hi good evening it's really great to be here thank you for coming out this is my second time coming to town hall and i was very excited when this was put on the calendar for the book tour so feel very glad to be back here i'm a native oregonian i'm from portland so i feel like i'm sort of coming a little bit of a homecoming here as well so thank you for coming out and spending some time to hear me talk about a story that i hope won't give you nightmares maybe will give you some  food for thought and we can have hopefully a good discussion afterwards this book which if you haven't seen it here it is by the way a very clever at war title it really it tries to tell the story of how security became a top national security priority for the united states many of you have probably been following the debate about surveillance after the disclosures of edward snowden from two thousand and thirteen i read a lot about this in my first book which came out in two thousand and ten but it's safe to say that there's also been an entire debate in a lot of energy and focus around this whole question of securing and protecting the internet not just people's personal information but the the physical systems that are connected to the internet the critical infrastructures like the power grid water treatment facilities banking systems that are increasingly run on this interconnected network of computers which have been vulnerable for quite some time and there's a lot of attention around that vulnerability now and it's something has been really animating the discussion in national security in washington in fact just today as if on cue for this talk of the director of the national security agency admiral mike rogers who is also the commander of something called u cyber command which is sort of the part of the military were all of our cyber defense in warfare activities are located he gave testimony today before the house intelligence committee in which he disclosed that a number of foreign governments plural have probed and penetrated the computer systems that run portions of the electrical grid in the united states and presumably are doing that in case they should ever want to try to turn the lights off in large portions of the united states pretty extraordinary admission from the n s a director not something that we haven't heard before but something that you rarely hear and the venue of a congressional hearing just to give you a little flavor of this what he said today it was really quite extraordinary  he said this is not theoretical referring to the possibility that someone could remotely disable a portion of the electrical grid for the u s networks are hacking attacks on u s networks are his words literally costing us hundreds of billions of dollars this is from the information that's frequently stolen and the cost of securing these networks e coli would be some of the really truly significant almost catastrophic failure if we don't take action and he actually said that he believes that his time in office he will have to be responding to a major attack on a portion of our cyber networks analogous to a terrorist attack that we've seen which we haven't seen the likes of since nine eleven so rogers is really echoing sort of a big conversation that's happening in washington right now the past two years the intelligence agencies collectively put out a report every year on global threats cyber threats to our networks and also the threat of cyber espionage directed at our corporations stealing secrets from companies has ranked at the top of that list of global threats from the spy agencies for the past two years james komi who's the new director of the f b i has said that the risk of cyber attacks in iraq is in cyber related crimes such as credit card theft and identity theft will be the most significant national security threat over the next decade more than terrorism this coming from the f b i that has been almost singularly devoted to counterterrorism since the nine eleven attacks so there's been a major shift in the conversation and the priorities in the national security community and this book really tells the story of how we got there so it opens with a fairly scary story which i think is always a nice way to open a tale like this which all relate to you  w in the summer of two thousand and seven the c e o s of the major defense contractors in the united states companies like lockheed martin raytheon boeing which i understand is kiley a sponsor of this offense and unintentional i assure you mean i like what i'm about to say were summoned to a meeting at the pentagon in washington they didn't exactly know why they were brought there but when the c e o s of all these companies are looking around seeing each other gathered together in one room they can probably survive it's not good news  they were ushered in to a room called a skiff a secure sensitive compartmentalize information facility if you watch homeland or any spy movies the skiff is the thing that they have to take your cell phone out first in the do the little retinal scan and you go in this room that sort of looks like a soundproof box it's impervious to eavesdropping and surveillance it's a room that you go into when you're about to hear something very classified and very highly sensitive which is what these guys heard they were given a threat briefing by military officials and senior pentagon officials about cyber spies located presumably in china people who were penetrating the networks of computers inside the united states and making off with large amounts of information about classified weapons systems and particularly one called the joint strike fighter or the f thirty five and the f thirty five as sort of our next generation fighter jet the fighter to end all fighters it's going to be used by all of the military services it's the most expensive single weapon system ever produced in the united states and somehow these spies were making off with tons of information about its avionics its defensive systems its weapons but the catch here was that these spies had not penetrated the systems of the military broken into computer databases in the pentagon which are actually well secured they've broken into the computers of these companies represented by the c e o s of the companies who were actually working on this project and other sensitive classified programs for the military it essentially made an end run and instead of trying to attack their target head on had gone around the back and hit the contractors who work for the government and had all of this sensitive information on their