Speaker 1: Welcome to tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio
Speaker 1: and a love of all things tech. And recently, the
Speaker 1: Pentagon's former chief of software, Nicholas Hilan, resigned, and he
Speaker 1: did not go quietly into that good resignation. No, he
Speaker 1: posted an explanation of why he chose to quit on LinkedIn,
Speaker 1: and he cited lots of very valid reasons for frustration.
Speaker 1: He expressed anger at how he would have to try
Speaker 1: and chase down budgets in order to fund any sort
Speaker 1: of project or research or development and deployment, and just
Speaker 1: you know how hard that was and exhausting and never ending.
Speaker 1: He pointed out how the US military complex is still
Speaker 1: focused largely on trip aditional weapons systems like fighter jets
Speaker 1: and guns and stuff, and not so much on the
Speaker 1: digital side of warfare. He argued that China is so
Speaker 1: far ahead of the United States in this regard, along
Speaker 1: with its advances and artificial intelligence, that the cyber war
Speaker 1: is effectively over already in China's already won. So today
Speaker 1: I thought I would really tackle these issues and examine
Speaker 1: them are his frustrations all valid? Has the United States
Speaker 1: lost the cyber war already? Well, the first thing we
Speaker 1: should do is acknowledge that cybersecurity in the United States,
Speaker 1: particularly at the federal level, like not a specific company
Speaker 1: or specific trend, but looking at federal cyber security, it's
Speaker 1: pretty lousie, particularly for you know, critical organizations like the
Speaker 1: Department of Defense. And there are many reasons why this
Speaker 1: is so. Some of those reasons are fairly intuitive, which
Speaker 1: means I'm still going to go over them because that's
Speaker 1: how I roll. For example, we know that technology advances
Speaker 1: at a really rapid pace. Uh not all technology evolves
Speaker 1: at the same speed, you know, not all of it
Speaker 1: goes super fast. Gordon Moore observed that because of you know,
Speaker 1: multiple factors, primarily market based ones, the number of discrete
Speaker 1: components that we could cram on a square inch of
Speaker 1: silicon would double every two years or so. Now that
Speaker 1: observation became Moore's law, and today we usually interpret that
Speaker 1: as meaning that a new computers processor will be twice
Speaker 1: as powerful as the ones from two years before. So
Speaker 1: the computers of today are twice as fast or can
Speaker 1: compute twice as much. In the same amount of time
Speaker 1: as the computers we produced two years ago and so on. Now,
Speaker 1: for multiple reasons, we've had to find new methods to
Speaker 1: try and keep Moore's law active. It's not it's not
Speaker 1: a guarantee. It was an observation, and now it's almost
Speaker 1: like a challenge. So there's there's nothing that says that
Speaker 1: this trend will continue forever. In fact, you know, we
Speaker 1: might be able to kind of keep the trend going
Speaker 1: by fudging some of the definitions and changing up the
Speaker 1: way as we do things. But my point is that
Speaker 1: this particular subcategory of tech has a really aggressive trend
Speaker 1: when it comes to advancement or evolution. Well, not everything
Speaker 1: advances that quickly, like battery technology is a great example
Speaker 1: of tech that has a much slower evolutionary path, but
Speaker 1: a lot of stuff does change pretty fast. The world
Speaker 1: of software is another example. Developers generate enormous amounts of
Speaker 1: code every single day. Some are working on mission critical
Speaker 1: systems that play a part in important organizations like the
Speaker 1: Department of Defense, uh saw are making the next version
Speaker 1: of Candy Crush. But the point is that software development
Speaker 1: happens super fast, and sometimes developers might overlook things that
Speaker 1: can lead to a potential vulnerability in the system. Like there,
Speaker 1: they might be focused more on I need to make
Speaker 1: this code work, and less on is there some way
Speaker 1: that someone could leverage this code in a way I
Speaker 1: did not intend. Now, in an ideal world, every developer
Speaker 1: out there would have plenty of time to test code
Speaker 1: thoroughly and conduct some penetration testing to make sure that
Speaker 1: the code doesn't have any vulnerabilities in it before ever
Speaker 1: deploying it. But in the real world we run up against,
Speaker 1: you know, stuff like deadlines and and budgets. These are
Speaker 1: things that mean that sometimes we have to push stuff
Speaker 1: out the door before we can do all the testing
Speaker 1: we would like. So sometimes we see code deployed that
Speaker 1: does have gaps in it, gaps that determined hacker might
Speaker 1: discover and exploit. Nelly. Important element for us to consider
Speaker 1: here is that all this development in tech, from hardware
Speaker 1: to software and all the related fields, it's happening all
Speaker 1: the time. The world of tech really drives home what
Speaker 1: the Greek philosopher Heraclitis said way back in around four
Speaker 1: b C, which is the only thing constant is change.
Speaker 1: The tech world is fast paced and fluid. Now let's
Speaker 1: talk about the world of policy and governments. Governments cannot
Speaker 1: be nearly as nimble as the tech sector. Governments move
Speaker 1: at a much slower pace, glacial, some might say, depending
Speaker 1: upon their point of view. So forming policy takes time.
Speaker 1: You have to have someone to propose it, for one thing,
Speaker 1: and then that person has to get buy in from
Speaker 1: other parties in order to form a plan of action.
Speaker 1: There has to be a vote on that plan of
Speaker 1: action to make sure their support for it. There needs
Speaker 1: to be a budget assigned to that plan of action.
