And now from the University of Chicago Institute of Politics and CNN Audio, The Axe Files with your host, David Axelrod.

Jen Easterly is one of the most interesting people you could know. West Point graduate, Rhodes Scholar, 22 year Army veteran of Bosnia, Haiti, Iraq and Afghanistan. White House national security aide and now director of the blandly named but incredibly important Cybersecurity and Infrastructure Security Agency. There, she oversees one of the most terrifying and underappreciated portfolios in government protecting our country against cyber attacks. I sat down this week with Director Easterly to talk about her fascinating journey in America's cyber challenge. Director Easterly, it is great to be with you. So welcome.

Thank you.

I want to talk about your extraordinary portfolio, which should be of interest and concern to every American. But I also want to talk to you about your extraordinary life. And let's let's begin there, because you've really had quite a breadth of experiences that are very relevant to what you're doing today. But let's start with your family, because you come from a family of of public servants and your mom and dad had very varied sort of histories. Your dad, I guess his family goes back to folks who fought in the Civil War.

Right.

And your mom was an emigre from Eastern Europe.

Her parents first generation. Yeah. Well, first of all, it's great to be here with you.

Thank you.

Yeah. I love any opportunity to talk about my parents. Actually, I was just up in Philly seeing them yesterday. And, you know, I think, like most people, my parents were fundamentally responsible for the path that I've taken throughout my life. So. My mom grew up in Brooklyn, the child of Russian and Poland immigrants. Her father was an Orthodox rabbi, so she grew up in an Orthodox community. My father was born in Philly, in the suburb of Chester, did not have a father. His father, his mom was an unwed mom, had him at the age of 16. He was raised in his early years by his great aunt Jenny and his grandmother, Margaret. And I'm named for them. And those were the first three years I think were good. And then he was adopted by the local barber. And then things went downhill from there. He had a pretty terrible upbringing and was pretty badly abused, ended up dropping out of high school and went off and joined the Army. And that was and it was the early days actually, of Vietnam. He was in Tan Son Nhut with the third Radio reconnaissance unit, which is part of the Army Security Agency. He was there from 61 to, or 62 to 63, and it was really formative in his life. That was actually a very positive experience and that affected me listening to these stories when I was young about his time in the service and how he was able to make an impact, and he actually came back from Vietnam, got out of the Army and raised some money to build an orphanage back in Qui Nhon. And he and I visited there about 30, 30 some years later, which was an incredibly special experience. But so that was their background. They ended up linking up later in both their lives. When my mom was teaching English literature at Bryn Mawr and doing some night school teaching at Temple University, and she was his professor. So they they somehow fell in love over Milton's Paradise Lost.

That's Paradise found.

Paradise found, exactly. And then had to disentangle from the marriages they were both in. And it was all a bit of a bit of it to do, but they ended up together. And it's been a 55 year love story. So a great example for me.

They also went on to serve in significant positions in government. How did that happen? Your dad was a deputy secretary or an assistant secretary of defense in the Reagan administration, and your mom was undersecretary of intergovernmental relations at HUD.

At HUD, yeah, Housing and Urban Development. I mean, it's interesting. My father started out as a speechwriter, so he was writing for the postmaster General, Red Blount in the late sixties, and then he got a job as a special assistant to the president for President Nixon. So this was in the early seventies. He was the speechwriter there. And it was quite an experience, as you can imagine. I think he was there from around 70 to 73.

Oh, yeah. That was that was an eventful time in the Nixon White House.

It was an eventful time. So he was there until the end of the administration. So after that, he and my mom did some consulting and then they worked on the Reagan campaign. I have this picture because we went out to Wexford, actually, and made a commercial with Governor Reagan at the time with a bunch of school kids from my think sixth grade class. I was whatever it was, 12 at the time, and I had to memorize the Emma Lazarus poem that was on the Statue of Liberty. And, you know, that was. I That was my role in the commercial. Of course, it never ran, but I had a lovely day with the Reagans and a lot of jellybeans.

Did you at least get a get a copy, a tape of the commercial?

I didn't. It's probably somewhere in some some archives somewhere.

Yes.

I've got a great signing photo. And so that was fun. And then they after Reagan became president, my dad worked in the Defense Department as a deputy assistant secretary. He was portfolio for international security affairs as well as Africa. And then my mom went to HUD as assistant secretary for I think research and then ended up as an undersecretary. And so they were both in for about six years and then they both got out. Interestingly, my dad then was part of the veterans for Obama. So so as some for a short time in the Obama administration in the early days.

I should thank him for that.

Well, public service was something that kind of runs through our blood. And so no surprise.

I was it like as a teenager that, you know, to have both your parents obviously quite busy, but also ensconced in government, I guess you were living in in Maryland. It wasn't that unusual.

Grew up in Potomac. You know, it was something that had a huge impact on me because even as busy as my parents were, we spent a lot of time together. We had dinners together. We would talk about what was happening in the world. We would always go to the museums on the weekend. So it was just a terrific upbringing to talk about service and impact on the world, and it really had a significant impact on how I thought about what I wanted to do and where I wanted to be in the world.

