In a wide-ranging interview with Carl M. Cannon and Andrew Walworth, the former head of the CIA and NSA discusses the increasing assault on credible information, and government and private efforts to defend against and deter that barrage.
More information on our Cybersecurity: The Next Great Battlefield series
CANNON: Is America already under cyber-attack from Russia? Our guest today will tell us. He's retired four star Air Force General Michael Hayden, and he's also a former CIA director, and Director of the National Security Agency. In a no-holds barred new book, he slams the Trump administration for contributing to a climate where he says intelligence and truth itself is under attack.
HAYDEN: I think Donald Trump, my view, is the most norm-busting president we have ever had.
CANNON: Also joining me with questions for today's guest is Andrew Walworth, Senior Fellow at the Murrow Center, at the Fletcher School of Law and Diplomacy, at Tufts University. I'm Carl Cannon, and this is Real Clear Cyber Today. Michael Hayden, welcome to the program.
HAYDEN: Thank you.
CANNON: And thank you for hosting us here at the Chertoff Group.
HAYDEN: Oh sure. Thank you very much for coming.
CANNON: Your new book, The Assault on Intelligence, American National Security in an Age of Lies, has gotten a lot of attention for its criticisms of President Trump. You say that when the intelligence community tried to warn the incoming president of Russian scheming he, quote, "rejected a fact-based intel assessment because it was inconsistent with a preexisting world view or because it was politically inconvenient, the stuff of ideological authoritarianism, not pragmatic democracy." Strong words.
CANNON: But let me try out an alternate, what's that phrase? Alternative facts?
CANNON: But it's a less nefarious explanation that Donald Trump came to the conclusion that this was a partisan effort to undermine his presidency before it even began. Why is that such an unreasonable for him to have?
HAYDEN: No, it's not, and I actually address it in the book. The outcome's still the same. It did happen and we're not doing enough. But I'm less interested-
CANNON: It did happen, you're talking about the Russian-
HAYDEN: The Russians, oh yeah.
HAYDEN: You bet. And we can go to the fine print-
CANNON: We will.
HAYDEN: To that directly. So let me give you a bit of a longish explanation, but it actually I think is the best one in fairness to everyone. I always describe the intelligence policy relationship as you've got to both get in the same room. Let's just say it's the room down the street here, it's the Oval Office. The President and the intel briefer gotta get together. It's the intel briefer's job to get inside the President's head but they come into the room, this is a metaphor now, they come into the room through different doors.
HAYDEN: The intel door is marked "facts". The policy maker's, the President's door is marked "vision". And that's okay, that's the one you voted for. Fact, vision. World as it is, world as we would like it to be. Common dynamic, every president. Fact, vision, as is, wannabe. Inherently inductive. Data, evidence, general conclusions. Inherently deductive. First principles. Again, the ones you voted for, how do I apply them to specifics? Fact, vision, as is, wannabe, inductive, deductive. We're generally pessimistic. Presidents are generally optimistic otherwise they don't interview with you for the job. Happens to all presidents. So we always know we've got this bump.
HAYDEN: I offer in the book that it would have been a fairly smoother bump with a Hilary Clinton. Not because of any judgment on her personality but because she's been doing it for four years, remember? As Secretary of State, so you've already established a rapport. The easiest bump for us was probably George H. W. Bush 'cause remember? He used to come into the room through our door.
CANNON: He had your job.
HAYDEN: That's right. We knew that if it were to be a President Trump this would be a big speed bump because these attributes I described over here, I think the creator gave him an extra measure. He is inherently instinctive, spontaneous, not very reflective, prone to action, has an almost preternatural view of his own preternatural confidence in his own a priori narrative of how things work. So we well, this one's gonna be tough.
HAYDEN: To your point, it is a national tragedy and a perfect storm that the first time we had to do that with the new president, we knew it's always tough but it was gonna be especially tough with this one, through no one's fault, it was on an issue as you described. An issue that other Americans, not the intel guys, other Americans were using to challenge his legitimacy of President of the United States. And that is national sadness. My call is for the intel guys, you gotta hold your ground. And for the President, you've got to look at this as something beyond yourself. This is a threat to the nation, whatever it is you may think about it in terms of your political enemies.
