Welcome to the Get, the podcast for enterprise leaders delivering timely insights for today's global economy and tomorrow's competitive advantage. I'm Chris Kane, President of the Center for Global Enterprise. In this week, we will be re-releasing key episodes from 2023 that we believe are very topical and on the minds of you, our listeners, given the challenges confronting business leaders around the world. Today, our replay is about the changes in U.S.-China relations and how they are shaping CEO decisions and new trade realities and how CEOs can embrace open-trade regionalization. You'll hear from John Hamry and Sam Palmisano, part one, and Victor Fun and Sam Palmisano in part two. The nations of the world just concluded global climate talks from Egypt at the UN-sponsored COP 27 conference. It is a current example of multilateralism. The issues of sustainability of our planet and climate change are perhaps the most pressing issues of the times. In Get, episode nine, Victor Fun and Sam Palmisano address the current state of multilateralism, trade, and sustainability. They provide you with a framework to think about the management trade-offs and investments relevant to global business success. And on today's podcast, we discuss global trade and how CEOs need to adjust to a new landscape that is very different from the rules and guidelines that have been in place for over 30 years. We're joined today by Victor Fun, Chairman of the Fun Group and the Asia Global Institute, and Sam Palmisano, Chairman of the Center for Global Enterprise and the America's Frontier Fund. Victor, Sam, thank you for joining us today and welcome. One of the greatest developments for global trade and economic drones after World War II was the creation of multilateral institutions that set the rules for international trade and economic relations among countries. The World Health Organization, the World Bank, the World Intellectual Property Organization and the World Trade Organization are among perhaps the most noteworthy for business leaders. These institutions have brought countries together to create and agree to a set of common rules and practices that were deemed to be in a nation's vested interest. But around the same time, the WTO was officially launched in January of 1995 to accelerate the harmonizing of rules for traditional commerce, technology was enabling a whole new type of commerce and the internet to become part of society. Only a decade later, e-commerce was a part of everyday life for billions of people. Platform business models broke onto the scene and delivered the matching of buyers and sellers with more efficiency and faster than traditional trade frameworks. You've both been leading CEOs and managed global businesses over the last 40 years. You also have deep insights about market access and working with governments on trade-related matters. Today's CEOs have to decide how to advance their strategic tangible and intangible investments and assets if they are to capture global opportunities. And yet they have to do this at the same time geopolitics is reasserting itself over geo-economics as the seemingly more forceful organizing principle for trade. So we see three pressing questions that CEOs must answer for themselves and their companies. And our first question is about multilateral institutions that seem to be losing their efficacy to manage global commerce and resolve disputes. How much effort should I, as a CEO, put into the WTO and other trade-related groups? Victor, perhaps we can begin with you and then we'll go to Sam. Chris, first of all, thank you very much for having me on the get. It's a great pleasure and honor to be here. Without doubt whatsoever, multilateral institutions has been the basis of the world's prosperity for the last 75 years since the Second World War. And I think we have all benefited greatly from the multilateral system. I guess all of us in the sort of practitioners in the world of business really are very much aware of the difficulties in operating that multilateral system, maybe for good 10, 15 years. Let's just recognize, first of all, what we're really seeing in terms of the reality of the world, and frankly, somewhat despite the geopolitics, the very tough situation that we're facing, the geopolitics, the world continues to progress in terms of trade and in terms of investment. And even in the recent figure show, although global trade has slowed down a bit, it's still increasing despite COVID, despite all the geopolitical issues. This ongoing development, I think it's going to be very important. Unfortunately, in my mind, I think I much prefer global multilateral system, breaking down more and more into trading blocks. We certainly experienced this in Asia. I think obviously, North and South America will be one block and in mere, Europe, Middle East and Africa will be another block. And things are progressing actually along the lines of different blocks. Now, if you look at the Asia block, I think the most significant thing that really executives need to be very much aware of is development of something called RCEP, the Regional Comprehensive Economic Partnership. It's really consists of the 10 countries of ASEAN plus five, which is China, Japan, Korea and Asia and New Zealand. This comprises one third of the world's population, one third of the world's GDP and one third of the world's consumption. Now, the significant thing about the RCEP as being at the center of the Asian region and what's happening in Asia is the fact that it is really based on the concept of open regionals, which means more and more countries can join when it reaches a very low barrier. And it looks to expand as opposed to maybe other trading arrangements in the world are much more like a club, if you would, setting very high standards. And only if you can reach those high standards are you invited to join. So this open regionalism concept, I think we should be very much aware of. And what that's gonna do for RCEP is start rolling up the economy that want to join in. And that will become a more and more important free trade entity that the world will be working on. So zooming back and answering your question, Chris, if you look forward to the global situation, what I see is perhaps a reconstruction of the global trading system from the ground up within Asia, within Americas, within Europe and then coming back together and hopefully in a again seamless multilateral system. I think the idea of trying to reform the whole multilateral trading system from the top down is gonna be very difficult. Victor, thank you very much. Sam, you worked for decades with multilateral institutions and governments around the world and you were the creator of a phrase called the lower in the center of gravity sounds to me like the global trade systems center of gravity is being lowered at Victor is correct. Well, it's interesting and Victor is a great intellect and extremely knowledgeable in this whole area much more so than I am. But I would just make a couple of points which Victor is highlighting that I'll transition to your question, Chris. I mean fundamentally everybody was frustrated with the current status even when I was working in the multilateral system and the institutions. However, question was what do you replace it with? And that was always the challenge. Everybody at least in the business community was seeking something else, but no one could define the else that they were seeking. I think Victor's now come up with a model that these big large trading blocks could replace that as long as they connect. They're risk if they don't connect and the risk is actually to society. People need to stand back and understand that capability, materials, components are not limited to a region. They are global. I know the technology industry better than others but there's just capabilities, people, smart people, research institutions, not just the components, the materials, et cetera, et cetera that happen to be located around the world and to solve these future problems that we talked about in artificial intelligence and hyperscaling computing, you need to connect the world technically on those capabilities. Now we all understand that's a lot of pressure from various countries to limit that interaction today, especially when it comes to national security, but a lot of those technologies are used for the betterment of mankind, like healthcare, climate, I mean there are lots of things that when you'd want collaboration that solve these massive issues for our globe that aren't gonna be solved in a block. So that is the, I'd say the negative side of these trading blocks. However, that could also lead to a reconnection but that would require some broader leadership than we see today in the political systems