Speaker 1: There's got to be someone in charge. There needs to
Speaker 1: be deliverable as assigned, and some means of holding the
Speaker 1: project accountable for achieving the goals that are set out
Speaker 1: by the policy. You need to have metrics these steps
Speaker 1: I'll take a lot of coordination, cooperation, and time. Complicating
Speaker 1: matters is the fact that in the United States the
Speaker 1: average age of federal level policy makers is pretty up there.
Speaker 1: So right now in the US, the average age in
Speaker 1: the US Senate is sixty four point three years old.
Speaker 1: The average age in the House of Representatives is fifty
Speaker 1: eight point four years old. Now, generally speaking, the average
Speaker 1: American is twenty years younger than the representative who you
Speaker 1: know represents them. Now. I don't want to engage in
Speaker 1: ages um here, especially since I'm forty six. I'm no
Speaker 1: Spring Chicken. I don't want to make too many generalizations. However,
Speaker 1: there is something to be said about people who have
Speaker 1: spent a career in politics who might not be the
Speaker 1: most tech savvy individuals out there. In fact, if you
Speaker 1: do a search on how tech savvy is Congress, you're
Speaker 1: gonna find numerous pieces about how Congress is woefully behind
Speaker 1: the times when it comes to even a basic understanding
Speaker 1: of where tech is and what it is capable of.
Speaker 1: The gap and knowledge with regard to tech is a
Speaker 1: serious problem. And in case you think I'm being hyperbolic here,
Speaker 1: I'll point to one of those tech savvy articles I
Speaker 1: just mentioned. This is something that I really feel you
Speaker 1: should read if you have the chance. It's titled How
Speaker 1: Congress Got Dumb on Tech and how it can get Smart.
Speaker 1: It was written by Grace Gedyer and published in Washington Monthly.
Speaker 1: Grace's piece details how some members of Congress have never
Speaker 1: so much as sent out an email. Okay, so email,
Speaker 1: in case you're not aware, dates back to the early
Speaker 1: nineteen seventies. So let that sink in for a second.
Speaker 1: There are politicians who are at least theoretically representing the
Speaker 1: interests of citizens who live in those politicians districts, and
Speaker 1: these politicians are unfamiliar with the technology that was invented
Speaker 1: fifty years ago, half a century ago. So how up
Speaker 1: to speed do you think these same people are going
Speaker 1: to be when it comes to stuff like a distributed
Speaker 1: denial of service attack or state sponsored hacker groups. Now
Speaker 1: I'll give you a specific example of an embarrassing lack
Speaker 1: of understanding. Recently, the governor of Missouri, Mike Parson, accused
Speaker 1: a reporter from the St. Louis Post Dispatch that's a newspaper,
Speaker 1: of being a hacker. Now, what the reporter had done
Speaker 1: was found out that the HTML code on a Missouri
Speaker 1: Department of Education website contained the private information of school
Speaker 1: teachers and administrators, including things like social security numbers. Now,
Speaker 1: that private inform ation was not visible on the web
Speaker 1: page itself if you were looking at the web page,
Speaker 1: it wasn't right out in front of everything. But if
Speaker 1: you looked at the HTML code, you could see it.
Speaker 1: So Governor Parson said the reporter was a hacker and
Speaker 1: should be prosecuted. Now, some of you all out there
Speaker 1: are probably already saying, what excuse me? So if you
Speaker 1: are not aware web browsers, let you look at the
Speaker 1: underlying HTML code of a page. And this is a
Speaker 1: great tool if you're building a web page. Being able
Speaker 1: to switch between what you see in a browser and
Speaker 1: the HTML code can help you troubleshoot problems. If you're
Speaker 1: learning HTML. Using this, let's you see how any given
Speaker 1: web page is set up. You can actually look at
Speaker 1: the code and say, oh, so that's how they did that.
Speaker 1: More importantly, it's super easy to do in Chrome, for example.
Speaker 1: In order to look at the HTML code for any
Speaker 1: web page doesn't have to be a web page, you won't,
Speaker 1: it's any web page. All you do is right click
Speaker 1: on the web page and you choose view page source
Speaker 1: and it will give you the HTML code. Alternatively, you
Speaker 1: could just hold down the control button and type the
Speaker 1: letter you Boom, you got the HTML code, no hacking involved.
Speaker 1: You can do it on any web page and like
Speaker 1: you know, when you think about it, that's essentially the
Speaker 1: code that the web browser receives. Then the web browser says, oh,
Speaker 1: this code means that the page needs to look like this,
Speaker 1: and that's why you see it the way it is
Speaker 1: on your screen. So there there shouldn't be anything in
Speaker 1: the HTML code that is bad like that shouldn't be
Speaker 1: there because ultimately HTML is just instructions for your web browser,
Speaker 1: so that knows how to display the information there. And
Speaker 1: that's my point. Governor Parson didn't or perhaps still to
Speaker 1: this day, doesn't understand that there's no hacking going on here.
Speaker 1: This is a browser tool working as intended. It's something
Speaker 1: anyone can do with no training, which means the State
Speaker 1: of Missouri was negligent and exposed the private information of
Speaker 1: a lot of people to anyone who just happened to
Speaker 1: look at the HTML source code. At best, you could
Speaker 1: say that Governor Parson was deflecting, attempting to shift the
Speaker 1: blame and hold the reporter responsible for an error that
Speaker 1: the state had made. At worst, you would have to
Speaker 1: say Governor Parson just playing doesn't understand web browsers, which
Speaker 1: doesn't necessarily fill you with confidence that he understands any
Speaker 1: other matters relating to technology and and seeing how tech
Speaker 1: plays such an important part two pretty much everything we
Speaker 1: do all the time these days. This is a huge challenge.
