Preparing for Disaster and Achieving Cybersecurity Readiness

Jonathan Reiber:

Hey everyone, and welcome today’s episode of Think Bad Do Good. It is my great pleasure to have Juliette Kayyem on the show. Hey, Juliette.

Juliette Kayyem:

Nice to see you.

Jonathan Reiber:

Great to see you. So for those of you that don’t know Juliette, which is probably very few of you; she’s a writer and security strategist and former assistant secretary for… was it intergovernmental affairs? Is that right?

Juliette Kayyem:

Intergovernmental. Yep.

Jonathan Reiber:

Intergovernmental affairs in the Department of Homeland Security, and the author of The Devil Never Sleeps: Learning to Live in an Age of Disasters, which is a great book title for our Think Bad Do Good podcast. Now, this book, it’s been endorsed by people that I really, really admire. James Fallows, who’s such a great writer. Some folks don’t know, he was Jimmy Carter’s speech writer, which is a great thing. And Jim Clapper, who used to work down the hall for me. He was the former Director of National Intelligence. When I first met him coming into government, he scared me quite a bit because I didn’t know him. And Jay Johnson, secretary of Homeland Security. So, she’s got great endorsements.

She’s also a professor at Harvard’s Kennedy School, which is really one of America’s best places of learning and public affairs. I worked there and studied there for a little while. And she has one of the most informative and entertaining Twitter accounts out there. I want to say it’s got like 300,000 or half a million followers or something.

Juliette Kayyem:

Close, but not that high. It’s a good way to do things quickly; get your ideas out quickly.

Jonathan Reiber:

Well, after today’s podcast, you’ll be at a million. You’ve got nothing to worry about.

Juliette Kayyem:

Yeah, exactly. That’s why I’m here!

Jonathan Reiber:

Her content is both entertaining and informative and also inspiring. So, Juliette, thanks for joining on the show.

Juliette Kayyem:

Oh, that’s so nice. Can we end the podcast now? Because it’s all downhill from here.

Jonathan Reiber:

Yeah, yeah. No, for sure. Totally. So, thank you for coming, everyone.

We’re going to get into Juliette’s book, which is going to be great, which I’ve started reading it and enjoying it. I really love the opening where you talk about the word “astro.” And I never knew this, that in disaster, the word astro and Latin is embedded in the middle of it. Is that right? I’m probably dropping the ball.

Juliette Kayyem:

Disaster and catastrophe. It’s amazing because I’ve been in this field, homeland security, disaster management, consequence management, call it what you will, and I never looked up the word disaster. And I thought, “I don’t even know what it means. I think I know what it means.” And it turns out ‘dis’ is, the prefix, ‘dis’, is not or bad or mal, like mis. And then astro, which is of course from the stars. And so, the belief was that a disaster was some random and rare misalignment of the stars and catastrophe has the same astro. So, it struck me that the way we think about disasters, the shock and awe, and this, the theme of the book, was still holding us captive. That we still thought that we’re at the mercy of something that we can’t anticipate, don’t know it’s coming, is random and rare.

And so, basically the book is, The Devil Never Sleeps, and if we can align our preparedness with the expectation rather than the possibility that a disaster would happen, what can we learn to do better? Essentially, if there is a bumper sticker for the book, it’s ‘how can we learn to fail safer?’ The expectation is that we will fail, but we can do it safer so that the measure of success isn’t, ‘did we stop the bad thing from happening’ but rather, ‘could we minimize the harm once it inevitably did’.”

Jonathan Reiber:

Yeah. Yep. That’s awesome. There’s a lot of serious questions I want to ask you about, so we’re going to do that. But then you also just told me that you’re a surfer. So, at some point in the conversation, I want to bring that in. And I’ll note you grew up in LA, but you surf in New England, which I think makes you even more of a badass than I knew you were.

Juliette Kayyem:

I’m not a winter surfer though. I clear everything out by late September. But yes, I try to hold onto California. I’m a bad New England mother. My kids don’t know how to ice skate, we barely went skiing and I try to hold on to summer as long as I can. But yes, I am a surfer. It’s funny because it does teach patience. I relatively call them disposition. I’m high energy, but I don’t get fazed very easily, and I think part of that is surfing, because you wait… You wait a long time when you surf for the right moment, the right wave and everything else like that.

