Tech Transforms

Sandy Carter, Unstoppable Domains SVP and Channel Chief again joins Carolyn and Mark, this time to discuss the importance of diversity in technology. She gives us an exciting inside look at her event, Unstoppable Women of Web3. Sandy walks the walk when it comes to getting women and girls involved in tech. Follow her on social media to get the latest updates!

Episode Table of Contents

• [00:55] The Vision for Unstoppable Women
• [05:42] Unstoppable Women Are Learning About IOT and Machines
• [11:09] A Dream to Start the Groundswell With Unstoppable Women

Episode Links and Resources

• Sandy Carter
• Unstoppable Domains
• Unstoppable Women of Web3
• Web3

The Vision for Unstoppable Women

Carolyn: So we have Sandy Carter back. The last time we talked to her, she gave me the 101 on Web3 and FTs, crypto. My head's still swimming a little bit but I'm actually really excited about it. She did a great job and one of the key things that Sandy talked about was for Web3 to be the vision that she has for it and to be really strong, it needs diversity.

Today, we're back with Sandy Carter, renowned technologist, bestselling author, and current senior VP at Unstoppable Domains. She's one of the leading pioneers in the digital business and also a former Fortune 25 business executive. She is a leader focused on helping companies with innovation and digital transformation through culture and technology like AI and the internet of things.

So let's jump into it. As an advocate for diversity and women in technology and your involvement within girls in tech, what advice would you give to women pursuing roles in technology today?

Sandy: There's a couple of things. Technology is moving at such a pace that I think you need to develop this learn and be curious notion. Probably, what you're studying today in school or what you're doing today at your job will change significantly.

Top Jobs Today for Unstoppable Women

Sandy: I was on the diversity group for the World Economic Forum and one of the interesting pieces of data that they shared with us was that the top jobs today in technology didn't exist five years ago. So unless you're going to be stuck in an old legacy role which will decline over time, you've got to be continuously learning and curious about what's coming so that you're ready to go in a lot of those new areas and those new fields.

Carolyn: How do we stay current? Getting a degree is a good foundation and things are changing so often. What are some conferences or certifications that you would recommend for women in tech?

Sandy: There is a lot of really good material out there. There's so many classes and things that you can take just to refresh yourself, like YouTube.

One of the things I do is to dedicate time every week. I mark an hour in my calendar every week. It probably could be more, but at least, an hour every week to check out something that I don't know about. Maybe it's quantum computing or spatial computing or a new thing that's happening in Web3. I'm always constantly on that front edge.

I still remember when I was with IBM and I got selected to lead a lot of our artificial intelligence work. People were like, "Wow, you're so lucky to get to do artificial intelligence." I would say, "No, I'm not lucky. I've been studying this. I took two classes at MIT. I've been playing around with this. I was learning and being curious about it so that when this opportunity came, I was ready."

Where We Are Today With Technology

Sandy: So if you're just doing your day job today, I don't think it's enough. In fact, I have two daughters and they love Alice in Wonderland. One of the parts I love so much about that book is, Alice said, "I had to run twice as fast just to stay in place."

And that's where we are today with technology. I think you can't just focus on your current role. You always had to be learning about what that next role might be or might hold.

Mark: You got your degree in computer science at Duke University. It's not surprising to me that you're the innovator and entrepreneur that you are in this arena. But how do we get women involved in technology at a younger age? How do we get them started with Math and Science so that by the time that they get to college or they get into the professional world, they're already teed up for this?

Sandy: I think there's a couple of ways that we do that. One, I love what Girls in Tech are doing and truth in advertising. I am Chairman of the board for Girls in Tech. One of the things we do at Girls in Tech is host workshops and hackathons for the younger generation but we make it relevant to what they like. For example, a lot of young girls like fashion. So, we did a fashion tech hackathon.

They get to create a ring with an IoT sensor in it and if you press the sensor, it would call for their parents. It was beautiful. The ring was beautiful and so they were all really interested in it.

Unstoppable Women Are Learning About IoT and Machines

Sandy: As they were learning about the ring, they were learning about IoT and machine learning. We put it in an application that was right for them. The other thing we did at AWS is teaching reinforcement learning which is even a higher level of artificial intelligence. We created a race car, it was called Deep Racer. It has IoT sensors around it and it races around a racetrack. You know a lot of young girls like to race cars. It's fun. We had kids all over the world racing these cars.

What they were really doing is learning again, IoT technology, cloud technology, and AI. I think it's about us putting it into their language. I’d also say when I lived in New York. We fought really hard to get computer science to be mandatory in high school. I also think there are policy issues for states. I just saw the governor of Colorado when we had an event in EatDenver. He says he wanted his state to be the number one digital state. Miami wants to be the city of crypto. In order to do that, you have to train your kids, the next generation at earlier ages, as well.

Mark: How do we do this at scale? How do we get the groundswell really moving across the country to do this? Maybe we can do it in pockets but I think we've really got to generate a groundswell.

Sandy: That brings me to an announcement that we are going to be unleashing on March 8th which is International Women's Day. Obviously, a lot of women are mothers and aunts. They have an impact on the next generation and themselves as well.

The Next Generation of Technology

Sandy: As we started looking at Web3 which is the next generation of technology, we started noticing that there is already a discrepancy in a lot of the numbers and a lot of what's happening. For example, only 15% of bitcoin holders today are women.

There are about 150 top crypto companies, only five are women. Men invest in this Web3 space so much more prevalently than others. Only 9% of women say they even understand Web3. So we're going to announce on March 8th this thing called Unstoppable Women of Web3. The whole mission is going to be around making this Web3 accessible for all. We want to help them with the first step.

We're going to give away 10 million dollars of free domains as the entry point for Web3, and we're going to be action-oriented. We've got education that's launching, networking that's launching. We have real-life events and virtual events that are launching to help women support women in this mission.

Now part of this, we're going to do a one-hour YouTube live session on March 8th. We're also going to host a 24-hour Twitter space with a different guest speaker sometimes every half an hour. So it's a big ordeal. One of the things I'm really excited about, for example, Nyla Hayes. I don't know if you guys know her. She's 13-years-old. She is a young woman who started creating an NFT collection of her art. They're called the Long Neck Ladies. She's made millions and millions of dollars.

How Unstoppable Women Accomplish Things at a Young Age

Sandy: She is Times' first artist in residence and she's going to do one of those Twitter spaces on how she accomplished this when she was 12. Now she's 13. How did she accomplish this at a young age? We're going to have women talk about what blockchain is. What is decentralization and what is digital identity? All the elements of Web3 and why we think the future of Web3 is female-focused. There's tons there.

We're hoping, our mission and our goal is to create that groundswell. That will begin on March 8th with all this education. We've partnered with over 57 different companies, big companies, small companies, Web3 companies from Google and Deloitte to folks like blockchain.com and BlockFi. Some of them work really well, and of course, Unstoppable Domains, to make this happen. I feel that if we all come together to be action-oriented, to have the 8th be that first push of the groundswell, this will continue.

We're also going to publish a top 100 inspirational women of Web3 and we're going to do a speakers bureau of women. The reason I want to do that is, I was announced as keynoting at South by Southwest on what Web3 is. You would not believe the number of people coming out of the woodwork now who want me to come speak because they want diversity. They're like, "How do we find other women doing this?" Well, we're going to create a speakers bureau so more women can be front and center.

A Dream to Start the Groundswell With Unstoppable Women

Sandy: So sorry that was a long-winded answer but I am so excited about what we're doing. My dream is that we do start that groundswell with all of these unstoppable women that will just expand and expand and expand.

Mark: It seems to me that at many universities and colleges throughout the United States, the number of women that are enrolled in schools might be over 50% across the board. But I really would like to see a lot of that moving to data science, computer science, those types of schools. So I appreciate the insight on it.

Carolyn: Honestly, I'm having chills as Sandy's talking because we talk about the need for diversity. We talk about the need to get more women in tech and girls in tech and we know the stats. We've got somebody who's walking the walk. I mean you're doing it. So I am so excited to get this out to our listeners.

Thank you for sharing this with us. We will get these links out to all of these different things that you mentioned so people can go. Do you want to give us your top three things to do right now for everyone, not just women? Top three that we can do to be involved.

Sandy: First, I would just say number one is to have that desire to learn. It is hard but make sure that you attend one of these Twitter spaces. They're half an hour, an hour investment of time and you'll just get excited. You can ask questions and just learn.

Discord and Telegram

Sandy: Twitter spaces work a little differently, it's a link where you can set a reminder on Twitter. It’s a little different but I'll share those with you. Then for the YouTube live, we'll do a YouTube live that's one hour on what is Web3. Just like the last session that we did on what is Web3, that's a whole hour on all the details with visuals. I'm a very visual learner and so that will be a visual. We'll get you that link right away so that you can help people do that.

The second one is, I would say just interact. Both of you are asking questions today and I think that interaction is how you learn. It's also how you figure out who some of your trusted advisors are so when you need to ask a question, you can do that. There are also two tools that most Web3 people use, Discord and Telegram. If you're not on those, you could go explore them.

Then the third thing, I think you have to experience it. You have to play with it. If it's Web3, you can't learn it in a book and then talk about it credibly. You've got to do it. You're going to run into challenges like I did. I ran into challenges too and I consider myself pretty techy. Setting up your domain, linking it to a wallet, figuring out how to buy Eth or bitcoin is a daunting experience. But once you go through it, you'll get hooked on it and what we call it as going down the rabbit hole. Then you want more and more.

How Unstoppable Women Develop Their SkillsSandy: That would be my three things: learn, interact, and play. I think that's really how you develop a set of skills that are hands-on.

Carolyn: I'll give a fourth. Again, follow Sandy Carter on LinkedIn. I know that you share your word of the day and you share insights that you have. That's a really easy way for our listeners to get involved and to learn. Thank you so much for your time today, Sandy. I really appreciate you taking time out of your busy schedule for us.

Sandy: Thank you for the honor of being on your podcast as well. I really appreciate it. Thank you, both, for helping me to evangelize what's happening on March 8th. I really do want it to be all of us working together to push this agenda forward.

Carolyn: Absolutely. Thanks to our listeners for joining us today. Please like and share this episode, this is an important one. We will talk to you next week on Tech Transforms sponsored by Dynatrace.

Sandy Carter, SVP and Channel Chief at Unstoppable Domains and former Vice President at Amazon Web Services talks about the groundbreaking work she is doing with Web3. Listen in to get more information on Web3 capabilities and hear about the chaotic creation that Unstoppable Domains is taking on.

Episode Table of Contents

• [00:53] A Leading Pioneer in Web3 and Digital Transformation
• [08:280] A Hot Topic Element of Web3
• [15:12] Women Are Getting Involved With Web3
• [23:04] What Web3 Means for the Government

Episode Links and Resources

• Sandy Carter
• Unstoppable Domains
• Unstoppable Women of Web3
• Uber

A Leading Pioneer in Web3 and Digital Transformation

Carolyn: Today, we're talking to Sandy Carter, and I'm excited to have her all to myself. Sandy is a renowned technologist, bestselling author, and current senior VP at Unstoppable Domains. She is one of the leading pioneers in the digital business, and a former Fortune 25 business executive. She’s a leader focused on helping companies with innovative and digital transformation through culture and technology, like AI and Internet of Things.

Sandy, you have an incredible background. You've been with IBM, recently with Amazon Web Services, and now you're working with Unstoppable Domains. I would love for you to tell us your story. What is the journey that you've had with your career? How did you get to Unstoppable Domains, and what is it?

Sandy: Well, it's really interesting. You'll notice in all of my companies, IBM, and then you missed a startup. I had a startup in between and then AWS, and then now a startup with Unstoppable. All of those companies were on the leading or bleeding edge of technology. At the time I was at IBM, we were bleeding edge for social media and business, which was that Web 2.0 era. I then went to form my own company and I was doing artificial intelligence. In fact, I thought it was so cool.

I was doing like a Myers-Brigg on companies to determine their culture so that we can match them with the right innovation tactic. That way, they didn't go and try something that didn't fit their culture, because culture eats strategy for lunch.Developing the Right Processes for Web3

Sandy: Then I moved on to Amazon, and Amazon was all about the cloud, another tech transformation that was going on. I learned so much from each of these companies. Leadership principles from Amazon and how to develop the right processes and mechanisms from IBM. From my startup, how to be really scrappy and to do things that 80/20 rule; not perfect, but good. Good for the customer, valuable for the customer, but not necessarily reaching that perfection mark.

When Web3 started out, I was really interested in it. I’ve done some blockchain at Amazon Web Services and I was fascinated with the new technology. So I started doing all of these side projects on NFT, setting up my wallet, doing all this stuff on the side. It turned out that a company approached me called Unstoppable Domains. I was fascinated by what they were doing in the marketplace. They’re focused on digital identity and how, in the Web3 world, you take your identity with you. It's not linked with a particular application.

I thought that was fascinating given my history. Looking at Web3, I was like, why would I keep doing these side projects when I could do this full time? So, I came on with Unstoppable. The founding team is great, the portfolio of products is really fascinating to me, and the partners are all the who's who of Web3. So, here I am and I'm having a blast.

Web3 Centralization and Decentralization

Carolyn: You talked about several things that are a little baffling to me. First of all, Web3. I'm embarrassed to say that I really haven’t heard that term until I knew that you were a guest. I started looking at some stuff that you've talked about, and I was like, okay, what is this? So, I read some articles over the weekend and I'm still not sure exactly what it is. It's decentralization and centralization and then decentralization.

Sandy: I would define Web3 in one word, and that would be an ownership model. When I say an ownership model, if you think about it, let's take Uber for example. I was an early user of Uber. I’ve told all my friends about it because I was living in Silicon Valley. I was Ubering all over when Uber was just in San Francisco and Silicon Valley. So, I was attracting new users and I got value because my friends thought I gave them something of value. But now, Uber is worth about $50 billion and I didn't get any of that financial benefit.

I was providing and attracting users for Uber, but the extraction of value came from Uber itself. Web3 turns that on its head. You’re now not a user of the application, you are a member. You have ownership rights in what you're doing. Web3 really introduces that real ownership model to the internet that combines economics, art, game theory, and technology in a very interesting way.The Five Essential Elements of Web3

Sandy: Web3, essentially Web3 means that something is built on what I would call five essential elements. One, it is decentralized. You said decentralization, or at least partially decentralized, meaning there's no one company who owns all the servers, all the infrastructure. It is decentralized or at least partially decentralized.

Two, there has to be a digital identity that travels with you. Think about today. You go to sign into LinkedIn, you use one ID. Then you go over to Instagram, you're using a different ID. When you go into TikTok, you're using a different ID. But I can now take my digital identity, which I've built with Unstoppable Domains, sandy.crypto.

I can take that identity and I can enter a metaverse. With that same identity, I can enter DeFi, decentralized finance with Cook Financial. And with that same identity, I can enter a game like Decentraland or Sandbox. That same identity travels with me, it's all built on the blockchain. That's the third assumption for Web3; decentralized digital identity built on the blockchain. It's trustless, meaning that there is no in-between.

I sign a smart contract directly with the person I am purchasing. There's not a bank or a lawyer or anything in between. It financially benefits the members because remember, we have members now. So if I buy an NFT, like a Lazy Lion, I now own that Lazy Lion. I can now create a t-shirt with that Lazy Lion, and that t-shirt could enable me, for example, to create my own business. It's really all about that ownership model.

A Hot Topic Element of Web3

Carolyn: This reminds me of something that I worked on years ago. I worked for Novell. I'm sure that you know who that company is, even though it really doesn't exist anymore. I was working with developers on a digital identity or a digital wallet, and it didn't go anywhere. It’s a hot topic and it was innovative and cutting edge. It sounds like, is it the blockchain that has enabled it to actually be secure and be something now?

Sandy: Blockchain is one of the underpinning technologies and blockchain does allow that transparency and that interoperability. It does help with that ownership too. Make it immutable. It can't be changed for sure. So, it is an element in Web3, just like we talked about those five elements. It has to be decentralized or at least partially decentralized. You have a transportable digital identity. It's built on blockchain, it is trustless and it financially benefits users. Blockchain is definitely a part of the equation.

Carolyn: If we were in a Web3 world and Uber's just coming online like it did when you were an evangelist for Uber, you evangelizing Uber to your friends and would give you shares? You would have some kind of ownership in Uber and you would reap the benefits of this $50 billion company?

Sandy: I could, yes, absolutely. There is this concept of fractional ownership, and fractional ownership means that whether it is a piece of art or a company or a piece of real estate, you can have a fractionalized ownership of that. For example, NFTs allow for fractional ownership of any digital native asset.

