Has llegado a la página guardada en caché de https://www.bloomberg.com/news/videos/2024-05-09/former-nsa-deputy-barnes-shares-top-security-concerns-video

A continuación aparece una instantánea de la página web tal y como aparecía en 3/6/2024 (la última vez que nuestro rastreador la visitó). Esta es la versión de la página que se usó para la clasificación de los resultados de búsqueda. Puede que la página haya cambiado desde la última vez que la guardamos en caché. Para ver lo que puede haber cambiado (sin la información destacada), ve a la página actual.

Bing no se hace responsable del contenido de esta página.

Watch Former NSA Deputy Barnes Shares Top Security Concerns - Bloomberg

Live on Bloomberg TV

00:00Great to be here with you and some very fine salmon that I see coming back and all of you. So, George, it was explained to me in no uncertain terms that you knew where all the bodies are buried. And normally that's a joke. It's actually maybe three bodies. You are at a mission. You've been at the NSA. You're out now. But you were at the NSA for 36 and a half years. You were deputy director for six years. And as you told me at the time the revelations came out, it was specifically your tools that he stole and revealed. So you've lived this extraordinary time inside the NSA, and we're really glad that you've left so that you can share with us all of the secrets. Exactly. You're now in the private sector. And I just want to start with this. There is so much discussion of public private partnership, and I think it means a huge number of things to different people. I think it's used as a way of complaining and cajoling. What when you were in the NSA, did you wish the private sector was doing? And now that you're out? What do you wish the NSA and the intelligence community was doing for cybersecurity that it's not already done? Sure. Great question. It was interesting to watch the the evolution of the relationship, and I'll call it a relationship because initially it was like was mentioned in the bumble thing. It was transactional. There wasn't trust and only things. The only things that went were they were metered out. And whether that was metered out by the government or metered out by industry, it was because there was a lack of comfort on the government side. Of course, there was the lack of comfort in exposing how we got the information. And on the industry side, there was concern about liability or reputational damage and acknowledging that something happened to you and now it happens to everybody now. So that's gone. And we know that the government and industry both have emerged and evolved to a point where they both have information that's extremely useful. But together the information is powerful. And so neither side has the totality of the information that's required to take action. But when you combine both together, it enriches the potential of getting to the right outcomes. I spent the week talking to industry players, to government players, and Director Coker said, We still haven't quite got this public private partnership right. There's a ways to go and industry is definitely saying you could still be sharing more. Yes. How do you see that? What actually needs to change and is it going to change or are we going to talk about it pleasantly? Yes, you can always share more. The other challenges, we don't know everything we need to know. And so all of us are resource constrained given the size of the threat that's coming at us day in and day out. You all know where most of the threats come from. Russia, China a little bit. Iran and North Korea. NSA, speaking for just NSA, is overwhelmed with trying to align the priorities within just general intelligence production for combat support, for policy formulation and for cyber security. And so it has to divide down all the resource space it has. And those resources are never enough. And, you know, NSA enjoyed lots of support from the current administration, the prior administration and general, they get a good, robust budget. But as we all know, the size of the threat continues to manifest itself. And that's where technology really is coming to fore and really helping to intensify the ability to do more with the same amount of money. When you look at that moment, that Edward Snowden moment, it was so combative, but not just for him, it was combative between two sections of the industry. And now here the NSA is I go to DEFCON, the NSA is the black hat. They're RSA, You're everywhere. How have you done this? How have you? You were the least popular people ever. We know you're still in Austin. We know you are listening to a lot of things. We know this controversy about the extent to which any US person data can be collected. What is this transformation about? How have you pulled it off? Well, I think the first thing Snowden did teach us is you cannot assume that people trust what you're doing. And I came into the NSA right out of university. I spent my whole formative adult life there. And when I started, we were trying to actually bring the Cold War to a head, which luckily we did collectively with our allies. And then we went into the terrorism phase. And so through town or terrorism, it was easy for those in NSA to just can conclude, hey, we are doing God's work, we're trying to prevent bad things from happening. Why wouldn't anybody trust what we do? And so that was a gross miscalculation. And I think what