They sound like such high powered people. Were there great expectations on you and your brothers?

You know, I think there probably were. I never felt pressure from them in any way. I think they expected us to do well and to do good things. But it wasn't this incredible stress that was put on me or on my brothers. I did pretty well in high school.

Yeah. You were valedictorian. Let's be clear. You did very well.

I did. I did well, you know, it wasn't.

I was a middle of the class student, so I'm impressed by that.

You had quite an impressive fad as well, David. So I did well in high school. You know, I decided early on that I wanted to apply to West Point to be in the Army.

Why? I was essentially you could have gone obviously, you were valedictorian. You could have gone anywhere you wanted to go.

Yeah.

Why West Point?

You know, I think it just had a real impact on me. My father talking about his time in the Army when he was in the Defense Department. I was, I met a lot of the folks that he worked with on his team. And it was to me, you know, a path towards leadership in service. And I was very attracted to it. So I applied early. I got in early. I didn't, however, ever visit the West Point before I arrived there on reception days. So I was terribly prepared for what West Point was all about, particularly they called the first summer Beast Barracks, which is all about, you know, getting up very early, getting screamed at, doing a lot of field work, doing a lot of physical exertion. And so, you know, I sort of got there and was like, oh, my gosh, what did I get myself into?

Shock to the system, huh?

It was a big shock to the system. Yeah.

You know, obviously there's been a transition over time, but when you think of the military, when you think of the army, you think of a lot of testosterone flowing. And what was it like for you as a young woman coming into that environment?

Yeah, it's a great question. You know, now that I'm many years removed from that, I am pretty thoughtful about the impact of that type of an environment on young women. I was actually just back up at West Point doing a lecture a couple of weeks ago, and, you know, you're in an environment and it was just about 10% women there. And you have you feel like you have to be as smart as as fast as as tough as all of the men that you're around. And by the way, this was 1986, ten years after women were were first admitted to West Point. And West Point had been around since 1802. And, you know, to be honest, not there. There were many men, cadets, instructors, leaders. Ship who didn't want women there, who didn't think women could be there, deserved to be there. So it was a really, really tough environment. And I thought about leaving many times and I'd never quit anything in my life, and I didn't want to disappoint myself, so I ended up staying. But, you know, one of my observations, particularly when I mentor more junior folks, is, you know, being in the Army, being in that type of environment. You almost have to put on this kind of body armor in many ways and be really tough, because that's the image people expect of our leaders. And, you know, a little bit of that is important because, you know, the Army is about values, but oftentimes it's about being cold, wet, tired and hungry. And so this relentless optimism of, you know, a leader who leads from the front and leads by example is really important. They you know, as I as I evolved in my career and as a leader, I found that actually that had some negative consequences to it, because I've come to believe that the most important way to be a good leader is to be able to show vulnerability and to be able to be authentic and empathetic and to have emotional intelligence. And frankly, nobody was really talking about that in my days at West Point or even in my days in the in the in the Army, at least the first year, you know, ten plus years. And so I've almost had to unlearn some of the toughness that I acquired in trying to get through really challenging things in a highly male dominated environment. And I'm glad I've been able to to unlearn them. I mean, a lot of that came from being in the private sector, thankfully. Yeah. But it's a lesson to young women who are there now.

Yeah. Those leadership lessons you mentioned are also true, I think in all the other realms, including government, authenticity, high emotional quotient, you know, empathy, these are important qualities in leaders. Yeah, it's interesting to hear you say that you thought you were going to do a five year stint. You went and spent 22 years in the Army and you were a battalion commander, you were in Iraq, you were in Afghanistan, you were in the Balkans, you were around and you were in leadership positions. How did young men follow you?

Yeah, I mean, I think if you are competent, if you learn your craft and I was an intel officer and, you know, I may not be the smartest person, but for a long time I think I was the hardest working person. And you need to. One of the great things, frankly, about the Army is that you move around every three years. So you have to learn new things. You have to build new networks. It just makes you incredibly resilient. And for every challenge that I would take on, because again, you're changing jobs either every year, every two years, I would work really hard to understand the situation that I was dealing with and then to help my team understand that situation, whether it was in Haiti in 1995 or in Bosnia in 1997 or when I was in Iraq. It's it's really being confident in your craft and then leading by example. You know, at the end of the day, you know, two things about leadership that I fundamentally believe. The first one is leading by example. Don't ever expect anyone on your team to do anything that you're not going to do yourself. Pretty basic stuff. And, you know, the second one is to lead by the platinum rule, which is, you know, we all know the golden rule. Treat others as you want to be treated. The platinum rule is really treat others as they want to be treated, which is predicated on taking the time to sit down and talk to the people on your team and get to know them and their backgrounds and their families and their motivations. And that's one of the great things about being in the Army, being an Army officer is you have these amazing soldiers, the sons and daughters of Americans who are entrusted to your care. So, you know, leadership at the end of the day was a a great gift and and a privilege. And so in all of these situations, I think I didn't think of myself as a woman leading thought of myself as a servant leader, taking care of my troops and taking care of the mission.

