Full Transcript for Broadcasting from the 9/11 Memorial & Museum Summit on Security

stories of very famous people who had their Twitter accounts taken over because they use the same password in my Space and the bad guy's got access to that. So it's it's taking advantage and giving them an idea of what they're up against and explaining the why you need to make these changes that I think help the overall culture and the overall safety of the company. So take me inside the range. What does it look like, what does it feel like for people who are going through it? So the range is designed to prepare for your worst day, so we will work with the customer and figure out the industry, the key aspects of stuff. You walk in there and now you're part of a fake company and we're going to literally put you through your worst day. We have concepts around media, we have concepts around regulators, we have concepts around your training, and how does this all come to get together on your worst day? Who's in charge? What's my next move? What's my priority? What is the company's north star? Is is it the customer that's my north star? Like, you don't find out where you are on your training or other aspects until it's underload. It's really important to realize that we've get a lot of run books and they're about an eight in quality, but when you put them underload, there about a three. Because they don't train like you fight and fight like you train. So we we they discover a lot of gaps. They want to as soon as they're done, they want to go right back home to the office and they're gonna They've got an action list of things that are gonna implement right away, so they get a good feel of you know what, you're validating what we're doing well. But you've also opened our eyes to things we haven't seen before, blind spots. The use of confirmation bias under a crisis is crippling. They assume that's the insider threat, and it wasn't the whole time, but they cannot let it go. So they trained to understand the physical reactions, the human reaction, the process reaction. Who do I call next, what do I need to do in the next twenty four hours, what are my priorities? And you don't do that until you train for it. And so in here in twenty nineteen, I feel like we're having this near existential debate around privacy versus freedom of access, freedom of movement. The smartphone obviously has changed everything it feels like in our daily lives, both personally and professionally. How do you sort of come down on that? How do you help people understand that balance? So when you think about the most mature customers, they always want to train for you as an individual at home first, if I make you a better spouse, a better mom or dad, uh, dealing with your kids and your cell phones at home, that awareness, that ability to understand comes into work and that is a great way to do it. So so if you make it personal for people, they better understand those things. There is. Cyber is one thousand percent about risk, and there's a balance of Someone said today there's no such thing as perfect security. It is how do I lower the risk? That is Christopher Crummy. He is executive director of x Force Command that IBM Security talking there with Bloomberg's Jason Kelly from the nine eleven Memorial and Museum Summit on Security. You're listening to Bloomberg Business Week with Carol Masser and Jason Kelly on Bloomberg Radio. Well, and welcome everybody to this very special edition Bloomberg Business Week. I'm Jason Kelly downtown Manhattan here at the nine eleven Memorial and Museum. And Alice Greenwald, you run this whole thing here with the cast of thousands, fair enough, and Frank Physignano, president and CEO of By Serve, also a board member here at nine eleven. Alice, this is a big day, the second year you've done this. Tell us the purpose, Well, the purpose of the Summit on Security is to bring together individuals across sectors, so from the private side, the public side, government, corporate, so that there can be a joint conversation about preparedness, the nature of the threats, how you recover from events, and really from our point of view, it's a perfect example of the continuing impact of nine eleven, the things that we have to pay attention to as a result of the world we now live in. And so what has really stood out to you today, the second year you're doing this, We were talking a little bit about this before we came on here. Let's really jumped out at you theme wise this year, So the theme has been primarily about cybersecurity, which is obviously a threat at every level of our lives. UM. But what has struck me most is that the conversation has bridged both the cognitive practical what you do, how do you deal with it? What are the ways you know you've got a problem, how who do you partner with? But also the heart. So it's been hid and heart and there's been a lot of conversation today, including Frank kicking it off this morning, UM, that has been about the motivation for this awareness of the need for security coming out of personal nine eleven experiences. Well, and Frank pick up on that, because you did. You kicked it off so beautifully this morning on a very personal note, your own remembrances of nine eleven, but also talking about everything that's happened in between and the work that you're doing now, both professionally in your day job as well as your work here, helps set the tone in that regard for us. Well, I think it's about preparedness and advance, about partnership. If you were in the Sacred Place on nine twelve, Uh, in that year, you have seen partnership at its highest possible level, people all across America coming together, uh to bond. And when you take that thought and say we can protect ourselves by sharing, by partnering, we will be much better prepared. And that means government, that means businesses, that's every form of law enforcement and sharing because protection is the number one thing for us to work on in preparedness and in the event of any disaster. And I think, uh, it

