Speaker 1: This is Bloomberg Business Week. I'm Carol Masser and I'm
Speaker 1: Jason Kelly. We're here every day bringing you the latest
Speaker 1: news from the world's of business and finance, plus technology, politics, economics,
Speaker 1: all harnessing the power of Bloomberg Business Week reporters and editors,
Speaker 1: not to mention our hundred journalists and analysts more than
Speaker 1: a hundred and twenty countries. You can download Bloomberg Business
Speaker 1: Week on iTunes, SoundCloud, or Bloomberg dot Com. You can
Speaker 1: also listen to our radio show weekdays at two pm
Speaker 1: Eastern only on Bloomberg Radio. At the bottom of the hour,
Speaker 1: we're going to be at the Non eleven Memorial and
Speaker 1: Museum the Summit on Security. Will be joining Bloomberg Business
Speaker 1: Week show host Jason Kelly. Earlier in the day, he
Speaker 1: was speaking with Christopher Crummy, who is the executive director
Speaker 1: of x Force Command for IBM Security and Jason and
Speaker 1: Mr Crummy we're talking about on the lessons learned from
Speaker 1: recent cyber attacks in both private and public sectors. So, Chris,
Speaker 1: tell me your message to the summit today, because it
Speaker 1: was so ring on the one hand, but very realistic
Speaker 1: at the same time. So I think my message is
Speaker 1: we've experienced some of the most mature customers in the
Speaker 1: world that have come through our cyber range, that have
Speaker 1: come through our cyber truck, So we've picked up a
Speaker 1: lot of best practices and a lot of their gaps
Speaker 1: when they go through a crisis. So our message was
Speaker 1: make sure that you focus on security culture. That's a
Speaker 1: key aspect. There's so many things that you can do
Speaker 1: ahead of time, practicing your run books, making sure you
Speaker 1: have the right language as you go through these things,
Speaker 1: and then making sure that you're doing this as a
Speaker 1: full business response and not just a technical response. So
Speaker 1: these are just some of the major ideas, and one
Speaker 1: of the key themes I feel like it's coming out
Speaker 1: of all of these conversations is around sort of the
Speaker 1: human aspect to this and when people go through the range,
Speaker 1: as you say, sort of seeing them at their most vulnerable,
Speaker 1: sort of literally and figuratively. What do you take away
Speaker 1: from those experiences the the fact that cyber is all
Speaker 1: about the human I mean, I really think it is
Speaker 1: a major major focus. Um think about how a human
Speaker 1: being reacts physically to a crisis, right that the courtisol
Speaker 1: that flushes through your brain, the mistakes that they make.
Speaker 1: These are all things we want customers to be aware
Speaker 1: of that their teams are going through a crisis and
Speaker 1: need a better way to respond, So we focus on
Speaker 1: trying to make sure that they understand how much you
Speaker 1: need to address things like increasing the password size. If
Speaker 1: you do that, you make yourself more secure, but you're
Speaker 1: not addressing the human side of that. Humans are not
Speaker 1: designed to remember fifteen character passwords. So if you're going
Speaker 1: to be more secure, you just got to make sure
Speaker 1: that you make it frictionless for your in users to
Speaker 1: do the right thing, and to also explain to them
Speaker 1: why you have to change your password every ninety days. Right.
Speaker 1: There's there's great stories of very famous people who had
Speaker 1: their Twitter accounts taken over because they use the same
Speaker 1: password in my Space and the bad guy's got access
Speaker 1: to that. So it's it's taking advantage and giving them
Speaker 1: an idea of what they're up against and explaining the
Speaker 1: why you need to make these changes that I think
Speaker 1: help the overall culture and the overall safety of the company.
Speaker 1: So take me inside the range. What does it look like,
Speaker 1: what does it feel like for people who are going
Speaker 1: through it? So the range is designed to prepare for
Speaker 1: your worst day, so we will work with the customer
Speaker 1: and figure out the industry, the key aspects of stuff.
Speaker 1: You walk in there and now you're part of a
Speaker 1: fake company and we're going to literally put you through
Speaker 1: your worst day. We have concepts around media, we have
Speaker 1: concepts around regulators, we have concepts around your training, and
Speaker 1: how does this all come to get together on your
Speaker 1: worst day? Who's in charge? What's my next move? What's
Speaker 1: my priority? What is the company's north star? Is is
Speaker 1: it the customer that's my north star? Like, you don't
Speaker 1: find out where you are on your training or other
Speaker 1: aspects until it's underload. It's really important to realize that
Speaker 1: we've get a lot of run books and they're about
Speaker 1: an eight in quality, but when you put them underload,
Speaker 1: there about a three. Because they don't train like you
Speaker 1: fight and fight like you train. So we we they
Speaker 1: discover a lot of gaps. They want to as soon
Speaker 1: as they're done, they want to go right back home
Speaker 1: to the office and they're gonna They've got an action
Speaker 1: list of things that are gonna implement right away, so
Speaker 1: they get a good feel of you know what, you're
Speaker 1: validating what we're doing well. But you've also opened our
Speaker 1: eyes to things we haven't seen before, blind spots. The
Speaker 1: use of confirmation bias under a crisis is crippling. They
Speaker 1: assume that's the insider threat, and it wasn't the whole time,
Speaker 1: but they cannot let it go. So they trained to
Speaker 1: understand the physical reactions, the human reaction, the process reaction.