Things That Happen in Web3

Sandy: People can own a portion of something that otherwise they might not have been able to afford. It extends beyond art, like a Lazy Lion or a Bored Ape. Of course, the use of NFTs and blockchain enable you to prove ownership, and you do that today. I have a friend of mine who collects Chanel purses. Of course, if you're going to spend that much money on a purse you want it verified.

My mom used to be a Boston Red Sox fan. I guess she still is a Boston Red Sox fan and she collects Ted Williams. I don’t even know who he is, but he's an old-time baseball player. She owns that baseball card and she had it authenticated, verified that it's real. It's the same thing that happens in Web3 with that verification.

Carolyn: Does the creator of the asset or the company have to say, "Yes, I want to buy into this Web3 idea and have this fractionalized ownership"?

Sandy: Yes. If you're a company like Parcel, Parcel is doing Web3 real estate. Or if you look at some NFTs, not all NFTs that are art are fractional ownership. Some of them, I buy and it's outright mine. I own it, I can do whatever I want to with it. Some I buy into it and the artist gets a fractional piece of that forever. If I go and produce a t-shirt and I sell the t-shirt for $10, then maybe the artist gets $1. I get $9 in perpetuity because I'm now a part-owner and they're the creator of it.

When Will We Be in the Web3 World

Sandy: This is why a lot of people in music love it. A lot of them today, when they sign on to agents and all these companies, the amount they end up getting is so small. In fact, this weekend I was listening to an artist. They said, "Look, based on the digitalization of music today, after everybody takes their cut my cut is pennies. So I have to do t-shirts, concerts, and ads, because I don't make enough money on my music, which I really should be making the money on."

Carolyn: When will we be in this Web3 world, or are we already dipping our toes?

Sandy: We're at the very early stages. I would say, we are super early. The tech right now can be very expensive. Think about the gas fees that you have to pay sometimes. A gas fee is not like the gas for your car. The gas fee that you're paying is for the permission to use those decentralized servers. In a centralized world, a company's paying for that. They're going to get the benefit of that too. They are going to get the financial benefit of it.

In this new Web3 world, which is decentralized, that gas fee is what you're paying to use a part of that decentralized network. That can be expensive today, and it may not be completely ready. If you think about it, blockchain, there's thousands of articles. Is blockchain scalable yet? Not quite yet, but it will be. I would say that we're in the dial-up phase of Web3. What's that movie? There's a movie, and you can hear the AOL sound of the modem.

Carolyn: Oh, You've Got Mail?

The Chaotic Creation of Web3

Sandy: You've Got Mail, that's right. So think about that sound right now, and you think about Web3, we're in that early stage of it. Or as someone said this weekend at EatDenver, "We're baking a pie and the pie's in the oven. You don't want to take the pie out too early because you can't really consume it. It's not done." We're in that early stage of Web3, and that's why I wanted to jump in early.

I like that early stage, I like that chaotic creation for a couple of reasons, and  I just love the tech. I just consume and dive into the tech. But also, because I believe that at the start of this new era of Web3, I want the new era to be diverse. I believe that's what's going to make it more innovative. If we look at the past Web1, Web2, it has not been a diverse group of people shaping the future of it.

Carolyn: Meaning there's a few big companies that own all the servers and the services?

Sandy: Maybe a lot of men that shape the company. Maybe white men that shape it, not a diverse group of people who are inputting all of their ideas. I think that diversity; diversity of thought, of any kind, is important, having people from multiple countries. Just look at Web3. It is being created in Africa. I was just on the phone this morning with an African company that's doing phenomenal things. They're going to impact what we're doing here.

How Women Are Getting Involved With Web3

Sandy: Women are getting involved; not at a fast enough rate, but we're going to try to fix that. I was just speaking with Eman who started the Ancient Warriors NFT collection. He focuses on black and brown artists. Now we've got everybody coming in early into the pot. I can feel that pot being mixed up and stirred by so many diverse ideas. The diversity of thought ideas is only going to make it more innovative and more powerful.

Carolyn: As you're talking, I'm thinking about baking a cake. I’m thinking, if you only put flour in the cake, you don't have a cake and that's the same with these innovations. Without the diversity, you just don't get the cake. So, I love that. I want to ask about the metaverse.

We got some advertisements, some creepy ones, to be honest, with the Super Bowl around the metaverse. When I think of the metaverse, I think about things like Ready Player One where I'm an avatar. There was a movie with Bruce Willis, I think it's called Surrogate. Have you seen that?

Sandy: I have.

Carolyn: They physically never leave their house. They have a replica of them that they control from a console. These are the kind of things I think about with metaverse. Then last week, I was sick. By the end of the week, I wasn't sick enough not to take a meeting, but I was still sick enough that I looked like I'd been chewed on by wolves.

A Metaverse Meeting

Carolyn: And so, I didn't want to get on video but I thought, "You know what would be super awesome? It’s if I could do a metaverse meeting and I could go with the perfect outfit and the perfect hair and show up as my perfect self." These are the things that spin around in my head with the metaverse. I would love to hear what the metaverse really is from you.

Sandy: It's simply an online digital environment and you are inhabiting that new land as an avatar. You access it through virtual reality or augmented reality. A lot of gamers are already doing this today, if you think about the metaverse. But I like to think about the metaverse in terms of layers. Maybe it's from my tech background. So I see Web3, that decentralized access, that ownership model, being the base or the foundation of a metaverse. That is then dependent on the blockchain for trust, for that secure value exchange, which I then think will be governed by DAOs.

We haven't talked about DAOs yet, but DAOs are, again, another voting experience done with tokens. It’s a dynamic governance model of which the metaverse sets. The metaverse is really that digital experience and the worlds, but it requires a DAO structure, blockchain for trust and Web3. The interesting thing is, when we talk about the metaverse and we talk about Web3, I think we're talking about the same direction because the metaverse requires Web3 to really deliver on its promises in the marketplace today.

Carolyn: Is Unstoppable Domains building that foundation then, for the metaverse with Web3?

Unstoppable Domains

Sandy: So Unstoppable Domains is building your digital identity, which is represented as your domain. Think about it as the domain with super powers, unlike the domain of a Web2 world. When I say super powers, I mean it's user-owned and controlled, so there's no renewal fees. You own it. It's back to that ownership. It is decentralized because it's created on that blockchain.

Any third party can read it and resolve that name without anybody's permission, not even ours. Others can build tools and applications on it, like metaverses, as they move forward. For example, the Atlantis metaverse is built on top of our digital identity. Cook Finance, that's DeFi, is built on top of it. Parcel, which is doing real estate in the 3D world, is built on top of it.

What that enables you to do is to travel with that digital identity. For me, that's really cool because if you think about your digital identity, that travels with you. It travels with you to any application. It's your wallet, it's your healthcare data, it's your education records, it's your finance. It is basically you.

Carolyn: It sounds scary. If somebody hacked that, then they have access to me.

Sandy: Think about how many people hack you today. It already happened today. So let's think about the hack as one thing. Today, people are selling your information to companies so that they can market to you. People sell, oh, Carolyn just bought a house. I'm going to sell that data to someone so that they can market to her differently because she just bought a house. Carolyn just graduated from college. Because I know that, I'm going to market to you differently.

Protect People’s Privacy

Sandy: Today, that information is not even considered a hack. That's considered their right to share that information, it's not considered your right to that information. It’s their right to that information. It is the whole reason why Europe set up GDPR; to protect people's privacy. If you think about it, in the future, digital identity is going to be much more important than it is today. It will be used in all sorts of apps that we can't even imagine today.

I believe that it's extremely important that ownership and those rights sit in the hands of you, not in the hands of a government or a corporation. That would be more scary, if another person had all of my information. Now, in order to achieve this vision I think there's got to be a lot of things that happen. We've got to have a way to protect it. You pointed it out right away, you need to have that be secure.

We've got to make it easier. There's a lot of things right now that we need to work on in the Web3 world. One of those is ease of use and UI. Though I consider myself pretty techy, it's hard for me. I could not imagine my parents trying it right now. It's too hard. I do believe if you are a designer sitting out there or you do UX, it's going to become more and more important due to the rate of adoption that we get that ease of use correctly and we do it very fast.

What Web3 Means for the Government

Sandy: Today, it's too hard. I think that if digital identity is going to be what it is, we have to make it easier for everybody to participate in it.

Carolyn: What does Web3 and everything we've been talking about mean for the government?

Sandy: It's really interesting because governments are reacting in different ways to this. If you think about it, some governments like El Salvador, they've gone all in. They now use bitcoin and crypto....

American culture and history is meant to be shared, according to senior application developer at the National Museum of African American History and Culture, and Army veteran Rayvn Manuel. She talks with Carolyn and Mark about some of her goals in her work at the Smithsonian and the importance of sharing our stories and understanding our history.

Episode Table of Contents

• [00:36] On the Record With an Army Veteran
• [09:18] A Change of Name on the Record
• [16:35] Growing up in a Lot of Racism

Episode Links and Resources

• Rayvn Manuel
• NMAAHC
• Renaissance Fair

On the Record With an Army Veteran

Carolyn: We had the pleasure of speaking with Rayvn Manuel in November of last year. She’s a senior application developer at the National Museum of African American History and Culture and an army veteran.

Following our regular recorded episode, Rayvn spoke to us about her opinion on some topics surrounding our history and culture in America. I went to the museum. When I got there, I felt a little bit like an intruder. It’s like I had no right to be there. Can you talk about that? Have you talked to other people who have felt that?

Rayvn: Yes, I have. One of my really good friends, Chelsea, we were talking. I make costumes, and I make costumes for Renaissance Fair.

Carolyn: I want to see pictures.

Rayvn: I don't even let my kids see pictures of me in my costumes, but I love it. I was making her costume and she was just telling me how uncomfortable she feels. She's not African American, she's Caucasian American. She was telling me how she is confused about what to do because she has so much empathy for what's going on with Black Lives Matter.

There are certain people in the African American community that will embrace people who are trying to understand. Then there are also other people who actually will make you feel like you feel, Carolyn. It’s like, you'll never understand so don't even try to understand.

She's like, "Well, what do I do? So I don't want to come like I'm condescending and I don't want to feel like whatever." I think that what you do, part of that is guilt.

A Big Heart

Rayvn: That you feel some sort of guilt for something that you had nothing or have anything to do with. You have a big heart and so much empathy that you just want to understand. Not only understand, because I don't think I could ever understand anyone that went through the Holocaust. I didn't feel like I didn't belong in that museum because it was an experience that I wanted to see. And I was in the army and I was stationed, actually, in Germany.

I went to Dachau, and that is a place to get a better understanding of the culture, of the society. That culture and that society makes up our culture and our society, and we engage. I engage. In New York, I engaged with people who had grandparents that had to deal with things from the fallout from the Holocaust. I learned that my grandmother, this hurt me to my soul, this is why I became what's called woke.

My grandmother told me that they were in North Carolina, her and my mom. My mom was little, and my uncle, they were not allowed to sit in the front of the bus. Up until that point I understood that that's what happened. I understood that from an educational perspective. When my grandmother told me about her and my mother, things changed.

Mark: It became personal.

Rayvn: Yes, I did. I couldn't because that's the generation before me. You can't feel that you don't belong. Because wherever your background is and where most of us are all mutts most of it, we're totally mixed.

Carolyn: I'm a complete mutt.

Your Background Is Your History on the Record

Rayvn: I am, too. My father's side is Portuguese.

Carolyn: Well, I feel like your eyes are green, aren't they?

Rayvn: They're blue-ish, but they change colors depending on what I'm wearing. Whatever your background is, that's going to be your history. Ford is actually British, isn't it? That's what it'd be, probably.

Carolyn: Well, it traces all the way back to Ireland.

Rayvn: There's a story there. If there was a museum, probably somewhere in England or Ireland, that would be your people. That would be something you could embrace, but would you want people to know what your people went through? That's what the museum is about. It's letting people know what our people went through.

Carolyn: I didn't feel like anybody was putting that on me. It was my story, and it was really hard. I went with my friend who's also a Caucasian. Surprisingly, we were one of the few Caucasian people in the museum at the time. I felt like it was so hard to get tickets. I was like, I'm stealing a seat that maybe somebody else should get first. There was all of that story going on.

Rayvn: I definitely see that, but it is what it is. It is where we are. It's where we came from. If those things didn't happen, then other things wouldn't have happened. If you would've asked me, who was my favorite person, a human being, would have been Dr. King and my grandfather. Dr. King wasn't about African Americans only, he was about everybody. He wanted everybody to experience this type of freedom.

How Things Are Going

Rayvn: I'm not quite sure what's going to happen. That's actually my thing. It's like, what's happening, how are things going? I don't know and I don't want to be pessimistic and say that it's going to continue down this bad path.

Mark: I think we live in the microcosm of what's happening every minute, and social media amplifies it. I feel that way, too. So I try to say, look, because I want to be positive. I got to step back and say, try to think of things in a bigger picture. In the political environment today, this is so caustic. I get so branched with it. It's like, you know what? If you could only step back and say, "In a couple of years."

Carolyn: Read The Broken Earth series.

Rayvn: Is it dystopian?

Carolyn: A little bit.

Mark: She does this every time. She waits until we're done and then she goes, "Okay, we're done." Then she asks these really good questions, and we get this really good stuff going on.

Carolyn: We can use it if, Rayvn, you're okay to use it.

Rayvn: Oh, yes.

Carolyn: It was a hard question for me to ask.

Mark: I think it's great stuff.

Rayvn: I think it's a great question.  There are people, lots of people, who feel like you do. Mark, where are you from? You have a great accent.

Mark: I'm from North Carolina. Senell, as you were talking about, you asked Ford, and I wanted to tell my story, but I didn't want to interrupt. It's a made-up name. My grandfather came over from Italy and his name was Simeoni.

A Change of Name on the Record

Mark: He came over, stowed away on a ship to America when he was 13 years old. The ship went to New York. He wanted to see America so he got off the ship in New York City. Then he went and checked things out. When he came back, the ship was gone. He never went home. They got an interpreter. They figured out he had a brother that had come over to America years before and put him on a train so they shipped him off. He never went home, and he changed his name, his religion, everything.

Carolyn: Why did he change his name?

Mark: Back then, at the turn of the century, Italian wasn't as cool and chic as it is today.

Rayvn: As of now, being Italian is cool.

Mark: You were prejudiced against. He didn't want to be Italian, he wanted to be American, so he didn't allow Italian to be spoken in the home. Whenever they would get together with their Italian relatives, they'd all speak Italian. My dad didn’t because my grandfather said, you are American. Speak English. That's my story.

Carolyn: See, we're keeping that in. People's stories are incredible.

Rayvn: They're people's stories. I know. You would speak Italian with a North Carolina accent. I wonder what that sounded like?

Mark: I really don't speak Italian, I never learned it. I learned how to speak Southern, though.

Rayvn: Yes, you do Southern really well. It's like smooth Southern, it's just in there and you don't even know you're doing it.

Mark: Well, I've been up here for a long time.

Culture Shock

Rayvn: From a New York perspective, when I went to the military, it was the first time I even dealt with the south. I was in South Carolina, to whatever that horrible base is. It was in Columbia. Fort Jackson, South Carolina.

Mark: It's a culture shock, I bet.

Rayvn: It was. First of all, I was in an all-girl Catholic school for high school. I didn't grow up around African Americans. Carolyn, your story's actually my story. I feel uncomfortable around African Americans, except for the people I work with. A lot of African Americans think that I am not being true to my race because my mom's big thing was education. We went to school. I didn't learn slang because I wasn't allowed to go outside. If you talk to me slang, I have no idea what you're saying.

I read a lot and I'm just like that. So I feel uncomfortable around African Americans because I feel like they judge me. When I went to South Carolina, wowzers. First, I was scared to death because I knew that I was below the Mason-Dixon. I was like, this is below the Mason-Dixon, I think I know that this is it. In the military, it was in the '90s, they were actually racist. Everybody was racist. African Americans did not hang out with Caucasian Americans. I had no group because it was so segregated.

Mark: I hear you there. I grew up in North Carolina. After college, I moved to Richmond. Richmond feels more Southern to me than where I grew up, in North Carolina. It was bizarre.

A Lot of Racial History on the Record

Rayvn: I've been to Richmond. Richmond gives me a weird feeling. I don't know what it is about that place but it has a weird feeling to it.

Mark: That's an interesting perspective. It's definitely got a lot of history. It has a lot of racial history because Richmond was the capital of the Confederacy but it's also got a very cool vibe that you may not get on the surface. Virginia Commonwealth University is an art university. It’s a big art school. There's a lot of cool vibe that interlaces through there that you don't catch on the surface. When you drive through, you're not seeing any of that but when you live there, you can get into that vibe. There’s a lot of really cool restaurants, ethnic restaurants, and you're like, "Oh, I didn't see that coming."

