Hello, and welcome to this special CUBE conversation. I'm John Furrier, host of theCUBE here in our Palo Alto studios. We have CUBE alumni and co-founder and CTO of Kong. Marco Paloandino is back. We get some big news. API management platform supporting dedicated multi-cloud is the pod area. Great to see you. Thanks for coming back. Well, great to see you again. So you guys got some news. We were chatting about the AI gateway recently you and your team did a great sprint on and nailed that product. I want to get an update for sure on that. Obviously, control planes, data planes, the hot thing now is the AI gateway across clouds. Give us the update on the big news. Well, so we are announcing our dedicated cloud gateway solution on top of Connect. So let me explain. Today, Kong already has a cloud control plane that allows every organization in the world to be able to have a unified control plane when they start gateways, ingress controllers and service meshes and AI gateways. And today we are announcing a new capability of Connect, the ability to press one button and deploy global, multi-cloud, multi-region gateway infrastructure across the world. So this is your typical SAS gateway infrastructure, but with a twist. There are some technology innovations that we have built that make these quite unique in the landscape. And of course, it is being powered by Kong Gateway, which is a very famous and popular API gateway technology out there. Yeah, you guys, APIs are the connect points for everything these days. We know that and covering it for over a decade. The global piece is super important. Why is that important? Cause what's different about global? What are some of the things around the global aspect of it? The one click in the cloud, obviously AWS, the big cloud, the biggest cloud. What's the global impact here? Is it simplicity? Is it functionality? Both, what's the upside on the global aspect of this? Well, so the infrastructure that we've built to be able to deploy a globally distributed API gateway on Connect is actually quite unique because we've built a few things that are not available in other products out there. First and foremost, this is multi-cloud. We're shipping at GA with AWS support across a variety of regions. In a couple of months, we're going to be announcing Azure and then before the end of the year, we're also going to be supporting GCP. This is important because every organization in the world, especially the top Fortune 500s, are already powering applications across more than one cloud and being able to deploy infrastructure that can run simultaneously across every cloud reduces complexity and simplifies the operational task that the platform team has to put in place in order to be able to manage that infrastructure. So you manage it the same way, whether it's running on AWS or GCP or Azure. Then we built it on dedicated infrastructure, which means that everything that's being provisioned, it's entirely compartmentalized from what other customers on Connect may be running. Therefore, it is the most secure and most performant gateway offering you can find anywhere else in the world today. And then we've built it in such a way that it can run without scaling, we call it autopilot because you press a button, you provision it across all the regions, all the clouds and then you forget about it. We will automatically scale it up and down based on the live traffic that we're seeing in the infrastructure. Or the customer can choose to decide how many nodes they want to start. And you would typically do that for cost predictability or infrastructure predictability. So multi-cloud, multi-region with auto-provisioning, but also management around loading. Correct, auto-scaling. Auto-scaling up and down, okay. And the provisioning piece, you said auto-provision? It's auto-provision, so essentially the way it works and it's available today. So anybody can go and check it out. We can go on connect, we can provision a control plane and we can attach a dedicated cloud gateway to the control plane. We choose the conversion that we want to run. We choose if you want auto-scaling, yes or no. We choose what clouds and what regions we are obviously announcing AWS today, but there is going to be more clouds like I mentioned. And then we choose if we want our cluster to be public or private. We support private networking. So we could be using this entirely as a private use case for internal APIs or we can use this publicly at the edge if you have APIs that we want to expose, let's say to a mobile application or a developer ecosystem. And then that's it, we press a button and we provision. Yeah, the one click thing, that's a cool feature. I want to get into how it works. You jumped ahead on me. So private networking securing connections across multiple clouds, across regions with private networking is going to be a requirement, especially as the AI gateway comes in with LLMs. How does this all work? Because API management now is, I won't say complicated, but it's getting more complex as more connections happen. So naturally it evolves, it's bigger. What are some of the things of how, why this works? Well, private networking, what's under the hood? Well, so let's look at the journey of an API management solution or technology inside of an organization. We start with a team building APIs. They don't want to build cross-cutting requirements like authentication, observability, load balancing, all of that requirements. And then they use a gateway technology to be able to provision it by themselves. Then there is another team, maybe running in a different cloud, maybe running in a different environment. They are also building APIs and they provision their own infrastructure. Every team today, it is an API team. Every developer is an API developer because every application that we built in the world, it is powered by APIs. It is the backbone of our organization, of our products. Everything is an API. And over time, having different gateway solutions running in different environments increases the complexity and the security risk of the organization. Because now we have much fragmentation across the board instead of having a unified solution to cater to every team. And so with this solution, the dedicated cloud gateways, we can solve that problem because it runs simultaneously within the same cluster. It can run across multiple clouds and multiple regions. It is the easiest way to essentially remove all the complexity that the teams have put in place over the last few years and then give them a solution that just works natively with their environments, with private networking. So it is as secure and as performant as if they were running it themselves, but we run it for them. Obviously, we are experts in running gateways. So we are delegating the complexity to the con team, which by the way also makes it more cost effective because now the team members in the organization, the SREs that we're managing that 24-7 infrastructure can do better things. They can actually focus on their platform, their business, their products instead of managing infrastructure. So what are some of the customer comments? What do they say to you? Give us some anecdotal sound bites. Like, we love you guys. You saved our butts. Or we had a very cluegy, disparate, disjointed architecture. We couldn't auto-provision. What were some of the problems that went away? Or what enhancements did you guys make differently once con came in? Was it a better, faster, simpler environment? Was it better performance, better security? What was the key before and after when you guys come into an environment that's got disparate API systems? Before, I have to deploy the software. I have to run it. I have to scale it. I have to upgrade it. I have to onboard the team members. I have to then build expertise on running it in one cloud, another cloud, Kubernetes, non-cubernities, virtual machines. After, I press one button and I just deploy that infrastructure. Which makes our API management solution become like electricity. Why electricity? Let me explain that. Today, we plug something in an outlet and it just works. In our homes, in our office, we just plug it in and it works. We're turning API management as electricity. It just works. It's always there, up and running, ready to cater to new traffic, to new use cases, it auto-scales, it runs everywhere the same way. And it allows us to have that global visibility across the entire API portfolio that the organization is creating, which is essential to be able to drive business outcomes on top of the APIs that we are building, like accelerating developer productivity, shipping new products faster by assembling existing APIs in a better way. It allows us to enter new markets and it just allows us to have visibility in a way that we can innovate and we can build faster and better. Now, we are removing that complexity from the teams. We are also removing that complexity from the platform team that's catering to the application teams and making that available in one click. Obviously, Kong is now maintaining it for these organizations and I'll tell you more. Even before announcing these capability, we actually closed our first customers because once you see it, you can't unsee it. It's so easy to provision this infrastructure that you are wondering why am I even running it myself ever again? It runs everywhere. It's the fastest technology. It is actually twice as fast as native cloud solutions that otherwise the organization may consider, which is quite of a big deal. It's twice as fast, at least twice more throughput at half the latency. That means that when someone buys a ticket online through our products, that is half the time. It's double the time as quick as it would be otherwise. It means that when we are sending money to somebody else for an API request that money that transfer that API call is twice as fast than otherwise it would be. The product experience is going to be better. Mark, this is one of the things I'm fascinated about your company and where the trend is going because you almost have to step back and say, how did we get here? And it sounds like, and what we've seen is as DevOps grew, the API sprawl happened. And it kind of just grew and it's like, why are we doing this? Is that really the key pain point? It's like, it's kind of become so instituted that it's critical infrastructure, but it became that by default of the growth of DevOps. Is that kind of the core problem? APIs are the new internet. And we had this conversation last time when we spoke about AI gateway, the artificial intelligence gateway, which at the time was a new product we shipped. And we talked and we spoke about at that time about APIs being the new internet. 85% of the internet traffic is APIs. Internet is APIs and the internet as we know it made of websites, made of emails, that internet disappeared and got replaced by API traffic. APIs are the backbone of our digital world, which is everything we do on a daily basis. How you get paid, how you watch something online, how you travel, how you book tickets, everything is powered by an API. Can we make that underlying API infrastructure twice as fast with lower latency, globally distributed and more secure? Then it's a big win, not only for the organizations that we work with, but from the customers and the end users that are using their applications. No debate on that. So check on that. You got me sold on that. I totally align and believe in that religion. The question I'm getting at is, is that on the customer problem set, they've been doing the APIs. It's almost as this been part of the culture. Is there benefit with Kong, the increase in velocity of more API deployments? I mean, what are customers saying to you when after they move from their homegrown or their evolved API management or system to Kong? What are some of the anecdotal feedback? Like we're going faster and redeploying resources. What's the benefit to them? Customer wants to go faster. They want to reduce complexity and they want to gather more visibility and more, how can I say, better management capabilities on top of the API portfolio that the organization is creating. And with Kong, they can do all of that. Quite frankly, Kong is the fastest API technology in the world. Kong also comes from the open source community. We have an open source core that is very popular across the world. We process 20 trillion requests every month that we know of. It's probably much higher than that. Every month across the world and that's all API traffic that we process. It is extensible because you can build plugins on top of it. It already ships with hundreds of integrations and hundreds of capabilities. So there was really no point in reinventing the wheel when there is a technology that is already doing it for them and it's very easy to use and it's very quick and very performant and very extensible too. It gets to very value faster. If you're building something, you go with Kong and you say, okay, they've got it taken care of, check, like electricity. Now I work on other things and building out that in the house. That's the metaphor. So you take care of that. Now I want to, I'm curious about the Amazon Web Services as the first cloud. You're announcing this. What about Azure and Google Cloud Platform? Yep, so today we are announcing AWS SGA. We are going to be announcing very soon in 30, 45 days the tech preview for Azure and then that's going to be the next GA cloud we're going to be announcing and then before the end of the year GCP. So before the end of the year, we will be able to support 30, 40 plus regions across all the three major clouds and the ability to deploy gateway, API gateway infrastructure seamlessly running in one or more clouds in one click. It is something that does not exist today. Okay, so you know I have a big fan of Kong love what you guys are doing. I do believe the internet is powered by APIs. I think it's only going to get better. That's the connective tissue for all applications. It's only going to get better with edge computing and on-premise and as distributed computing goes next level with AI, you're seeing it now. And I want to get back to the AI gateway a couple of questions today, but I want to ask you this question. I'll be the skeptic. I'm a skeptic. I'm a customer. Well, I got other solution options out there. Well, I got Delta. Why you, why Kong over the other guys? What's your answer to that? How do you compete against the other solutions? What do you say to the skeptical customer who's doubting the conjecture and the claims or might think there's a better solution? What do you say to that? Everything starts from the technology. At the end of the day, we are infrastructure technology providers. And so despite everything I say, the real final test is the technology test. Is the technology going to cater to the customers, the organization use case? And whenever we put Kong in place in the organization and we benchmark it, we look at what it can do. We look at how it can be extended. There is no one that can say that the technology is not best in class. And so really we're starting from technology first. And then based on that, we are then looking at the use cases where we can deploy this technology to make the life of the developers easier when they're building new products or building new APIs. But the technology, it is something that I am quite proud of being the city of the organization.  