Transcripts For CSPAN Deputy 20240703 : vimarsana.com

The white house has taken an active role in taking a public role to embrace technological change but also to ensure security and responsible guide posts are included. This mornings fireside will be moderated by brad, the executive Vice President , both alan, the featured speaker for this important discussion, the honorable anne neuberger, the Deputy National for National Security council, the white house. Please join me in giving these two a warm welcome and a round of applause. [applause] good morning. I think i can speak for everyone in this room, it is an honor to be here today and welcome back. I know you got in from a flight last night. It is terrific to be here with you. Good morning, all. We are excited to have an on conversation about the cybersecurity and National Security. I thought we would get started. Great. We are going to start by taking a moment to reflect. Youre in the third year of your role. You have accomplished so much, and theres so much happening, ransomware, russia and ukraine, russia tax on Critical Infrastructure. I would like to start by getting some of your thoughts. And finally, we are probably a nation of laws, regulations and morals that guide our work. Not all of our adversaries operate in the same way, making it a more complicated space, particularly when we talk about the semiCritical Infrastructure, which is operated by the private sector and governed by strict rules. Those three principles, attack is easier, it is easy, the shift from hardware to software and the regulations governing our work make the victories, while significant. We will always be in this forever war. To your point, i often think about the three ps. What are they . Preparation, international partnership, and the private sector. I we ask ourselves the white house a core question to see where we are and track progress in all the work we do. We first want preparation. Ukraine has showed us that the work that was done to prepare after russias the fourth brutal invasion of ukraine in 2015, to prepare towards this one, made ukraine far better prepared for the significant attacks it was seen. I recall in the three weeks before the war, from an intelligence perspective we were talking with european allies and we expected russias invasion to come. We were talking with the ukrainians about the fact that they were energy grade, fundamentally connected to the russian grid. Its incredibly difficult to bend a grid that is connected. We made a tough call. They made a call to disconnect from the grid and connect to the european grid. That preparation. The question for us in the u. S. , are the digital doors and windows of our Critical Infrastructure locked . The line our detection systems on . Before the beginning at president Bidens Administration we cannot answer the question not because folks were not doing terrific information sharing or wasnt good partnerships, but the question we do know is there are 97 critical pipelines in the country, how have they passed the most recent vulnerabilities . Have we done an assessment of their operations . The work president Bidens Administration has done to put in place regulation in various sectors that require Critical Infrastructure gives us the ability for pipelines, for aviation, for rail, for water. I will talk more about the additional sectors where working on to actually have a rating of the Key Companies in that sector. Thats game changing. Because in the runup to the war, when president blinded turned to us burned came to us, and asked what the blowback was for the russian Cyber Attacks. He was working with the european allies. We were able to answer that question for the pipeline sector. That was the first one under the emergency authorities. Regulations had been put in place. So, the first measure of our preparation as a country is the answer to that question. We track it close with the white house with key regulators and we Work Together to ensure that we can answer that question better and better. First do we have a rating for each Critical Infrastructure owner and operator . And how do we ensure we get all as . Second, international partnership. Is every piece of knowledge, and cybersecurity advice we have, have we shared that regularly with our key allies and partners . We will talk more about a number of initiatives underway. That is a driving question, President Biden always asks. Partnerships is so much of what we do. Then private sector. The balance of power has shifted to the private sector. Whether it is spacex and starling, whether it is the tremendous work, americans have done to place the endpoint detection moving their data to the cloud. The innovation and cybersecurity is what underpins our defenses. A he company reached out to me the evening of a key company reached out to me on the evening of russias invasion, and said we see some signs of destructive capabilities being deployed. My first phone call was the Key International allies and partners in my second with emails connecting him. Private sector partnerships acknowledge that innovation is so key. Those three ps and three questions are the way we organize ourselves and measure our agresta our progress. When you talk about some of the lesson plans, i would be interested in terms of how you are thinking about those Lessons Learned and incorporating them into future policies . Good question. President biden talks about how technology and cyber are core to geopolitics today. Indeed. We take the area of ai, we know the combination of ai, advanced telecom, quantum sensors, with the position that they bring in the advances