I took I took a couple decades off to have kids, but I got back into it about a decade ago, and it’s great fun.

Jonathan Reiber:

That’s so cool. I’m very envious. I’ve tried surfing once, it ended really badly. It’s exhausting for anyone who does it. And it looks really cool.

When I started working on resilience after I left the Obama administration, and maybe you can touch on this, but one of the things that I think about for anyone who’s suffering through disaster or increased pressure and strain is you actually have to be self-possessed and have an element of… The ultimate fallback is confronting your own mortality. And that’s really deep and that’s not the direction that I want to go in this call necessarily or in this podcast, but I want-

Juliette Kayyem:

It is true.

Jonathan Reiber:

It is true, right?

Juliette Kayyem:

Yeah, it is. It is related to how to think about living in a world in which, I call it the boom, that’s this agnostic… I’m pretty agnostic about what the threat can be, so it’s cyber, it’s climate or terrorism or whatever. I don’t mean to be flippant about it, it’s just the devil takes many forms. But one of the lessons that I share in the book because the book takes from hundreds of years of disasters and says, “What can we learn about what went right?” We always talk about what went wrong, but what went right in terms of learning to feel safer?

And one of the lessons is extend the runway. That what you’re trying to do is not get to that moment where you lost any capacity to pivot and respond. And so a lot of times, just not getting to that panic moment actually ends up very, very helpful.

Jonathan Reiber:

Yeah, that’s right. I love the line… You have, I think a chapter called “Assume The Boom.”

Juliette Kayyem:

Yeah.

Jonathan Reiber:

I completely agree. I completely concur with that approach. Can you talk a little bit about what that means and where you got it from?

Juliette Kayyem:

Yeah. I was torn about the title of the book. I wanted it to be Assume The Boom, but the publishers, and I think rightfully so, thought that you’d have to explain it for too long, while The Devil Never Sleeps hopefully just brings you in.

But basically, people in my field are relatively simple people. I often say like, what I do is not rocket science, not creating a vaccine, but you want me on the Titanic.

The idea is, there’s only two periods of time to think of, and that’s what we call left of boom and right of boom. Left of boom is all the prevention, preparation, protection efforts that say we put into a cyber network. The boom, as I said earlier, is agnostic. It could be anything, a cyberattack, ransomware, asteroids, whatever. And then right of boom.

Our discourse about disasters is often about, why did the bad thing happen? Why did we fail? Or it’s, how do we build more resilient, this future? And what the book is really about is the present. And it’s, you are here, that’s a recurring theme. Every chapter ends with the three words, you are here. And at that moment of the boom, what can you do to minimize, or what can you learn from these disasters to minimize the harm, because they aren’t random and rare?

In cyber world, as you know, they say “assume breach.” And that’s like a nice way to think about it is, if your network is open, assume breach. So, there’s things that you’re going to want to take off the network. There’s no reason, for example, when the Chinese hacked into our security clearances, I’m sure you were a victim of this, why were those even accessible? They are historical documents; they don’t need to be accessible.

I will say, I’m pretty critical of cybersecurity. Critical in the sense of at least my judgment of it, and I think it’s starting to change. The cybersecurity world talks an assumed breach, but still spends most of their time trying to stop the breach and a lot less time on, what would happen if the breach happened?

I tell the story of Colonial Pipeline. Many of your listeners will remember the ransomware attack on a gas pipeline, and a whole bunch of bad things happen. They had one move once the breach happened, they turned off the entire facility for over a week. That’s not a sophisticated failure plan. You can’t do that. And so trying to teach companies; I spent a lot of time doing that, “how do you extend the runway? How do you minimize the losses? How do you protect from, in my wonky world, what we call cascading losses?”

Jonathan Reiber:

Yeah. Well, let’s talk about this for a second. I love your points. If you’re going to assume the boom or assume breach, what are some principles that you would offer for organizations that are beginning to think like that? Like, “Okay, Juliette’s out there, she’s persuaded you to assume the boom, so now I need to take that next step.” What do you tell them?