was always on everyone's mind, but now it's completely in the forefront, and the partnerships are very high and very strong. Well. And it's interesting, Frank too, because it feels like a lot of that sharing has been demonstrated in the financial services industry. You've been a long time in that business, it's a very competitive business. We all know that, and yet financial Services has been able to share around this in a way that maybe is unexpected. Why do you think that is Well, I think everybody recognized that the greater good is the most important thing. It was our our financial markets, our stock market that wasn't operating during that disaster, and that's good for no one except the bad guys. And we all united to bring it together to get it back up and running. And everybody understands help each other. When we were walking on those streets Greenwich Street, everyone was created equal and everyone believed that they had to help each other. And today in war Manhattan, when you come to this fabulous, fabulous sacred place, the Nino of a memorial and museum, all you see is teamwork, partnership and people caring for each other. And Alice, it was interesting. You know. Admiral Mullin, we're gonna hear from him a little bit later on in the show. He was here in part to help unveil a new exhibit that's going to be open to the public this weekend about the hunt for Bin Ladden ultimately uh successful after many many years. Tell us a little bit about that exhibit absolutely and thanks for asking. Revealed is opening on Friday, November fift It's called Revealed, the Hunt for Bin Laden and it tells the story we all think we know, we all know the ending of the story. We know where it leads. What we don't know is how we got there. And this is really a phenomenal telling of the work. It took, the coordination across law enforcement, military, UM, you know, intelligence agencies, domestic and international. It was a hugely coordinated effort that but longer than a decade, so before nine eleven until May um and that level of coordination, what it took. And as you go through this exhibit, it unfolds like a mystery. Even though you know where it will lead, you are riveted because each moment is peeling away the layers of UM trying to find this man. What the leads were, some of the leads and nowhere, and some of the leads actually led to a bottom us well, And as Alice says, Frank, so timely, you know, given the capture of all Bughdatti as well, uh most recently, it reminds us the world is not a safe place in many ways. And I wonder how do you think about that from your business perspective? Because you have responsibility for so many transactions, so much money moving through the system. How do you think about it today? Well, you know, most of my career I worried about this, and uh, it's top of mind. It's top of mind for every CEO, for every senior executive, protecting, protecting your people, protecting the assets of your clients, protecting your shareholders value. And so it is the number one item. And you make sure your defense is as strong as humanly possible. Um. And it's never good enough. Every day you come in and say, never good enough, and you can never feel safe enough. So um, it's a constant drum beat. It's ah, it's you build uh an organization around it. You make sure you have great organizational awareness. And then connectivity of organizations matter. You know, any piece of data and information and that may seem trivial may actually protect you very very much. And having all partners work together is critically important. So speaking of connectivity, we are blueberg. After all, the last time we talked, you had not done the big deal. I believe that you have now done. How's that going? It's going great, it's going great. You know, we have an unbelievable company. Fi Serve is U is alive and well and strong. Uh. You know Fi served before Verse Data was this great brand and great economic machine. First Data had a lot of fabulous assets in it. We're fortunate that we could put them together and build what we think is the best fintech in the world. Well, Alice, it's a beautiful day here in Lower Manhattan. What's the biggest priority for you going forward? Um? You know, the biggest priority is thinking about the next generation. You know, we are coming up on the twentieth anniversary of nine eleven, hard as that is to believe, and twenty years is a generation conventionally speaking, And already we are seeing people who are in college with no memory of nine eleven, Young professionals coming out of law enforcement training from the academies, no memory of that day. And yet they are moving into careers like security, moving into careers in the financial industry. And we believe that the world that they are inheriting has been conditioned by the events and repercussions of this event. So we are here to help them connect those dots. And I think that's going to be our most important purpose going forward. Alice Greenwald, Frank Dosignano, thank you so much. We should also mention, of course, at Michael Bloomberg, the founder and majority owner of Bloomberg LP, also serves as the chairman of the Non eleven Memorials and Museum. Thank you both so much. It's been a really interesting and powerful day here at the nine eleven Memorial and Museum. Earlier in the day, I got to catch up with Jen Easterly. She's managing director over at Morgan. Stanley worked in Army intelligence for many years the n s A in the White House. She's a graduate of West Point of former instructor there, and she talked about her job on Wall Street and what she's doing encountering all sorts of new threats. Take a listen. Obviously looking at the threat landscape now, we still have the physical threats from groups like ISIS and al Qaeda, but now dealing with cyber significant cyber threats from nation states, from organized criminal group threats from the weaponization of data for things like disinformation that

