 last hour of the day. Sorry. So I'll tell you a story real quick. It is August of 1990. I am just got done with basic training at the Air Force Academy. And they bring us in to the Arnold Hall Auditorium. And as you may remember from basic training, you're in like a news blackout cycle. And they say basics, it's time for us to tell you what's been going on in the world. And they said, you know, the United States may be on the brink of war. And I thought, yeah, right. You know, I've seen Top Gun. It's a little too convenient. You know, you get done with basic training. This is what you've been trained for. And they started to show us videos. And I thought, well, that's pretty impressive. How'd they get Dan Rather and Walter Cronkite to start talking about this weird little country called Kuwait. And the fact that it was just invaded by Iraq. And as the briefing went on, it became obvious that no, this is actually real. I was about to spend my first year at the Air Force Academy watching as the Air Force started preparing for First Operation Desert Shield and then Operation Desert Store. One of the coolest experiences that I had when I was there was in January of 1991. We're all glued to the little EGA monitors watching CNN, because we could flip the monitor to receive a little RCA signal. And we saw the beginnings of the air war. And we saw Wolf Blitzer out in the middle of Baghdad. And we were watching it. And all of a sudden the report comes in that the first wave of the attack was over and all the planes were accounted for. And there was this cheer that went up spontaneously around the Academy. It was one of the coolest moments of my life because it's just hearing that spontaneous eruption. A couple of days later, I heard General Horner's, use a term I had never heard before, air supremacy. Yeah, he said, the way he described it, he said, even the birds flying over Iraq now have American stars and stripes painted on them somewhere. And that was 30 years ago. So for my entire career, I'm 21 years retired Air Force. We've had the expectation of air supremacy. We've gotten good and gotten used to operating in an environment, at least in the air, where we know what we're doing. We're the big dog on the block, no one's got challenges. The Air Force has had a great origin story. We talked a lot when I was a kid about how important it was that Air Force members, that airmen be led by officers who understand the unique aspects of the domain in which they fight. Cool. Well, right before I retired, I did a research project for the Chief of Staff and it was trying to improve data flow to the cockpit. And I was the one nerd. I was the one non-pilot on the study group. And while I was in Arizona, I heard a young captain say something which just tore my heart out. He said, yeah, you know, sir, we're the Air Force, so we delivered yesterday's solutions tomorrow. And I thought, oh my gosh, what just happened here? You know, the Air Force I joined and wanted to join was the Air Force that created things like the X-15 or the SR-71 or the Valkyrie. You know, some of these cool things. We didn't look to the airlines to see if we could catch up with them. And yet we were doing that. In fact, the Air Force is about to be kicked out as some of the best airspace in the country because it can't keep up with the ASDB radios on their aircraft. It can't get it to work. And it turned out, the conclusion we drew was that cyber was the reason that the Air Force is starting to fall behind dramatically, technically. And this is a pretty big existential threat. You know, the Air Force is supposed to be of all the services, the service, that is most capable of defending the nation in a high-tech manner. And so what I want to talk about today is are there some things that three decades of air supremacy have given us so much confidence that with that confidence, we've now started to rely on some assumptions that are now hurting us in cyberspace. So a little bit of my background, we're just happening there. A little bit of my background, I have 21 years Air Force. I've been also doing this four years as a consultant. I've been a professor at the Air Force Academy, Deputy Head of the Compside Department, also taught for the Military Strategic Studies Department. I've caught hackers with the 33rd when it stood up in the late 90s. Head of the Cyber Defense Branch for the Air Force Research Lab. I currently, say again? Bill Gehrig. Well, I don't know about that, but currently right now, one of the jobs I do is I support OSD doing a lot of the war games for their cyber resiliency exercises. I want to give three observations that I think we're getting blinded by. So observation number one, defense is done by operators. And what do I mean by that? We hear a lot of times, commanders say we need more cyber. Pretty much every time we do a war game, we talk to commanders, especially also one more disclaimer. I am coming more from a weapons systems perspective. Cyber and weapons systems is kind of where I'm most interested in, not so much the general purpose IT system. So you may have to make a slight adjustment, but when we talk to these commanders of their weapons systems, when we say how confident are you that your weapons system will survive a cyber engagement from an adversary, we get not very much. And they say they know we need more cyber. One of the things if you're in the military, right? The best thing to be as a commander, or the worst, depending on your position, the second best thing to be is the three. The operations officer, because operators are the ones that do the fighting. Okay, and if you can be the operations guy, that's the one that you wanna be. Now, the result of this is we tend to, and I think we're seeing this, the Air Force is right now looking at changing from the structure that it was to all cyber airmen are becoming more OCO and DCO focused. While we were doing an assessment of one of these weapons