Juliette Kayyem:

Right. And that’s the first chapter, is to get your head around it.

A couple things that I am recommending now, and so this is very topical. What I’ve seen in the corporate world, where I spend a lot of time is, they’re designed unsafe. I call it the architecture of security. What I tell companies to do is, simply put, “what does your organizational chart look like?” What you see in a lot of big companies, but smaller companies need to think about this too, is, you saw after 9/11, the rise of the chief security officer. That was like the former cop who is mostly guards, gates, and guns; the three Gs. They’re focused outside the physical.

Then with the internet and everything, you have the chief information security officers protecting the networks. I’ll tell you, after the pandemic, you’re seeing major companies, especially those in retail and the more physical assets, hire chief health officers or chief medical officers because of cruise lines and stuff like that. So that’s like a lot of chiefs. But when the boom happens, whenever it’s going to be, your response as a company is going to be relatively the same. “What is your communication strategy? What is X, Y, and Z?” I’ll get into that in a second.

The first thing is easy, which is, “what is your architectural design?” And “do people have access to you as the CEO or as the leader?” The second thing I recommend is to, in disaster management, like say an earthquake, we call them stupid deaths. I don’t mean to say the victims are stupid, it’s that you see a lot of things. Did I lose you?

Jonathan Reiber:

Nope. Not at all.

Juliette Kayyem:

Sorry about that. I got a weird-

Jonathan Reiber:

I may be lost for all sorts of other reasons, but we are still connected.

Juliette Kayyem:

I know. Yeah. Let’s say a hurricane, so you have a hurricane and people die at that moment. But in most hurricanes in the United States now, we have what’s called stupid deaths. It’s not actually that people are dying from water or the wind but they’re dying from, in the U.S. now, the majority of deaths occur because of the carbon monoxide poisoning that people start generating. So, we call them stupid death because they’re not at that very moment, they’re the cascading. So, you can think about that too for a cyber network or outside the fatality space and think, “What can I do to make sure I limit the losses?”

And a lot of that has to do with, “do you have appropriate situational awareness? Do you know what’s happening? Can you create layered responses so that an entire system doesn’t go down?”

If there’s nothing you get from my book, you get a lot of good cocktail stories, but one of them comes from the Super Bowl. People will remember when the Super Bowl in the third quarter went half dark in New Orleans in the Super Dome. That was because they had planned for cascading losses. So, a Super Dome in half light is better than one in all dark, even though you would’ve viewed that as a failure.

And so you can see ways in which companies are thinking about, “Okay, the expectation is that something bad will happen. How do I stop the cascades losses?”

Jonathan Reiber:

That’s great. You write about preparedness, and you talk about, I think it’s called the preparedness paradox, and I want to get into that.

From a cybersecurity standpoint, I’ve started thinking recently much more about readiness. So you want to achieve a state of readiness. How do you correlate readiness and preparedness, or are they the same thing?

Juliette Kayyem:

Yeah, they’re essentially the same thing. And I think that’s a good way to think about it. Readiness is actually more present in some ways. But it is called the preparedness paradox. And folks who’ve been around a while in the cyber world will remember the best example of is Y2K.

The preparedness paradox in wonky world is just simply the more that you invest in being ready, as you say, Jonathan, “being ready”, the less disastrous the consequences are because you were ready, you stopped terrible things from happening, but then it becomes harder to justify the investment because everyone will say, “Why the hell were you so freaked out? Nothing bad happened.”

And you’re like, “No, wait. We were ready.” Y2K is the perfect example of that that. In 1998, people started to notice or get alerted that our computers were not likely to go to 2000. They were likely to go to 0000, which would’ve been bad for a lot of reasons like banking, aviation, transportation; and spent billions, gazillions of dollars fixing it so that when the bell told on the new century, they were blitz. It wasn’t that it was perfect, but it wasn’t a huge deal because of the readiness. The narrative almost from the beginning or almost from that moment was, “Oh, all those Y2K crazies were freaked out for nothing.”