Rayvn: I didn't know that. I have to spend a weekend there then.

Mark: If it creeps you out, don't go.

Rayvn: I don't know. Hampton, Virginia, creeps me out. My friend lives there. I'm like, "Oh, this place is scary." It's actually really scary sometimes because when you know that there's that racial tension, you just don't know. I told my sister and my daughter that I was practicing what I would do if a cop stopped me because I went for a walk around my friend's neighborhood, and they're very rich. It was one of those neighborhoods.

The next neighborhood was not so rich and the socioeconomic status was a little bit lower. If I get stopped by a cop or some cop comes to me, what am I going to do? I was going to scream my head off and say, "Don't hurt me." Raise my hand, whatever.

The Civil Rights Movement on the Record

Rayvn: I was so scared. I was like, "Why are you so scared?" That's where we are. It's just, I don't know. I like your positive attitude about it, Mark.

Mark: Well, it's self-preservation otherwise, I get too stressed out. I try to say, "Look at the world, look at things." And I can imagine what people felt like in the moment during the civil rights movement, about how they felt about different things. You need to look at it now. You're like, "Look at the big picture." All this positive change that took place and all these good things that you're like, "Yes." But living in the moment, it wouldn't have been like that at all. It would have been a very intense situation. I try to think things will get better over time.

Rayvn: They are getting better over time. It's just incremental.

Carolyn: We're spiraling. I have one more question for you before we let you go, were you in the army?

Rayvn: Yes.

Carolyn: Do you mind if we use that in your title?

Rayvn: Absolutely not. Very proud of it.

Mark: Carolyn's dad was in the army.

Carolyn: Yes. When you were talking about how racist it was, my dad's my hero. I love him but he was horribly racist. The phrases that I grew up saying, I didn't know what they meant. They were part of my vocabulary because my dad used them all. It’s really funny because he also had really close friends of different ethnic backgrounds, different colors, and he was still intensely racist. I didn't know that, as a kid. Looking back, I'm like, "Oh, wow."

Growing Up in a Lot of Racism

Mark: Looking back, I can see a lot of that growing up in North Carolina. I see a lot of that with how I was raised and just the area that I grew up in.

Carolyn: We didn't know.

Rayvn: You know what? My grandmother, while I was growing up in the Bronx, was there. I'd be like, "Oh Nana, I met blah, blah, blah." Her first question was always what color they were. I was like, why does that matter? Now I know why because she grew up in the era of Emmett Till. She was in that era. It took me awhile to understand why.

Mark: Living in the moment, it's got to be a different experience. I was listening to Bill Maher talk about this recently on his show, we're making progress. We're making progress. I think people are, I'm not going to say enlightened.

Carolyn: But we are.

Mark: Do we want to call ourselves enlightened with progress?

Carolyn: Look at this conversation that we're having now. This is progress.

Rayvn: This is progress because we can have this conversation and be okay with it. It's great to be comfortable with it.

Mark: It is what we are. It‘s part of the world we live in, so let's embrace it.

We Can’t Change What’s on the Record

Rayvn: It is. To bring it all round, the whole purpose of our museum is to make those uncomfortable conversations happen. To be able to, here it is, this is not pretty, we can't change it. Let's just talk about it and figure out how we move forward because what we've been doing isn't working, apparently.

Carolyn: I love that. We're using that on the record too.

Rayvn: Just use everything. You're awesome.

Mark: Well, this was great. Thanks, Rayvn.

Carolyn: We cannot thank you enough for your service to our country, and dedication to representing our history. We hope you enjoyed this episode of Tech Transforms. Please like, and follow us on social media. We'll be back next week.

Willie Hicks, CTO of Public Sector at Dynatrace, joins Carolyn and Mark to discuss the top Cybersecurity news stories so far in 2022. Willie offers his expert opinion on the White House Executive Order on Improving the Digital Government Experience, the recent Log4j vulnerability, and the Pentagon's new Zero Trust office.

Episode Table of Contents

• [00:43] Unpacking the Biggest Headlines in Cybersecurity News
• [08:21] Major Catastrophe
• [16:03] Cybersecurity News Highlights the Highest Level of Vulnerability
• [23:59] A Quantum Shift in Cybersecurity News

Episode Links and Resources

• Willie Hicks
• Executive Order
• Willie Hicks Article on Zero Trust
• Log4j

Unpacking the Biggest Headlines in Cybersecurity News

Carolyn: Today we talked to Willie Hicks, Dynatrace public sector CTO. He’ll unpack some of the biggest headlines of late from the Executive Order on Transforming Federal Customer Experience and Service Delivery to Log4j. I know Willie, you're so sick of this topic, but we're going to cover it anyway, and then Zero Trust Thunderdome Awards.

I want to go first to the Executive Order requiring improving the digital government experience. Willie, will you give us the big takeaways from this Executive Order? What does it mean for our agencies?

Willie: First of all, I think that the Executive Order on Transforming is transforming the federal customer experience. It is going to impact the agencies, but I also think it's going to impact the digital citizens of the day, the real customers of the federal government. I think President Biden reiterated this, it’s supposed to be a government for the people, by the people.

We're trying to put people back into the equation. I think the big takeaway for me is that the federal government is coming back into or getting to a point where they're really understanding that customer experience, well, they already understood it. But they’re really starting to internalize and figure out how to make customer experience like the customer experience most citizens expect to see with anybody who shops on Amazon, anyone who does a Google search.A Fundamental Shift in Customer Experience

Willie: They expect, with the push of a button, that they got all the groceries shipped to them the next day or the same day. That kind of experience you do not get with the federal government today. I think that we're seeing a fundamental shift now, not just that kind of digital experience, but I think across the board. Like when you even walk into a brick or a mortar building, when you interface on the phone with a government employee, I think we're going to start, hopefully, seeing more customer-focused, customer-centric type attitudes.

This is really long overdue. I've been in this business for many years. I remember one of my early visits to a federal agency that will remain nameless, but I was speaking to this agency about what we call our digital user experience. How we need to focus on the real metric who's the end user. Right now, you are focused on the back end. You're focused on, is the server up or down? Is this process running? Do I have availability for this device? No one's actually really looking at the end user. So how do you know they are getting a good experience? Not only are the systems running, but are they running efficiently? Are they getting transactions back in a timely manner, or are they frustrated?

I remember one engineer saying, "Well, why does that matter?" I'm like, "It does matter because they're your number one responsibility. That is who pays your salary." This person, an engineer, actually said to me, "Well, there's not another X agency. It's not like they're going to go somewhere else. This isn't Amazon or another commercial entity. If it doesn't work, they'll come back later." That was the response. And I was like, wow!

Smooth Government Transactions

Carolyn: It makes me think of when my dad died a few years ago. We wanted to give him a full military burial, but we couldn't find the papers that we needed. He had shown me where everything was except these particular papers that we had to have to get him this burial. We spent hours and hours online trying to track them down. But, we never did, we never were able to find them. Ultimately, it came down to us, calling Camp Williams and saying, "Colonel Ford is gone and we need some help."

They stepped up and did it, and it was awesome. Fast forward to today, I'm in Utah and we've got billboards all over saying something about finding my cash.gov. I was like, all right, I'll bite, I want to see how easy this is. You guys, it was so slick. In 10 minutes I put in my name, I think I put in my address. There was a quick database search and it said, "Oh yes, you've got money here from these closed old accounts. We'll send you a check." A week later I got a check. I'm still blown away that I did a government transaction and it happened that smoothly.

Willie: Unfortunately, that's been the exception not the rule except for certain agencies that I work with. I work closely with organizations like the VA. To your point, the VA has been making a lot of great strides to improve their customer service, their image and so forth. A lot of that is around, I think, customer experience. Or I should say the veteran experience and making sure that they're putting veterans first.

The Cybersecurity News Features How Backend Systems Work

Willie: They're putting a lot of investment there to understand not just how their backend systems are working, but how the actual end-users are performing, how quickly that transaction took.

Carolyn: But to your engineer's point, why now? He's right. We have to have these services. We're just going to come back later or we're going to give up.

Willie: Well, I would say right now, why now? It’s because to be quite frank, that's the wrong attitude. At the end of the day, that person was right. It's not like I can fire this agency and say I'm going to take my business elsewhere. But there are ways we can speak at the voting booth, calling our senators and our representatives. Getting those types of attitudes changed by having them hold in front of Congress and ask, "Why are you treating my constituents that way? We pay your salaries, so we expect the same kind of response that they would get from any other service."

I think that's what we're seeing with the administration today. They focus on the need to bring the people back into the equation, and that the citizenry understands that they are our most important priority. We treat you that way in everything you do. If at the state level, it’s going to the DMV, which I think everyone dreads, hopefully this will translate down to the states.

But going to the Social Security Office to get a new Social Security Card or going to, in worst-case scenarios, I think this is even going to translate into disasters. How quickly do I get disaster relief? How quickly do I get relief because I just lost everything from a flood?

Major Catastrophe

Willie: When there’s a major catastrophe, how do I get to the right organization to help me just making sure I have the right avenues? I've seen reports lately where agencies, due to COVID, were slow to respond. They were slow to get PPE out and things like that. Those things, they are customer service. But there are consequences also to bad customer service. People don't get the services they need and they get sicker because they don't have that. They don't do that.

Mark: This is a confidence in government issues, Willie.

Willie: 100%.

Mark: I hope that this Executive Order has the staying power that generates money to put behind it. I mean, really it's a nonpartisan political issue that impacts all citizens. However, I think it's being leveraged a little bit politically. I do feel whatever administration is going to implement services and things like that, that they're putting out there for citizens to take advantage of, you have to have confidence. The citizen has to have confidence that the government can actually deliver. If you can't even access the application and the information online then you lose confidence that the government knows what they're doing.

Carolyn: Before we leave this topic, are there any teeth to this Executive Order? Are there deadlines? I mean what is it other than saying, "Yes, we need to do better."

Willie: Yes. That is always the issue that we have, how's this going to be implemented? How is this going to be upheld? Because unfortunately, it is an EO, it's an Executive Order. It is not codified in law. It's not like there was a bill passed on customer service.

Hard Deadlines on Cybersecurity News and Updates

Willie: Although there are ancillary bills that do cover some of these topics, I think of nothing that's more all encompassing as what we're seeing in the EO. So, does it have teeth? We'll see. Right now, I don't know of any hard deadlines that are imposed. I think they're really putting a framework in place to do all of these things. I'm sure the administration wants to be able to report by the end of the term to make sure that they are seeing progress.

My hope in all of this is that, in this period of time, even without the teeth, agencies will be forced to think about these things. They will be forced to internalize some of these things. Moving forward, regardless of administration, these ideals are self propagated throughout the agencies. These continue on regardless of the law and regardless of what's in place. At the end of the day, there are certain things that should be done just because they're the right thing and not because it's a law. It’s not because someone has to tell you to do it.

Carolyn: We've started the conversation, which is a really good thing. So, all right, let's go to Log4j. Just school me, what is it?

Willie: I won't bore everyone with the details, but I think because everyone's really probably heard a lot about this. You've heard of Log4j, Log4Shell. In a nutshell, it's an extremely critical, extremely severe vulnerability in a component. It’s a module of what's called Apache, a kind of server technology that is utilized.

Carolyn: That everybody has.

Full Court Press

Willie: That a lot of people have. Probably, I've seen millions, maybe billions of instances of this module that is distributed across multiple platforms. It could be in embedded devices, it might be in servers. Honestly, the scope and scale of it is unprecedented. That's why there was this full-court press.

Carolyn: Unprecedented beyond SolarWinds?

Willie: I think, I won't mix the two per se because with SolarWinds, we've got documented attacks. We know that our adversaries have taken advantage of this. They were lying in wait in some of these systems for months. They’re slowly making moves, lateral movements and so forth when they get into the system. With Log4j, I think it's still early to find out the true impact of it.

At the end of the day, I think from a scale standpoint, yes, because SolarWinds is a commercial product that agencies trusted. They brought it in-house and they left it behind the gates. Unfortunately, supply chain issues were there, which allowed for some malicious code to be in that product that was almost like a Trojan Horse. It was brought behind the gates, and then they were able to take advantage of that.

Log4j on the other hand, was a vulnerability in the code, but that was propagated over not just a few 100 customers or 1000 customers. I don't know SolarWinds' customer base, but whatever that customer base was, versus something that was just distributed across millions of devices. So really different scales.

Carolyn: Who did the Log4j?

Willie: Well, it's a vulnerability. It wasn't like a supply chain issue. As far as we know, it wasn't like somebody planted this.

Security Vulnerability

Willie: It’s just something that has been there for a while, just a security vulnerability that wasn't accounted for. Once it was discovered, it was figured out you could use this. You could exploit this to take over a machine. So basically to get remote code execution capability, so you could run remotely.

Mark: That was open source wasn't it?

Willie: Yes. So there's a whole other conversation we can have. I don't want to get into that about open source and so forth. Although open source has its merits and its benefits because a lot of eyes are on it, sometimes these things still happen. It also depends on the open source. Some open source projects are very well maintained, and very well scrutinized.

People are always looking at it, tinkering with it, understanding when they find a vulnerability like Log4j they quickly bubble that up. There are some open source projects that aren't so well maintained, but people still use them. But the vulnerabilities don't come out as quickly.

Carolyn: We're a month into this. Have we got it under control? Do we have our arms around it? What did agencies do to manage this?

Willie: I would say, well, that's a loaded question. Do we have our arms around it? I would say we are, well, let's just talk about what happened. Because I can even speak from a company, from my perspective on what our company has done around this. Immediately after at least it became public, I think it was December 9th that this was released or became known, this was escalated to the highest levels.

Cybersecurity News Highlights the Highest Level of Vulnerability

Willie: CISA made this a highest-level vulnerability. They instructed agencies to start immediate searches of their systems. I personally know of agencies we worked with where they might have had a team of 100 people plus over weekends. They were going through servers, looking for unfortunately, sometimes looking manually for this vulnerable code to remediate it. We quickly got our hands around it from that standpoint.

Is there still Log4j out there that we haven't caught? Of course. I know we haven't gotten to eradicate every bit of vulnerable code. But, there was a very concerted effort, especially at the federal government level. I know at the commercial level, the corporate level, and the private sector, there was an equally frantic push to get this taken care of because it is a major vulnerability. You don't want someone with the ability to remotely execute code on your servers. They could do anything they want at that point then once they get into the system.

I would say that, time will tell how well we got our hands wrapped around it. From our standpoint, we were able to quickly analyze our code to quickly find out where our vulnerabilities were. We’re able to quickly notify our customers, our government partners, and agencies of what our vulnerabilities were, and how we were remediating them quickly. We had patches out, I think on that day, to make sure our systems were patched. I think our SaaS environment was doing that. We quickly accelerated our testing cycles to make sure that we didn't break or blow up anything when we applied the patches.

Mark: You're also helping our customers with their application security module. Identify those vulnerabilities, yes.

Core Capability

Willie: That was the internal, but from an external standpoint as Mark accurately pointed out, I was saying earlier that some of our customers were manually looking for this. Luckily, for our customers that have agents deployed and had observability by Dynatrace, we actually had a capability that is core to our platform called AppSec. It’s designed just for this, to look for vulnerability.

Within 10 minutes of the announcement, our databases were updated with this vulnerability signature and pushed out to all of our customers that were connected online. Then for those customers that received that, they immediately, who were using the AppSec module, they immediately started getting flags all over the place of where this module was.

Those people who had AppSec and had our agents fully deployed didn't have hundreds of people. They were going to their Dynatrace consoles and were seeing all of the vulnerable systems. Then we actually had remediation steps built into the platform where they could see what they needed to do to remediate that. We were able to take that from a multitude of people down to the team that was monitoring the system.

Then we distribute that information to the admin teams or to the automation teams so they could use Ansible or whatever they were using to automate the remediation of that. It’s really powerful when you have that visibility, that observability into the system. There was no better example of how important it is for any type of DevSecOps organization. We can talk about it from a zero trust standpoint. I can even talk about it from just understanding the build of your systems.

The Last Big Boulder Cybersecurity News

Willie: There's all this talk about bringing legislation around companies. Having a software bill of materials, SBOMs, built in as part of their products so you can see exactly what components are in software. It’s something we don't normally do in the industry. Having that observability so you might not have that SBOM, but we can light up and say, this is how that application is built and all the components. Really invaluable.