systems, one of the really brilliant MITRE engineers pointed out, she said, you know, is your system, I know you wanna defend it more, but is your system even defensible? And one of the things that really resonated with me was that the Air Force doesn't really think about the concept of defensible ground, okay? In the air, there is no such thing as defensible ground. If you can get the high ground, that's good, but that's about it. You don't really worry about the terrain. It's not something that's in our DNA as an institution, okay? That picture there, anyone know where it's from? It's a statue on the valley wall of Thermopylae, okay? If you've seen the movie 300, you've seen the story behind this, okay? It's a great story of how a very small force of Greeks was able to withstand a far, far superior, numerically superior force of Persians, okay? The reason they were able to do it, they had defensible ground. Now, what do we mean in cyber when we say defensible ground? Is your system, especially your operational system, defensible? So perhaps I wanna make, I've been kind of going over this in my head, I wanna maybe offer one working definition that if your system, if the mission to your system can be impacted by at most one vulnerability, by the exploitation of one vulnerability, including zero days, then your system is not defensive. We show over and over again, the commanders keep trying to patch their vulnerabilities. We ask them, well, what happens if they get into your system? Because especially for a weapon system, an adversary is gonna be patient, they're gonna take their time, and you have to assume, because usually with a weapon system, there's an air gap. If you're gonna jump that air gap, you're not gonna risk it by doing a relatively common exploit that everyone's seen before that you can find with a Nessa scan, okay? You're probably gonna use a zero day, you're probably gonna do something pretty exotic. Now, when we start talking for OSD, we keep noticing they want more cyber defenders, more cyber defenders, and what we argue is that the Air Force wants more cyber defenders, they probably need more cyber engineers. Probably some people who can look and make this system more defensible in the first place. How is this different from compliance personnel? In theory, your compliance personnel should make your system more defensible. The argument I would give is this. Let's say you were making a banking system where you're going to deal with real money, okay? Well, one way I could do that is build out my system, then categorize it, it's probably gonna be very high on the categorization spectrum because I'm dealing with real money and there's lots of people that are highly incentivized to break into my system. I'm going to then look at the recommended controls and implement all those controls and keep patching and trying to keep up with it, and do anything in that way. If you did, that's basically the R and F process, right? I guarantee you someone's going to, we see systems built like this and people do really steal real money from systems built in that way every day, okay? Option two, you could do that plus you could add cyber defenders, right? We're gonna try and look for the bad guys, try and find people breaking in. Again, happens all the time, does work but we still get stolen from. Option three, design your system to be defensible. Design your system to be able to operate in the presence of an exploit and that exploit could come anyway. And doing so, you're gonna have to not defend the boxes which is most commonly what you see in IT systems, you've got to start defending the mission. Now an example of that would be Bitcoin, right? The Satoshi paper assumes that multiple systems can be compromised, will be compromised, okay? And it's designed to operate through that, okay? Now the problem is there's no way right now that the Air Force has the ability to ask for this, okay? There's nothing that Commander can do right now. We see lots of them that can say, okay, I want more cyber and they usually can say, okay, well, we can send you more CPTs or maybe we can send you more MDTs, okay? I am proposing here today, I've made this to a couple places, the possibility of a CET, a cyber engineering team that can look and start to examine your mission and say, are you in fact engineering your system well? That's number one. Number two, air tasking orders are for planning. Okay, I was gonna say ATOs are for planning but the problem is in this audience, you might say ATO and they might think, oh, authority to operate, no. Okay, if you've ever dealt with the ATO process, it's an incredible thing but it is based on a very air specific reality, okay? In the air, airplanes have very limited amount of fuel and so you have to choreograph the air war, right? Those airplanes have to be at a certain point at a certain time and if they're not, they can't wait around very long. They only have a limited amount of fuel and so when you're doing planning, you need to figure out to a very specific degree where everything is going to be and make sure all these pieces come together. It's a three day 72 hour process. It's this assembly line of death. The key thing with an ATO, however, is the fundamental question you're asking is where do you want the bombs, okay? So what's the coordinates, X, Y and Z that you want the bombs to be? How big do you want the bomb and when do you want the bomb to fall, okay? And the ATO process really is designed around putting all those things together and making sure it all comps, okay? As I said, it's a, okay, let's see if this can work. It's a 72 hour process from beginning, you know, I'd like something to blow up till the time that bombs are in the air. Okay, let's move back here. There's a limited range of effects. A bomb only interacts with the physical environment in more or less one way, okay? That's usually not too good, okay? But none of these things are really