Podcast
Why the Human Element Still Matters in Cyber Defense with Nightwing’s Chris Jones
Season 3 Episode 28 •Show Notes
AI is changing the speed and scale of cyber conflict, but the burden on defenders remains the same: they have to protect complex systems all the time, while attackers only need one opening. That imbalance is especially urgent as critical infrastructure, intelligence missions, and space systems become more connected, more contested, and harder to secure.
Chris Jones, Chief Technology Officer at Nightwing and a former senior CIA technology leader, joins Frank Cilluffo to discuss what that means for national security. He explains why AI may give attackers a short-term advantage, why many breaches still come down to basic defensive discipline, and why even the most advanced tools depend on skilled people, sound judgment, and mission-focused teams.
Main Topics
- AI and the attacker-defender gap
- Why cyber defense is so hard
- Human-enabled cyber and intelligence
- Digital exhaust and privacy risk
- Known vulnerabilities and defensive basics
- Space systems as cyber terrain
- Securing legacy infrastructure
- Cyber, RF, EW, autonomy, and AI convergence
- The workforce behind advanced technology
Key Quotes
“In the world we live in today, basic privacy is at risk. Everything you do creates digital dust. That digital dust reveals your activities, plans and intentions.” — Chris Jones
“Having an offensive mindset when you’re trying to play defense is really important.” — Chris Jones
“The notion with any technology that you’re going to be able to control and contain it… is just overstated. … Once the genie is out of the bottle, it’s super hard.” — Chris Jones
“In order to be really effective, it’s not just the application of advanced technology. It’s the application of advanced technology by really well-trained and experienced operators of that technology.” — Chris Jones
“We also need people who are looking at how the systems are engineered today and asking the contrarian questions on why they exist the way they do.” — Chris Jones
Relevant Links and Resources
About the Guest:
Christopher Jones is Chief Technology Officer at Nightwing, where he helps lead the company’s technology strategy and the integration of advanced capabilities in support of customer missions. He joined Nightwing in 2024 after a 26-year career at the Central Intelligence Agency, where he finished serving as Associate Deputy Director for Science and Technology. His career has focused on bringing technology into national security operations, and he has received numerous awards including the CIA Director’s Award, the Distinguished Career Intelligence Medal, multiple Meritorious Presidential Rank Awards and CIA Exceptional Performance Awards. Jones holds a bachelor’s degree in electrical engineering from the University of Notre Dame and a master’s degree in systems engineering from Virginia Tech.
Transcript
Chris Jones [00:00:01]: The notion with any technology that you’re going to be able to control and contain it, I think is just overstated. Even if the United States had a super effective lockdown capability on certain models, for us, you do have to embrace the notion that the world’s going to do what the world’s going to do.
Frank Cilluffo [00:00:20]: Welcome to Cyber Focus from the McCrary Institute, where we explore the people and ideas shaping and defending our digital world. I’m your host, Frank Cilluffo, and this week have the privilege to sit down with Chris Jones. Chris is the Chief Technology Officer at Nightwing, an amazing company that spun out of Raytheon. Prior to that, he spent over 25 years in the federal government at the Central Intelligence Agency, and his last role was Deputy Associate Director for Science and Technology, where the cool stuff happens at the agency. So, Chris, thank you so much for joining us today.
Chris Jones [00:00:57]: Thanks for having me, Frank. I’m super excited to sit down with you and talk about this.
Frank Cilluffo [00:01:00]: Likewise. And, you know, you’ve seen for 25 years, and everyone says the latest and greatest is transformational, but I think we really are at a transformational time in technology. And I’d be curious, sort of what your thoughts are just generally in terms of where we are and what the implications are for both defenders and potentially those that try to steal secrets for a living.
Chris Jones [00:01:26]: Yeah. We’ve seen, as you know, like, several generational increases in technology over the last 30, 40 years. You know, you look at the mainframe to client server models, you look at cloud adoption, you look at the evolution and slow growth of machine learning. But I agree, I think the explosion in the last 18 months on Frontier models and the introduction of artificial intelligence and what’s going to be all aspects of life, I think is truly once in a generation. Absolutely. From my perspective, I think, you know, there’s always a bit of an asymmetric advantage when you look at, you know, those who want to attack systems, go after infrastructure.
Frank Cilluffo [00:02:05]: The initiative remains with the attacker. Right?
Chris Jones [00:02:07]: 100%. And, and I think the attackers have always had the advantage that they have, you know, a mandate to get access to something, to take some nefarious action. They need to get it right once. They need to get in one vector via one angle in one moment in time to create whatever effect they’re looking to create. The defenders have to protect all the time, 24/7, and you have to protect the entire landscape of vulnerabilities in any system, regardless of what it is.