And our company, my company, Kong, has been incredible in the ability to hire the best talent that can then work on creating this best technology for APIs. APIs are so critical that today, Kong is being used in every sort of use case, every vertical that you can think of, but it's powering the top 10 banks in the world. The majority of them is running on top of Kong. Across the world, we're powering airline ticketing, we're powering stadium ticketing, we're powering e-commerce, retail, we're powering healthcare. It is being used in mission critical use cases where the stakes are very high. One customer of mine, I asked them, what happens, Kong is not going to go down, but what happens if Kong were to go down? And his answer was, well, the global economy would fail. That's how critical APIs are and that's how critical our technology is. And we have the best technology to be able to handle the most mission critical workloads and now we're making this technology available in one click. I think having the technology as the base truth grounded in technology, it sounds like you guys in your journey as a startup and now growing like crazy, is to look at customer use cases, deployments. So that's the multi-cloud, multi-region, a dedicated infrastructure and the seamless integration. That's part of this announcement. So this is like the next chapter, if you will, on top of the technology. We are working with organizations that are quite strict in how they are protecting and securing and complying with their data and APIs, they transfer data. So it's quite of a critical piece of the infrastructure. And the reason why we built it in a dedicated, compartmentalized way, it is because we understand these requirements and we do not want to run everything on a shared infrastructure. Where there is a possibility of having more than one customer running on the same underlying servers. We wanted to separate that because we wanted to give the best technology, even in the cloud, even as a SaaS service, the best technology to our customers. Typically when we are looking at SaaS and dedicated technologies, dedicated is typically harder to use, it's harder to deploy, but that's not the case with Connect dedicated cloud gateways. We have the power of dedicated, the compartmentalization of dedicated and yet we have the same ease of use of serverless. We press one button, we fire and forget that infrastructure will scale automatically for us. It will be the fastest infrastructure we will deploy for APIs without having to worry about pretty much anything. Kong does it for the customer. So it's really the best of both worlds. So before we get into the AI gateway next, I want to just ask one final question on this piece in the news. What is an example or what are some signs or symptoms or indicators from customers out there maybe watching this video that would kind of scream, I need to get to Kong? What are some of the things in their environment that would be hotspots, pain points, rooms on fire? What kind of things, if someone looks at their environment, is it certain symptoms? How would you talk about that piece of it? When do they know to call Kong? Organizations are realizing that in order to be able to move faster, they don't need just an API technology in place. They need an API vision and an API playbook that they can build upon in order to be able to automate what the developers do when it comes to shipping and creating and deploying new APIs. APIs are products. We need to have a lifecycle for APIs, the same way we have a lifecycle for any other product in the organization. Now, building that lifecycle, building new APIs, onboarding those APIs, versioning them, decommissioning them, being able to maintain this API portfolio can be quite challenging. And so typically we work with customers that are seeing the limits of what they've built up until now and they decide to, you know, the time is right to standardize on an end-to-end platform that can give them that unified control plane to manage all of the APIs with automation in such a way that the platform team doesn't become the bottleneck, but the developers can self-serve some of those API policies without having to ask all the time. Technology that's so fast that can run in Kubernetes, in the cloud. So they want something that essentially allows their developers to focus on the business, which is the products, the customers, and not on building infrastructure. So if APIs are unwieldy, they basically have so much laying around, so much work's going on, maintaining it. It is a lot of work. When we look at APIs holistically, it is about providing the infrastructure, yes. It is about also providing the onboarding, providing the documentation, providing the analytics, providing the governance, the compliance, the security, and we can keep going and going on and on and on. It's a lot of things that need to be done. No one wants an electrical plant on their facility. They just go right to you guys. Pretty much, right? And so we work with them to make sure that our solution works very well for their use case, but at the same time, it is customizable, because obviously everybody's going to have edge cases they need to cater to, and we want to be able to customize it. So AWS is GA, Azure's coming, Google's after that this year, end of the year, all three clouds. And before the end of the year. Yeah. All right, awesome. So last time you were on theCUBE, let's switch over to the AI gateway because this is like the hottest area right now, and so you guys, you told the story of the product that you announced that you got a small team and in conk fashion, you guys jammed it out the door, got it out, all done, small teams move fast. You were really proud of that. How's that going? Cause that whole idea of building and maintaining LLM based apps is hot. In fact, the CEO of NVIDIA, Jensen Wong said at their developer conference, he validated that there'll be generative culture where LLMs will need to talk to each other, which was a point that you made weeks and weeks before that event. So how's that going? Are customers adopting the AI gateway to build and manage these LLM apps? What's the update on the AI gateway? Well, so the more AI, the more API, right? That's where it all starts. We can use AI, train AI, or have AI interact with our systems and services, and it's always an API powering all three behaviors. And so if there is an API, well, that's the perfect fit for what conk does in the API world. And so we did announce, when was that? Six, eight weeks ago, we announced our AI gateway and believe it or not, we're actually going in production with two Fortune 500s that heard about that announcement and they were telling us, look, we were building the same thing ourselves. You guys have it. We're actually con customers already. Why don't we explore, evaluate your technology and they're now going in production with our AI gateway to be able to cater to all of that AI traffic. When it comes to AI, you know. So you got product market fit going on big time right now. Well, because everybody who's using AI today needs to have security governance around that AI traffic. It's very critical. And either they build it or they use conk, but however they do it, they need something in place. And so if conk can be a good technology fit, why not use conk? And so we are improving developer productivity because we support both cloud and self-hosted LLMs so we can orchestrate across multiple LLMs to improve the reliability of the results, to improve cost, to reduce latency, to self-train, to fine tune self-hosted models that the organizations are building. But then we can also enforce governance and compliance and security on top of all of that AI traffic. Now the cool thing about AI is that with this new announcement, dedicated cloud gateways, because AI is a feature of the gateway, we could be provisioning in the cloud in one click an AI gateway as well. So any organization today who's using AI and they want to have infrastructure to be able to process that traffic and make the developers more productive when using AI and securing that AI traffic, they can do it with this new announcement in one click in the cloud. So AWS and then Azure and GCP before the end of the year. So Amazon has the Amazon gateway that you just announced. AI gateway supports in that cloud one click. What use cases specifically does that support? Someone doing modeling in the cloud or managing data? What would be the example of why I would click on the AI gateway to work on Amazon? What use case? Well, whether we're using AWS, LLMs backed by, let's say Bedrock or whether we're using OpenAI, whether we're using self-hosted technologies that we're running ourselves, we need a gateway that allows us to visualize, orchestrate and manage all of that AI traffic.  Now, with our gateway technology, we can deploy in a AWS con technology or Azure or GCP down the road to cater to that AI requirement in addition to the API requirement. The point being in one click, we can kill two birds with one stone. We can simplify and accelerate adoption of AI while at the same time, also rolling out a modern technology for APIs beyond AI, our APIs that we're building ourselves. So developers on premise could be coding with local LLMs, go to the cloud with Bedrock, maybe Anthropic, maybe do a little things with AWS, VPC setup, you guys are managing all that seamlessly. Correct, and by the way, the cloud gateway offering that we're announcing, it is in addition to the hybrid offering. Hybrid means that we still support the control plane, the cloud, but then you can run the data plane, the gateways or AI gateway still on-prem if the organization wants to have more control on that traffic. But now, they have options. If they want to run it in one click, they could. If they want to run it on-prem, they still can, that's available today. So we are giving them the most options to be able to simplify that infrastructure. Okay, so you got public cloud gateway, AI gateway, and hybrid gateway. What about Edge? We can deploy it in the Edge as well. So today, when we provision a cloud gateway cluster, there is one question in the wizard, and it's asking us, is it a public cluster or a private cluster? If it's a private cluster, we can support private networking to power internal use cases that are not accessible from the internet. It is as secure and as performant as if they were running it themselves. But if they choose public, we provision a globally distributed DNS that targets all the regions in such a way that we can provide them with multi-region and multi-cloud connectivity out of the box. If one region goes down, we can implement automatic failovers in another region, and we do all of that in an automatic way. So there is nothing else that needs to be done other than provisioning the cluster in one wizard, and it's like four or five steps. Huge progress, one click, API in the cloud, dedicated infrastructure, seamless integration into Kong, multi-cloud coming with end of the year with Azure and Google, you got all the bases covered. Oh yeah, I mean, that's our vision. Marco, thank you for coming in and congratulating us on the new update and looking forward to seeing what comes next. Thank you for the opportunity to talk. Okay, Marco Paladios here, CTO and co-founder of Kong, the API management platform now supporting dedicated multi-cloud environments launching first with AWS, Azure and Google Next. Thanks for watching.


