Live on Bloomberg TV

00:00Please welcome to the stage and Neuberger, deputy assistant to the president and deputy national security adviser of cyber and emerging technologies at the White House for a conversation with Bloomberg's Katrina Manson. Thank you very much. Great to be here. Thanks for coming to the West Coast and. There's a lot going on in the realm of hacking. This administration when it came in faced. The crisis with Colonial Pipeline in 2021. Three years ago, the administration said this was unacceptable. This was a risk that maybe the US should have caught. And three years later, we've got the change health care hack. Who is dropping the ball? What is going wrong that a company this significant to a sector that is worth 20% of the US economy is being felled by ransomware in a way that now lives are being affected? That's why it's always so nice to come here to San Francisco. If you get direct questions, which are really the right questions to be asking. So let's take a step back for a moment and talk about what we're seeing. So first, software has made its way over the last decade into the critical services. We all rely on the water systems, the power systems, the pipelines for a number of reasons. First, it made for more efficient operations by companies, could control remote infrastructure with more confidence. It was easier to build. We got more precision on that. And as we've put more and more Internet of Things devices, think about smart meters to help us, for example, consume energy in a more efficient way to help manage load on the grid. Software is all over our infrastructure in a way that wasn't there before. I've had the opportunity to work both cyber offense and defense, and it's a lot easier and a lot more fun to be on offense, right? Offense has to find one open door window, one vulnerable system. Defense has got to guard every door window. I'm just looking around here. You know, if there was a Secret Service agent, there are so many opportunities. Right. So fundamentally, cyber defenders are already in a tough spot. And then finally, from a geopolitical perspective, post, Russia's invasion of Ukraine is an increasingly permissive environment in Russia, both for financially driven attackers like ransomware. Our intelligence community assesses 70 to 80% of them are based physically in Russia, as well as for political hacktivists. And we've seen some of those attacks recently. So those three kind of set the stage for what is a tough problem. And I would add the final piece, which is critical. Infrastructure is owned and operated by private companies, and as such, those factors all play in. So what's been the approach to your point over the last three years? First, and why has change happened? Yes, huge. And that's what I want to talk about. What's been the approach and then why does it change happen despite that, which is the really the right question to be asking? And the first piece is the first part of the approach has been really working to lock our digital doors for the last ten years. There were no cybersecurity minimum mandates for those critical systems. So if you walk into any large building, there's probably a guard, there's probably a security system. The digital systems of pipelines, hospitals, water systems had no safety or cyber had no cybersecurity cyber safety requirements. Largely as a result of a number of things, primarily because legislation on the Hill regarding cybersecurity always had this tension between innovation and security, and generally the sense that by regulating cybersecurity you would affect innovation has precluded that. Following Colonial Pipeline, the president said, We've got to be able to give Americans the confidence that their critical services can be safe. So we started essentially it's called interpreting, interpreting safety requirements to see each of these regulators have the authority to put in place minimum cybersecurity requirements. Frankly, the kinds of things we've been talking about for a decade, encrypting data. So you were looking for authorities because Congress wouldn't pass the legislation. We were finding ways to say, is there any way to do it within current law? And we found and cobbled together an approach sector by sector, in some cases emergency authorities. That's how we did it for pipelines, in some cases safety authorities. That's how we did it for real, because clearly, if TSA, for example, can say the physical rails have to be secure. The signal is most definitely have an impact on safety, but that had never been done before. So over the last three years since Colonial, we've been working sector by sector with each regulator first educating, coaching, getting, then the people. I mean, it's as you can imagine, right, top cyber thinkers don't necessarily think of going to TSA, so necessarily think of going to EPA. So helping bring those communities together, the water community in the cyber community, that water in particular didn't work. You you landed up in court. Your efforts have very clearly publicly failed. And the water sector is being hit now by Iran, by China and by Russia. And now you've even got water flowing, water tanks overflowing. It's a great example. So to the first line of the strategy, which was putting in place minimum mandates, it worked for pipelines, it worked for airports and airlines, and that we've been able to do it. It worked for me on. And shortly hopefully, we'll be issuing a similar approach for hospitals following change health care. But in the case of water systems, when we released a rule setting minimum standards for water systems, three attorney general sued and we had to rescind the rule. So