Ladies and gentlemen, to our over 200 attendees here in person at Joint Base Andrews, Maryland, and to our countless streamers online, welcome to day one of the 2024 U.S. Cyber Command legal conference. I'm Lieutenant Colonel Josh Johnson, I'm the Deputy Staff Judge Advocate or the Deputy General Counsel at U.S. Cyber Command, and I have the pleasure of introducing the Staff Judge Advocate, the General Counsel of U.S. Cyber Command, Colonel Pete Hayden. Colonel Hayden has served in this job for the last three years during an incredible time in national security law and cyberspace operations. He previously served on the National Security Council and served on Chairman's Legal, advising the chairman of the Joint Chiefs of Staff. Ladies and gentlemen, please welcome Colonel Pete Hayden. Wow. Good morning everybody. As you mentioned, I'm Colonel Pete Hayden. I'm the Staff Judge Advocate at U.S. Cyber Command. Welcome to the 2024 U.S. Cyber Command legal conference. For the past 12 years, this conference has explored cutting edge of issues in cyberspace and national security, specifically in military operations. It's always educational. Sometimes it's groundbreaking. You may be familiar with some of the speeches that have occurred here at this conference, and some of the ideas that have come out of these forums over the last 12 years. The theme for this year's conference is the power of partnerships. We're going to get together with a bunch of panels and a bunch of colleagues, and we're going to explore how we can work together to build a safer and better world in cyberspace. Over the next few days, you're going to hear from subject matter experts, 44 subject matter experts in speak, and then of course all of you in the room and online. And we're going to cover topics the subject matter experts come from the private sector. They come from the academy. They come from government, not just the military, but the broader federal government. They come from our international partners. The whole point is to learn how we partner with one another across lines. The topics are going to cover everything from privacy and civil liberties to competition and great powers, innovation, acquisition, private sector engagement, artificial intelligence, critical infrastructure protection, data protection, harmonizing the regulatory environment, and many more. I think you're going to find it interesting. I know I'm going to find it fascinating. So what would we like to take away? At the end of every session, I'd encourage you to think of three things. First, what does partnership mean to you and your organization? What can you get out of it? Why is it valuable to us? What can we accomplish with our partners? The second thing, of course, that we should be thinking about is we're all lawyers, or most of us are. How do law and policy affect our ability to partner with somebody, an organization that's not like us? But the third thing is, and this is the challenge, and what we really hope everybody comes away with, what do you need to know about the people that you would partner with, about the organizations you would partner with to build better relationships, to build better arrangements as lawyers to build better agreements, stronger, more enduring, more profitable for all partners? What do I need to know from my would-be partner's perspective? Their regulations, their limitations, their constraints, their authorities, their capabilities, their equities. What do I need to know, and how do I learn to frame how I engage with them? Think of these things at the end of each session each day. I want to say thank you. First of all, if you don't know her yet, I'm surprised, Lieutenant Colonel Lori Lincoln, who has spearheaded this conference and put everything together. I hope many of you know her. Lori's entire team has done a remarkable job with Ray Macias and Lieutenant Colonel Johnson, and then of course all of our team out in the front and the volunteers and the smart center, and then the defense media activity that's making it possible to bring this conference to those who can't be here in the room. Thank you to our 44 speakers, our experts who came to join us. Thank you to you in the room and to you online. Thank you so much for engaging with this stuff. Your discussion is going to make us better. So now, I'm pleased to introduce the keynote speaker and the real reason that you're here at this hour, General Tim Hock. General Hock assumed command of the United States Cyber Command and assumed the directorship of the National Security Agency and became chief of the Central Security Service in February. This is after 32 years of distinguished service in both the intelligence community and the military operations communities, and I counted it up. The man has been in command eight times. So a military officer, you understand what that means. That means he's been entrusted to be in charge eight times, 13 out of his 32 years. That's a huge amount. But what does it also mean? You look at the why and the why we want to work and why he's entrusted with leadership. This is the kind of people that lead our largest organizations, just like his predecessor, General Nakasone, he comes up with a vision. His principles are people, innovation, and partnerships. And what's the very first word? It's an organization of heavy policy. It's an organization of heavy technological change, and we're going to hear some of that because he's an expert on all of that. As are many of his leaders in Cyber Command and many of the people that you're going to hear from this week. But number one was people. And the motto of Cyber Command is we win with people, because that's what good leadership is. And that's what I encourage all of us to take to heart as we go back to our organizations. In this dual role, I don't know how he keeps it all in his head. How you date both the intelligence community, the cybersecurity community, and the military operations community. But however he does, we are honored to work for him at Cyber Command. So please join me in giving a warm welcome to General Timothy Hawk. Good morning. I would normally start with some sort of lawyer joke, but I normally tell everyone that if you're going to be in cyber, you're going to be a pretend lawyer. So I feel like I'm with my people. So when we think about where we are today in US Cyber Command and where cyber fits in the department, I just want to take a little bit of walk backwards. Because we've come a long way in a short period of time. I had the honor to serve for General Noxone as the deputy commander of JTF Aries in 2016. And this was a time when the department was trying to figure out, where does cyber fit? Where does it fit in our military doctrine? Where does it fit in our national policy? And at that time, we really didn't have clarity. We didn't yet have law that said where does cyber fit inside of military operations. We didn't yet have clarity on our national policy. And we certainly didn't have clear military doctrine. But when JTF Aries was stood up, we had a mandate. The Secretary of Defense had told Admiral Rogers that he wanted to take ISIS off the internet. And Admiral Rogers stood up a joint task force that was focused on understanding what that threat looked like online. And so when we began to propose operations, each one of those operations required us to essentially knock on every door in the interagency to explain what were we trying to accomplish. And there's been a really good post-mortem done on Operation Glowing Symphony, which was one of our largest operations at that time. But we had to go to every single door, led by our by our legal team walking through with the verse with the joint staff and with OSD and making sure that we were aligned in what we were proposing and how we proposed it. And then we had to walk through every element of the interagency and then all of our policymakers had to review each operation. And that was how it was done and that was not that long ago. When we think about our understanding of what law looks like in the military domain, we have millennia of experience of what it looks like in the land domain. We have centuries in how we think about maritime law. And we've got decades when we think about the air domain. 2016, we're talking about operations in cyberspace that we did not yet have really a codified approach of how we conducted operations and where they fit in military doctrine. So thankfully, 2018, a significant shift for overall how we think about cyberspace and how we gained alignment in our law through the 2019 NDAA, the establishment of national policy. And then establishing US Cyber Command as a combatant command with a clearly defined set of authorities and responsibilities. So as Cyber Command today, we know exactly what our roles are. And we know where we fit with our interagency teammates and we've got process to be able to work with them. And I'll talk about that today as to where we stand and how that collaboration works every single day. But first, I wanted to just make sure everybody was level set, what our roles and missions are. So when you think about US Cyber Command, three missions in the unified command plan. First, we defend the Department of Defense Information Network. So we are the responsible element to drive the defense of the entire department's network. All 15,000 networks that comprise the Department of Defense Information Network, we drive that defense with our partners across the department. Second mission, defend the nation in cyberspace. Really being able to defend outside our borders against foreign threats, targeting our critical infrastructure, defense critical infrastructure, or the department. That really translates to countering adversary hacking activity. Third mission is to support the joint force. And that's our partnership with the other combatant commands. And I'll talk more about how that partnership has evolved as we've integrated planning staffs with each of them and how we collaborate every single day. We have a fourth mission that has now been identified in the DOD cyber strategy. Building partnerships with allies and partners. Clearly overlaps with the theme today. And we're proud of the work that we do with our international teammates. Both those teammates that have capabilities and those teammates that are really trying to determine how does their ministry of defense build something that might be a cyber command or an entity that thinks about cyber and where it fits in their overall national strategy. So that's US Cyber Command and the roles that we play. I want to touch on the roles of the National Security Agency, because we certainly overlap every single day in how we operate. National Security Agency has two primary missions. First, as a foreign intelligence agency, conducts signals intelligence. The lead for the nation in conducting signals intelligence activities. To be able to collect information in the electromagnetic spectrum and to be able to produce indications of warning and intelligence for our policy makers. Lead for the nation in sighing. The second mission is in cyber security. Clearly define responsibilities as the national manager for national security systems. Setting the overall guidance and configuration essentially of our classified systems or systems that process national security information. NSA also has the responsibility in that cyber security mission to produce cryptography. The ability to generate code. And inside that, producing the cryptographic material that defend all of our systems. So as you can see between NSA and Cyber Command, they're clearly defined missions to organizations but operating in the same space. And that's why we have a single leader of both organizations. To allow us to have speed and agility and to be able to operate in a way that ensures both organizations can succeed in their missions and also not collide in cyberspace. So really good, we have had great success. We can talk more about that if that's an area that you're interested in. The environment that we're operating in today certainly is a charged environment. You can walk across the globe and think about what the threats look like today. Whether that's Russia's unlawful invasion of Ukraine and what that is translated to both for Ukrainian partners and for NATO. We could talk about the crisis that is going in the Middle East since Hamas's actions against Israel and Israel's response. And what that has meant to threats to US forces throughout the region and impacts on a number of allies and partners. We can look at what is happening today in cyberspace when we think about ransomware and the effect on US corporations and Western corporations and what that threat looks like. We can also talk about what China's activities in cyberspace look like. And one of the areas that we think about often is how do we expose that activity in a way that allows the maximum number of partners to be able to take advantage of that understanding to defend against those threats. So when we talk about China today, one of the threats you'll hear us talk about is something we've identified as living off the land. And what that really means is we have put out very detailed descriptions of Chinese tactics in cybersecurity advisories. And those cybersecurity advisories detail how China has penetrated systems and then use the capabilities inside those systems to live off the land using the technical capabilities of the systems they've compromised to reside there. Not for the purpose of intelligence collection, but to assure access in things like critical infrastructure or within Guam. Areas that we know have relevance from a military perspective, but also for pre-positioning for other activities. Those are things we want to expose and one of the reasons we want to expose it at that detail is so that we can then partner with our allies, with our partners to talk about those threats at an unclassified level. To be able to share that information with our industry partners, who also have insights that look different than ours based off their vantage point in either building the domain or operating in the domain. How do we increase that collaboration based off our knowledge? So as we think our way across the strategic environment, there are opportunities every single day to partner. And those are choices we make about how do we get the maximum benefit for the greatest number of partners as we approach those challenges. So one of the things that we're also thinking about is in our partnerships, one of the areas that we will address as we think about the future of US Cyber Command is also how do we partner with industry in capability development? As US Cyber Command, the original model of US Cyber Command when we were constructed was that the services would provide capabilities to the forces they present. And that model was really one that was thinking that a monolithic acquisition system would be able to over time be able to generate the requisite capabilities. What we have found is that largely we've had to generate our capabilities inside our force. And so what that has now occurred over time has been the growth of what are the expectations of US Cyber Command as an acquisition organization. And with a model that was thinking about, how could we grow Cyber Command to be so com like? Leveraging service like authorities. Now, the reason I'm going to walk through this is because I think it really talks about what our partners look like in the future. Because I think they're going to be different partners. And the vision of making a so come like has been a journey for about ten years that was finally realized two weeks ago. The passing of the budget for 24 and the appropriation gave Cyber Command the authority for enhanced budget control. What that translates to is we now have the budget responsibility for