Speaker 1: After all, its Congress's job to form laws and regulations
Speaker 1: at the federal level, and at the state level we
Speaker 1: see the same sort of sing I'm concentrating on the
Speaker 1: federal level because otherwise it starts getting really fragmented. But
Speaker 1: the same thing holds true in states too. If Congress
Speaker 1: at the federal or state level, doesn't have a full
Speaker 1: understanding of technology, how can we expect them to regulate
Speaker 1: it or to form policies that makes sense. So we're
Speaker 1: literally seeing a growing chasm between the fundamental ways technology
Speaker 1: plays a part in our lives and politicians understanding of technology.
Speaker 1: For some, you might as well substitute the word magic
Speaker 1: for technology. You know, as Arthur C. Clark said in
Speaker 1: his Third Law, any sufficiently advanced technology is indistinguishable from magic. Well,
Speaker 1: it appears that, at least for some politicians, the advance
Speaker 1: and technology doesn't have to be particularly impressive Web browsers,
Speaker 1: they'll do the trick. Now, I'm not saying politicians all
Speaker 1: need to become engineers or computer scientists, and politicians can
Speaker 1: and do rely upon subject matter experts to help them
Speaker 1: navigate unfamiliar territory. Whether the politicians grasp what those experts
Speaker 1: are saying is a matter for debate, but at the
Speaker 1: very least they do call upon experts. If you've ever
Speaker 1: watched any video or read any transcripts of these types
Speaker 1: of meetings, even if it's something like one of the
Speaker 1: times where you know, Facebook representatives have to appear before Congress,
Speaker 1: if you look at those transcripts, you might walk away
Speaker 1: with a pretty low opinion of some of the politicians,
Speaker 1: at least when it comes to their you know, tech savvy.
Speaker 1: You might also take issue with the saying there are
Speaker 1: no such thing as as dumb questions, because after reading
Speaker 1: one of those transcripts, you'd say, I beg to differ. Now,
Speaker 1: this also means there can be a certain lack of
Speaker 1: urgency on the part of political leaders to address matters
Speaker 1: that relate to tech unless they feel that it's directly
Speaker 1: threatening them, and this has both good and bad consequences.
Speaker 1: One of the good consequences is that we don't frequently
Speaker 1: see US politicians rush to fund some tech initiative that
Speaker 1: is completely unproven or unsuitable. We're not seeing you know,
Speaker 1: taxpayer money thrown at problems without due consideration. In this regard. Typically,
Speaker 1: most politicians are a bit cautious when it comes to
Speaker 1: authorizing money for something they don't actually understand. And in
Speaker 1: some cases this is a good thing. On the bad side, well,
Speaker 1: we don't see enough support for strategies that could do
Speaker 1: a lot of good either. And there are threats out
Speaker 1: there and they are there here now. So for several reasons,
Speaker 1: politics moves at different pace than tech. One other one
Speaker 1: I didn't really cover is that, of course we elect
Speaker 1: politicians and these processes because they can take so long,
Speaker 1: sometimes they will span beyond one person's term of office.
Speaker 1: And when people change in offices, often we will see
Speaker 1: priorities change and we'll see support for stuff shift, and
Speaker 1: that can slow things down again because again, politics, you know,
Speaker 1: works on its own kind of time frame and its
Speaker 1: own cycles, and that can be disruptive for things where
Speaker 1: you know you're trying to put in a cybersecurity policy.
Speaker 1: This is really problem no one this this timing issue
Speaker 1: when it comes to creating a strong cybersecurity policy, because
Speaker 1: just getting the policy makers up to speed as a challenge.
Speaker 1: Getting that buy in is hard, and there's always the
Speaker 1: possibility that someone will have a misguided but compelling approach
Speaker 1: and then we'll go down the wrong path. Like, you know,
Speaker 1: if I were to appear in front of Congress and
Speaker 1: if I made an impassioned appeal for a certain path
Speaker 1: towards security, and it really did sound like I knew
Speaker 1: what I was talking about, I might get support even
Speaker 1: if I'm totally wrong, just because I sound like I'm
Speaker 1: an authority. That's what we call an appeal to authority.