And that’s the challenge that we’re always facing. So, what’s the response to that? Well, if you live in a world like I do where you’re not guessing probabilities. I say, “I’m done with risk assessments. We’re bad at it. We get it wrong?” I’m into, “What’s your high consequence event?” And plan for that. I don’t know what the likelihood is, I don’t know what it is. And the only way to overcome the preparedness paradox is, of course, perpetual readiness, as you say, is that it becomes part of your connected tissue as a company, an institution, even a family and a small business.

Jonathan Reiber:

That’s amazing. I met an Indian government official in 2015 and he told me that India had prepared for Y2K, and because they prepared for Y2K it allowed them to withstand the brownouts and blackouts that came 20 years later. And I think there’s an interesting point, which I’m sure you touch on, which is, if you prepare for one thing and people may be like, “Oh, that thing never happened.” And you spent all these gazillions, but you actually ended up preparing for something very similar, which allowed you to-

Juliette Kayyem:

That’s exactly right. That’s the all hazards aspect to this that I’m done defining what the devil will be. I’m like, “Okay, there’s just going to be a disruptive moment for your institution, your family.”

Jonathan Reiber:

I love how you said that. You’re like, “I’m done talking about that.”

Juliette Kayyem:

I’m done. And it’s not that I don’t want them to succeed, it’s just that they have enough focus on all the things about insurance and risk and whatever. I’m just like, “Can we just focus on the high consequence event.” And the beauty of taking these eight lessons of focus, which is eight chapters of lessons and an introduction and conclusion.

Jonathan Reiber:

Yeah, tell us about those.

Juliette Kayyem:

If you take the eight lessons, and get your head around it, you’ve got to be ready. Part of it is about the architecture, situational awareness, cascading losses, all the things we’ve talked about. If you put yourself in that present moment, it won’t matter what the boom is because as you said, because if you prepared for Y2K, you’ll be ready for other stuff. And the difference between my approach, a reporter asked me, “Well what’s the difference between being paranoid and being prepared?” And I said, “It’s easy. It’s perfection.” I am assuming a failure. I don’t talk about preparation, I’m not a prepper, I don’t talk about perfection. I am trying to minimize losses and fail safer. That in the end is a standard of success.

We tend to think, left side of the boom is success and right side of the boom is failure. No! There’s a moment that if we’re ready, we can define success.

This is true of COVID. We can define success in ways that empower us, because we know that we can do better and give us agency. I’m very much into agency, because you could be in this field, and it is hard, people are, as you were saying about working in resiliency; it’s like if you spend a lot of time in it, you might either, I say you have two options: tune out or freak out. There’s got to be a third way, which is we have to have agency to minimize the losses.

Jonathan Reiber:

Let me pull the thread on that a little bit. And one of the things I’ve noticed about your career is you’re often making interventions in The Atlantic right after a disastrous event. You’re articulating a set of principles, you put out a voice of reason and I love that. So, keep it up.

But one of the things, you mentioned was agency, I wonder if you could talk a little bit about leadership and then what you’ve learned in writing this book about leaders and what lessons you’d offer for leaders that are trying to make society more ready and resilient?

Juliette Kayyem:

It’s good, especially leaders who have employees. And so I think there’s so many. And this is not a book about… I think it’s Jim Clapper who says this; I interviewed him in the book. I think it’s Jim Clapper who says, There’s not “crisis leaders” and “non crisis leaders”. There’s just leaders in the crisis.

So part of it is, what are my leadership skills? And I would say, there are three core attributes that I talk about in the book.

The first is of course getting your head around it. It is that you own this in a way that for too long, people in leadership positions have delegated. So, one of the stories I tell in the book is from a personal anecdote in terms of my advising. I advise a lot of boards and CEOs.

I was talking to a CEO of a Fortune 200 company. A really great guy, obviously smart, obviously successful. We were doing a tabletop and I could tell he really wasn’t into it. So, I just said to him, “How often do you meet with your COO?” And he says, “Five times a day.” And I said, “Your CFO?” He said, “At least twice a week.” And I’m going down the list, “your lawyer?”, whatever he wants, “your communications person?” blah, blah, blah. And I said, “Well, what about your chief security officer?” And he says, “Just totally honestly, well, he’s former FBI, he knows what he’s doing.”