Mm hmm. My question really wasn't about how you saw yourself, but how your charges saw you.

Yeah. You know, nobody ever I never no one ever came up to me and said, oh, I'm you know, I have an issue with following you because you're a woman. Now, granted, I was an intel officer, and so there were more women in Intel or more men that were around women combat arms hadn't be hadn't been opening up. But I was also downrange with infantry brigades and infantry divisions. And it never once I started on my path, it never seemed like something that was a negative thing or created issues for me. I mean, maybe that was unique. You know, I always had confidence in what I was doing. And, you know, who knows, maybe it was a unique thing about me, but it was a pretty good run, to be honest. And, you know, as you said, I didn't think I was going to be in as. There's this expression at West Point, there's two expressions at West Point one is the most beautiful view of West Point is the one in your rearview mirror. The other one is this five and fly, which is, you know, you have this five year obligation and then you can go off and do other things. And I thought I was a definite five and fly person. And then I was going to go off and do other things. And it was pretty interesting cause I came in during the Cold War, did four years of Russian, thought I was going to graduate into the Cold War. Berlin Wall came down and then they started offering my classmates early outs after three years because, you know, the Francis Fukuyama, the end of history.

Yes, yes.

Triumph of liberal democracy. And so I thought it was going to get out even earlier because I was off at Oxford for two years and it was fantastic.

Under the heading of I may not have been the smartest. We should point out that you got a Rhodes scholarship and went to Oxford after you left West Point. And so yeah, that should be noted.

But my, my point is, I mean, I never expected it was really Haiti being part of Operation Uphold Democracy when Aristide was brought back to Port au Prince, where I saw you could actually, based on, you know, how you could contribute to your skills in the military as an intel officer, you could actually make an impact on people's lives on the ground. And so that's really what kept me in there. And Bosnia and then, you know, went back to teach at West Point, was there during 9/11. So which was another really impactful experience.

Yeah. I want to I want to talk about that. When you say it was an impactful experience, it feels like, yeah, it's funny you should mention the the that the the fall of the wall and the end of the Cold War and how optimistic we were about what the world would look like after that. 9/11 was a wake up call. And it seems to me as I just look at your history, this is a good place to take the turn, that it was a line of demarcation for you as well, that it focused your future as well.

You know, it really did. I had a wonderful time at Fort Bragg, commanded a company. I was a paratrooper, then left Fort Bragg at the end of 1999, actually had that wonderful experience. That's when my dad and I went to Vietnam, spent three weeks around the country, and it was just magical. And then I got to West Point in what they called the gloom period back as an instructor right after the turn of the millennium, 2001. And I was there teaching for about a year and half before 9/11. And you remember well that period, right? That was a period where we are looking at downsizing of the Army.

Yes, sure.

And cadets thought, hey, I'm going to graduate. I'm going to spend in five years, I'll spend time doing exercises and training. But there was really this whole, well, you know, this is not the need for a huge army. And then 9/11 happened and it was just I mean, it was a life changing event, obviously, for everybody. But then it was real for the cadets who, you know, we went they went into battle dress uniform and short after we're wearing the beret and as officers and, you know, frankly, you got the sense that you're going to be graduating and into a world where you would be in combat. And it just it changed the way that they took, in my view. And as an instructor, it just changed the whole atmosphere of how they were being trained as leaders to go out into the world knowing that many of them would would end up downrange. And of course, you know, I had many students that were downrange. And so it was a watershed moment for me. That was, of course, in September. And then, you know, the other big inflection point in my life that has impacted me probably the most was in December 4th of 2001. My my little brother Eli took his own life.

We're going to take a short break and we'll be right back with more of The Axe Files. And now back to the show. I lost my dad to suicide when I was 19, and I didn't talk about it for a very long time. And then I started talking about it and writing about it, and I realized how desperately people need to hear people talk about it. And I know you've been involved in suicide prevention, but can we start just by telling me a little bit about Eli?

Yeah, absolutely. So Elias, he was eight years younger than me, so he was funny. Just so sweet, kid. He went to Hobart. William Smith College, took a year, actually went a semester abroad to Russia, which was an interesting experience for him after he graduated, came back to the area where we grew up and live very close to my parents in Rockville, working as a consultant for Lockheed Martin. And after 9/11 he and I talked quite often on the phone and he talked about wanting to join the Army, actually wanting to enlist. And so he was getting into shape and he would, you know, tell me about running in all of this. And, um, and I recall Sunday night, December 3rd, I was actually getting ready to go up to Middlebury to sit on a panel for the Rhodes Scholarship in the in the state. And, you know, these things I'm sure you remember these things about your dad as well. But but I had I was on the phone with my parents just chatting to them, and my brother was eating dinner with them. And I'd gotten to the place I was getting to and they said, Hey, do you want to you want to talk to Eli? And I said, I said, hey, I'm I'm at this place. I need to be. I'll give him a call tomorrow. So then I'm driving up to Middlebury and I'm near going by Lake George where he went to college. And I'm I'm give him a call and try and get a signal. I couldn't get a signal, and so I wasn't able to talk to him. It was a Monday. And that night in the evening was when he, he shot himself. And so, you know, I mean, you always feel like you always feel like, oh, if I would have done something differently, if I'd have reached him on the phone or.