Speaker 1: Who do I call next, what do I need to
Speaker 1: do in the next twenty four hours, what are my priorities?
Speaker 1: And you don't do that until you train for it.
Speaker 1: And so in here in twenty nineteen, I feel like
Speaker 1: we're having this near existential debate around privacy versus freedom
Speaker 1: of access, freedom of movement. The smartphone obviously has changed
Speaker 1: everything it feels like in our daily lives, both personally
Speaker 1: and professionally. How do you sort of come down on that?
Speaker 1: How do you help people understand that balance? So when
Speaker 1: you think about the most mature customers, they always want
Speaker 1: to train for you as an individual at home first,
Speaker 1: if I make you a better spouse, a better mom
Speaker 1: or dad, uh, dealing with your kids and your cell
Speaker 1: phones at home, that awareness, that ability to understand comes
Speaker 1: into work and that is a great way to do it.
Speaker 1: So so if you make it personal for people, they
Speaker 1: better understand those things. There is. Cyber is one thousand
Speaker 1: percent about risk, and there's a balance of Someone said
Speaker 1: today there's no such thing as perfect security. It is
Speaker 1: how do I lower the risk? That is Christopher Crummy.
Speaker 1: He is executive director of x Force Command that IBM
Speaker 1: Security talking there with Bloomberg's Jason Kelly from the nine
Speaker 1: eleven Memorial and Museum Summit on Security. You're listening to
Speaker 1: Bloomberg Business Week with Carol Masser and Jason Kelly on
Speaker 1: Bloomberg Radio. Well, and welcome everybody to this very special
Speaker 1: edition Bloomberg Business Week. I'm Jason Kelly downtown Manhattan here
Speaker 1: at the nine eleven Memorial and Museum. And Alice Greenwald,
Speaker 1: you run this whole thing here with the cast of thousands,
Speaker 1: fair enough, and Frank Physignano, president and CEO of By Serve,
Speaker 1: also a board member here at nine eleven. Alice, this
Speaker 1: is a big day, the second year you've done this.
Speaker 1: Tell us the purpose, Well, the purpose of the Summit
Speaker 1: on Security is to bring together individuals across sectors, so
Speaker 1: from the private side, the public side, government, corporate, so
Speaker 1: that there can be a joint conversation about preparedness, the
Speaker 1: nature of the threats, how you recover from events, and
Speaker 1: really from our point of view, it's a perfect example
Speaker 1: of the continuing impact of nine eleven, the things that
Speaker 1: we have to pay attention to as a result of
Speaker 1: the world we now live in. And so what has
Speaker 1: really stood out to you today, the second year you're
Speaker 1: doing this, We were talking a little bit about this
Speaker 1: before we came on here. Let's really jumped out at
Speaker 1: you theme wise this year, So the theme has been
Speaker 1: primarily about cybersecurity, which is obviously a threat at every
Speaker 1: level of our lives. UM. But what has struck me
Speaker 1: most is that the conversation has bridged both the cognitive
Speaker 1: practical what you do, how do you deal with it?
Speaker 1: What are the ways you know you've got a problem,
Speaker 1: how who do you partner with? But also the heart.
Speaker 1: So it's been hid and heart and there's been a
Speaker 1: lot of conversation today, including Frank kicking it off this morning, UM,
Speaker 1: that has been about the motivation for this awareness of
Speaker 1: the need for security coming out of personal nine eleven experiences. Well,
Speaker 1: and Frank pick up on that, because you did. You
Speaker 1: kicked it off so beautifully this morning on a very
Speaker 1: personal note, your own remembrances of nine eleven, but also
Speaker 1: talking about everything that's happened in between and the work
Speaker 1: that you're doing now, both professionally in your day job
Speaker 1: as well as your work here, helps set the tone
Speaker 1: in that regard for us. Well, I think it's about
Speaker 1: preparedness and advance, about partnership. If you were in the
Speaker 1: Sacred Place on nine twelve, Uh, in that year, you
Speaker 1: have seen partnership at its highest possible level, people all
Speaker 1: across America coming together, uh to bond. And when you
Speaker 1: take that thought and say we can protect ourselves by sharing,
Speaker 1: by partnering, we will be much better prepared. And that
Speaker 1: means government, that means businesses, that's every form of law
Speaker 1: enforcement and sharing because protection is the number one thing
Speaker 1: for us to work on in preparedness and in the
Speaker 1: event of any disaster. And I think, uh, it was
Speaker 1: always on everyone's mind, but now it's completely in the forefront,
Speaker 1: and the partnerships are very high and very strong. Well.