Speaker 1: That's an argument which I claim that my credentials stand
Speaker 1: as evidence that my argument is sound. The argument doesn't
Speaker 1: have to stand on its own. I'm using my credentials
Speaker 1: as if that is enough to say this is the
Speaker 1: way we need to go. That's actually a fallacy. It's
Speaker 1: the sort of thing that a debate club would jump
Speaker 1: on right away, and in fact, a lot of people
Speaker 1: in Congress would probably do it too, because a lot
Speaker 1: of those folks started off in debate club. Well. Even
Speaker 1: when things go well, when Congress is getting good guidance
Speaker 1: from thought leaders in cybersecurity, when they fashion policies that
Speaker 1: are effective and on point, the process can still be
Speaker 1: slow enough that by the time the policy becomes active,
Speaker 1: the field has changed enough so that whatever protection was
Speaker 1: offered has been compromised in the process. Because it's no
Speaker 1: longer the best practices, right, Like, by the time you
Speaker 1: finally get to the point where now we can put
Speaker 1: this into place, best practices have evolved beyond that. That's
Speaker 1: not to say that the policies are completely worthless, but
Speaker 1: rather that they're always lagging behind. It is the state
Speaker 1: of the art and technology. Now, when we come back,
Speaker 1: we'll look at another matter that affects US cyber strategies,
Speaker 1: and well, it's all about the Benjamin's baby. Let's take
Speaker 1: a quick break. Okay, we're gonna move on to other
Speaker 1: issues that complicate matters when it comes to formulating an
Speaker 1: effective national cybersecurity strategy, and a huge one is organization. Alright,
Speaker 1: so we often refer to the Pentagon as an organization,
Speaker 1: but it's really a massive building. The Pentagon is a
Speaker 1: structure of physical structure. It is the headquarters for the
Speaker 1: United States Department of Defense. So when we say the Pentagon,
Speaker 1: we're often actually referring to the do o D, the
Speaker 1: Department of Defense, not the physical building. So I will
Speaker 1: occasionally be using Pentagon in that regard in this podcast.
Speaker 1: The Department of Defense has three main sub departments within it,
Speaker 1: the Army, the Navy, which also has the Marines in it,
Speaker 1: and the Air Force. And there are other agencies within
Speaker 1: the d o D. For example, there's the Defense Advanced
Speaker 1: Research Projects Agency that's DARPA. You also have the National
Speaker 1: Security Agency that's ESSAY, that's part of the d D two.
Speaker 1: And then each of the three main departments, the Army,
Speaker 1: the Navy, and the Air Force all have multiple agencies
Speaker 1: and divisions under them. So if you had an organ
Speaker 1: chart for the Department of Defense that was even just
Speaker 1: a few levels deep, it would just be massively complicated.
Speaker 1: There'll be interconnecting relationships and potentially a few cases where
Speaker 1: it might be confusing to see who reports to whom.
Speaker 1: Sometimes that can be confusing to the people in the
Speaker 1: organizations themselves. Now within this organization of organizations, you've got
Speaker 1: different departments responsible for stuff like establishing, maintaining and protecting networks.
Speaker 1: You've got different groups that are running on different pieces
Speaker 1: of hardware and software. Some might be locked into systems
Speaker 1: that no longer get support, and we call these legacy systems.
Speaker 1: This is a problem a lot of us encounter in technology,
Speaker 1: not just in the government sphere, but it can happen
Speaker 1: in businesses too. So if you've ever bought a product,
Speaker 1: like let's say that you bought a computer from a company,
Speaker 1: and later on down the line, that computer company goes
Speaker 1: out of business, Well, you might find yourself kind of
Speaker 1: stuck because you're no longer going to get support from
Speaker 1: that company. Right if they were uh previously releasing like
Speaker 1: firmware updates for your for your device, You're not going
Speaker 1: to get those anymore because the company doesn't exist anymore.
Speaker 1: So the stakes become higher because now you're relying on
Speaker 1: something that no longer has support from the manufacturer, but
Speaker 1: you're still dependent upon it. I see this happen with
Speaker 1: like back end systems a lot where a company will
Speaker 1: invest a lot of money into a back end system
Speaker 1: and build pretty much its entire infrastructure on top of
Speaker 1: this back end system. That system will age out, but
Speaker 1: to migrate everything off of that system onto something else
Speaker 1: would be an enormous uh sink of of money and
Speaker 1: time and other resources, and it's a nightmare. So again,
Speaker 1: this happens in companies, not just in governments, but when
Speaker 1: it happens in governments it's particularly rough. Um, you know,
Speaker 1: the organization ends up building products on top of this
Speaker 1: and the underlying stuff is the foundation, and when it
Speaker 1: does come time to migrate, you've got to figure out, well,
Speaker 1: how can I do this without interrupting services. For a company,
Speaker 1: that's important because you want to keep generating revenue. For
Speaker 1: a government, that's important because you've got to keep governing. Right,
Speaker 1: you can't just say like, all right, well y'all all
Speaker 1: just behave and uh, well you're gonna go away for
Speaker 1: a month and migrate our systems on the new new network. Uh,
Speaker 1: then we'll be back and you know, whatever is not
Speaker 1: on fire, I'm sure it's fine, and anything that is
Speaker 1: on fire, we'll get to it. Like, you can't do that,
Speaker 1: So it's a huge challenge. So there are government offices
Speaker 1: that are, you know, at least partly dependent upon legacy systems,
Speaker 1: and these systems sometimes they have vulnerabilities, you know, just
Speaker 1: like any other system. They can have things where it
Speaker 1: was an oversight and some intruder has figured out here's
Speaker 1: my entry point into this network. And without ongoing support,
Speaker 1: you know, those vulnerabilities go unaddressed. There's no patch for them.
