Mike Rogers retired from the U.S. Navy in 2018 after nearly 37 years of naval service rising to the rank of four-star admiral. He culminated his career with a four-year tour as Commander, U.S. Cyber Command and Director, National Security Agency – creating the DoD’s newest combatant command and running the U.S. government’s largest intelligence organization . In those roles he worked with the leadership of the U.S. government, the DoD and the U.S. Intelligence community as well as their international counterparts in the conduct of cyber and intelligence activity across the globe. He also assisted in the development of national and international policy with respect to cyber, intelligence and technology – including extensive work with corporate leadership in the Finance, IT, Telecommunications and Technology sectors.Admiral Rogers is currently supporting companies in the private sector, serving as a member of various Boards or acting as a Senior Advisor. He also speaks globally to various business and academic groups and is working internationally in the cyber and national security arenas. He is a Senior Fellow and Adjunct Professor with Northwestern University’s Kellogg School of Managements’ Public Private Initiative and a member of the advisory board of the Australian American Leadership Dialogue and NATO’s Cooperative Cyber Defence Center of Excellence. He is also a member of the United States Naval Institute Board of Directors.View the profile
Niloofar Razi Howe has been technology investor, executive and entrepreneur for 25 years. Focusing on cybersecurity for the past ten years, she served as Senior Vice President of Strategy and Operations at RSA, and Chief Strategy Officer of Endgame, Inc. Prior to her operational roles she spent twelve years leading deal teams in private equity and venture capital. She is the creator of the TEDx talk, “The Gift of Exile,” on opportunities arising from the most difficult life challenges and the importance of seeking diverse perspectives. Howe graduated with honors from Columbia College, holds a JD from Harvard Law School, and is a life member at the Council on Foreign Relations.View the profile
About the talk
Former Director of the NSA and Commander of Cyber Command Admiral Michael Rogers talks with Niloofar Razi Howe about nationstate activity in cyberspace as a tool for attacking money, systems or information; why it's important for the United States to be active in cyber engagement; the roles for public and private sector collaboration; and how to build a technology-backed cyber system that reflects American values.
Thank you all for being here Admiral Rogers. It's always great to go as director of the National Security Agency and Commander of cyber command and we're here to talk about an uplifting topic. Cyber War. 1984 William Gibson coined the term cyberspace in his bus Neuromancer which by the way also launched the cyberpunk movement and came up with the concept of matric and he said find it as a consensual hallucination experience daily by billions of legitimate operators.
For the first commercial website went up and hdcp protocol was created in in back. Then we should have had this utopian sense of what the internet was going to be Universal connectivity Universal interoperability. We actually didn't want it to be secure and we also didn't Envision the kind of malfeasance. I can take place. We didn't think about resilient systems about trustworthy totally different structure. If those are placed human Ingenuity lost power greed and we certainly weren't thinking about Nation. There's a movie in there somewhere.