really corrodes our trust and people and institutions, and so things like that that we have to worry about, both for attacks against critical infrastructure, but also attacks against things like things like reputation are hugely important, right, And I'm so glad you brought that up, because at the core of that conversation, it feels like increasingly the conversations that we're having are much more holistic and focus on people and not just the the bits and bites and and the really wonky technicals off that you understand and I don't, but I do understand the concept of bad actors, and so how do you combat that instan You know, I often say that cyber security is not about computers, and it's not about code. It's about people and frankly, what we what I think we really need to worry about. Obviously, you know, there are significant cyber threats, and so we've done a lot across the whole banking sector to protect our assets and and our clients. But at the end of the day, it's attacks against what I think is our most critical infrastructure are cognitive infrastructure, the way that we make good decisions and our judgment, and that's being impacted by a lot of these disinformation and malinformation campaigns through the weaponization of data. So you're right, I think we need to to look at the threat landscape very holistically, from the physical threats to the cyber threats to the threats against facts. Frankly well, and it sounds like one of the ways you combat that is with better people in some ways and training them in a different way. Tell me about that human capital is really critical here. You know, you need people, you need process, you need technology to be successful in the cybersecurity world. That I think talent is the most important. You know, researchers estimate that by the year there will be three point five million unfilled cybersecurity jobs around the world, and you could argue were already in negative percent unemployment, so more jobs out there than people. So there's much we have to do to educate, you know, clearly our employees and our clients about the threats that are out there in cyberspace. But I really think we need to look at this problem much more comprehensively. We have to we have to start with the youngest among us. One of the things that I've been working on is part of a new nonprofit called Cybernation, and the idea is to bring together the world cyber and technology experts with the world's greatest storytellers to demystify cyber so to inspire, to inform, to educate from K through gray, from your digital natives to your digital immigrants, because we all need to understand what's the technology, what are the threats, are their laws and cyberspaces, their privacy online, and then ultimately what it means to be a good digital citizen. When you think about your work in the financial services world, as you said, you came out of the public sector working in the army, you worked in the White House, you worked in the n S. A part of what you are now faced with is cybersecurity when it comes to one of the fundamental building box of our society, which is money. And it does feel like banks and financial institutions have invested heavily here. What are you seeing now? Because you are charged largely with looking around the corner. I see my mission now is really an extension of what I've done through most of my career in national security, which is really defending our economic security. I mean, given that a big bank is so fundamental to to national security, so I think you're right. I mean, the banking sector is ahead of this problem, and we had to be because we were attacked pretty signific pigotly in time timeframe. We're a group known as the Al Kasam cyber fighters, later identified with the Iranian government. We're doing what was called distributed denial of service attacks, essentially launching massive data website so that people couldn't get to them, and it caused a panic. It was for the first time it illuminated the vulnerability of our critical financial infrastructure. But off the back of that, UH Banking really got ahead of this and put in the right programs, the right process is, the right technologies and started really investing in that talent so that we could strengthen the sector and some of the things that we've done to come together very importantly to share information. I was incredibly encouraged to come from the White House to the banking to the financial sector to see how much sharing there is both within the financial sector. So you know, big banks are super competitive about talent and super competitive about business, they're not competitive about sharing information. That's going to keep the sector safe. And there's also good sharing between the government as well as the private sector, and that it will continue to grow and strength and hopefully in the coming years. And so you know, you talked about that sort of k through Gray. I'd love that phraseology. But when you think about your own