Speaker 1: So that means if you are someone who is determined
Speaker 1: to exploit a system and you happen to know what
Speaker 1: hardware or software is being used within that organization. You
Speaker 1: can perhaps formulate a plan of attack that leverages that
Speaker 1: vulnerable system, and you can have a pretty decent level
Speaker 1: of confidence that you'll be able to pull it off
Speaker 1: because chances are no one's patched that vulnerability. It's why
Speaker 1: some experts call for a more modular approach when it
Speaker 1: comes out to planning network architecture. That way, administrators can
Speaker 1: swap out modules within the network architecture if necessary, particularly
Speaker 1: if they're working with stuff that's open source, where you know,
Speaker 1: the open source community finds and addresses vulnerabilities at a
Speaker 1: very quick pace, so that you're constantly with the most secure,
Speaker 1: most recent version of whatever it is you're working on. Okay, So,
Speaker 1: there are also a few big authorities in the federal
Speaker 1: government that are concerned with cybersecurity. For example, the Department
Speaker 1: of Homeland Security has the Cybersecurity and Infrastructure Security Agency
Speaker 1: or sees A c I s A. Uh So, there
Speaker 1: are some that are important when it comes to stuff
Speaker 1: like rolling out standards that all agency offices should follow,
Speaker 1: and once you get past that, there's a much more
Speaker 1: fractured landscape. A Senate report in two thousand nineteen recommended
Speaker 1: a more coordinated approach to cybersecurity to try and bring
Speaker 1: things into kind of a more focused effort, because what
Speaker 1: we were seeing is a very patchwork approach towards UH
Speaker 1: design and implementation of cybersecurity measures. Then you've got stuff
Speaker 1: like budgets to contend with. Every single department has its
Speaker 1: own budget and that gets funneled down into different sub
Speaker 1: departments and projects. So when it comes to weapons systems development,
Speaker 1: the typical approach is to spend thirty of your budget
Speaker 1: on development and procurement and the other goes to sustaining
Speaker 1: the weapons system and maintaining it. Now, that's according to
Speaker 1: Heidi Shiu, who is the current Under Secretary of Defense
Speaker 1: for Research and Engineering UH. She had previously served as
Speaker 1: the Assistant Secretary of the Army for Acquisition, Logistics, and Technology,
Speaker 1: so she has a history with the process of setting up,
Speaker 1: you know, weapons systems and technology systems. So when we
Speaker 1: talk about cybersecurity on a national scale, that actually does
Speaker 1: overlap with weapons systems, both from an you know, an
Speaker 1: attack perspective and a defense perspective. So we're not talking
Speaker 1: about traditional weapons. We're not talking about guns or tanks
Speaker 1: or missiles or anything like that. And that's kind of
Speaker 1: show use point. She was saying that that thirties seventies
Speaker 1: split to procurement and deployment and to sustaining. That doesn't
Speaker 1: really make sense when you're looking at it from a
Speaker 1: cyber front, and that really we should flip that ratio
Speaker 1: around with sevent budgets being dedicated to development and procurement
Speaker 1: and reserved to sustaining and maintaining weapons systems. So budgets,
Speaker 1: by their nature, not only limit how much we can
Speaker 1: spend on any given thing, but how we can spend
Speaker 1: money on that thing. And if we adhere to the
Speaker 1: older philosophy as we hinder our efforts to get up
Speaker 1: to speed in the digital realm. As Nicholas La pointed
Speaker 1: out in his resignation, getting those budgetary dollars is a
Speaker 1: never ending pursuit. You have to get buy in from
Speaker 1: the people who oversee the budgets. You have to make
Speaker 1: your case that the money would be well spent on
Speaker 1: a specific endeavor. You have to provide a means to
Speaker 1: show that the project is staying as close to being
Speaker 1: on deadline and under budgets you can possibly manage. It's
Speaker 1: really a game of numbers and politics, and meanwhile, you
Speaker 1: still have those actual threats out there in the real
Speaker 1: world to worry about. So budgets can also be seen
Speaker 1: as an issue when it comes to attracting talent, and
Speaker 1: just addressing that takes time in the world of policy.
Speaker 1: So back in two thousand and fourteen, the Department of
Speaker 1: Homeland Security requested and got the authority to create a
Speaker 1: new personnel system with the goal of attracting more talent,
Speaker 1: specifically in the field of cybersecurity and cyber warfare. See,
Speaker 1: that is a thriving yield, and the private sector pays
Speaker 1: really well for that kind of talent. So getting a
Speaker 1: qualified person to agree to come and work for the
Speaker 1: government at a salary and benefits that might be significantly
Speaker 1: lower than what they would find elsewhere in the market,
Speaker 1: that's a hard sell. Like, Hi, I know that you
Speaker 1: could make three times as much working for company X,
Speaker 1: but why not you work for us? So the Department
Speaker 1: of Homeland Securities goal was to streamline the process, to
Speaker 1: knock down some of the requirements that applicants would need
Speaker 1: to meet in order to be considered to work for,
Speaker 1: you know, the federal government, and to improve things like
Speaker 1: you know how much they would make. Even that process
Speaker 1: took several years, with the department recently, you know, actually
Speaker 1: bringing this talent management program online. So it was started,
Speaker 1: you know, the start the process started in two thousand fourteen.
Speaker 1: Really it's only been active for a short while and
Speaker 1: it's now so we do see changes over time, but
Speaker 1: now there's a lot of loss time to make up.
Speaker 1: Right now, let's talk about the d o d S
Speaker 1: track record when it comes to actually following through on
Speaker 1: cybersecurity projects, because they have set projects even with all
Speaker 1: these challenges in place, the agencies within the d o
Speaker 1: D have tried to set specific goals for cybersecurity. So
Speaker 1: how do they do well? It ain't great. The Government
Speaker 1: Accountability Office or g AO reviewed the d d S
Speaker 1: cyber hygiene initiatives. These projects were meant to improve overall
Speaker 1: cybersecurity practices and procedures within the Department of Defense, and
Speaker 1: the g AO found that the status of many of
Speaker 1: those projects was incomplete and and at least some cases unknowable,
Speaker 1: which is a big old yikes. So, for example, the
Speaker 1: d o D created a cyber Discipline Plan, and this
Speaker 1: plan identified seventeen preventable vulnerabilities in various networks within the
Speaker 1: Department of Defense and these needed to be addressed, like
Speaker 1: there needed to be a way to patch these vulnerabilities.