CANNON: You wrote in your first book, the one that came out two years ago, that if we were going to conduct espionage in the future we were going to have to make some changes in the relationship between the intelligence community and the public it serves.
HAYDEN: The public, yeah.
CANNON: It's almost like you saw this coming. I mean, I know when you wrote that book we didn't think Trump was gonna be president then so you didn't really see this coming. But I wonder if we've accomplished what you'd hoped. Are some of the failures, well-documented failures in the intelligence community, part of the problem between-
HAYDEN: Between what? The president and the-
HAYDEN: The public.
CANNON: The public's mistrust and the-
HAYDEN: So, fair enough. Doesn't help when you get things wrong and you get important things wrong but we admit we got them wrong. To your core point though, is we've got to explain ourselves more to the American people than we have in the past. That's just part of the whole swirl of distrust of government. So, as I said in the old book two years ago, you may not wanna show more ankle but if you don't you're not gonna get to do this in the first place. I tell my old tribe, "You have to be more forthcoming." Then I quickly add to everyone else, "And don't kid yourself. Their being more forthcoming is gonna shave points off of their effectiveness because this is best done in secrecy. But I get the deal. We don't get to do it at all unless you validate it and now you won't validate it unless you know more."
CANNON: You've got a lot of attention in other interviews for a statement in your book. It's well constructed. It's good writing. "There is no deep state," you say. "There is the state." But let me challenge that a little bit. You know what's meant. You know what, and I'm not just talking about the black helicopter crowd. Millions of Americans think that the unelected government officials, bureaucrats, whatever you wanna call them, not just in the NSA and CIA but in the Justice Department, IRS, are making policy instead of just carrying it out and that they feel it's tough to fight against. That's what they mean by that.
HAYDEN: Yeah. So there's a lot going on there. What you've got, and I get the deep state meme. My response is, "Oh, you mean the career professionals governed by the rule of law. Those people." So you do have things going on. You have a president who has gone in. I get the democracy reality here. We know how to count. We know how the electoral college works. Elections matter and therefore I say literally in the book, we have to accommodate all presidents. Now, we may have to do more accommodating here because this president is making far more dramatic changes in our direction. I get all that. So I tell folks in government, do your best. Make him succeed. Accommodate. We always do that. But you can only go so far.
HAYDEN: Number one, you've got a personal integrity question that you have to deal with. But beyond that, it's preserving the institutions. It is preserving the norms which are generally agreed should govern the institution.
WALWORTH: Let me just switch gears a little bit and go to sort of cybersecurity. You draw a distinction in the book between America's approach to cybersecurity and Russia's approach to cybersecurity. Tell me about that difference and why it's important.
HAYDEN: So what I try to describe, and this occurred to me as I'm writing, I'm sure this happens to other authors. You're going along and go, "Whoa, wait a minute." And so I go back in my own personal history. I became Commander of something called the Air Intelligence Agency. It's kind of the Air Force flagship thing-
WALWORTH: Based in Texas.
HAYDEN: In San Antonio. And we were on the cutting edge of things cyber at the time. Which you would expect, Air Force, it's kind of what, a natural domain for a service that operates in air and space. We had moved into the cyber domain I think more quickly than the other services. We were on the doctrinal cutting edge of thinking our way through this. We began to talk about cyber dominance. Land, sea, air, space, cyber. It's a domain. We're gonna go operate there.
WALWORTH: And domain is a separate sort of-
HAYDEN: An operational environment.
CANNON: It's like a theater of war.
WALWORTH: An operational environment that has its own doctrine.