computers which the c e o s now discovered were not very well secured  as it was described to me by somebody who's familiar with this meeting a lot of people went into this meeting with dark hair and when they came out it was white they were really really scared by what they had learned and by the find out that this was all happening under their noses and they knew very little about it so the pentagon says to them look you've got a security problem which means we have a security problem and we're going to have to work together to solve this and what that's going to look like is that you are going to take information from us that we know about hackers and foreign spies that we've gleaned from espionage and in return you are going to tell us the threats that you're seeing on your networks and you're going to tell each other about that which is a pretty extraordinary thing to make competitors like this open up to each other about their security and we're going to work together to try and protect these networks and the implicit threat here being that if you don't cooperate with us you may not find yourself receiving billions of dollars in u s military contracts in the future so i like to tell th story because it's sort of a pit in my eyes is our current national approach to defending this vast domain that we call cyberspace companies are essential in this eighty five percent of the networks the physical infrastructure that really comprises ultimately the internet in this country is privately owned the government doesn't own it it doesn't regulate it it's not treated as a utility these are private networks owned by companies like the ones that run that room so if the government wants to protect that cyberspace it has to work with corporations to do it out of that meeting something developed called the defense industrial base initiative or the did as it's called in washington sort of this cone of silence around these companies working hand in glove with government to try and defend cyberspace it started with a few dozen members and today comprises about one hundred companies and this model has since expanded into other portions of the economy today the national security agency which is our biggest intelligence agency that spies on foreign governments and terrorist groups and that you read about in the snowden files is actually sharing information about hackers and threats with large internet service providers in this country maybe the ones that actually you subscribe to and that carry your e mail and route traffic telling them here are the things that we see go filter your networks to to prevent hacking incidents and to prevent threats against our critical infrastructure big technology companies have now partnered up with the n s a in secret arrangements to defend cyberspace google probably one of the best examples several years ago google found that its own systems have been penetrated by chinese hackers and what's the first thing that it did one of the first things of the called the national security agency and said we have a problem  here the day after that breach was announced to the agency and google entered into a still secret partnership whereby google tells the n s a these are the kinds of threats that we're seeing on the network not particular information about customers mind you and they're not giving them back door access but essentially saying here's the bird's eye view that we as one of the biggest technology companies in the world are seeing about threats on these networks and the n s a in turn shares information with google it's a really extraordinary thing i don't think it's ever been the case in the history of the country where intelligence agencies spying agencies are sharing otherwise classified secrets with corporations and asking them to act on that information so defending cyberspace and really conducting office of operations in it has actually become now a cooperative effort between government and the intelligence community and it's partners in the technology industry and that's really what i mean by the military internet complex is this alliance of these two very powerful forces public and private and i'm very consciously drawing an analogy to what president eisenhower warned about the military industrial complex in his farewell address to the nation in one thousand nine hundred sixty one there are a lot of similarities between these two very powerful forces there's a range in really took off sort of at the end of the bush administration and which was sort of remarkable that it took as long as it did because round about two thousand and seven when the energy really heats up for this it's not like people in washington hadn't been warning about threats to our computer networks not long after nine eleven there were people in the white house who started in fact telling reporters like me look it's not just terrorists we have to worry about it's foreign hackers somebody could have done a lot of damage to a computer network rather than flying a plane into a building  t president bush was famously not the most technology technologically inclined president he once said that he looked at the google on occasion to look at photos of his ranch in texas not to pick on president bush president clinton reportedly only sent one e mail the entire time that he was in office the internet was sort of a nascent apparatus at that time but president obama is really when when he takes office when this sort of national kind of military internet complex idea really starts to come to life obama is certainly the first president of the internet generation he used the internet in his campaign to great effect and he also when he was on the trail got some firsthand experience in the nature of this threat so his own e mail systems in the campaign were hacked by spies presumably in china who were trying to read and find out everything they could about who this man was that might become the next president nothe leave any stone unturned the hackers also had john mccain's networks as well so obama was told about this and during the election season he was give about this by the f b i and pretty much on the day that he takes office he is then told that our computer networks in this country are extremely vulnerable to attacks two penetrations much like the one that he experienced the corporations are across the country are experiencing this every single day and that our critical infrastructure as well has been left woefully unprotected it does not take him very house and presidents when they do a speech in the east room which is something probably