I want to start with that when it comes to nation-state activity in cyberspace. What's happening out there. What are the classes of activity that that we're seeing is an extension of a broader strategic environment and it doesn't exist in isolation. So I always try to remind the teams that I was responsible for and then and is part of the leadership of the government. So let's Back and look at this. If you look at how the Chinese the Russians the uranians and the North Koreans use
cyber. It's all slightly different. Let's take the North Koreans is an example. You are a nation that's isolated economically because of the global sanctions and you look at Cyber as a tool among other things. Do you know we can rob banks we can mine cryptocurrency we can use cyber is a tool to go after Casinos gambling sites places where there's money. I never seen a nation state except for North Korea. Use cyber is a tool to go after money, but in the context are operating in a different environment, if you look at a Ron on the other hand,
you're not interested in this truck direct conflict with the United States and other so to cyber along with other things like you said proxy that becomes a very attractive tool to engage in behaviors designed to create pain potentially change Behavior, but doing away. That has a lower risk because there's some degree of anonymity and lack of Direct Hit. You can't really prove it was us or so, they think it time rush on the other hand to give them credit. They have looked at the dynamic between cyber and information and decided to bring these two together. We can do some pretty
powerful things in clearly as you've heard both from Mike as well as earlier today and I was part of all this you saw that play out in 2016 in a big way again, if you cyber is as a tool not the end. It's a means to achieve something on the other hand. Look they are trying to overcome what they believe is a technical and economic advantage in the west that has placed them China at a disadvantage for much of the twentieth century their view is so we are going to overcome that by creating the technologies that will shape the digital age will create the company structure. They look at the
Westin they go while you're not only develop the technology they got the globalist. Better Bodies to adopt it and then you monetize it through these corporations and these corporations generated massive economic Advantage for you. It's not by by chance and look at what they're doing. They are trying to overcome that by repeating it using a different set of Technologies. They've asked themselves when ITS Technologies in their owner going to underpin economic advantage in the digital economies of the 21st century machine learning,
you know, if we're going to overcome their advantage we can either spend billions of dollars in a lot of years doing it ourselves or we could do that and outright steal some of it bring it back will monetize it will develop will expand. It'll save us billions of dollars and literally in a years in developmental timeline. Baseball bats actually the wrong question to ask because it's not about who has the most sophisticated cyber capabilities, but who is using cyber most
effectively to further their national interests. I agree in the other, I will make it and look at the risk tolerance has You look at with the Russians for example did in 2016. They're willing to engage in behaviors as our other nations that they believe represent pretty low-risk opposite day, which I get in my previous Life as a person on the inside and the oval going let's step back and ask ourselves. How do we get to a situation where a Chinese counterparts are Russian counterparts the Iranians and North Korea and
yet we have come to the opposite conclusion. So we start off by telling ourselves. Here's what we're not going to do. They don't have those discussions. That's not the way they think look at the advantage. This is creating for them. We need to change this guy 9 if you took action in cyberspace suddenly was going to ask Ali to nuclear war. So there was this huge resistance to Precision engagement in in cyberspace. Started changing under you and I know you were a huge advocate of a
persistent engagement. Like you said fighting that the theory that we we can't engage because the risk is too high has persistent engagement in cyber work to our advantage to a purse that you know, the analogy always used to get with Mike. We the United States live in a glass house. We can't afford to throw any stones in my comment was can you tell me an advanced economy in this interconnected Digital World we're living in that doesn't live in a glass house. What do you think underpins the Chinese ability to move massive car goes for export based economy. What is it that you think the labels
the Russians to run a National Train system, for example guys in the the world is a whole has inherent vulnerabilities in the world. We're living it. So why we take this attitude, we're the only ones I never understood that so what we try to make I am the only one by any stretch of imagination, but with the transition want to think we tried to argue was we need to change the wrist active. Others because if we don't if they continue to believe that they can engage in these behaviors with little risk or little consequence than history to me would suggest you can only count on them to do more.
In fact potentially Escalade over time guys. That's not in the United States best interest to be on the if your strategy is we're just going to respond that is resource-intensive. It's going to cost us billions of dollars. We're always reacting my military career taught me good or bad you try to shape your opponent's behaviors to drive them to make choices that benefit you not them to my attitude was why we do this in so many other areas. Why can't we do that in cyber? So we can kind of collectively came with this idea of persistent engagement. I how can we get out