business and the talent gap there, how do you fill that? So we have been successful so far in recruiting the folks that we've needed for the for the Fusion Center, but we've reached pretty far afield. So we of course had great talent within Morgan Stanley from an engineering standpoint that we brought in to help build the center, but we've gone out to academia, We've gone to the military, we've gone to the intelligence community, some of the other banks, some vendors. We have really built sort of a village because it does take a village to be successful in cybersecurity, and it's not just about coders or developers or programmers. You do definitely need that skill, but you also need analysts who can help you understand the very complex and dynamic cyber threat environment. You need incident responders who understand how to reverse engineer malware. You need crisis managers who can deal with a major threat or a major vulnerability. So it's really

building, uh, this fabric of talent that's brought in from places all around the world. Because we're in New York, we're in Baltimore, where in Glasgow, we're in Singapore, so we're truly global, and so it's tapping into a global talent market. And then you know, my biggest challenge has not been recruiting necessarily, but it's retention because in a world where there are so many opportunities for cyber talent, you have to really cultivate an environment that enables you to retain that talent. And you know, you need an environment of psychological safety. Frankly, where people can bring their imagination, they feel like they're actively, actively listened to, where they can bring great ideas to the table, and that I think is the key to retaining your your best and brightest and that is Jen Easterly. She is managing director over at Morgan's Stanley, looking after all of their cybersecurity, coming out of the government to do that job. Over the course of her career, she worked not only for Condoleeza Rice during the George W. Bush administration, she worked for Susan Rice. Under the Obama administration, she worked in the n s A. She was an Army intelligence officer deployed all sorts of places overseas. She has seen the threat up close and personal that conversation talking about sort of looking around the corner but also having the right people to do it has really been a key theme here at the nine eleven Memorial Museum, UH and Summit on Security. Well, let's move to a conversation here at the nine eleven Memorial and Museum Summit on Security. Greg virgin is here with me. He is the CEO at Red Jack participating in the conference. Here. Greg, great to see you, Thanks for having me. All right, So tell us Essentially, I was gonna say why are you here? But I know why you are here because this is a really important series of conversations that's happening. What are you sort of taking away as the main themes here? Yeah, there's been a lot of conversation around, UM. For for what I talked about vote security and UM, a lot of that had a lot to do with information online through social media and UM, how we can trust information and the concept that while there's plenty to be said about hacking a vote there, you know, voter manipulation is is also a problem. Well, I'm glad you said that because what what seems to becoming clear And I spoke with the Craig Newmark earlier, and obviously he's done a lot of work in this area as well, and in several other conversations I've had on the sidelines and on air here it becomes very clear that we need to be worried about the humans, not the technology in some ways, and the manipulation of humans. So how does technology sort of help us do that? Well? You know, the way that I described this earlier is a lot of people coming at this from the cybersecurity side. I like to think in terms of malware. So you take a system and you hack into it and break it, or you socially engineered the people who run it. But you know, the

way that a lot of these systems online work. They've got inputs, which is what you've done in the past and what is trending online, and then they've got outputs. So if you want to exploit that system, you can exploit the system itself, or you could change the inputs. And I think that's one of the interesting things that we kind of have to contend with over the next decade right well, and certainly over the next year as we looked toward a presidential election. What have we learned over the past couple of years that we're now going to apply in this all important you know, presidential election in you know, um, this is a tough thing to really study. Yeah, I think that's one of the problems is we need better ways to understand how Um you know, they're they're all sorts of fake news campaigns and like bots that so these sorts of fake sources of information on social media, and um, you know, we we know that's bad. We know that. Uh, like a news article that tells a lies is wrong, right, But what if there are hundreds of thousands of sources of information and that can change that first news article that you see when you bring up your Facebook. Um, Like, so I think that first we need to be able to study that a little bit better. But you know, for for me, I'll be very intentionally getting my news from a bunch of different difference sources to make sure that I'm not relying on like anyone platforms way that they're curating information for me and essentially having to do some sort of human triangulation in some way sort of in your own mind. You know, I do wonder you know your background. Keep me honest here, I believe that you worked for the d O d worked on the government side. How do you sort of actively make that