they bring in terms of measurement, will drive and move technologies, and move ahead breakthroughs in the next few years. I returned from brussels where, in september, before chatgpt was a household name. We signed an agreement with the European Union to focus on five areas of ai for societal good together. Our goal was not only to drive the technical approaches. I will talk about the five areas are. Our goals were to show that the u. S. And the eu could do tech better and we could put in place data protections, that are so core to how we compete with our values, to ai, to advanced tech. Certainly, for certain areas, think about the area surveillance, there are significant perils that ai brings. As we look at the policy approaches, we think about the promise of emerging technologies and the perils. In our policy approaches we want to make sure we are advancing on the promise, hence the agreement with the European Union in those five areas, and also focused on the peril. As we see, because, as we talked about we are a nation of laws and regulation, and morals, in terms of privacy that drives our work, that is core to our competition in the space, particularly with china. As for the group, those five areas are extreme weather prediction, agricultural optimization, driven by the impact of extreme climates, droughts, floods, on how we go crops, how we ensure that grow crops, how we ensure we still have the food duction we need, optimization of our electricity grid. We want to bring in different kinds of energy, to get to a world where more individuals use electronic vehicles. The charging infrastructure, capturing where commuters are, what time, so it is built to support that group. Health, there are advances between the u. S. And eu in the area of vision, medical imaging, the text in. For cancer. Finally emergency management. How do we respond more effectively to emergencies and the role of satellites in helping us have the imagery to respond to emergencies an howd and how we do object detection . Those guide our policy approaches, managing the parallels while pressing forward on the progress. Thank you. Thinking back, you were talking about the progress made in Critical Infrastructure. Looking back, for 10 plus years, we have made more progress in the last three years, then the last 10. It is remarkable. We have seen a lot of the Critical Infrastructure sector, in terms of what your perspective is, in terms of next steps, in terms of increasing the partnership. Good question. Lets underpin the significant progress, as you say. I agree, there has been more progress in the last three years than the last 15. A shift from a voluntary model, to add to that, the regulatory model. We recognize that, i mentioned earlier, biden asked the question on the runup to ukraine, what is the risk or blowback . As good as Public Partnerships can be, it is very different when one shares different information with a pipeline company, with a real company. The regulator can say, what is your plan . And hold the company to that. Now, of course a part of that is the partnership. We need those models together. We need to be sharing that information actively. We also need to have our regulators have the ability be at the table. They know the sector well. Second, that gives us the confidence. Critical infrastructure is a zero fail mission. Critical infrastructure in this country is a zero fail mission. A zero fail in every country. As i travel around the world, we are all grappling with that. The vulnerability of our Critical Infrastructure, as you rightly pointed to, the fact that we owe citizens the confidence that they will have power and clean water, and be able to get gas, and the Pipeline System will not be down from a critical criminal attack. That has been the biggest fundamental shift, underpinned by fantastic information sharing at the Intelligence Community doing joint advisories, that is what our foreign partners are doing. A shout out to the team doing the recent one, chinese attacks on Critical Infrastructure, and laid out practical, actionable mitigations to help companies Work Together. Finally, its the work we are doing with the private sector to drive more secure products. The white house launched a Cyber Trustmark last month. The goal of Cyber Trustmark was bridging three communities, consumers who tell us they want more secure tech in their home schools and businesses. Companies who say, we will build more secure tech, but how do we differentiate ourselves . Then, our goal as government, is to use integritys. People trust in energy star, because they know there is a government standing behind that in the standard and certification. That launch, the shout out to the chairman of the sec, whose chairman did the hard work, quickly registered Cyber Trustmark. And who built the standard following up on the president s executive order, that program has launched. We have marked products with the Cyber Trustmark product, amazon has agreed to advertise it, thanksgiving 2024 please look out for that. Some of my discussions in brussels, where we recognized european and u. S. Products so they can be sold in multiple markets. Now the department of energy is working on smart meters, and they are working on a smart router. Our mission is to expand the number of products that has a Cyber Trustmark, we will run a Consumer Education campaign, which will show you the way we have been working and building up our team cyber approach. The standards, the sec running the program under their authorities, Consumer Education. The department of energy, building standards for things like smart meters. Fundamentally, where