equipping the offensive and defensive cyberspace force for the Department of Defense, that force that we operate. So now we have the ability to be able to validate a requirement under our authorities that we've been given. We can allocate the resources against whatever that need is. And then we will be able to acquire that under our own authorities, either inside US Cyber Command or in partnership with the services where we drive the requirement, we have the resources. And now we're going to be able to produce the capability that we need for our forces. That's a pretty radical change from where we started to now what we're authorized to do today. And what Cyber Command now has to do is grow into that role very quickly. And so in our discussions with the department, one of our key areas that we'll be talking about is how do we, as Cyber Command, rapidly mature our acquisition force. We're really confident in our cyber acquisition executive that we brought on to lead that team. Now we need to think about what our partnerships look like with DARPA, with our research and engineering teams at OSD. What does that partnership look like with the services now that we have resources, multi-billion dollar resources to align against our capability development? How do we use the authorities the department has given us as an S&T center to do tech transfer? Where does that put us now to be able to partner with industry as we start to think about capability and capability development? That's an area that for us is going to be one of the most significant priorities that we will focus on and we will accelerate. And those partnerships will primarily drive us with our teammates in the services and with industry. The other area that we have really talked about with our teams is as we think about persistent engagement and when we look at the national defense strategy, which talks about integrated deterrence. What integrated deterrence really means to us is that the rest of the department is looking at US Cyber Command to say, how can you bring cyber to our activities? And as they think about their focus on strategic competitors, they clearly would like to partner with US Cyber Command. And that's our task. Our ability to partner with those combatant commands to be able to generate options for them that enable either defensive or offensive options that put them in a better position to be able to campaign within their respective area of responsibility. The way we've matured that has been primarily through our teams that we have placed at the combatant commands. We have over time grown teams at each combatant command that are at the smallest 35 cyber experts that we've now put with those combatant commands to the high end of over 50. And that allows us to integrate every single day with every combatant command across the globe and with US Cyber Command being invested in their outcomes. And being able to deliver cyber as part of how they campaign and how they think about integrated deterrence. For us in the missions that we're responsible for, when we think about the overall responsibility to defend the Doden or to defend the nation in cyberspace, the areas that we're thinking about are outcomes. How do we break down a problem? And we normally do it through a very simple structure. How do we generate insights about that problem? How do we enable defense? And how do we impose costs? And inside there, what we have matured to is very different than where we started in JTFaries, which was about the department generating a capability and getting it approved to be able to execute. Today, it's about outcomes. And those outcomes could be a cyber operation. It could also be a public affairs release that exposes something from our adversary. It could be a defend forward mission where we send a defensive team to another nation to help them clean out a network and identify adversary activity and expose that activity. It could also be a sanction. It could be a demarch. It could be an exposure by the Department of State's Global Engagement Center. The outcome is what matters. And in doing that, we can think about how we campaign very differently. And we're proud of the work that goes on every day with our interagency teammates, with our other combatant command teammates, and also with our foreign partners that are also dealing with the very same issues, either within their networks or in requests from other elements of their government for more cyber capability. So the last area that I really wanted to talk about is how we really think about multi-domain. When you think about what the future holds and we look at what's happening today in Russia, Ukraine, and what it means to not just be able to generate kinetic capability, it's also about how we operate, how we defend networks to ensure that we have information advantage. And so for us, as we think about those multi-domain activities, it's also about realizing that as a Department of Defense, we have incredible capability, incredible experience. But we have not had a crisis against a near peer that could both collect against us at scale and also target us within the cyber domain at scale. So what does that mean for us when we start to think about our priorities? That means we need to think about how US Cyber Command leads the department to set the globe from a security perspective. How do we ensure that we're cyber secure? So that we understand that the department would be able to operate all the way from our strategic capabilities to be able to move goods around the globe and to be able to ensure that we're best postured. That takes a number of partnerships. When we think about how the Department of Defense moves, our global reach, what does that also mean for the networks that we operate? What does that mean about the underlying infrastructure of the partner nation that we're going to be operating with? That brings with it an implied series of partners that we have to have to be able to be successful in anything that we're going to do in crisis. Those include our combatant commands, those include the interagency, and they include the foreign partners and allies that we're going to be operating with. And it's going to be different than what we've seen in our past. So for us, it starts with setting the globe. Wherever that crisis is, we're going to think about setting the theater. And how do we partner with the geographic element that may be the lead for that crisis to ensure that they have information advantage? That's an area for us that's going to be continued tradecraft. That's going to allow us to be thinking about not just where do we place our cyber protection teams, our high-end defensive force. It's about how do we use all the authorities that we have to set the configuration of the Department of Defense networks to be able to set the training standard for anybody who does cybersecurity or defense across the globe in the Department of Defense. And it's also which partners and allies do we need to either team with or when they come and say, hey, we need some help. As we think about standing up a cyber command, that's where we're going to invest our time and our energy. Because it's going to be important to our command and command teammates to be able to respond in a crisis. The other thing we have to think about in any crisis is generating options. How do we generate options for our policy makers, for the secretary, and for any supported combatant command? This is where the overall department and Congress's investment in the US Cyber Command and our ability to generate capability. We've got to be able to do that so we can generate options that are going to be relevant in competition, in crisis, in conflict. We're doing it successfully today, but we've got to be able to do it at scale. And I think those are the areas we're pretty excited about. So finally, what I really wanted to walk through today, is kind of talk a little bit about where we are. As I get the very exciting week of getting to be part of posture hearings all week long after leaving you today, it'll be an assessment of where we are today as US Cyber Command and the National Security. And we're at a really great starting place. But we have opportunity in front of us, and our grade sheet should be built on how well we use the authorities we've been given, how fast we scale, and how we partner. So looking forward to continue the conversation with you. I'll take questions for a few minutes on any topic that you're interested in. It's our Sean McMahon from SOCOM. I know with the new passage of, as your service like authorities are going, and they have the ASD cyber, in alignment with SOCOM has ASD-SOLIC, our partnership, ADCON, Statutorily Defined Partnership. How do you see that going for you going into the building, in your cybercom hat, using that ASD and then being able to project and message to the secretary and those unders and deputies? How do you think that goes forward now with the current creation of it and then going forward? Do you see it becoming like an ASD-SOLIC or something different? That is clearly Congress's vision. Is the relationship between ASD-SOLIC and SOCOM should evolve that ASD-CYBER will look like that with cyber command. Now, we're gonna get an opportunity to really test that partnership fast. Cuz I'm testifying with the acting ASD-CYBER actually manning this week. And so it'll be our opportunity to talk about what we see this looking like. There are a couple things that Congress has already given us. That is where we're gonna owe products. So when we think about part of our future, we are talking about cyber command 2.0. And for us, that's how do we take all these new authorities? How do we take this partnership with ASD-CYBER? And how do we leverage a series of things that Congress has asked us to do? And Congress has asked us to study, how do we generate forces? How do we structure our headquarters that includes cyber command headquarters, our joint force headquarters that are our components, and our cyber operation integrated planning elements that are our forward presence with combatant commands. It asks us to also accelerate our ability to stand up a program executive office by 2027 to manage our architecture. And finally, we did a defense science board study on our architecture. So all those are due, but one of those studies on force generation has required us to go back between ASD-CYBER and the commander of US Cyber Command and brief the secretary on our vision for the future of force generation this summer. And so that's gonna clearly be a really good example to partnership. So you didn't ask, but I'll now dive a little deeper on that. Cuz I think it is a good cue and I know you're likely gonna have some conversations about it. So in the force generation study, what it asked us to do was to look at our partnership with the services. And what I will tell you is, over time, we have had with the services a different relationship between each service and at different parts of our creation and to where we are today. But we're pretty proud of how the services responded to a series of things. So before I go into that study, I'll talk about how we've worked with the services real quick. And one of those is, Congress asked us last year in an element of the law on section 1502 to evaluate the services readiness and their ability to present forces to US Cyber Command. So we provided Joe Noxone submitted back a response that said, here is how the services are doing. And here are five things that we think the services could do to improve our readiness. And most of those things were areas that had previously been tackled by SOCOM, as it looks at how the special operations forces are managed. And it was around personnel policies. It was in how the services leveraged tools that Congress had given for retention to each of the services. And it was about assignment policies. And so those five things were areas we identified that have now come back to the department in a different section of law in this year's NDA for the department to consider to implement those five things. Well, what we also found in the last year is that we have been doing a concerted readiness campaign plan with our service teammates and with our service cyber components. So it's been going on for over a year. And we have now seen a pretty significant jump in our readiness. And part of that has been driven by services implementing a number of those areas we had identified. Now, what else could the services do? Probably the number one thing that we would ask them to do is uniformly implement those five things. So we have seen individually within the services some really excellent things as part of our partnership to be able to improve our readiness. And use things that Congress has given us. The Army has incentive pay that's based off of certifications and qualifications, it's really good. The Air Force has now implemented a tech track pilot for keeping individuals in cyber for extended periods of time and have changed some assignment policies. The Navy has now created their rating. And the Marine Corps has an eight year initial enrollment for a new cyber officer. Those are all really good examples of something each service has done. We would like to see them all raise that floor farther. And that would be an area. So that's our starting point when we look at where we are in force generation. And one of the key things that we were told was evaluate where you are today, which is really last year's approach. Include the SOCOM like model which you've just begun. And then look at whether or not we should consider a cyber service. And so we're doing a study right now that will evaluate and we brought in an outside think tank to help us look at this. What are the spectrum of options? There are also a number of things in between there that we should consider. And also whether or not any of that menu should be applied together. So we're evaluating that and that'll be a great test for us as our teammates within ASD cyber and cyber command as we go forward. Good question. Good morning, sir. On our 10th leap, you mentioned the cyber security missions as well as cyber defense and partnership development. Could you please tell us a little more about the division between those missions, collaboration between cyber command, the interagency and partners? And what kinds of solutions you think are needed in that area? So first, I think as I think about internal to the department. What really there's been a number of initiatives by the secretary and the depth sec death to raise how we are doing cyber security in the department writ large and identifying where do we have any critical vulnerabilities. And one of the areas that US cyber command has taken on as part of that, we have a role within the department and in the law as the joint force trainer. So that allows cyber command to set the training requirements, not just for our force, but for all of duty cyber forces. And that allows us to now start to raise that floor. The first place we've invested our time in our training standards was in the cyber security service providers and what is the standard for every element in the department that does cyber security. And that is our offering to start to grow the overall capability of the department so that every weapon system has a cyber security service provider that is trained to a common standard. And so we have now been able to start assess the readiness of the key largest cyber security providers and we want to keep that going throughout the department. That's an example of how internal the department. With our interagency teammates, I think from both NSA and cyber command we clearly have we see defined roles between all of our other team mates. The role that DHS plays in terms of defending our critical infrastructure with all of the lead