 So, good afternoon. I have the great pleasure of announcing Marisa McAuliffe's uncle. That's right. That is my claim to fame. Marisa McAuliffe worked for me several years in the State Department, best Chief of Staff there ever was, and I got to know Terry that way. But on a more serious note, those of you from New America know that one of my hobby horses and one of the things I'm really proudest of at New America is our effort to reinvent the think tank and to not only do great top-down research and analysis, but also bottom-up work in communities across the country in a ways that find solutions that people are inventing for themselves, partly because of technology, partly because of speed, and partly because it's nice to get out of Washington. I did not think when we originally wrote about this in 2015 that cybersecurity would be so important at the state and local level. Indeed, if you'd asked me, I'd have said, no, no, no, cybersecurity, that's a Washington issue. That's a federal issue. That's a national security issue. That is not one of the things we could do at the state and local level, but I was very wrong. Governor McAuliffe is one of the real visionaries in this space for seeing exactly what needs to be done at the state and local level. We're going to talk about that. However, in addition to his status as a very proud uncle, he is the 72nd Governor of the Commonwealth of Virginia. He'll probably ask you to raise your hands for how many Virginians there are in the audience, and he really is a champion of cybersecurity. In 2014, 2015, there was the Commonwealth of Virginia Cyber Security Commission, which launched a whole number of state initiatives and critically has been a model for other states. Governor McAuliffe is now the chairman of the National Governors Association, and he has launched the Meet the Threat initiative, again, which we'll talk about, to convince other governors just how important this is. Governor McAuliffe, welcome, and we are so grateful to have you here. Thanks, Anne-Marie. Great to be with you. Thank you, everybody. Let's go ahead and do it. How many live in Virginia? Good crowd, smart. Maryland. Boy, paying those taxes? You've got to be kidding me. Line over the Potomac. It's much nicer. So let's just start at the beginning. Why cybersecurity? I mean, you and I knew each other a little during the Obama administration. I mean, this was not an area I necessarily would have predicted. There's no bigger threat to the governors than cybersecurity. I talk about this constantly. Let's just take Virginia last year. I had 86 million cyber attacks on the Commonwealth of Virginia's state account. 86 million. Just Virginia. My personal information was a foreign actor two weeks ago tried to get my personal information on the state. We were able to block it. It affects everybody. No governor wants to have their data stolen. The governors control more data than the federal government does. Collectively, if you think about, we run the Medicaid programs. We have all the health information. We have all the state tax information. We have all the driver's license information and social security and all that. So collectively, we have more data than the federal government. The federal government has moved to protect themselves and we work very close with DHS and FBI and all that. And I think for a lot of the cyber criminals, an easy place to go is to go to the states. And the point as chairman of all the governors is we do a very good job in Virginia. I would say we're one of the best states for protecting our data. But the point I make to the 50 governors, if we do a great job in Virginia, and there are about 10 states that do a great job and 20 or 30 making progress and 10 really need work, well, let's just hypothetically, if we do a great job in Virginia and protect ourselves, let's take some small state out west who has done nothing. If we both have Anthem healthcare providing, they will get to Virginia through a back door through a state. So the point I've made to the governors is we are only as strong as our weakest link. So I have started this initiative working with the NGA and I see Tim is over here and my team, Michael, so I'm going to team from our NGA who worked on this. All 50 states were trying to get up to a basic protection level to meet basic protocols so that we are, as I say, we're only as strong as our weakest link to make sure all of our states are up. But all the data, I don't want to be governor where my personal information Utah has had a major breach South Carolina had a major breach and I tell the governors it's like, you know, you don't want to be caught out of state during a major snowstorm. It could ruin your political career. Also could ruin your career if you haven't done the basic things you need to protect the data. To me as governor, this is one of the most important things I could do and I do also think it sends a very strong message to businesses that we do a very good job of protecting our data. One more reason why you should put your business in Virginia. Number one, number two, it's a huge job creator. We now have more cyber companies than any state in the United States of America, 650 in Virginia now. I have 36,000 openings right now in cyber in