companies play a role, those meeting the new standards, and Companies Like best buy and amazon say they are thrilled to be a partner so consumers by safer tech. This conference convenes a lot of different products. I can tell you one of the themes i heard was scared by design. The industry is listening to the guidance. Thank you for that. One of the other Lessons Learned was around foreign partnerships. Certainly playing were allied partners or allied partners played a key role as we shift our focus to the northern pacific. How are the governments thinking about continuing to strengthen these partnerships and the role of the coalition . Great question. President biden talks about partnerships, it is a key part of everything we do in the geopolitical world. You cant operate alone. The more countries we are operating with together, the more we can be a force for positive progress in the world. I will talk about three examples of approaches that we have been working on. President biden welcomed the president of costa rica to the white house last week. Costa rica did a cohost. From a cyber perspective, costa rica, president chavez, was the first one in latin america to call out russias invasion of ukraine. He mentioned, he use the word criminal. They faced significant Cyber Attacks thereafter. A shout out to the fbi and the ambassador, her father was the ambassador there too. Talk about a family legacy. The fbi had a team on the ground the next day, to ensure that we could help costa rica rapidly recover because their government systems, their citizens ability to order medical Services Online were disrupted. Then, the state department worked closely to put together a 25 million grant to help fundamentally costa rica build out the cyber resilience. That money is already working on the ground. A part of that is also money that is flowing to build a Security Operation Center both for the country and their military. Finally, recognizing that, the nations infrastructure, their telecommunications is the foundation of security. We did the first ever xm financing grant of 300 million to help costa rica move off infrastructure to trusted infrastructure. Shout out to the first financing grant for the 5g trusted infrastructure in costa rica. That is one example. The focus to ensure that when a key partner has a major cyberattack, we can help with the nations resources on the ground, to help them recover quickly, southam build resilience, then to help them build resilience, which is the foundation of the country. The second model of International Partnerships is the Ransomware Initiative which will be convening, october 31 in d. C. The number of members have grown to 37. Global partnerships to fight cybercrime. Everyone is dealing with the disruptions of cybercrime. In the u. S. It is disruptive schools, hospitals, companies are facing that. It is a major issue. It is a problem thatk as the Prime Minister said, you have attackers in one country based in russia, they are often beyond the reach of law enforcement. Convening that global partnership, the United States built it, designed it, it is part of our work. Were working on the first ever statement on a coordinated approach to ransom payments. That will be a major take away. 47 countries and a statement in that area. The final example of public our International Partnerships is the virtual cyber incident capability response, hosted by me. Europe fishes significant risk faces significant risks. We wanted to ensure if there was one all the members of nato could quickly respond. So, International Partnerships is a major part of the work we are doing. Its also a major part where we have worked hard to integrate innovate, based on the different partnerships needed, some bilateral, some very large and multilateral, and some smaller in focus. A lot of industry in this room. Across the u. S. , the Industrial Base has built a tremendous capability around cybersecurity and support of the commercial industry. How can the industry best help our foreign partners . It underpins all of our foreign partnerships. When we do a 25 million grant to costa rica, that is for private sector, cybersecurity support, Rapid Response capability. So, the fact that the u. S. Is one of the leading innovator nations in cybersecurity is what underpins our ability to project a secure cyberspace. That works. The information sharing, frankly between companies, the power of connecting the Network Internet routers with endpoint detection at each endpoint and the sharing that happens across our private sector is also a force for good. Driving more of that is a piece. Finally, you mention secure by design, a major effort by my colleague, the u. S. Cyber trustmark, that comes is it built secure. Build your products to that. Lets have a vision to that for the u. S. , by the end of 2025 every iot product, every router in this country has a Cyber Trustmark label. So that consumers are buying more secure tech. Otherwise i will put it in a more positive way, without approach, we can Work Together with that approach we can enable a more secure cyberspace. The glass is halffull. Always. You know that. You talked about ai. Every conference has a team, i would say, here this week, a lot of conversation around artificial intelligence. A lot about the opportunity, but it presents risks. The ambassador last night talked about trust, speed is based upon trust. I would be interested in your perspective on the opportunities and risks associated with ai and how we move towards the trust model. Absolutely. The white house approach because ai crosses every part of our society, the impact on jobs, the impact