agencies for the identified elements of critical infrastructure. The role that the FBI plays in terms of response to hacking activity in the United States and how they pursue and investigate. You'll hear from both of them during the conference. And I think you'll find from both of them that we have incredible collaborative activities that go on with both CISA and with FBI every single day. They are focused domestically. We are focused outside of our borders and how we think about threats. So it gives us a really clear delineation. Now the other thing that we want to be able to do is be able to share information faster. So what the department has now done has given cyber command the resources that we will now place LNOs from cyber command with every lead agency for a critical infrastructure segment. And that will allow us just to have better connectivity. So if we see a threat, we'll now have somebody on site to be able to work with that lead federal agency so that we can move faster and be able to allow them to use their authorities if there's something that we see that they haven't seen. So I think those delineations have served us well. And there are areas that we want to make sure that we close any gap as we go forward. Good morning, sir. Steve Svansky from Army OT Jack National Security Division. Given advances in technology, there have been increasing calls for more government regulation in cyberspace and artificial intelligence, both in the private sector and the public sector. This could potentially disrupt the US market-based approach to cyberspace that we've had for the advent of the Internet, pushing more towards a European model of more increased government regulation. From a cybercom perspective, would we serve welcome that type of more of a regulatory encroachment or would we do that more as a hindrance? Thank you, sir. So I'll steer clear of the policy discussion about how the US government's going to regulate. And I'll tell you how I'm thinking about the overall problem. So I'll give you two very different lens to look at it through. So the first one, when I think about overall privacy, I think about service members. And how do we think about educating our force and how to operate in an environment where their data may be accessible by our adversaries? And how could that be used? And how well are we doing today to think about preparing our force for a crisis where they could be messaged or they could become a target of an information campaign? How well are we educating our force today? I think that's one that we have to consider as a department, as a risk that is increasingly something we should be concerned about. The other area is how do we think about AI and where do we contribute in terms of understanding the threat environment? So when I think about that, it really starts with the investment that NSA has now made to stand up our AI security center. A built inside of the cyber collaboration center that really is the outward facing part of NSA to be able to work with industry and be able to share what we know and to be able to partner in a way that allows them to leverage, we can leverage what they know. And we're able to enable that from our perspective. We have a different vantage point in how we can inform this conversation. How do we believe that adversaries are going to leverage this technology? How are they going to target it to try and steal it from an intellectual property theft perspective? Are there appropriate security controls that ensures the tools don't get subverted in some way? Those are the things that we have to be thinking about from a threat perspective to be able to inform this dialogue. And it's an area for us that I think we're increasingly postured for. We do have extensive experience in both NSA and Cyber Command of leveraging artificial intelligence and machine learning and have done so for extended periods of time. So I think from our perspective, we'll keep trying to inform that discussion but we'll allow the policymakers to determine what is the end game for what those regulations look like. Good question. So I think we've been a strong supporter of doing a pilot in that area. How do we think about this? I think there are a number of models that we've talked about with Congress. And we've also seen the Marines being pretty thoughtful in how they've approached this. So we were a strong supporter in the last NDAA to get language that would allow us to begin a pilot and think about what that would look like in terms of what a partnership a public-private partnership would look like and a way for us to leverage talent, particularly as we would think about incident response in the United States. So we're excited to pilot that and we've been a strong supporter of that legislation and we look to inform it as we go forward. It's a great question. Sir, thank you so much for taking the time to come down and kick off our legal conference. We could not think of a better way to start. And the lawyers will appreciate how much of a wonderful client you are in terms of you value the legal advice, you seek out the lawyers. But you ask us tough questions and make us do our job to ensure that Cyber Command and our partners can accomplish our mission. So best of luck in your congressional testimony. Ladies and gentlemen, please join me in a round of applause for General Hawke. All right, ladies and gentlemen, we are now on break and we will start sharply at 0945 Eastern Time, private partnership. In recent congressional testimony, the private industry has been described as our force multiplier. And so our first panel for our legal conference is a corporate round table, the evolving cyber threat landscape. And I have the pleasure of introducing our panel's moderator, Mr. Nick Hall. Mr. Hall is the deputy to the commander of the United States Cyber Command Cyber National Mission Force. And in this role, Mr. Hall is able to assist the commander in leading a 2000 plus member organization responsible for planning, directing, synchronizing full spectrum cyberspace operations to defend the nation from foreign malicious cyberactors. Ladies and gentlemen, please welcome Mr. Nick Hall. Thanks very much to everyone for being here. Thanks to the organizers. Thanks to our partners and allies from around the world. And thanks very much to Heather Adkins, the vice president of security engineering at Google, and Judy, the senior threat intel analyst from Microsoft's threat intelligence center. Heather and Judy bring a wealth of experience in operating and defending the networks that make up the domain that we are tasked with defending here in Cyber Command, right? So unlike any other domain, cyberspace is built and operated by human beings and built and operated by human beings in the private sector, right? So the private sector isn't just a partner here, right? The private sector owns the domain that we operate in, right? Which means that our partners and our colleagues in the private sector have tremendous insight into what happens in their domain, right? And play a critical role in building, operating and defending the systems that underpin all of modern life, right? So really, I'm really excited to talk to you all today about how we can work together to improve the security of this global commons of the internet, right? And make it possible for us all to live and work online in a way that's safe. So I thought we'd talk about the threat a little bit. How do you see the threat evolving over your time working in this space? And where do you see it going? So Judy, right? I know with all of the recent news about things like full typhoon, right? A lot of what's old is new again. So where do you see things coming from and where do you see things going? Absolutely, thank you, Nick. And thank you everyone for having me. I just want to start off. We have a saying where it's same same but different, right? So the cyber threat actors are trying to achieve their strategic goals. And these goals don't often change, right? It's for intelligence gathering. It's for gaining access and keeping access, right? However, that's the same goal. But the difference is they do it differently. So the commander just mentioned living off the land, right? That's not a new idea. It's a way to live in the environment that they are. So they don't raise any alarms. So it goes with the same same but different. And also they have a desire to be sneakier, right? So I come from a background where I've been tracking the China threat adversary for over 15 years within government and outside of government, right? And so in the beginning, predating APT-1 report, they used to be a lot louder. You used to be able to see where they registered their domains. They might use their true names, things like that. But these days with privacy and them wanting to hide their stealthiness and wanting to hide that hand, it's a lot harder to just attribute one activity without enriching your data set and looking beyond just one piece of data set. You know, I think, hopefully you can hear me OK? I would say over my kind of 25, 30 year career that the thing that really stands out for me is that the techniques we're seeing are not that different. What is different now is the scale, the sophistication, and the way these capabilities are deployed. I'll give you some stack on that. 40% increase year over year between 2022 and 2023 cyber attacks in one year alone, a 40% increase. That suggests to us that there's some element of democratization of hacking capability, that there's certainly an element in the criminal underground and certainly with the radicalization of teenagers enabling people to just do a lot more hacking. I mean, it's sort of out there. The other thing we have to keep in mind is that there are now commercial vendors providing this capability to various entities, not just governments, but in various places in the world, also to other commercial companies, to law firms, et cetera. 75% of all of the vulnerabilities against Chrome last year derived out of commercial security vendors, not nation states. This means that we are going to be dealing with elements of scale for quite some time. But the techniques are all the same. Living off the land is a really good example. Any of you have ever read The Cuckoo's Egg, a very classic book on a KGB contractor in the 80s lived off the land in US government networks. This is not new. I think what we have to think about from a defense perspective is how do we defend it scale? And we're going to do that not with people, but with technology through better security design and just better architecture and technology decisions overall. And I think that's the challenge for all of us in the industry building these platforms that billions of people use every day. So how do we shape the environment in our favor? It's something that we think about at Cyber Command and the Cyber National Mission Force. It's something that I know we think about in the private sector right here. You want to shape the environment in a way that's favorable to expanding market share, to bringing new products to market. How do we shape the environment in a way that's favorable to defense and security? Yeah, I think one way to think about this is just how hard is it to secure? I saw a stat recently that worldwide, we're missing about 2.3 million cyber jobs today. And that might be as big as 3 million in a couple of years. We are simply not going to hire and train our way out of that mess. It means that we're going to have to put the security job in the hands of not a security professional, but in the hands of everyone who runs the IT system, all the software developers, everyone who contributes to building, designing, and maintaining the systems. And the only way we're going to do that is by making that job much easier. Again, you're not going to train all of these millions of people doing IT and development jobs. We're not going to give them all a PhD in cyber. So the reality is that the technology they buy, the technology they build off the shelf, has to be secure by design. So that when you buy a solution, it's actually really hard to do the wrong thing. If you look at the way we built the internet, it is built on layers and layers and layers of technology that is designed to be trusted by default. This is why you can send an email anywhere in the world to anyone without authenticating, because it assumed that everybody in that ecosystem was trustworthy. We have to shift to the opposite mindset of zero trust by default. So as we shift to a zero trust mindset, and as we build the training and the infrastructure to improve security, how do we arm people with the information they need to take action to secure networks and counter threats? I think this segues ways into a big topic in this conference partnership, threat sharing between different partners and also continuous feedback. Continuous feedback can help us improve our security, but partnerships can also say, hey, we notice something here. And then we go back and investigate, and we're able to understand what they were doing and how they were abusing it and be able to put in new security features to be able to afford that activity. But partnership is really important in communication. And what have you seen works best in that space? Both, right? Both communication and partnership. I can tell you my team at the Microsoft Threat Intelligence Center were in partnerships with different government agencies, but also different private companies as well. Because communication is really important. Seeing you can see something in the left. I can see something in the middle, and the other partner may see something in the right. But combining that picture together, that's when you may get the whole picture. And then communicating that back out, letting your partners know what you discovered and what you think it might. And that comes from building trusted relationships, but also trying to build new partnerships. And entering the collaboration centers, like I think the commander just mentioned, the Cyber Collaboration Center at NSA. And CISA has their own collaboration centers. It's being an active participant in those partnerships. Yeah, I would echo that Judy. I think the partnership pieces, I think we've as an industry been working on this for as long as I can remember, 14, 15 years now, is to think about how do we build the common picture together, super important. And then companies like Google joining the JCDC, we're a founding member of that, contributing to shared threat picture actually for not just nation state actors, but also in the criminal sphere with ransomware actors as well, and the commercial security providers that are sort of eating away at this ecosystem quite a bit. I think the other thing to keep in mind is that in addition to the operating picture, we need to remember the foundations of how the internet was built. It was built through coalition, university researchers, government researchers coming together and building open standards, open protocols. That's how these layers on the internet were built. And I think that's also how the next generation of those technologies will be built. Coming to the table and saying, we need a secure solution that does the following thing. Let's not build a proprietary solution. Let's build an open one and interoperable with the systems we have today so we can migrate to a better future over time. And I think a little bit about some of the great work NIST does, for example, on crypto, many of the internet protocols themselves through coalition government. And that also allows us to more seamlessly work with international partners in Europe and the Quad countries, et cetera. So I would say that partnership is not just threat sharing. It's also the foundations of the technology that we build as well. And how do we bring in