Virginia starting to pay 88,000 dollars. So I'm going to that is extraordinary. Again, the number and I want to come back to the economic dimensions. But on what can governors do? I mean, is it policy or is it sort of a set of best practices or both? Both. So what we've done and we just with all the governors, the first time this happened at our NGA meeting in February, you know, this is a real deliverable. Every governor when they sat down, there was a sealed envelope and they got a report card. This has never happened. No governors have done this before. I didn't, as chairman, I didn't even know what other states had, but every state was ranked. You either were green in areas, yellow or red. And there are some governors whose states got all red, which means you've got a lot of work to do. So, but we're working with them. We just had a huge conference in San Jose. I was out there Wednesday on cyber security. We've done training for all the states. And this is like really these are the things you have to do to protect your... Here's the things. And I've already done it in Virginia. We're the first state to do the NIST framework. We're the first state to stand up and ISAO. I mean, we've done all this. I've the first one to put a cyber commission together. Just take the executive orders that I've done in Virginia. You don't have to reinvent the wheel. Just take them. And because this is one great thing about the governors, we all want to help each other in this regard. This is not a partisan issue. We need everybody to be strong. So, it's executive orders. It's doing legislation. It's investing. I just put a billion dollars into education last year. A lot of it aimed at cyber. I now do cyber camps. I had 39 cyber camps last summer for freshmen and sophomores in high school to come for nine weeks for free. We'll pay for it. I'm the first state. I now have a scholarship. If you'll go and get a cyber degree and work for the state for two years, I'll pay for your education. Really? So, we really in Virginia, because it's worth it for me to do it, to get these cyber warriors to continue to do it. So, back to the number of how it creates jobs at the government level. 36,000 jobs? 36,000 open jobs today in Virginia, starting paying 88,000. I tell parents all the time, you know, you're all too young, but there used to be a movie called The Graduate. And the key phrase was plastics. It's now cyber. And I've literally beaten up my college presidents. I bring them in once a month. And I apologize if any of you are anthropology majors. Stop offering courses that don't get skills to match the jobs that exist. I have 30 billion dollars worth of student debt in Virginia today. Why are we graduating folks with a lot of debt without skills when I have all these jobs open? So, I'm trying to change our education system. I've just added code writing and computer science is part of our standard of learning, our standardized tests. They're now part of them. I got rid of five worthless ones and have added these two back in. And I apologize. I didn't have to be anthropology. It could be anything. Listen, I was a political science major. So, you know, who knew? Anything can happen. You too could be governor of Virginia. And are those three, are those three? And remember this, when you go to bed tonight, think about this honestly. Our first governor, Patrick Henry, started the American Revolution. Give me liberty, give me death. Our second governor, Thomas Jefferson. And now, Terry McAuliffe. Is that a great country? As a former Virginia, I love it. But are those jobs, those are government jobs? So, those are across the private sector. They're private sector jobs. Yeah. So, we have, I say, about 650 cyber companies. You know, listen, this was something important that I needed to do, first of all, because, as you know, being a Virginian, you know, we have more military bases than any state in America. We have the largest naval base in the world. We have the Pentagon, the CIA, Quantico, a lot of three letter agencies I can't name, all in Virginia. So, we are in partnership with the federal government because we all, we have a shared purpose to protect our data. So, for us, the Northern Virginia, huge, really huge core group of companies, but also down in Hampton Roads with all the military assets, the base and all that that we have down there. So, but this is all private sector jobs. I'm not even including what I would need in the government. Wow. And so, part of this is, as you said, working with higher education, getting people, getting people in those jobs. What about creating sort of hubs for the cybersecurity industry? I mean, so, there's the cybersecurity needs in every company, but what about actually growing the cybersecurity as an industry, just like you might grow the auto, I mean, you know a lot about this, the energy industry, the automobile industry. And that's what I'm, you know, listen, that's what I'm trying to do in Virginia, you know, I was out at the RSA conference, you know, which is the biggest cyber conference just out in San Francisco. For the last two, three years, I was the only governor that went to up, which I just found nuts. You're giving me this huge opportunity to go do it. So, I'm trying to make Virginia that