Snowden did is he filled the void that we were not filling. We had no communication agenda. We assumed people trusted what we did. We assumed that they would just. I need to know the authorities we had and just let us do the right things. And I used to actually watch CIA get called out all the time. And we always kind of hid behind them. They got all the press and we just quietly did our work. So Snowden really exposed our inability to connect with the public. And because he got the microphone, he made assertions that luckily were disproven by commissions that were commissioned by President Obama at the time to come in and look at our compliance regime, look at the data holdings we had. Look at how we did do things that we were doing within the authorities. We were given everything he said was disproven and he did show a lot of tools and most definitely show tools. But but the things that he did wrong was were the assertions of broad collection on the U.S. persons, for instance. And so that's that was way overblown. And so those are the things not having a public persona. It was hard for us to build from really the basement to create trust and transparency. And so a lot's happened, you know, the Odeon and I just put out its most recent transparency statistics, which all the agencies contribute to every year. We're proud of that. I'm proud to show what we do. We have nothing to hide. We're within legal regime, and I think that's good for all of us. And it's unlike the adversaries we face who really have no checks and balances. Does the NSA need to have information from data centers to do its job? Data centers, meaning data centers? Most definitely. I mean, we have NSA has its own data centers. And so NSA built its own cloud, other data center. Oh, I see. So NSA uses the least invasive means possible to get the information responsive to their requirements. And so if that information is somebody talking on their telephone or texting on their apps or holding their data in a data center off in a foreign land that we've been asked to target, wherever that information is, that's where we need to go. But we don't harvest in bulk. You know, we're very precise, unlike a lot of the verbiage that comes out, even with FAA 702, which was undergoing reauthorization last month, a lot of adjectives characterize NSA as bulk collection. And under 702, it's extremely precise with three orders of checks and balances. You can't just vacuum. You have to have an entity you're going for and have it substantiated before you can actually task to get content for that entity from a service provider. So it's very specific. I know NSA is much more public than it used to be, but obviously Senator Wyden had huge concerns about that reauthorization zation of 702 and said that it could effectively require people who clean buildings, who work in buildings to spy on their own employers and reveal that information. I think that was something of a thought experiment. But his point was there is nothing in the language that prevents that. And the reporting showed that it was probably about data centers, but no one came out and told the American public. So there's still a deficit of, I think that trust. Yeah. And we have a ways to go. And I think we need to continue to be transparent with how we use the authorities. We need to be transparent on where they fall short. Our adversaries know our authorities much better than the American public and much better than most of Congress, unfortunately. And they use that knowledge to work right at the edge, just beyond the limits of our authorities. And they do that right within the US, much less overseas. Let's come to China. How have you watched China evolve its techniques over the years, the decades that you've been at NSA? And can you tell us how you first saw this picture of vault typhoon of pre-positioning in US critical infrastructure and how seriously you take it? The government is talking about it a lot. They've given us no sense of how many cases there are, any one specific that's actually suffered. How are we to believe that this is really such a serious problem that we should alter our own practice? So I watched China's evolution of computer network operations mounted against the US for over a decade. They started very sloppy, was very easy to find them. They were unsophisticated, they were kind of more brute force. But the one thing that China does do is they create long term strategies and they're willing to forsake a near-term game for a long term gain. And so they will watch, learn and listen and evolve. And so taking forward, that's the state they were in, say, in 2011, which was very rudimentary today, as I think everybody could attest. They're extremely sophisticated. They have tens of thousands of humans. They have farms of supercomputers. They're evolving their algorithms by training not only in the intelligence, but, of course, we know that they actually train on their own people. All that knowledge is amassed to create this engine that is threatening every aspect of our livelihoods here. And the big thing. Given where we are in San Francisco that I've really been harping on, it's just this whole concept of getting our intellectual property. You know, the seed corn of America starts with the innovation engine that America has created and our Western allies for all these years. China sees much of that as in its national security interest to