We all live with that.

And, you know, as it turns out, he was very good at hiding the pain that he was going through. And it's just sort of tragic because I feel like I was the closest one to him, and I feel like I should have picked up on that. And, you know, it had a fundamental impact on the rest of my life. My my parents, you know, as you can imagine, were destroyed. And it's not anything you get over. So I left West Point. I ended up, you know, was teaching. I left from the department where I was teaching, and then I needed to be close to that. This all happened relatively quickly. So I went down to D.C. and ended up getting a Council on Foreign Relations, International Affairs Fellowship. Really, so I could be in the area with them. But that turned out to be another like, you know, seminal experience in my life because I ended up being the executive assistant to Condi Rice, the national security adviser, from June of 2002 to June of 2004. And, you know, though, I remain very close to my parents, as you said, David, I never really talked much about my brother. I felt first of all, it was hard to it was hard to articulate the the reasons. And I didn't completely understand the reasons other than he had, you know, bipolar disorder, which, again, we didn't really know about. And I don't know if I felt there was a stigma associated with him or with my family. But I really didn't talk about it except to my very close friends for, jeez, a really long time. And I started talking about it actually when I got to the private sector. And I found that, like, it was really helpful to people because, you know, everybody has something like this in their life and like talking about it just I don't know, it creates much greater connection to people. And you find out that everybody has this thing in their life and it just goes to the point about vulnerability. So on that side. And then secondly, like I am just a huge believer that mental health is health and we cannot stigmatize this. Right. And and the Army was not good at this, by the way. You know.

First of all, amen to everything that you said. It's so important that people who are struggling with depression understand that this is an illness and it's an illness shared by millions and millions of people. It's not a blemish of character on your character. And, you know, I you know, my dad was a mental health professional and still couldn't get help. And I've said this before here at his funeral, all these people came up to me and said, hey, your dad saved my life. And I thought, just how sad. He saved other people's lives, but could not reach out to to to save his own. And so I'm just I hope everyone who's listening will will leave a, you know, information at the end of this podcast for how to reach out. But please don't don't, don't stay in that dark tunnel by yourself. Reach out and get help. The thing I wanted to mention, you said the Army hasn't been good at this. We have a terrible problem with suicide among veterans. And, you know, I think why is a foolish question. But what do we do about it?

Yeah, well, you know, this has been an issue for a while, right? The 22 [unclear]. And I don't know what the stats are now, but certainly the most senior leadership recognizes that this is a serious issue. A lot of I think some of it and again, I'm I haven't studied this deeply, but comes from post-traumatic stress, having been deployed multiple times, having been and seeing a lot of the violence and the stress and being away from friends and family. I think that's part of it. And then you come back and you're coming down from the adrenaline and you feel disconnected and it's just incredibly hard. And everybody, you know, expects you to be super tough again. It's that whole put on your body armor. You're the leader.

Suck it up.

Suck it up. Exactly. And so there is such a stigma with mental health. And, you know, I'm on a war path to try and you know, in all in all places, to try and make sure that people realize that we all have these problems. And by the way, like during the pandemic, I think it even got more exacerbated. You know, I think we're going to see a lot more of these mental health issues come out of the isolation and the anxiety of of the pandemic for a couple of years. You know, I saw this when I was managing the response to COVID at Morgan Stanley, along with our chief medical officer. And so one thing, though, that I'd mention to anybody who's listening, particularly of your veterans, I came across this incredible person last year. So what we did at CISA is we declared the 2022 the year of mental health and wellbeing, because for cyber defenders, for people doing incident response, it's also highly stressful. And so I really wanted to make this an issue where we could all talk about it. So we brought in a lot of experts and we made the mindfulness app, Headspace, available to all employees for free. We set up meditation rooms. We did all kinds of things to just open up a conversation about mental health. And so one of the folks we talked to was a guy named Taylor Gregor who had come back from being a Navy diver and was in a really bad space and tried to shoot himself, the gun didn't go off- put the gun to his head, the gun didn't go off, and he just collapsed crying. And after that, he recognized like how important it was to help others. And he started this adventure therapy. So he sails around the world with veterans to give them that sort of adrenaline that they're missing, that they've come out of combat or come out of intense training. And it's a beautiful story. It's captured in this documentary called Hell or High Seas. And so there are creative things that can be done to help people who are dealing with different types of post-traumatic stress and coming out of the military and coming down from that adrenaline rush. And so but anybody that has any sort of depression or anxiety, my message would be it is 100% normal to have these things. It's like and you should get it treated and you should talk to people. If you had diabetes, you would get that treated. If you had heart issues, you would get that treated. Mental health is health and there should be no stigma to talking about it or to getting help for it.