Speaker 1: And it's interesting, Frank too, because it feels like a
Speaker 1: lot of that sharing has been demonstrated in the financial
Speaker 1: services industry. You've been a long time in that business,
Speaker 1: it's a very competitive business. We all know that, and
Speaker 1: yet financial Services has been able to share around this
Speaker 1: in a way that maybe is unexpected. Why do you
Speaker 1: think that is Well, I think everybody recognized that the
Speaker 1: greater good is the most important thing. It was our
Speaker 1: our financial markets, our stock market that wasn't operating during
Speaker 1: that disaster, and that's good for no one except the
Speaker 1: bad guys. And we all united to bring it together
Speaker 1: to get it back up and running. And everybody understands
Speaker 1: help each other. When we were walking on those streets
Speaker 1: Greenwich Street, everyone was created equal and everyone believed that
Speaker 1: they had to help each other. And today in war Manhattan,
Speaker 1: when you come to this fabulous, fabulous sacred place, the
Speaker 1: Nino of a memorial and museum, all you see is teamwork,
Speaker 1: partnership and people caring for each other. And Alice, it
Speaker 1: was interesting. You know. Admiral Mullin, we're gonna hear from
Speaker 1: him a little bit later on in the show. He
Speaker 1: was here in part to help unveil a new exhibit
Speaker 1: that's going to be open to the public this weekend
Speaker 1: about the hunt for Bin Ladden ultimately uh successful after
Speaker 1: many many years. Tell us a little bit about that
Speaker 1: exhibit absolutely and thanks for asking. Revealed is opening on Friday,
Speaker 1: November fift It's called Revealed, the Hunt for Bin Laden
Speaker 1: and it tells the story we all think we know,
Speaker 1: we all know the ending of the story. We know
Speaker 1: where it leads. What we don't know is how we
Speaker 1: got there. And this is really a phenomenal telling of
Speaker 1: the work. It took, the coordination across law enforcement, military, UM,
Speaker 1: you know, intelligence agencies, domestic and international. It was a
Speaker 1: hugely coordinated effort that but longer than a decade, so
Speaker 1: before nine eleven until May um and that level of coordination,
Speaker 1: what it took. And as you go through this exhibit,
Speaker 1: it unfolds like a mystery. Even though you know where
Speaker 1: it will lead, you are riveted because each moment is
Speaker 1: peeling away the layers of UM trying to find this man.
Speaker 1: What the leads were, some of the leads and nowhere,
Speaker 1: and some of the leads actually led to a bottom
Speaker 1: us well, And as Alice says, Frank, so timely, you know,
Speaker 1: given the capture of all Bughdatti as well, uh most recently,
Speaker 1: it reminds us the world is not a safe place
Speaker 1: in many ways. And I wonder how do you think
Speaker 1: about that from your business perspective? Because you have responsibility
Speaker 1: for so many transactions, so much money moving through the system.
Speaker 1: How do you think about it today? Well, you know,
Speaker 1: most of my career I worried about this, and uh,
Speaker 1: it's top of mind. It's top of mind for every CEO,
Speaker 1: for every senior executive, protecting, protecting your people, protecting the
Speaker 1: assets of your clients, protecting your shareholders value. And so
Speaker 1: it is the number one item. And you make sure
Speaker 1: your defense is as strong as humanly possible. Um. And
Speaker 1: it's never good enough. Every day you come in and say,
Speaker 1: never good enough, and you can never feel safe enough.
Speaker 1: So um, it's a constant drum beat. It's ah, it's
Speaker 1: you build uh an organization around it. You make sure
Speaker 1: you have great organizational awareness. And then connectivity of organizations matter.
Speaker 1: You know, any piece of data and information and that
Speaker 1: may seem trivial may actually protect you very very much.
Speaker 1: And having all partners work together is critically important. So
Speaker 1: speaking of connectivity, we are blueberg. After all, the last
Speaker 1: time we talked, you had not done the big deal.
Speaker 1: I believe that you have now done. How's that going?
Speaker 1: It's going great, it's going great. You know, we have
Speaker 1: an unbelievable company. Fi Serve is U is alive and
Speaker 1: well and strong. Uh. You know Fi served before Verse
Speaker 1: Data was this great brand and great economic machine. First
Speaker 1: Data had a lot of fabulous assets in it. We're
Speaker 1: fortunate that we could put them together and build what
Speaker 1: we think is the best fintech in the world. Well, Alice,
Speaker 1: it's a beautiful day here in Lower Manhattan. What's the
Speaker 1: biggest priority for you going forward? Um? You know, the
Speaker 1: biggest priority is thinking about the next generation. You know,
Speaker 1: we are coming up on the twentieth anniversary of nine eleven,
Speaker 1: hard as that is to believe, and twenty years is
Speaker 1: a generation conventionally speaking, And already we are seeing people
Speaker 1: who are in college with no memory of nine eleven,
Speaker 1: Young professionals coming out of law enforcement training from the academies,
Speaker 1: no memory of that day. And yet they are moving
Speaker 1: into careers like security, moving into careers in the financial industry.
Speaker 1: And we believe that the world that they are inheriting
Speaker 1: has been conditioned by the events and repercussions of this event.
Speaker 1: So we are here to help them connect those dots.