relevant to the cyber domain, okay? Let's talk about the Intel Corporation. So at the Air Force Academy, the Intel Corporation is kind of interesting. The Air Force Academy right now is the only entity which has a direct relationship with the Intel Corporation. Now the reason they do that is because the Intel Corporation said we don't wanna have lots and lots of relationships with the government. We only wanna have one. And we wanna make sure that this one relationship is going to be plausible enough that's not gonna harm our international sales. So for instance, if the Intel Corporation had a joint research agreement with the NSA, that would probably tank all of their international sales all over the world. But they said, okay, the Air Force Academy is a military institution. It's close enough out west. We can couch it with an academic research thing. Pretty cool. One of the things they did was they taught us how they did their form of planning. Now for the Intel Corporation, when they plan for building a new chip, it takes 10 years from the time they say, gee, I'd like to build a new microprocessor until the time it rolls off the assembly line and is starting to be operationally used sold in CPUs, 10 years. Okay, now if you think about it, what would it take for you to start planning what CPUs would look like in 2029? Okay, if you can imagine how difficult that is. Well, what they said, which is really surprising, and they actually offered to the federal government, they said, look, we're gonna teach you how we do planning. Okay, and it's pretty interesting. They said, here's the thing. It begins with storytelling. So they hire a whole bunch of storytellers and the Intel Corporation will look and they'll say, okay, what would a computer in 2029 look like? And they write a whole bunch of stories and they just write them out and they put them all together and then they start grouping and they say, okay, what stories are the good stories we'd like to tell and what stories are the bad stories that we would like to see not come true? And they start to think about, what are the common threads and the good stories and what are the common threads and the bad stories? And from there, they start to figure out, okay, well, this is how we're going to make our CPU and then they start to worry about the technology. One of the things we found when we were doing Wargaming, at first, we started looking at availability, right? A typical cyber attack, usually, and we even saw this with Russia when they did the invasion of Abkhazia and Ossetia in 2008, a junior varsity player, when they're doing cyber attacks, they're gonna do availability attacks. They're going to denial of service, they're going to try and turn your system off, okay? As you get more mature, you're gonna start getting into integrity attacks, okay? And integrity attacks are kind of interesting because they're very, very open-ended. In effect, if you're gonna do planning with an integrity attack, you have to start asking what lie do I wanna tell? So what lie do I wanna tell? Who do I wanna tell it to? And who is going to be doing the telling? And then under what conditions? Okay, that is a very different challenge than where do I want the bomb and how big do I want it to be? When we did red TV, we noticed that we would bring in a lot of folks, including from NSA and some really decent people, folks that could write a buffer overflow attack, folks that knew how to break your route or 10 waves from Sunday. And we said, okay, let's assume you have access, let's assume somehow there's a way to get in. What are you gonna do next? We would get crickets. And after seeing this over and over and over again, realizing, you know, the Air Force isn't training people to start thinking about how to attack in cyberspace. It's a real-world example. In 1999, I'm on the ops floor at the 33rd down in San Antonio and we caught a guy breaking into a Solaris computer. And we watched him do it. It was a lot easier back then when it was just tellin' that and everything was unencrypted. But it was pretty cool. It's like, oh, cool, there's the buffer overflow. There's it, get in. We watched through the little soda straw lens of the command line as he starts, you know, looking around the system. While we're doing that, we call up the base and we said, hey, by the way, here's the IP. This is under attack, it's just been compromised. And the guy goes nuts. What's going on? He goes, well, that particular, at the time, that particular system contained, was the master database that contained all the orbital vectors of everything we were traveling, we were tracking around the planet. Now they're like, now the good news was the guy didn't know what he had. Okay, if he did, he could have crashed the space shuttle back when that was flying. But once again, it illustrated to me the fact that the attacker was so focused on how to get in. And from the defender's side, we're often so focused to keep people from getting out that we stop asking the questions, once you're in, what do you do next? And how do we plan for that? Both from the defensive side, because if you understand, if you start telling stories to each other about what would an attacker likely do next that would really mess up your day. Okay, give you one more example. We asked the superintendent of the Air Force Academy, what would be the thing if an attacker broke into your network that would get you fired? Any guesses? Football ticket sales. Okay, it turns out we invite 50,000 people to watch our football games every year. And at the time, the football ticket sales were being transmitted over an unsecured Wi-Fi network all the way to the Athletic Center. And it's like, you know, ma'am, imagine someone coming in, sitting down with a sniffer and then receiving the credit card numbers of all of the neighbors that you just invited in. That will get you fired. But if you start thinking in terms of stories, you can