Carolyn: Let's go to our last topic, the last Big Boulder news item, which is the Zero Trust Thunderdome contract. I'm going to be honest when I read this seven million contract developed, to develop zero trust architecture, I thought this was already happening. So what is the significance of Thunderdome?

Willie: I will preface this by saying I'm not a security expert, but I can talk to it from my industry perspective. But the Thunderdome award, which I like the name by the way, is seven million dollars. It's just a prototype to prove out the schemes and the technologies that they're going to be using. They’re technologies that DESO wants to use to build out their zero trust architectures or to validate the zero trust architectures that they've been developing.

To your point, there are pockets of the DoD. There are pockets of the service branches that have been already investing in zero trust. So, you look at programs like Platform One where this is already being built into the platform. It was part of what was really, I think, revolutionary about the Platform One environment and what they were trying to do at Platform One. This was already being built-in in DESO.

What Happened With Log4J

Willie: The DoD had already been investigating this for, I'm sure, several years. But I think what happened with Log4j, SolarWinds, all the ransomware attacks, the administration basically has put a stake in the...

What does it take to secure 160 million Americans privacy? Greg Crabb, former Chief Information Security Officer at US Postal Service joins Tech Transforms to talk about his experiences from his time as Projects Coordinator for International Fraud to his role in the 2020 US Presidential Election.

Episode Table of Contents

• [00:42] Greg Crabb in the House, Founder of 10-8 Cyber
• [10:33] Good Guys Get Together With Greg Crabb
• [20:05] They Want To Do the Right Thing
• [29:32] Greg Crabb Had a Long, Deep, and Intense Service

Episode Links and Resources

• Greg Crabb
• USPS
• FBI
• Secret Service
• Europol
• Interpol
• AQAP
• CISA
• Ebay
• Chief of Police Conference
• Hurricane Electric
• LexisNexis
• Sergey Pavlovich
• James Woolsey
• Damitri Gluboph
• Orange Revolution
• Russian FSB
• Solar Winds
• Chris Krebbs
• Matt Heartman
• Amazon
• CAD
• Jen Limb
• Delivering Happiness
• Adam Grant

Greg Crabb in the House, Founder of 10-8 Cyber

Carolyn: Today, our guest is a rockstar. His background just blew me away. Greg Crabb, founder of 10-8 Cyber and strategic advisor to several organizations, but that doesn't even scratch the tip of the iceberg of who our guest is today.

Greg: Thank you, Carolyn. I enjoy the opportunity to chat.

Carolyn: You recently retired after 20 years with the US Postal Service where you wore many hats. From being a project coordinator for international fraud, assistant director of economic crimes, you ended your career as the chief information security officer and vice president of USPS. That's the very tip of the iceberg of your career. I want to kick it over to you and have you tell us your story.

Greg: The mission of my life has been to protect others and drive benefits for society. I was grateful enough to have the opportunity to retire last year after 30 years of federal service. When I joined the postal service in the mid-90s, I spent the first several years of my career being an auditor. I was responsible for the old electronic data processing controls portion of the financial audit. There I learned an amazing amount of information about how computers work, mainframes, networking, and all that sort of thing.

In 2000, I transitioned to spend seven years investigating the origins of Eastern European organized cyber crime. That was an amazing experience. I got the opportunity to really attack an organized crime group. It was based out of Ukraine and had splinters all over the world. I worked with Europol and Interpol, the Secret Service, the FBI, and many other organizations in between.

Bigger and Better Things for Greg Crabb

Greg: In about 2005, I moved to Washington to take on bigger and better things. Then in 2010, the international supply chain was attacked with some parcel bombs from AQAP. AQAP put PETN, it's the liquid explosive that we all know as why we can't carry water bottles onto airplanes. It completely changed the security model of how international supply chains work for moving parcels. I spent a number of years working with an international community of 190 countries to develop new standards. Worked with civil aviation authorities to properly secure the supply chain from a commercial aviation perspective for parcel security.

In 2014, I got tapped to respond to a pretty significant breach at the US Postal Service. In that moment, I transitioned from being the law enforcement officer who was the hunter to the chief information security officer who was the hunted and responsible for an amazing network. I was grateful to provide security for 160 million delivery points, private communications, and parcels for all of America for six years. As we talked before the show, I was really grateful to have the opportunity to help protect the 2020 election. It was just an amazing collaboration with the folks at CISA and many other organizations across the country in order to pull that off.

Carolyn: Can you talk about what you did to prepare for that? Talk about pressure. You'd been preparing for 20 years.

Greg: I had been preparing. I wouldn’t have been as successful in protecting the technology assets the postal service relied on to move 70 million ballots if I had not had those experiences.

Greg Crabb Is Dealing With Eastern European Organized Cyber Crime

Greg: I’ve been dealing with Eastern European organized cyber crime and understanding what it takes in order to protect a network from everything. From disinformation campaigns to all of the technical details that are necessary to secure a network. Where do you want to start? From an application security perspective for the organization, from an OT security perspective, all of the technology that was necessary in order to be able to move the ballots were in the consideration.

Carolyn: It's interesting because when I think of the US Postal Service. I'm not going to lie, it's a little boring.

Mark: You think of physical security, OT.

Carolyn: It's a letter and you're moving a physical thing. But like all the cyber that was involved in it, is it the processes that you were securing, the databases?

Greg: It was everything. From the delivery scanner, the letter carrier that is driving by your house every day, securing that scanner to know that your ballot was in the mail, to all of the operational technology that exists. Now, imagine big warehouses larger than big football stadiums, where mail processing is made. Huge pieces of equipment were down to your address. All the packages come in and we sort them down to each delivery point.

In total, I was responsible for the protection of 1.2 million technology assets. Petabytes and petabytes of data relative to package tracking and those kinds of things. Only 630,000 employees are necessary in order to be able to deliver that mission and interact with all those technology points.

Mark: That's just at the federal level. I can only imagine the collaboration across states and everything must have been massive.

A Massive Enterprise Focused on Collaboration

Greg: I did not have the responsibility of dealing with each of the states. The postal service, in order to be able to secure the election, is a massive enterprise focused on all of the collaboration, developing standards on how mail pieces are supposed to be formed. There's a lot to make sure that everything gets delivered on time. If the ballots aren't there, they don't get counted. That was something that not only my role as chief information security officer but my security partner, who was the chief postal inspector, was out all over the country in facilities. Basically, just making sure that each of the communities were getting their ballots in a timely manner from all of our delivery operations.

Mark: I know you've done a lot of work with cyber crime and you've worked with adversaries, I guess, as well. I’m curious to know how you've seen this whole landscape transform over the years.

Greg: I started working in organized cyber crime investigations in 2000. I was asked to help the FBI with a case coming out, or some significant amount of fraud against eBay, coming out of Ukraine. It took me several years to wrap my arms around it. I was ultimately able to arrest a number of folks from Ukraine and other Eastern European countries that were involved in this. But really, I had the opportunity to sit down and talk with a lot of investigators from Eastern European countries.

We had a conference in Warsaw a number of years ago. These were early days. They talked about how they started to see car smuggling gangs that were based in Eastern Europe starting to have technology equipment in the vehicles where they were getting arrested.

Good Guys Get Together With Greg Crabb

Greg: Eastern European car smuggling gangs would basically get caught in Poland with stolen cars. They popped the trunks and there would be a bunch of technology equipment, credit card skimmers, and other technology that's necessary in order to be able to commit those types of crimes.

There was a conference. Good guys get together and do the International Association of Chiefs of Police Conference and those types of things. But in 2001, there was a conference in Odessa where a bunch of criminals got together. They referred to it as, "The First International Carders' Conference." The members of that meeting became my targets.

Carolyn: How did you find out about it?

Greg: I had the good fortune of one of the criminals that I was investigating had hacked into a server in San Jose, California. At the time, I was based in Northern California. The data center was on my drive into the office. He was sending all of his communications through that server. I intercepted 40,000 of his email messages.

Carolyn: How did you find that?

Greg: Long story. It was just tracing IP addresses and getting back to the source of where all of his communications were coming from. They all sourced to this particular server. The company was called Hurricane Electric in Fremont, California. I worked with the US Attorney's Office and the victim to get approval to go in and review my suspect's messages on a daily basis. So I had this unbelievable wiretap on this criminal and all of his email messages. Not only facilitating his crime but with all of his cohorts in crime who were doing these activities.

Greg Crabb With Eastern Law Enforcement

Greg: One thing led to another and I learned about this International Carders' Conference based in Odessa and basically focused on this group. That led me to the opportunity to really work with Eastern European law enforcement officers. I had occasion to work with the Russian FSB and the Ukrainian MVD, and even law enforcement officers in Belarus. I proudly display the hat there from my colleague in Minsk, Belarus. Unfortunately, he was actually arrested for working with me. We went to the country in '05. The suspect had a website. The banner on the website said that their objective was to take the United States back to the time of 1929.

Fortunately, the Belarusian law enforcement officers were willing to work with us until the government got involved after we left. From the computer equipment in that case in Minsk, we recovered over 55,000 full infos. These are victims in the United States where they've got their mother's maiden name, their social security number, all of the answers to the questions that are necessary for those knowledge-based questions. He had hacked into LexisNexis, and his hack was actually the subject of a congressional debate. The subject's name was Sergey Pavlovich.

It was interesting to be able to work with all of those folks and deal with not only, on a personal relationship, the police officers but then the governments from a not-so-friendly perspective. I was never invited back to Belarus again, I was stupid enough to try to go back to Belarus. But I think the US embassy was smart enough not to let me in. Those experiences were foundational for me to understand what's necessary in order to be able to counter what we see from a law enforcement perspective.

What James Woolsey Taught Greg Crabb

Greg: Like James Woolsey taught me, there's little difference between a Russian businessman, a Russian politician, and a Russian organized crime figure. They're one and the same, like the people that organized that International Carders' Conference in Odessa, I look at where we are in the political world today with Ukraine and Russia, and the United States. And I started going to Kyiv in November of 2003, trying to get the guy's name was Dmitry Golubov. Dmitry Golubov arrested.

He was one of the key organizers of this conference, responsible for massive amounts of fraud against financial institutions and online companies. It was very difficult. He was protected by the police in Odessa. They were on the payroll. It really came down to the Orange Revolution. In early 2005, late 2004 to 2005, there was a highly contested election in Ukraine. The first election was called by the international community to be fraud, and a second election was made. It was very close from a decision perspective.

You might remember that the candidate that won was actually poisoned by the Russian FSB in Switzerland while he was traveling there. He won. When he took power, the Ukrainian MVD asked for me to come over and actually present my case. I got an opportunity to go over and brief my case to the Minister of Interior to Ukraine. Two weeks later, they arrested Dmitry Golubov.

Mark: In London, the UK?

Greg: No, it was in Ukraine. It was in Odessa. I do stop for a second. The Orange Revolution was extremely important in Ukraine. It was really that turning point in the history of Ukraine where they went Western leaning, they were looking to democracy.

Why the US Embassy Was Giddy When Ukrainians Invited Greg Crabb

Greg: They were looking to, how can they become more westernized? At the time, when the Ukrainians asked me to come over, the US embassy was giddy. We actually have a government that's interested in working with the US.

I remember going with the special agent that was the FBI leg-att there in Kyiv, Ukraine. His name was John Boles. We drove over to the briefing with the Minister of Interior to Ukraine. He was so excited that we were going to present this case. Then for them to actually, the Ukrainians, to go and arrest Golubov was unbelievable. I was invited back over after the arrest to again do something that had never been done before. Boles was really excited.

I was the first US law enforcement officer to ever be asked to interview a Ukrainian on Ukrainian soil. Albeit, we went to jail. He told us to buzz off, but so be it. It was a great turning point in our relations. Now when you see what's going on in the international community, I can only pray for the folks in Ukraine to be able to maintain their democracy and keep the coalition here, or the West to be able to help them.

Mark: Given all of the things that are top in the news right now, this is really interesting. Ukraine is in the news every day.

Greg: Unfortunately, we weren't able to present our case in Ukrainian court against Golubov. I won't say it was corruption, but after some time the case was dismissed. Several years later, Dmitry Golubov actually became a member of Ukrainian parliament. And you're just, "That's the way the world works, people."

Carolyn: The James Woolsey quote holds true.

They Want To Do the Right Thing

Greg: Exactly. You know it. I saw it firsthand. I've seen it again and again in my interactions with folks that are over in Eastern Europe. On an individual level, I was able to form some amazing personal relationships with law enforcement officers. They want to do the right thing, but governments, politics, and corruption are difficult things to overcome. I think that's where we really need to continue to focus and understand. Thank you for letting me take a little walk down history lane. I think all of those lessons are important today to understand what we face from an organizational national security perspective for the country.

Mark: When I think of cyber crime, cybersecurity, I think of technology, bits, and bytes. I think of leveraging cutting-edge kinds of technologies and the way people do what they do. I'm really curious to know because you've talked about a couple of things which makes me think really just grassroots intel, spy versus spy. How much of this world is HUMINT or human intel as opposed to the technology piece?

Greg: Technology's just an instrument to the motives of the actors. I think that one of the things that, as we look forward and we look at the attacks like SolarWinds and you name the Eastern European-based attacks that we've seen, they're all motivated by the objectives of either greed or control. Or I often recall, and this is a supply chain story. It's going to start a little weird. One of my colleagues in Eastern Europe always used to say, "Mr. Greg Crabb, trust no one. Not your wife, not your girlfriend and not your lover."Supply Chain Related Story

Greg: How could that possibly be a supply chain-related quote? I knew all three of his, by the way. His wife, wonderful mother of his children, awesome. Girlfriend was just beautiful. His lover, she was smoking hot. But what he would always talk about is that from a mass surveillance society, you need to understand your relations. You need to understand your most trusted intimate relations in order to keep them controlled.

I think when we see the types of attacks with SolarWinds and the other supply chain attacks that we're seeing in software development lifecycle, we need to understand that mass surveillance is a technique that is used in those cultures. We need to understand and account for it in our information security practices. There's bits of the story that I've left out there, but you can get the main point.

Carolyn: I feel like we're...

Technology is paramount when it comes to securing our nation according to Pete Tseronis, CEO of Dots and Bridges, former CTO of the US Department of Energy and US Department of Education. On this episode of Tech Transforms, Pete explains the critical role technology plays in our lives, and how innovation underpins that foundation.

Episode Table of Contents

• [00:38] Pete Tseronis: From Fed to Dots and Bridges
• [05:50] Why It Matters To Translate the Tech
• [12:22] Who Are Keeping the Lights On
• [22:00] How Pete Tseronis Responds to the Mission
• [29:33] Information at Your Fingertips

Episode Links and Resources

• Pete Tseronis
• Dots and Bridges
• Department of Energy
• Department of Education
• CSF
• Cybersecurity Mandata 14028
• Infrastructure Bill
• Roadbotics
• Tipping Point
• Entrepreneur Roller Coaster
• Think and Grow Rich
• Thought of the Day
• Ray Kurzweil - Singularity

Pete Tseronis: From Fed to Dots and Bridges

Carolyn: Our guest today has got quite the pedigree, Pete Tseronis, CEO of Dots and Bridges. Before Dots and Bridges, Pete served as a Cabinet-level federal CTO, not once, but twice. First at the US Department of Education for eight years, and then at the US Department of Energy for seven and a half years. Before those two, he was actually with the DoD since the beginning of things.

Pete: It's nice to be on the other side of the mic. I have all the respect in the world for what you're doing, in addition to your other jobs and incredible pedigree you have. But I love the conversations and it's a treat to be able to tell my story a little bit, at least.

Carolyn: Your unique perspective on technology and federal agencies, as well as from the commercial side, it's going to be a great conversation. Let's just start with your story. Will you give us an overview of Dots and Bridges and how it came about? Then share your journey in the government and where you are now.

Pete: I tell folks I can do five hours or I can do it in about a minute. But there's about 32 years there, wrapped up. I'm a Washingtonian native. I grew up in the Washington DC area, in the suburbs of Maryland, Montgomery County and went to high school in Washington DC. It took me to Villanova University for my undergrad, where I studied liberal arts and communications. I wanted to be a sports broadcaster.

Pete Tseronis Had the Coolest Job in the World

Pete: I’m 54, and I do have a nine-year-old. So a little bit of a late bloomer. Four kids, a great wife from Pittsburgh, and yes, I have an Australian Labradoodle named Phineas Maximus Tseronis. So that is my life, my family. I came out of college, I ended up back here in DC, and interned at the Pentagon. One day, I woke up and I'm working in the Pentagon. I thought it was the coolest thing in the world. Didn't have a plan to work for the government. I didn't know much about it, even though it was in my backyard. But it put me on my journey.