about twice the size of this room it's for a really big deal of that and a really momentous occasion and i was at this in the room was really packed and he does something extraordinary he gets up he confesses to the fact that his own e mail systems have been hit he talks openly about the fact that spies are stealing information from under the nose of our corporations and he actually says that we know of a foreign organization he won't say which country or who that has penetrated the electric the systems that run the electrical grid in the united states so here's the president of the united states standing in front of everyone is saying we're vulnerable it could happen any day a massive attack on our infrastructure could be devastating or could be right around the corner heretofore most senior officials in government would not even speak on the record about threats like this and now you have the president the united states getting up and saying we are living in an era of these threats notably he said and i quote from the speech or the vast majority of our critical information infrastructure in the united states is owned and operated by the private sector we will collaborate with industry to find technology solutions that ensure our security and promote prosperity he is really outlining the crux of the military internet complex in that speech and then he goes on to describe the internet as quote a strategic national asset which we will protect as such so momentous occasion but also a conflict there talking about the need to join in a co operative effort to control and protect these privately owned networks but it's also a strategic national asset i mean he speaking of it the way we talk about our airspace the way we talk about protecting our borders really elevating this to  a level of homeland defense that is usually the domain of the military he is describing cyberspace effectively as a battlefield which is exactly how the military now talks about it and sees it and how the intelligence agencies view it as well and that is really where the center of gravity is in our national approach to securing cyberspace they have been put in the lead these agencies because they have the most information about who is trying to penetrate the networks the military now called cyberspace the fifth  domain of warfare after land air sea and outer space and interviews trying to achieve supremacy in that supremacy in that domain as essential as it is in the other for it is the only domain however in which no one can claim that they actually that no country could probably go toe to toe with us in a conventional military setting but there are lots of countries right now trying to achieve dominance in cyberspace and we're not the only ones to give you a sense of how kind of fixated the military in the intelligence community is because on achieving dominance in cyberspace you can follow the money which is always a great way to figure out what's important in washington and where the priorities have been put so a little picture of this is a snapshot in two thousand and fourteen for the twenty fourteen budget the u s government plans to spend more than thirteen billion dollars on cyber defense programs this is just the defensive portion right this doesn't really account for the office of side which is all classified and held in the intelligence budget so thirteen billion dollars mostly just to protect the government computers and networks and to share information with private industry through these alliances but that interest from perspective a thirteen billion dollar figure and twenty fourteen the government plans to spend eleven point six billion dollars on direct efforts to combat climate change which obama has called in a speech the global threat of our time so in just one portion of the unclassified budget we're spending thirteen billion dollars on cyber defense eleven point six billion dollars on climate change that's a pretty pretty stark contrast i think there you would think there would be spending perhaps a lot more on climate change if that is perceived as the threat of our time as the president has called it the two thousand and twelve pentagon budget two years ago had the word cyber in it only twelve times the twenty fourteen pentagon budget has toward cyber in it one hundred forty seven times it's kind of become a joke in washington now that if you want to get money for a new military program you should just mention the word cyber and they'll throw money at it charge of cyber security for the pentagon recently gave a speech in which he said it's become sort of ludicrous that he seeing all of these budget requests come across his desk with the word cyber slapped on things that have nothing to do with cyberspace and he joked that if you want to get money for your new battle system in washington just say you're funding money for the cyber tank and somebody or the cyber airplane and somebody will will fund it there's a lot of incentive right now in washington to talk of the the threats of describe them now as not as if they're not real threats but you're hearing more and more officials talk about this openly and i think a big part of that reason is that they want to drum up funding for it and attention and they don't want to be called out for having underestimated or downplayed the risk of a cyber attack on the united states but they're not telling the whole story for all of the things that we describe china or accuse china or russia or even the iranians or the countries of doing to us we are doing to other countries anything that someone is doing to us we can do to them and we are doing it to them we do break into the computer systems of foreign corporations and steal their information we do try to probe the electrical grids of foreign countries we do all these things it's one of the reasons why we know how dangerous it could be if anyone ever did it to us because we know how much we could screw with them there's a story i tell in the book in the first couple chapters that i think really kind of captures how sophisticated we've become at this side of cyber which officials really don't like to talk about and i think illustrates how good the u s has become at waging cyber war and where these what these wars are going to look like in the future in two thousand and seven you'll recall the t syria the violence was spinning out of control the country was on the verge of a total civil war and a sectarian kind of implosion and we sent these tens of thousands of more combat forces to try to get control of the situation well another pillar of that