around the world. I think you're absolutely right, Seth. We really should much prefer the multilateral system that will allow us to really conduct global trade as a whole. And I do see the difficulty in reconnecting the blocks as you point out. That's why the blocks is definitely the second best alternative, but we're there. Yeah, so Sam and Victor, it sounds like multilateral institutions from a CEO perspective are necessary but not sufficient and that a sufficiency is gonna have to target and point the CEO to a number of neighborhoods around the world. As the center of gravity has lowered in global trends, I'd like to turn our attention to the impact of technology on trade from your perspectives. Given the changing dynamics we just talked about and the geopolitical cyber threats that exist, how much risk do global platform businesses like Amazon and Meta and Alibaba, et cetera, represent to a company's ability to access markets and customers that they need in order to grow? Clearly, electronic commerce has become an easier path to the customer, whether that's a business or whether that's a consumer as trade has become both tangible and impangible, but there is a trade off to that. From a CEO perspective, how much of a risk do you think, given the cyber threats that we see materializing both by state actors as well as non-state actors, does this represent? Well, Chris, you make a very good point and there's been tremendous benefit that's called the hyperscalers, I mean the platform business models, that running these massive infrastructures as people refer to as cloud which is a nice little buzzword, but fundamentally, which absolutely created great computing capacity at a low cost point. So therefore, a lot of the benefits that these businesses were able to accomplish, whether it's in retail, advertising, built simple various points of these hyperscalers, but fundamentally was a result of that technology platform lowering the cost that made things much more affordable than what they were in the past. However, there's a risk in the hyperscalers and the risk, quite honestly for me, is not under, I'll call it their serviceability or disruption of service. Like early days of cyber attacks, it was a disruption of service. I don't think that's the issue. These infrastructures are pretty resilient. The issue to your point is the data. The data where it resides, how it's moved, got policies around that, that's the fundamental issue. From a CEO perspective, you start with something very, very simple. If you have anything that you view as very, very proprietary, you do not put it in the public cloud.  Now, there are ways to connect to the public cloud, there are ways to protect that data, it's called the hybrid bottle, et cetera, et cetera, but you would not take that fundamental risk to your business, whether it's your formulas associated with biotech or even Coca-Cola and Pepsi or the fundamentals algorithms that you might be using for exploration and production, those kinds of things, you would never let leave your firewall, right, where you can secure and protect it. You can translate that to national security interests as well. Those very, very important data sets, the issue there though becomes location of the data. That's what takes you in the public policy because there are all these restrictions put it in place because of privacy and there have been issues around privacy. So therefore, it's not surprising that Europe has set regulatory policies around the data itself and its transport work resides. It's not surprising that many ways that the current administration in China is shutting down some of the big consumer platforms as far as that data and the use of that data and you see regulations in the backstage as well. So the key there is the location of that data and the protection of that data. Now there are ways to do that quite honestly and still get the advantages of these hyperscalar models but it's certainly a strategic consideration. You cannot be frivolous in where that data resides and how you're moving that data, not only because of regulation, because regulation is, you and I know tends to be behind the problem because the technology moves so fast. So the regulating things that were relevant 10 or 20 years ago and by the time they get that passed everybody's moved on. That that's just the nature of technology progress. So my only point is that fundamentally I would have a data strategy and the protection of that data and if I was a business, I would get ahead of it. So if I, we have a consortium of 25 or 30 CEOs that will work on these problems Chris and they're working on getting ahead of these issues because the concern of the regulations it'll slow down innovation and it doesn't solve the problem quite honestly but that's because it always looks through the past. So key proprietary data, you don't put it in the public cloud. Very, very simple. Other issues where it resides and how you protect it's very, very important but be compliant or be a leadership position on data privacy versus trailing because if you're trailing you're going to be unhappy in your innovation. So CEOs are responsible for their company's assets and in today's world their company's assets are both tangible and impangible. Victor, you have been in business for a long time delivering assets to customers around the world and Asia probably is the fastest growing region that relates to impangible asset. Your thoughts on the question about the risk factors affiliated with global e-commerce platforms and the benefits in the trade off for a CEO? I think a CEO really got to put this absolute at the top of the list. One of the things I would say on a pragmatic level don't capture data that you really don't absolutely need and are sensitive, especially of a personal privacy nature that you have much more to worry about in terms of exposure.  You got to cut out this extraneous stuff because that really opens you up to a lot more risk because you're in possession of the data. So my first advice would be just make sure that you're capturing just the minimal set that is absolute essential for your business. Don't do anything extraneous just for the sake of capturing more data.  But I do want to say something else from a more macro global perspective in terms of competition. You know, I think one thing we really got to keep an eye on is the development of digitalization. I think this is a trend that we've all seen in the last 15 years and I would not be surprised if this trend will continue despite the geopolitics frankly, at the business level, at the micro level, you know, for the next 15 years or more. And I think what we're really seeing is with the development of increasing digitalization of the world, I think we're going to see a increasing empowerment of small and medium-sized enterprises, the SMEs. You'll see a lot more of them really being able to access the global system because of digitalization. I'm talking about all I see around Asia, not just China. India is really coming up. India is now in the midst of developing something they call ONDC, Open Network Digital Commerce. And they're giving a digital identity to every small and medium-sized enterprise in India. And we all know that India is a country with a huge number of small and medium-sized enterprises of shopkeepers. And they're going to enable those and it will be a government-sponsored network, minimal charge and giving them access. And these will go out of India and we'll be going global. So the competition that we're seeing will no longer be in a sense big company to big company. We're going to see a swarm of SMEs coming into the world through the digitalization process. And I think you'll be facing them much more than even other major companies that you traditionally face globally. It's a tremendously empowering moment in time, Victor. I agree with you 100%. The opportunities for small and medium businesses to reach beyond their traditional physical boundaries and have access to customers around the world is remarkable. And the opportunity will be fortified by good cyber strategies and practices. But what I hear you both saying is, like everything else CEOs have to do, they have to make choices about which data is most important and which data they need in order to operationalize their success and which data just happens to come along and represent a threat or an unnecessary burden. Let's put it that way. Let's talk about the third question. There's a lot of focus these days on sustainability. And CEOs are being asked about sustainability. CEOs are talking about sustainability. How much importance and impact do you assign to sustainability for a company to have trade success? Do you think the importance and the impact of sustainability for a