The time was '91. I had the chance, when I was working as a civilian, the Department of the Army, to dabble in some of the work that the DARPA community was working on. The internet work was what it was called. Before I knew it, I had a bug, an itch that I scratched. And I was like, "This is going to be a big deal." I was that guy typing in on a text-based, character-based, if you will, screen: www.espn.com. I'm like, "Whoa, I can see all this news before it's in the paper tomorrow."

The itch was there. I said, "I'm going to go learn this internet thing." At that point, it was three years at DoD. I had a chance to move over to the Department of Education and do some computer security work. That was becoming a thing, like if you're going to use this tool, security matters. So we'll talk a little bit about that today and its evolution, but I jumped back to school.

Pete Tseronis Got the Coolest Education for Three Years

Pete: I enrolled at Johns Hopkins University and got my master's degree in telecommunications. I’ve wanted to know how this worked. How do you type something in and then it's there on your screen? That was the coolest education for three years. Every time I'd go back to class, it was like the material we learned was outdated. For three years it was like all of us were growing up in this IT world.

So I finished school while I was working. By the time I came out, the Clinger-Cohen Act had passed, 1996-ish. The federal government had chief information officers, CIOs. You were a thing, you weren't an IT director. Not that there's anything wrong with that, but you were actually a C-level. I said, "Well, maybe that's what I'll be."

So I tried it. At least, I went on that path. I found myself very interested in wanting to leverage what I learned in grad school. That was, well, you got to get into a data center and see how it really works. I ended up at the Department of Education, being a director. But really, running the data center with an incredibly talented group of folks that run circles around me. But they were my on-the-job training experts, firewall guys and gals, circuit folks, server people.

It was a real education on how to learn this stuff, this geek speaks, but then I have to go talk about it to my federal community. By the time I was making a decision on, “Do I want to be a tech guy, like the geeky side which is a compliment, or a propeller head?“

Why It Matters To Translate the Tech

Pete: “Do I want to go down the management route and stay in this government, as I was being promoted every couple of years?“ I got up to a SES status by the time I left. Then I found myself on a speaking circuit, talking about technology. I was asked frequently to work with the Office of Management and Budget, an arm of the White House executive branch, to translate the tech and why it matters. Maybe I wasn't a sports broadcaster, but I definitely loved getting in front of an audience and doing a bit of that educational component.

So in '08 I felt like it was time to do something different. I was appointed CTO. But in '08 it was like, "Well, what do they do? What's a CTO? We all know a CIO is such and such," and I didn't care. I called myself a connective tissue officer because I just loved bringing people together, convening, having conversations. Never, for the life of me, act or feel as though I was the smartest guy in the room. I was learning constantly in a world that was just moving at a clip.

In '08 I had an opportunity to come over to the DoE. I got to be blunt, it was the coolest, and it still is, job I've ever had. But I didn't really know what I was getting into. I didn't know much about the Department of Energy, or the Department of Science as it's called. But we can speak for hours on just the complexity of that institution. It was not just the Department of Energy circa 1977 when it was made a Cabinet-level agency, it was the former Atomic Energy Commission.Pete Tseronis Caught a Bug

Pete: It's truly where some of the brightest minds, for years, dating back to the Manhattan Project, to autonomous vehicles today, with our national laboratories. It is this brain power, that if you have a chance to work there or visit, you walk out of there just feeling like, "Oh my gosh, I can't wait to come back." At least, I did and I had a great run. That was eight years. I caught my passion and bug there for, “How does all this technology impact humanity? Why are we spending billions of dollars on research and development? Where is it going and how does it impact me and humanity globally?”

In 2015, I hit that ceiling. I was not in the government for the money. I realized, "Well, I'm not going to be able to really go much higher. So maybe I better go out and figure out what all this education can do in terms of hanging a shingle." I started Dots and Bridges. My wife gets all the credit for the name. I try to be cute at times, and then ultimately she said, "What's the big deal? What'd you do for 25 years?" I said, "Well, hon, it was a dot-connecting bridge builder." She goes, "Be Dots and Bridges. People get that. Connect dots, build bridges, that's what you did." So that was it.

Six years and a few months later I'm living the dream, working my tail off. I didn't retire from the government, I miss it. But being here in the Beltway and having this global community now, whether it's smart cities or critical infrastructure or cyber physical systems, I continuously learn and teach wherever I can and within bandwidth.Pete Tseronis Had Critical Roles in the Government

Pete: I make sure that I'm there for my family first and foremost. I love what I do.

Mark: It's a fascinating history. You had the opportunity to have critical roles in the government, in areas that are really impactful to society today. So helping the greater good. Those are certainly two organizations in your roles that are fabulous, and so is Dots and Bridges. How does that work? Having now been on both sides of the fence, how do you think you can help organizations, industry, the country, and its citizens be more effective in that transformation? Is it on the Dots and Bridges side or is it on the government side? What are the different dynamics there?

Pete: The short answer is, when people say, "Oh, you're in the industry now." I'm like, "Yes, I took an exit off the highway of being a Fed, and I'm enjoying it. But I'm going to get back on that road." I say as of late, "I'm probably going to end back up in the government again someday. I miss it." There's something about the 25 years of why you do it. People use this phrase, "I love the mission. I serve the mission." And I dig it. I get it.

But the impact of that mission that you're serving, or the mission impact of what you're doing, is really what hit me late in my career. I remember waking up one day at the Department of Education. Somebody asked me, "All this data center stuff you do and all this technology, how is that helping the Office of such-and-such at the Department of Education?" I honestly was like, "I have no idea."

The Epiphanic Moment of Pete Tseronis

Pete: That was the moment, or epiphany, that I went, "It's one thing to be a tech person. But to know how it's impacting students, or teachers, or educators, or rural America." Something I said to myself, "If I don't know that, shame on me."

When I came to Energy, the first thing I did was, "I'm going to learn this mission. It's going to take a while. I am going to travel to the national labs, all 17, as best I can. I'm going to understand why all these agencies, why the government even exists to serve our country and the world."

One way I’d like to answer part of your question is, it's a yin yang thing. There's an opportunity for all of us to understand the role of the mission. There are 450+ agencies in the federal government. There's not 32, there's not 24. Every one of them has a mission, from the Smithsonian, to the National Nuclear Security Administration, to the Environmental Management Office at DoE, to the USDA.

Think about that as a technologist, a guy who was sold to for so many years. One of the questions I used to say to every industry partner that came in was, "Do you know what it is I'm doing in my role, in a $30-some billion agency, a CTO, to serve the mission."

That's when I realized there was a gap. I'm translating why it matters. How zero trust can impact our nation's 16 critical sectors, how distributed energy makes sense and doesn't make it about fossil versus renewable. But the technology, the one thing I say is never the problem, it's how we are implementing it.Who Are Keeping the Lights On

Pete: Your C-level, or the people in the data centers, in the basement, or the outsourced folks at these big large institutions, do you know that they're the ones keeping the lights on? Technology is agnostic. How you explain it to people is critical in terms of adoption. If we don't do it, that's where the inertia is created. It takes forever for us to realize the benefits of what technology's promise is.

Carolyn: You've said something a few times. I think what your focus is, is how to make life better for our kids, for our country, for the world. You actually mentioned smart cities. I'm fascinated by the idea. From what little I've read, there's a lot of potential with smart cities. The smart cities are a big step towards our environmental problems and improving our lives, for ourselves and for future generations. Can you talk about smart cities? What did you do in the Department of Energy with them? Start with what a smart city is?

Pete: Technology, humanity, and culture. It's interchangeable. Technology, we know we need it. Humanity, we want to live longer. I know we won't be here forever. We're not in the era of the matrix, from what I understand, even though it's a great movie. The machines, that's the futurist comment. But there's hope. We're living longer, but we need our air clean. We need our water treated properly, we need our cars to be safer.

I'm looking at my list here. You brought up smart cities, what makes up a smart city? Well there are 16 sectors that are deemed the critical sectors. Their assets, systems and networks, whether physical or virtual, are considered so vital to the United States.

16 Sectors Everybody Should Be Aware Of

Pete: Their incapacitation or destruction would have a debilitating effect on security; national economic security, national public health or safety, or any combination thereof. Straight from the DHS CISA website, there are 16 sectors that everybody should be aware of that should relate to our lives. They’re the energy sector, food and agriculture, financial, and government facilities. Those are the foundations for cities. It's our streets, it's our water, it's our air.

We love when we get, at least I do, a snowy day. But then when you can't shower, or you can't eat, or you can't get food, then you realize that Mother Nature is in control of some of this. Why are we not a more resilient city? We saw it happen in Texas last year with the freezing temperatures, and people died. The goal is safety, public safety. I always say, "Bad stuff happens, we realize how resilient or non-resilient, how we need to improve when a bridge collapses. Or somebody says, 'How did we not know?' or a tsunami hits."

So smart cities don't one day appear, a smart city is not smart because you put a sensor on a traffic light. A smart city is people getting smart, from city officials to those that have to make the investment in the technology to then deploy it. Then to figure out where's the data, how do I distill it, and is it protected? Yes, the world we live in, data is the new oil, data is the fuel, data is compromised. When that happens, we saw what happened in Colonial this year. We can shut down an East Coast pipeline because of ransomware.Pete Tseronis Puts the Word “Smart” in Front

Pete: Smart cities eight years ago were more like a smart grid. How do we make the grid smarter? Or how do we put technology on our power grid so that it stays up longer? So when bad things happen, people don't freeze to death, or there's a blackout and there are looting instances or traffic accidents?

The word "smart" is something I put in front of a lot of things: smart agriculture, smart water, smart air. It's really just the application of technologies and sensors to communicate, to tell us in real-time where things are at risk. I'd like to think that our most critical sectors, that critical infrastructure, that $1.2 trillion is now being made available as a result of the infrastructure bill. It will go towards making sure that the very things we need, the water, the air, the food, the bridges, the planes, trains, are safe.

Carolyn: So to be a smart city, they have to check the box that they're monitoring. That they're being smarter about critical infrastructure and at least three or four different areas. I still am unclear how you get qualified as a smart city.

Pete: There is no single definition. If you think of smart cities, it's the people. It's reexamining the process by which we do certain things to know how technology can make it better. I'll just use an example of potholes. There's a great company in Pittsburgh, RoadBotics, that, with a phone, takes pictures and sends them into the cloud. They're now detecting where all the potholes are. Why are some repaired overnight and others don't get repaired? It's about equity, societal and economic value.

A Smart City Defined by Pete Tseronis

Pete: A smart city involves tech. It also involves people becoming smarter about the tech and what those risks are and implications of deploying it in a city.

Carolyn: Is there a green component? Or is it more about being resilient as a city?

Pete: I like the word sustainability and resilience a lot. You bring up a great point. The reason there's this, let's look at distributed energies and microgrids and low Earth orbit satellites. Let's use wind power. It's just to say, if the coal burning and the nuclear power, it's not one or the other. We need a resilient grid so that when it goes down, it doesn't stay down.

Carolyn: Diversity.

Pete: Yes. And that's not sustainable in, "Oh, sustainable, I think of greenhouse gas emissions and carbon footprints." Yes and no. It's like, we don't want it to be down for a long time. That's why you'll see these days that cities want to be smarter, secure, and sustainable. On the flip side, it's reliable, resilient, and flexible.

How do you do that? We have to look at the integration of renewable and fossil fuels and nuclear power. At the end of the day, you flip a switch on, you want the lights to turn on. You turn on your water, you want it to be clear, not brown. Then you get in your car, you want to know, even...

With transformative technologies such as AI and Machine Learning, government agencies can help achieve goals, detect fraud, and create data-driven strategies. Chief Data Scientist and ODS Acting Associate Director at NTIS, US Department of Commerce Chakib Chraibi joins tech transforms to discuss his insights on helping the US Federal agencies and citizens use data to enhance any mission.

Episode Table of Contents

• [00:53] Delivering Transformative Data Solutions
• [09:00] AI Has Very Transformative Data and Technology
• [18:12] How Transformative Data Identifies Fraudsters
• [29:10] Virtual Reality

Episode Links and Resources

• Chakib Chraibi
• NTIS
• Data Strategy
• Immersive Van Gogh
• Baudelaire
• Deep Learning with Python

Delivering Transformative Data Solutions

Carolyn: Today, we got to talk to Dr. Chakib Chraibi. He’s the Chief Data Scientist in the US Department of Commerce, National Technical Information Service, or NTIS, and acting associate director for the Office of Data Services. He provides expertise and assistance to government agencies in harnessing innovative technologies and delivering data-driven solutions to achieve mission impact within the NTIS framework. Chakib, welcome to Tech Transforms.

Let's start with a brief overview of your role at NTIS as well as the role of NTIS within government agencies.

Chakib: NTIS is a bureau within the US Department of Commerce. We want to think about NTIS as the best-kept secret in government. What I'm going to say about NTIS is going to resonate with a lot of our listeners. NTIS is a very interesting agency that is focused on data science and data innovation. It was created shortly after the Second World War.

The main task at that point was to gather all the information collected from the Second World War that dealt with technical research, et cetera. It became a repository of information for the government. They dealt with any technical papers or publications from the civilian side. But in the 1990s, the internet happened. And so, we're still doing that. We have one of the largest libraries. We're continuing collecting that information, but Congress has thought about focusing us on a different mission at that time. It is actually a great idea, and which is about data science.

Our Main Focus at NTIS

Chakib: Currently, that's our main focus at NTIS. We provide a unique pathway for federal agencies towards innovation and digital transformation. We have an authority from Congress that allows us to seek out their partners from the industry, from academic institutions, nonprofits, to help federal agencies address national data center challenges.

It's available to all federal agencies seeking an agile capacity to scale. It has quick access to private sector ingenuity, and expertise, to meet critical mission data priorities. We also use a very innovative framework. It’s based on agile methodology to be able to harness emerging and cutting-edge technologies. We operate outside the Federal Acquisition Regulation, outside of FAR.

It’s in the innovation space, and it's really exciting. Whenever you want to innovate, you are not sure about how to go about it. All federal agencies want to be effective and efficient in accomplishing their missions and addressing data priorities. But, sometimes they don't know how to go about it. They have an idea about the business problems and what they want to achieve, but they don't have all the details, and the steps to go about it. That's because that's part of any innovative work that you're going to do. That is where we can help them with.

We have a very agile framework where they can come and discuss their business problems with us at a very high level and what they want to achieve. What is their mission? What's the most important thing that they want to accomplish? Based on that conversation, we can actually develop a problem statement. It’s a very high level scope statement that tries to address data innovation goals they want to achieve.A Free-Flowing Discussion on Transformative Data

Chakib: Once done, we reach out to our partners. We actually have a whiteboard session that is open to anyone. It's a very free-flowing discussion based on design thinking. Discussing what the objectives are and what they want to accomplish, what problems they want to solve, etcetera. That helps us refine the scope statement, and then complete that statement with our partners. We have a selection process, like a review that goes on to finalize the partners that will be involved in conducting that project.

We already have more than 45 partners from the industry. Of course, we have the big ones like IBM, Booz Allen, and universities like Stanford. There are smaller enterprise companies from Silicon Valley that are focused on very specific aspects of data science and artificial intelligence. They are part of our list of partners. The good thing is that, these partners can still partner with others. We don't expect everyone to know everything about anything. As long as they are the major players, they can partner up with others to complete the project.

Mark: How does industry engage with your organization? Do you and your organization determine what technologies and industry partners are getting involved with some of the things that you're working on?

Chakib: We have a notice in the Federal Register, asking for any company. We focus on and also encourage minority-owned businesses to apply, to become a partner, and we have a specific criteria. Our criteria is related to data innovation. If you can provide some value to the government in terms of data science, machine learning, artificial intelligence, and the related emerging technologies, we encourage them to apply.

Transformative Data Providing Specific Value

Chakib: We have a process where we have them evaluated by people from NTIS, as well as outside NTIS from the federal government that volunteer. They help us evaluate if they are providing specific value and meeting some criteria that we define in the notice. After that process, they become partners. Once they are a partner, then they will be able to compete for a project that we bring in.

Carolyn: You guys are like a technology innovation playground. You get an idea, you help the agency or group scope it, and then you put it into action. When you put it into action, do you actually implement it within the agency or do you have a lab that you model it in first?

Chakib: We are a very small agency. We are more like a broker. What we do is reach out to federal agencies and let them know about our services. We tell them, "If you're having difficulties innovating data in a data framework, then come with us."

The advantage in working with us is, we have been involved in several projects already with several departments and federal agencies. We have experience with what federal agencies are trying to achieve, the challenges that they encounter, and the type of solutions they should seek out.