And you’re like, “Okay…”. That would be unacceptable for that to be your answer with the CFO or the lawyer or whatever. You have to own it. So, it’s first that, and some of that has to do with accessibility.

The second is that if there’s anything from a leadership perspective that matters in the moment of the boom, it’s “have you set up…”, especially in a world of disinformation, “have you set up adequate, what we call in disaster management and military situational awareness?” “Are you aware of what’s happening in real time?” Because if you aren’t, you’re not going to be able to make decisions. And you can set that up now, you can set up structures, and I write about them in the book, that make you more aware of what’s happening. And I have examples of when CEOs look like they’re being negligent. And what you find out is, they don’t have the access to the information that we would later learn.

The third thing that I often think about from a leadership perspective is communication. That’s one of the key attributes of any leader. A CEO of company’s not going to control logistics, right? They’re going to hopefully have someone who knows what they’re doing or have people in place. But are you communicating regularly? And this is my advice over COVID, to mayors and governors that I advise and CEOs is, “this is really long and it’s really hard, and lots of rumors and lots of things and you need to set up what we call the battle rhythm of communication” which is, what I was recommending everyday, until it didn’t have to be everyday. But they want to hear from you everyday. Same time, same platform, email, whatever. And have fun with it.

People want to show you their dog or whatever and relate on two things: facts and hope. I’ve now reduced all crisis communications to two words, facts, which is, “what the heck is happening?” And hope, which is, “here’s what we’re doing to try to make it better.” And you can think about Donald Trump, for example, who we always talk about the facts side. He always got the facts incorrectly or related in falsities, but he also was really bad on the hope side.

People need to feel like things will get better. And though one is not allowed to talk about him, I think that was why Governor Cuomo from New York became this rockstar for a while. If you look at his daily press conferences, which were televised nationally, it was, “Here’s where we are with the PowerPoints. Here’s the facts, and then here’s hope. Here’s what my grandmother’s saying. Here’s what we’re doing tonight. Here’s something.”

So those are three key areas that I focus on.

Jonathan Reiber:

I love that. That’s incredibly instructive. The one thing that feels constant is relationship between all three of them. The one you pointed out about the CEO who said, “He’s former FBI, so he’s got it.” On one hand, that’s a delinquency of leadership, you’re handing over the hard stuff to Anthony Fauci, that equivalent, like, “I’m just going to let Fauci run the show,” as it were.

But on the other hand, there’s no relationship between them, so if the subordinate has to be like, “I need an extra $10 million,” he only is going to get one ask about that because after that, then the CEO’s not going to trust that person. They’re going to say like, “Well, why are you doing this? What are your motives?”

Juliette Kayyem:

That’s exactly right. Exactly. That person and their team will not feel like they have agency or not feel like they have authority if you don’t give them access. And I talk about this in terms of boards, so for public boards or even private company boards, something like 6% of all board membership is someone arguably in the security space. But they tend to be former military, which is very different than disaster management. And think about that. You’ve got all your friends from the venture capital firms, all your buddies from… but what do they know? And if you don’t have board representation, there’s no one at the big kids table, I always call it the big kids table because that’s where the things happen, who is driving the, as you say, the readiness agenda.

Jonathan Reiber:

Yep. Well, that is immense. We don’t want to go too long because we know readers these days aren’t driving, which means they’re not listening to hour and a half long podcast, but obviously I have a million questions for you and I’d love to have you back on, but I just have a couple more because I think our listeners-

Juliette Kayyem:

I’ll answer that.