strategy which is really not been discussed much was a cyber warfare component national security agency tapped into the networks of iraq the telecommunications and internet systems and literally the network of that country they were able to intercept and collect every email every text message every phone call that was sent in iraq now why were they doing this they wanted to use the communications and the networks and this is the cyber systems if you like of these insurgent fighters to get inside their network understand them and ultimately break them i write about a guy in the book who was part of this effort his name is bob stasio he was a twenty something young army lieutenant who joined up and deployed to iraq he was a big fan of the h b o show the wire does anybody out here watch the wire ok so remember in the wire there's this great detective you sort of the old veteran attacked of name lester freeman and lesser rather than going out and walking the beat and trying to gather intelligence from a network of people  informants to figure out who the king pins are in the drug network in baltimore he starts studying their phone records he starts trying to piece together who is calling who who are the important guys who are the big fish in the network and by looking at this data actually builds a network of understanding the hierarchy of the of the gov the criminal rings and who are the most important people that they need to go after well bob stasio and his fellows in the them terry and the n s a did exactly that with the insurgency in iraq they monitored their communications to understand who these people were how they were moving where they were planting roadside bombs who was making the suicide bombs who were their couriers and importantly where were these people located  your phone can actually be a pretty sensitive and accurate homing device to give away your location the n s a used those phones in many cases to physically locate where these people were and then to either go capture them or kill them they did some other really ingenious things they sent fake text messages to members of these insurgent networks posing as people they knew and trusted saying effectively meet us on this corner to go plan the operation at this time and when they got there they fell into a trap u s forces were waiting for them the n s a found ways to implant spyware in websites that were frequented and chat rooms that were frequented by jihadi and other members of qaeda in iraq they go there thinking that they're communicating with people about the fight and about the proper ations are planning remotely installing information on their computers so they can read their e mails they were actually able to break into the e mail folders of some of these guys and read messages that they were saving and the draft folders that they were leaving there for other guys to come pick up really ingenious ways of figuring out how they were communicating and trying to evade surveillance the n s a gets inside those networks and effectively sees exactly what these guys are talking about and goes on cap and sends the information to ground forces who then go out and capture or kill them this intelligence cycle this cyber warfare kind of cycle of the spies the digital spies on the ground forces working together is i think the reason why the united states achieved a victory during the surge in iraq a temporary victory to be sure but we quote the violence and essentially brought some stability back to the country and really that operation has never been credited i think for the fundamental role that it played in the surge david petraeus who was the commander of all ground forces in iraq has actually said publicly that this combination of cyber with ground forces is quote a prime reason for the significant progress made by u s troops during the surge of twenty zero seven and twenty zero eight and his words quote directly enabled the removal of four thousand insurgents from the battlefield that's an extraordinary achievement iraqi change the way that the n s a and the intelligence agencies spot and the way the united states will fight wars in the future cyber operations are going to become an indispensable part of conventional military operations in iraq is where this really this model was born in this deal to dominate cyberspace as the fifth domain of warfare i argue in the book that the government in partnership with the corporations with which it's form these alliances may be making great gains to control that space and do amazing things from a military spec to perspective but that it's fundamentally actually making all of us more vulnerable to the very kinds of attacks that we are trying to stop the n s a is a great example of this the n s a is a big big intelligence agency about forty thousand people i'm told billions that it spends every year has two very conflicting missions on the one hand it wants to protect computer networks in the united states it wants to keep the bad guys out on the other hand it wants to go and break into computer networks in the united states and outside the united states and find out what it can about those bad guys well these networks are all comprised of commercial technology that you know it's microsoft and cisco it's a t n t these are things that are used all over the world well the n s a goes to great lengths to try to figure out how to weaken those systems so that they can get into them but when you weaken those systems in the security that's in place the systems is cut dollars we're all using you're putting all of us at risk to a couple of good example of this that i write about in the book some of you may be familiar with something called encryption and corruption is basically just a way of turning your communication maybe your email that you send to your friend into a jumble that only the two of you can decode when you have the key to unlock it and christian is used in internet communications it's used to protect your financial transactions it's a pretty fundamental and very good way of preserving privacy and security on the internet well the n s a a number of years ago got involved in helping to write an encryption algorithm that was later promoted publicly which makes a lot of sense actually a cryptographic agency it knows a lot about making codes and breaking codes and actually played a role in encouraging people to adopt this particular form of encryption that was then put out by a big technology company and sold and use all over the world well what the n s a didn't tell people was that it was inserting a secret flaw into