in this space in can test what they are doing on a regular daily ballast within of legal framework? To the global legal framework everything we do with a law of armed conflict. I was always adamant guy cybers. No different. We have got to fit into this konstrukt and we buy the war or it's not warm like these binary good bad yes or no, either or For example Isis in al-Qaeda and the strategy is shifted to Russia China Iran North Korea partially because we were effective in taking on violent
extremism and all the activity. They were taking on inside were talked about how we were effective in cyber against that enemy. First of all, I think you have to acknowledge her success against non-state actors in the form of violent extremist organizations. Like Isis now, no one should take for that that we have eliminated them or that it is going away because I always try to remind people look the fundamental conditions that led to the generation of this. We haven't fundamentally address those and until we get to that point. This isn't going away. What
we've been able to do is knock it down to a much lower level of capability. Don't you think it's going away but we try to do was one of the arguments I and others made was we have got to show these guys that weird have the capability and the will to kontest them in every domain. We're not only going to fight them in the physical battlespace of Syria and Iraq, but we're going to take it to him in the information Dynamic and in their ability to spread their ideology using the world wide web and cyber and backbone the ability
to use that same system to generate Revenue the ability to use that kind hosts Global structures to recruit the ability to use those structures to connect geographically dispersed entities and try to come up with as we would say in the military some form of Commander control. My argument was it isn't going to be enough just for us to go kinetic and Syria and Iraq, we got the fight them in every domain. We got to take away their freedom of movement. We've got to take away some of their abilities that we watched. Until we engaged in a series of activities which Republicans knowledge using
cyber and are going after the information infrastructure going after the monetary infrastructure that no one should think for one minute that we took it all the way and I said look at that's the objective you're going to give me as a military care man would tell you right now. We have a low probability of success just given the way this is structured. It is unlikely, but I think we can significantly degrade and I think we can send a broader message to them that we're ready to can test you. I mean, for example, we wanted them to know it was all so I can remember telling the team. I
want you to insert United States cyber command of the code. I want them to know it's coming from us. Just extension are prepared. To confront you in every domain you have no Sanctuary. You have no area where we're not prepared to come after you. Agencies play in cyber command is it is more recently obviously set up National Security Agency largest intelligence organization in the US government or 17 different segments. It is the largest of the Seventeen by a fairly significant number not surprising given the technical with the digital world in the
technical World. We're living in our nation has overtime chosen to invest heavily in those technical capabilities than NSA has it has two primary missions one using a signals using a single discipline signals intelligence and generate knowledge and insight about what is going on in the broader world around us section traditional intelligence rule take that information combined it with others that helps you get knowledge and insight and hopefully that that leaves two better policy and better military decisions the second part of the NSA Mission and one of the reasons why the decision
was made initially that one individual should lead both organizations and I say because much of the Telecommunications in the world 20 years ago shift The world of the network and I say got really smart of a network developed a lot of people with great in-depth knowledge a lot of technical capability. And so NSA second mission was Defensive. How do you take this knowledge of networks? I can't take this knowledge of the things that actors do out there and how can you translate that into Insight that will help us better defend that work bills better never meant to say for example develop
from the mathematical algorithms to the actual production. We did all the encryption for the class flight systems in the US government all the way up to the nuclear codes and the football for the president. So NSA of those two missions, then we made the decision in the Department of Defense about 10 years ago. Now we saw the way technology and we thought Warfare was moving and we thought to ourselves Cyber is going to be an operational domain in which actors with Ade nation-states individuals criminal groups others are going to use capabilities against our nation and against us
specifically in. We need a capability both to forestall that develop options as a tool to put pressure on potential for poem. And so the decision was made up create a very traditional warfighting structure just like Central Command that ran the wars in Iraq and Afghanistan has created a similar and at the same time we ourselves we realize we got a big hurdle to jump to create something new. What's the center of gravity in the Department of Defense right now today 10 years ago that has people expertise we can take advantage of the