Jonathan Reiber:

Yes. Take your time. What do you think in your analysis of preparedness, and you’ve done a lot of good work on human psychology in the book, I can feel it coming through, what do you think is the reason why businesses and organizations aren’t investing in the solutions that they know will work, whether it’s in cybersecurity or anything else? Talk to me about this cognitive problem. The person who’s informed me the most is also at Harvard, Daniel Gilbert, a psychologist. He’s really smart guy. I’m curious for your thoughts on this, because it seems like the-

Juliette Kayyem:

I address it in the sense of like, “Okay, here’s the leadership of blindness.” In other words, that is causing this. And some of it is optimism. If you think about Silicon Valley, they’re disruptors, so they actually welcome this. I was like, “I don’t break things. We don’t break things in my world. We don’t want them to be broken.” And so there is a lot about, what is it? From my perspective and what the purpose of the book is, we’re not telling the stories of failing safer. In other words, we’re telling the Hurricane Katrina, whatever. And we need to tell the stories of, how did it work.

You were asking me before we got on what’s my favorite story, and favorite in the weird way I am, this is my favorite story, is Fukushima, the 2011 nuclear meltdown in Japan, radiation leak. We have a narrative of Fukushima, which has impacted the way the globe works. Germany got out of the nuclear industry, the Democratic Party got out of it. They’re coming back to it now. People were like, “Well, this thing is unsafe because there was an earthquake, a tsunami and then the radiation leak.” All of it was knowable, we knew that building facilities there was dangerous, or Japan did.

Part of it was the history of Japan, and it being a victim of two nuclear bombs that it didn’t want to talk about nuclear facilities. I tell the story, and people think, “Well, nuclear disasters, we can’t afford that, we’re out.” Then I tell the story of the nuclear facility down the street from Fukushima that no one’s ever heard of because it failed safely. It had prepared, it was ready, it empowered its teams, its leadership knew that the industry was risky and therefore had to invest in, how would you fail safer with about six minutes to spare. They were closer to the epicenter, so they had structural damage.

They were closer to the coast, so they got more water damage. With about six minutes to spare, they were able to, in my technical terms, ‘unplug the nuclear facility’. So that if you’re thinking about, what’s my standard of success? I’ve got an earthquake and a tsunami. I’ve got one with a radiation leak and one without. I’m taking the one without. And we need to say, “Okay, so what did they do?” They empowered their workers. They allowed decision making at the operational level because at Fukushima, you had the guys at the nuclear facility calling the Prime Minister’s office. You’re like, “Okay, now that’s not good.”

And they accepted the responsibility of failing safer and aligned their training and planning around that. So now all of a sudden, I probably told you about a nuclear facility you’ve never heard of, so that’s the story I want to tell.

When you say, what’s the psychology? Part of it is we’re not telling the stories of measuring success through less bad. That’s a very technical term I use in the book, ‘less bad’. But I get it. Look at COVID, over one million dead. No one who thought there was a global pandemic, no one in my space thought there’d be zero dead, but 250,000 dead is a better number than a million.

And I can sound crude, but I just want people to see, if we had gotten ready January to March of 2020, if we hadn’t gone to war with the states and stuff like that. So thinking about what would work is important.

Jonathan Reiber:

That’s actually a very inspiring story about the Fukushima. I’d never heard that before.

Juliette Kayyem:

Of course. It was the excerpt, and I write for The Atlantic as you know, it was an excerpt from the book in The Atlantic. Most people who you would consider knowledgeable in both either energy or disaster were like, “I never knew that.” I was like, “Yeah.” We are so bad at telling those stories. And the press wants to follow the dead bodies, of course, but if you look at the not stupid deaths, you can see some good investments about how companies aligned correctly.

Jonathan Reiber:

This is immensely valuable information. And Juliette, it’s so great to have you on. Congratulations on the book.

Juliette Kayyem:

Thank you.

Jonathan Reiber:

Congratulations on your million Twitter followers, now that you’ve gone on this podcast in particular-

Juliette Kayyem:

I know I’ve got million. I know. I’m so excited. Thank you for having me, it’s great. I had to say yes to a podcast with a title like yours, because I live for this!

Jonathan Reiber:

Well, that’s great. We are going to tell the story of your book and you in whatever way we can. And it’s wonderful to have you.

Juliette Kayyem:

Thank you so much.

Jonathan Reiber:

Yep. And I look forward to the next time.