Speaker 1: And I think that's going to be our most important
Speaker 1: purpose going forward. Alice Greenwald, Frank Dosignano, thank you so much.
Speaker 1: We should also mention, of course, at Michael Bloomberg, the
Speaker 1: founder and majority owner of Bloomberg LP, also serves as
Speaker 1: the chairman of the Non eleven Memorials and Museum. Thank
Speaker 1: you both so much. It's been a really interesting and
Speaker 1: powerful day here at the nine eleven Memorial and Museum.
Speaker 1: Earlier in the day, I got to catch up with
Speaker 1: Jen Easterly. She's managing director over at Morgan. Stanley worked
Speaker 1: in Army intelligence for many years the n s A
Speaker 1: in the White House. She's a graduate of West Point
Speaker 1: of former instructor there, and she talked about her job
Speaker 1: on Wall Street and what she's doing encountering all sorts
Speaker 1: of new threats. Take a listen. Obviously looking at the
Speaker 1: threat landscape now, we still have the physical threats from
Speaker 1: groups like ISIS and al Qaeda, but now dealing with
Speaker 1: cyber significant cyber threats from nation states, from organized criminal
Speaker 1: group threats from the weaponization of data for things like
Speaker 1: disinformation that really corrodes our trust and people and institutions,
Speaker 1: and so things like that that we have to worry about,
Speaker 1: both for attacks against critical infrastructure, but also attacks against
Speaker 1: things like things like reputation are hugely important, right, And
Speaker 1: I'm so glad you brought that up, because at the
Speaker 1: core of that conversation, it feels like increasingly the conversations
Speaker 1: that we're having are much more holistic and focus on
Speaker 1: people and not just the the bits and bites and
Speaker 1: and the really wonky technicals off that you understand and
Speaker 1: I don't, but I do understand the concept of bad actors,
Speaker 1: and so how do you combat that instan You know,
Speaker 1: I often say that cyber security is not about computers,
Speaker 1: and it's not about code. It's about people and frankly,
Speaker 1: what we what I think we really need to worry about. Obviously,
Speaker 1: you know, there are significant cyber threats, and so we've
Speaker 1: done a lot across the whole banking sector to protect
Speaker 1: our assets and and our clients. But at the end
Speaker 1: of the day, it's attacks against what I think is
Speaker 1: our most critical infrastructure are cognitive infrastructure, the way that
Speaker 1: we make good decisions and our judgment, and that's being
Speaker 1: impacted by a lot of these disinformation and malinformation campaigns
Speaker 1: through the weaponization of data. So you're right, I think
Speaker 1: we need to to look at the threat landscape very holistically,
Speaker 1: from the physical threats to the cyber threats to the
Speaker 1: threats against facts. Frankly well, and it sounds like one
Speaker 1: of the ways you combat that is with better people
Speaker 1: in some ways and training them in a different way.
Speaker 1: Tell me about that human capital is really critical here.
Speaker 1: You know, you need people, you need process, you need
Speaker 1: technology to be successful in the cybersecurity world. That I
Speaker 1: think talent is the most important. You know, researchers estimate
Speaker 1: that by the year there will be three point five
Speaker 1: million unfilled cybersecurity jobs around the world, and you could
Speaker 1: argue were already in negative percent unemployment, so more jobs
Speaker 1: out there than people. So there's much we have to
Speaker 1: do to educate, you know, clearly our employees and our
Speaker 1: clients about the threats that are out there in cyberspace.
Speaker 1: But I really think we need to look at this
Speaker 1: problem much more comprehensively. We have to we have to
Speaker 1: start with the youngest among us. One of the things
Speaker 1: that I've been working on is part of a new
Speaker 1: nonprofit called Cybernation, and the idea is to bring together
Speaker 1: the world cyber and technology experts with the world's greatest
Speaker 1: storytellers to demystify cyber so to inspire, to inform, to
Speaker 1: educate from K through gray, from your digital natives to
Speaker 1: your digital immigrants, because we all need to understand what's
Speaker 1: the technology, what are the threats, are their laws and cyberspaces,
Speaker 1: their privacy online, and then ultimately what it means to
Speaker 1: be a good digital citizen. When you think about your
Speaker 1: work in the financial services world, as you said, you
Speaker 1: came out of the public sector working in the army,
Speaker 1: you worked in the White House, you worked in the
Speaker 1: n S. A part of what you are now faced
Speaker 1: with is cybersecurity when it comes to one of the
Speaker 1: fundamental building box of our society, which is money. And
Speaker 1: it does feel like banks and financial institutions have invested
Speaker 1: heavily here. What are you seeing now? Because you are
Speaker 1: charged largely with looking around the corner. I see my
Speaker 1: mission now is really an extension of what I've done
Speaker 1: through most of my career in national security, which is
Speaker 1: really defending our economic security. I mean, given that a
Speaker 1: big bank is so fundamental to to national security, so
Speaker 1: I think you're right. I mean, the banking sector is
Speaker 1: ahead of this problem, and we had to be because
Speaker 1: we were attacked pretty signific pigotly in time timeframe. We're
Speaker 1: a group known as the Al Kasam cyber fighters, later
Speaker 1: identified with the Iranian government. We're doing what was called
Speaker 1: distributed denial of service attacks, essentially launching massive data website
Speaker 1: so that people couldn't get to them, and it caused
Speaker 1: a panic. It was for the first time it illuminated
Speaker 1: the vulnerability of our critical financial infrastructure. But off the
Speaker 1: back of that, UH Banking really got ahead of this
Speaker 1: and put in the right programs, the right process is,
Speaker 1: the right technologies and started really investing in that talent
Speaker 1: so that we could strengthen the sector and some of
Speaker 1: the things that we've done to come together very importantly
Speaker 1: to share information. I was incredibly encouraged to come from
Speaker 1: the White House to the banking to the financial sector
Speaker 1: to see how much sharing there is both within the
Speaker 1: financial sector. So you know, big banks are super competitive
Speaker 1: about talent and super competitive about business, they're not competitive
Speaker 1: about sharing information. That's going to keep the sector safe.