the encryption that it thought only it knew about so that if it ever needed to on encrypt the information that was being used it would have the secret key to do that well the problem with this is that the n s a is not the only smart hackers in the world you insert a flaw like that someone else might find it too and you've gone out and told everyone to use this product but not told them that there's a backdoor in it i use the analogy of imagine that the government came out and said we have helped develop this amazing new door lock everyone should install it on the front door of your house it will keep all the bad guys out your house will be basically you know burglar proof except the government has a secret key to it and the key is not particularly well hidden someone else could find it too we would be outraged if the government were to be doing that and i argue that n s a was essentially doing that too and putting us all at risk another way that th undermined security which they seem to be wanting to promote paradoxically is in collecting information about flaws in commercial software and computer operating systems so there's something called a zero day  zero day is a flaw in a system that has never been discovered before kind of a way into the system that allows you to penetrate fia some flaw in the programming of potentially take control of the computer this is a flaw of a zero day that's never been discovered except for the person who just found it so if you are microsoft and i find a zero day in your operating system you microsoft don't know about it but i know where that hole is and i can exploit it well this is really valuable information if you are in the business of trying to break into computers so if you're a hacker  criminal hacker you look for the zero day flaws and in fact there is a fairly thriving black market online for this kind of information hackers are out there researching systems all and selling this zero day information to the highest bidder w in the united states the single largest purchaser of the zero day flaws is the national security agency largely through a network of defense contractors goes out and acquires this information and keeps it secret keeps it known only to itself largely so that it can build exploits to go penetrate those vulnerabilities to build weapons if necessary to take advantage of that so make some sense if your job is to go out and break into computer systems you want to know how to do that but again your agency supposed to be in the business of defending all of us shouldn't you be telling us when you find these flaws shouldn't they be alerting microsoft when they find a flaw in that system this is something that actually got revealed by the snowden documents we know a lot about this thing thanks to those in part  i argue that this is something that the n s a is also doing that is fundamentally putting us more risk if you're really in the business of defending the united states and defending our strategic national asset shouldn't you be in the business of telling people when you find the way that the bad guys can get in  these approaches to cyber security if the government is taking you know they may allow us to strike at our enemies more effectively but it's leaving the vast majority of internet users and not just in this country really but in the world exposed to the very kinds of attacks that we seem to want to prevent and all of this is really happened with practically no debate you know we talk some about surveillance authorities in spying on americans and collecting phone call in n post snowden mainly but really we haven't given much thought to how it is that we are approaching this problem of cyber security that is you know arguably important i mean i'm not saying that we should you know discount threats in cyberspace but why haven't we really had a debate about this why has this whole vast apparatus that up largely in secret and i'm hoping in some ways that the book kind of help be a corrective to that i think it's time that we start having a much more open conversation about what our own officials are telling us is the most important national security priority of the day we should be talking much more openly about them we are this conjunction of a huge war fighting machine with a growing technology industry  unprecedented i think in our history i hearken back to president eisenhower sixty one speech for a reason and i write by this in the end of the book he said that the military industrial complex of a previous generation was quote new in the american  experience it's really striking when you think about this is a man who had been the supreme allied commander in europe had a lead us through world war two and then becomes the commander in chief of the armed forces and in that speech he's effectively saying this military has morphed into something that i don't recognize because of this convergence with industry with this sort of this private profit motivated interest and i go argue that the same kind of thing is happening when it comes to cyberspace and the internet and that it is changing the way that we all use cyberspace and therefore directly affects our lives cyberspace it is just too vast into pervasive and too important to allow a single entity or a single alliance like this to govern it and dictate the norms of behavior shirtless certainly should not be vested in an intelligence agency that operates largely in secret and quite frankly has been shown to be taking all kinds of liberties with our personal information that we didn't find out about until years after the fact there's no neat way to define cyberspace and i don't try to do that in this book it's not a commons but it's not private we've come to depend upon it like a public utility like our electrical and water systems but it's still mostly a collective of privately owned devices that has not changed but i think cyberspace is undeniably we can all agree a collective which is why i think it's incumbent on everyone who touches it that's all of us to take a stake in how we treat it and to find what president eisenhower i think very wisely call said in his speech was essential agreement on the issues of great moment the wise resolution of which will better shape the future of our nation i think he had it right i think if you were alive today he'd be calling for the exact same type of skepticism and caution and encouraging us to all find some essential agreement on how we're going to control and govern and live in this space so thank you very  much and that's talking for me i would love to have a conversation