that gives a picture just of the complexity in the space. I want to talk about the two other parts of how we've been working to counter ransomware, because they all go together and then and similarly talk about the complexity. The second piece is really a shift in strategy by our law enforcement community. The law enforcement communities approach used to be working with law enforcement partners around the world to try to bring people to justice. The reality is where many of the individuals are in a country where we don't have an effective law enforcement relationship, that had to change. So the FBI, the Department of Justice, and frankly, law enforcement partners around the world have work to change and to start disrupting takedowns. But takedowns you saw of lock their high, both the takedowns of infrastructure, trying to get the encrypted tools and build descriptors to make sure victims could decrypt. So that's been the second part of the strategy. And then the third has really been to build an international partnership because everybody's hospitals, schools and companies are affected. So as you know, this morning I came from a meeting of the International Counter Ransomware Initiative. The White House stood up this partnership invite and 30 countries joined us when we started two years ago. It's now grown to 61 countries large, small from every continent. And today we launched a platform where countries can share indicators of compromise, can actually collaborate to say, Here's what we're seeing in a hospital. Is anybody else seen this? And the goal in all of this is to make it riskier, costlier and harder for attackers, because if one country has seen a particular malware strain, I can say we've seen that. Here's the way you defend, here's the things you need to do. Here's the individuals who are likely responsible. The community of countries fighting this given defense is so much harder than offense we hope can start to get the upper hand. But that's been the approach, that three part approach. I know that there's a lot of store set by this prospect of more disruptions, more takedowns. Blackout was one of the groups that was taken down, seized in the end of 2023. That's the same group that did change health care. And in the interim, all that blackout said was now you can go after hospitals in the nuclear sector, that free range, and now you've got change health care. So these policies are creating new problems and you are now dealing with one in three Americans having lost maybe their personal health data and I think with serious impacts also on patient care. You're right. You know, I have a chart in my office that shows the disruptions over the last two or three years. And not just Americans, Americans, obviously, with partners. The Germans, the Netherlands are all strong partners on this work and how they last for a limited period of time, because you can take down the website, you can take down the infrastructure, you can try to recoup the money. At the end of the day, this is every time a us any time anybody pays a ransom, it feeds the beast. And as you know, US companies, US entities paid $1.3 billion in ransom in 2023 alone. So is it any wonder that the problem continues and that those disruptions, while impactful, are impactful for a very short time? So they have to happen much more frequently. They have to be much broader, and we really have to think about how we focus on the money and turning off the money over time. And there's a lot of different approaches we've been thinking about. But that's a big part of having these attackers move on, we hope, from what's today a very profitable business. So UnitedHealth paid the ransom. They paid $22 million and they still don't know if the data is safe or not. Should they have paid? I would say two things. The first question is should that data have been unencrypted on that network in 2024? What do you all think? Should we have rules requiring that data to be encrypted? Because frankly, as you all know, even if the data is stolen and it's encrypted as to 56, most common encryption algorithm cannot be broken even with today's most advanced commercial high-performance computers. Right. So that's where the defense comes in. That's where the call to action for companies. And yes, as a government, we will be moving to start requiring that. But often when I talk to hospitals because post change, I've gone and I've talked to the American Hospital Association many times, we've done virtual calls with health care companies. And our first question is what prevents you from encrypting data today? What prevents you from using NSA passwords? Or did we all know passwords are dead where you can remember their password? Right. That's the reason that passwords are so that call to action to say what does the HRA say to you? Because they are opposing a rule that would mandate minimum cybersecurity requirements. They were opposing it in December last year. They're opposing it in April this year after the hack after patient care has been delayed. These are the people who are responsible for patients. What do they say to you? And you mentioned you're going to take a similar approach. Can you mandate a rule against their interest even if Congress won't do it? So first we find with every conversation, that conversation comes closer together. So when we say look at the cost of a change, health care and the time to recovery. In our medical system, there were 20% fewer billings during the weeks of change. Health care. That means 20% fewer procedures. Right? That could have been a postponed temporary procedure, but that point is a significant one. And much of that is preventable. That's not