100%. Yeah, my dad, you know, was a refugee from the pogroms and he left when he was ten or 11 years old. But he saw, you know, just excruciating things. Lots of death, lots of destruction. His his own house was blown up and he never talked about it. And I'm you know, it took me years and years to realize, you know, he had untreated PTSD. That was the source of one of the sources of his depression. And he would never talk about it with with with me. And I don't think he talked about it much with anybody else. So, anyway, getting back to your story, so I want to talk you went to the National Security Agency. You're still in the military. You did your stint at the White House. You worked for something called Tailored Access Operations. And just the prelude to this is the world has changed and in every way because of the march of technology. And that is true of of of warfare and conflict and intelligence and so on. You're probably limited in what you could say about this particular assignment, but it's like known and a matter of public record that you guys were essentially hackers, that you were hacking around the world to try and gain intelligence for the U.S. Talk to me about that experience and how it serves you in the job you're in now.

It was an amazing experience. I didn't know much about Fort Meade, to be honest. And my boss, you know, Dr. Rice, knew Mike Hayden, who was the director of NSA, because I think they'd done some fellowships together. And so I kind of started to get interested and in Fort Meade and went up there after I left the White House to do a couple of years as a battalion chief of staff and as a brigade operations officer, and then ended up much more formative, frankly, than TAO, which as you described, is sort of the center of gravity for computer network operations. But my first real exposure to the power of NSA was in Iraq, where we were we were trying to do something fundamentally different, right. NSA, which began as never say anything, no such agency, the agency behind the quote unquote Green Door. Well, I was deployed there in '06, the head of NSA was then Keith Alexander. And they basically, and Alexander was trying to bring all the capabilities of the National Security Agency to help what was a really difficult situation on the ground. You remember, David, the height of the violence here? '06, '07.

Yeah. Yeah.

And so we were bringing this technology that enabled us to essentially take all of the collection we were getting in theater, and a lot of it was around these bomb making networks. If you remember the improvised explosive devices, catastrophic impacts on our troops and Iraqi civilians. The idea was take all of this data and be able to in very, very rapidly integrate it and correlate it and enrich it so we could provide this information to the troops on the ground. So not one of these green door wait for my, you know, my highly classified report, but essentially provide information to the troops on the ground they could use to prosecute these networks. And it was a highly classified program. It's all been since declassified called Real Time Regional Gateway. And that program, once we finally got it up and running, really led to folks like Stan McChrystal at Chase Arc and the brigade combat teams being able to prosecute terrorist networks much more rapidly and help to save lives and helped ultimately with everything else to to help reduce the violence and that was the first time I had this incredible picture of the power of NSA and the power of intelligence. And quite frankly, you know, the power of imagination. This was definitely an environment where alive with imagination. And after I returned, I was asked to stand up the Army's first cyber battalion. At the same time, I went to go work in TAO and then at the same time I was asked to go stand up U.S. Cyber Command. So I was doing sort of three things, but all of them were about harnessing the power of cyber to enable us to protect the U.S., to protect our foreign partners and from a DOD perspective, protect military networks. And so that was another one of these sort of fundamental, fundamental times in my career that really, really impacted me. And I think to your meta point, David, you have to understand how adversaries operate. To be able to defend against those adversaries. So, you know, back in Baghdad, Stan McChrystal and team would talk about it takes a network to defeat a network. So being able to have what I call adversarial empathy.

I love that.

Knowing how in an adversary operates. Right. I mean, it's extensible to so many different things. But in this particular case, you know, understanding the intents, the motivations of your adversaries allows you to be a better defender. So having been in that world for many years, you know, then going to the private sector and being, you know, doing cybersecurity for Morgan Stanley and then coming back to CISA, it has been I think it's enriched my ability to be the head of America's Cyber Defense Agency.

Well, let me just ask you one quick question before we get into CISA and what you're dealing with now, I should ask, what differentiates, if anything, what you were doing back in the day when you were on offense to what China's doing, what Russia's doing, what our adversaries are doing? Because I'm sure people, certainly the Russians and Chinese would say, well, they're just like us. That's their go-to play, which is to kind of discredit like liberal democracies that way.

You know, it's a great question. Right. And and this is the deal, and I haven't been on that side for a while, but I would wager that the U.S. remains the most capable fighting force, both in terms of our military, but also in terms of cyber. And I don't think to your point that it's a question of asymmetry of capability. That's not what I worry about. I worry about the asymmetry of ethics, because as we're seeing on the ground.

Well, that's really what I'm asking about. I'm asking about are there boundaries or limits to how this capability can and should be used?

Yeah. And we have boundaries to what we do as a values-based democracy. But the problem is Russia. We haven't seen them use any of those boundaries, certainly from a kinetic standpoint in Ukraine.

Yeah, of course.