center of cybersecurity. I can only pull that off Amory if I can find, and you know, we have the second most number of technology workers of any state in America. California is one word too, but even with that, trying to continue to feed this, but what is really important, parts of, here's Northern Virginia, Hampton Roads, but you go out to South Side and Southwest Virginia, they've lost coal, textile, furniture and tobacco. Rural communities have been ravaged by the loss of these jobs. How do you bring in new jobs there? Danville, as you know, Danville, rural down in Southwest Virginia. Textiles originally. Lost all the textile business. We just, the Danville Community College just became a cyber center of excellence, you know, which is designated by DHS and the National Security Agency. We had one when I became governor, I have 14. My goal is to have every community college be a cyber center of excellence, and now with Danville, they are now going to have these cyber degrees. So Northern Virginia Company would be glad to hire somebody in Danville. You don't have to be in Northern Virginia as long as you got access to the pipe and you get in the internet and you can code right. This is how I can help rural communities that have not taken part in the job growth. I think what you saw in that last election, this is how you can help these communities grow. And I tell everybody, once you begin with these assets, we in Virginia just won for the National Guard, the new Air Force Command Cyber Center. Why did we get it? Because we have invested. And I tell the governors all the time, you're not going to, federal government's going to spend billions in this area, billions. You either get in the game, change your education system and start doing what you need to do, or you're not going to get these federal assets. So we'll continue to get them in Virginia. And how do you convince people, so in Danville, former textile workers, former coal miners, these are, these are folks who are a little suspicious, right? Of cyber stuff. How do you, how do you overcome those cultural barriers? They have been beaten down for so long. You know, it's interesting when you think Virginia, you think of us parts as a coal state, right? We have about eight and a half million people working for Virginia. We have 4.3 million workers out of 4.3 million workers. Let me just ask Ann Marie, and we're considered a coal state. How many coal workers do you think we have in Virginia? Oh gosh. Out of 4.3 million. I would have said 100,000. 1,000. Oh my. I'm off by an order of magnitude. It shocks people when we do this. But that is what's happened. Yeah, about 1,016. So what has happened, of course, obviously with gas, but, and I think they've realized it's not, it's not coming back. It's not coming back. Natural gas. So they are desperate for new opportunities. But when I went down to announce that, you know, the certificate for the cybersecurity, 200 people showed up. This was the biggest thing that happened in Danville. So there's real excitement. As you know, in these rural communities, the hardest working folks, they're passionate. And, you know, I'm trying to do drones as well, UAV. We, you know, we're one of the seven test sites in America. I'm trying to do the same thing with autonomous vehicles. Every road I'm building now has sensors. This is what you have to do, what I call building that new Virginia economy. And to get a cyber degree, it only takes eight, nine months, as you know. So we, you can do this relatively quickly. And, you know, you pay someone in Danville, Virginia, $88,000. Boy, that's a game changer. Great. So let me, let's go back to the education part. So it's community colleges, state institutions, private colleges. What about earlier? Have you thought about what you do? We had somebody earlier today who said, you know, what is most needed? And she said, we really need digital literacy from kindergarten forward. But how do you, how do you tackle that? I tell my superintendent, Steve Staples, that every kindergarten when they come in, I want to cray old book that says STEM on the front of it. I mean, we literally have got to change the way. And that's what I've tried to do through our education system. Listen, our high schools don't work in America anymore. Don't kid yourself. They don't. They were built for the industrial revolution. They are big buildings with classrooms with seats and you get credit for seat time. Well, that was great for the industrial revolution, but it's totally inapplicable to what we're trying to build today. So we're totally revamping, as I say, externships, internships on the job, all the way in high school in Virginia now. We've totally transformed it. But going earlier, we are now teaching computer science and code writing in fourth, fifth, sixth, seventh, eighth, and now we're offing summer camps. So, and now letting people know that if you will give us two years, I'll pay for your college education in Virginia. Scholarship for service. We're the only state off from that. I also have a huge... And that's a legislative program. I mean, did you get that through the legislature? Yeah, we did. Yeah. Yeah. I mean, listen, I have a very Republican legislature. I'm a Democrat, if you didn't know. But