with all of you answer any questions that you might have about the book about the subjects that i've discussed anything that you're hearing about in washington around the surveyed and when what concerns you about the subject as well  week during the cold war we had something of course called mutually assured destruction so it is something similar developing here in cyberspace where if the chinese wanted bring down our our electrical grid we can do the same to them it seems like i don't know quite how that develops but i'd like to hear your thoughts about yeah yeah it's a great  question and i should say that when it comes to mean talk about cybersecurity people are frequently drawing analogies to the cold war and to the question of strategic weapons nuclear weapons and the question of mutually assured destruction frequently comes up and i think that there  are useful parallels there so take china for instance i mean china china is sort of the becoming like the soviet union was in the nuclear age it's hard becoming like you know the bit of the of the main enemy china has no real interest in trying to knock out a major bank in the united states or cause a financial panic through cyber attacks because there are a largest creditor and anything that they do to sink our economy or disrupt our way of life is going to come back on them and possibly twofold the russians not withstanding putin's sort of you know provocative and kind of dumbfounding actions in ukraine of flate i think know that if they were ever to launch a major attack on a portion of our electrical grid and we were able to attribute that to them that we would see that as a military provocation akin to an act of war and that we would respond in fact the defense department has actually been fairly public of late in trying to spell out the kinds of cyber attacks it would consider to be the equivalent of a conventional attack that would merit a response and what they've said is that anything on a really critical infrastructure systems electrical power utilities health care systems transportation would be the kind of thing that if someone were found to have attacked those they would go to the president and recommend that we respond not just with cyber force but with conventional force as well so i think that to some degree that is there that mutually assured destruction turns the problem is what do you do about rogue actors like iran or north korea what do you do about criminal organizations that might decide that they want to hold hostage a piece of the power grid which has been rumored to happen in at least one country there you find that people are much more likely to take provocative actions and not worry about the consequences if they think they will never be discovered is a big big problem no an attribute simply means knowing where the attack came from so knowing that it was china that wrecked that system or knowing that it was russia that took out that part of the grid if you can't prove who did it it makes it very difficult to respond the n s a has gotten a lot better at attribution we might be able to narrow down the number of countries who would have an interest in attacking a particular system but that makes it really hard to respond so the counterweight to sort of mutually assured destruction is that we don't necessarily always know who are the mutual parties in that exchange and that makes this an extraordinarily difficult security challenge yes or no the genius of the pentagon in using this subject to amplify its budget or to keep the cuts within reason takes an awful lot of filtering when you read literally that daily stories that come out how do you go you know you've spent a lifetime at this how does somebody from the ordinary world how do you read the how do you read between the lines to figure out what part of this is meant to simply induce fear get us to support bigger budgets or minimize the cups and where's the real fear yeah yeah i think that's a great question and a lot of it is  is a somewhat strategic and cynical calculation on the part of officials in washington to scare people i mean i think you can read it this way officials genuinely do want to scare you  because they want you to take it seriously you know nine eleven sort of had a formative kind of it was a formative experience prickly for the intelligence community they never want to be in the position again of saying i'm sorry we didn't warn you i'm sorry we didn't tell you about you know all the bad things hiding under the bed and now it's sort of you know in the mode of like we're going to tell you about what all these threats might be i think you can sort of draw kind of a spectrum though to know when somebody is maybe exaggerating the threat or harping too much on remote possibilities so at one of the special things that do happen every day credit card theft identity theft spies breaking into corporations and stealing trade secrets and giving it back to their home countries those are things that are real that are happening every day as devastating as an attack on the power grid would be it's a fairly remote possibility i think so i think one way to look at this is if you hear officials coming out and talking about things like cyber crime and cyber espionage you could probably be pretty sure on the level when describing a real threat if all they do is come out and say the power grid the power grid the power grid they're trying to scare you it's not to say that there couldn't be a devastating attack on the power grid but that should not be the thing that we're sort of singularly worried about right now and  at's it it's an easy one to kind of gets drawn out each time to sort of the drama that said it could happen it absolutely could happen and if it did i think we would all if we if we found that our officials hadn't warned us about that we would do heads would roll right or maybe they were actually in washington has don't really roll anymore there's not much accountability there but we would want to know why didn't you tell us and why didn't you warn us sooner other questions  talk more about your background related to all of this sure so i started writing about technology in government basically around two thousand and one early two thousand and one i got hired to write about contractors actually so i was writing for a magazine that covered sort of government as you know government as a business we actually called it which was a very interesting conceit so i was sort of without knowing it writing about the military industrial complex largely through i t companies  after the nine