investments in a boarding been made and it would clearly one. We made the decision was create a related but separate organization different Mission different legal authorities. It would be hilarious. Sometimes it meetings. I have to say nothing. Okay. I am speaking now as a director and I direct the following things or I would say I can't speak it out with the commander and is the Commander in a direct the following things but different budgets different legal authorities, and I'd have to talk to different sets of lawyers about what's legal with witch hat cetera people don't
appreciate the amount of oversight that the NFL in organizational change, but do we have a coherent strategy in cyberspace to go against these nation-state adversaries who clearly have well-defined strategies in terms of my biggest frustration was in remains. Number one. I thought it wasn't at the government didn't have capability. It was the fact that this capability was Across multiple organizations multiple structures with multiple authorities multiple is a
military guy multiple change of command and we create a structure. That was so complex if you were on the outside, if you are I run a big Bank in New York and worried about the uranians coming after me who in the heck in the US government. Am I supposed to deal with I've had more than one CEO tell me how many you want to stop mic or hey, why can't we work just worked directly with you and I'm going to not the way the government the structure itself. The first challenge always thought was we have got to create something better within the federal government. But then secondly, I thought I
was thought to myself. The greatest challenge of cyber is the fact that it forces you to rethink the traditional traditional mechanisms. We've often taken to solve problems in the geography define Solutions. It's why we have a central company. That's why we have an endo. That's why we have a European command this hey, don't worry. We'll just draw lines in the bathroom will break the problems down and yet but we're finding in this century is problems. Don't necessarily just to find themselves by geography in one of the jokes. I used to say was so
Central Central Command for the war in Afghanistan. I would say do you know where most of your infrastructure is it isn't in your area physically. So this idea that you can control cyber guys. It's not going to work for us and yet the other thing is in in our Societies in nation for bride a very legitimate reasons historical. We've said there's a well-defined role for the private sector as well defined role for the government and they need to do their thing as somewhat independently. I don't think that's the optimal solution of the world. We live in and out put another way. You tell me how
you expect private companies to withstand the determined efforts level of effort integrated strategies of entire nation up to you. Good luck with that Russian thing of that Chinese thing. As we become more active not just in cyberspace, but as we've got me a week to workout General soleimani recently and the first conversation that happen after that is oh my God a Ron's going to attack, you know you Seibert attack the US and his store that we haven't responded to those to those tax are on the tactic initial Services sector and there was no response or Iran
attacks out of the externally and the Russians are all over our grid, for example, there's a book that came out recently that documents all of that as we become more active built in cyberspace, but also in the kinetic world, the second third order of facts aren't going to be necessarily against US military. They can very well be against the private sector what exactly is the government's role in that scenario and what is private sectors responsibility because it's it's new territory for everyone.
On a Hino on a company headquarters, there's no question. That would be an act of War but when Iran attacks Financial Services the White House said not our problem you guys on the defense good luck back. Even with the North Koreans in November 2014 wants to fight for malware is against Sony still be having this same discussion about well, it's really much more of a legal issue than it is. An act of War. We're clearly not there. I think on the private sector side that the whole idea to me is why can't we work
collectively on these problems? I want to be in a situation where the pain of the one leaves the benefit of the mini. So who won company if one entity is dealing with the problem we use that as a way to improve a broader set of actors that isn't the way we do it. Now the paint of the one needs to the continued pain of the many it'll keep asking yourself over and over. Keep working and I'm going because we're not looking at this collectively what works against one company isn't shared by anybody else. They're not with anybody else. They're not smart about what has succeeded
what is not work? And so the actress just keep using in many cases not always but you see the same techniques the same approach used over and over again and it in many cases has high probability of success likewise. We got to figure out how the government could be more integrated and can then work with his blood a collaboration environment. I just think we need to get where we need to be. We're going to have to be willing to step back and ask ourselves are we really comfortable that we have these roles correctly aligned? Cuz I don't think we do right now have a
great quote which is the problem with humanity is that we have what does he say? We have Paleolithic emotions medieval institutions and Godlike. And Technology keeps moving at this rapid Pace, but our institutions are certainly not keeping up and of course our Paleolithic brain and that's a whole other conversation around cognitive. I season the plot human operating system, which gets in the way of everything but went when we look at that starting with our institutions.