Speaker 1: And there's also good sharing between the government as well
Speaker 1: as the private sector, and that it will continue to
Speaker 1: grow and strength and hopefully in the coming years. And
Speaker 1: so you know, you talked about that sort of k
Speaker 1: through Gray. I'd love that phraseology. But when you think
Speaker 1: about your own business and the talent gap there, how
Speaker 1: do you fill that? So we have been successful so
Speaker 1: far in recruiting the folks that we've needed for the
Speaker 1: for the Fusion Center, but we've reached pretty far afield.
Speaker 1: So we of course had great talent within Morgan Stanley
Speaker 1: from an engineering standpoint that we brought in to help
Speaker 1: build the center, but we've gone out to academia, We've
Speaker 1: gone to the military, we've gone to the intelligence community,
Speaker 1: some of the other banks, some vendors. We have really
Speaker 1: built sort of a village because it does take a
Speaker 1: village to be successful in cybersecurity, and it's not just
Speaker 1: about coders or developers or programmers. You do definitely need
Speaker 1: that skill, but you also need analysts who can help
Speaker 1: you understand the very complex and dynamic cyber threat environment.
Speaker 1: You need incident responders who understand how to reverse engineer malware.
Speaker 1: You need crisis managers who can deal with a major
Speaker 1: threat or a major vulnerability. So it's really building, uh,
Speaker 1: this fabric of talent that's brought in from places all
Speaker 1: around the world. Because we're in New York, we're in Baltimore,
Speaker 1: where in Glasgow, we're in Singapore, so we're truly global,
Speaker 1: and so it's tapping into a global talent market. And
Speaker 1: then you know, my biggest challenge has not been recruiting necessarily,
Speaker 1: but it's retention because in a world where there are
Speaker 1: so many opportunities for cyber talent, you have to really
Speaker 1: cultivate an environment that enables you to retain that talent.
Speaker 1: And you know, you need an environment of psychological safety. Frankly,
Speaker 1: where people can bring their imagination, they feel like they're actively,
Speaker 1: actively listened to, where they can bring great ideas to
Speaker 1: the table, and that I think is the key to
Speaker 1: retaining your your best and brightest and that is Jen Easterly.
Speaker 1: She is managing director over at Morgan's Stanley, looking after
Speaker 1: all of their cybersecurity, coming out of the government to
Speaker 1: do that job. Over the course of her career, she
Speaker 1: worked not only for Condoleeza Rice during the George W.
Speaker 1: Bush administration, she worked for Susan Rice. Under the Obama administration,
Speaker 1: she worked in the n s A. She was an
Speaker 1: Army intelligence officer deployed all sorts of places overseas. She
Speaker 1: has seen the threat up close and personal that conversation
Speaker 1: talking about sort of looking around the corner but also
Speaker 1: having the right people to do it has really been
Speaker 1: a key theme here at the nine eleven Memorial Museum,
Speaker 1: UH and Summit on Security. Well, let's move to a
Speaker 1: conversation here at the nine eleven Memorial and Museum Summit
Speaker 1: on Security. Greg virgin is here with me. He is
Speaker 1: the CEO at Red Jack participating in the conference. Here. Greg,
Speaker 1: great to see you, Thanks for having me. All right,
Speaker 1: So tell us Essentially, I was gonna say why are
Speaker 1: you here? But I know why you are here because
Speaker 1: this is a really important series of conversations that's happening.
Speaker 1: What are you sort of taking away as the main
Speaker 1: themes here? Yeah, there's been a lot of conversation around, UM.