company's trade success is high, medium, or low in today's world and looking five years down the road? I would say it's high plus. It's beyond high. We all know how important this is to the planet, but let's talk about business. I don't know of any company that doesn't say that we care a lot about sustainability. And this really comes to the very existential issue for the planet and for companies themselves because you know what? I think this is more than just a stock market issue or even a government or societal issue. It's really your customers, the ultimate consumers are really worrying about that unless you perform in that regard on sustainability, you're not gonna be around for a long time in my mind. So I would say it's absolutely essential in the long term, but I really like to make a very direct point on the difference between talk and actual action. Many, many companies talk a lot about sustainability, come up with a lot of nice looking reports on sustainability. And I think to actually really do something concrete as a gap. And if you talk about global supply chains and global trade, I would again move to the issue of digitalization. Once the global supply chain is gonna be totally digitalized, I think the key thing that you can really do with it is to actually work on the traceability of your raw materials down to first, second, third, fourth, fifth tier suppliers. You know, if you're in food or if you're in apparel, whatever it is, you can trace it all the way back to the farm and the growing and so on. So I think that really allows us to look at the progress of sustainability and also explicitly doing something about it in different parts of the supply chain. You really, for the first time with digitalization in my mind, you have the end-to-end visibility that will allow you to do something. So in order to meet this long-term goal and not just talk about the goal, thinking about the digitalization of the global supply chain as really now the tool that you have available to do something about it will be crucial. Sam, Victor has raised the bar. He gave high plus over to you.  At the end of World War II, the way companies, then multinationals, got permission from society to enter and do business was they put manufacturing capability or distribution capability in those countries. You know, IBM and Berlin. We can go around the world here and talk about those sorts of things as the world was rebuilding. That's what companies did. When manufacturing, they learned it became the center of the economy. So if you moved to more of a services economy, then you saw it move to intellectual property, collaboration with research institutions, creation of IP, et cetera, et cetera. So to Victor's point, here we are today, market access. When this world is digital, and it will be, it's gonna take some time. I mean, these things are 15 to 20 years. You used to talk about the e-commerce or the digital businesses. This will be like the datumop business. It'll be the data businesses. That's where it's evolving. In my world, it's a 15 to 20 year cycle. I could take it through 100 years of technology, but that's what it is. Having said all that, I think society, forget governments, government just, I think reflects society. Society is gonna cherish whether it's your brand or whether it's your relationship with the educational institutions. All the things businesses need to be successful. Society is gonna value people that are sustainable or the ones that aren't. That economic trade-off is gonna force companies to invest. That to me will be much more progress than all the regulations that they come up with. Because if you look at the regulations like today on these transitions, there's always something that's disrupted. Today it's the low income people that are being disrupted because of all these regulations. Energy bills are going through the roof. So you've won up to Victor, UN high plus one. Yes, you will. Exactly, it's off the charts. I mean, if you're running a company, other deal with all these short-term issues that we talked about, you have gotta come up with a strategy that connects your brand with the interests of those markets around the world that you operate in. So it's more complicated than just a global point of view. So if you're Nike or Underwater, you need to make sure that you're connected in China, in Brazil, in the United States and all your major markets, those sorts of things. Well, look at the close of every get podcast. We like to take the last minute or so to give our listeners one strategic insight to consider what we're gonna change it today, all right? But we call it the emerging critical issues moment. And here's how we're changing it. I'm gonna ask you each, if you were to recommend where today's CEO should put their corporate headquarters anywhere in the world, given the geopolitical and geoeconomic trends we've just discussed, where do you recommend a CEO place their headquarters in today's world? Victor, we'll go with you first. My gosh, what do you expect me to say? I would have to say Hong Kong. Yeah. I think we have been in the middle of global trade. We're at the heart of Asia. And I think under really one country, two systems, I think where we would have to wear with all to really access the Chinese market as well as the global markets. Okay, Sam. Yeah, I mean, I would go through a characteristics that why you locate. One is obviously a stable environment to operate within. So where do you have stability? That gets back to public policy and the economic systems and those sorts of things. So it starts with stability. The other thing you need to access the talent and you need to access the capital. So you're starting up a business, you have to have great people and you have access to the BCs or private equity or some public markets, whatever it happens to be. So I would just say something that's open and transparent and consistent. Now, when you would measure countries, you can do that if you, as you know, Chris, you did this for us at IBM, you could take those characteristics and you could quantify them and model those and decide where to go. But I would start with, I think open democratic systems long-term are gonna win because of talent development, low capital, somewhat business-friendly regulations than a closed proprietary system. It's no different than in technology. Open always beat up proprietary was just a question of time. I would challenge the idea of one headquarters in today's global world. I think we really got to get used to the idea of multi-location headquarters. I mentioned sort of the emergence of blocks. I think you can use other criteria, but I think in this sort of multilateral world that we're facing today, with such diversity, I think we really cannot think of one place where you can conduct global business, whether it's your political, whether it's open system, whether availability of raw materials or whatever. I think you've got to think in terms of multiple locations. So what you asked me, Chris, was a trick question. Ha-ha-ha-ha! Well, it wasn't a trick question, but you improved upon it, Victor, so thank you very much. And with that, Victor and Sam, thank you very much for your time today. We hope our audience enjoyed this discussion about trade, which is a very dynamic part of life and the economy. So thank you very much. We really appreciate your time. You've been listening to the Get sponsored by the Center for Global Enterprise, celebrating 10 years of convening global enterprise leaders around the most important business transformation. Today, we sit down with two people who have been leaders in U.S.