the open source software community into things like this? Yeah, open source hot topic at the moment. If I think a lot of people will be aware that there's an ongoing, I guess we might call it an industry incident where we're all watching the XV project. This is a piece of compression software that's been incorporated into many, many parts of the ecosystem. This has had one maintainer for quite some time. And we now, I think, better understand that single maintainer projects are a little bit vulnerable both to sustainability, but maybe also to social engineering, which is what happened here. And an unknown threat actor, at least unknown to me, has managed to attempt to get a back door in there. I think the open source community really imbibes that culture and spirit of the open collaborative process. And I think that's what they love contributing. Their time, their energy, they volunteer. Most of them do this for free without any compensation other than the pure joy of contributing. But they are all gonna retire one day. And there are probably 1,000, 1,500, 2,000 of these projects that will need a sustainability plan if we're gonna put them in critical infrastructure. I don't think we've got a great solution to that. There are amazing initiatives, Microsoft and Google both participating in things like the Alpha Omega project to give funding. We've got new frameworks for thinking about building secure software. OpenSSF is a great partner there. Again, industry coalition, industry collaboration. But we have to have a serious conversation, I think, about how do we help the maintainers over time. She took all the best words out of my mouth. She wrapped it up brilliantly. I have nothing to add. Heather, I think your point on the social engineering aspect of this recent vulnerability is really interesting. And Judy, I know you've done a lot of work both in the technical space, but also in the understanding where the adversary is coming from. And can you talk a little bit about how we're not just facing a technical problem and a technical threat. How you also have to understand who the people are who are behind the technical threat. The context, right? What motivates them? Why they may enter and target one sector, where can we predict that they might go next, right? So I don't want to jump ahead to some of the volt typhoon discussion, but if you look at China's strategy that they put out in 2020, the science of military strategy, right? Their military doctrine of where they would use CNA. There are specific sectors that are mentioned in this doctrine, right? And our team has kind of done where we've seen volt typhoon activity and we've compared it to that critical infrastructure list that was mentioned in this military doctrine. I'm not gonna say it's a one for one, but it's pretty close and we definitely see some sectors overlap. So we can do things like, oh, they've mentioned power generation and whatnot. Let's go look at this other sector that they might have mentioned and we'll take the TTPs that they've used and let's see if we can highlight, discover anything in those sectors that we may not have seen before. But if we go and hunt for specific TTPs that they use in that area, that helps us one highlight new activity but all the collaboration that we mentioned and the partnerships, we can actually go back to our partners and say, hey, has anyone seen anything in this sector as well? And I would say, looking at the trends to your point, also important for not just the one threat actor we know about, but the threat actors are learning from each other as well. So we can see the threat picture between Russia, China, DPRK, for example. Common techniques, whether they're studying each other or sharing between themselves, I wouldn't know. But this XV example, this open source example reminds me a lot of what the North Koreans did a couple years back where they set up a company, they impersonated security researchers, they made friends with all the security researchers and of course being an open collaborative environment, they like to trade research, right? All of these very, very smart developers. The North Koreans were actually able to make friends and get in there and then exploit their friends, right? And so that I think other actors are looking at that learning from it and probably adapting it. I think XV is a good example where probably somebody learned a lot a couple years ago by that example. And the only reason that we're able to defend against it is because partners come to the table, we share what we know and we can be on the lookout for that. And I think that, you know, I sort of credit the finder of this XV issue, which is a software engineer at Microsoft and being aware, being aware enough to spot something that nobody had thought about. And just adding on to what you said about threat actors learning from each other, you know, there's also a trend of if a zero day comes out, right? And, you know, someone posts the proof of concept publicly available, we'll see a group of threat actors that may have original access to the proof of concept, you know, basically blueprints to how to use it. And once that's out there, we'll see other threat actors pile on. And then it becomes a whole attribution mess of like, okay, which actor was actually leveraging the code to accomplish their mission. So it was a military command, right? It's really easy for us to conceptualize threats in terms of nation state actors, right? The Volt Typhoons, right? The Russian Intel Services, the North Koreans. But earlier you talked about radicalized teenagers, right? You talked about private sector, right? You talked about actors learning from each other, right? How do you think about the non-nation state threats that might be learning things from nation state actors? I feel like the situation's very fluid. And we, you know, my background's actually in marine biology. And one of the first things you learn is the Linnaean taxonomy for organisms, right? And sort of as humans, we put names and labels on things because it makes it really easy for us to understand them and understand the differences between them. I think we do that a little bit with threat actors, right? This is APT 1, 2, 3, 4, 5, 6, 7, 8. But in reality, I think there's a lot of fluidity here. And I mentioned radicalization of teenagers. One of the great honors currently from, you know, that I'm getting to participate in is CISA's Cyber Safety Review Board. And we did a review of a threat actor group called Lapsis. And when we were doing that review, we thought, okay, we're gonna review this Lapsis group, whoever they are. And then it turns out, actually, they're part of a broader ecosystem. And they called themselves Lapsis for all of three months. And then they all kind of splintered off.  And some of them are just teenagers hacking to make money. And some of them are participating in very scary, organized crime, really dark stuff. And some of them are one step away from getting paid by a government to hand over an exploit, a technique, or access. So I think when we put these labels on things, be careful, because these lines are actually very difficult to define. We have a very professionalized approach, maybe here in the United States, but you go somewhere else in the world. And somebody may have a day job, somebody may have a night job, and people move between these roles. So it's not as clear as we might think about it. Another way just, you know, to be nation state agnostic and whatnot is just to look at the behavior. What behavior are they exerting? What are they doing that may catch our eyes? Like, are they doing something on the operating system that shouldn't be done, right? And then, you know, that is looking at the actual behavior that displayed. And then once you look at the behavior, you can, you know, build out your research and discover, hey, who else is using this methodology? And, you know, does this tie to a set of activity already?  You know, I like, I like slogans obviously, but one of these things is not like the other. So what sticks out for us to go and look at that emerging threat behavior and whatnot and to build it out? And I was just saying, I think that's really important for the disruption conversation because defenders, you know, I tell my teams at Google doesn't really matter if it's Sally or Sam or Alice on the other side. It matters what they've deployed against you. You need to understand the in common techniques that might work and you need to defend against that. And I think that comes up in the disruption conversation as well because if you think about it, if you've got a threat actor who's doing ransomware and using social engineering to get in and you've got a nation state who's doing that as well, you're gonna disrupt them potentially using the same kinds of techniques that may have a different decision framework. So in some sense, we have to begin to up level the conversation on defense because we have to defend against all the threat actors and all the in common techniques. So back to, you know, what's gonna work, what's gonna make a difference. It's going to be through raising the bar on the defense side. So how do you think of non-state but seemingly aligned threat actors, right? So hacktivists, right? Who are doing things that are, right? Maybe not at the behest of a nation state but certainly aligned with a nation state interest, right? Ransomware actors, right? Who might enjoy sanctuary at a nation state, right? I think as we look at ransomware tools, right? That won't install on computers with a Russian language pack, right? That's certainly a tell about where they're comfortable operating and where they're not comfortable operating, right? How do you think about those threats and how do you think about what we could do together? I think it goes to Heather's point where it no longer matters if it's Sally or Bob, right? What are they trying to accomplish, right?  So we have to look at their techniques and stop them at their techniques, right? Motivation is just always hard to measure, right? You never know the motivation of the person on the other side. So whether it be a hacktivist or in behest of a foreign government or just, you know, personal views and whatnot, it depends on their behavior and what they're trying to accomplish and how we defend against that. I think there's been some interesting conversation over the years about norms. So, you know, what are the norms around the use of cyber, especially in the military context? And could you have a kind of Geneva convention for cyber of countries agreeing to the do's and the don'ts? I think when you bring it back to activists or state aligned or even state tolerated, all the norms are out the window. We've seen this in Ukraine, for example. When Russia invaded Ukraine, Ukraine put out a call to the world, please come defend Ukraine. And you saw thousands of hackers all over the planet willing to hack Russia on behalf of Ukraine. These are not under any kind of military command. There are no rules, a lot of hacking and dumping of data, chaos, if you will. And we saw a little bit of this also with the current Israeli Hamas conflict. We released a paper tool of first resort where we saw activity by Hamas before and after October 7th. And we're continuing to see that. And it's not necessarily controlled by necessarily any one particular military command, but it's in support of Hamas. And again, it throws the predictability and the norms out the window. So I think from a policy perspective, we just have to keep that in mind as we think about how do we wanna regulate cyber? How do we wanna set norms? Understanding that the threat in the adversary is not always operating under a agreed upon set of rules. And that's probably going to continue for quite some time. So what have you seen work best for identifying these threats, right? For sharing information between the private sector, right? The open source community, the government, right? Like we talked a little bit about the Cyber Security Collaboration Center, right? Cyber Command has a program called Under-Advisement that works in parallel to that and in concert with it. But I also recognize that I spend most of my day living inside a vault, right? In a big glass building surrounded by fences. So how do we collaborate better, right? What works? What can I do better? What can we all hear in uniform in the room do better? I'll say that it's changed a lot in the last, say, four or five years, maybe. I think government coming to the table and declassifying information has been incredibly helpful. That has been a barrier for us on the collaboration front for a long time. Of course, there are certain things that deserve to be kept back and certainly to be discussed only in certain forums. But we can only take action on information if we have the freedom to do that. So receiving indicators of compromise, receiving information about threat actors and how they behave is helpful because then we can go program our systems to defend. That's why I'd say that's been really helpful and that has changed a little bit over the last couple of years. Encourage people to continue to think forward on this. As you mentioned, Nick, the cloud providers especially are providing a lot of services for critical infrastructure in the United States. Small to medium businesses in the United States are like two to three million of them, schools, et cetera. We can only help defend the nation if we have the information that we need to. But I think also creating the table for us to sit at to come together, whether it's JCDC or any of the other initiatives. We will naturally info share because it's in the benefit to all of our customers to do so. We're a Microsoft user inside. We develop Chrome for Windows. So naturally we've got Chrome developers. But also many of our customers use Microsoft and vice versa. So we're gonna naturally collaborate but I think creating the table for us to come together is very, very important. And then I also mentioned on the defense side not just the information sharing but on the defense side to make sure that we're all creating open, operable, interoperable solutions that enable us to sort of defend its scale. But yeah. Absolutely, echoing what Heather said, bringing us to the table at these collaboration all at the same time is really helpful because then we can also make a connection but we can actually have meaningful conversations rooms as well when you bring us all to the table and share threats, IOCs and whatnot. We can all be like, oh, so actually when we discovered, we've actually seen some of this behavior over here and there can be more meaningful conversation in the room that may highlight something from industry to government or vice versa. So we have classified information. You have proprietary information. You have customer information, right? Are the current systems, right, in place to make you comfortable having conversations, to make us all having conversations? We talked about declassifying, right? How can we help make it more comfortable to share proprietary information in a safe space, right? Not to enable a commercial advantage, right, but to enable common defense. I think a lot of the things that are useful to know aren't particularly proprietary. I think if you're building an open and interoperable system, then you're using open protocols, open standards, and these are not particularly proprietary secrets, especially when it comes to the kinds of techniques that help people defend its scale, whether it's security keys, which is done through open collaboration with the Fido Alliance, all the way to crypto where you have NIST as a kind of a collaboration body. So actually, I think that things that really matter are not that proprietary. I think we also do have to be mindful and respectful that