Speaker 1: For for what I talked about vote security and UM,
Speaker 1: a lot of that had a lot to do with
Speaker 1: information online through social media and UM, how we can
Speaker 1: trust information and the concept that while there's plenty to
Speaker 1: be said about hacking a vote there, you know, voter
Speaker 1: manipulation is is also a problem. Well, I'm glad you
Speaker 1: said that because what what seems to becoming clear And
Speaker 1: I spoke with the Craig Newmark earlier, and obviously he's
Speaker 1: done a lot of work in this area as well,
Speaker 1: and in several other conversations I've had on the sidelines
Speaker 1: and on air here it becomes very clear that we
Speaker 1: need to be worried about the humans, not the technology
Speaker 1: in some ways, and the manipulation of humans. So how
Speaker 1: does technology sort of help us do that? Well? You know,
Speaker 1: the way that I described this earlier is a lot
Speaker 1: of people coming at this from the cybersecurity side. I
Speaker 1: like to think in terms of malware. So you take
Speaker 1: a system and you hack into it and break it,
Speaker 1: or you socially engineered the people who run it. But
Speaker 1: you know, the way that a lot of these systems
Speaker 1: online work. They've got inputs, which is what you've done
Speaker 1: in the past and what is trending online, and then
Speaker 1: they've got outputs. So if you want to exploit that system,
Speaker 1: you can exploit the system itself, or you could change
Speaker 1: the inputs. And I think that's one of the interesting
Speaker 1: things that we kind of have to contend with over
Speaker 1: the next decade right well, and certainly over the next
Speaker 1: year as we looked toward a presidential election. What have
Speaker 1: we learned over the past couple of years that we're
Speaker 1: now going to apply in this all important you know,
Speaker 1: presidential election in you know, um, this is a tough
Speaker 1: thing to really study. Yeah, I think that's one of
Speaker 1: the problems is we need better ways to understand how
Speaker 1: Um you know, they're they're all sorts of fake news
Speaker 1: campaigns and like bots that so these sorts of fake
Speaker 1: sources of information on social media, and um, you know,
Speaker 1: we we know that's bad. We know that. Uh, like
Speaker 1: a news article that tells a lies is wrong, right,
Speaker 1: But what if there are hundreds of thousands of sources
Speaker 1: of information and that can change that first news article
Speaker 1: that you see when you bring up your Facebook. Um, Like,
Speaker 1: so I think that first we need to be able
Speaker 1: to study that a little bit better. But you know,
Speaker 1: for for me, I'll be very intentionally getting my news
Speaker 1: from a bunch of different difference sources to make sure
Speaker 1: that I'm not relying on like anyone platforms way that
Speaker 1: they're curating information for me and essentially having to do
Speaker 1: some sort of human triangulation in some way sort of
Speaker 1: in your own mind. You know, I do wonder you
Speaker 1: know your background. Keep me honest here, I believe that
Speaker 1: you worked for the d O d worked on the
Speaker 1: government side. How do you sort of actively make that
Speaker 1: transition and sort of take that knowledge and take it
Speaker 1: to the private sector. Uh, you know, UM, I've been
Speaker 1: looking at it's a big question. And UM, I've been
Speaker 1: looking at internet scale data for eighteen years. And UM,
Speaker 1: you know, we talk a lot about these really acute problems,
Speaker 1: and I've been looking at the noise on the Internet
Speaker 1: now for so long that it's just sort of like
Speaker 1: our immune systems, right, we're just immersed in these cybersecurity issues,
Speaker 1: and we've it's become a part of the DNA. UM.
Speaker 1: You know it. I think that from from my perspective,
Speaker 1: just helping people understand how the Internet works. And one
Speaker 1: of the interesting data points which researchers found, uh, of
Speaker 1: all of the hashtag I've voted tweets around the last election,
Speaker 1: we're from they were from robots. Wow. Yeah, And and uh,
Speaker 1: you know, it's easier for us to focus on, um
Speaker 1: like contentional sources of fake news, but you think about that,
Speaker 1: like some hackers decided that they were going to manipulate
Speaker 1: a system that way. Uh, and we've kind of got
Speaker 1: to wrap our heads around the implications of that, where
Speaker 1: you know from my career doing cybersecurity that phenomenon is
Speaker 1: not very strange, right, Um, but it's it's not the
Speaker 1: sort of thing that we're all going to be able
Speaker 1: to understand until people from my background trying to explain
Speaker 1: it well. And that I'm so glad you said that,
Speaker 1: because part of it really is about explaining. You know,
Speaker 1: Jenny Easterly who's here at the conference and I we're
Speaker 1: talking earlier, and you know, she's working on some projects
Speaker 1: related to essentially marrying the science with storytelling in a
Speaker 1: lot of ways, sort of helping people understand How do
Speaker 1: you go about doing that? You know, because you have
Speaker 1: a lot of smart people, I would put myself in
Speaker 1: the category of being relative of lee smart who do
Speaker 1: not understand fully you know sort of and and it
Speaker 1: don't have any sense of of our our depth of
Speaker 1: knowledge that that you do. But how do you explain
Speaker 1: it to someone who wants to understand, um and has
Speaker 1: a has good intentions of being genuinely curious about it? Yeah, Well,
Speaker 1: you know, I didn't go into computer science because I've
Speaker 1: got social skills. Um. I I think that, Um, you
Speaker 1: as an industry, we need to figure that out. Um.
