CTOVision

CTOs, Global Cyberwar and Our Collective Future

If you are a technologist, please take a moment to download the PDF of the report by the U.S. Commission on Cybersecurity.  This report, titled Securing Cyberspace for the 44th Presidency, is the best proclamation of the challenges of cyber I have read.  It is also a roadmap that will help any trying to navigate these very tough issues.

I've been involved in things cyber for a long time.  My deepest involvement began in December 1998, almost 10 years ago to the day.   In all that time I've seen lots of studies and lots of papers and many treatments of the issues.  But I've never seen one that captures the complexities and the need for specific actions as well as this one. 

I'd really recommend you read every word, if you want to be considered literate in this field.   But if it will be a little while till you get to it, here are some key points:

The three major findings are:  1) Cybersecurity is now a major national security problem for the U.S., 2) Decisions and actins must respect privacy and civil liberties, and 3) only a comprehensive national security strategy that embraces both the domestic and international  aspects of cybersecurity will make us more secure.

The report makes a few points about the Bush Administration's Comprehensive National Cybersecurity Initiative (CNCI).  In general the give credit to that initiative, and call it good.  I agree, it is a great activity I've previously written about that is led by one of the most effective people in government today and has done great work.  But as the comission points out, the work of the CNCI is good but not sufficient. 

The biggest shock for me in this study:  The amount of funding on R&D for cyber security.  I have been looking into the many activities underway, and maybe that look made me deceive myself into thinking it was a well funded effort.  According to the comission, however, they estimate that the total R&D funding in the federal government for cybersecurity is about $300million.  Less than two-tenths of one percent of the total federal R&D.

The report has a great section on identity manangement. 

I am convinced the organizational approaches outlined in the study are the right ones as well.  There is only one place in our government where we can lead solutions to this challenge.  Where is that?  Hey read the report!

What else do I recommend CTOs do besides read the report?  I think one way we can all help the cybersecurity effort is to think through which standards bodies are the most important to engage with regarding security.   A few are here:

http://www.ctovision.com/2008/05/standards-organizations-ctos-should-track.html

Three Events of Federal CTO Interest: Will You Be At These?

FYI, in case your schedule will allow us to connect in person I wanted to update you on a few events I plan on being at over the next few weeks.

The Advanced Technical Intelligence Association TECHINT conference will be held 9-11 Dec 2008.  This conference focuses on the technical dimensions of intelligence, and has a theme of "integrated performance."  The theme refers to the need to integrate capabilities from all the agencies engaged in national security to better perform in meeting our national security challenges.   On 9 Dec I'll be speaking at a panel on the real and growing threat in cyber space.  There will be no blogging or tweeting from the conference.  But if you are going to be there please drop me a note and lets connect in person there.   For info see http://masint.org 

The AFCEA Solutions conference on Cyberspace will be held 10-11 Dec 2008 at the Ronald Reagan Center in DC.  This conference will be focusing on the challenges and solutions of cyberspace related to national security.  Speakers include Secretary of Homeland Security the Honorable Michael Chertoff, The Deputy Secretary of Defense the Honorable Gordon England, Assistant Secretary of Defense for Networks and Information Integration the Honorable John Grimes, Ms. Melissa Hathaway, senior adviser and cyber coordination executive for the Director of National Intelligence, LTG Keith Alexander, Director of the National Security Agency, Deputy Assistant Secretary of Defense for Information and Identity Assurance Mr. Bob Lentz and Deputy Assistant Secretary of Defense for Information Management Mr. David Wennergren.  I'll be speaking on a panel on Wednesday at 1530 on formulating a common response.  

• This unclas conference follows a model that AFCEA has been using for several similar events.  They are actively seeking ways to enhance the value of these conferences by leveraging more Web2.0 capabilities before, during and after the formal presentations.  Blogging and tweeting from the conference is encouraged. You can visit the site at: www.afceasolutions.org/group  For the event schedule and program details can be found online here: www.afceasolutions.org

The US Army Intelligence Warfighting Summit will be held 15-17 Dec 2008.  This one will also be a conference where blogging and use of twitter is not appropriate due to the sensitivity of info discussed.  However, I would appreciate knowing if you will be going so we can connect there in person.  Speakers will include the most senior Army intelligence leadership, plus Vice Admiral Bob Murrett from NGA, LTG Alexander from NSA, and Scott McNealy from Sun Microsystems.  For more on the event see: http://www.ncsi.com/iws08/index.shtml 

So, if you are going to any of these please let me know.  

And please follow me on Twitter so I can send you a few bursts from the AFCEA conference.  I'm at http://www.twitter.com/bobgourley 

Cheers.

Collaborate and Deliver With More Cowbell

Participants in this week's Enterprise 2.0 conference, hosted by the ODNI's ICES group and the CIA's WIRe team, were treated to a shared experience that is hard to capture in a blog post.   So I won't try.  But I will say this, we all had some great collaboration and coordination lessons and context, and we were able to participate in creating that ourselves because the conference organizers established a great ambiance and gave us access to wiki's, blogs, twitters and WiFI that knitted that all together.  I really appreciated being there.