HAYDEN: A theater of war, right. And right, and has its own laws of physics, its own doctrine, its own approach and so on. We had for a while a theological debate there that made us look like a medieval university populated by Jesuits. I mean we were really pounding the table as to whether or not we were in the cyber dominance business or the information dominance business. Let me explain that very quickly. I mean cyber is what you think it is. It's protecting your computers, attacking their computers. Information has cyber included but it also includes other things like public diplomacy, public affairs, deception, what the Russian's call-
HAYDEN: Maskirovka, disinformation, psychological operations. So we're there saying, "So where are we going?" We, frankly, I think at least implicitly made the decision, "We're gonna do cyber." We have a cyber command now. We don't have an information dominance command. We rejected this for a couple reasons. Number one, that's very complicated and this is hard enough. Second, in our political culture you don't do this very long before you start implicating the Bill of Rights. The First Amendment pops up. The Fourth Amendment pops up. So we stayed over here in cyber dominance. The Russians, they went to door number two. The apostle for this inside the Russian Armed Forces was a fellow who's now Chief of the General Staff, Valery Gerasimov, who wrote about contact-less warfare using informational means to achieve victory by influencing the target country's population. That's what the Russians are doing.
WALWORTH: So that is the Gerasimov doctrine and the quote that is most quoted is, "the role of nonmilitary means of achieving political and strategic goals has grown, and in many case, they have exceeded the power of force of weapons in their effectiveness." This was originally written, I guess, in the context of the Arab Spring.
WALWORTH: And the idea that basically populations could be-
HAYDEN: Whole societies collapsed.
WALWORTH: Whole societies could be changed. Now, in another life I worked at the US Information Agency, 150 million years ago. We were involved in Hearts and Minds, basically. This was an area where we thought we were pretty good. So isn't this in a sense good news in that if the Russians are thinking we're going to have to compete with you around ideas, images, storytelling. We're pretty good at that. We have Hollywood. We have-
HAYDEN: I make the point that the global centers of technology and image making are 300 miles apart in California. We should actually be okay in it.
WALWORTH: Right. So I mean-
HAYDEN: So why aren't we?
WALWORTH: Yeah. If they're saying that that's where the big competition is in the future, bring it on, it seems to me.
HAYDEN: It is if we choose to fight and choosing to fight is hard. I mean that seriously, not flippantly like somebody's being incompetent. We generally don't like the government controlling our information space, our information domain. So you did US Information Agency. That's pointing outward and in a previous age, if you pointed it outward it generally stayed outward. In the current age, and I actually experienced this. When we started talking covert influence campaigns in CIA, which of course, governments do. It's getting very, very hard to conduct a covert influence campaign in a digital world who's effects remain isolated to the suspected, pretended-
HAYDEN: Specific target. It blows back on your own population which we are absolutely forbidden to do. So although we probably have the talent and we probably have the technology, we are limited by a couple of things. One, law, policy, Constitution, and frankly, we generally feel compelled to tell the truth when we do this which gives you a time lag because you wanna make sure what the truth is. What's the old phrase? The lie's gone around the world a couple of times before the
CANNON: Truth puts her boots on.
CANNON: In your book you make an analogy, and talking about what we're talking about now, the importance of truth and having a culture that the norm is fact-based information exchanges. You invoke the Enlightenment.
HAYDEN: I do.
CANNON: You're the second person to do that that I'm aware of. Joel Garreau who runs in Arizona State University runs something called the Weaponized Narrative Initiative. They do papers there examining what the Russians are doing to us. He says, and Joel's an old peacenik. He says, "How do I, I'm talking to all these Generals. How do I excuse that to myself?" Back, young Joel Garreau who marched against the Vietnam War. "The way I tell myself is it's the Enlightenment itself that's under attack."
HAYDEN: Sign me up. That's exactly the thesis in the book.
CANNON: Now, but that raises other questions. So is Donald Trump the first post-modern president?
HAYDEN: So he's-
CANNON: Let's start with that.
HAYDEN: Yeah. So he's the first president in what we have begun to define as the post-truth era. Oxford Dictionary word of the year 2016.
CANNON: But I used post-modern for a reason.
HAYDEN: I understand.
CANNON: Alright, go ahead.
HAYDEN: I understand but my word is post-truth. And it's decision making based less on data and evidence and more on feeling, preference, emotion, tribe, loyalty, or grievance. Watch the President talk. I'm a career GI so I want to be respectful of both the office and the man. So this is descriptive, but watch the President talk. With the exception of the speech he gave, telepromptered, across the river at Fort Myer with regard to Afghanistan, when the President argues for a position or lays out his expectations he does not martial arguments or evidence for it. He transmits it as assertion. Period. There's no fine print underneath it. Then in the defense of whatever had been asserted, he defends it by attacking those who would oppose or question it by undercutting their legitimacy. Fake news. Lying media. Intelligence in quotes. So-called judges. That is the very opposite of the Enlightenment's values which is evidence-based, inquiry, pragmatic, experimental, humble in the face of complexity, willingness to change based upon observation. That's the meat of the Enlightenment. And now you have this other approach.