as cloud providers, we're providing not just to the United States, but we have customers all over the world. We have complex regulatory environment, complex privacy environment all over the world, and complex customer expectations as well. And so we wanna be at the table. We also wanna be respectful of how other partners are looking at that. And so I think that just making sure we're being thoughtful at the table is really important. Being thoughtful, and again, to what Heather said, being thoughtful, and also continuous collaboration. These relationships take time. So your first collaboration meeting, you wanna start it with a bang. It may not start off like that. It takes time to build relationships. It's also, there's a level of trust between entities when you come to a collaboration, a wider collaboration. So it just takes time. Understanding that it's not gonna happen overnight. It may take multiple meetings to gain that trust, build that relationship, where you have a better understanding of what you can share and what you can bring to the table and what I can share and what I can bring to the table is really important. But just to understand that it takes time and it doesn't happen overnight too. Yeah, that's a great point. Right, we talk frequently of operating at the speed of cyber, right? But really we're operating at the speed of trust, right? And trust is a thing that you can't surge in a crisis. You've gotta build it up. Before we go to questions here in a little bit, any closing thoughts on how we can build that trust, right? What we can do from the government to help build that trust, to help improve that communication. Are there better questions we could be asking you? Is there a question you wish that I'd asked you today? Well, we didn't talk about AI. That's a question maybe we can't talk about, but again, I think the trust is built on relationship. It's built on bidirectional information sharing, bidirectional building. We find when we have to build trust between teams at Google, we give them a task whether it's in an incident or to build something together that creates more lasting trust than an occasional conference or an occasional meeting. People have to work together to know that they can trust each other. And so finding opportunities for work to get done, whether it's in standards bodies or sort of developing norms or sort of working through the difficult conversations on sharing, these kinds of things will build lasting trust. And then I would also think about just the natural movement of people. People come in and out of roles. If you really want capability to be sustained, then this is a relationship building that has to be ongoing. It can't be just point in time, one conference, two conferences. It must be a cadence and a steady drip of opportunity to build trust between generations of folks who are gonna move in and out of these worlds. And I'll sort of tie that a little bit into AI. I think AI is gonna change the workforce quite a bit in terms of capability and what technology they will have available to them to defend at scale. And so I think we're gonna all, as a community, need to come together in new kinds of ways as that happens. We're thinking about the early career talent coming in right now who are using security technology that the vendors are putting more and more AI into. This is data analysis at scale, petabytes of data now available to them to spot things they've never been able to see before. That's going to change the cadence, it's gonna change the kinds of things we do together. And I think underlines the collaboration that we're gonna need as a community. Hitting on Heather's theme of task and cadence is really important, right? Working on a problem together is really important, like Heather highlighted, but having that cadence, not just getting called out of the blue, but having quarterly or biannual meetings on this, especially enduring threats is really important because those are the ones that don't change. But if there's a topic for emerging threats, that may be a different group of people because like Heather said, we don't always have the same people working on the same issue. So it also gives different opportunities to different people to build the relationships as well. And we could talk about AI, right? So in the future, some more questions about AI and just thinking through what does it mean and how not only, how to use AI for defense, but I think it was mentioned earlier, how do our adversaries use the same AI technology available for them? Well, I really appreciate, you know, it's time and thoughtful approach to this big challenge. I'm really excited about the potential, right? The continued potential for what we can do together to spot threats, mitigate threats, right? And disrupt them as needed. Why don't we go to questions from the audience? Hi. Hi, yes. I'm Ed Vasco. I'm with Boise State University and I run their Cybersecurity Institute. And I have many, many questions we can take offline. But the primary one seems to be the push towards automation at the bottom layer. And it seems as though we end up, my concern would be, and question to you both would be, do we not end up in a spiral where if we can't train enough people to come in at the bottom layer anyway and we replace the bottom layer, do we not create a situation where we're not giving the base level of understanding, the base level of awareness, and the base level of training in order to be able to do the advanced work from a career pathway standpoint? So lots of opinions on this, I might jump in. When we look at where we might be deploying AI assisted work, we're looking at a few things. The reason we have such a problem with the talent base at the moment is that it takes a long time to train and then we have burnout. And that's probably a five to seven year cycle. I see most people come in, train, it's been really hard. Actually, we find people coming out of four year degrees and certification programs are having trouble getting the first job because they have no experience. I think we have the ability to solve all those problems. First off, we are starting to see people shape the kind of interactive AI LLM chatbots to be assistants and that includes teaching. So for example, if you had to learn to code, two years ago that would have been an intensive class you took, you may not like your instructor, maybe hard, maybe they didn't teach the way that you learn. Now we have an assistant who doesn't judge you for your mistakes. And also is as patient and can give you as much time as you need. And in addition to that, help you code basic things. Now I'm not talking hardware, firmware. I'm talking a script to automate a task that might otherwise take six hours to do manually. So this is very beneficial for early career. The other thing is you have an oracle of knowledge at your fingertips and to help you learn on the job. And so it could be possible that those early career people coming out of training programs, you would feel much more confident hiring them without any experience if you knew they'd had help to get the job done in a very unique way. It will also remove the toil that causes the burnout because we can have the automated, it's really the data analysis. So if you've got a sock, people looking at false positives every day, you can start to automate some of that away, make it smarter, make the assistance in doing analysis smarter, malware analysis, data analysis at scale. So I actually think it's gonna help the bottom layer, not replace it. They'll stay in the job longer, it'll be more interesting and you can develop then the advanced skills over time. The problem now is that everybody falls out of the field before they can get to that advanced level. That's just my opinion, but that's kinda where I see us going. I would also say that some of the automation are things, are tasked to help me, right? So these are some of the automations that we've set are things that we know to be true, specific TTPs and behaviors that I might be known to be true that I can automate so that then we can look for the different anomalies and that's really gonna help an entry level person when they come in because even though it's automated, they're gonna be able to ask me, they're actually gonna be able to look at how we automate it to see what is this task doing, why is it automated, what is it surfacing? So they're actually gonna get to learn quicker, I feel like, because it might have taken me months to develop the research to put the automation together, but they're gonna get a leg up because they're already gonna get alertings for some of the automation. So they're gonna be able to spot the next thing a bit quicker than I did in the past. This gives me a lot of hope actually that the defenders are gonna win.  Yeah, we'll just agree to disagree on that one. Yeah, but I actually think that security is a data problem. We've long recognized if we could analyze the data we've got, all of the things we need to know are there. I would actually contend that security is a coding problem from a cybersecurity standpoint. I mean, you raised security by design as an option. I view that as a three generation problem. We have so much legacy tech debt that it will take us three generations just starting now to be able to secure by design. So we have so much of there that even with all the data analysis, we're still gonna have a challenge related to workforce, related to defense, no matter what. I would think of them as parallel tracks. So we're trying to get rid of passwords, for example. That's my goal in life. We've been on a- That we can agree on. Yeah. Thank you, MIT, who first put passwords on a mainframe. But over the last 15 years, we've been on a real actual journey to get there. Security keys, pass keys, these are all... None of these are the solutions. They're the pathway to the solutions. And it was only because we had the willpower to adopt these. But I would say it's not just the coding. We need to think of not only clever technical solutions, we need to think about usability. The human experience piece is more important here than the technical solution. We actually have a lot of the technical solutions. We just don't know how to get people to want to use them. And we don't know how to make it cheap enough. And by cheap, I mean time. The reason pass keys are successful, for example, as a replacement for passwords, is that it saves people time. And that's why they wanna use them. And we need to find what are those elements in every single technology component that's costing us time, costing us resources. And actually, I think you'll find people will get rid of the legacy tech debt when they realize, the productivity gains of going to a better solution. How long do you have to think about, do I need to patch my systems today? If you're a sys admin, how long does it take for me to check that all the configurations are right? For example. Thank you very much. Other questions? Yeah, hi, I'm Bob Peterson. I'm an attorney at the National Security Division of the Department of Justice. And I wanted to kind of pick up on your historical note that in the historical development of the internet, going all the way back to it as a DARPA project, it was basically populated by good faith actors who were interested in creating something cool and knew that in the first instance was gonna link university computers and then government computers. I would say that I think you'd probably agree we're now in the era of a high percentage of bad faith actors. And I wonder whether if you look at the role of international standards organizations. First of all, whether mitigating cyber threats is top of mind for all of them. But secondly, whenever I read about Russia or the PRC putting something forward at, for example, the International Telecommunications Union, I assume that it's in their interest but not in the interest of the world and the greater good at large. And so the question is, is the United States both in the private sector and in the public sector taking an active enough role in international standards organizations from the point of view of trying to advance the cyber security ball? And again, I take your point that the bad guys are not necessarily gonna follow the norms but it'll be a better world if the norms are better in general. So, over to you guys. You mentioned the norms first. Let me think a little bit. So we do have representation. I know Microsoft does have representation at international norms or interest in international norms, but they may not always, to be truthfully, they may not always align and be the same norms that the USG may be interested in. So it's really important to establish as to build those relationships again back to the partnerships of establishing what the norms need to be enacted before you go into the international realm related to that. And I would also say, I don't think all actors are all bad or malicious. Some of them are just curious. We have a lot of curiosity these days of what is it to push the boundaries a little bit and that in my mind isn't always necessarily bad because it allows us to adapt our cybersecurity and change things and enhance things as well. Yeah, let me push back just a little bit on maybe two assumptions. I think, you know, sort of if you are Russia, if you are China, you're representing sort of the prevention of harm to your population or to your interests, right? So I think when I see participation in the international standards bodies, sort of put it through the lens of what are they trying to get, right? I do think it's important that we continue to push for appropriate amounts of representation in the bodies. So I know this is something, for example, the groups who look at internet routing, internet naming, et cetera, pushing to make sure that that is sort of equal amongst the participants on the planet. I mean the internet, if you think about it, is maybe the most ambitious human endeavor in cooperation that we've ever done, right? And it moves at a faster pace than most traditional political dialogue happens, right? And the people who are willing to have those technical conversations at that very, very low layer of technology are actually doing it because they want to be there. They want to contribute and they want to keep it open. They want to keep it interoperable. And they would all prefer that. And I would say from what I've seen of the very low level that that's still true to some extent, but we will have to fight to keep it true to your point. I think the other thing to think about is that the internet has revolutionized so much of our lives. I mean, I think I was just thinking about how we navigated here using a map. Like that would have been a paper map and we've gotten lost three times. We would have been late. We've changed the world with technology across everything. And the reason that that all works is that we have the free flow of data to some extent through open interoperable systems. If we start making systems that are closed, we will lose the benefit. And I think because of that, we will continue to see a desire even from closed societies to use the open and interoperable technology. DPRK is a completely closed society. But as far as I can tell, they're all running on open source, right? Maybe a little bit of closed source that they're making for themselves or forking, right? So, and we certainly know they're using cryptocurrency networks, which is by default an open and interoperable financial system. It's kind of remarkable. So keep that in mind. They want to use the openness to achieve their goals. And I think that that's the commonality point that we should really continue to drive home for better and you're gonna get the good and the bad. Thank you. Good morning. Emily Daniels, Fleet Cyber. I just wanted