Chris Jones [00:02:37]: So to me, in the very short term, you look at AI and the explosion of foundation models and even the recent announcements on Mythos and Spud coming out from OpenAI and others, it’s clear that the attackers are going to try and use those capabilities to increase that asymmetric advantage. The time cycle between identifying vulnerabilities and then building exploits and then deploying them is going to get tighter and shorter for them and defenders are going to struggle to catch up right now. I think just like previous iterations of technology, at some point you will get back to an equilibrium. It’s going to happen over time. That same frontier model that’s going to enable people to find vulnerabilities will help you to patch them and to identify other weaknesses and to help work them off. But I think in the very short term, we should be looking at-
Frank Cilluffo [00:03:24]: There’s a window of vulnerability, right?
Chris Jones [00:03:25]: There’s a window. Exactly. And we need to understand that and we need to bear down on that. And I think you see a lot of that with policies coming out, you know, from the administration, the executive orders. I think there’s a, an urgency that everybody kind of understands in the space.
Frank Cilluffo [00:03:36]: You know, we’ve had a number of guests in senior roles, current and former, at the National Security Agency and have looked at the whole change in, in terms of signals intelligence and the broader cyber sets of issues. When I look at the agency, they play a very unique role in human enabled technical means. Help us, help my, our viewers and audience understand the role that the Central Intelligence Agency plays in cyber. Most people think immediately the fort but I’d be curious what some of your thoughts are there.
Chris Jones [00:04:09]: Yeah, there’s clearly cyber focus and cyber initiatives and you know, one thing I’ll always say is, you know, there’s a close brotherhood. People always believe that the agencies are on different pages at times, but there’s a really close linkage between the two organizations and they play really well together the vast majority of the time. The real vector that the agency can enable is the human enabled part of technical collection and the human enabled part of cyber. And I think it’s underappreciated. And even when you talk about frontier models, you know, the application of any vulnerability that winds up into an exploit that’s looking to take advantage of, of some collection modality. No matter what it is, there’s usually a human necessary in the loop somewhere, and regardless of how that human manifests themselves in loop and, a lot of that we can’t get into, but the bottom line is human enabled technical collection is a game changing opportunity. Just like human enabled Defense is absolutely mandatory for cyber defense and cybersecurity.
Chris Jones [00:05:11]: And understanding what that human can do from an access perspective, I think is really critical, both offensively and defensively. And I think that’s where the partnership between the folks up in Fort Meade and the folks in Langley is really so important.
Frank Cilluffo [00:05:23]: Absolutely. And you know, there is so much data and exhaust in, in, in our environment these days that it’s, it almost makes the hard target harder. Yes, no? I mean, at the end of the day, I’m with you. There’s someone behind the clickety clack of the keyboard until this goes purely autonomous. And God help us when that occurs. But, but for the most part, there’s normally someone with intentions, someone with an intent to do X or Y or Z. But in a weird way, now that there’s so much available, it actually makes the role at the Agency more essential, doesn’t it?
Chris Jones [00:06:02]: 100%. And you know, I, when I was inside the organization, I used to routinely say, you know, if you’re trying to explain this to civilians on the outside who maybe don’t understand the intelligence community, it’s a very simple concept. Right? In the world we live in today, basic privacy is at risk. Everything you do, right, creates digital dust. That digital dust reveals your activities, plans and intentions. I go home, I’m going to look at my computer. This is a dated example, but it’s quite true. I go home and I turn on the computer and it’s popping up all these F150 ads. I’m not in the market for an F150.
Chris Jones [00:06:34]: And then I go around my house and I realize, oh, my 20 year old son has spent an hour on the Internet looking for F150s. The bottom line is ad trackers, the digital data that’s out there. People know what you’re interested in and they’re going to push it to you. That same concept regarding, you know, the risks to privacy exist when you start talking about clandestinity. Right? And so anytime you need to do things in a more secretive way, those same forces that create privacy risks put things that need to be quietly done at risk. And so, yeah, I would say the price per pound for doing sensitive things in the modern world continues to go up. I don’t think that eliminates the opportunity, it just makes it more challenging and difficult. And so I think the intelligence community knows this and I think they’re spending more and more of their time trying to prioritize which activities are the most important to conduct.
Frank Cilluffo [00:07:20]: Yeah, because, because when I think about Counterintelligence today, it’s not just the traditional defense industrial base or national security secrets. It’s very much the frontier models and, and the like. And that’s hard to get our hands around sometimes. Any thoughts on that?
Chris Jones [00:07:37]: Well, and you can see it playing out today, like the news right now is this constant conversation back and forth between, you know, where the models are, what’s the application of the models. Should we be afraid of the models? Should we be embracing the models? Can you control the models?
Frank Cilluffo [00:07:51]: The answer is yes, yes, yes, and yes. Right?
Chris Jones [00:07:52]: And the answer is, it’s all true. Exactly. You know this Frank, right, I mean, there’s truth to all of those things. The one thing I will say is the notion with any technology that you’re going to be able to control and contain it, I think is just overstated. I think it’s incredibly hard, you know, once things, you know, once the genie is out of the bottle-
Frank Cilluffo [00:08:11]: Once it’s out of the bottle, it’s out.