And a lot of concerns. I mean, we have China and Russia getting together today, a lot of concerns on how China is learning lessons from Russia's invasion of Ukraine into what they may do one day with respect to Taiwan. And you could read it in the Intel community assessment that went out last week. But, you know, to the point about Ukraine, we're a little bit more than a year when even before the invasion, David, we were working with the private sector and with state and local officials as part of our Shields Up campaign to ensure they had an understanding about Russia, the threat from Russia, malicious cyber activity, part of their standard playbook. And more importantly, all the things that they could do to drive down risk to their businesses, to their organizations, to individuals. And that's what that campaign is all about. It still goes. I have been, I was surprised that we did not see more significant cyber activity in the homeland. Certainly, we've seen a lot in Ukraine. I think that's because, frankly, you know, Russia miscalculated badly in thinking it was going to be a quick trip to Kyiv. They miscalculated in terms of the U.S. would not be unified with its allies and NATO, I think they did calculate correctly that a strike, a deliberate attack against our critical infrastructure would be highly, highly escalatory. And so they have held off on that. I don't think we're out of the woods, frankly. We're still in a very unpredictable time. But I think Xi is costing all that into his own plans with respect to the potential for unifying Taiwan. And so this is why this continued vigilance, this continuous Shields Up, is so incredibly important for the defense of the nation.

I read a bunch of your comments on this, and it struck me, you know, in during the Cold War, you know, we operated under the theory of mutual assured destruction that we had these weapons, but the cost of using them were dramatic and potentially catastrophic because of the fear of retaliation. It seems like there's some of that at play here as well. I mean, they could do catastrophic damage to our infrastructure and we could do the same to theirs.

Theoretically, yes. You know, I don't want to go into too much on what our capabilities are, and that's not my world. But certainly they recognize that there could be escalatory impacts to them. And again, I think, you know, if you look at, you probably read "Deterrence and Dissuasion in Cyberspace." A good article by Joe Nye, I think from 2017. He talks about deterrence by punishment, deterrence by entanglement, you know, the economic entanglement, deterrence by norms which are aspirational. But clearly our adversaries.

Don't apply here. Yeah, yeah.

Yeah. And then deterrence by defense and resilience. And that's the world that I live in. And that's about trying to ensure that our critical infrastructure owners and operators have everything that they need to be able to defend their networks. And it's not a matter at the end of the day of prevention. I think if if China decided to invade Taiwan, they would pair it with significant attacks against our critical infrastructure. We saw what happened with Colonial Pipeline, David. I mean, that was not even an attack against the operational technology that was that was shut down in an abundance of caution. And you saw this panic across the eastern seaboard because people couldn't get gas for a couple of days. Just imagine, you know, that in happening in all over the country in multiple ways. So we need to take that very seriously.

That was ascribed to Russian sources, not Chinese. Right?

The, yes to Russian. Absolutely. But but all of us that thinks that the Chinese are lying to your point. Yes, they think about potential escalation, but I think they're costing all that in. To be honest.

The only assumptions I'm making about our capacities are that you said earlier that you felt that we had superior abilities there. So I presume anything they can do, we can do better, as the old saying goes.

One way to put it.

We're going to take a short break and we'll be right back with more of The Axe Files. And now back to the show. So CISA, cybersecurity and infrastructure security agency, difficult name and a terrible acronym.

Wait, to be clear, the old acronym was NPPD. National Programs and Protection Directorate. So, I mean, if you had to choose between the two.

There should be an acronym, a secretary of acronyms in Washington, whose job it is to think of more creative and memorable acronyms. But the portfolio belies the sort of bland acronym we all came to know CISA, which is a relatively new agency. We all came to know it because of Russian, primarily Russian, but, you know, Chinese, Iran and so on in our elections and messing around in our democracy. And that became- Chris Krebs, when your predecessor was very much involved in that, well, irritated the president and so on, got in trouble for it. To his credit, by the way. But there are many layers to what you're doing. And overarching it all is you're kind of like a Paul Revere here warning people about the threats that exist and trying to lay responsibility on people who should accept it for hardening our defenses.

Yeah. Wow. So much there. So I know you've talked to my my dear friend Chris and and huge props to him.

Yeah.

So, you know, he is, I think, remembered mostly for all his work around elections. And it's worth pausing there for a second because that's still a mission that we have. But frankly, when election infrastructure was designated as critical infrastructure, and as you well know, the federal government doesn't run elections that state and local, state and local, you know, news flash, they don't always trust the federal government. So they had they didn't want anything to do with CISA or the federal government and were basically like, thank you, go away. And to Chris's credit, he built these incredible relationships with state and local election officials that I inherited. And there was real trust built there that we were not here to run or administer elections, but to provide resources and capabilities and intelligence and information to help them run safe and secure elections. And I think there's been enormous progress, particularly on the cyber front in terms of hardening and making resilient election infrastructure. And so I think all of that is a positive news story. And, you know, '22, I think, went a lot better than I personally expected in that that most obviously we are working right now on the road to '24 on continuing to help our election, state and local election officials shore up their elections. But that remains a top priority for me. But, you know, the the agency itself has two key roles. First of all, we were built four years ago to serve as America's Cyber Defense Agency. We also serve as the national coordinator for critical infrastructure, Resilience and Security, because we also do physical security. But this is all about leading the effort to reduce risk to critical infrastructure. And whenever I talk about critical infrastructure, David, it's like, oh, infrastructure. That's those guys. And critical infrastructure at the end of the day are just the water, the transportation, the communications, the power, the health care. It's all of the networks and systems we rely on. So protecting and defending it is an incredibly important endeavor, but yet we own very little of it. It comes back to trust and partnership.