Hail, Silver! God of dust and a hearty hail, Silver! The lone ranger. His faithful Indian companion, Tonto, the masked writer of the plains led the fight for law and order in the early western United States. The stories of his strength and courage, his daring and resourcefulness have come down to us through the generations. And nowhere in the pages of history can one find a greater champion of justice. Return with us now to those thrilling days of yesteryear. A mile of the past and the thundering hoofbeats of the great horse, Silver. The lone ranger rides again. Come on, Silver! Let's go, big fellow! Are you, Silver? Organized crime hit Texas like a hurricane. Small bands of masked men attacked the coaches on the Butterfield line. Larger groups sacked towns and buildings. Little larger gangs attacked supply trains, destined for their army post. It was a tidal wave of crime running rampant from the Rio Grande to the Panhandle. It all seemed to be directed by one brain. The outlaw bands, both large and small, had many things in common. The same foresightedness and planning was evident in every affair. It was this careful planning that made it possible for a short, thick-set man to occupy a mansion in Taos and to have a fortune in tax collections in his library. The money is a great responsibility, Mr. Dork. Are you sure you can't take it with you when you leave? It's the matter, Crawford. Don't you like being commissioner of taxes? I lie awake all night worrying about the money. My safe over there is full of it. Thousands of dollars. That's nothing at all. More coming in every day. The collectors I gave you are fishing day, Crawford. Yes, but all the money! You should see our headquarters, Crawford. Not only money, but arms and ammunition, uniforms, horses, cannon. Ah, I can well imagine. You needn't worry about thieves. Who is it to steal the money? Nothing is done unless I so direct... Even so! Keep the money here until I send for it. Soon we shall have to put our men in uniforms and then the cash will go quickly enough. It takes money to feed and pay an army. Dork, do you think that we can get away with these plans of yours? I'm sure of it. Before we are through Crawford, we shall have a nation of our own. A nation extending from the Pacific to the west bank of the Mississippi. The United States will end at the east bank of that river. You plan to put all the gangs together when you're ready to declare a new government? To be sure. Are you expecting company? No. Who is it? That's Feeny. He's one of my collectors. Don't introduce him to me. All right. I've got to... Oh, I thought you were alone. It's all right, Feeny. You may speak.  I said you might speak. No matter what? No matter what. All right, then. You and the rest of us are in for some trouble with the Federal Marshal. What do you mean? They found the real Frederick Crawford. What do you mean? Who found him? All I know is what a friend heard from the telegraph operator. What's that? This guy was found a few days ago. The man that found him told the Marshal that it was Frederick Crawford and the Marshal said he was loco. Just the same, a description was sent to Washington. The reply just came in. What was the reply? The Marshal knows that the real commissioner of taxes was killed on the way out here.  Confound it. That's bad. I have the credentials that the man carried. It's just a matter of time and the Marshal will be here to accuse me of the murder. They should have eliminated the Federal Marshal's. They should have done that first of all. What'll they do? You've got to disappear right away and so have I. I can't be found here with you. I'll leave at once. You get all your credentials together.  Meet me in the main headquarters. Very well. As soon as possible. I think you've got half an hour or so, boss. The Marshal is getting some men together. Give me a hand, Feeny. Put these documents into that handbag. Right. I'll open the safe and get the money. I don't know why the Gully's a gun Crawford. Didn't do a better job of hiding the body. And I don't know why the leader of this outfit didn't get his own men in the lawman's jobs before it began bigger operations. I've got all the papers in this bag. Now what? Put it right there in the bag. The window. What the? At the window. He's masked. Don't shoot. The lamp. Do something. Get your gun. I got it. Get him. Where is he? Shoot. Shoot him. I can't see anything. He's coming in. I hear a light. Shoot him. I can't see anything. Can't see the shoot. You don't need to see. He's right here. Feeny. Feeny. What happened? Where are you? He hit me. Where's your gun? Shoot him. He's going out that window. I can't. Oh, wait. I can't. What happened to you? Oh, my God. Come, come, Feeny. You were close to him? Did you see him at all? What happened? I was at the desk. Someone came close to me and grabbed at the handbag. I tried to stop him and he hit me. The handbag? Where is it? I guess he got it. Oh, with all my private papers in it. What's this? A bullet. He must have left it. A silver bullet. So that's who came here. Who? The Lone Ranger. In Washington, DC. Two men sat in one of the most private of all officers hauling a conference in grim earnestness. Sebert, these documents confirm our suspicions. Oh, it's incredible. How can one man hope to take over the West and set up an independent country? Several men have thought of it. Aaron Burr had complete plans to do it. Then you're convinced that all the crimes of the West are the work of a central control body? Yes, I am, Sebert. Yes, I am, Sebert. Evidence points that way. Rifles that were stolen by one gang from an army supply train were used by another gang a few days later. And there are other reasons for the belief. What about the man who posed as a commissioner of taxes? He's in custody, isn't he? Yes. These documents came from his office. He's been identified. His name is Kennethick. I'm expecting a telegram momentarily. Authorities in Texas are questioning him. If he'll name his co-conspirator, he may be able to nip this scheme before it gets out of control. Is anyone in particular under suspicion? Frankly, there is. The Secret Service knows of a man named Sidney Dorick. He used to be here in Washington. I see. He was a genius at organization. Fanatically ambitious. That was his undoing. He left here under a cloud some time ago. Is anyone nowhere he is now? No. But he and Kennethick were close friends. Oh, isn't there anything in the Kennethick papers to show that Dorick is involved? Nothing. We've got to hope that Kennethick will talk. What if he doesn't? In that case, Sebert, I'm going to call upon the man who proved that Kennethick was an imposter. The man who found the real Frederick Crawford. The masked man? A lone ranger. Splendid. But for one thing. What's that? It's nearly impossible to locate him and even more difficult to keep track of him. He must have someone as an intermediary. I have someone in mind. Good. One of our most brilliant secret agents. Identity is Operator 10. That may be the telegram you're expecting. Come in. Mr. Nonna. Oh, yes. A telegram came from 10. I've been waiting for it. But how do you happen to be the one who brings it to me? The chief thought you might want to see me. Here's the message. Is it what we hoped it would be? No. Kennethick is dead. Dead? He dropped dead before he could be questioned. Evidence points to poison. Possibly self-administered. Well, I guess the chief knew what he was doing when he had to deliver this message. He did? I don't believe I've met the young lady. Mr. Sebert. This is Operator 10. You? Why, you're only a girl in her teens. A sweet compliment, Mr. Sebert. Will you be seated? Thank you. I want to tell you all about conditions in the West. We're facing a most critical situation. Someone has to go there to work between this office and the Lone Ranger. Someone who can give the masked man the information upon which he can operate. You have been chosen for the assignment. I? Yes. Here's a ring. Gold? There's no other ring just like it. Let me show you something about it. It looks like solid gold, but it isn't. The ring is hollow. It opens in this way. In this small compartment, there's a small piece of thin paper with a message. Sorry. The message is signed by... by someone very important. I'll close the ring. Now, you're to take this ring to the Lone Ranger. Very well. The ring will be recognized by men in high authority. And someday it may save the Lone Ranger's life. I see. We have a number of operatives in the West. Information received from these will be forwarded to you in Code W. You'll call at the Western Union office and ashtray for messages. Yes, sir. We will interpret the information and take it to the pod rate, a small mission. I'll give you the address. You may also leave the ring with the pod rate. He knows how to reach the Lone Ranger. Let's hope the Lone Ranger can help. If he can't see it, we may look at the Mississippi instead of the Pacific as our Western boundary. Like the tentacles of an octopus, the arms of Sydney Doric reached out in all directions. His lieutenants were everywhere. There was little that went on unknown to them. A man named Dornamon lived in the Ashton Hotel but spent most of his time in the cafe. He generally occupied a table in the darkest corner and was here that he received information and passed out orders. He knew by the way Jake Ganson approached that Jake had moves. Sit down and keep your voice low. Dornamon, you know the telegraph office. What about it? You told us to keep an eye on the place and the account of the code messages that have been coming in during the past few days. Those messages come from Washington. Do you know who they're for? Of course, you'd never guess. Do you know who they're for? No, but I can tell you. I hope they'd be for the Lone Ranger. Lone Ranger? Is he around here? I don't know. But the big boss would like to get rid of him. How's that? He's the one that exposed Kennethic. Oh, in towels. And he's the one that got Kennethic's confidential papers and sent them to Washington. Mr. Big thinks instructions will come from Washington for that mask man. You hope those coded messages were for him? Well, they ain't. Who are they for? It's a girl. A girl? Yep. I just come by the telegraph office and seen her in there going over. You did? Yeah. She was sitting at a table. Teaked in the window and I could see that she was studying the messages we were wondering about. Why didn't you say so in the first place? Is she still there? I guess so. Get the rest of the boys. You know the routine. Get them together and capture that girl. Take her to the canyon hideout. She's going to tell me what those messages mean. The curtain falls