When we talk with them, we always ask them about what their mission is and what they're trying to accomplish. We ask about the challenges that they are encountering and the support they need from us. That's how we start. We start with a specific problem. We can discuss later how we advise federal agencies to go about artificial intelligence. That’s an amazing topic there. It’s an interesting area to discuss.AI Has Very Transformative Data and Technology

Chakib: AI is a very transformative technology. It does require a big investment from federal agencies. As an AI expert, I tell them, "Get involved right away because the data doesn't stop, it keeps coming. Then it needs to be processed, accessed, cleaned, and prepared to be used." The models that you're going to develop based on that data, if they are predictive models, they're also iterative models. They need to be refined over the years, as soon as they're deployed and monitored. The sooner, the better.

Carolyn: When you say the sooner, the better for AI engagement, what specifically are you talking about with AI? Is there a specific technology that you recommend that they start with?

Chakib: I wrote a paper recently about the challenges and opportunities in the federal government, and the type of model they should use. I'm not saying that is the perfect model, but let me just try to identify some of the guidelines that I identified. In that model, I try to identify the challenges that all federal agencies encounter. The first challenge and the most important and the most immediate one is about data. We are moving from federal agencies in the IT infrastructure.

We used to have legacy-based applications, so we have a siloed application. So we had the data basically fed in a specific application, and things were going well at that time. That was really what you needed to do to accomplish a specific task. But if you want to really take advantage of data, that's one of our roles at NTIS. It’s to foster and encourage agencies to use data as a strategic asset for evidence-based decisions, to be more efficient, to enhance their processes.An Aggregation of Transformative Data

Chakib: All of these need an aggregation of data from different sources, internal and external. The first thing is to switch the model of thinking and the model of operation from siloed application into a more integrated data framework. It will come together whenever it is needed and with the flexibility that is required to address specific problems within the federal government.

Mark: Do you typically need a government agency or a customer to engage, to drive some of the work and innovation that you are working on? Or do you have the flexibility or the autonomy to do the innovation on your own and then take it to federal agencies where they might be doing some stuff like that?

Chakib: It is the former. The agency actually leads the project. That’s a great thing because they are really the subject matter experts. They're the ones that are really working on the specific aspects, and they know what works and what doesn't work. So they do it in collaboration, of course, with the partner, but they have to lead the project.

Carolyn: Without revealing national secrets, is there a favorite project that you've worked on that you can think of?

Chakib: I can tell you the department agencies that we worked with. But, of course, I cannot be very specific about what we do. Some of them have agreed to allow us to publicize that. So, I'll focus more on those. One of the projects is the USAID Presidential Malaria Initiative. The goal of the project is to control and eliminate malaria.

We are now going over a pandemic that has been one of the worst calamities in the history of humanity. But malaria has been around for several centuries.

An Important Project

Chakib: It’s a subtle life-threatening disease as well. It is caused by a parasite which transmits it to people through the bites of infected female mosquitoes. It's preventable and curable. In 2019, there were about 409,000 estimated deaths from malaria, 67% of that were children aged under five years old.

This is really an important project for us because we want to help USAID and the US government. We want to help the countries that are affected by malaria throughout the world and save lives. In our work, we have helped USAID design and build a platform that they call the Malaria Data Integration and Visualization for Eradication platform, with the help of a partner. It includes storage and organization of malaria and related data, literally in different formats, different structures, and different languages.

The goal is to aggregate all that information, collect it, integrate it, and then help them do better evidence-based decision-making. Predict and identify high-risk areas based on geospatial and weighted data. Better manage the preventive supplies, such as mosquito nets or insect repellents. Eventually, to implement some low-cost malaria competitive solution in resource struck area to machine learning tools. This is an important project that ultimately has an amazing outcome.

At the same time, it's also a model for other agencies about how it's important to combine the data, how even geospatial or geographic data can be combined, protected, and secured, and providing self-service capabilities. That is what we always try to encourage federal agencies to do within a program or within a region where the program is applied. To provide them with user-centered, self-service capabilities that allow them to enter the data, process the data, and do the initial cleaning and preparation for the data.

Technology Is Transforming Lives

Mark: It sounds like we need to connect you up with some of our friends over at CMS because they're dealing with this thing. They probably could use your help, Chakib.

Carolyn: What your department is doing is just what I love to talk about. Technology, literally, is transforming and saving lives. We’re using technology and data to do better.

Chakib: The pandemic has been a calamity and one of the worst disasters. But the silver lining is that it has helped accelerate digital transformation across all industries, definitely in the government. That is definitely a momentum to be using technologies to achieve our goals. Actually, we're working with HHS-OIG in one of the projects that we are developing. This is our eighth year working with them. We started many years back. It is an interesting example to discuss because it shows the progression of what federal agencies are bound to do to benefit from artificial intelligence and machine learning capabilities.

The issue that they had is that they were working in siloes. Then they had the data in different areas of the country. But fraud exists in California as well as in Florida and they usually use similar patterns. So, why don't we bring that knowledge together, aggregate it, and help everyone take advantage of others' experiences? One of the aspects that we helped them with is to use sentiment analysis. Use social media posts to include them as part of the information that the investigators and auditors need to better identify fraud patterns.

Carolyn: You look at their social media to detect their mood, where they might be leaning politically or otherwise?

How Transformative Data Identifies Fraudsters

Chakib: We try to identify if there is any pattern. One thing that the fraudsters do is that they keep moving. They create a company and they keep moving. The underlying patterns are there, they keep repeating them. But they have become more and more sophisticated.

The advantage of using machine learning is that we can actually be on top of those. You can predict what type of new patterns that they're going to develop instead of just using simple rules that were used before. Where they say, "Okay, if you see this and that, then let's look into it." Now, we can actually have the machine learning algorithm model tell us in advance, "Okay, this is the type of pattern that I see. I believe, with a certain level of confidence, that this might be fraudulent."

That's the fact that we see in the future of machine learning and artificial intelligence, it’s working very closely with human beings. It's an augmented artificial intelligence. What we do with HHS is that, when an investigator or an auditor comes in, we try to make their life easier. We spend a lot of time automating the tasks that should be automated, because they're tedious. There's no need for a human being to do that unless just to check if they're correct or not.

Then, we try to surface which cases can be the most beneficial for the American people, for the taxpayers. So which one will give us a better return based on the time that the investigator units spent, because we have limited resources. All of those are really important in terms of trying to address the fraud and wasted abuse within the government in general.

Incredible Tools for Complex Issues

Chakib:  But in HHS, we’re using these incredible tools that help us basically sift through the data, identify the patterns, and surface some areas that we need to focus more time on as human beings.

Mark: Those are complex issues that you guys are working through in a lot of different areas. It's fascinating work that you all are doing. You have a very long and distinguished academic career. How do you perceive some of the differences in working in the academic world, compared with the government world?

Chakib: I started in the industry with one of the largest computer companies. Then I moved to academia where I really enjoyed it a lot. The difference between academia and government is very little because it's all about service-oriented, mission-based activities. I joined the government because I really love the NTIS model, what we do. I'm fascinated by these fields that are exploding, which are data science, machine learning, and artificial intelligence.

I strongly believe that this is not just another technology. It's a transformative technology that's going to directly affect us in many ways. I see my goal, and that's why I'm very active in social media. My participation is to inform the public about this awesome power that is AI.

One aspect that's related is that I started in academia. I'm also working on the side of looking into it. Participating in some forums that try to foster collaboration between government industry and academia, for instance, called Responsible AI. We're trying to look at how we can make sure that AI is actually applied the way we intend it to. Without bias or being harmful to us in some way, short term or long term.

Commerce Data Strategy

Chakib: It's such a complex issue. Then, at the Department of Commerce, we actually published a Commerce Data Strategy late last year. One of our action plans is to develop some data ethics that we're going to use at the Department of Commerce. As part of the Federal Data Strategy, there is a push to make sure that we understand how AI and the data we use can impact any application we do. We try to prevent and mitigate any issue that relates to equity or bias. So, that's very important as well.

Carolyn: You've reminded me of something that I've heard other data scientists and other AI experts say. AI is going to make us more human because it will free us from the menial, over-repetitive tasks that we don't really need to do. If we can be freed from those, it gives us more space and more time to devote to innovation and ideas. I would love to hear your thoughts on...

In an AI driven world, the role of intuition and experience can be hard to define. Kris Saling, Chief Analytics Officer for the Army Talent Management Task Force and Director of People Analytics in the office of the Assistant Secretary of the Army M&RA joins Tech Transforms to give insight on talent management within government agencies.

Episode Table of Contents

• [00:41] The Analytic and Technology of Talent Management
• [07:35] Ensuring Unbiased Data Talent Management
• [16:28] Talent Management Prediction Vectors
• [22:21] Quality of Life
• [31:58] Talent Management in AI Analytics
• [38:39] How Do We Ensure Trust in Talent Management

Episode Links and Resources

• Kris Saling
• M&RA
• Army - Talent Management
• Footprints
• Arthur Conan Doyle
• Be Data Literate
• Balance Myth
• Mad Scientist
• More Intelligent Tomorrow
• Game Changer

The Analytic and Technology of Talent Management

Carolyn: Kris Saling is Deputy Director Army, People Analytics, and the Chief Analytics Officer for the Army Talent Management Task Force. She coordinates analytic and technology solutions, rights policy, and resources innovation to promote data-driven decision-making across the Army's people enterprise. Kris, welcome to Tech Transforms.

Kris: Thanks so much, and I'm really happy to be here. This is going to be fun.

Carolyn: So I want to start off with a two-part question. Let's start with the awesome poster behind you, of Sherlock Holmes. Tell us the story behind that.

Kris: There are a bunch of stories behind that. The big one is people ask me why I went into data science out of all the things I could have gotten into. My usual answer for them is because I read too much Arthur Conan Doyle when I was growing up. I just love the idea of sifting through all this information, finding clues, and solving problems, and that just persisted.

That's up there for some motivation, but also a huge Robert Downey Jr. fan. He established a smart AI, a corporation that specializes in sustainability work through AI. It's called Footprints. He took the whole Tony Stark thing and decided he was going to make that his real life.

Carolyn: I'm loving him even more. I've always been a big fan. How can you not be?

Kris: Yes, save the planet through AI, how can you not love that?

Carolyn: Before we move on to your job, do you have a favorite Arthur Conan Doyle story? What's your favorite Sherlock Holmes?

A Long and Unusual Story

Kris: There's so many of them that stick, but I'm trying to remember the title of it. It's one of the first ones where he first meets Watson and just some of their banter. It is a really long and unusual story. Half of the story is a flashback where he's talking to the perpetrator, one of these crimes. He is talking about his migration across the wild west frontier. Going to have to try and remember what that was, but it's just the meeting between him and Watson.

Just the dynamic of this very straight-laced professional, trying to sit there and figure out what the heck he has in this certifiably, insane new roommate. But the fact that they connect on the intellectual level, it just makes that dynamic all kinds of fun.

Carolyn: Do you remember?

Mark: It's like Jarvis.

Carolyn: Do you remember how old you were when you first got hooked? Your first story?

Kris: 12 or 13 I think?

Carolyn: So now we know what inspired you to get into the line of work that you're in? Mark and I are really intrigued by your titles. Is it HR or is it operations? It's super cool. You have a quote that says you're leveraging AI to leverage AI. Will you unpack what it is that you do to include how the USA fits in?

Kris: I have two bosses. One of them is the assistant secretary of the army for manpower and reserve affairs. The other is the director of the army talent management task force. In both of my roles, I essentially have the same portfolio.

Applying Talent Management in People Analytics

Kris: My short way of explaining it is it's all things talent data and data talent. So doing a lot to revitalize how the army is looking at its personnel management systems. I’m going from just transactional human capital type work to actual people analytics. We're starting to look at not just quantity analytics, but quality distribution employment. How do we optimize performance, but then also how do we do targeted retention to keep our top talent? Those kinds of problems.

On the data talent side, I run a planning team that looks at the army data workforce. I've run this for about two years now. We look at how we do talent management for the folks who are doing everything. From our very high-end analytics, building AI solutions, doing very high-end data architecture to just what does basic data literacy look like for them? So all of that fits within this really broad portfolio.

I've been really fortunate that my bosses have allowed me to essentially build my portfolio. They just come at me and we're giving you some free space to think about what the army needs to understand about its people and what kind of talent we need to make that happen. So go play and I swear this has been my favorite job in the army, it's so much fun.

Mark: Who are your customers then? Are your customers commanders over certain areas and then you're looking to help them as far as how they field their organization? Or it's not really operational or logistics type stuff?

Kris: Oh it is. One of the projects we have ongoing right now is a campaign of learning where we are.

Data Talent Management

Kris: We’re trying to see how far down in the operational army we push data talent and how we build the supporting architecture. How do we build the supporting environments that we need in order to do analytics at that level? Also, how do we make it accessible? But then, how do we train up not just the data professionals who are going to be working at that level, but also the commanders to interpret the information and turn it into action, into decisions?

Mark: When you talk about the architecture, is that the architecture of the human capital and the resources that you're providing to do whatever the mission would be?

Kris: There's some of that. Some of it is process engineering, the rest is actual data architecture. Have we developed our pipelines in order to be able to push data safely and securely to these organizations that haven't previously had access? They've had to send RFIs or requests for information up higher.

We don't want them to have to send in a request 48 hours, two weeks, whatever it is later, they get some analysis that you've all seen the requirements model where it's like playing telephone. The more steps you have in between the person who actually needs something and the person who's going to deliver it, the more it gets garbled.

We want to be able to have commanders ask their questions to the right kind of talent to interpret it appropriately. Understand what is needed in the data and be able to engineer that solution. Now, it might just be a couple of folks and at that point of the question point of origin, basically with reach back capability up in the higher ranks.

Ensuring Unbiased Data Talent Management

Kris: But again, we're still campaigning and learning. We're experimenting with what works best and what's the best use of our talent.

Carolyn: Do you have challenges with ensuring that the AI is unbiased?

Kris: That's a challenge everywhere. The idea that AI is ever going to be unbiased is like saying that humans are ever going to be unbiased because we all use biases.

Carolyn: It's really just an extension of us.

Kris: It's only as good as the decisions made by the people who program it or the decisions it's learning from.

The way you get around bias in AI is the same way you get around bias in an organization. You bring in a lot of diverse perspectives, you bring in a lot of quality control. And you ask a lot of the “what if” questions.

So you have to go back through and essentially triage the model when you're developing either a machine learning model, deep learning model, or you have AI making those decisions and those recommendations. But part of that is going back through and looking at what the model's keying in on. Is it actually making decisions based on stuff you want it to be making decisions? Do you need to hide some of the variables?

There's an example I used. There was an AI that somebody created a few years ago to predict winners of the academy awards. It turned out, it was just keying in on anything Daniel Dan Lewis was in. It’s just like, "Okay, granted that is correlated." But we don't want you predicting based on this. He might turn into a lemon.

From the End Game Backwards

Mark: You mentioned in a recent interview that you look at the problem from the end game backwards. This builds on the question we just asked because it seems like a very difficult thing to do. If you start with the end game, then aren't you basically saying this is the outcome we want to see? How do you create the algorithm to give you something that well? You don't know and you don't want to necessarily point it to the answer. But you want to see what you might be able to get out of it without doing that.

Kris: It's beginning with the end in mind. When we start looking at the outcomes we want to generate, we have to focus on something. Train the model and sometimes that focus is a proxy for what we actually want it to focus on. More and more, we're getting our folks to build things using very modular, reusable, very tailor-able code. If we decide we want it to do business in a different way, we want it to key in on something differently. Then that's fairly easy to go in and modify.

We're doing this right now with some of the predictive tools we're looking at for performance. The way we're looking at performance is based on how the army currently measures performance. But we have a number of efforts going on to change through our campaign of assessments on how we measure performance. We need that to be something we can iterate on later. One of the things that we've keyed in over time for the army has been that there's no more end states.How Intuition and Experience Helps in Process Improvement

Kris: We're not going to plan toward an end state. Something isn't just like a one and done, this is continual. We've got to keep upgrading, and we've got to keep developing. We have to keep this thing adaptive and learning. So if we get more traction on that, then we generate more of a flavor process improvement.

Carolyn: Your job sounds really broad. I heard you say you use AI to source new talent, retain talent, and help identify talent who's going to be best on this or that mission. Identify talents who should be on these different teams.

Kris: That last one is something we're trying to get to. We're doing a lot of job competency studies right now to see what's actually required for different positions. We don't have that in the granular level of data that I'm looking for to be able to make some of those recommendations. What I envision out of our marketplace is eventually, you get a recommendation engine, it starts looking like Amazon. Since you like this job, you might also like these. Since you did this job, these might be the next best for you based on your capabilities.