Speaker 1: So the d D Chief Information Officers Office became accountable
Speaker 1: for ten of those seventeen identified preventable vulnerabilities, and the
Speaker 1: goal was to have of the projects completed by the
Speaker 1: end of the fiscal year of two thousand eighteen. Now,
Speaker 1: when that time came around, only six of those tasks
Speaker 1: were implemented. Four had not been. So remember ten were
Speaker 1: assigned to this office. Six we're complete, four we're not.
Speaker 1: So by my reckoning, that's a six completion of the tasks,
Speaker 1: not a nine d percent. That's not good. But it
Speaker 1: does get worse because remember I said that the total
Speaker 1: number of preventable vulnerabilities that this program identified was seventeen.
Speaker 1: Only ten of those were given to the CIO office,
Speaker 1: So what about the other seven? You know, that's a
Speaker 1: really darn good question, and sadly it's a question that
Speaker 1: we do not have an answer to. The g AO
Speaker 1: found that no Department of Defense entity had been designated
Speaker 1: to be in charge or to report on those vulnerabilities,
Speaker 1: so the status was unknowable. You could probably make a
Speaker 1: good argument that the vulnerabilities probably went unaddressed since no
Speaker 1: one was assigned accountability to them. It would at least
Speaker 1: be the wisest to move forward under the assumption that
Speaker 1: no one had done anything about them. But the g
Speaker 1: a O was really saying, how can you hope to
Speaker 1: improve cyber hygiene if you don't have any way to
Speaker 1: measure or monitor progress on your goals. Another thing the
Speaker 1: g a O found was that while d D personnel
Speaker 1: were to take cyber awareness training courses, a lot of
Speaker 1: departments within the Department of Defense lacked any information about
Speaker 1: who had or had not actually gone through the training.
Speaker 1: And since network access was supposed to be continggent upon
Speaker 1: taking the training, this meant that people who may not
Speaker 1: have followed the required process continue to have access to
Speaker 1: the system. So the g a O found that project administration,
Speaker 1: accountability and follow through was lacking in the d o
Speaker 1: D when it comes to cyber hygiene. So there's yet
Speaker 1: another problem on top of the ones we've already talked about.
Speaker 1: So on the one hand, you could argue that, but
Speaker 1: you know, with bureaucracies that are as labyrinthian as the
Speaker 1: Department of Defense, you can see how things can get
Speaker 1: lost in the shuffle. But on the other hand, you
Speaker 1: can also see the conditions that would lead someone to
Speaker 1: resign in frustration when it's their job to try and
Speaker 1: get things up to speed. You just you see the
Speaker 1: mountain of work you have to do and the fact
Speaker 1: that as you're addressing one problem, other problems could be
Speaker 1: getting worse. It just becomes a never ending quest. Now
Speaker 1: we've seen some other efforts meant to try and get
Speaker 1: a handle on things in the d o D s
Speaker 1: under Secretary of Research and Engineering put out a request
Speaker 1: for information to federal agencies in order to lay out
Speaker 1: a roadmap on creating effective cybersecurity strategies not just for today,
Speaker 1: but for the next couple of decades. So the goal
Speaker 1: was to get a look at what the Pentagon's capabilities
Speaker 1: are right now, as well as to create projections of
Speaker 1: what future threats could look like. So there are definitely
Speaker 1: people working on these problems, they just have really big
Speaker 1: challenges in front of them. One thing the d o
Speaker 1: D is implementing is what's called a zero trust model.
Speaker 1: This is a system in which users must continuously verify
Speaker 1: their identity even within a session, to ensure that the
Speaker 1: person who is accessing any given system actually has the
Speaker 1: authority to do that. Some of that became really necessary
Speaker 1: in the wake of COVID nineteen because people would frequently
Speaker 1: need to work from home, and granting access to critical
Speaker 1: systems for mote workers comes with a big risk. So
Speaker 1: implementing a system that requires frequent identify identity verification is
Speaker 1: one way to kind of mitigate that risk. Okay, when
Speaker 1: we come back, we're going to talk about cybersecurity threats
Speaker 1: and Chilan's belief that the US has already lost the
Speaker 1: cybersecurity war against China. But first, let's take this quick break. Okay,
Speaker 1: whither China? How how are things looking when we are
Speaker 1: looking at China as a potential threat? Uh with regard
Speaker 1: to cyber warfare. Well, first of all, it's not just
Speaker 1: potential threat, it's a real threat. We have seen attacks
Speaker 1: including ransomware attacks, supply chain attacks that link back to
Speaker 1: hacker groups that either we know or suspect are backed
Speaker 1: by China's government. So it is a a clear and
Speaker 1: present danger, if you will. China is definitely at least
Speaker 1: funding efforts to penetrate various cyber systems within the United States.
Speaker 1: So this is where we get into state sponsored hackers.