to go back to one of the comments you made about information restrictions. And I can certainly think of very easily our classification restrictions on us sharing information with you. But sometimes one of the things we see is perhaps the agency that industry shared with might have like a law enforcement restriction that keeps defense from maybe using some of the information. So I wanted to ask both of you is how do you choose which agency to partner with and what goes into selecting, sharing it with agency A versus agency B? Thanks. We try not to be bias, right? We understand that each agency has different authorities. We understand that each agency has goals that they want to accomplish with it, right? So we never tried to turn down a different agency that may come to us, right? We may just have the more established relationship with agency A. So we may not know to contact agency B because we haven't talked to them in a year or something like that. So going back to the tempo of some of the relationships that you build is really important. And that also goes to say it's really important to have most of the players or all of the players in the room, right? So like JCDC not only has private public partnerships so not only industry but they also have other agencies in there at the same time that may get access to the same information but having different platforms like that is really helpful. I pointed at Judy because she's a practitioner and she knows this much better than I do. I will say as a, you know, I've never worked in the government and I do, I am somewhat sometimes mystified by all the acronyms and your org chart. And I think maybe some of, you know, I think for, you know, the Googles and Microsofts of the world where, you know, we have broadened folks who've been in government and, you know, we have teams who work directly with the governments every day. This is a little bit easier for us. As you think about some of the other players in the market, there's almost 700 softwares or service companies, many of them startups that you may need to rely on someday and they're not gonna have any idea how to interface with you. So I think maybe sometimes when you see the differences between, you know, when we go to one agency versus the other it might just simply be that relationship had been established and we've never heard of the other acronyms, right? So this is where I think the common tables are important, because you can think, you know, if I sit at this table, gonna get at the benefit of all these relationships without knowing your org chart, without having to memorize kind of the differences of responsibilities and who does what. I would say make it simpler and a little bit easier for us, give us a single API rather than 20, yeah. And I think it's incumbent on us in government, right, to not just be passive recipients of information at these common tables, right? But to also share what we know not just about the threat but about what other folks in the government space are doing, right? So if you come to the Cyber National Mission Force, right, and you say we're sharing this with you, we shouldn't just say thank you and then have it disappear into a big cloud, right? We should say, right, well, you know we're working with the FBI, right? We're working with other people in industry, right? Have you considered the benefit of us all talking together about this threat? Right, so I think that that's incumbent on us here in the room, right, to know what's going on in the government space, right? And then be able to help educate our partners in the commercial sector. I'll also add some of the joint advisories and whatnot have been really helpful because you see the multiple seals on it. So you know that, you know, even though I might threat share with one person, I know the information is going back to their partners as well. And so sharing information outward of what the government sees and having multi-agency seals and knowing that you are all working on the problem together is really helpful as well. That's great. I think we've got time for one more question. Sir. Good morning, Lieutenant Colonel Puzio, 335, single command. Throughout the course of your roundtable, you've addressed threats, threat indicators. In fact, your title of your roundtable is evolving threats. And you've mentioned state actors, two or three states we've mentioned. You've mentioned the radicalized teenagers. A couple of questions. Is industry noticing trends? Trends within like the last 12 to 16 months or 12 to 18 months on an increase in threats coming from a particular state or from particular individual actors or groups or consortia. And what gives you more concern industry? Are you more concerned about the threats coming from state actors? More concerned about groups or consortia or the anomalous or the individual that you can't identify? What keeps you up at night? State actor threat or individual actor threat? Yes. All of the above, all of the above. Well, I think, you know, no surprise, we are seeing an increase in activity from PRC. I would say both nation-state and nation-state affiliated, probably fair to say. Commercial security benders, so floor-pay hacking, not being funded by government. I mean, everybody's got contractors, but actually benefiting law firms, sort of non-state affiliated actors, et cetera. I mean, imagine you are in a place in the world, I don't know, let's pick Antarctica, it's easy to pick on them. And a law firm in Antarctica was in battle with another law firm, you could hire a hacker and hack your opposing legal counsel. So, and we're definitely seeing a rise in that because there's a lot of money in it. And we now have automation, which is making some of these bugs a little bit easier to find. I worry about that because it's hard to control. It's hard to see, it's hard to attribute, and it's hard to gather intent, and it's hard to know who all they're gonna sell to. So, I worry a lot about for-profit hacking that is legal in the jurisdiction it's happening. But I don't know, do you wanna comment a bit on the? No, I think all of the above, I mean, not only do we have to, because Microsoft is a platform, right? They can get to us to get to you and everything, right? So we can't just worry about one threat, we have to focus on all threats. And fortunately, we have, within my organization, we have different teams that are focused on nation state actors, but they're also focused on the cyber mercenaries. They're also focused on the different ransomware families, the syndicates that run those ransomware families and things like that, because you can't just look down one silo. Eventually, some of those silos overlap, right? We've seen more nation state threat actors use initial payloads of ransomware to gain access to systems. So you can't just peg them in these little silos, so you also have to look at all of them. And where they overlap is really interesting as well, to pull back and discover what's beyond that. Thank you very much, right? I think that was a great question to close on, right? Because like you said, right? As we look at the totality of the threats, it's the totality of our partnerships, right? The totality of our insights that make us able to effectively counter those threats, right? So to borrow a phrase from a former secretary of defense, right? It's not the threats that keep us up at night, right? Together, we can keep the threats up at night, so. Thank you. Nick, Judy, Heather, thank you so much for taking time out of your incredibly busy calendars at the Cyber National Mission Force, Microsoft, and Google. I think you really helped us better understand the contours, the opportunities, the challenges, and the importance of public-private collaboration, including the need to increase that cadence and frequency for which we engage. And as lawyers, I think we can take the task to help our clients in any way to increase that frequency consistent with law, policy, and regulation. And Heather, even inside the US government, we continue to be mystified by acronyms. So thank you for that. Ladies and gentlemen, please join me on a round of applause for our panel. And we are on break until 11 o'clock Eastern Standard Time. Thank you. Today's most consequential battle is being fought with everything, everywhere, all at once. It's in this room with you right now. It's the battle of information. Every day we see new examples of how the flow of information shapes the battlefield. A fake tweet, a doctored video, an encrypted chat. It has become shockingly easy to trigger unrest, radicalization, extremism, terrorism. As a joint task force under US Cyber Command, JTF Aries serves as the commander's maneuver element to tackle these emerging and difficult problems. Stood up in 2016 with the stated goal of countering the threat of the Islamic State, JTF Aries demonstrated immediate success. Declassified reporting has outlined the successes of JTF Aries, such as Operation Glowing Symphony, which dismantled ISIS's global media production and dissemination apparatus, striking a critical blow to their ability to spread propaganda, raise funds, and inspire further radicalization of violent extremist ideology. These successes required unique partnerships and coordinated operations across the inter-agency and international allies, which continue to this day. In 2018, command of JTF Aries was transitioned to Marine Corps Forces Cyberspace Command, which allowed for an expansion of missions across multiple violent extremist organizations. This transition was also a natural fit as Joint Force Headquarters Cyber Marines serves as the general support arm of US Cyber Command to US Special Operations Command and their global counter-VEO mission. As a result of JTF Aries operations, the global presence of violent extremist organizations is continually under pressure and has decreased dramatically. Due to shifting national security strategic priorities, in early 2021, the commander, US Cybercom, began to transition JTF Aries towards the strategic competition problem set. Nearing three years into this mission shift, JTF Aries stands ready to counter our pacing threats and deter aggression in competition and crisis. Fittingly, we take our name from Aries, the Greek God of War and Courage. We take his inspiration, our duty to fight faithfully, no matter where the battle leads us. Interested in war and courage? Come and serve with Joint Task Force Aries. Ladies and gentlemen, welcome back and to our virtual audience listening in. My name is Lieutenant Colonel Laurie Lincoln. I am the Chief of Plans Policy and Partnerships and the Office of the Staff Judge Advocate at US Cyber Command. Our next panel is extremely timely and it's often a hot button topic, both within and outside the government. The purchasing of data. What are the concerns with this? What, why does the government need this data? Does it circumvent the Fourth Amendment? What is its value? And is it data or data? These are just some of the questions that this panel will tackle. And if you think that we only stack the panel with government insiders, you are wrong. We have a diverse group here with differing viewpoints. That's what makes this conference so great. I am excited to introduce our moderator for the panel, Mr. Eric Rosenberg, who is the Acting Chief of Acquisition and Tech Transfer in the Office of the Staff Judge Advocate at US Cyber Command. And in case you're wondering, he calls it data. Over to you, Eric. Watch Star Trek, often say data. That's a typical theme. So I've revealed myself as a Trekkie. Non-endorsement. So I'd like to introduce our really great panel. So we have Lindsay Rodman. She is from the Department of Defense Office of General Counsel. She's the Associate Deputy General Counsel for Intelligence and she's basically been the lead on public available information, commercial available information, what we call PAI, CAI issue. She's really been at the front of that, working on DOD's policy to kind of give us more guidance on how to handle it. And we also have Mr. Eric Eichhorn. He's from the CDAO. That's the Chief Digital and Artificial Intelligence Office. And he's Director of Governance. We also have Mr. Aaron Mackey. He is from the Electronic Frontier Foundation. We're really happy to have him here. I think this could be beginning of a greater dialogue between our organizations, between Cybercom and EFF, but also DOD and EFF, and as well as with the interagency. And so it's great to have you here. He's the Free Speech and Transparency Litigation Director. We also have, to my right, Brandon Pugh. He is the Director and Senior Fellow at R Street Institute. And he's in charge of Cybersecurity Emerging Threats. He also, in his Reserve Capacity, he worked at the Army Jag School as well as a professor. So that's our distinguished panel. I'm really honored to have you guys here. So just to kind of like set the stage for this discussion, you know, the issues of publicly available information, commercial available information, it's really, really important. You think, oh, data, that sounds kind of boring, and your eyes glaze over, gets really abstract very quickly, but it's really, really essential. This is really at the heart of what we do as, you know, cyber operations attorneys, as acquisition attorneys in cyber. This is really at the heart of everything. You know, we're gonna, things are in flux right now.  There's also, you know, DOD policy that's pending. Cybercom, you know, we're drafting our own policy, and right now I'm working with different folks at Cybercom on that, you know, to try to regulate that. We're already starting to incorporate clauses into our contracts at Cybercom to try to, you know, sort of address issues about, you know, data privacy and things like that. At Cybercom, we use, you know, we purchase data for a variety of purposes. So for intelligence purposes, for cyber security purposes, operations, as well as R&D. And that makes Cybercom a little bit unique because we buy it for a variety of reasons. And each, you know, these different purposes, and it's really important here for capability development and to support the warfighter. And I think it's, this is really an opportunity, one, to more transparency on this topic, to the larger public, as well as to get, you know, I think starting a dialogue and an opportunity for us to get feedback. Because policies in flux, we have a chance right now to, you know, to shape that policy.  And just one more thing, there's sort of three big policy goals we have to kind of think about. You have national security, civil liberties, and sort of this internet economy that's based on advertising, technology, and data. And it's hard to achieve all three perfectly. You could maybe get two perfectly, because you know, if we were to not buy this data at all, if we were like no one to buy the data, then you wouldn't have the civil liberties concerns and our adversaries wouldn't be able to buy it. However, the internet economy would suffer greatly if we couldn't buy the data. And so, you know, if no one could buy the data. So in that world where we can't, you know, prevent anyone from buying this data, we have to have compromise. And that's what we're gonna discuss today.  