on industrial manufacturing, the impact on equity, we want to make it a more equitable world because of ai. If aa models are trained on the data we have, they may not be, how do we make this be a force for greater equity . The National Security impact, the Biggest Issue we struggle within the Intelligence Community is how to make sense of the data we collect. How do we enable we have thousands and thousands of intelligence reports. Today, if an Intelligence Consumer i am sitting at my desk, and there watching about the particular advances, making a space one has to read all the reports to do so. So the ability of a chatgpt like product that can summarize the most significant and recent information is incredibly powerful to make sense of the wealth of intelligence we produce, we have produced and we produce today. A massive promise. Know the area of cyber defense. Thats the reason we announce the challenge to open that up and say we need to advance ai defense over a i4 offense. Really massive promise in this space. As you know, the approach the u. S. Has been taken is first to drive a set of companies. Because they are the first base of resilience and defense and how they build models, how they protect their ai models, and the transparency is the data they are trained on and the tests that are been done. The second piece is an executive order getting underway in late to late fall and then the work on the hill, just the regulatory approach to address those risks. We want to make sure that in the ai brain, we are really focused on the promise. One peril is that we are so focused on the peril that we dont make progress in the promise space. And i think, when i think about what would be, to your point, theyre kind of promise in this space. I talked about keeping people safe. What if we were able to predict the fires in maui and use that to provide a much more Rapid Response in eviction and evacuation. I grew up with a cousin who was blind and i would take her for walks on sunday afternoon. It was tremendously humbling as a sighted person, to walk with her. Because my brain automatically adjusted to the uneven road. I did meet even see it until she would stumble next to me, then i started work looking for. She commented to me, the indent in the road to carriages makes it easier, she says no, thats how i stumble into the gutter. So she walked with a stick and she needed by a quiet voice. Which, from an independent perspective, was very hard. We think about what ai can do for folks with disabilities. Its connecting to satellites to find the shortest route. The find the root with police check traffic. To identify uneven parts of the route or a fastmoving vehicle that a deaf person wont necessarily hear. Theres tremendous promise in that for folks who lose their vision at the end of their lives. I think as a society, we want to make sure we make that progress, even as we keep an eye on the perils, because there are significant perils. Particularly when we think about authoritarian models, not governed by Privacy Protection like we are. For example, extensive advances in Computer Vision to capture all the data from cameras to surveilled movement and communication. Last question. We are in a government industry together talking about some of the nations most challenging cybersecurity problems and opportunities. I would love to get your closing thoughts on a password together. As you said, it can only begun together. Innovation coming out of the cybersecurity industry, u. S. And around the world is the underpinning and Critical Infrastructure is a zero fail mission. So, the doors are open for policy ideas. As you said, this demonstration has a great deal of a shout out with the entire government and our partners around the world to drive more and rapid information sharing, to set regulations so that Companies Know they must have the basic digital locks, digital on their doors and windows in a digital alarm system to detect. But the way that we have a shared commitment that americans and individuals around the world can feel their face in cyberspace, can only come from that partnership together. I think a really positive example was the recent backtoschool safety event. What we are seeing in schools, where criminals are attacking schools, and then leaking sensitive kids data online is unacceptable. Multiple companies stepped up at that summit the first lady did at the white house. A shadow, for example to , which has provided Free Services to schools with less than 2500 kids. If i recall correctly, the entire state of arkansas is moving all their schools with under 2500 schools, and five corrupt recall correctly, 28 states are in talks. Amazon, Free Services. Its also work the u. S. Is doing, department of education coordinating a council to bring things together for School Superintendents requiring more secure tech. On the ground in multiple states helping schools. That sets an example of how we each do what we do best, but we do it together in partnership with the measure to say, every kid in america is safe when they go to school. That joint measure of our goal together and individual work is what so inspiring and what is aspiring when we see everybody here together at the conference. So its exciting to be here. Thank you. Thank you for the conversation today. Thank you for your service. And thank you for being on the front lines of our nation and bringing us together in this important fight. It was an honor to be with you today and thank you for the honor of joining us today. So good to be here. Good morning, everyone, i hope you are able to get caffeine in your systems, get your blood flo