So we have an effort right now to basically make an intelligent individual development plan where folks can go through. See where their skills might best lead them or pick goal positions down the way. This can show them, "Okay, here are the gaps in your current resume." My eventual dream for that is here are the gaps in your resume, would you like to sign up for a class? Would you like to take a self-initiated assessment or to talk to your career coach? All these different ways that we can help them bridge that gap.

Where the Army Needs To Be

Mark: It sounds like you're working with the leadership of the army to determine this is where the army needs to be in 5, 10 years down the road.

Kris: That was the charter they gave me. It's just like, "Okay, what do we need to know about the army? What's your 10-year life plan?" I'm like, "Oh this is going to be fun."

Carolyn: I had never really thought about using the AI for this purpose. It makes sense and I'm wondering about your role, how new is this job? For other organizations, even in the commercial world, is this a thing? Or is this a thing that you're creating right now?

Kris: This particular job is one created for the army. I've been in and out of the MNRA for the past six years which is unusual for an army officer. Normally the PCS has a lot. But I started out in the G1, the Army's director and personnel working on how we actually use our data. How we collude all of it together out of all of the different systems we have spread throughout the army in a way where we can rapidly access it and utilize it to solve problems.

We put together what was at the time called the Human Capital Big Data Plan. It just basically directed consolidation of all our personnel data into this massive data warehouse that we house out in Monterey with the research facilitation lab. From there, we've grown a number of different initiatives. We started using this data in creative ways. We've really started to see the gaps between what we need, as far as data, to answer our questions.Asking the Right Questions

Kris: We see what we don't have and basically if we are asking the right questions. I noticed, I didn't quite address this, the leveraging at leveraging AI to leverage A?  AI takes a lot of data so we are making more data. We're using natural language processing and optical character recognition. A whole bunch of other techniques that fall underneath advanced analytics umbrella to go through and read old evaluations. Read files, transcripts, and all of the stuff that we have that's sitting in TIF files in our repositories at human resources command. We’re trying to turn that into more usable information.

Carolyn: How much data are you crunching every day?

Kris: A lot.

Mark: Is this more of a future state for us? Is this a state now where we're able to take advantage of this?

Kris: This is now, this argument. We have this argument with future commands, a lot. It's like AI is not the future, AI is now because right now at RFL, we’re supervising seven separate AI projects. We're actually using an IBM Watson implementation and a couple of other things to do AI projects and predictive modeling. One of those that we mentioned before was retention prediction.

Hopefully this February, March, it's already been tested for a trial. We're just waiting to get it up and accessible. The RPMA, the Retention Prediction Model Army, we've got this in partnership with the Institute For Defense Analysis. We're just putting it into our systems and getting it hooked up to all the right data feeds. But it creates an individual vector of attrition for every active duty person right now.

Talent Management Prediction Vectors

Kris: We can say based on this quarter, next quarter out to 20 years from now, what's the likelihood we're going to retain this person. That's cool, but the best part of it is not just the individual aspect. It makes it really easy for us to combine that data. Look at those prediction vectors by demographics, by particular skill sets, by commissioning source, by a point of recession.

We can really figure out trends in who's staying and who's going. Where we need to do some targeted retention efforts if we're going to keep the right talent that we need for the future. We're also trying to develop some algorithms to help us figure that out of our marketplace. We want to have something that looks like LinkedIn's talent insights, where you start seeing demand go up for certain skills.

You've got your human resources professional. Well, this person also needs to have a background in analytics now because we're seeing all these things. We wanted to pop up in the marketplace and tell a commander, "Hey, we're starting to see this demand signal here. Do you want to add this to your request?" Yes they do. I also want to be able to funnel that information to our schoolhouses as we're developing the training talent. So that they know, "Hey, this is an increasing demand in your field. You need to make sure that we have this in the program of instruction."

Carolyn: Do you collaborate?

Mark: Are you looking across the army into the warfighter needs? Are you talking more like IT and some of the different skill sets like that?

Project RIDGWAY

Kris: No, our best client in the campaign of learning right now is the 18th airborne corps in the 82nd air board division. They're doing Project RIDGWAY which is their move toward becoming an AI-driven corp and division. They have a number of different exercises that have gone on through that process to test how they're going to use this information. To see what they need to automate, how it's going to change their business processes and their decision flow.

We're looking at supporting them with this talent. But then, we're also looking at how we do it at the high level. What does the leading edge for these capabilities look like? We've got army research labs working on this. We have the AI integration center of Carnegie Mellon looking at this. Also, we have a future command doing a lot of great data science work. We have the center for army analysis. And we have a lot of folks who are really digging in and looking at what the future looks like.

Carolyn: You're collaborating a lot within DoD and Carnegie Mellon. What about industry at large? You mentioned LinkedIn insights. Do you collaborate with industry?

Kris: Frequently. We're actually trying to leverage some of the collaboration with academia and industry that our air force partners have done so far. I talk a lot to the guys who found a digital university. They have a lot of networks going with both academic partners and industry partners and how they're developing their curriculum for their advanced analysts. I do have some other partnerships going on with various vendors that we're trying to...

Logistics of supply chain could be the difference in a successful mission for on the ground forces or the cyber warfighter. Scott Hume, managing director of operations in contested environments at MITRE, speaks to the importance of tactical planning and innovation to assist our troops. Carolyn and Mark discover the best ways industry can assist the warfighter.

Episode Table of Contents

• [00:47] Globally Contested Logistics Strategy
• [07:17] Supply Chain Challenges
• [13:47] Constant Intellectual Property
• [21:28] Globally Contested Supply Chain
• [30:27] Robot Dogs

Episode Links and Resources

• Scott Hume
• MITRE

Globally Contested Logistics Strategy

Carolyn: Today's guest, Scott Hume, is the managing director of operations in contested environments at MITRE. Scott has been with MITRE for more than 20 years. He’s responsible for shaping the company's globally contested logistics strategy, particularly for one of its sponsors, the US Air Force.

Today we're going to talk to Scott about how our government and our military enhance their capabilities in contested environments through partnerships with industry and academia. We’ll also discuss how the industry can best connect with the DOD to help safeguard our nation and support our military.

Let's start out Scott with how MITRE does a lot of work with the Department of Defense. Can you tell us what areas and with which military branches you do work with?

Scott: Let me first start out because some of the audience may not be aware of MITRE. In fact, when I came to MITRE over 20 years ago, I was disappointed that we weren't the company that made soccer balls and soccer cleats. I quickly learned that MITRE operates R&D centers for the government. One in particular is the Department of Defense, which is our National Security Engineering Center.

Particularly of the 20 years, I spent the majority working with the Air Force. But MITRE works across all branches of the Department of Defense as well as the combatant command and the joint Chief of Staff. Throughout the Air Force, I always say that I've had seven different careers. At MITRE, I've been able to work in IT, cyber, command and control, programs, as well as counter improvised explosive devices. So counter IEDs during the war on terrorism.

Remembering Pearl Harbor

Carolyn: What area of the military and the branches are you working with?

Scott: Primarily I'm working with the Air Force, leading an opportunity to develop MITRE's globally contested logistics. Let me break that apart for you. When we talk about logistics, it's really anything from fuel, water, ammunition to food. It’s getting equipment as well as our forces to the locations that they're going to have to fight in.

The contested pieces, I'll pause for a second and remember the day of December 7th, 80 years ago. So on this day today, an adversary decided to bomb Pearl Harbor and our forces there. That was the last time that we actually were in a contested environment across the globe. Where we didn't have freedom of maneuver, freedom of navigation and we're in that environment today with our pure adversaries.

We no longer have the full freedom to move our forces or supplies, like some would call the greatest generation. Perhaps we can meet that same call as we look at how to, first of all, develop the capabilities our DoD needs to deter that fight with a pure adversary. But if that pure adversary chooses to fight, we have the capabilities to win and execute that fight. If you look at the logistics piece of it, it goes all the way back to the Napoleon wars.

Napoleon once was quoted as saying, "Logistics wins the wars." MITRE is not a logistics company nor are we looking to get into that business. We're looking at how we provide our system engineering and integration expertise to this domain. If you read the 2018 national defense strategy, you don't have to read the classified version. There's an unclassified version that's out there.

Understand Logistics and Supply Chain

Scott: You quickly will understand that logistics is our underbelly. The way that the DoD has positioned itself for conflicts, it takes months. We move massive amounts of material and it's analogous to the way the Hume family goes on vacation. Whether it's two days or two weeks, our suburb is packed with everything that we might need.

That's how the logistics community is when we go to these conflicts. You saw that in some of the withdrawal of Iraq. Why did we have all of that equipment? Some of it may not have been necessary. Because we plan and go to war by doing, "What if this happens? Well, then I need that piece of device."

Mark: Is that because of the reality of geography that we're typically fighting wars across oceans and that's just challenging in its nature?

Scott: Moving equipment, fuel, water, I believe 80% of it is fuel and water, and that's a huge challenge. Also as you brought up, our conflicts over the last have been more of a way game. But we will get into this. I'll contest that there's a home game fight to this with a pure adversary, especially if we talk about cyber and other EW, electronic warfare and other things.

Carolyn: You said that the logistics are our underbelly. Do you think that's true for other adversaries or is it really unique to us?

Scott: It becomes more of a logistical challenge when you're fighting in an away game. So if you're fighting and it's a home game for you, you have more access to your supplies. That itself is a challenge.

Supply Chain Challenges

Scott: If we look at our pure adversaries, whether it's China or Russia, if we focus on China, you're looking at the tyranny of distance across water that we would have to rapidly move supplies, whether that's sealift or airlift.

And then just things we can learn from going through this past pandemic, our supply chain challenges. If we look at the cyberattack on the gas pipeline in the Southeast just recently, that starts to get you thinking about this home fight. We will fight in all domains, whether it's air, land, sea. There'll be a fight in space as well as cyber.

So if you want to cause chaos or slow our movement down, a cyberattack on our critical infrastructure in the United States would severely impact this fight. If there was a fight, they talk about war of annihilation, a war of attrition, or a war of exhaustion, I don't think we're looking at annihilation as I don't think anyone would escalate up to nuclear level kind of thing.

Attrition could happen. A conflict with a pure adversary becomes a war of exhaustion. If you can exhaust our capabilities to resupply our forces, that's crucial. Then look at using all avenues and fighting in all domains.

If you think about this logistics piece, I'll start within our own United States. How do we get, not only the defense industry base, but our manufacturing up to the speed that we would need to be able to manufacture goods and supplies? And how do you protect them from those cyber attacks? Many of our traditional logistics suppliers don't have SIPRNet. They don't even have NIPRNet. So they communicate in the open. How would we protect that?

How Do We Protect the Supply Chain

Scott: You have to get those supplies into the theater, the challenge in and of itself. Then how do you get those supplies and protect those supplies? How do you get those supplies down to the tactical edge for when they need it in a matter of days?

Carolyn: I feel like you explained what contested environments mean, but I'm not 100% sure. Figuring out how to secure the supply chain, secure the communication lines, is that what you do?

Scott: That's one aspect that MITRE's looking at, working with our DoD sponsors. There's also the contested piece. I talked about jammers. They will jam our communication so we won't be able to communicate. We mentioned a fight in space. So imagine not being able to have our satellites or have satellite communications.

Our peer adversaries have radar technology that will be able to detect our fighters, detect our Navy as well. We won't be able to just kind of roll in onto the country of one of these peer adversaries and just go deploy the Army like we did when we went to Iraq or went through Afghanistan.

Mark: You hit on so much stuff here, Scott. We could spend an entire week unpacking this. Those different domains probably are massive efforts.

Scott: When I describe that from the industry base to theater supply to the tactical edge, most people say, I'm describing one of the most complex system engineering problems that this country faces within the DoD. It's not an elephant that I'm talking about. It is a herd of elephants. How do you decompose each one of those?

Many Facets of Those Elephants

Scott: There's many facets for each one of those elephants that we have to look at. That's one of the values that MITRE brings. We try to look at these hard complex engineering problems holistically from that defense industry base or even small businesses, or academia. Look at how they could help, all the way to that warfighter at the tactical edge on an island in the Pacific.

Mark: Are you specifically working with the Air Force or is it a broader kind of audience that you're having these conversations with?

Scott: It's broader. I primarily work with the Air Force. But in this case, when we're talking about globally contested logistics, it's broader DoD. It's beyond the DoD as well because we need to look at our allies and partners. So how do we work with the state department? I talked about the home game aspect of this. It's working with the Department of Homeland Security as well.

We call it a great power competition in this competition phase. There are aspects of commerce and treasury that are involved as well, diplomacy. The military is just one aspect of this. There's all of the government that needs to be looking at this.

Mark: It feels like a multidimensional or four-dimensional arena that we're trying to manage and use to our advantage.

Carolyn: How does industry help with this? Mark and I are on the industry side. What are best practices for industry to support our military and to help with these problems?

Scott: If we break it up in certain aspects, let's talk about the supply chain aspect. How do we protect our supply chain, how do we protect our businesses from cyber attacks that are involved here?

Constant Intellectual Property

Scott: We don't have constant intellectual property being evacuated by our competitors. From that aspect, how do we look at leveraging new technologies like autonomous drones, things like that? Perhaps it's an unmanned aircraft or even sea vessel that is delivering a logistics package on that island in the Pacific. How do we look at technology from that aspect of it?

Then also looking at aspects of 3D printing, additive manufacturing. Imagine if you actually could quickly 3D print a part in the middle of the Pacific so that you could get a plane back up and running. Instead of having to wait for it to be shipped to you or flown to you. There's a lot of different technology spaces that could apply here.

Carolyn: How does the DoD prefer that industry engage? What's the best way?

Scott: There are avenues which industry can engage with the DoD. You can always look for requests for information, RFIs if they have or requests for proposals through the acquisition community. But I would say one way that industry can engage is also through MITRE.

MITRE's role is to be that bridge between industry and the DoD in this case. I'm on LinkedIn, you can find me on LinkedIn for our folks. They can reach out and connect there. There are many aspects where industry can play here again to help from all aspects of globally contested logistics.

Mark: Thinking about the supply chain and all the challenges we seem to be having in civilian life.

Carolyn: Just getting our Christmas stuff.

Mark: So the military has TRANSCOM. Aren't they like military logistics? Isn't that their charter?

Aggregating the Supply Chain

Mark: I wonder if Secretary Buttigieg is working with the military to help them with stuff like this. It just seems like that's a perfect area where those two entities can work together to try to solve problems.

Scott: No criticism with TRANSCOM, but TRANSCOM has been used to doing logistics in permissive environments. They've had months to aggregate supplies.

Mark: Not days and weeks?

Scott: Again, not to be critical of it because there are some great things that TRANSCOM did, but disaggregating our supplies in Afghanistan was a huge challenge for them. There's a cultural aspect of how we do things differently. There are concepts of operations that need to be rethinked.

How do we analyze our data to be more predictive on our logistics front, and be more predictive on the health of our aircraft or rotary vehicles? There's a lot of aspects in the supply chain whether through the pandemic or the supply chains that we're all facing in our lives now. It's all something that we, both industry, academia and others, can really rethink about how we do our logistics differently.

Mark: Can you spend a minute or two delving a little bit into the cyber side of this to talk a little bit about this whole concept of the contested logistics, as it relates to the cyber side of it.

Scott: I see the cyber side of it will definitely be a huge play in this. So many of our industry bases have some network defense capability. But probably not the most latest or many companies don't even have a cyber framework that they're following.

The Attack Framework

Scott: MITRE has what we call the Attack Framework, which is readily available off of mitre.org. It talks about how industry can leverage different policies, procedures, or capabilities that they should be looking at protecting their business from multi-facets.

Mark: Are you talking about more of the defense industrial base or all like industry?

Scott: I would recommend all industries. In particular, our defense industry base, which they are looking at. Our financial institutions are heavily involved in cyber protection. But if you look at the supply chain where we have minerals that we must need, are those minds protecting their network? Probably not.

It hadn't occurred to them to think about those. That raw material, where it's getting manufactured, if you shut down that factory through a cyber attack, imagine the impact that could have.

Mark: Have you found or heard about industry's willingness to participate in this collaboration or do you find that industry resists this?

Scott: From a cyber protection perspective or from contested logistics?

Mark: Just working with the military.

Scott: There's been some hesitation for some of their industry-base. I would say the non-traditional defense industry base to work with the military. The military has gone on a campaign to open those doors more to small businesses and other nontraditional industry bases.

I hope to see our fellow patriots stand up and want to work with the military. From a cyber perspective, cyber has become more pervasive in our society. With all the different attacks that have happened, you're seeing the industry base really step up there.