Chris Jones [00:08:12]: It’s super hard. And we also have to realize that we’re not the sole purveyors in the United States with our frontier labs. You know, we’ve got competitors out there with the Chinese and others who are very, very close and who are investing in this area, you know, at a steep rate and advancing quickly. And so even if the United States had a super effective lockdown capability on certain models for us, you do have to embrace the notion that the world’s going to do what the world’s going to do and others are going to be out there and those models are going to leak. So dealing with the technology and figuring out how to put the guardrails around the technology and then knowing that people are going to try and jailbreak those guardrails, knowing and understanding that’s half the battle. I think locking it up is going to be a real, real hard thing to execute.
Frank Cilluffo [00:08:59]: You know, that that’s really well said. Because if China had released Mythos, would there be a press conference? Would there be any responsible use? Would we have any of these discussions? No, it would be after there’s a, hey, we’re here. Right? So I think that that also has implications for our policy. So you’ve sort of got a double edged sword, as you do with most technology. We need to maintain our superiority in this space, which means we have to utilize. But at the same time, I think right now people are pretty flipped out in terms of what some of these capabilities are. So I think it’s a, it’s a window, right?
Chris Jones [00:09:42]: Yes.
Frank Cilluffo [00:09:43]: And there’s a chance for blue, for the Defender to get up to speed at some point. But again, that’s, I think when we look at risk, it’s not going to stop everything everywhere, all the time, from every perpetrator and every modality of attack, because the bad guy only has to be right once. So it’s, it’s, it’s balancing those sets of issues.
Chris Jones [00:10:07]: Absolutely. Totally agree. And, and, and this gets back to, you know, and I’m in no way dismissing the effectiveness of the frontier models to do things like vulnerability detection.
Frank Cilluffo [00:10:17]: Yep, we there.
Chris Jones [00:10:18]: They’re, they’re there. They’re real.
Frank Cilluffo [00:10:19]: Yeah.
Chris Jones [00:10:20]: And I think that we just need to acknowledge that. But I would also suggest that if you kind of look at cyber defense and cybersecurity over the last 10 years, how many of the attacks, how many of the compromises, how many of the losses of data and PII and other things, how many of those were executed with known vulnerabilities?
Frank Cilluffo [00:10:38]: Exactly.
Chris Jones [00:10:38]: It’s not just about the fact that, oh, we have new models that are going to find new vulnerabilities. It’s about having the discipline as a socioeconomic society to invest in the cyber defense piece. And I think to date, we’ve invested here and there, but I think it’s been inconsistent, and I think people haven’t fully appreciated the scope and scale of the vulnerability to their enterprises. And whether it’s public institutions, whether it’s academic institutions, whether it’s private industry, I think we’re all guilty of this a little bit, which is, you know, defense is a cost center.
Frank Cilluffo [00:11:12]: Exactly.
Chris Jones [00:11:12]: It’s not a profit center.
Frank Cilluffo [00:11:13]: Exactly.
Chris Jones [00:11:13]: And so people are going to index on, you know, what their mission is if they’re a government organization, what their profit, you know, makers are if they’re in private industry. And we’ve got to be a bit more tempered and balanced, and we have to just commit the resources to doing defense well. And the fact that these new vulnerabilities are coming out, on the one hand I look at and say, yeah, there’s some risk there and there’s going to be an asymmetric disadvantage for a while for the defender. But on the other hand, you kind of look at it and say, well, in this seminal moment in our history, maybe this is the right message for us if we’re going to prosper as a free society, to know people will come after you, whether they’re coming for your IP, whether they’re coming from your resources, or whether they’re going to try and mine data from your talent. And on your comment earlier about being an open, democratic society, you know, autocratic regimes have different controls in place than we do. So our information’s out there. We might as well understand that we need to triple down on protecting it and protecting our economy. And so there’s a, there’s a silver lining to this whole conversation.
Frank Cilluffo [00:12:13]: Absolutely. And before we started filming, we were talking about football. And often it’s the trenches, it’s the blocking and tackling that wins games. Right? We focus on the, the antelopes or the zebras when we really need to sometimes focus on the horses. And, and I think that that analogy plays very well with this business as well. It’s not just the quarterback.
Frank Cilluffo [00:12:38]: It’s not just that unique play that gets, throws everyone off guard. It’s the day in, day out. Right? It’s the reps and doing them well.
Chris Jones [00:12:48]: Yeah, I, I’ve been on the offensive side for large swaths of my career, and I’ve been on the defensive protect equity side for a lot of my career. And I’ve always told people-
Frank Cilluffo [00:12:55]: Where’d you have more fun?
Chris Jones [00:13:00]: Oh, the offensive side. And the other thing I’ve said a lot in my career is, you know, when you’re playing offense, you know, you usually get two kinds of phone calls, right? You’ll get the, hey, this didn’t work, or this didn’t go well, or you’ll get a, hey, congratulations, your team did great. You guys accomplished the goal.
Frank Cilluffo [00:13:13]: Yeah.