eleven attacks those companies kind of rushed into the space and said we can build computer systems that can collect information analyze information do surveillance help you connect the dots about the next attack and make sure there's not another nine eleven so those tech companies which are actually calling them tech companies almost misleading these were companies like raytheon and boeing and lockheed martin who have just big technology divisions were the ones who started trying to build up this new intelligence apparatus for the government which kind of became my entree into writing about national security writ large and it really wasn't long after nine eleven that you started hearing people warn about this kind of stuff talking about the vulnerabilities of computer networks cyber kind of became you know his big thing after nine eleven but it took several years for people in washington to focus on that i mean you we shouldn't understate the degree to which and then the war in iraq really consumed the attention of the national security community and now there's been space that can kind of accommodate this this other big worry no actually it's a great question and not at all i was in theater and did scare comedy when i was in college  which comes in handy in washington for getting by i wanted to write i was very interested in writing it was always fascinated by government and politics i was always also just loves movies i mean i love that he loves you know all the tom clancy movies war so i suppose i had some sort of thought it was very intriguing i came to washington like a lot of young people because i was just interested in the city and just sort of fell into journalism and then realized there was actually a great way to to write creatively but about real things and true stories and that's how i got into it so no tech background whatsoever given the role that n s a has in protecting me i have mixed reaction to this with which they are pursuing that role and there's a part of me that goes they're out there they're out there for me and it's easy to pick on some places where they've crossed the line that outrages you know a boy scout sense of ethics but at the end of the day i don't care very much about that boy scout sense of ethics because i'm not sure what from a priest script of since we as a country should do independent of our inability of for the people in this room to cause that to be but just you know what would what would you want us to be doing in terms of setting rules for and saying yeah i think you sort of point to the fundamental tension in all of this debate around surveillance and post nine eleven that you know there are there is it is an agency and there are many agencies that are devoted to protecting us and that want bad things not to happen and at the same time in their pursuit of doing that they know they can threaten your privacy your liberty your sense of ethics and i think i've tried to illuminate some number of different reform proposals for the n s a one of which and it was radical was to separate essentially the defensive in the office of missions so to take n s a and essentially kind of split it into two organizations where one would be responsible for protecting information secrets and networks and the other would be responsible for trying to exploit them would have fundamentally changed the d n a of the place the president did not adopt that it would've been a radical shift i'm not so sure that was a good decision you know look the government is full of agencies that are working at cross purposes all the time in the big united states government i think can accommodate that kind of bureaucratic headbutting and that cross purpose i'm not sure that having this office of in defense of mission under the control of one person in the of that director is the right idea i think that's something that people can look a lot more closely at is same should we be giving some of these other responsibilities to the different agencies that don't have you know a sort of conflict of interest really and it's funny i mean you talk to people even in the n s a who work on the defensive side of it and they will tell you that their work grow at the office their guys are doing and vice versa i think that one thing we could look at too and ask for more debate on is how the military should be behaving here so i argue that a lot of this computer off fence that's going on should actually not be in the hands of the n s a or at least some of the great influence of the n s a but should be actually situated in the military and we're kind of moving in that direction or something a little too early or called u s cyber command which is the military is set up with these things called combatant commands for their central command which is actually what's running the war in iraq and afghanistan their southern command there's northern command that does homeland defense cyber command is this new group that's being set up to do cyber operations well n s a effectively is in control of it this intelligence agency where all of the brainpower exists where all of the equipment is role of the expertise is effectively running the show and in fact the n s a director actually serves a separate position at the same time as the head of cyber command so you see how it's sort of like the intelligence agency kind of creeping over the military you could separate those two you could have the military take on a much  more definitive role in that and why would that be good it's not that the military is entirely transparent but generally speaking the armed forces are more accountable publicly than the intelligence agencies are they're governed by a different set of the law they are they are required to report a lot more than the intelligence agencies are it's a bigger bureaucracy that congress has managed to exert more oversight authority of it is weird as it sounds i guess i'm actually more comfortable giving these operations over to the military and intelligence agencies so i mean those are some places where there are there's real policy debate to be had and i think that you know we should all be a part of that and you know talk to your member of congress or however you know you feel that most empowered i'm not entirely hopeful washington right now can't solve problems and they prefer to punt on them but i think those are there are some real ways that we could make this more rational and i think all be better off  other questions directly connected via the internet the way that the power grid is certainly got i hope they aren't so there are the military