on the first act of our Lone Ranger story. Before the next exciting scenes, please permit us to pause for just a few moments. Now to continue our story. The girl from Washington, known only as Operator 10, was in the office of Western Union. For some time, she'd been seated at a table studying an accumulation of messages that had bewildered the operator because of a special code. Did you say all that jumble makes sense to you, Miss? I'm doing all right, Sparks. Hey, what's this? Hey, it's me, Sparks, and you won't get her. Who are you? Eddie there. Put that gun down. What's the idea? You got to take this girl, Sparks. She's a criminal. One and a half a dozen counties. I don't believe it. I don't care whether you believe it or not. I got a deputy badge and I know what I'm talking about. Come on, Miss. This gun's the authority. So is this. Great day. She had a gun too. I have and I can fire as fast as you. Sort of a stalemate, huh? You got to do me. I'm going to send a message on that key. Well, I can't. You better lower that gun and come along, Miss. Resisting the law is serious. Save it. Sparks, get this. Operator Tan amazed the Western Union man with her speed and precision as she tapped out a message with one hand while she held a gun on Jake with the other. While she pondered the key, Jake's companions approached the office, looked through the window, saw the stalemate and rushed in. Help the girl. Take her gun. Let me go. Help. The Padre in a little mission had a way of reaching the Lone Ranger. He passed the word to friendly Indians and then, like wildfire, the news traveled far and wide in expanding circles until the mask man knew and rode to the mission with Tonto. A couple days after the capture of the girl from Washington, the Lone Ranger and his faithful Indian companion sat with the Padre. I hope it is not too late to make a meal. They were far from here, Padre. They came as quickly as possible. See, see, I know you did. I want to tell you about the man who came here. Who was he? He's the telegraph operator in Ashton. He had a message for me? See. But first, let me tell you his story. It was about a girl who came one night to the office. She claimed some messages in code. He said... She said they're studying the messages. Then a deputy sheriff and another man came in, pulled a gun on her and told me she was wanted by the law. She pulled a gun and there was a stalemate. She tapped out a message that was meant for me.  She left the ring on the table. Here it is. A ring? See, senor. What happened to the girl? A weatherman came in, one of them another deputy, and the girl was captured. As a criminal? The operator did not know what she was. He did as he asked him and went back to his job. Where is the ring he brought you? Here, amigo. This ring? Padre, look. Senor, what is it? Padre, this ring. There's no other like it. Came from the finger of one of our nation's greatest men. Is it possible? That girl had this ring? Padre, you have to find her at once. Senor, can you not rest for a little while? Rest? There'll be no rest until we find the girl who wore this ring. Come on, Padre. You ready? May I give you food to take with you? There's no time, Padre. Ready there, Silver? I'll still have his. Get him up, scoundrel! Hold, Silver! For several days after the capture of the girl from Washington, Donovan remained in his hotel room and spent most of the time pacing the floor in anger. He wanted to talk to the Western Union man. That man had left town. Unfounded Jake, why was he allowed to leave town? Well, nobody said anything about holding him. I didn't know he was going to take a vacation. Ah, you. I hope you've got guards on the girl. Sure, but I... I don't like the idea of holding her in that shack. Why not? I'm a deputy sheriff. I arrested her as a criminal. Well, I should have put her in the jail. You do as I say. Don't worry about your duties as a lawman. Wait. Who is it? It's last. Let the men take you. Sure. It's the idea of bringing me here to the court of a gun. You'd better have a good excuse, Donovan. Where have you been? I took a few days off and my helper ran the office. The telegraph company don't complain. I don't know as anyone should. It's none of your affair. Sit down there. Hey, call you Sparks, don't they? That's right. Perhaps my men were a little crude in bringing you here. That galute was standing in my office. He drew a gun on me as I came up. Red, you should know better than that. What's your job? Enough. Yes. What do you want of me anyhow? Sparks, I didn't have a chance to tell you about the girl who was taken into custody in your office. Where is she? Oh, she's been turned over to the law. Federal prisoner. You see, Sparks, we have to work in a mighty different way than the local law officers. Are you a federal man? Well, I wouldn't want to generally know. I guess I'll keep what I know to myself at the time being. I want to find out more about that girl. Very well, Sparks. I'm going to talk to the sheriff. Oh, I'm a deputy. I said the sheriff. That is unless you figure to keep me here. Oh, you're free to leave. Then I'm leaving. Got to be careful how we handle him. The whole of Western Union is back up, and he's going to talk to the sheriff. I've got the sheriff in my pocket. After the telegrapher talked to the sheriff, he was more confused than ever. He walked into his home. He thought of contradictory facts. I've got to do plenty of thinking on this. Plenty of thinking. I shouldn't make the wrong move. I'll get to bed and sleep on it. I have company. Well, what do you want? Make it easy. Don't they? Yes.  But who are you? Bite the candle. Mash. And I brought this ring with me. The Low Ranger. For some time, the masked man on the telegrapher talked in low tones. Then, instead of going to bed as he'd planned, Sparks blew out the candle and returned to Donovan's room at the hotel. Donovan was pleasantly surprised. Come in, Sparks. I didn't expect to see you again tonight. I had a talk with the sheriff. So I heard. I guess he set you right, didn't he? You still want to know what that guru said to me the other day? You like talking now, huh? Sit down, man. What did she say? She asked me to get word to the Low Ranger. She did? That's why I left town for a time. Did you get word to him? Yes, and he's coming here. If you're on the level, Mr. Donovan, I sure had the wrong idea about the Low Ranger. Well, is he coming? Real soon. He's going to have men enough to take that girl away from you. He is, huh? Does he know how many friends I have to help me? I guess he does. Well, that's different. I don't like that. Well, look here, Donovan. If you're sort of working for the government, the soldiers would be on your side, wouldn't they? The soldiers? Is that what he's doing? Now, hold on. Donovan, you look downright scared. You've been lying in your teeth. You're not at the side of the law at all. And the Low Ranger is.  Up with him and hurry. Jake, come in here. I heard it, Mr. Donovan. Get out the back way with this man. Take him with us. You better watch yourself, Donovan. I intend to watch myself. You've blundered into something. The cards are down. I'll come along, or we'll pour lead in you. Do what the boss says. Get going. Sparks was taken out a rear door of the hotel, then forced to ride a borrowed horse between Donovan and Jake. Outside the town, Donovan hauled into the shack that looked abandoned. Oh, there he is. Oh, oh, oh! I'll be right inside with you. Take him in, Jake, and call the men together. No time to lose. All right. Well, it's the boss himself and Sparks. All of you, listen to me. The Low Ranger's coming here with a cavalry. I never said that. Too late to deny it now. This man's too dangerous for us. He's got to go with a girl. Get that rope tied, or Jake. Try. But it's plenty tight now. What are we going to do? We've got to get the girl and Sparks away from here. Oh, shoot him. That's what I say. I want information from that girl. She can be valuable. We can make her write letters and reports that'll pull everyone off the trail. We can make Sparks and messages that'll help us. Like fun you can. You'll do a lot for you. You'll see her suffer. Or, and Jake, you two will stay and help me. The rest of you ride out to meet the Low Ranger and the men with him. Hold him off for about one hour. That'll give us time to get a head start. Get moving now, hurry. The outlaws hurried to obey Donovan's command. They leaped to the saddles and rode out on the north trail. Donovan, meanwhile, threw things into saddlebags. I'll be ready in another minute. Jake, you keep watching Sparks. I will. Red, take this key. Unlock the door of the girl's room. Good enough.  She makes me trouble. Hit her on the head with your gun. Oh, my God, trouble.  Get those hands up. He's here. Low Ranger. No, you don't. Get him. Brilliant. There's a red skin, too. At them, trouble. They want for you. Good going, red skin. No, you don't. This is for you. Let me use this knife. I'll get them. Let me at them. No, you don't. Where's the dog gone if I didn't knock him down? Good work, Sparks. That does it. He was going to knife me. I couldn't do any more than bump him with my shoulders. I didn't want to shoot. I didn't know where the girl was. In that room there. Red, we just opened the door. All knocked out now. Get ropes on them, Toto. Uh-huh. They have these three for prisoners. And I think Dornamon is one of the ringleaders. I got those ropes, Sparks. That crook can tell him plenty. My ginger chair worked out just right, just like you hoped. Dornamon's scheme in mind filled in the spaces I left, and he figured he had it clear out with the girl and take me along. You followed us here, huh? Yes, sir. I get that sheriff, too. But first, let's look in that other room. The girl isn't here. Man, she was here. Oh, wait. She left a note. She must have slipped out while we were fighting. What's the note saying? Dornamon can name... Toto. Dornamon can name the man on top. Him on top now came a thubby. Him dead. Dead. I didn't hit him that hard. Let me see. I just shouldered him, knocked him down. I fell on his knife. Oh, God. I thought we'd found a trail to the headman. And now what we do? Well, two of these men are alive to be jailed. I'll go for the marshal. You wait here. Yes, Toto. I'll be back soon. I'll stay with Toto. Very well. Maybe these po-cats will get conscious before he gets back. Then I'll have the chance to tell him a few things. I'll see to it. Hey! Well, the Lone Ranger is on his greatest manhunt. The next episode finds him wearing the mysterious ring and moving into the midst of the outlaw army. Be sure to listen. What you have just heard is a copyrighted feature of the Lone Ranger Incorporated.