start really planning and preventing some of your attacks. Now the problem is who can fill this gap? Is anybody trained to do this today in the Air Force? Do we encourage our folks to start telling stories and to start thinking in terms of what would I do next? Number three, the randomness of fog and friction. So if you talk about randomness in warfare, it's an old concept. When Julius Caesar crosses the Rubicon, as he's about to plunge the Roman Empire into a huge challenge, he says, the die is cast. In other words, we're gonna roll the dice. Let's see what happens. Today, if you talk about fog, if you talk about randomness and you look up in the doctrine, you're gonna see fog and friction as generally being the overall concepts that cover that. And that's not bad, but it's incomplete. So I wanna play some dice games with you for a minute. So let's say you take three dice, you shake them up, you roll them, and you add up the results. Well, you'll probably get a result that if you calculate the probability of you getting a different result, it'll look like that. What does that look like? Normal distribution, a bell curve, yeah. By the way, has anyone actually taken three dice, rolled them, and added up the results? And then maybe assigned them to Strength, Intelligence, Dexterity, Wisdom? Some people probably play Dungeons & Dragons, that's exactly what that's based on. And Dungeons & Dragons actually has a tie to Wargaming as well. Gary Gygax actually was playing a medieval war game, and then all of a sudden he had the idea instead of them facing war knights in the castle he put a dragon on the other end, the guys had played with them, thought that was so cool and then D&D was war. But this works pretty well for describing physical systems because Strength does show up on a bell curve. Intelligence, at least measured by IQ, does show up on that bell curve. It shows up over and over again. And so these dice games actually do make sense for war games because they're pretty good at modeling physical systems. But I wanna show you another dice game. So in this game, and I'll explain why this works a little bit later on, but you roll the dice, if you get an even number, stop, you're done, you get no points, go away. If you roll an odd number, you get one point, and you get to roll again. And then from that point on, every time you roll an odd number, you get to double your score and go again. And you keep going and going again until you get an even number and then you stop. Now if you plot the probability, this is what you'll get. Couple things to notice, most people get what? For a score. About half will get it even, they'll get nothing. Some people will get points, and some people will get a lot of points, and some small percentage will get a heck of a lot of points. Okay, now, this, what I've just described to you, is a, the mathematical term for this is a power law distribution. If you've ever heard the concept of the 80-20 rule, you've just encountered a power law distribution. Okay, if you've seen Occupy Wall Street, like 99% of the people, 1% of people have 99% of the wealth and vice versa. That is another example of the power law distribution. Anytime you have a situation where most of people get one, get nothing, and a lot, I'm sorry, most people get nothing, and a small percentage get just about everything you're encountering a power law distribution. Yeah, why does this matter? Turns out, cyber systems show over and over again power law distributions. Why do I care about that? Well, our brains are used to dealing with randomness, but the randomness they're used to dealing with is the randomness we encounter in a normal distribution, and the air forces evolve in the exact same way. And so my argument is, we'll show you why, but if you're playing the wrong game, you're much more likely to lose. Okay, now, where does this show up? Okay, so in 1999, a group of Notre Dame mathematicians started to examine the structure of the internet, and specifically they started to examine, at first, the structure of the worldwide web, and they said, what are the odds that someone is going to link to your particular webpage? And they assumed that it would be a normal distribution, most people would get a few links, a couple of people had very popular web pages, and a few people would have very, very unpopular web pages. What they found, it was a power law distribution. Most people never got linked to. Some people got linked to a lot. Structure of networks. People used to ask us over and over again, what is the structure, I want a map of my networks, of the network they have. And it usually looks something like that thing on the left, which is a map of the internet, according to one visualization. Guess what? It's a power law distribution. You know, you can tell? The firework distribution. See, the center of those fireworks, there's something there that everything is linking to, and it's important. So if you understand that, oh, this is a power law distribution, you'll understand why that network map looks the way it does, and you ought to be asking yourself, because another power law's distributions are also what they call scale-free distributions, meaning that that structure will show up at every base, at every match, come at the national level and the international level. It always shows up at each level. You can be another way of putting this income distribution as a power law distribution. You can be the richest man in the world, and the disparity is huge. You can also be the richest man in town. The disparity is still big, just for a smaller, local area. This is also, by the way, why the Kevin Bacon game works and why you can receive Netflix. Because some of those people, like Kevin Bacon, are connected to a lot of different actors, because they show up, they act in a lot of different movies, and most actors only show up in one, maybe two movies. In the network structure, some of those hubs are