actually does a pretty good job of taking its most sensitive information one of these systems that was being used by central command and a virus showed up on it which was very strange because how did it get there these were not computers that were connected to the internet and the theory is that it was probably on a thumb drive  b that maybe was left somewhere and someone picked it up and then when he went to work one day in iraq or afghanistan plug it into a computer and bam it's there so there are there are ways into a system of the stocks that virus that attacked the iranian  nuclear facilities that we built with the israelis that was an air gap system precisely how it got in there we're not entirely sure probably we had someone either wittingly or unwittingly act as a courier and get it in so i guess if you were gaming that out if you could get access to the facility even if it wasn't connected sure but actually launching a weapon i don't i don't know now a weapon system like you know the joint strike fighter which i alluded to earlier which is you know a network only they're immune to prosecution for crimes and we have to remember is that you know all of what i'm describing what they're doing is actually legal i mean the law allows for this i mean they are they're governed by the n s a s operations to the extent that they are largely foreign into foreign targets does this stuff is legal i mean what the what they're doing now whether or not a company would ever try to sue the n s a and say hang on a second you are inserting flaws into my product you know i think a really novel lawsuit would actually be if somebody were to try and say you are tampering with my intellectual property and altering it in key ways that materially affect my business so i'm going to launch a civil lawsuit against you i'm not sure how many of these companies particularly the ones that are in this military internet complex would really want to try and challenge the n s a and piss them off but but you know i don't think that they know they're not immune i think what they are is insulated and for to a large degree that's because we just simply don't know about a lot of what they're doing now there's a real question about some of the things that snowden revealed of whether they are if not illegal whether they might need to be  so i mean for instance the collection of americans phone records was probably the most controversial program that that snowden exposed the supreme court has indicated that it wants to hear a case that would ask the question of whether things like phone records should be subjected to the fourth amendment and therefore the government have to have a warrant to access them currently they're not you don't have to have a warrant to the government the subpoena which is a or threshold so i think that you're going to see some reconsideration of the legal standards and maybe a redrawing  lines but not that much i mean you know there was a surveillance bill that was winding its way through congress this week that would have put some restraints on n s a surveillance that would have potentially had an implications for their cyber programs as well  asked the question of whether or not the n s a collects mass amounts of data on americans and he said no which is not true and he later explained that he was trying to give what was that the most truthful and truthful answer  he got himself into a little bit of a pickle there as well but but yeah i mean but your point there are people who argued that jim clapper the director of national intelligence gave false testimony before congress and said that was a serious accusation and  you know i think there are people who still feel that he did and i think he lost a lot of credibility particularly the eyes of congress for that if you have one more if there's a way if there's one more if not than i will ok one more and then we'll i would argue that the greatest threat to the military industrial complex is the people of the united states and you know when i hear you talking about what the united states did in iraq you know by collecting everybody's records and  getting everybody's number well they're doing that to us so does it scare you that they might use this on people if things got out of hand and democracy started to raise its ugly head in this country and is there a way  out it does it does worry me in the first book i wrote the watchers was largely about this question of ok so we've built this capability to collect all of this information and it's a kind of a foregone conclusion that the government's going to collect large amounts of information about other people overseas so what should the constraints be these are concerns i should say that are shared by a lot of people in the intelligence community as well including whistleblowers frankly who've come forward and not just whistleblowers brothers to who remember a time not so long ago in the sixty's and seventy's when our at the f b i and our intelligence agencies were spying on war protesters and monitoring and blackmailing martin luther king and spying on supreme court justices and doing these just know horrible things running roughshod over people's civil liberties the generation in the intelligence community came after that was reared in school with this idea that you do not spy on americans we don't collect americans communications we don't monitor people's political speech we don't look at the things that people are doing that is the activities that are covered by the first amendment these were stark lines that were drawn in for decades they say in place nine eleven  lines we all know that story now and i think that what we're facing today is a situation where we have to be constantly constantly checking the rules that are in place for how this data gets used the fact that it's going to be collected that is that is a foregone conclusion we're past that at this point we should be constantly looking for in this is a lot harder because it requires more inspection where we draw the lines on how that information is used and what the authorities are when it comes to using our personal information i hope that people in the intelligence community are still asked concerned about that as they were a generation before but you know every step that we sort of take after nine eleven that gets more into that old territory it starts to feel more comfortable and familiar and i feel that we're sort of in a in a in a squishy middle ground right now and i worry a lot about that and that's why i keep writing on the subject so thank you very much for coming out