transition and sort of take that knowledge and take it to the private sector. Uh, you know, UM, I've been looking at it's a big question. And UM, I've been looking at internet scale data for eighteen years. And UM, you know, we talk a lot about these really acute problems, and I've been looking at the noise on the Internet now for so long that it's just sort of like our immune systems, right, we're just immersed in these cybersecurity issues, and we've it's become a part of the DNA. UM. You know it. I think that from from my perspective, just helping people understand how the Internet works. And one of the interesting data points which researchers found, uh, of all of the hashtag I've voted tweets around the last election, we're from they were from robots. Wow. Yeah, And and uh, you know, it's easier for us to focus on, um like contentional sources of fake news, but you think about that, like some hackers decided that they were going to manipulate a system that way. Uh, and we've kind of got to wrap our heads around the implications of that, where you know from my career doing cybersecurity that phenomenon is not very strange, right, Um, but it's it's not the sort of thing that we're all going to be able to understand until people from my background trying to explain it well. And that I'm so glad you said that, because part of it really is about explaining. You know, Jenny Easterly who's here at the conference and I we're talking earlier, and you know, she's working on some projects related to essentially marrying the science with storytelling in a lot of ways, sort of helping people understand How do you go about doing that? You know, because you have a lot of smart people, I would put myself in the category of being relative of lee smart who do not understand fully you know sort of and and it don't have any sense of of our our depth of knowledge that that you do. But how do you explain it to someone who wants to understand, um and has a has good intentions of being genuinely curious about it? Yeah, Well, you know, I didn't go into computer science because I've got social skills. Um. I I think that, Um, you as an industry, we need to figure that out. Um. You know, I I studied biology and chemistry also, so I like to use analogies that we need to find real world analogies that aren't just warfare, right, because, um, what this space looks like is um like, the the ability to infiltrate to exploit systems on the Internet is like it's relatively straightforward and low risk for adversaries to do that. Yeah, it's calling it an attack doesn't exactly work, right, Um. You know, from the perspective of what I used to do, it makes a lot of sense. But um, you know that the Internet is just kind of dirty place, you know, like I've I've got three little kids and they go to school and don't wash their hands. Right, that's a lot That's really a better analogy. Yeah, I'm glad you said that, because I do feel like one of the one of the things that I feel like has taken some residence here is this idea of hygiene, right, you know that that we have to think about this, uh in to a level of as you're alluding to, sort of cleanliness in a lot of ways and having good habits in the same way that you know, I'm sure I'm guessing your kids are the same as mine where you have to remind them to brush their teeth, which is a disgusting idea that you have to remind someone to brush their teeth. But here we are, we're parents, we understand this, um. And yet those are the sorts of things that we don't uh necessarily think about in a figurative sense in terms of how we operate in the in the virtual world. And I think another important concept is resilience. So it's the idea that that's the way that reality works, and we need to do things in a survival by way, uh, in ways that comply with regulations. Um, you know, we we need to be better at doing it. We need to clean up the the d n A and and and the backbone of how this stuff works and um you know security too. But really I've been trying to shift um, you know, the way that I'm doing business around that concept resilience. And so what does resilience sort of look like in practice? Yeah? For companies? Yeah, I think that what we've seen in the last couple of

years as this trend towards destructive attacks, destructive breaches where for for years and years it was like somebody stole your data again, Um, but now we've seen more and more, like big companies being down for days, weeks longer. Um. And so we need to be able to survive that sort of an attack. Um. I believe by being able to just stand up all of your infrastructure somewhere else, which means you really have to understand how it works. Um. And it also sounds like you need sort of the buy in beyond the I T department. For too long, these things have been he's like, oh, that's an I T problem, or that's a problem for the security guy, or that's a problem for like the tech guy who's gonna fix my phone. Yeah. Well, and you know another issue is when you when you go into then moderately sized environments, I T has become so complicated that people don't really understand how it works anymore. Right. So, um, so much of this is our ability to understand it right to begin with. So, so, okay, we need to make it resilient. How does it really work? Um? You know, we we use a bunch of automated ways of doing that, but you know, I think we can kind of apply that principle to individuals. Right, Right, let's talk about how all of the stuff you use online really works, Like a half an hour of that can help people really understand how to protect themselves. Well, it's a great conversation to keep on having A really grateful fee for