massive and they receive all the important links, and that is why the diameter of the network, the time to go from side to side, be as much smaller, because we have these key centers at the center of those fireworks that put it all together. Software library dependencies show up as power law distributions. Most libraries only get to be used by one or two programs. Some get to be used by a lot. Effectiveness of malware, most malware is seen only once in the wild, and never seen again, but then every now and then you get the heartbeat virus that shows up and affects everybody. Network traffic patterns, most people, if you have an IP to IP connection, most traffic never occurs, but then every now and then you'll see everyone jumps onto and hits one particular network thing and we call it a network storm, okay? All of these things, the researchers found out that any process that exhibits growth, it's something that's growing, it's something that's changing, preferential attachment. The idea is if something is working, more people wanna get on board with that. You've seen a video, once someone sees a video, then they share it with someone else and then they share it and they share it, and if it's good it keeps growing and growing and growing, goes viral. That's an example of preferential attachment. In short, this is a mathematical fingerprint for evolution, okay? Now, why is that important? Your networks were not designed, your networks evolved. So stop treating them like they were designed. Okay, they weren't. We can show it. Okay, but this is the one I wanna talk about where it really shows up and that is in the physical world, how do we create our force, okay? So in the Air Force, right, we have these things called recruiters and they recruit and they care about how many people do they get and what is their average quality, okay? Now, when we put people through basic training, right, we know some people are gonna suck and some people are gonna be awesome, okay? But we don't care, okay? We care about the average and we discount the extremes, okay? Now the reason we do this is because what we care about fundamentally is the power of teams, okay? If you are part, fighting in the physical world, it's about numbers, okay? Imagine if you are a six sigma pilot, you are a one in a million pilot. How many aircraft are you gonna shoot down on the course of your career? Maybe two? If you're lucky. If you're lucky? Yeah. Zero. Maybe zero is a good chance. You could be a one in a million pilot and you'll shoot down not a point, okay? Now, if you do that, are you going to, if you're a one in a million pilot, are you really going to affect an entire air campaign? Probably not. Probably not. The guy at your wingman who are good enough, if they're trained well enough, will probably be good enough, which is why the Air Force says, hey, pilot, now that you've made field grade officer, it's time for you to get out of the cockpit and start leading people because we need good pilots, or we need good leaders desperately, and even if you're a one in a million pilot, you're really not gonna make that much of a difference so it will take the hit. There are professions that deal in the power law world, okay, and they look very, very different, okay? So, usually power law professions, if you're producing something which is non-rival, if you're an author, if you're a singer, if you are a model, okay, and your image can be copied. When we say non-rival, we mean that the product can be replicated over and over again, and if I have it, so can you at no cost, okay? So, an F-16 is a rival product. If I have it, you can't. An X-loit is a non-rival product. I can have it, and you can have it, we all can have it, and it doesn't diminish its quality, okay? Now, professions that deal with power law focus, I'm sorry, with these products, we only care about the extremes. We do not care about the average, okay? Think about the average musician. He's probably, or the typical musician, right? Nobody thinks about that, right? He's probably the musician that's playing piano in the mall, okay? And if he's lucky, you know, he might be able to, you know, afford Taco Bell at the end of the night, the five dollar box, right? We care on a power law career field about the extreme. Who is the top 10? Okay, likewise for authors, who is that New York Times best seller list, okay? For professional athletes, okay? Who is going to make the pro team? For super models, right? If you have one name that you're known by, you know, congratulations, okay? Let's go back to that dice game. The reason the dice game models power laws is it's a tournament, okay? Imagine you roll the dice, you roll odd, you lost to somebody, okay? You roll, I'm sorry, you roll even, you lost to somebody, you roll odd, okay, you get to move up to the next level of the tournament, and you roll again, and you move up to the next level of the tournament, and the next level of the tournament. And each time, with each step, there are fewer and fewer people that you're competing against, but the rewards go up exponentially. This is why American Idol works, you know, the TV show used to work so well because you're watching that tournament take place, okay? Now, these professions that take place with power law distribution, they're recruited very differently. You do not send a recruiter for musicians or athletes and say, hey, I got 5,000 athletes recruited for, you know, the Denver Rockets. You only want to find that one guy. They're trained and developed very differently. Okay, if you're an author and you write a New York Times bestseller, nobody is going to pick you out and say, hey, congratulations, it's time for you to manage and mentor other authors. You're done writing now, let's have you move into a leadership position. And they're compensated very differently, right? The person that found, the person that is the editor of the author, the person that is the agent of the