CANNON: Alright, I wanna tie this back to-
CANNON: I wanna tie this back to-
HAYDEN: That's what I'm concerned about.
CANNON: I understand. I wanna tie this back to what the Russians are doing. So post-truth, I said post-modern. That paradox to me that I'm getting is that the first president who behaves this way is the one who routinely attacks the college campuses and political correctness. But this term isn't new. This approach isn't new. This victimization, it comes out of the left. It comes out of college campuses.
HAYDEN: I have no brief to counter your argument.
CANNON: So now we're at the point where we've got the intellectuals on the left and we've got the President of the United States on the right using these same sort of tactics. So then the Russians, we've made the Russians' job very easy for them.
HAYDEN: So let me use my metaphor here. We got this cake.
CANNON: They want us at each other's throats but we already are.
HAYDEN: So I describe it as a three layer cake. The first and biggest layer is us. It is our political dialogue and I am not blaming the political dialogue of the right. I am blaming the political dialogue, the victimization, the position taken by demonizing the opposition. Now a couple years back, a particular political candidate, Donald Trump, recognized that so I'm now to the second layer of the cake, the administration. Recognized it, exploited it, and frankly in my judgment, he makes it worse. He makes it worse sometimes by what he does. He really makes it worse by what he says. So I've got a basic layer, it's us. Now I've got an administration, more effect than cause, exploiting it but worsening it. Then I get to the third layer of the cake which is smaller than the other two, that's the Russians. All the Russians are doing is, "Whoa, this is easy." They flow back and take advantage because what it is they want to do is that which we are doing to ourselves anyway, which is to divide and incapacitate us. Let me give you a number. In terms of this division and what's going on and post-truth and demonizing the opposition. 85% homegrown, 15% Russian.
WALWORTH: Do you think that the Russian campaign during the election had any effect at all on the outcome?
HAYDEN: My answer is yes but I can't prove it and I sure as hell can't measure it so now we're done talking about it. It's an unknowable. Now the President-
WALWORTH: Well it's not unknowable but if no one has been able to come up with a-
HAYDEN: There are no methodologies to count it. It's an influence operation. So I can't measure but I do know that Candidate Trump called attention to Wikileaks 162 times in the last 30 days of the campaign so somebody thought it made a difference. But again, I gotta go back to where I began. I can't measure it and therefore we're done. Donald Trump is the legitimate President of the United States. Move on.
CANNON: General, I wrote a story. If you lose the closest election in history, I'm talking now from the Hilary Clinton side, there's 50 reasons why. This is one of them. That's what you're saying.
HAYDEN: But you didn't ask me to rack and stack them. You said did it influence it. My judgment is yeah, probably, but I can't measure it. Yeah.
WALWORTH: Well my question is that by saying it had immeasurable impact, it had some impact, we don't know what the impact is but it certainly effected, aren't we sort of playing into the Russian narrative?
WALWORTH: But aren't we saying, if we're saying that our electoral college or electoral system rather is so vulnerable that a small, a relatively small effort on the part of the Russians.
HAYDEN: Relatively, yeah.
WALWORTH: That that could influence our campaign to the point where it could potentially delegitimize the outcome.
HAYDEN: Now you see I've not used the word delegitimize. In fact, I've gone precisely the opposite. He is the legitimate President of the United States. There are an ocean of factors and good people-
WALWORTH: But aren't we sowing the same doubt in our system by doing that that you're accusing others of doing in terms of using social media for their purposes?