The defense is at the edge of a network that begins with the soldier in the foxhole and vice versa. We're trying to move from a smart push to a smart pull system. Smart push, think of a telephone. I need to know not only where you are but what you need to know in order to convey the information. Smart pull says I probably don't know where you are and I certainly don't know what you need to know. So we'll use the network to provide the information for you to gather it. The basic thing we're trying to get to is to take data and turn it into information and turn it into knowledge and turn it into understanding and then into action as quickly as possible in near real time if we can. And the point of this is not just material, we're not just talking about the networks. We're talking about you have to change the doctrine by which new business, we have to reorganize the way we are set up, we have to train our people. Obviously there's some material pieces, there's a key leadership piece we need to personnel in place to do, to be trained to do this and we have to have facilities and infrastructure to support it. So all of this needs to be evolved together in order to get the objective we're looking for. The mission I think is more complex than a lot of people realize, it's not just war fighting, it's a mix of that of course plus business, plus intelligence, plus logistics and also increasingly importantly peacekeeping. I was in Afghanistan in January talking with people in the provincial reconstruction teams working with the Afghan provinces. We did a lot with the tsunami relief efforts in Southeast Asia. We've had people supporting relief efforts in Darfur. All of this relies on the same network we're talking about. A point to be made is that when we do get to combat, it's a fundamentally different sort of things than one might have expected in the past. So people now talk about something called the three block war.  It's not the clear kind of distinction that most of the planning and most of the people are used to in terms of the phases of operations. People also talk about something called a strategic corporal, meaning that decisions made by people at every level at this point, get into the newspapers, get into the CNN, get into whatever, and they become sort of national issues very quickly. So in short, the whole structure, the whole hierarchical structure is breaking down to a much flatter, much more network, much more dynamic organization. There are a lot of things in the security field that relate to what industry is doing, but frankly there's a scale and a complexity and perhaps even a sort of stakes issue here that doesn't really reflect a lot of what industry has. We have people whose lives literally on the line today, depending on the network. Somebody described DoD as being just like Walmart, except that, you know Walmart, okay, except that every store is mobile, the competition fires ordinance at you and Christmas comes randomly on any given day. So other than that, we're more or less the same. We have this thing on which, of course, the key to network-centric operations, you've got to have a network, and the basis of this is something we call the global information grid, or gig, since we addicted to acronyms, and there are six major programs that comprise this gig, and it's not just material, it's also the people and processes who store, process, transmit, add valued information across the department. So four of the programs deal with the transport of information. Two, one deals with enterprise services, and I've just come from a very sobering talk from Scott Stender on the vulnerabilities of network services, and one deals with the information assurance of the network. By the way, I'd like to talk for about 30 minutes and then I'll open it to questions. The programs first, four deal with transport. One is a terrestrial fiber net, we call it the gig band with expansion, 10 gigabit per second, OC192 fiber, to the 80 largest command and control nodes around the world. That'll be full operational capability by the end of this year. The second is to extend this global network to mobile units, and that's a transformational satellite that's going to take lasers around the satellite ring to give you, again, 10 gigabits a second anywhere on the planet. One of the purposes of that is to use laser uplinks from aircraft, so we won't have to use so much spectrum to exfiltrate the data from the various kinds of reconnaissance sensors on the aircraft. The third piece of transport is something called the Joint Tactical Radio System. It's a software-defined radio, software-controllable architecture, and that's designed to provide the mobile routers on the IP mobile networks in order to bring these capabilities to the tactical units. Finally, there's something called teleports that links the ground infrastructure with the on-orbit infrastructure. That's kind of the very heterogeneous network we're talking about. It's 10 gigabit per second, stable, to 10 kilobit per second, very unstable in tactical mobile environments. The Enterprise Service, NetCentric Enterprise Services, is basically beginning to take you to a software as to a service-oriented architecture. I'll talk more about that in a bit. And then there's a whole information assurance program called the Gig Information Assurance Program. We spend about $2.2 billion a year in DOD and with NSA on the security of the network. One of the pieces we're trying to work on is to move from this stable environment to a tactical environment. This perhaps is something that a lot of the commercial analogies break down, because we have to be able to handle very dynamic environments, of course the cell phone environment is dynamic also, mobile, but here with people jamming, shooting, very kind of severe environmental conditions. The paradigm that goes with this is a movement from need to know, which is kind of hoarding the information, I own it, to need to share. You're not going to get the value of the network until you get the information out on the network. And this is much more of a policy and a cultural thing than actually a technological thing. People issues come to mind in 1996 or seven or so I went up to New York and listened to a group of presentations by a series of analysts from the computer security industry talking to people on Wall Street. And so there's maybe a certain amount of hype in the presentations, but what I took away was we industry can provide you customer with any level of security you want. But we need from you three things. We need to have a commitment from the top of your organization that security is important. We need to have you spend the resources and by resources I don't mean the one time procurement of firewalls and guards, but the ongoing expenditures to maintain near real time situational awareness of what's going on in your networks. And you got to be willing to drop the hammer on people who don't play by the rules. And I'd say in government at this point we've done a pretty good job at conveying that security is important. God knows we're spending a lot of money on the problem. We have not done a good job in dropping the hammer on people who don't play by the rules. It's a lot easier for me right now to get a security violation by leaving my safe open than it is by posting my password on my computer or letting an unattached unauthorized modem be attached to my network. We need to work on that. NSA has done a terrific job in putting together a new information assurance architecture for the gig. And this is being driven by several factors. I mean obviously the environment is changing, the paradigm security is changing, moving network-centric operations. But we also have to pay a lot more attention to the insider threat. If you look at our major espionage cases over the past 25 years, almost every single one of them had their security clearances before they went bad. We focus a lot on the perimeter of the problem, keeping the bad guys out. The issue is we have to be able to detect anomalous behavior in the network and respond to it. I heard today from Paul Simmons of Jericho Forum the term deparimeterization, and I look forward to learning more about that because I think that's some description of where we're going. So there are five concepts you will in this new information assurance architecture. One is to separate the protection of the information from the protection of the infrastructure. Another is the end-to-end protection of information through enhanced access controls. We need to have strong identification and authentication, which is absolutely critical to being able to do security based on rule policy-based access. We've got to have enhanced misuse identification. For example, Visa and MasterCard. I was in Kuwait a couple of months ago, and I went to buy my wife some jewelry, swiped the first card and went through, second time went through and said, ah, denied. So we pulled the string on and turned out of course they said, well last Saturday you were in Virginia, now you're in Kuwait, you never told us you're going overseas, is this really you? And I appreciate that. On the one hand, if they can do this sort of thing on the basis of hundreds of millions of transactions, why can't we do this in our network? But it was pointed out to me several occasions, most recently today, the problems we're looking about detecting anomalous behavior inside a military network are perhaps qualitatively different than those on just credit card transactions. I mean if you want to ask why as well as trying to hack into the Secretary of Defense's computer at midnight, if you want to say why is the Southeast Asian analyst all of a sudden more interested in Cuba, and I submit that to a more complicated problem than just a transaction in different physical location. And some of these in fact may not even be solvable problems, we need to understand just what the limits are of what we can do. So the fourth piece of these five characteristics is enhanced computer network defense. And I'll talk a little bit more in a minute about something called the Joint Task Force Computer Network Operations that's recently been set up. But basically it's improved detection, correlation of data, and visualization of data. The fifth point is we need very aggressive research and development. These are going to be different problems. We're building really for the world of 2012 to 2015. And they're not going to be solved in the near term. So first of all we have to stay abreast of the changing threat. Some of the examples, the really high-end computing that are going on, or high-end R&D, a lot of work in quantum computing. As Feynman said at one point, by the time every bit gets down to an atomic scale then you're going to be at quantum principles whether you like it or not. And so as Moore's law progresses we're going to be driven to quantum computing whether we like it or not. Some of the breakthroughs recently or some of the developments recently, much more control over single photons, the ability to separate electrons into separate streams based on their spin, the ability to combine information from multiple atoms onto a single photon, and the building of the first quantum registry with progress made towards a quantum gate. So that's a fairly aggressive program. DARPA, www.darpa.mil, they have a strategic plan there which I encourage anybody interested to take a look at. I mean some of the things they're looking at are self-forming, self-feeling networks. They've already made a lot of progress in tactical environments. There's a lot of questions about whether in these dynamic networks, TCP for example is an acceptable protocol just because the overhead associated with all the handshaking is so high that we may not be able to get enough throughput. So we're looking at alternatives. Chipscale atomic clocks, 200 times increase in power and size, 300 in power, 200 in size. And then a lot of work on hybrid optical and RF connections so we can get much more robust, smaller units in the field to let us get around bandwidth limitations. So there's an awful lot of stuff going on and I think we're making some progress but obviously we don't have all the answers. I mentioned the Joint Task Force Global Network