So could you talk to us about what is PAICAI? And where do these data sets come from and why does the government need them? So publicly available information, and that includes today's conference. So congratulations. Is information that has been public or broadcast for public consumption a formal reference because I heard that I was going to a legal conference is 3115.18. Commercially available information is a subset of that. So it's information has been made available to the public and is available for purchase. Specifically either by governments or the public writ large. Some of the different types of commercially available information that we purchase because we are a huge department. We have data activities that run the gamut. So we do research and development data. We do weather data. We also do internet of things data. We look at financial data. We buy legal data. Some of the different uses in addition to normal intelligence activities. We also use it for things like background investigations, insider threat, network analysis, which I'm sure is near and dear to cybercom. We also use it to look at supply chain vulnerabilities. So that's a huge area of growth for us. Great, thank you so much. Lindsay, would you like to kind of help lay out what the current legal and policy framework is for purchasing data? And if you have anything you wanna add about how we use data. Sure, thank you. And thank you so much for having me. I really appreciate the opportunity. So the terms, especially in conferences like this where you're bridging the gap between folks within DoD who are using a certain vernacular and then folks on the outside who are using different vernacular. Eric very helpfully laid out what we mean when we say PAI or CAI publicly available information or commercially available information. Those terms originate from executive order, well PAI originates in its DoD usage from executive order 12 triple three. So those of you who have worked within or with the intelligence community, you know that's our Bible. I carry it with me everywhere. I have a copy here if anyone wants to reference it. And EO 12 triple three originally signed in 1980 as an effort to kind of clean up what was perceived as intelligence community misbehavior, shore up the rules, get us on track with a strong eye towards protecting US person's information in the hands of the intelligence community. And one of the frankly exceptions to the rules as they applied to the intelligence community about the information that they were bringing in. A lot of the rules were softened for publicly available information or information for which the person concerned has consented to its disclosure. So right off the bat, we were using the term publicly available information in a sort of, you know, Venn diagram of there's private information over here in a circle and then the two circles don't touch. There's also public information over here and what's in the public information is stuff that is akin to what someone would have consented to being out there and usable, right? That's how we were thinking about it before technology started muddying the waters. Now we live in a world where there is public information at least the way that I like to think about it. There's private information but those two circles overlap and there is in the middle of that Venn diagram a world where there's information that is what we would call public information because it's accessible to the public openly. It's data that one can purchase relatively freely. There's nothing illegal about obtaining it in these ways but that has serious privacy concerns associated with it. There's kind of an obvious bucket that involves things like doxing and revenge porn, right? Like things where someone has done something illegal or nefarious in order to release what you would consider to be private information out into the wild. But there's also data about you that's floating out there that you have ostensibly consented to through terms and conditions and stuff like that or that's just collected from you as you're out in the world but that you might have an X factor associated with being fair game for DOD, the intelligence community, private companies, anyone, frankly, accessing and learning about you. For those of us who, well, I drove here today but when I'm on the Metro, I'm there doomscrolling and candy crushing just like everybody else and I have probably ignored lots of terms and conditions that allow people to know exactly where I'm going. Luckily, I work with the intelligence community and in the Department of Defense but not in a role where I guess I know that I'm vulnerable to people sort of tracking me and understanding where I am and I guess my OPSEC isn't particularly good but I'm gonna guess that a lot of you guys are in the same boat as me. So some of that data, as Eric suggested, comes from sort of literally being able to track where you are at any given time, what your preferences are, what you're saying out in the world, what are you putting out on social media? All of those things are ways that someone else might be able to gain an insight to you and I'm doing a lot, so Eric was like, what is the policy and I'm giving you a whole lecture on public and private and then diagrams and whatnot and I haven't even gotten there but the reason I'm doing that is because the point I'm trying to make is that we got here through lawful conduct, right? So we're in a place where people were sort of using the law sometimes but also just working within the law to enable conduct that fuels the internet economy, as Eric mentioned. This is stuff that, if you were to regulate highly, would actually really fundamentally affect the internet marketplace. Now that might be something that we as a democracy decide we wanna do but we haven't done it yet. So okay, so what is the law when it comes to all of this stuff? I had the opportunity last year to speak to, but last week I'm sorry to speak to non-lawyers about Fourth Amendment obligations and that was much more comfortable because I didn't feel like everyone's gonna be judging my legal analysis. This is a little bit more, I think maybe friendly but scary audience. So where does Fourth Amendment analysis start? Usually we start with Supreme Court for the lawyers in the room who did con law and then immediately started practicing in the Department of Defense and then didn't do con law again. So Carpenter of the United States, many of you will have heard of this, some of you will not. 2018 Supreme Court case, this is if you went to law school back 20 years ago like I did, if you were on the older side of the audience, you will remember we did Kilo, there were certain other Fourth Amendment cases that talked about technology and what could be seen and known about people. Well, since we all went to law school, 2018, Carpenter came out. Carpenter is a case where four men were convicted using cell site location data that was compelled by a magistrate judge. So what's important to kind of understand about that fact pattern when we try to think about its Fourth Amendment implications was this was not data that was obtained freely on the commercial open marketplace. This was data that was compelled by the company but it was not compelled using a warrant. And the Supreme Court struck that down and said no, if you're going to obtain this type of personal information and this was pattern of life geolocation establishing data, that is a bridge too far.  In that case, Chief Justice Roberts also said, our decision today is an hour one. Our opinion does not consider other collection techniques involving foreign affairs or national security. So, you know, the young lawyer, enterprising lawyer for the Department of Defense can read that and say, oh, thank God, we've got an out clause, we don't need to leverage it. There's nothing in the opinion about commercially available or publicly available information and it's not supposed to apply to the national security application anyway. So we've got to get out of jail free, thank goodness, because if we had to get a warrant in every case, that would be a disaster. But I don't think that's actually a fair, that is not actually how the conversation has gone down in the legal community and the Department of Defense. We've all taken Carpenter to heart and Carpenter has shown us, and I mean in the conversations that I have with Eric and with many of my other colleagues around the Department of Defense and in the intelligence community, Carpenter signals to us that the Supreme Court and the public and Congress and you know, in these broader conversations takes very seriously the question of the sensitivity of geolocation data and what it means to establish pattern of life on people and that we should be thinking very seriously about protecting it and safeguarding it, understanding that it does raise an ick factor for people and it does raise privacy and civil liberties associated concerns. So whereas I think the jury's still out about whether there's really a fourth amendment right associated with all of this, I don't know, I am not the administration spokesperson on what Carpenter means for the Department or anything else. I do think it's fair to say that it really informs our force amendment analysis and it more broadly, because we go past what the fourth amendment compels, it really informs how we think about where we need to be going in terms of safeguards, guidelines and guidance to the field about what our obligations are associated with data that presents these kinds of sensitivities. Okay, so I see within the intelligence community in 2022 a senior advisory group led by some of the most distinguished lawyers in our community wrote for ODNI a review of the IC's use of commercial available information. And that was very, very close hold and I was at a conference last summer about the conclusions of the senior advisory report and I said, I'm sorry, I can't talk about it. It may or may not exist. And I go out and in the hotel lobby on CNN, IC, ICCAI report is released. So no one told me, but apparently as public you can Google it on CNN, they've got it. It's there as of last summer. And it will tell you, I think it's a good and thorough rendition of what the privacy and civil liberties associated implications are of the IC's use of CAI as much as we could publicly release, but frankly, there's really not very much redacted in that report. And they reached three conclusions. One was that we really needed to do a better job of data cataloging because we weren't doing a great job of responding to the questions about what do you have? And we're like, oh, stuff. And there's a lot of hand waving and some of that was because we couldn't say in an unclassified setting and some of it was because we hadn't actually done the work to go back and understand how people were using this information. Some of that is because it's really used at a grassroots level. So it wasn't like a top-down acquisition of this data. Oftentimes people were acquiring it at a lower level and so you had to understand how to, we had to establish the right capabilities to have that reported up. And number two and number three were to identify which commercially available information presents sensitivity concerns and establish standards and procedures to govern it a little bit better than we were doing already. Now it wasn't that we were operating in a vacuum. Those of you who work in the Intelligence Committee know the DOD manual of 5240.01 provides a lot of guidance on what to do about protecting US person information and that applies to commercially available and publicly available information as well. So there were retention limitations and guidance on when you can use this information and safeguards that you need to take associated with it. But these enhanced sensitivities associated with new privacy concerns around this data merited a new look. So ODNI is now nearly complete with an ICCAI framework. Some of you know this because you've been in the working group meetings and the implementation and all that. And that is set to be released any day now. I asked my IC colleagues at ODNI what kind of clear talking point, like what can I say about what's in this? And they wrote this, the following talking point for me. My colleagues at ODNI are the best and I really love working with them. So, thanks guys. And then they thought I wouldn't actually say that at the conference. I was like, oh, no, no, no. If that's what you give me, that's what I'm going to tell them. But what I can tell you is that it establishes nine principles and it provides a means of determining when CAI, because as Eric said, CAI can be weather data, right? But when CAI presents the kinds of privacy and sensitivity concerns that we're talking about, then there's basically a whole rubric of requirements for doing that analysis and then putting appropriate safeguards in place. So that is coming literally any day now. We thought perhaps it would be released this week. I think that may not happen at this point. So, DOD is also putting together its own CAI framework. And Eric and I have been in some painful and some not so painful meetings in the drafting of this policy. It is now in coordination in CADEMS. So if you have opinions about this, find your local person with CADEMS access and go to town on the critical comments. I say this because we really, truly want this policy to be workable for the whole department. So now is the opportunity to get that feedback into the policy-making process. And that will both cover DOD's IC elements, but it will be for the rest of the Department of Defense. And it's meant to kind of carry forward the important work that the IC has been doing in this regard to the rest of DOD in a way that makes sense as applied to DOD. Now, DOD also is not without its existing privacy framework. There's the DOD privacy program, Eric cited 3115.18. That is our current policy directive that governs publicly available information that is already in place. And we also have DOD directive 5200.27, which is titled Acquisition of Information Concerning Persons and Organizations Not Affiliated with the Department of Defense. So we have policy that currently governs how we work with this stuff. It's just that the way that technology has recently developed, we've recognized that we need to do a lot more. Both because it's the right thing to do, but also to signal to the public and to Congress and to folks who are looking all the way from California at what we're doing, that we're trying to do the right thing in this regard. So these policies go beyond what is required by the Fourth Amendment, as far as we know what's required by the Fourth Amendment. They go beyond what's established in law right now. But they don't have the force of law. They will be policy, they will be regulations. So if there is any future legislation, then that's something that would fall on top of them. I know I've been speaking for a very long time. Eric said I could talk as long as I want. That's his fault. But I will say one more thing. The vast majority of the missions that the Department of Defense is performing in the intelligence community and outside have absolutely nothing to do with US person information. It's just not relevant to what we're trying to do. And what we're trying to do, you know, people are mission focused. There isn't an interest or desire to get into US person information because it doesn't serve the mission. People wanna do their job, do it well, and then go home and hang out with their families or crush candies on the metro, whatever it is that they're doing, right? So there isn't a sort of like deep hunger to obtain this information beyond what is mission enabling. However, there are certain missions that do require digging into this information. And for those, that's what we need the extra safeguards in place. But I think also for those of you in the audience who work within the department on these issues, not only is it not particularly helpful for the mission, I interact with folks in the IC especially, but also DOD every day who are like, I don't want US person information because it makes my life so much more complicated to have to navigate the restrictions and the safeguards and sort of the bureaucracy that we have put on top of it. You know, there's no one sitting in the department who's like, ooh, I really want US person information, that'd be so awesome. It