listen, on economic development, we get a long file. We disagree on some of the social issues, but on economic development, you know, I've had a very good run with my legislature. And we've all, we've really tried to stay focused because, you know, we're very vulnerable in Virginia because, as I say, we're the number one recipient of Department of Defense dollars. So when sequestration hit Virginia in 2011, we lost $9.8 billion direct spending from the Pentagon. Now, as you know, the next round, I mean, all I hear is bad news on the federal budget that we're going to have another CR. Well, another continuing resolution, you know, phones keeps at the same level. Those draconian sequestration cuts are going to hit again next October. So because of all that, and the federal government shut down we had in 13, because of all that, I think the legislature has, we can't lie on the military, let's build, expand, broaden, let it be cyber, data analytics, human genome sequencing, all these new things, and it's worked. But, you know, getting your education system, it's hard, as you know, it's like an aircraft carrier trying to churn it. And, you know, I deal with issues of tenure and everything that we all deal with, which sometimes it's hard to deal with. But we're making great progress. We just got to shake it up. So I need to ask one of my team, do I have 10 minutes left or 10 minutes till questions? I thought we were here all day. 10 minutes left or 10 minutes? Oh, all right. I'm going to ask you one more and then I'll turn it over because we so you mentioned the National Guard Academy. So one of the things I've read when we talk about cybersecurity are arguments that this is really a great role for the National Guard. Is that part of what this academy is supposed to do? Have you thought about the National Guard? Oh, our guard is, you know, instrumental in doing this. And there's another thing called the Council of Governors. It's five Democrats, five Republicans appointed by the president that serves. And we meet with the head of the DHS, DOD, FBI, you know, twice a year. And Tim and Jeff and everybody have been working very hard. We finally have an agreement after years to share data. A lot of the big problem we've had with the guard is the ability of the federal to give state the information that we need. And it gets down to those privacy issues, but we finally have an agreement. So the guard is absolutely instrumental in doing this. As I say, we just got one of the new Air Force Command Centers for cyber in Virginia, but your guard, but also the veterans, you know, I'm very proud. We have more female veterans than any state in America. We have more veterans under the age of 27 than any state in America. We have the largest workforce per capita of veterans in any state in America. We transition out about 15,000 a year. I want all 15,000 of those to go and I will pay for them to go get their cyber degree and move them right into the workforce. We have a thing called the V3 program, Virginia Values Veterans, where we have about 800 companies signed up that promise the state that they will hire a veteran once they finish the training. So this is a huge opportunity also for your veterans. That's great. Well, thank you. The floor is open. We've just wait for a microphone. There's a question down here. Good afternoon, Governor. My name is Maurice Turner, Congressional Elevation Fellow working in the Senate. My question goes back to digital citizenship and literacy. When do we get down into the elementary level and start teaching kids the equivalence of, you know, look both ways before you cross the street or, you know, wash your hands after you go to the bathroom when it comes to being a citizen online, you know, those basic fundamentals of using strong passwords, you know, making sure you're reading the entire headline, not just the tweet, you know, those kinds of things that doesn't seem like we're teaching them in school. It's a great point and we're not. And as a father of five children, I have 25, 24, 22. I have the 17 and 14 year old live in the Governor's Mansion. They spend all their day looking. It drives me wild. Pick up a book. It just doesn't happen anymore. So I couldn't agree with you more. What we're trying to institute in Virginia is exactly what you talk about, digital literacy for a lot of reasons, one, to prepare them for the jobs of the future. But I don't, I'm sure how many are parents here with kids who've got devices? How many times have you said what you write today could come back and haunt you? I tell my children this every single day. So the digital literacy part is, you know, they get on these Facebook chats and they say a thing that will literally come back and listen, look what's going on in Capitol Hill today. We don't have to tell anybody what, I mean, they hacked into our elections and I could go on and on. So what we're trying to do when I'm putting money into our education system to begin to do the digital while they, while literally starting in fifth grade. And here's the issue we have. The problem is finding enough teachers. That's a real problem because if you are really knowledgeable and skilled in this area, you're going to get cherry picked by a business or the government. I