Speaker 1: You know, I I studied biology and chemistry also, so
Speaker 1: I like to use analogies that we need to find
Speaker 1: real world analogies that aren't just warfare, right, because, um,
Speaker 1: what this space looks like is um like, the the
Speaker 1: ability to infiltrate to exploit systems on the Internet is
Speaker 1: like it's relatively straightforward and low risk for adversaries to
Speaker 1: do that. Yeah, it's calling it an attack doesn't exactly work, right, Um.
Speaker 1: You know, from the perspective of what I used to do,
Speaker 1: it makes a lot of sense. But um, you know
Speaker 1: that the Internet is just kind of dirty place, you know,
Speaker 1: like I've I've got three little kids and they go
Speaker 1: to school and don't wash their hands. Right, that's a
Speaker 1: lot That's really a better analogy. Yeah, I'm glad you
Speaker 1: said that, because I do feel like one of the
Speaker 1: one of the things that I feel like has taken
Speaker 1: some residence here is this idea of hygiene, right, you
Speaker 1: know that that we have to think about this, uh
Speaker 1: in to a level of as you're alluding to, sort
Speaker 1: of cleanliness in a lot of ways and having good
Speaker 1: habits in the same way that you know, I'm sure
Speaker 1: I'm guessing your kids are the same as mine where
Speaker 1: you have to remind them to brush their teeth, which
Speaker 1: is a disgusting idea that you have to remind someone
Speaker 1: to brush their teeth. But here we are, we're parents,
Speaker 1: we understand this, um. And yet those are the sorts
Speaker 1: of things that we don't uh necessarily think about in
Speaker 1: a figurative sense in terms of how we operate in
Speaker 1: the in the virtual world. And I think another important
Speaker 1: concept is resilience. So it's the idea that that's the
Speaker 1: way that reality works, and we need to do things
Speaker 1: in a survival by way, uh, in ways that comply
Speaker 1: with regulations. Um, you know, we we need to be
Speaker 1: better at doing it. We need to clean up the
Speaker 1: the d n A and and and the backbone of
Speaker 1: how this stuff works and um you know security too.
Speaker 1: But really I've been trying to shift um, you know,
Speaker 1: the way that I'm doing business around that concept resilience.
Speaker 1: And so what does resilience sort of look like in practice? Yeah?
Speaker 1: For companies? Yeah, I think that what we've seen in
Speaker 1: the last couple of years as this trend towards destructive attacks,
Speaker 1: destructive breaches where for for years and years it was
Speaker 1: like somebody stole your data again, Um, but now we've
Speaker 1: seen more and more, like big companies being down for days,
Speaker 1: weeks longer. Um. And so we need to be able
Speaker 1: to survive that sort of an attack. Um. I believe
Speaker 1: by being able to just stand up all of your
Speaker 1: infrastructure somewhere else, which means you really have to understand
Speaker 1: how it works. Um. And it also sounds like you
Speaker 1: need sort of the buy in beyond the I T department.
Speaker 1: For too long, these things have been he's like, oh,
Speaker 1: that's an I T problem, or that's a problem for
Speaker 1: the security guy, or that's a problem for like the
Speaker 1: tech guy who's gonna fix my phone. Yeah. Well, and
Speaker 1: you know another issue is when you when you go
Speaker 1: into then moderately sized environments, I T has become so
Speaker 1: complicated that people don't really understand how it works anymore. Right. So, um,
Speaker 1: so much of this is our ability to understand it
Speaker 1: right to begin with. So, so, okay, we need to
Speaker 1: make it resilient. How does it really work? Um? You know,
Speaker 1: we we use a bunch of automated ways of doing that,
Speaker 1: but you know, I think we can kind of apply
Speaker 1: that principle to individuals. Right, Right, let's talk about how
Speaker 1: all of the stuff you use online really works, Like
Speaker 1: a half an hour of that can help people really
Speaker 1: understand how to protect themselves. Well, it's a great conversation
Speaker 1: to keep on having A really grateful fee for spending
Speaker 1: some time with me, Greg Virgin, CEO over at Red Jack.
Speaker 1: He is part of the nine eleven Memorial and Museum
Speaker 1: summit on security here in Lower Manhattan. Thank you so much.
Speaker 1: A nice segue from our last conversation with Greg Virgin
Speaker 1: to Craig Newmark. You probably know him is the guy
Speaker 1: who created Craigslist. Yep, he's that Craig. He's spending a
Speaker 1: lot of time in the philanthropic world right now, including
Speaker 1: talking about election security, and that is why he's here.
Speaker 1: Check out this conversation. The country is facing an attack,
Speaker 1: particularly on the integrity of our elections. I feel that
Speaker 1: I can modestly help the people doing the real job
Speaker 1: of protecting our elections, which is the same as protecting
Speaker 1: our country. My contributions are modest, but somebody's got to
Speaker 1: do it. And so, how did you come to this?
Speaker 1: Because you've been very specific and focused. It feels like
Speaker 1: in your philanthropy you have identified I believe, sort of
Speaker 1: three major areas. How did this become one of them. Well,
Speaker 1: came through the confluence of an of a number of paths.
Speaker 1: One is that I'm interested in cybersecurity, and yet our
Speaker 1: foreign and domestic adversaries are attacking voting systems using cybersecurity methods.