Speaker 1: China funds companies and hacker organizations. There are companies in
Speaker 1: China that have sort of a front that makes them
Speaker 1: appear to be some you know, relatively harmless organization, but
Speaker 1: in truth, the whole purpose of the company is just
Speaker 1: to attract hackers and then direct them toward efforts to
Speaker 1: to conduct things like espionage. So there are entire companies
Speaker 1: in China that are really just fronts for hacker organizations.
Speaker 1: And then there, of course you're your black hat hacker
Speaker 1: groups that aren't quite that organ eyes but are still
Speaker 1: active in China, and China's government will fund a lot
Speaker 1: of these. It allows China to have you know, top
Speaker 1: talent on hand without formally being part of China's government. Like,
Speaker 1: China has the same issues that the United States has
Speaker 1: in that if you want to make a lot of
Speaker 1: money in China, then working for a company tends to
Speaker 1: be a better approach than working for the government. So
Speaker 1: same sort of thing China, rather than recruiting directly into
Speaker 1: its ranks, is funding the efforts of companies that the
Speaker 1: hackers work directly for. It also means that China has
Speaker 1: a little bit of plausible deniability because those companies aren't
Speaker 1: formally part of China's government, and hackers get a little
Speaker 1: bit more leeway. Like if they worked directly for the government,
Speaker 1: they would have to do exactly what the government says,
Speaker 1: but because there's this buffering, they have a bit more freedom.
Speaker 1: This is a good thing for them and a bad
Speaker 1: thing for them, so they can you know, they still
Speaker 1: have to achieve whatever it is that the government wants
Speaker 1: them to do, like to infiltrate a system for the
Speaker 1: purposes of espionage, for example, but they can also do
Speaker 1: some other stuff, like they can try and steal things,
Speaker 1: which frequently is how we find out about them, because
Speaker 1: if an intrusion is done very well, you might not
Speaker 1: be aware that the system has been compromised, but if
Speaker 1: someone's messing around with stuff, it becomes apparent pretty quickly.
Speaker 1: So in some cases this approach means that we become
Speaker 1: more aware of these intrusions, gives us the chance to
Speaker 1: address those vulnerabilities and patch them out, and while the
Speaker 1: damage might have already been done, it can help prevent
Speaker 1: ongoing espionage projects at least using that specific vulnerability. So
Speaker 1: you know, the fact that hackers can do these things
Speaker 1: outside of their initial directives. Means that there's an additional
Speaker 1: financial incentive for the hackers. If they can make money
Speaker 1: by stealing, then that's an added bonus to them. However,
Speaker 1: it does mean that we tend to catch them more frequently.
Speaker 1: Um yeah, and then espion as you just don't want
Speaker 1: anyone to know that you're there. So it could be
Speaker 1: a downside for China's goals in the long run, although
Speaker 1: they can do, like I said, a lot of damage
Speaker 1: even in the short term. But China itself is also
Speaker 1: facing a cybersecurity talent shortage. This is according to China's
Speaker 1: Ministry of Industry and Information Technology, and it ties into
Speaker 1: another issue, which is China's approach to regulations with regard
Speaker 1: to the tech sector in China. This also will tie
Speaker 1: into artificial intelligence. All of this is interconnected. So China
Speaker 1: was saying that China's superiority in AI is part of
Speaker 1: what is spelling the doom in cyber warfare. So we're
Speaker 1: gonna look at that in a second, um, but really quickly,
Speaker 1: just to talk about regulations. For a long time, it
Speaker 1: was the wild West in China as far as the
Speaker 1: tech sector was concerned. Like China was taking very much
Speaker 1: a hands off approach and allowing companies to do things
Speaker 1: that here in the United States or in places like
Speaker 1: the European Union, companies wouldn't be able to get away
Speaker 1: with stuff that would clearly violate, say, people's privacy. Well,
Speaker 1: in China, that was kind of fair game. You could
Speaker 1: do that, uh and that that ended up fueling a
Speaker 1: lot of rapid growth in the tech sector. It fueled
Speaker 1: a lot of consumerism in China, and it fueled a
Speaker 1: lot of growth in AI in China. We're now starting
Speaker 1: to see that kind of turn around. This also is
Speaker 1: affecting things like the desire to go into UH tech fields,
Speaker 1: because now we're seeing China start to push back against
Speaker 1: the tech industry. Okay, so let's talk about AI. One
Speaker 1: way to measure how our country is along with regard
Speaker 1: to artificial intelligence is to look at how many papers,
Speaker 1: how many scientific papers are published on that subject within
Speaker 1: that country, how many patents relating to AI get filed
Speaker 1: in that country, And by that those metrics, China has
Speaker 1: surged ahead. So in just twenty years, it went from
Speaker 1: publishing less than five percent of all papers on the subject.
Speaker 1: You know, scientific papers in the world per year to
Speaker 1: now around, so like almost a third of all scientific
Speaker 1: papers about artificial intelligence are coming out of China. That
Speaker 1: marks an enormous push in AI research and development. China
Speaker 1: caught up and then started to run past everybody else. However,
Speaker 1: as Harvard Business Review has pointed out, a lot of
Speaker 1: this research has benefited from that very loose regulatory environment
Speaker 1: in China, particular early when it comes to stuff like privacy.
Speaker 1: So AI research could take advantage of the fact that,
Speaker 1: you know, it was easy to collect enormous amounts of
Speaker 1: data and to use that data when refining your artificial
Speaker 1: intelligence for specific fields of AI, like speech and facial
Speaker 1: recognition technologies. This is also where we have to remind
Speaker 1: ourselves when we say AI. You know, when we use
Speaker 1: the phrase artificial intelligence, that is an incredibly broad term.