supermodel, gets some money, but the model, the talent itself, they get a lot. Now, and these work because it's not the power of teams. It's not based on the power of a bunch of people to work together to solve these big problems. It's based on the power of a good idea or something compelling, something that's going to capture attention or eyeballs. So what about tech? Well, let's look at the salary. Tech is kind of in between. If my daughter came to me and said, dad, I want to be a musician, I would probably cry. If she said, dad, I want to be a physical therapist, okay, good, she'll have a good, average salary. Tech, you can have a pretty good, average salary. However, when we go to the extremes, the richest men in the world are also all in tech, like Jeff Bezos, Bill Gates, all those folks. Recruiting. We recruit a lot of average cyber folks, but we also look for some very, in industry, we look for various, very specific people. You may have seen some of the Google job applications where if you search for very specific patterns and strings, they might say, congratulations, we think that you have the horsepower to become a Google employee and they'll go after people individually. Development. Usually these people will, in a power law world, we're generally speaking, going to put them together with other superstars and have them rub off on each other. The Palo Alto Research Lab is a great example of that. And disruptive potential. If you are a dentist, okay, a physical world type career field, you may feel, you may be a Six Sigma dentist. You may be a one in a million dentist that can do such beautiful fillings and root canals that people just aren't at all. It's like you have velvet hands reaching into the person's mouth, but it's not gonna change the industry. But one Six Sigma cyber person can, okay? For the good and for the bad. My company learned that the hard way, right? We hired Edward Snowden for two weeks and then he got what he wanted and left. Dang it. Now, the question is, is a good idea, how could that affect a cyber campaign? What is the power of that? If so, perhaps we need to start treating cyber in the way we deal with people more like the cyber career fields or the power law career fields we talked about earlier, the musicians, the authors, and less like the basic trainees that we have, you know, we're bringing a bunch of folks in the army. This may be a bridge too far, but perhaps it's worth looking at it because the Air Force is kind of stuck in between these two realms. So, in summary, in 1984 there was an author that published a book called The Neuromancer and in this book he basically described a world where a bunch of people got together and plugged into a network and they enjoyed a common shared reality. It became the basis for the movie The Matrix, okay? But the idea is that these group of people created this shared illusion, okay, because they wanted to, okay? One of the challenges in being with such a successful entity as the Air Force, which has really had a lot of well-earned successes, is that the stories you tell each other might blind you to some of the new realities that are coming up against you. And so, all the successes we've had in the Air Force and the physical world may be hurting us when it comes to the cyber campaign, okay? And so, once again, if we're gonna fly, fight, and win, we may need to reassess these, both in fact that cyber engineers and not operators should be the ones that should be so crucial to the defense of your system, that right now our planners really don't know how to, I don't think are terribly well-equipped to plan in a cyber campaign and that the way we recruit, develop, and compensate our cyber personnel may need to start looking like the power law professions and not the way we're doing it today. So, with that, any questions? One for you, sir. In your time, really, when you were working with the 33rd and I suppose, wherever else, this gets into your point about the planning and more so the top level, what kind of terms did you and your team use? Did you use cyber specific terms or did you use the racist terms? Because something that seems to have happened lately, I work in the network operations center, is we use terms like flying sorties to refer to our missions. If you call them access missions or escort missions, we refer to the time we spend in a, when I say we need to win, we're almost the time they spend in an adversarial system as time on target. Terms that we're not pretending to be fighter pilots here, but I feel that when we provide these in briefings to our senior leaders, they're probably not getting what we're trying to tell them and in part that may be because they don't understand our actual capabilities. Yeah, so we had to, so it's so funny because we would have to translate all the time into pilot speak and that just was a constant challenge for us and that's one, and so, yeah, exactly. It's a little depressing to me that 20 years after we were doing the same thing, that that is still occurring and in a sense it's a real, almost a repudiation of the Air Force origin story because what we've said was fundamentally, look, airmen have the right to be led by officers that understand the unique aspects of the domain in which they fight and if you're doing that, that represents in my mind a fundamental failure of who we are. I think you're absolutely right on that. I think a comparison would be in the earliest days of air war, let's say around the time of the First World War, if we were forced to, or rather if the Air Service were forced to refer to its engagements as air bayonet fights because the infantry officers couldn't understand the concept of dog fight. Yeah, exactly. And so what happened as a result of that many years after? Split off. Yeah. And I think that we do need to go in that direction. Well, there's, so Joint Hub Five, for getting some second up, we'll get some second up, but you start with