-China relations, one in government and one in business. John Hamry is president and CEO of the Center for Strategic and International Studies in Washington, D.C. He formerly served as the 26th U.S. Deputy Secretary of Defense and is chairman of the Defense Policy Board under four secretaries of defense. And Sam Palmolosano, chairman of the Center for Global Enterprise. He also serves as chairman of the America's Frontier Fund, a non-profit deep tech strategic investment fund. It was formerly chairman and CEO of president of IBM. John and Sam, welcome and thank you for helping us discuss this defining issue. Glad to be with you. Thanks, Chris. So both the United States and China have recently announced plans and enacted policies that will affect each other and more broadly the global economy. The two largest economies in the world will shape the nature of business over the next 30 years in perhaps more pronounced ways than they have over the last 30 years. Two factors in particular shaped the last few decades of global economics. In December of 2001, the U.S. granted China permanent most favored nation trade status and China was formally admitted into the World Trade Organization. Since then, CEOs have operated their businesses to factor in a relatively cooperative economic and geopolitical relationship between the U.S. and China. But today things are different. We will discuss how things have changed and what are the factors CEOs need to address as they execute their business over the next few decades. John, perhaps we can start with you. You have served in the U.S. government for many years and in many different capacities. You have directly dealt with many countries of the highest level. You recently wrote about the resurgence of geopolitics over geoeconomics as the organizing force for the years ahead. Can you elaborate on this and what you think it means for CEOs? Thanks, Chris. I wrote that in the context of the Russian invasion of Ukraine. And I do think that it marks a significantly different period in our approach to international relations. You know, really for the last 30 years, as you noted in the setup for the question, it was basically a fairly politically benign time in global commerce. We invited China to join the WTO. We worked hard to try to pave a way for that. There was a pretty permissive environment. There were some scratchy episodes, but nothing that really fundamentally changed the underlying economics. But the war in Ukraine triggered something quite profoundly new. You know, we decided to weaponize the global financial system. I mean, to put swift sanctions, restrictions on Russia. We mobilized the most comprehensive sanctions on economic commerce with Russia. This means we took what people for 30 years considered to be maintaining a public utility, you know, global finance, and we turned it into the weapon that we could use in a war that where we didn't want to get involved militarily, but we wanted to affect the outcome. This is a pretty different world. Now, I will say, I think I had personally anticipated in March last year that this would bifurcate the international political order. It did not. And that's largely because China chose not to let it become a divisive point. So it, but I still think geopolitics is going to be a dominant factor. So Sam, given your former and current private sector activities, what do you think this new US-China environment means for CEOs from a business and an investment perspective? Chris, I mean, I agree with John. I mean, basically what's happened is whether it's national security or nation's own self-interest, whatever you want to be, has overridden some of the things that were viewed as economically beneficial for all. I mean, when the world integrated after World War II, it really did lift millions and millions of people out of poverty. Standards of living are better. Life expectancy is lower. So there was a great benefit to that. And that's not being challenged. I think John, I completely agree with John. The war has exacerbated that and brought some things into focus. But it's been under challenge for the past two years. If you just look at recently at China, then we're talking about China today, I would put my hat as the CEO.  COVID-free has now changed. The pressure on the technology sector and innovation is now opening up again. And credit or financing to the product property sector has also opened up again. So yes, there were economic downturn. Forget the numbers that are public. Nobody believes them anyway. But it's either slow or negative. And then fundamentally, these things have changed. The reason I mentioned the question is, what's going to happen next? And as a CEO, you're worried about, because you're making long-term investments. And so you're worried about, is this actually a philosophical change or are they going to go back to their old audiology? Are they going to go back to the malice approach or to go back to done? You will see. But as a CEO and you're planning, you really can't plan that things are going to return to the way they were, let's say six or seven years ago, given what's happened recently, and now they're pivot now. But that means overnight they could pivot again. So I guess my only point is, you need a plan B. You need to have a business as usual plan and maybe you assume the next couple of years are fine as far as being able to invest and get returns in China. But you also need a plan to protect your assets, assuming this thing reverses itself again. Well, that's the title of our session today, which is looking ahead at US-China relations and factors shaping CEO decisions. Sam, you're certainly right on point, given the scope of what we want to talk about today. John, from a government perspective, the pivots that Sam just described by President Xi, do you anticipate that this will continue to be kind of a dynamic policy approach by Xi or do you think this is a temporary let-up without necessarily a fundamental shift on his part? We don't really don't know that. I don't think there's a view on that. He held very firmly to his COVID policy as well as to the more restrictive policies that were choking off the real estate sector, pretty firmly up until one weekend, and then bam, it changed. Now, one can say that he had gone through the 20th Party Congress and he cemented his power status. And if you believe that's the case, then you say, well, he has the flexibility to move things around. And he was holding a firm line as long as he could until he knocked off all the internal opposition. The other is that he is authentically worried about the health of the economy and that the decisions that he thought were right were damaging the economy and he is recalibrating. Now, does that mean he changes his underlying? He's still basically a Marxist. He's a Leninist Marxist. He believes in common ownership of the means of production and believes in a central Leninist party that directs the economy. So, you know, is it tactical or has he made a realistic change? I don't think we really have an agreement on that. I think probably the predominant view is that it's tactical, but I don't think we know. Let's talk a little bit about the US-China economic relationship that has been quite a powerful engine for global growth over the last 30 years and had profound effects on people around the world and countries around the world. There's been a lot of discussion about the decoupling of the US and China economies and the impact it will have on global economic growth. Certain investments in operations and sectors such as semiconductors or deep tech technologies and certain consumer, even certain consumer technologies are being constrained by both countries. Do you see government policy restrictions expanding? And if so, what areas of business do you see next? Sam, maybe we can start with you and then go to John on this. Yeah, yeah, Chris. I mean, let me comment a little bit. I completely agree with John and nobody can really call what's going to happen in China. We know where he is philosophically in ideology. Who knows? I mean, and that's a little bit of brings uncertainty into the things that you're talking about, like sanctions or tariffs or restrictions as far as the flow of technology around the world. I really did believe at the end of the day these economies, these countries will not decouple. And the reason I say that is because their economies need each other and either you're going to lower your standard of living for your population, which is probably not attractive, or you're going to defund entitlements of the military, which is again, probably not constructive, because you have to have a robust economy to do these things. I admit that I'm not an audiologue, I'm a pragmatist, which says though that you can't disconnect completely these two economies and accomplish those goals. Now, however, I do think the points that you've made as you project out to the future, anything that they view as related to national security when it comes to technology, that is going to come under restriction and pressure, not just the short term as far as technology around semiconductors and the equipment that produces the semiconductors. That's what you see going on right now. But even future areas like quantum computing, 5G cyber infrastructure, those sorts of things, biologics, biotech, all those areas, I believe are going to be more challenging.  