Chris Jones [00:13:13]: When you’re playing defense, there’s only one kind of phone call.
Frank Cilluffo [00:13:15]: Exactly.
Chris Jones [00:13:15]: But you’re only going to get one call, and that is, hey-
Frank Cilluffo [00:13:18]: It’s never good.
Chris Jones [00:13:19]: This didn’t work today. I can’t get access to my resources today. The network is slow today. My comms are down today. Right? When everything is working great on defense, solace is going home at the end of the day, knowing it was silent.
Frank Cilluffo [00:13:31]: Well said.
Chris Jones [00:13:32]: And so it’s obvious that people oftentimes are going to be like, hey, I’ll take the side that has parties and throws high fives. But you need to balance. You need to really balance those things. And you need to appreciate that the culture between playing offense and defense are just so different.
Frank Cilluffo [00:13:44]: And, and to play good defense, you have to understand offense. Right? I think that bridge has been. People recognize that, but 20 years ago, they were seen as very discreet communities, or 25 years ago, but that’s changing so fast.
Chris Jones [00:13:59]: I think that-
Frank Cilluffo [00:14:00]: And the bad guy gets a vote in all this. Right?
Chris Jones [00:14:02]: 100%. And I think, you know, one of the things in my government time and also now at Nightwing that I see is we, we’ve got portfolios on both sides of the ledger, and having an offensive mindset when you’re trying to play defense is really important. You know, the offenders and the attackers are going to try and figure out what is the least intrusive, least costly, fastest way to get to success, and they’re going to try and execute those. And so at times as the defender, you know, it’s not necessarily about trying to plug 100% of the holes. It’s understanding what is the attacker’s mindset, what’s the paradigm they’re having to exist in and how do you make it successively difficult and harder for them to go after those things and costly to the point where they go it off to somebody else? It’s like crime.
Chris Jones [00:14:46]: You know, people are always saying lock your door. You know, make yourself a hard target. You know, doing that on the cyber front is just as important to do all the things to make it hard so attackers go elsewhere. I feel like, I feel like this entire conversation around frontier models is an opportunity for us to get the basics right, right? And then for super elite organizations, you know, if you’re at the Pentagon, you know, if you’re at CIA or NSA, you know that you’re going to get attacked daily by advanced state actors, you have a different level. But you know, when we’re talking about mom and pop businesses, dentist offices and pharmacies and local, you know, florists who rely on comms, those people just need to do basic investment and understand that they don’t need to be cyber experts, make it harder.
Frank Cilluffo [00:15:28]: And displace risk. Right? I mean, in the end you’re just going to push it, you’re not replacing it, you’re moving it elsewhere. That’s the best we can do. And, and you know, not to, to belabor this point too much, but technology changes, but human nature is pretty consistent, right? I mean, you can look at Maslow’s hierarchy still plays as much as it did when it was first rolled out.
Frank Cilluffo [00:15:56]: So, so I do think there is a human nature, both from the attacker perspective and from the defender. And I guess from a defender’s perspective, when we look at deterrence, I spend a lot of time looking at cost imposition, but it’s also making it harder for the bad guy. And that doesn’t get rid of it, it just pushes it somewhere else. You would agree with that sort of mindset?
Chris Jones [00:16:21]: 100%. And there’s examples over time. You look at the Star Wars program in the 80s. It was exacting cost on the Soviet Union as the adversary to compete with us in a way of it didn’t almost matter whether we got to success. But you change the ground rules and the competition and then the adversary has to decide can we actually invest to get there. So exacting that cost, changing the strategic calculus for adversaries I think is just as important as making sure your firewall is configured accurately.
Frank Cilluffo [00:16:51]: That, that’s a perfect segue into space. And you know, you’re absolutely right. When you look at sort of like Brilliant Pebbles, a lot of our capability just made it too costly for the Soviet Union to engage. And luckily we didn’t have to discern the efficacy of all of these capabilities. But what does space look like today? I mean, forever, we’ve had some conversations around APNT, positioning, nav. Actually clocks kind of rule the world. I don’t think people have a full understanding of that, obviously GPS and alternatives to what that could look like. So we’ve known, we’ve worked on these issues for years, but space is now increasingly being contested.
Chris Jones [00:17:41]: Yeah.
Frank Cilluffo [00:17:42]: What do you think that means from a cyber standpoint? And clearly we can’t get into too much discussion here, but to help frame the thinking.
Chris Jones [00:17:52]: Sure. I mean, I think overall, in any critical infrastructure environment, certainly space is absolutely critical, today, the challenge for cyber resiliency and cyber defense going after APTs is really about access, upgrade, replacement, right, iteration on the technology front. And so space prevents the obvious challenge of a physical domain that you don’t have ready access to, you can’t readily replace. Now, there’s lots of systems on orbit that can be updated. There’s lots of systems in orbit that can be patched. It’s not the case that it can’t be done. It’s just not as accessible as most other domains. And so you just need to recognize that going in. The other thing that I’ll just say-
Frank Cilluffo [00:18:34]: And it’s also ground, right? It’s not just what’s up there.