Speaker 1: There's also information warfare, where bad guys are using so
Speaker 1: called influence operations or maybe just call them dirty tricks
Speaker 1: to attack elections, to attack voting rights, that kind of thing.
Speaker 1: And finally, in my interest in a journalism and related ethics,
Speaker 1: a lot of what the bad guys are doing are
Speaker 1: trying to uh, trying to paralyze our country by getting
Speaker 1: disinformation like conspiracy theories into mainstream news, and one of
Speaker 1: the worst effects of that is to get Americans angry
Speaker 1: at each other for no real reason. These are ways
Speaker 1: that our foreign adversaries and their domestic allies are hurting
Speaker 1: the country and hurting our elections. What was the if
Speaker 1: there was a moment, what was the aha moment for you?
Speaker 1: What did you see out there? Was there a certain action,
Speaker 1: was there a certain election? What was it? Well, in
Speaker 1: recent times it was the two thousands sixteen election. But
Speaker 1: as I think more and more about my motivations, I
Speaker 1: think about my high school U. S History teacher Mr.
Speaker 1: Schilsky forty fifty years ago telling us the importance of
Speaker 1: the free press and protecting the Bill of Rights as
Speaker 1: amended prior to that in Sunday School, Mr and Mrs
Speaker 1: Levin saying that bearing false witness is bad and that
Speaker 1: we should strive to prevent that. Um. That sounds a
Speaker 1: little bit Pollyanna, but those are my motivations speaking as
Speaker 1: a nerd a guy who takes things literally right well,
Speaker 1: and you have very much embraced your nerd um over
Speaker 1: the years, and and clearly that led you to be
Speaker 1: I don't think it's hyperpoly to say, you know, one
Speaker 1: of the most influential people in really creating the modern
Speaker 1: Internet are certainly the way that we use it. What
Speaker 1: have you seen in terms of the unintended consequences? I
Speaker 1: guess I've seen a lot of good people connecting for
Speaker 1: the common good. But then I've also seen the very
Speaker 1: small number of people working in the other to hurt
Speaker 1: other people. Uh. In the beginning of the net, we
Speaker 1: didn't prepare well to handle the bad guys. We're learning
Speaker 1: how to do that now, we're learning how to make
Speaker 1: the Internet a much more resilient place. And when you
Speaker 1: think about what is working in terms of solving those goals,
Speaker 1: you're funding a lot of those efforts. What is working well,
Speaker 1: what's beginning to work is that people doing good work
Speaker 1: solving pieces of the entire puzzle. They're making progress with
Speaker 1: those pieces. But people like me are getting the people
Speaker 1: who are so far isolated, getting people to talk with
Speaker 1: each other to combine their efforts. That's maybe the biggest
Speaker 1: single thing I'm doing. I'm getting to talk with each other.
Speaker 1: I'm getting to alert the public of what's going on.
Speaker 1: And you know, because I've I've been lucky and I've
Speaker 1: been privileged, I can write some checks to help the
Speaker 1: good guys work together to defeat the bad guys. So
Speaker 1: one of the interesting things, Craig, is this intersection of
Speaker 1: your work around journalism and around election security. What is
Speaker 1: that nexus? Well, the immediate nexus is two wells is too.
Speaker 1: Part one is that bad guys a foreign adversaries and
Speaker 1: the domestic allies. I figured out how to game the rests,
Speaker 1: meaning they figured out how to introduce disinformation and generally
Speaker 1: phony news such that American citizens don't get the information. Uh,
Speaker 1: they need to make smart decisions Meanwhile, they're also using
Speaker 1: cybersecurity techniques to attack our voting systems, possibly in subtle ways.
Speaker 1: For example, um, they're working with oh their domestic allies
Speaker 1: to purge voters who shouldn't be purged. What's worse is
Speaker 1: we fear that they might do things like taking a
Speaker 1: legit amid election the registration record, tinkering with it such
Speaker 1: that when the person goes to vote, they have to
Speaker 1: file a provisional ballot. And if a bunch of people
Speaker 1: do that, that slows down the line a lot. The
Speaker 1: thing is, we know that's a thing, and that's a
Speaker 1: thing that can be prevented, and people like me work
Speaker 1: with the people who do the actual operations. Again, my
Speaker 1: contributions are small. I get people to talk to each
Speaker 1: other and help out. Um, that's not a big thing
Speaker 1: in itself. But a NERD's gotta do what a NERD's
Speaker 1: gotta do, and that is the self describe nerd. Founder
Speaker 1: of Craigslist, Craig Newmark himself spending most of his time
Speaker 1: on his philanthropic efforts around election security, supporting independent and
Speaker 1: fair journalism as well. I caught up with him here
Speaker 1: at the eleven Memorial and Museum Summit on Security. Thanks
Speaker 1: for listening to Bloomberg Business Week. You can subscribe to
Speaker 1: the podcast on iTunes, SoundCloud, or Bloomberg dot com. You
Speaker 1: can also listen to our radio show every weekday at
Speaker 1: two pm Eastern only on Bloomberg Radio h