Jeff? What worries me is that we have two political parties that don't agree on much these days in the US, but there are two things that they really do agree on. One is a parochialism about America, by America and one form or another. And the other is a fear and loathing of China. And this is bipartisan now. And I think that could become dangerous in months ahead. I think there'll be fighting and scratching at each other nonstop, but they're ready to align themselves together if the right stimulus presents itself. Now, you know, when I thought the major development of the Biden administration was the semiconductor restrictions announced last September, because the most important thing was the accompanying narrative for it. Our historic industrial policy, we don't call it that, but it is, our historic industrial policy was always, we will restrict people from having access to cutting edge technology today. We will allow our companies to export and sell or older technology, and we will subsidize companies to invest in the next generation. You know, that was our national strategy and that was coherent, because it meant that companies could, they could capitalize on the productive revenue opportunities that came with old technology, use it to invest in new technology. And so the, you know, there was a logic to the framework. But when Jake Sullivan gave his presentation, he basically said, we're gonna try to restrict everything. Now that's a very problematic shift. And I don't think we really know where it's going yet. I think American semiconductor companies are very nervous about this. I know our foreign partner countries that are in semi-tech are very nervous about this because they continue to wanna sell in the China market. And they don't want to give China a protected enclave to develop a competitor. So I think it's unstable, but I think the trend of our macro politics is going to be difficult and challenging. So you and I worked closely together when you were in government, I was at IBM around that very subject matter, which is those technologies that are leading and developed in the United States and how do we create a market-oriented approach to giving the United States a lead in those technologies without it being captured by adversaries in a global market, which is a perfect tie-in to the next question that I really wanna ask you both about. And in many respects, it's both a policy but also a management question, which is in the previous periods where geopolitics was the organizing force for global business. Read that to be the Cold War era. US government oversaw compliance by US business through a spectrum of expert controls. You were just referring to that, John. Today, the global economy and technologies are very different than they were during that period. We have cryptocurrencies, we have pervasive computing, we have digital products and services, we have global supply chains. So should business leaders be expecting a return to detailed export control regulation by the US government and be reinvesting in the operating controls to ensure that they are compliant? Because we were benefited greatly during the period of trade liberalization where export controls were allowed to be loosened up around this very concept of dual-use technologies, consumer technologies, et cetera. Are we re-entering a period where the export control environment is tightening and therefore companies are gonna have to begin the reinvestment of management processes internally? So John, maybe we can go with you. I think the announcements on semiconductors in September clearly, you know, suggests we're heading that way. And at the time, informally, they were saying, there's lots more coming, it's gonna be in other sectors, we're gonna go into biotech and we're gonna go into medtech, et cetera. Now, we haven't seen that. And I think the administration has been quietly getting a lot of pushback from the business world and from our allies. I mean, I think that there's a general agreement on limiting, you know, the most advanced semiconductors that are used for artificial intelligence, but there is not an agreement on constraining semiconductors just generally. So I think they're getting pushback, but I know the administration said that they had a vision of much more expansive controls. Now, you know, export controls only work if there's a consensus on them. What happened at the end of the Cold War was we kept export controls in place, but nobody else in the world did. And so it kind of lapsed, although the mechanism is still there, Americans still have to get, you gotta get an export license for the radiator for a 50 year old truck design.  But we could be marching down that road again, but it only will work as if there's a broad consensus among affected parties. And right now, I don't think we have that. So Sam as a CEO, what would you be doing now internally in the planning process, even the direction yet the uncertainty that we've just been talking about? Yeah, I think Chris, that John's right, the world doesn't work this way anymore. And I don't know how effective controls would be. Let's go back to semiconductors. There are five or six key countries that are advancing semiconductors. In China, it's not one of them. There's only ones in the United States, okay? You have Japan, you have Korea, you have the Netherlands, you have a couple of European countries, you have Germany, et cetera, et cetera. That's the industry. You know, so I know the politicians would like it not to be that way, but that is what it is. And you can't get the tooling if you have these controls, you can't get the materials, the design tools, all those things are completely globalized. And the best solution is to have these like-minded nations work together, not restrict them. The other thing, that's why I think you see this European reaction to some of these things, even in the automotive industry with EVs because they view it as biasing the US, you know, for their own self-interest, but impacting our allies. I just quote, I should say, that if I was running the company that some rational behavior would some point occur.  I understand that, John's right, to have some kind of logical behavior versus their positions they like to take, but fundamentally, those controls would be destructive to the things they're trying to accomplish. So I would start with if I was a company educating those people and why it's destructive. And you see that going on now in semiconductors, quite honestly. And you're gonna see it going in biotechnology as well. We're gonna try to educate these people so they understand that this is gonna hurt us as much as everybody else. Well, going back to the previous era of geopolitics being the organizing principle, you had allies, as John said, who had less scrutiny from our export control system than other countries who were not considered allies. And therefore, the world was broken up into different lists of countries that were assigned different levels of risk. So the sounds though, like the French shoring concept, which has been talked about by folks in the administration and elsewhere, is one way of finding maybe an HOV lane stand for what you're talking about, which is if Japan and the Netherlands and other countries are considered friends for the semiconductor space, then maybe as the CEO you target your investment into those countries as opposed to someplace else? Well, yeah, I mean, clearly, I would not put assets into countries today, like Russia, obviously, or China. I would not be putting hard assets into this location. I would try to figure out in China how to operate economically without having hard assets there. And there is a solution to that, quite honestly. There are ways to do that, as you and I know, because it created a lot. But I wouldn't be putting a, if we stay on semiconductors, a fabricator in China, if I was IBM to that, I'd keep it some, I would either put it in Germany or the United States, quite honestly. That means, though, the reason why we'll, and to jump to this American Frontier Foundation, we're gonna, we should be collaborating with these countries. It is, the research for future technologies is very expensive and it's very hard to do. The fact that we think we're gonna go along is very naive. It's not technically sound. So what you need to have, you need to do is have relationships with these five or six countries where you have that expertise is my point. So you really can't in any way disrupt the system, the way it works today and expect to be self-sufficient and leading in semiconductors. You will fall behind. Forget the $52 billion in the CHIPS Act. That's like four fabs, guys. You know, that's nothing compared to what's required from the R&D, it's the tools, the material science, all those sort of things that need to be done. And that's all done globally. So I think it would be destructive to the industry, destructive to our economy if we decided to say it all has to be in the United States. John, if you were asked by CEOs and companies who were participating in sensitive industries or some of these strategic technologies that we were talking about, what countries would be the safest for me to invest in? Suggest the top three? Well, I think, Chris, I think the challenge with the question you pose it is, depends on what it is.  