Chris Jones [00:18:37]: And people think about, exactly, people think about what’s on orbit, but you have to think about comms, you have to think about the ground, you have to think about command and control. All aspects of space systems present, just like any other system, present risk. And you need to manage that risk. Now one of the things I would argue is some of our, you know, as a nation, some of our capabilities have lasted so long.
Chris Jones [00:19:00]: They’ve been so successful for so long, things that we anticipated we’d have for a very short period of time are still on orbit, doing great things. And we still have-
Frank Cilluffo [00:19:07]: And that’s a good thing.
Chris Jones [00:19:08]: And that’s a great thing. Kudos to the engineers, right, in this country and our ability to innovate and put things on orbit. But it’s clear that decisions are being made and investments are being made to do two things concurrently. One is upgrade, harden and make things as cyber resilient as possible on legacy infrastructure, while at the same time moving to a more rapid launch, rapid reconstitution of constellations so that you can replace things on orbit with things that are more easily configurable with modern technology, not things that you were constrained to 10, 15 years ago. And I think both of those things need to happen concurrently. I think both things are happening concurrently. I think when you look at the example of something like a SpaceX and you look at this success of LEOs, commercial space has really charted a course in many ways for, hey, reusable launch, expendable small sats.
Chris Jones [00:20:02]: And so you can put capabilities up very, very quickly that, you know, I mean, SpaceX is already deorbiting, you know, assets that are no longer working or having trouble.
Frank Cilluffo [00:20:12]: And they were an idea when we were talking about national security space.
Chris Jones [00:20:17]: Exactly. But now that’s a model people can look at and say, okay, so you know, rip and replace for satellite capabilities is not something anybody really thought about. But now given the price points and given where they are, they can really have that conversation. So I think you have to do both. I think you have to harden and integrate modern cyber defense capabilities as much as possible to the entire end to end system, the entire end to end ecosystem of space for the legacy capabilities that you need and require. And at the same time you need to be heavily investing in replacements for capabilities that are more readily upgradable, things that are more swappable, you know, things that are using SDRs and other capabilities are more dynamically configurable that maybe 10, 15, 20 years ago you didn’t have that luxury. And I think, you know, the space domain and the people managing it, my perception, are doing both of those things actively.
Chris Jones [00:21:08]: And I think that’s the right answer.
Frank Cilluffo [00:21:09]: And I dare say that we look at cyber through discrete lenses, sometimes exquisite, sometimes not, but we’re starting to see convergence of technology. I have a hard time delineating and differentiating cyber from EW, from RF and, and, and it’s all coming together, isn’t it?
Chris Jones [00:21:34]: It is. And I know, you know, you spent a lot of time doing national defense policy, right? And a lot of policy originates out of very clear delineations between like who’s got the authority for A versus B versus C.
Frank Cilluffo [00:21:43]: We look at the world through our boxes and org charts rather than the way it is.
Chris Jones [00:21:46]: And it makes sense. Like you had to delineate roles and responsibilities that way. And technology is just not a cooperative partner in that effort. Right?
Frank Cilluffo [00:21:52]: Which is cool, but.
Chris Jones [00:21:53]: Right. It’s amazing. And you look at the technology and you look at the advancements of technology, but I mean, you look at a cell phone today and I challenge somebody to tell me, you know, what it is, you know, is it a router, is it a modem, is it a computer? I mean it’s everything.
Frank Cilluffo [00:22:08]: Is it a brain?
Chris Jones [00:22:09]: It’s everything all at once. You start putting AI on it. So how many different technologies with how many different policies would have to cover the governance of behavior, right, on a device like that? And the answer is, well, it’s the entire gamut of things we imagined and envisioned 20, 30 years ago. So you know, early years of the global war on terror, when we were kind of moving out as a national security establishment, you could draw some pretty clear delineations. Technology is converging in a way that’s making that incredibly complicated. And as much as the technologists, I think in the national security space are trying to be agile to stay ahead of it, you also have a policy mandate.
Frank Cilluffo [00:22:46]: Absolutely.
Chris Jones [00:22:47]: To try and integrate to stay ahead of it. Because the technologies are just converging too fast.
Frank Cilluffo [00:22:52]: Yeah, no, that’s a great set of points. And I mean autonomous vehicles and UAS and counter UAS and cyber and EW, it’s all coming at us. And I think that when we look at the offensive side, we see the delineation quickly, but defensively, we’ve got to spend money, right? I mean, we’ve got, an ounce of prevention here is essential, is it not?
Chris Jones [00:23:23]: 100%. And I also believe that, a couple of points there, you know, we talk about autonomous systems, I think there’s going to be different thresholds for different capabilities depending on their different outcomes. You know, in the non kinetic space, I can see a lot of opportunity to have automated machine to machine communications that are taking discrete actions with a man in the loop, right? A man over the loop kind of conversation. When you start talking about kinetic options, I think you’re going to get into a very different policy space.