Speaker 1: It It encompasses dozens of different disciplines. AI is not
Speaker 1: so simple as saying their machines are smarter than our machines.
Speaker 1: That's not that's not an accurate representation of what's going on.
Speaker 1: So you could make a very valid argument that China's
Speaker 1: expertise in AI is incredibly advanced for some specific subcategories
Speaker 1: of AI, but not necessarily across the board. Also, China,
Speaker 1: as I mentioned, has more recently started to impose some
Speaker 1: regulations on the tech sector. So they're starting to put
Speaker 1: a little bit of a cap on the amount of
Speaker 1: data and the types of data that companies can collect
Speaker 1: for example. And I suspect that one cause of this
Speaker 1: is that the Chinese government doesn't want companies to potentially
Speaker 1: rival the power and authority of the government itself. Like
Speaker 1: we've seen that China, China's government has been a little
Speaker 1: uneasy with the growth and power of big companies within China,
Speaker 1: and that there is this sort of push pull relationship
Speaker 1: that goes on occasionally. And right now it looks like
Speaker 1: China is starting to pass more regulations UH. That could
Speaker 1: mean that we might see this area of AI research
Speaker 1: and development start to slow down a bit because the
Speaker 1: access to the data itself is going to decrease. In
Speaker 1: an edition, most of the patents in ai UH in
Speaker 1: China belong to universities. They're coming out of university research groups.
Speaker 1: In the West, most AI patents are actually held by companies,
Speaker 1: not by universities, and that means that the organizations that
Speaker 1: can actually implement AI solutions like these are companies that
Speaker 1: can turn them into products and sell them either to
Speaker 1: consumers or to other businesses or what have you. In China,
Speaker 1: that knowledge is within the universities, and there is a
Speaker 1: pretty weak technoledge transfer in China from universities to companies,
Speaker 1: so actually making use of those patents in China is
Speaker 1: not as straightforward as it is in other parts of
Speaker 1: the world. The Harvard Business Review concluded that AI research
Speaker 1: in China is largely in fields that lack original ideas
Speaker 1: and breakthrough technologies. So again, the stuff that they're focusing on,
Speaker 1: it's phenomenal the work they're doing, but it doesn't necessarily
Speaker 1: mean that the AI technologies that are really going to
Speaker 1: power cyber warfare in the future are the ones that
Speaker 1: China is excelling at. So the from a casual glance
Speaker 1: at how kind of slipshot our cybersecurity is here in
Speaker 1: the United States and the general progress of AI in China,
Speaker 1: I could easily see where you would come to the
Speaker 1: conclusion of the game's over. The United States has lost,
Speaker 1: China has one. There's no point in saying otherwise, I
Speaker 1: would argue the future is not yet written. There is
Speaker 1: a lot that needs to happen in the United States
Speaker 1: in order for cybersecurity to get up to a level
Speaker 1: that is even roughly equivalent to the threats that are
Speaker 1: out there. And you have to keep in mind that
Speaker 1: those threats are constantly evolving. After all, the threats, all
Speaker 1: they're really doing is trying to find a way into systems.
Speaker 1: So they just have to find a way in, whereas
Speaker 1: we have to anticipate all the potential ways that hackers
Speaker 1: could potentially get into a system. It's very, very difficult.
Speaker 1: And you know, if we look at our recent history,
Speaker 1: we might say, well, what hope is there for us?
Speaker 1: But I would argue we're constantly pushing to get better
Speaker 1: and that that is something we have to take into account.
Speaker 1: And I would also argue that we shouldn't fall into
Speaker 1: the trap of overestimating the capabilities of any potential uh,
Speaker 1: you know, rival out there, whether it's China or Russia
Speaker 1: or Iran. We we shouldn't dismiss the threats at all.
Speaker 1: But we also shouldn't, you know, become fatalists and say, well,
Speaker 1: we've lost, because I don't think it's as simple as that.
Speaker 1: I think there's still opportunities and that it's not as
Speaker 1: It's not as simple as saying, well, we left we
Speaker 1: left the country unguarded for too long and now there's
Speaker 1: not anything left to guard. So this was a complicated topic,
Speaker 1: like there was a lot to go through. Uh. And
Speaker 1: obviously we've only touched on certain things a little bit
Speaker 1: and could dive into much more detail. But I wanted
Speaker 1: to cover it because it was in the news. It
Speaker 1: was something that was really interesting to me, and I
Speaker 1: wanted to get a better handle on exactly what are
Speaker 1: we looking at here. Uh. I hope that this was
Speaker 1: interesting to you. If you are someone who works in
Speaker 1: the cybersecurity field and you found this interesting or you
Speaker 1: have more to add, certainly reach out to me. Also,
Speaker 1: if you just have a suggestion for a topic I
Speaker 1: should cover in a future episode of tech Stuff, feel
Speaker 1: free to reach out. The best way to do that
Speaker 1: is over on Twitter. The handle we use is text
Speaker 1: stuff hs W and I'll talk to you again really soon.
Speaker 1: Tex Stuff is an I Heart Radio production. For more
Speaker 1: podcasts from I Heart Radio, visit the i Heart Radio app,
Speaker 1: Apple Podcasts, or wherever you listen to your favorite shows.