You gotta go to certain places to get lithium. If you're talking about building factories and having manufacturing in a country, I agree that there's a chill in the air on China. But there's no country in the world that has put together the whole package the way that China has. The internal transportation networks are dovetailed into intermodal transit, efficient ports. If you need a longer runway, they'll extend a runway for you so they can get in different.  And I don't see another country getting close in the near term in having it. So I think for manufacturing, I think China is still going to be a pretty central actor in global supply chains for a long time. I don't think that's going to go away soon. I mean, it's a very important point for your listeners here is that last year, the world invested in about two million industrial robots, half of them were in China. Tell me how, who's gonna step in and replace China as a manufacturing power center given the way they've got the package together right now. So I think we've got a long way before we're going to see a shift. So recently, President Xi and Biden met face to face in Indonesia and they have announced new high level meetings in defense, foreign affairs and financial sectors. But what's notably absent from these positive actions is trade, commerce and scientific cooperation. So what should CEOs and other business leaders take from this? If anything, is it to be determined and don't worry about it? Or is it a message? John, let's start with you. Is it a message that you think is telling as to the geopolitical relationship that these two largest economies are in right now? I think it's a leading indicator of the problems that we're going to have with each other. I mean, part of it is a unique problem with the Biden administration. They don't wanna trade policy. There's a proclism about the Biden administration about manufacturing and it just, there is no trade policy. They've got something they call the Indo-Pacific Economic Framework, but it's, there's nothing in it. Just a label. Asian friends are working with them, trying to get them to agree to put content in it, but I don't think that's happening. But when you get to something like technology restrictions, I think, unfortunately, this is now a bipartisan consensus, partly based on paranoia, partly based on protections, legitimate protectionism. You know, the Chinese do spy. You know, I mean, after all, they've been trying to steal secrets, but we're starting to see real restrictions coming in place. And a very little known thing right now that Biden administration is talking about doing away with non-compete clauses on business. Well, what they haven't thought through is a non-compete clause restricts foreigners from taking trade secrets back home. So we could see a real ratcheting up of other restrictions in technology controls once the dawn's on them that one agenda is in conflict with another. So I would be nervous about where we're heading right now if I were a business guy.  No, I'm kind of where John is. I mean, they had a meeting, but they didn't establish anything that I understand. It's called guardrails of some kind or lanes we could operate within. I don't know that that's been defined. And so I would just be cautious. I mean, you'd have to watch closely guys. I mean, you know, as a CEO, especially if you're operating outside your domicile country, whether that's your European United States, it doesn't much matter. You need China for business growth, right? In tech, it's like either the largest or second largest market in the world. So you can't say I'm going to avoid the largest market, second largest market in the world. But my point being is I would just be watching and trying to see where this thing goes. I wouldn't be committing much of anything. You'd be operating your business, dealing with the, you have enough pressure on the business these days called high inflation, commodity prices going through the roof, labor causes going through the roof, economy slowing in a macroeconomic environment.  So I would, I'd be watching, I'd be relying on people like yourself, Chris, to keep us informed what's going on. But I wouldn't be acting quite yet. The title of today's session is looking forward, looking ahead to US-China relations because CEOs and businesses need to know how to plan and they need to know how to plan and informed in an eligible way. So I want to thank you both for joining in the conversation today. Hopefully it's been helpful to our listeners. But before we close, we like to use the last minute or so to give our listeners some strategic insights to think about. We call it our emerging critical issues moment. So in one word or one phrase, please tell us what emerging issue do you see on the horizon that business leaders ought to be putting on the radar? So John, why don't we start with you? There's a proclism that's growing in American politics and the only antidote to that is business has to be engaged in Washington. You got to come here and share your insights. But I don't think this is unavoidable. We now have to have the business world in Washington sharing its insights about what we have to do. And do you see that same involvement by business leaders in other capitals around the world, maybe in Europe and elsewhere? Oh yeah, no, no, the Europe has put together a consultation mechanism with the business world that's much more effective than ours. Now unfortunately, the regulatory environment in Europe is choking off for their future. So Europe has decided they're going to manage their future by controlling access to their consumers, not by stimulating an innovative economy. And so that's why we're scratching at each other right now. I mean, that's why the Europeans are all pissed off at us over the new green investment stuff that the Biden administration put in because they don't have it. And so their solution is we're not gonna let American companies sell into our market. Okay, so we're gonna have some challenging days, I think, with our allies too. Sam, one thought, one word that CEOs ought to be putting on their radar. I'm gonna give you a technology lens versus a geopolitical economic, Chris. I would say this whole accept area or chat GPT, I would think about the same way what we thought about digital currencies before FTAC. Well, the GPT is getting a lot of attention. And so is silver's Bitcoin, so is the ethics. Across all generations too, right? Not just my generation. Absolutely. All right, well, great. And we will come back to these critical issues in future shows, but John and Sam, thank you for your time today and your insights. It's been very enjoyable and helpful. And you've been listening to the get sponsored by the Center for Global Enterprise celebrating 10 years of convening global enterprise leaders around the world to the most important business transformation issues.


You know it takes a lot of effort to talk in front of a big group and this is Andrea's first time so let's give him a round of applause. Can I start? Okay. Well good morning and thanks for being here. This is my first time DevCon. It's a big pleasure to be here. My name is Andrea Marcelli and today the talk is looking for the perfect signature and automatic rule generation algorithm in the high era. I am a PhD student at Polytechnic Tutorino in Italy. I study machine learning, semi-supervised modeling and optimization problems. But I'm also a PhD security researcher at ISPA-SEX Systemas where I work on new techniques for large scale Android malware detection. Today we will talk about the signature generation problem about the algorithm that I have developed and the tool that I have developed. Then we go through a quick demo and some results of the algorithm. So let's now, let's now talking, start talking about the signature generation problem. And what is a malware signature? A malware signature is a unique pattern that indicates the presence of malicious code. And since the problem is that since malware evolves over time, new signature should be generated very frequently. And historically there are two type of signatures. There are syntactic signatures and semantic signatures. Syntactic signatures are those based on textual strings and on binary sequences extracted from the application. And this is also the industrial standard type of signatures and where most of the existing research focus on. Instead today we will talk about semantic signatures, which according to some recent literature could lead to a better detection. And those provide an obstruction of the program behavior. So in today's talk we will talk about Android malware and automatic signature generation. But all the concepts are very generic