Operations. This was changed last year from the Joint Task Force Computer Network Operations because we're expressly trying to get to not just computer nets but telephone nets and space networks and a whole series of different approaches to the problem. It's responsibility is the operation and the defense of the network and it does this by coordinating and directing the activities of the network operation centers, the various components across the department and also the computer emergency response teams. We also work very closely with law enforcement and the intelligence community. The Task Force I would say has successfully responded on several occasions to attacks whether direct or indirect on the DOD network. I love you, Nimda, Whitty Worm. We did not have significant degradations from those. We certainly don't have it 100% but I think we are getting better at containing the events early and mitigating the consequences of people again where folks' lives are quite literally on the line. We're not doing this for profit. We're not doing this for bragging rights. We're doing this to support people who are in the field today and whose lives are on the line. We've also had much better cooperation I think with other agencies and I'll talk more about that in a little bit. We certainly don't claim to have all the answers and we need talented people and that's one of the reasons why I really appreciate the chance to be here today because you all out there represent an enormous body of knowledge, an enormous amount of talent and we could use a better understanding of some of the skillsets you have. My main focus frankly is not on the hacker who's in a way for support or challenge. My concern is the people who want to steal DOD information and do harm either in sort of directly or indirectly to these people who are out there every day putting their lives on the line. We do prosecute lawbreakers, those caught getting into DOD networks and so if you are going to try to break the law and hack into our nets we will try to impose legal consequences. But I'd rather emphasize today something different. It's an opportunity. The opportunity is if you want to work on cutting edge problems, if you want to be a part of the truly great issues of our time, if you want to literally write history, we invite you to work with us. Quite frankly in my job not a day goes by that I don't come to work and say wow what new and interesting thing is going on out there that I want to work on and it's an absolutely fascinating environment and we definitely need your help. What I would ask for is your help in reducing the noise. All the scanning, all the probing, all the attempted intrusions divert our resources from the truly serious attacks that are out there and have no doubt there are people out there who seriously want to do us harm and do not share the values of the country of the freedom of information on the network. There are people who want to do us harm. If you haven't taken a look at it, I recommend Scott Borg who's done some very interesting work on the economic consequences of cyber attack. He used to be up at Dartmouth and now he's his own country company. Really worthwhile. So my final message is again, we value your talents. I would like very much to learn from what you have to offer. I frankly have taken away just from the time I've been here so far an enormous amount of information that is really useful to me that I would not have gotten without coming here. I look forward to coming back and talking with you more on the Meet the Fed panel later on in the afternoon and let me open it to questions. Thank you very much. Go ahead. The question is on full disclosure and what is my, sure, what's my take on full disclosure, national security compared to business, so on and so forth. By and large, as we moved in network environment, again, I mentioned the point is sharing of information and we do better in the long run by having information out there and having us, having us share it. It's a major cultural change for us in terms of people who've owned information and say, you know, my owning it is more important than, you know, getting out to other people. And so I can't draw you a clear line that says everything right of the line is kept hidden. Everything to the left is shared. My inclination to this point is shared because as I say, I've learned stuff today about vulnerabilities that we need to get back and work on that I wouldn't have known if I hadn't come to a place like this. At the same time, there clearly is stuff that needs to be protected. And my particular focus is on protecting that information that puts people's lives directly at risk, which tends to be fairly perishable operational information. And then the flip side is things to say the U.S. has invested tens of billions of dollars of research and development in that gives us some kind of competitive advantage long term that needs to be protected. And so those are the sorts of things that I tend to focus my concerns on rather than just saying, well, everything has got to be kept secret. Let's hear. The use of COTS and weapon systems. Let me answer that in two, pardon me. Yeah, OK. So the use of COTS and weapon systems. There's an interesting study that says that the government is a whole, federal government is a whole. Now, outsources more than, and now pays more in contracted services than it does in salaries of government employees. And this trend appears to be one that's only going to continue. So part of the problem is that almost none of us gubbies know how to manage those kinds of outsourced services. We may not have to manage a program that where the gubbies are controlled and deliver it all, we don't know how to manage these outsourced services very well. And so the challenge is, the baby boomers shuffle off the stage. What are we doing to train up the next generation of managers to do a better job of managing these outsourced services and the COTS that go with them and avoiding more AIDAs and things like that? From the security perspective, my concern is that this now means I will have almost no clue into the pedigree of the networks that we're becoming so dependent on. I may know who the prime is, I'm likely to have no idea who the second and third tier subs are and where they're coming from. And so this then leads me to a much greater emphasis on not only the near real-time situational awareness of the network I mentioned before, but in some kind of understanding of software and hardware assurance for those critical applications where it really does make or break the successful missile engagement or the tip of the spear issues. And so we're looking at, for example, we have a trusted foundry that we're building for hardware chips. For those certain applications, we absolutely have to make sure that the pedigree is right. We're looking at various ways through, you know, common combinations of common criteria and CMM and others on how to get better software assurance involved. So I think there's going to be a graduation between GOTS and kind of trusted COTS and then what's just out there in the marketplace. Because I think we're migrating to this much more commercial environment where we frankly are never going to know where a lot of this stuff comes from, I would tend to put more of my emphasis on the anomaly detection of the network, the strong identification, authentication and the response to, you know, problematic behavior in the net, then I would worry about, you know, what was going on in every piece of software in the system. And so you draw the line here as to, you know, what's in a weapon system. If you're dealing with a fighter plane, that's pretty much going to be, at the very least, the high pedigree commercial software and probably is going to be dedicated design systems. But it turns out that for us, you know, exercise after exercise after exercise shows that the most dangerous, most vulnerable parts of our operational chain, if you will, are things like logistics and medical. And in that, you're almost certainly going to have lots of COTS products. So I'd love to give you an answer to what's a weapon system. I'm more interested in what do you need to assure the mission to complete the job, irrespective of the level of attack you're under, and that's going to be a layered process. Okay? Sir. The question is, what do I feel about how other foreign governments stand in information assurance in England, Russia and China, whatever? I think we understand at this point that almost every significant operation we're going to do is going to be in some kind of coalition environment. And therefore, we have to take into account the fact that our coalition partners are going to come from very different levels of information assurance and capability. I was struck by at one point, one of our coalitions when right now you have long-time partners like Lithuania, Moldova and Tonga. So this means that we're going to have to, in fact, we are working very hard in developing something called MNIS, Multinational Information Sharing. It's going to have to give you some sort of multi-level security firewalls and guards to allow you to interoperate them in some kind of a shared space while protecting those core command and control functions, say, and key pieces of data that you don't want to share. So I spend less time actually worrying about what foreign governments are doing because I don't have much control over that and rather having to put together an operational networked environment where I can bring in unanticipated users. To that effort, I would say that we are trying to completely rethink the paradigm for DOD to operate outside the dot mill domain, to work with non-traditional partners like the Agency for International Development, UN, Doctors Without Borders, and even commercial partners in the kind of stabilization and reconstruction operations that we're seeing more and more of in what we're doing. We learned a lot from Tsunami. We learned a lot, we are learning a lot from Afghanistan. Some of you may know there's something called the World Summit on the Information Society that's coming up in Tunis. It's the second of two conferences this November and we'll be working with the whole batch of the international community to try to look at ways we can do that. I personally think we are never going to get to the stage where we'll allow these, you know, pick up team partners to get inside, say, the NipperNet firewalls, which means that we have to go outside and have .NET or .org type domains in which we can operate and share the information. So the long answer is I'm not too much worried about what foreign governments are doing. I'm trying to set the conditions whereby we can work with a whole batch of different people in different circumstances. Back there first. The question has to do with integrated tax.  