One lesson I'd like to note now was underscored by Fred Hassani.  Fred found a great way to make us all think about the variety of collaboration tools at our disposal.  In a musical analogy he underscored how hard it can be to make music with instruments that don't traditionally play well together.  But in a sign that the spirit of the community is strong, we all saw how a cowbell can make really really great music if you put your heart into it.   And we the community of professionals can make use of any tools we are provided to collaborate, even if they are not our favorites.  We will always make due and will always overcome.   One way we will overcome is through mashups.  Just like in music you can mashup piano's and cowbells, in IT you can mashup imagery data and SIGINT data and analytical data etc.

Which brings us to a great video that underscores this point-- not from thte WIReICES conference, but from a group of spirited collaborators from SNL who many of us in the community look up to.  

So please check this out and as you do please think of the IT tools in your enterprise.  I guess the point made for CTOs is that we need an enterprise that allows mashups of all tools and all data.  You never know when the maestro will call for more cowbell.

Social Media and Web2.0 for National Security Planners

Over the last couple weeks I sent several friends and associates a draft article I was working up on Web2.0 for National Security Planners.  I enjoyed pulling that together, since it helped me convince myself that the right thing to do is to get more senior US strategists engaged in Social Media.  There are some real security concerns there and we dont' want all our national security efforts exposed to all our adversaries on the Internet.  But use can be made of these tools and the risks there can be mitigated so the overall benefit to the country will far outweigh the risks. 

One of the folks I sent it to was Dion Hinchcliffe, President and CTO of HInchcliffe & Company (see http://hinchcliffeandco.com ).   Dion has long been a very collegial person with an open/collaborative work style.  I met him several years ago when he was giving a presentation to my old community on the then new concept of Web2.0 and have been very glad to be connected with him since.   Dion read the article and published it in his Social Computing Magazine (see http://socialcomputingmagazine.com/viewcolumn.cfm?colid=578 ), and I am very appreciative of him getting the word out on that.

Another online associate is Helen Thompson of AFCEA.  Helen is herself a great contributor to the dialog on national defense.  She just published an article titled "Reconciling Collaboration and Security in the Social Media Space (see http://www.afcea.org/signal/articles/anmviewer.asp?a=1680&print=yes ).   In it she references my article and underscores the point I make about social media tools being a good way to accelerate good idea.

The current draft of the article is at:  http://www.ctovision.com/social-media-national-security.html

Please check it out and let me know your thoughts/input/suggestions.

Day Three of the Synergy Conference

This is the third and final post on some observations from the 2008 Synergy conference (co-hosted by Stratcom).

The day opened up with a great update on operational intelligence in the modern age, with Mr. John J Powers of the Defense Intelligence Operations Coordination Center (DIOCC) providing a first hand look at the DIOCC, its mission, and recent successes.   The question and answer period generated some great dialog and feedback and suggestions from some of the greats in the community, including Mr. Terry Casto and Ms. Lynn Schnur. 

JJ's discussions were followed by a panel of CTO-types introduced by Ms. Nancy Wheeler of the GETA.  Panelists included Mr. Malcolm Hyson (CTO Microlink LLC), Dr. Alex Karp (CEO Palintir Technologies), Dr. John Triechler, CTO Applied Signal technology), Mr. Guljit Khurana (President and CEO, Centrifuge Systems) and me.   

Our panel was followed by the highlight of the day, a presentation by Dr. Prescott Winter, CTO of NSA.  I capture some more detailed notes on his presentation below.

Dr. Winter was followed by CAPT Eva Scofield, the Director of Intelligence (J2) for JTF-GNO.  This is the position I held from Dec 1998 till 2002.  She did a great job of characterizing the threat.  I hope all were listening and I hope the world remains alert and focused on this growing menance.

Closing comments were provided by the Stratcom's Director of Intelligence (J2), Captain Jeffrey L. Canfield, USN.  Unfortunately, I had to miss that presentation to catch a flight. I imagine Jeffrey did his usual great job of both extracting the key points of an entire confernece and drawing conclusions we should all take away.  I'll have to get with him later to see if he can get me up to speed.

Notes from Dr. Winter's presentation:

Dr. Prescott Winter, CTO/CIO of NSA, provided an overview of the NSA IT story and the many changes to the way we do business.   He provided a very good, succinct vision and a compelling argument for continued change towards integration.  He is fully aware of the great progress that has been made to date and does not discount that. But he knows more needs to be done and is helping us all move forward.   We need to move more users into an integrated ops intel space where new information models can be used.  The SIE, Single Integrated Environment, for example, is a new model and new operating environment.

A key vision has been to integrate what users see with what intelligence knows.  This is an integrated ops/intel space that is serving the mission with an integrated picture that wraps the user.  He is moving towards this vision by engaging today's architecture and looking for gaps and addressing those, engaging with industry to know more about the future of technology and how they can address gaps, integrating the NSA investment programs (as you identify stacks of services you must have investment plans that appropriately resource and optimize them).  he is also engaging technologists from throughout the organization by working with PEOs and the AE of NSA.

Pres is working hard to move NSA from a net centric model to an info centric model.  He is also changing the access model from compartment based to attribute based.  On the issue of data  ownership, he is doing everthing he can to change the old model of data ownership to data stewardship.  This is a behavioral issue.  On the issue of SOA and Services, he is moving the entire stack of IT to a services model. 

Pres is a champion of the ODNI's info sharing strategy and vision and is working hard to help execute and implement.  He is working hard to change attitudes and behaviors from need to know to need to provide.   He is working to engineer solutions that will help make data discoverable and available to every member of the selected community that needs that information.