HAYDEN: I get the point. I totally understand the point. Just one counter punch and then I'll throw myself on the mercy of the court here. It's the President who campaigned that the system was rigged, which is a perfect echo of the Russian effort. So there's a lot of this going around. So, yes, but it's a broader question. It's just not about the campaign. It's the broader pushback from folks like me who go on air, try to be objective, but we open ourselves up to the accusation that we're that deep state thing and we're anti-democratic. So I really do, I write about this in the book, I really do try to be what I am which is the fact witness and not make judgments about the person or the President. I can comment on his actions. I like that. I don't like that. But not about the character of the President. I just think that's, we have no legitimacy for that.
HAYDEN: Now, the problem becomes is I think Donald Trump, my view, is the most norm-busting President we have ever had. So we've got a lot of institutions pushing back against the norm-busting of the President. Actually, it's all those evidence-based institutions like intelligence, law enforcement, justice, science, scholarship, and journalism. But the danger is, in pushing back against the President's norm-busting, these institutions might bust their own norms. Thereby-
CANNON: That's my fear.
HAYDEN: Thereby worsening-
CANNON: About the press.
HAYDEN: Exactly what-
HAYDEN: So the press becomes obsessed with a particular issue. Intelligence? Maybe they leak or they say publicly more things-
WALWORTH: Maybe they leak?
HAYDEN: Say publicly more things than they should. Law enforcement becomes more focused on this than they might otherwise be. So I get all of that. And so we have to be very careful because we can make it worse in the way, but that is not an argument for not arguing.
CANNON: I agree but can I follow that with an example? The example that came to mind, James Comey, by his admit, it's in his memo so this is his words, he tells the President of the United States, "I don't do weasel things. I don't leak." He comes out of the White House and goes in his car and starts typing up the notes. Well, maybe that's a weasel thing, maybe it isn't, but he leaked. He said he leaked. So this would be an example where the norm-busting then is on the other side.
CANNON: In response to.
HAYDEN: Yeah. I wasn't in Jim's circumstance and we'd have to go to the blackboard and get all the fine print. Is that technically a leak? Was it technically classified? I get all that but that's not important. What's important is the argument, is that in pushing back are you doing things then that you should not otherwise do? Or, in other words, are you cheapening your argument by how you're responding to the things to which you object? I get it. I really do.
WALWORTH: Let me just change gears for a minute here because we'd like to talk about cyberspace for a minute. John Bolton, National Security Adviser to the President, has, there was a fellow named Rob Joyce.
HAYDEN: I know him. He used to work for me. Now he's going back to NSA.
WALWORTH: He's going back to NSA and there's the report that he will not be replaced, that they won't, is that a smart thing to do, not replace the NSA?
HAYDEN: I don't think it's a good idea at all. Look, I've been in government. Remember, big ship, small rudder? How do you make things change? You've got three baskets of tools. And that's all you got. One is you can throw more money at it. Second, I can throw more people at it. Third, I can create structures that in essence impose on the bureaucracy, "this is important, pay attention". I think Ambassador Bolton's decision to do away with the position and pull Rob back to NSA kind of gets in the way of all three. It cannot help but be read as a de-emphasis on the cybersecurity mission.
HAYDEN: Now, if we walked down the street and went into the West Wing to the corner office and say, "John, why are you doing this?" He may actually have a pretty solid argument with regard to efficiencies and streamlining and de layering and let the departments be the departments. I get all that. But on balance, you asked my opinion. On balance my opinion is you get the focus, you get the energy, you get the Presidential White House attention by having that position and when that position goes away, I fear it signals to everyone this isn't as important as you used to think it was.
CANNON: Well if they've been reading our series they know it's important. I have a couple of general questions about cyber. What can government do, if anything, to disrupt the ability, Russia's ability to use Facebook, Twitter, Google? What's a practical thing we can do to interfere with that process?
HAYDEN: Yeah. It's hard. It's very hard and it gets in the way of free speech. We don't-
CANNON: Do Russians have the right to free speech?
HAYDEN: Yeah it's-
CANNON: Mueller indicted 13 of them.
HAYDEN: It's hard to suppress Russian free speech without having collateral damage to everyone's free speech. It's hard to police bad news sites and not have an effect on the free flow of the news. There's some things government might be able to do but I think this is a private sector function so I toss some ideas out in the book.
WALWORTH: Isn't it, in a sense, this is the price we pay for having-
HAYDEN: Of course.
