rule, they get in anyway. But we do see changes to the compliance and regulatory environment coming and that may raise some awareness. That's not sufficient. We know that. So we have tried to figure out how can we steer our own thoughts and how can we steer our writings on our web properties like CTO Vision and Oodle. And we've assembled a team of experts to help us think through that very issue and many others. These are guys like Scott McNeely, the iconic businessman, founder and chairman of Sun Microsystems. Jeff Jonas, perhaps one of the greatest data scientists out there. Jeff Moss, the creator of the DEF CON and Black Hat hacking conferences. Them and many others are going to help steer us as we try to dive deeper into questions like that.

Well, I really appreciate you coming in the studio today and and also I wish you the best of luck with ooda. I think it's an enterprise that will help our region grow and for that reason I thank you. Bob Gourley and Matt Devoe, thanks for joining us today.

Thank you.

Thanks.

Thanks to our sponsor, Tandem Product Academy. If you're looking to grow a software technology business and you're past your first five employees or your first half a million dollars of revenue, their free educational program will teach you how to grow your business. Supported by a broad group of our region's leading business organizations and local governments. Tandem Product Academy is free to participants. Learn more@tandeminnovate.com our executive producer is Tracy Madigan, online writer Barbara Ulrich. Music provided by two DC Region bands, two Car, Living Room and the Sunbathers. I'm Jonathan Aberman. Thanks for listening. See you next time.