What Contested Logistics Supply Chain Means

Scott: When we're talking about globally contested logistics, we spent five minutes just having me describe to you what contested logistics really meant. There's an awareness campaign that a lot of folks just aren't aware of. The environment or future environment in which the military would have to conduct operations.

Carolyn: MITRE facilitates this between industry and government. Can you talk about how MITRE would go about developing options to deter attacks on the supply chain, cyber, critical infrastructure? What does that look like for you? Like a day in the life of Scott.

Scott: MITRE's role is one, making sure that we can help our DoD capture what those challenges and problems are. What kind of requirements are they looking for, whether it's both operational requirements or technical requirements? The MITRE, often we would start to look at what a prototype might look like to help flush out those requirements.

That's where we can really look with, partner with industry to see if there's technology that can be integrated into those prototypes. Often, it's not just one capability or one piece of software or hardware. It's often looking at it from a systems of systems approach.

MITRE's role is looking from a system engineering perspective. It’s looking at how we integrate different capabilities to maybe solve that challenge space for the DoD.

Carolyn: When you say prototype, it’s like you're developing an architecture or a process or a plan rather than a single prototype. Am I interpreting that right?

Scott: It could go from an architecture framework. It could also be an actual no hands-on prototype, not one that MITRE produces or sustains. We're not in that business but one that could just help visualize what a system of systems could do.

The Coolest Prototype

Scott: I wouldn't even call it a .1 version. It's more of a 0.2 version. Those in the software world would know. That's something that helps the DoD then understand what the requirements are. How they could use those systems and then be able to go through the acquisition process.

Carolyn: What's the coolest prototype you've ever worked on?

Scott: One of the coolest ones I did is called Localize. The premise behind this was when I was working counter IED. So counter improvised explosive devices. The premise about Localize is it was using your phone. It was allowing Iraqi citizens to let US forces know where these IEDs were being hidden, whether it was under the ground, in a building. The premise behind it was instead of trying to find a needle in the haystack, the IED being the needle, you turn the haystack into sensors to tell you where that needle or that counter IED is.

Carolyn: What do you mean it uses your phone?

Scott: This was an app that MITRE developed, prototyped, and actually transitioned it to industry to produce it.

Carolyn: It sniffed out IEDs?

Scott: It allowed citizens to report IEDs.

Carolyn: You crowdsourced?

Scott: Yes. It was an earlier version of crowdsourcing because this was back in 2005.

Carolyn: So you're saying MITRE invented that term crowdsourcing? I'm just kidding.

Mark: MITRE invented the term raid parties.

Scott: That's a thought of how MITRE has a concept that we're thinking we're working with a DoD. They're like, "How do we get this concept?" So we build a little bit of a prototype and then see if it can be operationally used.

A Technology Transition

Scott: And then do a technology transition to an industry partner to take it further, build upon it, produce it, and maintain and sustain it. But that was one of my favorite prototypes that I worked on.

We integrated the early use of facial recognition software on it, which we were able to integrate as well. It allowed our force protection folks to be able to test out, if there was someone that was of...

"Technology is easy: Everyone is doing it, culture is the challenge” says retired Navy Chief, now Defense Consultant, & Cyber Educator at Deloitte, Katy Craig. When it comes to implementing new technology, a trusting environment can make all the difference. In this episode, Carolyn and Mark learn why prioritizing people is always a step in the right direction.

Episode Table of Contents

• [00:48] Helping Teams Accelerate
• [09:34] The Point of the Mission
• [20:08] Better Minds on People Problem
• [29:09] Technology Is Transforming People Problem

Episode Links and Resources

• Katy Craig LinkedIn
• Deloitte
• Zero Trust: An Enterprise Guide
• Minority Report
• 4 Stages of Psychological Safety
• Black Mirror
• The DevOps Handbook
• The Phoenix Project
• The Unicorn Project
• The Goal: The Process of Ongoing Improvement

Helping Teams Accelerate

Carolyn: Our guest today is Katy Craig, a retired Navy chief. She's now a defense consultant and cyber educator at Deloitte. We're going to talk about her work, helping teams accelerate to deliver value safely and securely to customers.

She provides guidance on tools, technologies, and methods such as cloud security, agile methods, SDX, Zero Trust, and DevOps practices. One of my favorite topics and Mark's as well, is shifting security left for DevSecOps and continuous everything. Today, we're going to dial into how she helps teams embrace a DevSecOps culture, some of the biggest pitfalls, as well as best practices.

I read something on your bio and I was like, "I love that!" You say in your bio, "Technology is easy. Everyone is doing it. Culture is the challenge and where I can help most." Talk to us about that.

Katy: I'm trying to think if I can legally hashtag it, the people, s*. I actually Googled it. Somebody did back in the '90s after President Clinton said, "It's the economy, s." Somebody actually said, "It's the people, s*." But I want to bring it back into the lexicon and into the vernacular. Because a lot of these buzzwords that we're hearing in the zeitgeist, DevOps, I need to go buy some agile.

We're going to do some DevOps. They're selling Zero Trust, let's go buy that. It is rarely turnkey solutions out of the box. It's rarely the technology that all these vendors are selling on the internet and promising it’s going to be the panacea.

People Problem You Have to Deal With

Katy: No matter how great your tool, your weapon, or your process, if the people don't embrace it, they aren't brought along, and aren't included in deciding that's the tool we're going to use, that's the process we're going to embrace, they're going to fight you. They're not going to adopt it.

Maybe even in a bureaucracy, they might eventually go along to get along, but it will be delayed. It will be less of a quality approach. It's always going to come down to the people. We always have to remember that our reason for being here, for being in tech, for doing all this work has to come back to the people. I always go back to Gene Roddenberry and Star Trek. I'm a Trekker, sort of directive. You can do no harm.

What are the Boston Dynamics people doing? I worry about the robots. It's got to come back to the people. If we're doing this tech and pursuing all these areas, it's got to come back to: is it going to be good for the people? Is it going to make our lives better, make the planet better, or our country better? That's why I say, "You know what, everybody's out there peddling technology. Promising that if you install my platform, I'm going to solve all your cyber problems." It's just not true.

Mark: Are you talking about the mission? Or are you talking about getting the people on board with the technology to be able to leverage and use it? Is it the people as it relates to the mission, or is it the people as it relates to getting them on board with the technology, and how it can help them?

Unique People Problem of the Military

Katy: It does go to the unique problem of military teams, for example. We have administrative control and operational control. Then we have organizations in the military that acquire their technology. They decide whether to make or buy the technology to serve the warfighters who are operating the technology. Those separations are real. They're part of the challenge because of how they're organized, regulated, supervised, overseen. They spawn bureaucracy.

So the people, in their way, the policymakers need to understand that they themselves have a lot to unlearn. That takes a lot. It takes so much vulnerability in ourselves to say, "I need to relearn how to do acquisition." Using taxpayer appropriations to buy this capability is different in 2021 than it was in 1970, A1 Abrams containerized application.

We can't levy the same amount of oversight. The speed, there's so much delay in that type of bureaucratic oversight. For software, we can't move that slowly. So for the people to embrace that there is a new way of us living and fighting and being in the world during great power competition. You'll hear the military leadership talk about how we've got great powers rising and near-peer adversaries. There's a lot of saber-rattling.

They need to understand those people, policy makers, legislators, government leaders, that the way that they look at acquisition and technology needs to change. The users, the war fighters, are actually ahead. They are aware of what could be, the art of the possible. They’re playing 4K UHD video games online with multi million players. They know what technology can support and do. They're used to using game controllers, joysticks, and getting information very quickly.One Person Can’t Solve a People Problem

Katy: Getting the warfighters, that group of people, to embrace the technology is easier in a way. What we need to do to help those people understand that bureaucrats are victims too. It's not like one person can come up in a bureaucracy and change it all.

Carolyn: You said prime directive. Do no harm.

Katy: Star Trek.

Carolyn: We can lose sight of what this is really all about, the reason we do all this. Yes, there's the mission. But the whole point of the mission is to make our lives, our families' lives, the Earth, to make it better for us. To be happy, to be healthy, the prime directive. As you were talking, I'm like, "Oh, I can get so focused on: Well, is this about the mission? Or is this about technology?" But what it's all about is us.

Katy: And helping us, the warfighter, the program manager, the citizens, and the family. We send volunteers off to join the military. It's not a job. They raise their right hand, swear under oath, give up certain rights and privileges, and do very dangerous work for us. The whole idea and goal really, if you adopt the people first concept, is let's not shed any blood at all. Let's avoid war.

Carolyn: Peacekeepers.

Katy: Let's keep the sea lanes open. I know the Navy, and so the Navy mission is one that's most clear in my mind. Let's support democracy worldwide and try not to allow human rights violations. Let us do good for the environment, just all those noble things that are supposed to bring all of us up as people.

The Point of the Mission

Katy: I always come back to the person, the humanity of the situation. Acknowledging that they have their hopes, dreams, aspirations, no matter who they are. Working side by side, or serving alongside, or delivering to a customer, all people, we all should consider the person first.

Carolyn: That is the point of the mission. That gets me to these things that you educate on.

Mark: That was an incredibly rich answer. We could peel that bad boy back for the entire discussion today. You were hitting on so many different things. If I can dig in to just more of a specific thing. Explain to us the importance of DevSecOps to someone in the military.

Carolyn: What you do with educating at Deloitte. With the DevSecOps, why is that important and how do you explain it?

Katy: It depends, and that's the standard cybersecurity answer. It depends on the audience and who's asking the question. Why is DevSecOps important to me? It's the government authority, the government program manager, the mission to accomplish your mission, and delivering capability within cost scheduled performance. Let's do it fast, but let's do it safely.

We bring it down a little bit lower to the program managers on the contractor side. Why do I have to do DevSecOps and why is this important to me? These cyber people that you've got on the team, they're very expensive. We don't have enough of them and they don't scale. So we're going to try and use the technology to automate some of the routine tests and scans. So that your limited fill-in-the-blank engineer can do more on this product.

It’s Important to Communicate a People Problem

Katy: For the developer themselves, who doesn't know anything about security and probably has never been incentivized to care about delivering security features, it's important to communicate to her if you build in this control. If you build in this check for multi-factor authentication, then down the line, to the left and the right, in the linear pipeline of delivering software, then we don't have to test for it further down the right. So depending on who's asking in the organization, why should I care about DevOps, or DevSecOps, that determines how you address the response.

Mark: Is this any different for the military or outside the military?

Katy: Yes. The example I just gave you was the last team that I was on for a military organization.

Carolyn: Is it hard to get them to buy into the idea of DevSecOps? Does it add a lot to their workload?

Katy: What I find in bureaucracies is the bureaucrats are incentivized to go along. The bureaucracy is there. Everything about the incentives support the bureaucracy and the bureaucratic processes. When you try to tell a government client, maybe a two or three-star admiral, we shouldn't plan to do that gigantic operational test two years from now.

We really should be building in the six week sprint little tests. And we really should not worry about all the outputs and all the requirements that you need to know so that you can brief them up to your higher level authority. We need to remember that going outside of that process usually results in negative consequences.Embracing DevSecOps

Carolyn: Is that the culture now? I've been in this world of people that I'm surrounded by all the time, really embracing DevSecOps. So with what you just described to me, I hope I don't offend too many people, but it sounds very archaic. Is that really still the culture?

Katy: It is, absolutely. You have to remember that Kessel Run, Platform One, these are all huge paradigm-shifting successes. They get a lot of media coverage. It's easy for us to conflate those successes with, okay, it's enterprise-wide, everyone's practicing it. No. We are absolutely not. Depending on who happens to be in charge determines risk aversion, risk tolerance.

If I'm a two or three-star admiral and I don't like being the first person out there, let me try this, then I'm risk-averse. I'll be like, "No, I don't want to take that approach. We'll follow the documented process." That official over there is going to audit our stuff. We've got to back up our schedule 90 days for that because everybody in the bureaucracy has to overlay their checks.

Self-licking ice cream cones, justify my work and my job because this is how I'm incentivized. This is how the organization has hired us. These are the standard operating procedures. My performance reviews and merits and promotions depend on how well I do this process. Everything about it fights the change. That's why you see this.

Mark: That change happens about every two to three years.

Katy: No.

Mark: Well, that leadership swaps out.

Carolyn: The leadership changed. I think you're saying those are the bureaucrats.

People Problem Is Subject to Bureaucracy

Katy: Yes. I don't mean bureaucrats as an epithet. I’m using them as people who are subject to bureaucracy. Even in large corporations, there can be bureaucracies, and “red tape”. This is how we do it. It's not that anything intentionally started off maliciously, or ineffective, or inefficient.

But what we know in real life and on the ground is, if the people don't embrace the change, if the people don't think it's a good idea, if the people don't support that shift or pivot, it's not going to happen. Or it's going to take a long time. They may even outwait you.

Carolyn: Is that where you have to start? Really at the top, at the bureaucratic level, and get the leadership to buy in and have that initiative come down? Have you done it both ways, top-down, bottom-up? Which works better?

Katy: Again, cyber answer, it depends. It depends on the organization, and the openness of the organization. To bring it back to the people, it depends on the people that you're working with. The change has to start simultaneously top-down and bottom-up. We do have these, we see these pockets of innovation and small groups of military organizations like the Navy in San Diego.

I'm familiar that there are some engineering organizations that are experimenting with building strong, safe, psychologically trusting teams. They're workshopping, taking new approaches to communicating and collaborating. Making the best use of what we've learned over the forced remote work during the pandemic.

Better Minds on People Problem

Katy: They're realizing now, I don't need my team for nine hours, butts in seats outside my door. We can do this remotely and we can get better minds on the problem. Actually, we can use this to our advantage to increase our diversity and bring more people to help us solve this problem. If only we can get out of our way. Let's unlearn all these old ways and try to embrace what Silicon Valley has proven.

They proved that you can do it better and faster and safer, as long as we remember we're not Silicon Valley. This is the US Military or the federal government, and citizens and taxpayer dollars. We can take what they're doing, the best of it, but we can pragmatically apply it. Keeping in mind the people that we're talking about and what those people need to do their jobs, to protect us.

Carolyn: When you go in to set up, to help implement and educate on embracing DevSecOps, what are some of the best practices? Or let's look at something really pragmatic here. Where do you begin? What do you see as best practices for these teams that actually started out super rough, but then, they really embraced this philosophy and they do it well?

Katy: My experience has proved that if you get to know the people on your team as individuals, try to remove all the transactional stuff, it's not I need you because you're an awesome coder. I really want to get to know you because you're my teammate. We're working together to solve this, or accomplish this mission. I don't know if it's a blessing or a curse, but what I do know is military leadership.

Know Your Sailors

Katy: I was an Army brat and then I joined the Navy when I was 18. I’ve been a chief in the world's finest navy, and part of a mess, a chief's mess, that teaches and encourages and lives, “get to know your people.” Your job is to know your sailors. I do this on the teams too.

Know your teammates and know what's important to them. Where did they come from, and where do they want to go? And remember it. It's important because you're trying to make authentic, genuine, personal connections. So that you two together can do better work to deliver on the mission. Remember who they are and what they want because you probably know somebody who can help them.

That six degrees of separation comes into play, and that's what chiefs do. The mess is worldwide. It's like I know a chief on that ship, or I know the master chief over there. My guy is transferring. Let me connect them. Do that with your teams. Encourage them to get to know each other. As a leader, facilitate that with ice breakers and fun.

Carolyn: Do you do that? As a consultant, do you do things to facilitate this?

Katy: I encourage things like books, happy hours, and getting to know each other. I recommend 15-minute coffee talks, and for the teams to get together. In tough times, when we're facing what seems insurmountable challenges, that's when you really get an opportunity to get your team to bond. There's this term in the military, we call it trauma bonding. I know that maybe other industries refer to it for things like Stockholm syndrome and kidnappers.

Mark: Healthcare professionals.

Difficult Challenges and People Problem

Katy: Yes. But really difficult challenges can be traumatic. In the military, you're faced with those quite frequently. Getting through those types of challenges can form a bond that will last your entire life on both sides. I'm not saying anything as heavy or as serious as that is going to happen with every connection that you make, but it could.

Even in the tough times, if you work together, the better you know your team and you know you can rely on them, and they have your back and you have theirs, the more successes you get through. You can build those types of lasting relationships, even in the industry.

Mark: When it comes to implementing DevSecOps in the military, or the Navy in this case, what pitfalls have you found or have you come across?

Katy: It's the separation of authorities. When you think about how the military's organized and the authority is, and where they get their money, and all the congressional oversight on how the money is spent, we can't negate the importance of it. Your tax dollars, my tax dollars, are very important that they spend it wisely in the way that...