spending some time with me, Greg Virgin, CEO over at Red Jack. He is part of the nine eleven Memorial and Museum summit on security here in Lower Manhattan. Thank you so much. A nice segue from our last conversation with Greg Virgin to Craig Newmark. You probably know him is the guy who created Craigslist. Yep, he's that Craig. He's spending a lot of time in the philanthropic world right now, including talking about election security, and that is why he's here. Check out this conversation. The country is facing an attack, particularly on the integrity of our elections. I feel that I can modestly help the people doing the real job of protecting our elections, which is the same as protecting our country. My contributions are modest, but somebody's got to do it. And so, how did you come to this? Because you've been very specific and focused. It feels like in your philanthropy you have identified I believe, sort of three major areas. How did this become one of them. Well, came through the confluence of an of a number of paths. One is that I'm interested in cybersecurity, and yet our foreign and domestic adversaries are attacking voting systems using cybersecurity methods. There's also information warfare, where bad guys are using so called influence operations or maybe just call them dirty tricks to attack elections, to attack voting rights, that kind of thing. And finally, in my interest in a journalism and related ethics, a lot of what the bad guys are doing are trying to uh, trying to paralyze our country by getting disinformation like conspiracy theories into mainstream news, and one of the worst effects of that is to get Americans angry at each other for no real reason. These are ways that our foreign adversaries and their domestic allies are hurting the country and hurting our elections. What was the if there was a moment, what was the aha moment for you? What did you see out there? Was there a certain action, was there a certain election? What was it? Well, in recent times it was the two thousands sixteen election. But as I think more and more about my motivations, I think about my high school U. S History teacher Mr. Schilsky forty fifty years ago telling us the importance of the free press and protecting the Bill of Rights as amended prior to that in Sunday School, Mr and Mrs Levin saying that bearing false witness is bad and that we should strive to prevent that. Um. That sounds a little bit Pollyanna, but those are my motivations speaking as a nerd a guy who takes things literally right well, and you have very much embraced your nerd um over the years, and and clearly that led you to be I don't think it's hyperpoly to say, you know, one of the most influential people in really creating the modern Internet are certainly the way that we use it. What have you seen in terms of the unintended consequences? I guess I've seen a lot of good people connecting for the common good. But then I've also seen the very small number of people working in the other to hurt other people. Uh. In the beginning of the net, we didn't prepare well to handle the bad guys. We're learning how to do that now, we're learning how to make the Internet a much more resilient place. And when you think about what is working in terms of solving those goals, you're funding a lot of those efforts. What is working well, what's beginning to work is that people doing good work solving pieces of the entire puzzle. They're making progress with those pieces. But people like me are getting the people who are so far isolated, getting people to talk with each other to combine their efforts. That's maybe the biggest single thing I'm doing. I'm getting to talk with each other. I'm getting to alert the public of what's going on. And you know, because I've I've been lucky and I've been privileged, I can write some checks to help the good guys work together to defeat the bad guys. So one of the interesting things, Craig, is this intersection of your work around journalism and around election security. What is that nexus? Well, the immediate nexus is two wells is too. Part one is that bad guys a foreign adversaries and the domestic allies. I figured out how to game the rests, meaning they figured out how to introduce disinformation and generally phony news such that American citizens don't get the information. Uh, they need to make smart decisions Meanwhile, they're also using cybersecurity techniques to attack our voting systems, possibly in subtle ways. For example, um, they're working with oh their domestic allies to purge voters who shouldn't be purged. What's worse is we fear that they might do things like taking a legit amid election the registration record, tinkering with it such that when the person goes to vote, they have to file a provisional ballot. And if a bunch of people do that, that slows down the line a lot. The thing is, we know that's a thing, and that's a thing that can be prevented, and people like me work with the people who do the actual operations. Again, my contributions are small. I get people to talk to each other and help out. Um, that's not a big thing in itself. But a NERD's gotta do what a NERD's gotta do, and that is the self describe nerd. Founder of Craigslist, Craig Newmark himself spending most of his time on his philanthropic efforts around election security, supporting independent and fair journalism as well. I caught up with him here at the eleven Memorial and Museum Summit on Security. Thanks for listening to Bloomberg Business Week. You can subscribe to the podcast on iTunes, SoundCloud, or Bloomberg dot com. You can also listen to our radio show every weekday at two pm Eastern only on Bloomberg Radio h