WALWORTH: Deregulated information? And just to go back to this Russian information strategy again, one of the strengths of the American system it seems to me has always been it is difficult to break through. It's difficult enough for those of us who are in the professional business of trying to talk to people out there to break through because there's so much news, there's so much information all the time. The Russians have RT which is their television network. Nobody watches it.
CANNON: Nobody watches it.
WALWORTH: They have Sputnik which is their-
CANNON: Nobody watches it.
WALWORTH: Radio. Nobody listens to it. They aren't particularly good or known for their ability to change hearts and minds. So why are they, in your view though, I mean why is this such a real threat then because looking at their record, they haven't been very good.
HAYDEN: That's not the objective. Their objective is to divide, not to convince. And so what they do is they pick up native memes from the United States and amplify them. They're not trying to change your minds. They're not trying to tilt you toward Marx. They're just trying to mess with our heads and to make us a divided society. I write in the book about Jade Helm 15. That's a normal exercise in Texas and some southern states that Russian bots and the alt-right media convinced enough people in Texas with an Obama administration coup to arrest political dissonance up to and including abandoned Walmarts being used as concentration camps and boxcars transiting Texas with leg irons on the floor.
WALWORTH: Let's posit that there's a lot of crazy stuff on the internet.
HAYDEN: But that's the point. It's on the net. So two additional realities. More Americans get their news from the net than they do through the traditional curated way news has been presented to us.
WALWORTH: Again, sir, that is true but if you go to the first two pages of Google on any subject that you're gonna look up, they're going to be mostly mainstream sources of news there. You're gonna see CNN. You're gonna see ABC. You're gonna see the Wall Street Journal. You're gonna see-
HAYDEN: So there's a scholar at the University of North Carolina named Tufekci. She's Turkish by birth, North Carolinian by choice. I heard her give a wonderful talk about how social media works. The social media business model is to keep you on the site. The return on investment is clicks and that's how they generate revenue. So first of all, when you're working through social media, Facebook and YouTube and others, they know who you are. They know what you like. They tilt you to something that you're gonna find confirming. Miss Tufekci talks about social media being a lot like Doritos. They're compromised of salt and fat and if you eat one piece of salt and fat really what you really want is another piece of salt and fat and you just can't eat one.
HAYDEN: What the algorithm does, there's a fellow named McNamee who was one of the early investors in Facebook and a mentor to Zuckerberg who's kind of said, "What have I done?" The algorithm, the longer you're on, and again, they make money by keeping you on, drives you more and more into like-minded individuals because that keeps you on the sites. The internet, rather than being this grand dialogue is now composed of increasingly darkening ghettos where people actually don't bend towards common views but bend in the direction of like-minded, more extreme views. It is embedded in the actual algorithm that's used for profit from the business model.
HAYDEN: And so what helps the Russians are our own divisions, our creating our own memes, and now most of us getting information not from Google but from Facebook and others which ghettoizes us even more than we know. That makes it fairly easy for the Russians to do what they want, which is not to convince us, it's just to make us angry at one another.
WALWORTH: Let me just ask you about cybersecurity generally because you've talked about this, this is outside of the context of your book but think of cybersecurity generally as sort of building a defensive perimeter, keeping the bad guys out. You recently were talking about this and it seems like that it's changed a bit and that you can't keep the bad guys out. You're under attack constantly. There already inside the Alamo or whatever. How does that change the way companies should deal with cybersecurity?
HAYDEN: Sure. So the history of cybersecurity, if you could go back far enough, it's what you described. It's the firewall. Keep them out. Cyber hygiene, good passwords, turns the machine off over the weekend, all those sorts of things. Put the patches in, talk to your sys ad, get the work done. That's good and keep doing it but it's not nearly sufficient. The persistent talented threat is getting in. So if you really wanna defend now you have to defend on presumption of breech. They're getting inside the wire, get over it. Operate while under attack. Survive while still penetrated. So now the passing grade is not whether or not they get in, the very best will get in. The passing grade is how long are they in before you know it. So now rather than defense, you gotta do it, but the secret sauce now is response, resiliency, recovery, reconstitution, the detection of attack. It is almost as if rather than the moat, the castle wall, or the Maginot line it's a constant meeting engagement in which you are constantly fighting within your own network to keep your own network secure against intruders which are inevitable.