Chris Jones [00:23:58]: And I think there’s always going to be a requirement to have a human in the loop. Right? And to have that conversation. So I think, you know, over time the technology is going to really challenge our norms for what our expectations are from a policy perspective and push us into uncomfortable areas to define those things. I think from the outset people are probably rightfully so, going to want to be conservative until they know what the outcomes can be. I do think, though, you know, overarching comment here, I do think that as people talk a lot about frontier models, advancement AI, technical convergence, I think we’ve got to not lose the importance of the human.
Frank Cilluffo [00:24:37]: Yeah. And I’m glad you’re saying that.
Chris Jones [00:24:40]: There’s, there’s so much, you know, when people talk to me about the really impressive examples, whether it’s cyber defense, you know, whether it is analysis of open source data, whatever the example is, whenever people are giving me examples of really high end effective use of advanced algorithms, AI, machine learning, they’re all being leveraged by subject matter experts with deep technical expertise, deep subject matter expertise. And because they have and they possess that expertise, the application of AI completely transforms productivity and output. It doesn’t necessarily mean that you’re going to have that same level of effectiveness with someone who’s not native to the subject, someone who’s not steeped in the technology, someone’s not steeped in, I’ll say in my business, the tradecraft, what they’re doing. So we can’t lose sight of the fact that in order to be really effective, it’s not just the application of advanced technology, it’s the application of advanced technology, be it really well trained and experienced operators of the technology. And that is going to be, I think one of our challenges is to not allow ourselves to be more and more lax on the, you know, workforce development efforts that we need to maintain parity, if not to grow our expertise as compared to our adversaries. Because they’re going to be doing the same thing.
Frank Cilluffo [00:26:11]: Absolutely. That, that was an incredibly nuanced and an important set of issues. And I do want to sort of talk a little bit about the workforce, but before we jump into there, yay or nay, is this still the greatest technology between our ears?
Chris Jones [00:26:26]: Absolutely. Absolutely.
Frank Cilluffo [00:26:27]: Yeah, so, and if you look historically, it’s normally not technology, but how it’s applied. And that I think gets lost. I mean, even if you look at military history, whether it’s Martin Van Creveld’s sort of work in terms of understanding all the way down back to the Trojan horse in terms of how technology was used, would you agree with that at this stage?
Chris Jones [00:26:54]: I do, and I, and I think-
Frank Cilluffo [00:26:56]: But it is potentially changing because autocratic regimes don’t play by the same rules, right?
Chris Jones [00:27:01]: Exactly. And I, and I think people underestimate the human ability to nuance thinking and learning and be intuitive towards approaching things. Problems that you know, can’t just be learned via models. I think models will continue to improve and will take more and more and more of that burden off of humans. But there’s always going to be dynamic decision making, intuition, perception management that machines are not going to get to the level of a human. My opinion.
Frank Cilluffo [00:27:36]: And certainly not most of the people behind those machines, right? They’re not, they’re thinking maybe differently too.
Chris Jones [00:27:40]: Right. And then, and then there’s other biases. So the more you put on the human, and you talk about like autocratic regimes, the more you put on the machine from that human trained model, if the human trained model is constrained by guidelines and rules that were very narrowly defined and is not thinking beyond the borders of what that society is typically allowed to think beyond, that’s going to have to seep into the model which is going to seep into the decision making of those models. So I think there’s a whole other emerging field here which is understanding the outcomes of those models, understanding manipulation of models, understanding security of models, and that’s going to beget a whole different risk vector in the national security space.
Frank Cilluffo [00:28:25]: Really thoughtful. And the flip side of all that is we can’t unilaterally disarm in that space either. So we’ve got to apply, but we want to do it in a way, you know, I don’t think we can take for granted that democratic institutions will continue to dominate. We have to invest in all that. And you know, when you started at the agency and you’ve always been at the intersection of technology, operations and national security, the type of case officer or young woman or young man who is joining the agency, is, is it pretty consistent or is that change? Obviously they need new skills in terms of the technical acumen to bring to the fight. But what does that look like?
Chris Jones [00:29:16]: Well, I mean, as a, as an alum, you have to, I have to say, first of all, you know, I’m incredibly proud of the agency and the accomplishments of the agency. It’s a unique population in my estimation. And I think the skill set-
Frank Cilluffo [00:29:31]: The mission, the why is essential.
Chris Jones [00:29:34]: Certainly the technical acumen of, you know, the staff today is much, much higher than it was. And that’s just natural generational. You know, you’ve got a digital native fluent generation coming in today. Right? So the technical acumen is, is very, very different. But it is the why, you know, why would you want to serve in an organization that tells you that the accolades, when you get it right, are that we don’t get any accolades.
Frank Cilluffo [00:30:00]: Absolutely. People’s lives are, yes, safe.
Chris Jones [00:30:04]: So having people know that they come to work to contribute to being the first line of defense for the country and serving in that silent service, there’s just a certain character of person who I believe covets that, enjoys that, relishes that, and-
Frank Cilluffo [00:30:20]: And makes a big difference.