That's the question. I always get asked which I have a hard time answering is does China have an advantage because it's an autocratic regime over liberal democracies where you have to have consensus and Sarah work on these problems in a Cooperative collaborative way and everyone has to agree to come look in the long run. I would take our cards every day over there. I don't want to live in that kind of society, but you have to acknowledge in a short-term scenario in many instances autocratic regimes have an ability to direct action in a way that Democratic nation states and
institutions just don't that week because when I comfortable that and also we Bolivar structure has led to Great benefits over time is in perfect as it is and I have to stay look we've created something special. We've created something that is a model for the rest of the world. It is something we ought to be very proud of you business. We have to acknowledge. It is imperfect. We got to keep working hard to continue to make it better and I'm sure that we're treating each other in a respectful Fairway and I used to tell people look the hardest part is not technology. The hardest
part is how you change culture and people technology is easier to change an implement. It is the human Dynamic and for all this great technology. The greatest Challenge and potentially greatest benefit for us is if we can bring together the human peace and all this in a meaningful effective way combined with his great technology. We will have something really really special. It's the cultural and they human piece. It is lagging the most at the moment. There are technical check the collaboration and cooperation you're talking about we need to have
trust between the private sector and government and not trust isn't there in a way that needs to be kind of gets the completely control its narrative right? When was the last time we saw anything of something here talked about much sometime in in the 80s probably get to completely control the narrative that get to control how the information flows in the US we have, you know, where the First Amendment people can say what they want. How do we build that trust right for us? But it makes it harder to have a control
conversation. So how do we build that trust that is necessary to have them before we got to acknowledge look traditionally in our structure. It's it starts in my very beginning. We start we created this thing we call the United States of America in no small part because we had a distrust of this comprehensive invasive government in the form of Great Britain that with no input from us would decide what houses they're going to put their troops in your building how they were going to strict at the Town Square Wichita our culture even at the time when they look we use this is the form to
articulate our viewpoints to express our disagreement. So we started from the very beginning and we created a structure in which we wanted to put a measure of control on the government. That combined with got no knowledge of time's the government has done some things and its history where you step back and say that consistent with our values. That's not if we are the second step is so let's not be bound by the past and sent to tell ourselves. So all that history leads you to believe you can't trust government all thoroughly. So what are the checks and
balances that we can put in place as we're working for this more collaborative approach? What are the checks and balances that we can put in place to help ensure greater transparency greater knowledge in the part of the citizens in Greater awareness up. So what made the government doing, you know, that's that's one of the things that I would say the government historically has not been good at I came in in the aftermath of the revelations for example, and how might one of my comments was. So what NSA for example was doing was in accordance with the law having a discussion about this law.
We like it we disagree with it that we think we ought to change it. One of my takeaways is you want to be you want to do intelligence in a democratic structure in the digital age. Then you better start from her premise that says you need to be open kimono to a much greater degree than historically we have been because I'd rather have the discussion up front with our citizens about okay. Are you comfortable with this or you come for that then we'll let's just assume they're comfortable will go along and we'll do something within the legal framework that was created and was
actually renewed in this case. They call data records nude in more than one by our elected representatives. But because we didn't have that discussion. It's suddenly led to this. We weren't aware of that. Can we trust you guys? I just think we need to do things a little differently which have some pretty serious consequences that can go with them if we get it wrong again, if we look at our official intelligence if you look at Quantum Computing, how do we make sure that we don't get to the same place in It's not used against us from
us. So it's not the technology. Don't be a lot. I just don't sit here and technology is inherently therefore we should step away from that might even be to look at the Hort the history of man. How's that played out? I'm not aware of societies that have really been able to do that. This is Steinway and achieve a measure of success increase benefit for their societies rather. The challenge to me is much less the technology and much more the cultural in the human piece. So what are the controls that we're going to put in place to make sure that
the technology reflects our values technology can be used and lots of weight lots of different ways. So many good some of great concern all depends what framework you're from and what you're used to and torturing Society what might be perfectly reasonable and one nation smart city is another nation of your treating his total surveillance framework, and now you want to score Are citizen on the right here and stew some social construct meaning government Dogma. We don't want that. We have to look at it. That seems like a perfect model for us. If it's not consistent with our values
are history. We're very comfortable doing it our way. That would be totally abhorrent for us as a nation or for any other democracy. So I would like us to see a spend a little bit more time on those checks and balances, but I don't want to be intimidated by it technology offers a lot of advantages. It's all about us as people. Halloween music tag technology do reflect our values and what we believe in. Well, thank you so much for you and your baby as a great military person would you so much for coming out here?
Buy this talk
Access to all the recordings of the event
Buy this video
With ConferenceCast.tv, you get access to our library of the world's best conference talks.