to say that every hack is preventable, but they can't be this easy. And we see malware strains reused again and again. So I think the conversation we have with them is it's costing a fortune in mitigation and recovery. And a core part of patient safety is confidence that the system works. And that's and as particularly the health care system as more and more tech is being used, frankly, there's more and more promise with tech being used that tech has got to be secure. So patients and patients deserve that. And that's the argument we've been making, and that's the argument towards we look to putting in place minimum cybersecurity requirements for hospitals in the next. In the near-term, near-term, you're going to do something. Yes. One of the things I've learned in government is never say the timeline because it always takes longer than yourself. So you'll put in a rule that does mandate minimum cybersecurity standards for hospitals. So we've been working closely with the relevant agencies and frankly, with the sector to say, work with us on this. This is not one against the other. This is us working together to keep Americans safe. But you will encounter a lot of resistance doing that. I think it's on all of us to talk, and we've been doing rounds of that conversation. But I think one of the reasons, if you ask why is it delayed? There has been resistance. Companies push back strongly. And quite frankly, the threat is here. The healthcare sector is, if not the most vulnerable, one of the two most vulnerable. They're here. And we tried for a while just to get them here. And we'll note as well, because we're here, they're at the center of American innovation. At the same time, we'll be rolling that out. We will be rolling out a free program of cybersecurity and training for the nation's 1400 rural hospitals. Those are small hospitals in parts of America where if a hospital is locked in a ransomware attack, the next hospital's hours away and a shout out again. Now, we reached out to a number of technology companies and said, Can you help us? Right. Can you? You all have nonprofit programs. In our own country, there are hospitals that need the skill building, that need the more secure systems. And they've stepped up. And we'll be rolling that out together in the next few weeks. So a thank you to the tech community that really is the source of innovation, but just as a source of good. Thank you so much for coming here to discuss something in detail. I think it makes a tremendous difference to hear from you. One last question, which is that the SEC has effectively become a tool of the administration's policy in ways that is causing huge resistance and kickback. Do you. The approach? Is it going to deliver the kind of cybersecurity outcomes that you want to see? You know, there was a very famous court case a number of years ago with a line that said sunlight is the best disinfectant. And what we've seen again and again is major cyber incidents that weren't made public. So the customers didn't know. And think about a tech company which had a major cyber incident. We're not sure if they're code base was compromised. Shouldn't all their customers know about that so they can consider what risk they are at? So the transparency that the SEC's new requirements put in place, which is that companies must disclose material incidents in a specific time frame. First, we hope it makes cybersecurity a CEO level issue. We hope that CEOs start to ask their systems who need their support. Being acesso is a tough job, who ask, you know, where are key vulnerabilities? Can I see a recent pen test? And what do you need from me for us to address this? So goal number one was transparency for investors customers. Goal number two, as much was getting the CEO to say, what does this company need to do to be safer in this really heightened threat environment? I'm we're at time, but I can't have you here in front of this audience and not ask you about Microsoft. So I'm going to tell us about the point of conversations that you've been having with Brad Smith. Are they doing enough? Do you buy the new memo about security? So here's what I'll say. Our economy and our national security relies on our digital infrastructure, right? The cloud is where we keep our corporate IP secrets. It's where we keep the nation's secrets. We have classified, unclassified clouds that have been a big part of improving government cyber security, moving off thousands of legacy systems. And folks, in that way, those companies have an obligation to be leading the way in cybersecurity. And I think we really appreciate the steps Microsoft is taking to become a leader in this space. And and that's because there's as we think about where we need to be as a country, trusting our digital infrastructure to be resistant to both criminals and adversarial countries is something every company and every government agency must be able to do. And we appreciate the big steps and the fact that the CEO of Microsoft has made that commitment has tied compensation to this, because when you tie compensation, you know it's a company's priority to help us get to a more secure and safe environment. Thank you very much. Thank you. Thank you.

No schedule data available.

BTV Channel FinderWatch BTV in your area

Top WH Adviser Neuberger Talks Security Threats

Anne Neuberger, Deputy Assistant to the President & Deputy National Security Advisor for Cyber and Emerging Technologies, The White House speaks with Bloomberg’s Katrina Manson about the Biden Administration’s cybersecurity strategies at Bloomberg Tech in San Francisco. (Source: Bloomberg)

More From Bloomberg Technology Summit
All episodes and clips