And this clearly is an area that we have to be working on and working on harder. I personally think that the, again, my goal is to get to mission assurance, not just information assurance. Coming from a Navy background, I tend to think of a ship, you know, which is built with watertight compartments and you can still float with a couple of compartments flooded and you have a starboard to engineering plant and a port engineering plant so if one is damaged, you can still carry on. You've got multiple fighting men and you train and you train and you train and you train. So we need to take into account the fact that an attack may be just cyber, just physical, a mix of physical and cyber and work the problem in an integrated manner. This is not entirely within the domain of the Department of Defense. A lot of this comes now up in the US with Department of Homeland Security where a lot of the cyber defense of the National, the defense of national infrastructure rides. So in fact, this week I've just spent several meetings with people from Department of Homeland Security and how we in defense and they and the private sector can do a better job at coordinating the infrastructure defense on which things ride, E911, those sorts of things to give an integrated approach. So is there an answer? No. Are we better off than we were? I mean, we now have, I mean, GETS worked very well. The government emergency telephone system worked very well on 9-11. We now have the wireless equivalent of that in place and so you basically priority overrides in the wireless service for first responders. We've had a series of major exercises called top off, top officials where you bring the FBI and Homeland Security and National Security Council all that together and actually run through some pretty horrific scenarios and how the decision-making would flow. So a lot of this stuff, quite frankly, is as much a policy and a decision-making process as it is the technical parts of the network and that's what we're trying to get right now while we inventory the networks and you will find out what's available out there to use when the situation comes up. Okay, somebody's down here. There's one behind. Go ahead. Question is, do we allow the implementation of software hasn't been entered in the audited? All software needs to have been validated through the NIAP to be used in the DOD, National Information Assurance Partnership to be used in the DOD networks and in most cases it also has to go through an interoperability certification through the Joint Interoperability Test Center. Well, in some of the code, there is code review in the NIAP. It's done not in JITIC, but it is in the NIAP. And then there are other things that NSA does to review code and that sort of thing. But so we're cautious and this question goes back earlier about what we do with commercial software and part of it is, if we're going to use something, say, like enterprise resource software, ERP or PeopleSoft or something like that, I mean, you're obviously not going to go through and try to change or validate every piece of code in that and yet we're going to be dependent on it. And so the question again is how do you detect anomalous behavior in that and but for those things that are in our NIPRnet or SIPRnet, we're requiring the NIAP certifications. So the question is, has anybody given any thought to preventing cell phones being used for detonating IEDs by war-dialing all the cell phones in Iraq? The amount of time we spend on IEDs is quite extraordinary. I mean, literally, you know, our tens of hours a week on the IED problem. And the cell phone issue has actually come up a lot. Now, there are ways to get the cell phones beyond just war-dialing. I mean, there are different ways to get to them. And so that problem has been addressed. I have to tell you, there's not a lot of evidence that cell phones per se have been used to trigger IEDs. There's much more stuff on garage door openers and those sorts of things than cell phones per se. But I guess all I can say in this forum is we understand the potential threat of the cell phone. Guys are spending lots and lots of time on, you know, when we see it being used like this, how would we counter it? I haven't heard war-dialing specifically as suggested of a way to do it, but there are other kind of electronic ways they've been looking at countering it. So it's a, there's nothing, frankly, of a higher priority issue for the military right now than addressing this improvised explosive device issue in Iraq, because that's what's killing our people. Let me see, is there any shrimp back in the back? I'll get to you in a minute. Sir, you're talking about ADA? The question is that DOD has spent a lot of money to develop ADA. We're not using it. Other people are. Is there a way we can bring it back? Let me take that for the record and go back and look at it. Frankly, my sense is that time has moved beyond ADA.  So I haven't paid a lot of attention trying to revitalize it. If you want to give me your name later on, I'll take it for the record and get back to you. It just hasn't been something I've focused on. Is there anyone here? Yeah, the question is, what's the ratio and the number of IEDs, improvised explosive devices, that are being detected and disarmed before they are exploded? And the answer is, yes, we have those data. I'm not sure I can share that. What's happening, though, is that we're getting better at detecting them and disarming them, but they're making them more lethal, so each one causes more attacks. I mean, using explosive-formed jets and things like that, as opposed to just focused explosive jets, rather than just a circular explosion. So anyway, it's a typical dynamic of offense and defense. And, sir, what kind of scorecard? Assist? Yeah. So the question is, is there anything like an assist scorecard and what are we doing with the guidance for the private sector about implementing data tag? I'll get you next. And I would say that we're doing, a lot of our work is based on various kinds of balance scorecards, we're trying to put together metrics. Right now, the deputy has challenged us on getting metrics for the information assurance world. And I have to tell you, this is one of the hardest problems I've got, and this is something I would really ask for your help with. The question is, how you measure and return an investment on information assurance-type things. So if I'm going to go in and put, you know, $100 million into some sort of technique to get to better multi-level security in 2012, and the budgetiers are out there saying, well, you know, show me, that's going to give us a 14 or a 22 or a 71% increase in security. It's really hard to do that. And so the idea of link between metrics and investments and all that is a hard problem for us. I mean, I can go through right now and measure what's working in different network operation centers and all that, how we're doing on implementing known vulnerabilities and all that, and more concerned about the long-term return to investment metric. With regard to the public-private sector, again, a lot of this lies in the Department of Homeland Security, and part of the problem we've had ever since PDD 63, which is the critical infrastructure protection in the last administration, is building the trust, if you will, to be able for two-way sharing of information. We've spent a lot of time working with Congress and others on trying to change laws so you can provide better protection to proprietary information that comes up through the ISACs, these information sharing and analysis centers, and we're trying to work with getting the government being more willing to share a sense of information on the way back down. If I were to say anywhere, I think the telecommunications sector, the National Security Telecommunications Advisory Committee, that process is working pretty well in the telecom sector. I don't think it's working as well in, say, transportation or energy or others, and what's coming to be a concern for me as SCADA, as the Supervisory Control and Data Acquisition Nets, become more and more a part of all of our critical infrastructures. We're making the most progress in the telecoms and the ISP world, and I think we're getting as much progress in controlling the information technology in these other sectors where it may be equally critical to us on a national basis. So the answer is one piece of advice I would have is the DOD and the Intel community have committed, I mentioned the Global Information Grid and the programs. There are three other pieces that go with that. There's a network operations, network resources, management piece about how you balance the use of resources to the network. There's a spectrum management piece and the key underlying bit is the NetCentric Data Strategy, which is an XML-tagged approach to the problem. And it turns out that DOD and the intelligence community and NATO have almost identical NetCentric Data Strategies. And we've really had some very good luck over the past several months in moving towards a service oriented architecture approach and a shared situational awareness. That strategy has not yet been adopted by the Department of Homeland Security, which means it's not being infused into the private sector through those channels. And over the past week, we've actually been working hard with a senior leadership of DHS to get them to adopt that kind of a strategy. So maybe that'll be an answer to one part of your question. Okay. Yeah. Question is as warfare goes NetCentric, how do you envision managing security connecting together what used to be standalone systems? I don't think there's ever going to be a closed-form solution where you lock the door and say, we got there, let's go go and turn off the lights and go home. It's, there are just too many dynamic pieces of the puzzle in terms of not only the evolving threat, but the rolling out of new technologies. I mean, there's a very good session this morning on vulnerabilities associated with XML and service oriented architectures. Three years ago, we wouldn't have paid any attention to that. And so now we need to fold that into the process. So I think it's going to have to be an ongoing dynamic series of reviews. The first key part of this is cultural. If you talk to the intelligence community, they have a concept called Orcon, originator controlled, which basically says, I wrote the information, it's mine. And so just trying to break down the stovepipes to share that becomes much more an issue of politics and culture than it is of physically getting the bits and bytes to work out. So I think it's going to be a mix of cultural solutions, this doctrine organization training evolution, the physical. And even if I could give you a solution today that said I'm at the 95 percent level, I'm happy with it. It won't be that way tomorrow. The one thing I would say in DoD that, again, I look for your help on if I'm a credit card company and I'm willing to and I realize that I'll probably get three to four percent loss rates in fraud or whatever. I can factor that into my calculus. I can put that in my interest rates. I can factor that in. And what you get from that is an explosion of credit across the economy that transforms the ability of every day people to buy things they never would have been able to buy before. And I don't know anybody lately who's gone to the top secret control officer and say it's OK to lose 3 percent of your documents a year. Even though in the net centric model, you might have maybe 100 people were lost because some piece of information were compromised, maybe 10,000 were saved because the fight was over in three days rather than three months. And the value of net centricity had an upside. So we need to think through our cost benefit analysis to put more emphasis in the military on the upside benefit, even as we focus on the cost. So not not a neat clean answer, but it's that's where we're looking at. Over there, sir. Critical factors in my going, I mean, how I got to be CIO. I'm sort of in a strange situation in that I was career Navy and so I spent 26 years in uniform and then and then about seven years in the office of the Intersecretary of Policy for Policy working largely on the interface between policy and technology issues. And so when in 1998, the secretary decided to beef up the role of the the assistant secretary for command control, communications and intelligence, which is what this my organization was then known as, I was asked to go over and be the principal deputy in that organization because I had an understanding of, you know, less the technical details and the the balance between policy and technology.  