CANNON: So companies can do that themselves, what you described. In terms of cybersecurity, should the United States Government be using offensive measures also against bad actors?
HAYDEN: That's a great question. So a couple factors bearing on the problem. Number one, this is a domain in which offense doesn't translate to defense. The offensive capacity doesn't automatically make you more secure. Whereas in the maritime domain, you got a big navy, hey, play it both ways. I can go there. I can stop them from coming here. Cyber domain, not that way. So I agree with you, we've got, I'm fond of saying, the greatest concentration of cyber power on the planet is about 30 miles over my left should up there at Fort Mead. But it doesn't, it's hard for us to apply that to defense, largely because of civil liberties questions, political cultural questions. We don't want the government kind of walking the beat inside of our network and so we have those issues.
HAYDEN: The outgoing Commander of Cyber Com just left, Mike Rogers. And the incoming Commander, Paul Nakasone, Admiral, General. In recent testimony, I mean really recent. Six weeks ago maybe, four. Both talked about imposing consequences on cyber aggressors which is not the same thing as defense. It's simply convince people, "You don't wanna do this. Trust me, you don't wanna do this."
CANNON: The Stuxnet theory. Kind of.
HAYDEN: Well it's that, "I can hold things you hold dear at risk. I don't think you should be throwing rocks at me." Now that is actually a bold theory. It is not government policy. Even this government which is more aggressive than some other ones. It is not. So it's out there as an idea that we might be able to conduct what they label as cyber deterrence, not defense. That we can either disable machines that are coming at us or we can hold at risk things they hold to be dear. In other words, what they're arguing for is a new legal and policy space above the normal, "I'm spying on you and stealing your stuff" line but below the, "And now I'm at war with you" line.
CANNON: Is it the same logic of mutually assured destruction?
HAYDEN: Well actually you can reason by analogy with the nuclear world with the disabling attack being the counter force approach and the counter value approach being hold dear that which they value. There is a logic there but mutually assured destruction was always a theory. These guys are asking for something that would actually be taking place.
WALWORTH: Do you think that would be a good idea to do it?
HAYDEN: I've not yet resolved that one in my mind. There's a lot of thinking that needs to be done about that.
WALWORTH: In the private sphere you've talked about this being now a board level responsibility. You've even talked about repopulating board with people who understand-
HAYDEN: Just relive the Sarbanes–Oxley drama.
WALWORTH: Right. So tell me a little bit about that.
HAYDEN: So most boards being of my age don't have an awful lot of inherent cybersecurity capacity on them. So boards are now gonna have to go out and hunt for that talent to be on the boards. I mean the same way that they had to respond to other regulatory requirements they now have to have some technological expertise on the board in order to be able to do what a board ought to do with regard to the company, yeah.
WALWORTH: And in your conversations you're having success with that?
HAYDEN: Yeah. Actually you know, American's industry's got this. Yeah. So shortly after I left government, so this is 2009 maybe, late in '09. I'm up in New York with George Tenet and Mike McConnell, former DCI, former DNI. We're having dinner with 20 folks that I would just call Wall Street types. We're waving our arms about the cyber threat. By the time we kind of got around to the dessert one of the participants finally asked the question I knew was on everyone's mind. "How much is this gonna cost me?" We have moved from that position, from a time when American business saw cybersecurity as subtraction from the bottom line, to an appreciation that cybersecurity is integral to the top line. I think we really have made that turn.
CANNON: What's that old ad? Pay me now or pay me later?
HAYDEN: Yeah, and pay me more later.
CANNON: General Hayden, I want to thank you on behalf of Real Clear Politics and Andy Walworth for your time.
HAYDEN: Thank you.
CANNON: It's been a great discussion.
HAYDEN: I've really enjoyed your questions.
CANNON: There's more information about cybersecurity, including information on General Hayden's new book, on our website. Just go to ReadClearDefense.com and you'll get a prompt to go to our cybersecurity page. We hope you'll join us again next time. On behalf of all of us here at Real Clear Politics, I'm Carl Cannon. Thanks for watching.