mean, I met with Admiral Rogers the other day and he was saying, he has the same problem we have. A little bit different. The NSA, once you work there, people love it and love to stay there, but generally for FBI and DHS, they can't keep their employees there because, you know, they get cherry picked by the big companies. My big problem is I'm trying to find teachers who can teach digital literacy early on. So we don't have them today. So I'm now putting together a program to offer for teachers to go get that literacy training. I will pay them extra to do that to get them into the classrooms. It's a great question. And we, not Virginia, the country, we better get in this game and we better get in it pretty quick. It's a great question. You might think about, it's interesting if you talk to Teach for America to think about a whole part of Teach for America that is around cyber to also teach others. Sure. Thank you, Governor. I'm wondering if you could talk about, are you concerned at all about the cyber security of public works of ports and electric grid? And if so, what you've done as a state about protecting those things? Yeah. That's our biggest concern and that's when I was alluded to earlier when I said we have so many unique assets in Virginia. Protecting our port obviously is key, but Dulles Airport, they have tried to get into our 9-11 system to shut it down. That has happened in Virginia already. Be careful how I say all this because I do get some data. You would be shocked, let me put it this way, of how many businesses on a daily basis, hospitals, healthcare providers, that right now are being hacked and data is being taken and held ransom and they are paying it off with Bitcoin just to be done with it. Not even, don't even want to report it to the FBI. It's just not worth it. They don't want their shareholders to know. They don't want cuspers to know. But this is going on today at an alarming rate. So we meet in Virginia obviously because of the rich assets that we have all the time to protect those key core assets. There listen, they want to get into our electrical supply. They want to get into our water supply and it's going to happen. And that's the point I go back to when I tell the other 49 governors or actually 55 when ENJ is the governors in the territories as well, that if you get hacked and your data gets stolen and you've been alerted to all the stuff that's gone on out there and you haven't done anything to protect your assets, you're going to pay a huge political price for it. And I think that is really, the stuff in the news I think has really got people, everybody's paying attention to this. It's scary what's going on out there. And we can be great today in Virginia. Tomorrow there's going to be some new creative person somewhere around the globe who's going to come up with some new way to get into our system. But having them come in and steal some of our personal data of our citizens in Virginia, that's horrifying for us and health records and things like that. The OPM breach was horrible. I mean my secretary of veterans affairs in Virginia, I convinced the four star admiral to come work for me. He's in my cabinet. He lost everything, his fingerprints, everything. Got hacked on him, Admiral Harvey. Scary. Over here. Good afternoon Governor, long-time listener, first-time caller. What are you looking, any other governors, looking for support from the Trump administration with regards to cybersecurity since you are the chair of the government? Looking for what? Looking for the Trump, what type of help or support are you looking for from the Fed? From the Trump administration. Oh, what are we offering help in that? No, what are you looking for? What do you need? What do you need? From you? No, not from me, the Fed. Oh, from Trump? I've done my bit. I'm in the private sector now, so. Well, it's a good question. And as I say, different agencies of federal government have done a good job. They have to, obviously, our security agent defense and all that. But let's be honest, there has been a benign neglect by the federal government to deal with this issue. The reasons why we're honestly having to do at the state level is that the federal government can't get their act together. Do you know in Congress, they don't even have a committee that deals with cybersecurity, and the problem and the reason is, is that no one wants to give up their turf to have one designated cybersecurity committee. Think of that. I mean, let's be honest, no one wants to give up the turf. So there are 80 different entities in the United States Senate that deal with cybersecurity. And when you have 80 different committees and so forth, nothing gets done. And we just met, we took the governors up, we had a good meeting with the senators, and they were very honest with us. Yeah, you're right, we need to do this, we need to do this. But this should be done at the federal level. There should be a national, what I'm trying to do for the governors, there should be a national standard of what should happen in states to protect one's data. But they cannot get legislation out because nobody can take control of this because it is scattered to so many different committees. And unfortunately, due to partisan politics that