Yeah. One of the things I think we need to stress here is the degree to which the new technology, the connectivity that, you know, runs all of this has also created a new vulnerability. And that's really the world in which you're living.

Yeah, it is. I mean, if you think about it and, you know, the Internet, it's not that old at the end of the day. And when the Internet was constructed, nobody said, oh, we better make that thing secure. And so it's really turned out to be a tragedy of the commons in many ways. It is not necessarily the safest place to be operating, even though so many of us operate, you know, every minute of every day. So, you know, the Internet was created. Security was in mind. And we had software that was created. And because of the incentive structures, it was all about cost. Reducing cost and getting speed to market was not about safety and security. And so we had to create a multibillion dollar cybersecurity industry to be able to bolt on to the unsafe technology that was created. Again, because the incentives are all misaligned here. You know, then we had the era of move fast and break things. And we thought that social media was going to unite us. And now we have incredible mental health issues with our kids. And now we're hurdling into the the next technology in a big innovation, which is artificial intelligence. And it's getting implemented incredibly quickly. And to be frank, we do not fully understand the safety consequences of how quickly it's getting integrated into our lives. And so we've been making these, we've been making these mistakes, frankly, since the dawn of the Internet by bolting security on at the end.

After the fact.

And it's created a really unsafe ecosystem. And so, you know, our job is to what are all the things you can do to deal with these vulnerabilities. But what we've been saying is to ensure that actually we're able to put the burden on technology providers, not on the individual user or the small business who are least aware of the threat and least capable of protecting themselves. And so that sea change is a long time coming. But in my view, it's the only way that we can catalyze a sustainable approach to cyber security when we're dealing with nation state actors that frankly are unbound by by norms or by values or by ethics. So we need to take a different approach.

And some of these are aligned with state actors. But, you know, cyber criminals, ransomware, I saw an incredible figure about the amount of money that is lost to ransomware and cyber crime and so on. I mean, I think it was in the trillions. Is that possible?

No, it definitely is. I mean, I think the figure I've seen for, that will be for this year, sort of 8 trillion going up to 10 trillion.

But that's a lot of money.

It's a lot of bucks. Yes, it is. But the thing I'd say is, we don't even know because there is no mandatory reporting yet. We're actually working through a process where critical infrastructure will have to report to us. But we don't fully understand even, you know, how big the problem is. That's, you know, part of our challenge. But, yes, it is absolutely in the trillions and, you know, the ones who are suffering the most here, what we call these target rich cyber poor entities, you know, the local hospitals, the K-12 school. I worry a lot about public utilities like water.

Yeah.

So working to try and help some of these entities with the basics of what they need to do to protect themselves using some no cost resources, pairing up with our industry partners, using something called our Cybersecurity Performance goals, which is an easy checklist of steps that you can take to drive down risk to your network. But at the end of the day, this has to be a collective endeavor. It ain't a problem that government can solve or that industry can solve or that state and local. We have to have looked at look at this as collective cyber defense and put collaboration over self-preservation, frankly.

You talk about sort of critical infrastructure, schools, health care and so on. What is it that you fear? What is it that that the average person should say, this is serious and we need to be vigilant about it.

Either some of these entities. Again, let's go to hospitals. My mom is 90. We just, she's in hospice care now, but spend a lot of time in hospitals. So I worry very much about these ransomware attacks on hospitals. I mean, that affects all of us, frankly. We've seen patients that get diverted to other hospitals, which incurs risks. We've seen surgeries get canceled, and we've seen this all over the country. And so when you think about a hospital administrator who has to make a decision about, well, do I upgrade my software across all of my systems in the hospital or do I bring on a new surgeon? You have to make these resource tradeoffs and it's always going to go to the mission and the business side. And so what we're trying to do is to help these entities that really don't have a lot of cyber resources, again, like hospitals. K-12 schools, we saw the L.A. Unified School District hit with ransomware last year. Second largest school district in the country. And then, you know, kids can't go to school. And so these are these are real things that can happen.

Their system was shut down, essentially, and held hostage by cyber criminals.

Yes. And I don't recall what they you know, what happened with the with the ransom. But I do recall that it was a significant event. They were they were able to get kids to school. But it was a real wakeup call about all the things that they needed to be doing to ensure that didn't happen again. And so what we're trying to do is work with not these huge public companies, which some of them are very good. They invest a lot of money. You know, one of the other themes for us is the importance of embracing corporate cyber responsibility. This can't be the job of the I.T. people. It has to be a CEO owned risk. And so we do work with public companies, and that's important. But as you know, David, the engine of the American economy are these small businesses. You know, the medium size, I think, of a small business is 11 people. The person who's doing H.R. is also doing I.T. is doing finance. And so we are working to try and ensure that these small businesses, that individuals, these entities that Americans depend on, have resources, have the knowledge that they can help to raise their cyber baseline, because, again, critical infrastructure is not this technical term. It is the way we get gas at the pump.

It's the stuff that makes our country go.

Yeah, yeah. It's what we do every day to run our world.