and should be applied and could be applied to other targets too. So which are the motivations behind the work? Well, first of all we want to reduce the malware exposure time. Second, generating, writing a malware signature is a very repetitive task. And keep in mind that we, from 20 to 50,000 new applications received every day. Mono analysis is not an option. Then we have a goal, which is to recall and very high precision requirements. In other words, you want to lower both false positive and false negatives. And lastly, in the end it's all about saving a lot of resources and time because writing signatures manually, it's very time consuming and expensive. And we will generate signatures using the YARA language. YARA has been defined by Victor Alvarez, his creator, has YARA to file what's north is to network traffic. And the advantage of YARA is that YARA is fast and it's also the standard type of languages that is used in the antivirus industry. So it's very spread. And YARA naturally supports syntactic signatures, but it also supports semantic signatures through custom models. So you can write your own models. This is an example of YARA rule. There are three main sections, although the most important one is the condition that is where the logic of the rule is placed and also where the semantic attributes of the signature can be added. Now let's go through the algorithm. The algorithm for the automatic malware signature generation is placed within a pipeline that is very common to many antivirus industry, antivirus software's house. And the idea is that there is a submission of new APKs every day. And those APKs are analyzed through machine learning techniques, mostly unsupervised techniques, in order to automatically infer new malware families, that is the clusters. And in the end, for each malware family, you want to generate a signature. And this is where my algorithm comes in place. And in order to generate a signature, you need to start from some attributes, some features extracted from the application, through the application analysis, both statically and dynamically. And just to have a graphical representation, each feature could be a small square within the gray grids that you can see in the slides. And it could be, for example, a neural hell, it could be a permission, an intent filter, or everything else. And it's very, very important that the analysis is performed very carefully because through the analysis, we extract the attributes. And having good attributes is the key to have a good signature tool. So the idea behind the algorithm is very simple. We have two applications. We have a set of attributes for each application. Probably some attributes will be of the same type and will be actually the same between the two applications. In this case, we have some orange and some green attributes which are the same. And actually, we can generate signatures by combining those attributes. Although the reality is much more complex. And as you can see, in most of the cases, you cannot find a unique pattern which is in common to all the samples of the same malware family. And so the problem of generating signatures is the problem to find the attribute subsets that cover the entire malware family, all the samples of the entire malware family. And if you can, if you think about it, it's a very, it's a problem that is very similar to a very well-known problem in the literature, which is the set coverage problem. Actually, this is a variant of the set coverage problem, which unfortunately is very hard to solve because it's NP-complete problem. But since we are not interested in a global optimal solution, we just need a local optimal solution. I have developed a dynamic reading algorithm to solve the problem and actually automatically generating a signature. So as you can see, generating a signature is not such a big issue. But the main challenge is to evaluate signatures. So in order to better understand this process, I will introduce a couple of formulas. First of all is the DNF, the disjunctive normal form, where a set of clauses are in logic R and each clause is made by a set of literals which are in logic N. And a literal is one of the attributes that we have extracted before through the analysis. So if we reduce each signature to a DNF, we can actually weight each clause. And in that way, we can say that the weight of a signature is actually the lowest among its clauses. And this weighting process is the base of the evaluation process of a signature, because if a signature has a very high weight, it means it's too specific. It will not be able to generalize and will actually produce a lot of false negatives. Instead, if it's too generic, it will generate a lot of unwanted detections. That is a lot of false positives. So we want to generate a signature which stays between two thresholds, TME and TMAX. And that's where the optimal signatures are. So as you can understand, the key of the weighting process is to actually assign a good value to the attributes. And the value to the attributes is very tight to the value of the two thresholds, TME and TMAX. And actually, I wanted the entire process to be automated and I didn't want to rely on the knowledge of the expert analyst. I just wanted to make it automated. And one of the possible solutions is to start from the repository of YARRA rules. There are a lot of public repository of YARRA rules that you can parse them and reduce to the disjunctive normal form. Then it becomes a linear problem that you can solve by means of a linear programming algorithm, like the Simplex algorithm. And in the end, you are able to satisfy the 95% of your rule set in order to have a weight which is between the two thresholds. Why 95%? Well, because some rules set are so specific to a type of malware family that it's not possible to really extract some useful knowledge for them. Well, when I actually implemented this algorithm, I ran into a new problem. That is, the signature were too specific, too many attributes. The weight was so high, it was actually impossible to use them. So in order to create a better signature, we have to remove some attributes. How to remove them? I have developed two strategies, one very simple, which is the basic optimizer, which simply randomly throws away some attributes. And then the other is the heave optimizer. And why we need the evolutionary algorithm to optimize signature? Well, there are some no written rules about how to generate a good signature. And those rules can be placed within an algorithm, a genetic algorithm, that actually find the best combination of them to generate the best signature. And the good thing about all of them is that they are very fast. One less than one minute, the other about five minutes. So it's scalable. So I actually implemented the entire procedure that I have described into an algorithm, which is called Yaya-gen. Yaya-gen is an acronym, a sense for yet another Yara rule generator. And if you know Spanish, you will probably know that Yaya in Spanish means grandmother. And the goal of Yaya-gen is to start from a set of application reports, which means start from the result of the analysis of several applications, and generate for them a set of Yara rules. Yaya-gen includes a lot of functionalities. And for sure, the most important one are the algorithms to generate a rule. There are two variants. There is the clot and the greedy. The clot is an unset greedy because the problem with the greedy is that probably you will generate rules which are not homogeneous in the number of samples that are covered. Instead, the clot tries to generate a rule with all the same coverage in order to create better rules. Then we have True Optimizer, the basic and the evil one. And some heuristics because in the signature generation, it's all about heuristics. For example, we are very interested in including some URL if those are malicious, so there are some heuristics to understand if URL is malicious. There are some heuristics to throw away some attributes, so performing some kind of filtering at the beginning. And the software package also includes the Yara rule parser for attribute weight optimizations. So if you have your own set of Yara rules, you can actually apply this program and find out which values satisfy the rules starting from your set. Then it also supports the false positive exclusion. And although the false positive match is something very rare with our automatic generated signature, we want to include this option in the rule generation. So in case of unwanted detection, you just include that detection into the process of generating a signature and the signature will not match that false positive anymore. Everything is written in Python 3, so very easy to use and customize. And finally, as you