Chris Jones [00:30:22]: And not everybody can do it. And so, you know, people, you know, have had stints there and realize it’s not for them, but I think for the people who really succeed there, do well and thrive, and there’s lots of examples, I think, you know, there’s something in their core about being kind of that silent sentry and that silent guardian that they love. And working in teams that are populated with those individuals is one of the most rewarding experiences, I think, of my professional life.
Frank Cilluffo [00:30:49]: And it really is the team. Right? And, and, you know, we’re at a university, Auburn is a university. I, I know we talked Notre Dame, we talked Virginia Tech. You have a daughter at Tennessee, so another SEC school. What, what should universities be doing, thinking to ensuring that we are playing our role, which I don’t think is an option. I think we have no choice to make sure we build that next, whether it’s on the national security side or the commercial side.
Chris Jones [00:31:22]: I, I think on that last point, regardless of whether it’s, you know, public or private service-
Frank Cilluffo [00:31:27]: It’s all converging too, right?
Chris Jones [00:31:29]: The lines are blurring. I think, you know, we’re competing against autocratic regimes that don’t have that distinction to begin with. So I think we’re taking intentional steps to make sure that there’s always going to be a difference in the, in the United States between public and private entities and their, their authorities and their roles. But I think it’s going to be far more integrated moving forward than it has been in the past. And so I think there’s the guidance and my, my hope is the same on either side, which is the engine that runs our country and the engine that enables us to prosper, that drives, you know, quality of life in the United States, drives prosperity and growth, and then investment to make sure that democratic norms and free and open societies prevail and the competition of ideas across the globe is innovation. It’s innovation. So we need to continue to have people coming up through the system and through the educational organizations and through, you know-
Frank Cilluffo [00:32:23]: Sometimes mavericks too. Right?
Chris Jones [00:32:25]: Universities like Auburn who think differently. And so to me, that’s one of the things, you know, providing basic foundational information is incredibly important. You know, as an engineer, you know, I love, you know, engineers who can dissect problems, work them down into basic understandings and work through the problem, working the problem, working the issue. I love that about engineers. But we also need people who are looking at how the systems are engineered today and asking the contrarian questions on why they exist the way they do today.
Frank Cilluffo [00:32:51]: And what makes people tick. Right?
Chris Jones [00:32:53]: What, how do you bring the human element into the technology? What if you looked at things orthogonally? What if you took some outside the box ideas? But it’s the innovation longer term that will keep our resources at the level that they need to be and the prosperity at the level it needs to be to be self sustaining and ensure that our country remains free and open and can compete in a world that candidly, we have autocratic adversaries. We have plenty of non state actors still who want to come after us. There’s all kinds of, you know, organized crime and drug trafficking organizations and groups. There’s plenty of threats out there.
Frank Cilluffo [00:33:32]: Who don’t want to bring any attention to their activity. Right? They’re using it from a tradecraft standpoint.
Chris Jones [00:33:37]: Exactly. And so having a population of people who are constantly innovating, and whether that innovation drives into the private sector and then helps, you know, maintain, you know, our way of life, or whether that’s driven into public service to help maintain our way of life, I think they’ll intersect well either way, as long as we’re driving innovation, thoughtfulness and curiosity into the next generation.
Frank Cilluffo [00:33:57]: Very, very well said. I, I, I often say, and I get in trouble for this, but I think the real differentiator is if you ask yourself, would you rather be born here in the United States or Beijing or I mean, from a tech standpoint, I can see, but at the end of the day, it’s all the other things that make our democracy imperfect but the best out there, right? I mean, that’s the, at least from my perspective, I may be biased, I may be blindsided, but that’s how I differentiate. I hope that that continues. And ultimately it’s not just the tech innovation, but it’s how it’s applied. And often autocratic regimes are focused on their own people first, right? So from a privacy standpoint, that is in jeopardy and we can’t totally punt, right?
Chris Jones [00:34:51]: Yeah. And not waxing too philosophical on it, but as an engineer and a technologist, you know, I spent a lot of time there, but I also am hopeful that people, as they come through the educational system and they, and they go through that, they also have a deep appreciation for history and how we got here.
Frank Cilluffo [00:35:05]: Technology changes.
Chris Jones [00:35:06]: Because the technology is going to constantly change. But there’s lessons in the past that we don’t want to have to relearn. And there’s, there can be, you know, a debate about ideas and systems, and that’s healthy, but you don’t want to try and relearn things that you’ve learned the hard way in the past did not advance society, did not advance freedoms, did not advance people’s ability to move and be upwardly mobile, mobile in our society. So I, you know, as much as I’m a giant fan of technology, and I want everybody coming out to have a certain level of technical literacy, to be competitive and to innovate, we also want those people grounded in, you know, history and culture to understand how we got where we got and what all the generations that have sacrificed before us to give us this opportunity that we’re sitting in today to understand what that looked like. And I think if you have the right innovation engine, the right curiosity, and the free society that we have will continue to outpace the rest of the world in innovation. I’m very confident in that. And then at the same time, we just need to make sure people are grounded.