get. The US doesn't do that. We target governments. We don't target industry for economic gain, for stealing IP to give to our companies, to market back against everyone else. And so there's a big difference in that. Taking forward to what you've heard in Bolt Typhoon, that's the continued evolution in China of cyber in much of the world, cyber not just for espionage but also for the future of warfare. And so that's an evolving space. Ball typhoon was evidence that China not only has computer network operations, attack operations as part of its evolving doctrine, but it's exercising that quietly but surely in our own infrastructure. Do you think they really could stop everything everywhere, all at once, which is what one sister official has said? Well, I think the problem is we don't know. It's all we can do to find the exploits. These exploits don't look like the typical exploits. We've trained ourselves to look for. Most exploits that we all have looked for forever work to collect data, whether that's commercial data, personally identifiable information, governmental information. But you have command and control, you have exfiltration. Those are all telltale signs. You can train algorithms to search for. When you're embedding attack capabilities. Basically, you have an ingress, you lay it down, you test it, and then it lays latent. And you only have to revisit every so often to make sure it's still there. So the the observables are much different. And so it's really hard for and especially where they're hitting they're hitting areas and critical infrastructure, as we heard earlier today, that have not had the awareness of cybersecurity vulnerabilities. They haven't had the money for modernization. They haven't had the talent. And so collectively, we need to bring all of that to bear for our critical infrastructure providers. I want to thank attendee number 136 for an excellent question. Should U.S. companies AI models be under export control? Oh, that's a very good question. I mean, we heard a little bit of discussion on llama this morning and this whole balance between what's opensource and what's not. I'm very conflicted because on the one hand I see the power of open source for our liberal democratic world of the West, but I see the the opposite end of that where the Chinese government can take those same models, perfect them, train them and apply them back against us. And so it's a it's a big quandary in our society because we actually operate against different mindsets, different rules. And that's part of the thing that keeps me up at night are where are we headed? Right? We have this beautiful thing that we've created over decades in the West, and we have two big nations and a few smaller ones that are pulling us in the wrong direction. If you look at ransomware and what that's done to our society. Data theft. Not a day goes by that you don't hear about breaches. Theft. One of the repercussions. And so we have to make defense better. We have to communicate better. But I think we need to find ways to put pressure back to the source of where this came from. And so, you know, the current administration has done a great job in bringing the whole of cybersecurity to the fore. But I think we have to go further, unfortunately. How has the NSA been using AI and how has this generative AI moment affected the tools? What was it like sitting inside the NSA? Sure. So as you would imagine and as we all talk about generative AI, as though it's the new thing, it is the new thing with the large language models and the generative pre-trained datasets. But different aspects of AI have been evolving for many, many years. And as you would imagine, NSA has been evolving its own applications of AI for many years. Inside, the big change now is what happened with industry here. And, you know, basically here in California, dedicating ourselves to amassing the compute required to take to get the benefits out of Pre-trained model that now we are all finding ways to use. All of us are finding ways in every walk of life. And as the gentleman said earlier this morning, don't start with I have a model. How do I use it? Start with a problem I have to solve. What do I can, a model or an integration of that model help me solve a problem? And so every aspect of society in the modernized world. And find ways, and we'll find ways to use generative pre-trained models and including intelligence. I know the NSA is always very focused on recruitment and it's a big problem. You have a very interesting solution to that in your family. My daughter works for NSA. She went to industry for two years first, and then she she actually surprised my wife and myself at Christmas. There was a letter on the Christmas tree and it was her acceptance letter. And so it was a neat surprise. But. But she loves it. I took a 40% pay cut, but. But the happiness factor is ten times what it was before, so she loves it. Thanks very much for joining us. Thank you. Thanks. Thanks.

No schedule data available.

BTV Channel FinderWatch BTV in your area

Former NSA Deputy Barnes Shares Top Security Concerns

George Barnes, Former Deputy Director, NSA; Cyber Practice President, Red Cell Partners shares fears about the current cyberthreat landscape and what business leaders need to know with Bloomberg’s Katrina Manson at Bloomberg Tech in San Francisco. (Source: Bloomberg)

More From Bloomberg Technology Summit
All episodes and clips