You talk about AI underscores what the problem is here, which is this technology is churning at an exponential rate. And, you know, I think about this a lot relative to just society and politics. It's changing so rapidly that we can't get our arms around the changes fast enough. Just keeping up with the pace of that must be an extraordinary challenge for you.

I mean, it is with respect to thinking about, again, like some of these are incredible capabilities, but things that can be used for good can be used for really bad things. And so when you think about the weaponization of data for genetic engineering, for biotech, for cyber weapons, for influence operations through deepfake technology, if we don't somehow say, okay, wait a minute, like what are we doing to ensure that AI ethics and rules are mandated? You know, not just kind of the best practice, I think five, ten years from now, we're going to look back and say, wow, we really it's the same issue around, again, you know, our mental health issues around the, you know, weapons of mass distraction. Everybody's walking around that our kids have. Seriously, it's it's like an experiment. It's, you know, the attention economy and max engagement. We're going to look back for even more powerful capabilities that we were not able to get our arms around. And so these are the things that I most worry about, you know, both as a leader. But, jeez, as a mom.

Talk to me about this tick tock issue, because, you know, when you speak about young people, that is the greatest source of distraction and attention right now. One of your sister agencies is now pressuring the company to rid themselves of their Chinese ties. Do you have a view on this and why would that be important?

Yeah, I mean, it's important, you know, from from my perspective as director of CISA, certainly the amount of data that can be, you know, and I won't sort of go into deep debate about where that data is stored and whether it's really possible to segment it. But the potential for that data to be harvested and used I think is enormous and is something we need to be really thoughtful about, not just respect with respect to TikTok, but there are all kinds of capabilities that we have resident in our critical infrastructure that come from foreign companies that can allow them to do things with our data that we would not want to be done from a national security or economic prosperity perspective. So, you know, that is, I think, should give everybody pause. And I think the direction that we're going in as a government is the you know, is the correct one. I also from an election perspective, I very much worry about the use of these types of tools for foreign influence and disinformation. The big election coming up next year, as you know.

Yes.

So I think that is a significant concern. And if you look at how TikTok is used in China, Tristan Harris from the Center of Humane Technology has written about this, you know, spinach TikTok, where they're limited, their kids are limited to a certain amount of time per day. They're seeing museums and Nobel Prize winners and our kids are seeing cat videos.

Yeah.

So I don't have anything against cat videos. They're probably amusing. But at the end of the day, I think this is part of a long range strategy of, you know, sadly dumbing down the next generation. We are falling for it. And it's it's something that I think we really need to address. But TikTok is tactics. We need to go to strategy.

Just as we go out. You mentioned the next election. We all know the controversies that swirled around the 2016 election. We're now in a much more adversarial position with Russia, where we're in a more adversarial position with China. What do you anticipate in 2024? And just say a word about how they may try and influence our democracy, influence the next election.

So let me just say broadly. You know, we are already working with officials now because it's not just about cyber. There's a full range of threats, cyber threats, physical threats, insider threats, foreign influence operations and disinformation, which, of course, we saw in Russia. We saw a little bit from Iran, some from China. And so we full well expect to see our foreign adversaries use the tools at their disposal to be able to influence the American electorate for their own purposes. And so, you know, we are working very closely to ensure that all election officials have the resources that we need. One of the things that we do on foreign influence and disinformation is we first of all, most important thing is to amplify the trusted voices of local officials, because that is where the community goes to for their information. And so we amplify them. We work with our intelligence community and bureau colleagues to understand those tactics of foreign influence and disinformation so that we can put out information on how to build resilience. So we put out a whole thing on tactics of foreign disinformation at the end of last year before the election, and again, how to build resilience to it. And then we have a rumor versus reality page because, you know, frankly and I didn't know this before I took this job, I didn't know much about how elections are run. You know, a lot more than I do, David. But they're very technical. You've seen one state, you've seen one state. Rules are laws are all different. And so a lot of people don't understand like what are drop boxes, How does that work? How does absentee balloting work? What is the, how do things get counted, why everybody thinks, okay, the ballots are going to be counted that evening. And what you see in the polls, that's going to be the result, which, as you know, is not at all the result, particularly when you have a lot more mail-in voting. And so part of this is just making sure people understand the myths, but also the reality. Putting out information to help with election literacy. And so we are already gearing up to make sure that we can do those three things so that we can deal with some of this foreign influence and disinformation that we know we will probably see again. 2022, I thought went very well. We are working hard to make sure that '24 goes equally well, but we are going to be all hands on deck with our state and local election officials and the rest of the federal government as we work to ensure that officials have everything that they need to run safe, secure and resilient elections.

Director Jen Easterly of CISA, thanks so much for your service and thanks for sharing your wonderful story. Inspiring story. I so appreciate it.

Thanks so much, David. Great to be with you and thanks for your service and leadership as well.

Thank you for listening to the Axe Files brought to you by the University of Chicago Institute of Politics and CNN Audio. The executive producer of the show is Miriam Fender Annenberg. The show is also produced by Jeff Fox and Hannah Grace McDonald, and special thanks to our partners at CNN. For more programing from the IOP visit politics.uchicago.edu.