strategic guidance and what are you trying to accomplish. You talk about, you describe your current system and then you describe your desired state. Desired state. Yes, the thing that separates you from where you want to be is called the problem. And then you build the commander's intent and the hospital and that sort of thing. Okay, so I've given four warning here, like I live and breathe in the desired state and I'm calling you to join me there. So the extent that you saw the break from army to air, at that time they didn't understand, it's a, they didn't understand, I don't, I'd like to understand where the word domain was first introduced. Maybe they did understand the concept, but we use that all the time nowadays. And what needs to happen is, what's going on right now is we're having a lot of discussions in the current state. You're at this measurement, now let's move three inches further, ah, success, you're still in the current state, all right? So we need to build the desired state and then migrate that. And we're not telling ourselves stories to get there. And so I'm more, I have a paper coming in that this is about re-architecting how we defend the nation. So I'm going, and I love your reports, you're going to organize training with forces on the domain who are certified. So we have services and the deficit is sort of joint responses in combination of the four to one service, all right? So what I'm going to architect is domains. We organize training with two domains. So if you operate on the land, you're in the land domain, the air domain exists above your head until you're in that oxygen. At that time it becomes the space domain. Cyber, we added space to the air force and the air and space force, so it was kind of sort of first, the cyber was the first one is to have and say the fifth domain, all right? So we're going to organize training with cyber forces. Just as we have air domain when you operate in the air, you're currently in that airmen, people who operate in the air, fly things, great, I don't do that. Army guys have done what we want. So we're trying to afford with a spoon right now. All right, because we're still in this current state trying to move three millimeters further than before yesterday. So we organize training with the cyber forces. So we have air forces, naval forces, space forces, land forces, cyber forces. We organize training with the cyber forces. And I've been into this thing. In the commercial world, we have the operating on the ACC model. So we have an A, your power law, your horse, as your CCI E. Network Terms Cisco, sort of, I don't know what you're expecting me to have a hand full of CCI P's and you have a lot of CCI A's and you grow A's to P's to P's to E's. But all they're doing, all they're doing is networking. Yeah, I'm not being pulled off. Well, and as a guard guy, I'm a traditional guard guy, so when we get a month to a year, I do this. But when I'm not doing this, I'm hands-on, route switch voice wireless in the, the only Fortune 500 company in Alabama and then the next largest fortune company, 700 something Vulcan material, so, Regents Bank, but that's all I did is Friday through Friday. Route switch voice wireless. Occasionally, once a year, you get interrupted for some process. How often are you interrupted? I don't even know if you're able to see with whatever it is. Yeah, your question. One, two, is it a single digit? I don't think I can go 20 minutes. I'm in COIC, the network operations shop at the I-NAS West. I don't think I can go to 20 minutes, even back when I was doing more technical work before management, so I don't think I could go 20 minutes without being pulled aside for either a meeting or a phone call or some sort of additional duty. I can only imagine how good I would have been at route switches had I actually done that all day. Now then, yeah. I love the military. I love the military, almost 28 years, almost there. So love, calm, love the military, but the military is a self-licking ice cream cone. The military is inside of a mirror cube and when the mirror, when it looks at itself and the mirror, it wants to reflect back itself as a behavior on it. You need to bow, you need to wear the right clothes, you need to wear the right things, you don't salute the general's car when it's driving past you. We're gonna have a discussion about that like three or four hours that day, right? You know what you mean, sir? Correct, you know, the military, military needs the military and it needs to do military stuff. But these are, I'm taking off the line. That's, we got a couple quick things to go back. I think this should only have a stand up for us. Okay. I just had a story, because you're talking about telling stories. I was in ASSOC from 2009 to 2015 and I was honored to lead the electronic flight by initiative before EFB was even term. Okay. And ended up flying with a vice commander. I was testing nine different devices illegally in the plane. And, but we had top coverage from a Lieutenant Colonel that was like, hey, you guys get this idea, run with it. And ended up flying to Maxwell, actually Air Force Base and a big thunderstorm came in. I had an iPad and it was a perfect time. And I came out and I had my briefing on the iPad and I said, hey, sir, we can't take off. There's a huge thunderstorm outside. And I gave him the iPad using for flight. And I showed him, here's the thunderstorm, here's the approach leading out of here. And he's like, what is this thing? And I said, oh, this is an electronic flight bag. And he goes, oh, I've never seen one of these. And I was like, well, check it out. So, you know, he freaked out on the spot because he saw the technology. And then he said to me, hey, call me tomorrow. Oh, you can't call me, you're just the captain. And then two weeks later, 300 iPads showed up at our squad. And so we, and this is like late 2009 or early 2010. So I'm in combat flying with an iPad with the most classified