may understand, this is just a plug-in with a much bigger infrastructure because you need an infrastructure to actually analyze the application and an infrastructure to test the rules that you have generated. And that's the reason why Yaya Gen has been written to directly work with Kudos. Kudos is the open antivirus from Ispa second. It's free and open to everyone. And it works with the Android applications, Android malware. So the great news about Yaya Gen is that it's free, it's on GitHub, so any improvement is really welcome. Now I'll go through a short demo. Okay, in this case, I'm using Yaya Gen to generate a rule using the Cloud algorithm for the SkyGo free family, malware family. And as you can see, I gave in input some ashes of known applications that belong to this family. And what the tool actually is doing now is just downloading the report of the application analysis from the internet. So I said it's generic and it is because if you change this part, if you feed into Yaya Gen another type of report, it's all about changing which attributes are selected and then everything can be optimized. It's not tied to this type of report only. And the rule that is generated and everything is super fast because I didn't speed up anything. And the rule that is generated is a valid rule. So you can actually use this rule in your system. Be only aware that probably you will need some custom models in Yara to use it according to the type of the attributes that you use. In our case, we are using Android and Kuku, which are models that are available in Kudos, but probably if you will use it on your own platform, you will have to add them. And let's just go through the rule. This rule has 17 literals, which means 17 attributes. With a score of 484, which is a quite high score, and it's above the threshold. The minimum threshold is set to 400. It has a coverage of 8 over 8, which means that all the samples that I gave in input are covered because in this case, the family was very tight. If the family is loosely defined, it doesn't matter. Simply find more rules. And that's all for the demo. Now let's go back to the result. I wanted to compare the efficacy, the effectiveness of the automatic generated rules with the human written rules. So I started from some of the available ones. And I tried to recreate an automatic version starting from some sample that were originally detected. Well, actually, I did some tests on 1.5 million data set of Android applications collected through 2017. And what came out is that all the automatically generated signature improved the number of detection, ranging from the 8% to the 131%. With a neighbor age of 65%. So it's a huge improvement and all of that without even generating a false positive. So in order to conclude, I developed a set of algorithms to automatically generate VRR rules. I did it in the context of Android and using Yara language. But as I said, everything can be easily ported to other targets and other languages. And what comes out is that automatically generated rules perform better than human generated ones. Then one interesting fact is that there are several ways in which the expert knowledge can be included into the Yara rule generation. For example, there are the heuristics. There are the way in which the attribute value is set. And there are also, there is also the optimization phase. So actually a malware hasper can really increase the quality of the automatically generated rules. And finally, all the approach is very scalable because generating a rule for 100 up, it takes less than five minutes. And if it grows to 1,000 up, it takes around 30 minutes, less than one hour. So it's a lot, but it's orders of mind to the less compared to the manual work. We are working on a new version of Yaya Gen, which will target Windows executable. It's called Yaya Gen P. We are still working on that. We are still testing it, but preliminary results are very great. So I will keep you posted if I have any news. And that's all. Thanks a lot for attending the talk. And if you have any question, I would really appreciate to talk with you off the stage.


My name is Sandak Nin and I am the author of Malignan's Search Lava, Narcissism Revisible. Today we will discuss the Rorschach inkblots test. Swiss psychiatrist Hermann Rorschach developed a set of blots of ink, inkblots, to test subjects in his clinical research. In a 1921 monograph published in English in 1942 and 1951 respectively, Rorschach postulated that the blots of ink evoked consistent and similar responses in groups of patients. Only ten of the original inkblots are currently in diagnostic use. It was John Exner who systematized the administration and scoring of the test, combining the best of several systems in use at the time, systems developed by Beck, Kloper, Rappable and Singer. The Rorschach inkblots are ambiguous forms, printed on 18 x 24 cm cards in both black and white, and sometimes in color. The very ambiguity of the inkblots provokes free associations in the test subject. The diagnostician stimulates the formation of flights of fantasy and fantasy by asking questions such as, What do you think this is? What might this be? The diagnostician then proceeds to record verbatim, the patient's responses, as well as the inkblots' spatial position and orientation. An example of such record would read, Card V upside down, child sitting on a porch and crying, waiting for his mother to return. Heading down through the entire deck, the examiner then proceeds to read aloud the responses while asking the patient to explain, in each and every case, why she or he chose to interpret the card the way they did. He asks, What in Card V prompted you to think of an abandoned child? In this phase, the patient is allowed to add details and expand upon his or her original answer. Again, everything is noted, and the subject is asked to explain what is the card, or in his previous response, gave birth to the added details, so it's an iterative process, a process where the answer expands as the conversation continues and the card is merely a trigger. Scoring the Rorschach test is a demanding task. Inevitably due to its literary nature, there is no uniform automated scoring system. Methodologically, the scorer notes four items for each card, one location. Which parts of the inkblot were singled out or emphasized in the subject's responses? Did the patient refer to the whole blot, to a detailed inkblot? And if so, was it a common or an unusual detail? Did the patient refer at all to the white spaces between the blots? The second item is determinant. Does the blot resemble what the patient saw in it? Which parts of the blot correspond to the subject's visual fantasy and narrative? Is it the blot's form, movement, color, texture, dimensionality, shading, or symmetrical pairing that might have provoked in the subject the responses that he gave elicit them? The third thing noted by the diagnostician is a content. Which of Exner's 27 content categories was selected by the patient? A human figure, an animal detail, blot, fire, sex, x-ray, and so on. Popularity. The patient's responses are compared to the overall distribution of answers among people tested with the two. Statistically, certain cards are linked to specific images and blots. For example, card 1 often provokes associations of bats or butterflies. The sixth most popular response to card 4 is animal skin, or human figure, dressed in fur, and so on. Then there is the issue of organizational activity. How coherent and organized is the patient's narrative, and how well does he or she link the various images together? There is form quality. How well does the patient's asset fit with a blot, and with a blot? There are four grades from superior, through ordinary, and weak, to minus. Exner defined minus as the distorted, arbitrary, unrealistic use of form as related to the content offered, where an answer is imposed on the blot area with total or near total disregard for the structure of the area. The interpretation of the test results on both the scores obtained and on what we know about mental health disorders is somewhat questionable. The test teaches the skill diagnostician how the subject processes information and what is the structure and content of his internal world. These provide meaningful insights into the patient's defense, psychological defense, reality test, intelligence, fantasy life, and psychosexual makeup. Or so it is thought. The Rorschach test is highly subjective and depends inordinately on the skills and training of the diagnostician and his interpretative abilities. It is therefore cannot be used to reliably diagnose patients, which mainly draws attention to the patient's defenses and personal style. In the case of narcissists, that's not enough.