has gridlocked this city, nothing is getting done. And the point I tried to make to the Senate, when we sit here in Rome Burns, there are people trying to figure out how to get into our system. So, you know, President Obama, before he left, he put a commission together. And they just came out with their results and all that. But I hope the Trump administration will pick up the recommendations and Tom Donilon headed this up. He used to be the national security advisor. And we get in the game and start getting some substantive legislation at the federal government. Because right now, we don't have anything. We have nothing. But I'd also like to see the federal government get in this education piece to what we just talked about. They ought to be incentivizing, helping us at the state level, incentivizing teachers, requiring us through new essay, requiring us to be doing things in our states on, we got to get in the game in America on this. Other nations are moving ahead. And we're unfortunately caught, you know, partisan gridlock in Washington. And that's why we're having to do this at the state level. So you asked how you can help me to call President Trump up. Say, get a hold of the Obama recommendations. But let us as America lead on cybersecurity. It's the biggest threat I think we face in our nation today. And listen, they're getting in, as I say, they tried to go after my 9-11 system. They're doing hospitals. They want to shut down water supplies. You can wreak havoc on a community very quickly. So we got time for one last question over here. But before you ask your question, I'll just say we were I was reading something last week about what is going to be the big innovation pull, right? Back to Sputnik, back to the sense of the moonshot and how much innovation that pulled obviously altogether, but then spilling out. And when you think about it that way, you know, defending ourselves in the cyber domain. And that's an ongoing process. And we'll just get more and more critical as we move to the Internet of Things. The way you frame it as a national challenge, it could be a major innovation pull. I mean, these new autonomous vehicles, they're going to be able to get into those, they will be able to get into drones. You worry that they might be able to get into our aircraft. Think what they could do. You get in our aircraft and you get in our nuclear subs. There's a lot of things that obviously we've got to worry about. We've got to worry about. Last question. Paul Joyo, NSI. Governor, thank you for your leadership in the Governance Association. Have you considered trying to get, go to the federal government to get a grant structure for states and in cyber security? We have it for Homeland Security. We have it for law enforcement. We don't have it for cyber. For states to come up, they need to have the funds to upgrade their IT departments, their staffing, et cetera. We have to find a mechanism to provide funds to states. They're not all as wealthy and fortunate as Virginia, but there's others that need help. Yeah, that's a great point. And when we met with the Senate the other day, this is the point we tried to make to them. Give us some performance grants. We can work with us, some shared things, federal state to do it because you're exactly right. The reason why a lot of states probably haven't done this is they didn't think about it. It's not in their budgets. Remember, as governors, we do not, we have to have balanced budgets. We don't, we're not like the federal government. We cannot run deficits. We have to balance every year. And for a lot of states with, you know, declining revenues and this disruptive economy and so forth, they don't have the money for certain states to be able to do what they need to do. And that's why we're trying to step up at the NGA to help them do this. But I couldn't agree with you more. If the one message we could get out of here, if we could convey is that the federal government needs to get their act together in this. The Congress of the United States of America needs to lead on this, incentivize us. You want to talk about infrastructure? I'll tell you, the best infrastructure you can spend on is cybersecurity to get all of us states up to where we need to be. And it should take, and the federal government needs to get into it. Because if we lag behind, we are going to pay 10 times the cost of them being able to get into one of our serious defense assets, intelligence assets, or whatever it may be, or just a water supply. And then, you know, how we react in this country. Then we'll just, you know, after 9-11, if you remember, money was no object. And there was money for all, everything. We need to do it at the front end before someone is seriously hurt in this country. But you're exactly right. The federal government should be doing grants. We tried to convey this. The governors, trying to get 50 governors to agree is never easy. We agree on a couple of things. And this is one area where we actually do agree on. So, Governor McCullough, you have made, listening to you, I think cybersecurity is about defense. It's about education. It's about jobs. And it's about the future. I can't imagine a better conversation for this conference. Thank you so much. Thank you, everybody.