just, it sort of doesn't really help. That's not a fair characterization of what we see as people are interacting in the department of defense, nor is anyone sort of accusing DOD of doing that necessarily. But I think it's important to highlight that the type of guidance and safeguards that we're putting in place are really meant to make someone think twice about whether they need that information and whether they're gonna do the appropriate things to safeguard it when they access it. And making them think twice is actually, hopefully, a step in the right direction towards doing what we need to be doing. So, thanks. Thank you so much for that. Really appreciate that rundown. Also, I'd like to add that we may touch upon this more later, that Federal Trade Commission has also entered these discussions. They've been, there's been some recent orders that have been issued with respect to data brokers, and so that's also now kind of at play as well. So, Erin, so could you kind of give us a bit of your perspective on the government procurement of PAICAI, and also what, you know, reasonable safeguards would you hope would be put into place that aren't currently in place? Right. So, thank you for having me, particularly, thank you, Eric, for organizing this panel and making sure I got here. So I think big picture where EFF comes from is we come from a place of wanting to ensure that people's rights, particularly the constitutional rights, are protected. And so our view is that the Fourth Amendment should be the guiding star of all of these protections, and it's great to hear that DOD is taking to heart carpenter, which we read as really sort of a sea change, and recognizing a lot of sort of undercurrents that I think are real, including sort of the fundamental idea that the information we provide, whether that's location data, or other sort of personal information in the context of surfing the web or using an app that we consent to that data. And then as Eric just described, I think the FTC is also acting in a way that makes, that raises questions about whether that collection is itself lawful in ways that I think implicate the policies and sort of fundamental principles about the collection of this information in the first place if it is legally collected. I think there are concerns about whether that's actually true now. But I think more particularly what we think about is how do you protect people's privacy and honor their First Amendment rights and their Fourth Amendment rights throughout the life cycle of the data itself. And so that starts with collection, it also begins with use, retention and disclosure. And I think sort of looking high level and I'm not deep in the regulations like you all are. But I think a lot of this, once there's sort of collection, it's sort of seen as use limits are pretty limited. And there are retention limits, which I really appreciate. But some of the disclosure limits that are sort of like, do you have a reason to know or a reason to use? I think those are sort of concerning. And what it looks like from an outsider is that once we obtain this information as long as we obtained it lawfully and we purchased it as anyone else could, we can essentially do with it what we want and disseminate it further. And I think that looks quite different from the sort of normal Fourth Amendment analysis that a court would apply, which would ask at every step of the way, does a user or does that individual have a reasonable expectation of privacy and to the extent that the government action implicates it is certain legal process required for that initial search, the collection, the retention and dissemination. And so I think it's great to hear that there's forthcoming policies that are really trying to align with the Fourth Amendment. But I think there's probably more work to do and in trying to actually ensure that people's Fourth Amendment rights are protected. And I do think that DOD needs to take a hard look at whether or not this collection is lawful in the first place. I know we'll talk about some of the FTC settlements, but basically what happened is a number of location data aggregators have been subject to civil enforcement under the FTC section five authority on the theory that their collection of this information itself was unlawful because they deceived consumers, right? And that's not just sort of the general deception that we all sort of walk past when we scroll through the endless terms of service, right? Where they say we get to do with your data what we want and we also have a get out of jail free card, right? But the FTC actually held these companies to account and then one of the remedies that they issued in at least one case was a prevention of the further sale of that data. And so I think what's important to understand is if you start at the outset from this belief that the purchasing of CAI and PII is itself fully consistent with the law, I think the FTC and potentially Congress is acting in a way that might say that that's actually not true. And so I think that might shift a lot of the thinking and hopefully we'll see policies that reflect that reality. Thank you so much for that, I really appreciate it. Brandon, so I guess what's your sort of take on this? Do we have the right protections in place right now? What should we add, thanks. Yeah, no, Aaron kind of teased it up well. He mentioned Congress' action, but before I get there, I want to kind of take a step back and reflect on something the commander had said this morning, which was great. I was texting Eric during his remarks, I'm like, this is great, he mentioned privacy in response to a question, but a different dynamic of privacy. Obviously the risk and the threat of adversaries collecting and potentially using commercially available information against our service members. And I think it's helpful to take it, have that lens as well as a force protection issue. And if that at all interests you, the Army Cyber Institute, I know there's a few of you here and I have done incredible research around that, specifically looking at how China and other countries are collecting as much information as possible and leveraging against us, and we see it playing out in conflict present day, and that's even an open source. But taking a step back to Congress and what they're doing, outside of specific sectors, whether it be finance, healthcare, or even what the DOD is doing, and then specific states, there's largely no framework on data and privacy and the security of that data in the United States, which is astonishing, because countries around the world have similar laws, but there's no comprehensive federal data, privacy and security law in the United States. So largely speaking, you're free to collect as much information as you want, share and sell it as you wish.  Aaron kind of teed it up, but Congress has been looking at this some of you in the room has been working on this longer than me, but well over a decade. And there's been a lot of disagreement on what a federal law could look like and balancing the needs of consumers, industry to Eric's opening, it's key to our economy and emerging tech, but also like the security and national security space, how do we balance all three of them? That's been a constant struggle. And many people had said I was an internal optimist and that likely we never would have action on a comprehensive bill. I mean not to make this bill specific, but it is interesting that this past Sunday we saw a compromise emerge between the Democrat chair in the Senate and the Republican chair in the House. I don't wanna oversell that, it still is a long path forward, but it does a lot around data collection and it targets data brokers. So it has the potential to be pretty extraordinary if it passes, not saying it's perfect in every regard, but it does a lot, but just briefly, what does it do for data brokers? It's designed to bring a lot of transparency to data brokers. So no more would there be the data broker that nobody's ever heard of, or as a very tenuous relationship to a legitimate company, they would have to register through an FTC registry. They would have to have a public website where they're notifying you and everybody here that they are in fact a data broker and this is how they're leveraging data. And it would also have a do not collect registry and that's maybe a little sensitive for those in this room because the law enforcement community has had some concerns around that because would criminals or others avail themselves of that. So that's pretty interesting, but at a broader context, it does a lot more on how data is collected in the first place. It relies on data minimization. So essentially there'd be 15 permissible purposes for collecting and utilizing data and security is a component of that, law enforcement is a component of that, but outside of that, no more would there be the days where you can collect as much data as you want regardless if it's actually necessary for a product to service. So happy to dive more into that, but there's a lot there. No, thank you so much. So I'd say Lindsay, do you wanna touch upon any kind of current legislation that you can talk about that? Yes. Eric's trying to see how much he can get me into trouble today. So first, I'd love the opportunity to respond quickly on the FTC stuff because obviously that was something that the legal community within the Department of Defense and the ICU was like, oh, okay, here we go. And so for those who aren't tracking the FTC, I mean, Erin explained it perfectly, like they are starting to really look into questions of data broker behavior, what is fair game from a consumer protection standpoint and the thing I think that's most interesting to us as we dug through what should the DOD policy look like is how do we define which data presents the most sensitivity concerns and what reasonable safeguards can, what do reasonable safeguards look like? What should we be putting in place for this kinds of data? So the decision we're talking about is X mode social, by the way, in case folks wanna look it up later. And ultimately there was a complaint that had frankly mentioned sale of information to national security agencies in it. So we were watching it. The ultimate settlement and order did not have really anything to do with those potential use cases. And frankly, I mean, that was really not what the case ended up being about. But X mode social was selling data, as Anne mentioned, in contravention of its own terms and conditions, right? Even like, you know, not what it said that it was going to be able to do. But what was most interesting, that leads to me, was that in the settlement and order, they actually define for the first time which information, which data about individuals presented the biggest sensitivity concerns. And so I think one can fairly look forward and say, okay, these categories of data are going to be protected beyond just whether X mode social can continue to solve this data, which the answer is they can't. And that was geolocation information that associated people with locations that presented privacy concerns. The big two that stick out in my mind, I think there were six, are certain healthcare clinics in Ohio, right? And then other would be geolocation information that would give away LGBTQ affiliation or status, right? So you can think about that data and think like, wow, okay, yes, I would like there to be restrictions on people selling geolocation information about which healthcare clinics I've been to. That seems reasonable. So we are also sort of interested and we see FTCs paying attention. And it is important for us to know and we always want to know if the people that we're dealing with have obtained the data in an above board manner. That informs a whole lot of things that we care about. And in most cases would mean that, you know, there's no way we're gonna even continue to look into that information. So that's FTC on Congress. Yeah, so I think you're talking about Senator Cantwell's proposed legislation. So that is really interesting because it is sort of an interesting, serious attempt by Congress to govern the space more broadly. We also have seen a flurry of legislative action that is focused on IC and law enforcement agency uses of commercially available information in particular. Over the past couple of years. So there've been a lot of incarnations. And what is interesting here, and Brandon kind of touched on it, is that this is not a partisan issue. Like the people who come together for these bills come from different political backgrounds. And that, you know, for civil servant, like then I can talk about it with, like there isn't really a partisanship associated with this. We're just talking about the issues in the policy. So that's actually kind of an interesting and refreshing place to be. I wish they weren't trying to take DoDCAI away, but it is interesting to be in that world. Okay, so last year we saw a House amendment to the National Defense Authorization Act that would have prevented the Secretary of Defense from obtaining commercially available information, essentially that had to do with U.S. persons. We saw that as very concerning, right? I think we've tried to explain that this information is important and could be quite valuable. It also presents privacy concerns. So, you know, we want to live in a world where we're doing the right thing, but also able to use this information to keep Americans safe. There was also a government surveillance reform act that was introduced in the Senate last year. Right now there are kind of two major live actions having to do with this, having to do with CAI. One is that the House on Thursday is going to vote on FISA 702 reauthorization. That has nothing to do with CAI. FISA 702 is about wiretapping, signals intelligence. CAI is about purchasing data that is freely, openly, commercially available in the marketplace. However, they both are things that the intelligence community uses to learn stuff, and so those two issues have gotten, I think, quite conflated in Congress. So you saw during FISA 702 reauthorization a number of efforts to tack on amendments having to do with preventing the Department of Defense or the intelligence community or law enforcement, or all three, from obtaining commercially available information. And then you get all sorts of rules, issues about whether it's germane, and things that are totally beyond what I pay attention to normally. I go to these meetings and I'm like, just tell me if the amendment's in or not in, whatever. And so those two issues have now been split in the House. But what that is doing, it is, people are now paying attention to the fact that there is a vote on FISA 702 on Thursday, but there is also a vote on what is called the Fourth Amendment's Not for Sale Act, also on Thursday on the House floor. The Fourth Amendment's Not for Sale Act, very catchy name, whoever came up with that. Good marketing skills or something. But the Fourth Amendment's Not for Sale Act would make it illegal for the IC or law enforcement agencies to obtain commercially available information about Americans or about anything that's happening in the United States, full stop. It would, for those of you who are in the Department of Defense, place serious obstacles in the way of us performing our mission on a daily basis. So I personally have some concerns about that legislation that because FISA 702 has more attention and has been sort of an issue for longer that folks are sort of forgetting that this other vote is happening on Thursday. There's also a bill in the Senate that's called the Safe Act. It stands for something. I didn't write it in my notes. I apologize, Google it later, Erin might know. And that would require a warrant for CAI access. But again, it presumes that we would go to a court under circumsta