plane, one of the most classified planes in the U-28 at the time. I don't know if it's still as classified, but back then it was super classified. And so here we are testing the iPad downrange 2010 in combat. And Vans Air Force Base just got iPads at the beginning of this year in AACC. So I came back to Vans Air Force Base in 2015. I was so frustrated with the Air Force for a lot of innovation. I separated in 2017 to start a company to do innovation for the Air Force because they won't freaking do it for themselves. So there's a story for you, if you need a story of it. We saw over and over again where pilots were bypassing the comm squadrons. Like we would go to the flight line and talk to the pilots and we'd got stories like that all the time. And then we would go to the comm squadron and we'd be like, so tell us about your network. What about those pilots? And they're like, oh yeah, I don't do anything. It was unbelievable. Because we're doing all of their jobs, like all of them. We're doing DTS for them or because of these terrible pieces of software that suck that we have to use that we solve our time so we can't freaking fly our planes. So that frustration, I mean, I separated, completely separated to start my own company at 13 years after duty. No retirement, no nothing to innovate. Now the good news is you're on the power law distribution pay scale. Not the... Well now I'm on this crazy, because innovate wasn't even a word in 2015 and now it's almost a curse word. There's like too much innovation. Like, ah, stop it. You're like, the reason why people are saying stop it is because you're not solving their freaking problems. You're creating more problems. We're still talking about it. So that's giving you this. Well, but they're creating more problems. Like, they create something and then they shove it on their throat. You could say pecs or e-pecs or Tims or mick tea or name up freaking software that's terrible, right? That when you just log into the network it takes you 10 minutes to log in, right? So how do we solve problems? So... If you can log in at all. Yeah, if you can log in at all. So we chose the domain of basically smartphones because all the airmen have smartphones and so we're solving that in a core platform called Base Connect. So our users are giving a, I have so many, I think, with thousands of users. Yeah, here's a question though. I mean, so, and this is probably the last one. I do want to honor people's kind of this. 650, feel free to go if you need to. I think we'll kind of like just do more of a one on one discussions. But most phones have softer defined radios in them. Could a phone be turned into a transmitter? Could that phone start broadcasting GPS? Absolutely. So we talked to the pilots and we said, okay, how many pilots fly with an iPhone that they own? And the Air Force has never seen, touched, or is even aware of the old one, right? And so we started to say, okay, what are the odds that I could start mucking with the aircraft through the iPhone and the pilot's pocket? Zero. I disagree. I could probably pull that aircraft off course if I wanted to. Prove it. Well, more, more. We have more problem. I saw a stunt in the Army where they were actually giving away troop positions because they had phones in the GPS trackers. Ask the pilot if he wants to know where the enemy, forget taking over the airplane. They're gonna figure out where your phone is and where the airplane is. Off! That's the bigger problem. They did it with a phone off? No, not off. Okay, there's a big difference. Cause right, we had a young lieutenant we're flying in a place you're not supposed to fly. He left his phone on and take off and he got put on the terrorist watch list by the time we landed. And that went through the whole chain of command and our colonel pulled him in and was like, hey dude, I understand you had your phone on you because here's your name, literally on the list. We had a good list. I thought I was supposed to get him off of this and then we explained to everyone else, make sure your phone is in airplane mode. Right? Because somehow he connected to a tower in that country and it's like, why is there a U.S. phone and why is there this and this and this? And by the time we landed, it's like, oh my gosh. So you learn to turn your phone off when you go to places like that. So I would say, I mean, but what you're saying though is, and that's what we ran into is that instead of innovating, we come up with a lot of reasons why we can't for example, question of how can we? Okay, I understand what you're saying but how can we fly with a phone? Okay, we turn it to do not disturb. We turn it to airplane mode. We turn it off during certain areas but I'm willing to take the risk here because it saves me 10 hours to just follow a flight plan. Oh my gosh, I take up electronic form and we print it off and we fill it out by paper and then we fax it and then they make a copy of it and then the student makes a copy of it. Something that's electronic, I can literally not in my flight suit even 30 seconds for my phone takes 20 minutes. Yeah, when the reserve pilots on our team that would fly for the airlines would show the iPad that Delta Airlines or United would give them to the active duty flyers. It was so different night and day. I loved your analogy with Chuck Hager when we did innovate at like so, what happened to the space program type stuff? Like we were like, this has never been done before. Right, we didn't look to the airlines. The Air Force I joined did not look to the airlines for inspiration of how to do technology. And now they do. Yeah, now they do, right? The airlines look to us, so I think that's kind of an existential threat. And now the airlines are still our pilots. And that's over 2000 short. There's a whole separate side to it for that. Well, I think that's the last thing separate you all from break, so thank you for coming. Hope you enjoyed it. Thank you.