Chris Jones [00:36:08]: And, you know, as a person who’s been able to travel the world, you know, I’ve traveled to dozens and dozens of countries that I love visiting, met amazing people globally. I’ve never not come home and said, this is home, and I’m really glad this is home.
Frank Cilluffo [00:36:21]: Well said. And one of my favorite quotes is Mark Twain. Whereas history may not repeat itself, it tends to rhyme. And we continue to make some of the same mistakes. But at the end of the day, there’s the positivity out of all of that. You know, two final quick questions. What is one underestimated technology you think that, and now we’re going beyond cyber, because when I think cyber, it’s integrating to achieve an outcome and an effect you’re trying to achieve.
Chris Jones [00:36:51]: Right.
Frank Cilluffo [00:36:51]: I, I don’t think it can be treated as this black magic anymore. I think it actually undermines it. It’s how it can be applied more, more broadly. But if there is one technology that you think we’ve underestimated, what is that? Miniaturization, speed, autonomous, or something totally different? Is it in the bio, in the biological?
Chris Jones [00:37:14]: I was just going to say, you know, this is certainly outside my area of expertise, expertise. But I think biotech.
Frank Cilluffo [00:37:21]: Boom.
Chris Jones [00:37:21]: I think biotech. And I, I think for a lot of reasons. One is it’s such a delicate area to be doing some research in. And we have norms and standards and ethical expectations as we should. But not everybody in the planet’s gonna behave the same way. Not everybody in the planet’s gonna hold themselves to the same standards. And so I do wonder at times where we are in our understanding of the application of, you know, advanced technology to some of the biotech areas. And again, admittedly not an expert, but that’s an area that interests me that I think could be surprising. And it’s also an area where I think frontier models and AI can really help. Right? Because if we can do a lot of simulations and a lot of advanced modeling of things on diseases and other things where you don’t want to do human subject testing.
Chris Jones [00:38:14]: And again, getting back to the ethics of it, you know, questionable behavior by people, you want to avoid that. So as much of that that you can handle via simulation and modeling and not have to practice on people, I’m hopeful that that unlocks the opportunity to, for have having breakthroughs with diseases and, you know, persistent conditions and chronic issues. I can’t escape being, you know, a national security person for several decades. Also wondering that any technology that gets, you know, put forth and is a new discovery, I also worry about how, you know-
Frank Cilluffo [00:38:48]: It can be exploited
Chris Jones [00:38:49]: How malign actors might take advantage of that.
Frank Cilluffo [00:38:50]: You know, and, and that’s a perfect segue to my next question. We’re often asked what keeps us up at night. I think you’re, you very eloquently laid out innovation is the engine. But what gets you most excited every day?
Chris Jones [00:39:07]: I’m just super passionate about the intersection of national security and technology. I just, that’s what I wake up every single day, I live and I breathe it. And I’ve had the pleasure in that role of working with the, some of the most patriotic individuals who at the same time represent that innovation, like they, they’re focused on it. And I’m not talking just about, you know, national security, you know, public, you know, servants.
Chris Jones [00:39:37]: I’m talking about across the board. Academics, you know, private institutions.
Frank Cilluffo [00:39:43]: That’s what makes it great is the mix and match, right?
Chris Jones [00:39:45]: R&D. And so when you see the landscape of Americans who come together and raise their hand and say, hey, I’m existing in this country, I’ve been given great opportunities in this country to grow, and I want to give back. I want to focus my energy on helping protect this nation and ensuring that my kids’ kids have the benefits of the way of life that I was offered. When you see those things, to me that’s eye watering and that’s what gets me juiced up and that’s what gets me going.
Frank Cilluffo [00:40:09]: Couldn’t, couldn’t have asked for a better response to that. Finally, what questions didn’t I ask that I should have?
Chris Jones [00:40:17]: Oh, we didn’t talk too much about Auburn and Notre Dame’s football series coming up.
Frank Cilluffo [00:40:22]: It’s going to be fun.
Chris Jones [00:40:23]: I know we’re talking about that. We won’t bet on that here. No, I, I think you hit the landscape of everything.
Frank Cilluffo [00:40:31]: Chris, you, you covered so much territory in a short amount of time. I had a bunch of questions I want, we threw that out the window. Those, those make for the best conversations. Thank you for joining us today. Thank you for your service for all these years to advance our national security and, and help the women and men of our country and more broadly, democracies globally. And thanks for continuing to fight that fight.
Chris Jones [00:40:56]: Thank you so much for having me, Frank. Appreciate it.
Frank Cilluffo [00:40:58]: Thank you for joining us for this episode of Cyber Focus. If you liked what you heard, please consider subscribing. Your ratings and reviews help us reach more listeners. Drop us a line if you have any ideas in terms of topics, themes or individuals you’d like for us to host. Until next time, stay safe, stay informed, and stay curious.