My master's is an applied math, my doctorates in international relations. And I found that nicks of a policy science and engineering science to have been a really valuable combination. So so just a long story, what's happened now is my permanent title as principal deputy, our assistant secretary left about 18 months ago. And so I've been acting as the CIO since. But I think in my case, it was less a certainly wasn't a commercial background. It was less a technical background than having the policy technology interface understanding. The question is I've been focusing a lot on information assurance. And as you play out 2012, 2014, how do I see the offensive side playing out of information operations? I'm really limited in what I can say on that in this venue. But I think the one of the key points is as the network becomes the center of gravity for military operations. I mean, right now, we're probably the most net centric of any of any military in the world. Its model is being adopted by a number of others as well. As more and more countries come to depend on the network, then how you attack that network, be it a physical attack or a cyber attack or whatever, will become a more important thing to work on. And I think also what I would expect to see is not just a you know, not just a single solution, but a broad it'll become a target just like anything else. And one of the things we're saying is we need to fight the network like a weapon system. You need to think of it as a ship tank and airplane. It's a critical component. And so as a result, you have to defend it against the full range of threats and we have to be able to similarly mount the full range of threats. That's probably about as far as I can go. Somebody in the back, I'm sorry, I can't see hands back there. I'm glad to... Yeah, please. It's a really good question. It's what about cyber attacks and penetrations that originate from foreign countries and how do we prosecute them? I think as most of you know, the attribution of a cyber attack can be a really hard thing to do. And so with the number of countries, for example, in Europe and the Interpol and a number of bilateral agreements, we now have some pretty good mutual law enforcement rules to be able to address, for instance, the UK. There was a, the UK would either prosecute people who were hacking to our nets or in some case, we can extradite them to be prosecuted here. There are other countries where, frankly, it's a free ride. If you hack from there, there's no, some cases it's not a crime to the hacking and those nations' laws. And if we don't have agreements with them, there's not much you can do about it. So I think over the past 10 years, we've made a lot of progress in working out multilateral and bilateral law enforcement agreements, but it's certainly a patchwork quilt around the world. The question is on these countries that are not doing a good job in policing their own cybersecurity or which we don't have agreements with, are there other ways we could put pressure on them, postal agreements or something like that too? And the answer is, Defense Department doesn't do, that's not our thing. That would be the law enforcement or State Department. When we have the Ask the Fed panel later on, if you come, that'd be a very good question to ask for the folks who'd be here because it'd be people who could address it. Back there first. What does IPv6 capable really mean? We've set a goal of 2008 to implement IPv6. And it's gonna be done through a technology refresh policy rather than a big bang solution. And so I would guess we'll be running dual stack for a long time. Tell me more about your question because what we're essentially saying is anything that we're buying since last year or 2003, I think should have been IPv6 capable. And your question is, that's an ambiguous definition. I see the rollout of IPv6 is gonna be a, we're pushing as hard as possible. And it was just a congressional hearing that was basically saying that the government as a whole should be doing more with IPv6. And the DOD was really the only organization that was taking the lead. And so the Congress seemed fairly happy with what we're doing. At the same time, as you know, there are lots of issues associated with it, what kind of costs are gonna be imposed, how much, how quickly we're gonna retire the IPv4 systems if they can't run dual stack. So I don't think this is gonna, on the 31st of December, 2008, there's not gonna be a magic cut-off because we try to get there as fast as possible. Most of it's gonna be new equipment we buy, data we refresh, they're gonna have to be IPv6 compatible. But we can talk later on if you want, I don't think that's answered it. There was a, yeah. By the which project? I can't actually know. The question is, can I comment on the achievements of the DETER project? And I'm not familiar with the project. What's, give me some more background. It's an NSF DOD funded testbed, if you will, to look at the internet. Actually, I'd like to learn more about that because we're in the process right now of assembling an end-to-end testbed for the global information grid. And we've been going around inventorying, if you will. For example, I'm funding something at the Naval Research Lab that's an end-to-end testbed. The Joint Forces Command down in Norfolk has an end-to-end testbed. Army has one out of Fort Hood. So I'd like to learn more about where DETER goes because I'm not familiar with it. Question is, why are we moving towards IPv6? Well, we need the security and the mobile environment features are being able to automatically establish links with adjacent networks, those sorts of things. The security, there's a sense that the rest of the world, China or whatever is likely to move to it. We're certainly not doing it because right now we're constrained in IP address space but the department is going to be explosively moving to unattended ground sensors and unattended, well, mainly ground. And that's going to start using up our space. We were trying to not have to go to NATS for some of these sub-NATS. So that was essentially the reasons that drove it. The question is, how much collaboration do we do with other agencies on information sharing and information security? As I mentioned, we in the intelligence community and NATO have a very close relationship based on the fact we have a common data strategy. And that's, NATO has something called stand-ag, standing agreements. And in fact, we've tried to base a lot of our policies and technologies on NATO stand-ags. So it's not just a U.S. only and we're actually trying to show it's an alliance event as well. I think there's still some major cultural differences in here, especially with the intelligence community in terms of some of the stove pipes that have been around for a long time. And they probably feel that we're moving too quickly to need to share or vice-need to know. And we probably feel that we'd like them to put some more information in the network faster. So the discussions are ongoing continuously. The president signed the executive order last summer mandating the sharing of terrorist information across the government. The legislation that set up the director of national intelligence amplified that to actually set up a position within the DNI's office as a program manager for information sharing. So there's just a lot of energy in this and we're just trying to pull it together across the messy processes that are the U.S. government. Okay, that's on here. Yeah, the question is, do I think there's enough control by the government over the internet, not enough control? This is going to come up in the WUSIS and the World Summit in Tunis and we're working out the various positions. I think by and large the U.S. is willing to see more role in internet governance by other countries, but we're not willing at this point to give up some of the key features like ICANN and that sort of thing. The positions frankly are still being refined, but let me see, first of all, I can only speak for the Department of Defense and from the DOD perspective, I have no problem with the current level of control of the internet. I'll defer, it's a good question for the ask the Fed panel because the law enforcement people might have a different view, okay? Please, the question is there's a need to keep a 10 to 15 year focus on information assurance. The concern that recently the DARPA funding for the longer term computer science projects has dried up, what do I think about that? I know there's been a conscious effort on the part of DARPA to focus on projects with more, what do I wanna say, direct return on investment from the R&D. There's always gonna be a tension between what the 10 to 15 year problem is and what the local one is. Candidly, I've more or less accepted the view of the director of DARPA where he should put his resources. We're doing a lot of work, not just with DARPA but also with NSA and also with the academic community in terms of the long term projects. And at this point, I have more problem with the point I made earlier of how to justify what I believe should be a higher level overall of across the board and information assurance projects rather than whether DARPA is not doing enough because there are ways to cover that in other areas. So that hasn't bothered me particularly. Ma'am, I got you. I'm sorry, the question is, as we work outside the dot mill domain, the areas, the ones I cited were non-traditional partners within the U.S. government like USAID with whom DOD hasn't typically worked. International organizations like the United Nations, some NGOs, and I cited Doctors Without Borders because they're a whole raft of them. And some of these in the past have actually had in their charters that they should not work with the military. And I think one of the things that we've made some progress on over the past year or so, particularly since Tsunami, is a recognition that if we really are gonna provide services to people in distress, and frankly from my perspective, I'm just talking from my DOD hat, I'm interested in the stabilization of these situations so they don't turn into problems where the military has to intervene. So in those type of situations, we have a common interest. And that was the, I just used the Doctors Without Borders in the example of a broad class of non-governmental organizations. Absolutely, NGOs are a group we're actively courting. Yeah, you had something here, right? Yeah. And the question is, we've seen anything similar to TPED, the Trusted Product Evaluation Program for military? Yeah, for power grid and banks and other critical infrastructures and things like that. That's a very interesting question. I hadn't thought of it, let's talk afterwards. Because I think you could do a lot with that, but we need to work that through this messy inter-agency process and I haven't tried to do that. I'm getting a sign here, I think maybe two more questions and we'll have to call it a day. Question is, information assurance and contractors, how does that affect security when information assurance isn't part of their award fee? And one of the things we've got to learn to do better in this outsourcing of services is to write our contract smarter. I was out in Afghanistan earlier this year and the contracting officers represented for the 25th Infantry Division in Bagram was actually down in Gutter. And if they wanted to do combat operations after hours, they would have to call Gutter and get money added to the contract in order to conduct the operations. Because we just hadn't written the contract right. So it seems to me in this environment we've got to write the contract so that information assurance becomes part of the award fee structure and we're not there yet. This is a learning process. Any more? Thank you very much. I appreciate the chance to talk with you today. Come work with us. I'd love to draw on your talent, Paul. Thanks again.


my name is Amanda. I'm from the USA and I just finished the 120-hour Teaching English as a foreign language course. This course was an excellent course and I truly feel prepared to begin my English teaching career. The course was detailed enough to help you learn important aspects of teaching English, but it was not too overwhelming. I love that I was given six months to complete this course because at first I was worried about finishing a full TESOL or TEFL course due to my full-time job and other responsibilities, but the course was perfectly laid out and I finished well under six months and I learned so much. I have participated in English teaching camps and activities over the past several years in several different countries, but now that I have this course under my belt, I will be able to provide much more high quality lessons to my students in the future and I look forward to applying the information I learned in this course as I teach in Central America starting this summer. Thanks! Thanks so much for watching. We are ITTT, the leading provider for TEFL and TESOL training courses. If you like this video, please subscribe by clicking the button down here and click on any of the videos here on the left for more interesting teaching tips for getting certified to teach English abroad and online.