WE'RE IN!

Lt. Gen. Lori Reynolds on the evolution of cyber warfare

Episode Summary

Lieutenant General Lori Reynolds' (Ret., USMC) career journey from a Naval Academy graduate to a key figure in cybersecurity and information warfare illustrates the progression of military communications and cyber operations. Initially commissioned as a Marine Corps communications officer in 1986, Lori’s career took her from managing traditional radio communications to leading the Marine Corps Cyberspace Command.

Episode Notes

Lieutenant General Lori Reynolds' (Ret., USMC) career journey from a Naval Academy graduate to a key figure in cybersecurity and information warfare illustrates the progression of military communications and cyber operations. Initially commissioned as a Marine Corps communications officer in 1986, Lori’s career took her from managing traditional radio communications to leading the Marine Corps Cyberspace Command. 

Tune in to hear how she played an important part in integrating cyber operations into the Marine Corps' combined arms approach and later spearheaded efforts to create a comprehensive information warfighting function.

Listen to learn more about: 

How China's cyber operations have become more sophisticated, quiet and focused on long-term strategic positioning

Why the threat now extends beyond cyberattacks to include technological exports and influence operations 

How Russia and other state actors are also engaged in hybrid warfare, operating below the threshold of conventional conflict

Episode Transcription

 

[00:00:04] Lori: Thank you for the invitation.

[00:00:07] Blake: course, of course, I'd be curious to kick things off. If you could walk us through what led you into the security and cyber security industry. Your educational background, I notice, is in poli sci and national security policy.

[00:00:19] So, curious how you went from there to InfoSec.

[00:00:22] Lori: Yeah, it's a great question. Well, I, I graduated from the Naval Academy, and I learned at the Naval Academy that, that my strength was in the history and English parts of academia. I learned that really fast. I was commissioned as a second lieutenant in the Marine Corps. And, you know, Blake, in, in 1986, when I graduated, there weren't a ton of things that women could do in the Marine Corps. And I knew only that I wanted to be a platoon commander, and I wanted to maybe someday be a company commander, and One of the jobs that, enabled that for me was the communications MOS.

[00:01:01] And in the Marine Corps, communications at the time was push to talk radio, maybe multi channel radio. Today it is obviously and clearly much different. So I grew up in the Marine Corps as a communications officer.

[00:01:16] Blake: Very different kind of communications than my communications with Synack, is a little more critical on the communication side for you.

[00:01:22] Lori: yeah, it's really important to make that distinction.

[00:01:25] So sometimes you say communications and people think about, you know, strategic communications or public affairs or, it wasn't that. It was install, operate, and maintain, a network so that your commander at whatever rank can communicate with his or her own forces or those, up the chain of command. So that's what I did for the first, probably 25 years of my career.

[00:01:48] Blake: So fast forward, I do have some questions about your assuming command of Marine Corps Cyberspace Command. Let's start with the basics there. For those unfamiliar with the mission of Cyberspace Command, how did your work help to enable the warfighter?

[00:02:02] Lori: you know, U. S. Cyber Command, when I took command as a component commander, meaning the Marine Forces component commander, it was 2015. And I served there until 2018. But this was relatively early, like in the days of the cyber force, until U. S. Cyber Command was created as a component then of U. S. Strategic Command, we really didn't have a force that was dedicated to operating and defending creating cyber forces. Now, It's kind of important probably to say that, when we're talking about cyber and what U. S. Cyber Command does, it's about maneuvering in the information environment, it is about either operating or defending, attacking or defending, while what a communications officer does is build the network.

[00:02:53] Your job is to build and defend. And I offer that only because, a lot of people think that cyber is communications, and communications is cyber, and while I think they're really close cousins, communications officers don't have the ability to attack. Cyber officers do.

[00:03:11] Right? So how does a cyber operator enable the warfighter? Obviously, using intelligence to defend the network, to maintain a secure network. Again, all part of what a COMO or communications teams do, but I think they do that in partnership. But I think also increasingly we have more and better capabilities to actually add cyberspace, the ability to maneuver in cyberspace as part of a combined arms construct. So the Marine Corps is really big on this idea of combined arms. So how do you integrate ground operations with aviation operations? Where does the logistics piece come in? Where does naval gunfire come in? And increasingly, how do you use space and cyber as part of that combined arms kind of planning and execution to achieve whatever your mission may be?

[00:04:11] And what I think I would offer there is, you know, from the time that, that I was a commander, trying to figure this out really for the first time, very early in the delivery, no kidding, of cyber operations. 

[00:04:24] Blake: to figure out cyber operations years, years later.

[00:04:27] Lori: Yeah, no, absolutely. And that's, it's really good.

[00:04:29] Like, it's, it is hard. It is a journey. Are we doing more very interesting things in cyberspace right now? Yeah, I think we are. Do we have it to a point where we can synchronize it in time and space? Maybe, but that's hard. But it's definitely an asset to the warfighter, right? The ability to at least temporarily have overmatch in the cyber domain is really important.

[00:04:55] Blake: Absolutely. No, and I appreciate the kind of two tiered distinctions you made there already. One between the strategic comms that I was talking about and the more tactical comms out in the field. And then in addition to that, the difference between comms and the fact that you have a cyberspace command capable of going on offense as well when the situation calls for it.

[00:05:14] Sounds like it was a bit of a shift for your military career as well. What was that like? Starting something new and going in a little bit of a different direction.

[00:05:22] Lori: That too is a really good question because I think, for the last six years of my career, so I spent 2015 to 2018, and very clearly, the Commandant at the time when he sent me up to Marine Forces Cyber in 2015, and he sent me up to MAR4 Cyber, and he said, Lori, Go figure out what the Marine Corps is doing in cyberspace.

[00:05:43] Right? Because there were a lot of people back then saying that's not what Marines do. Right? Marines don't do cyber. We're like a close with and destroy, we're like at the pointy end of the bayonet kind of team. So my job was to figure out, number one, you know, are we organized properly? What is this cyber thing?

[00:06:00] How can we properly integrate it into the rest of the Marine Corps? But then really, what is our role? What is the Marine Corps role in cyberspace? And Blake, there are a lot of people right now, there are a lot of studies that are happening that say that maybe we should have a cyber force like we have a space force.

[00:06:20] Maybe we shouldn't leave it up to the services to figure it out. Maybe we should just create a cyber force and let them go. So, I would argue, that every service brings their own culture and their own experience and their own history to the cyber fight that is relevant and necessary. In the Marine Corps, we bring a bias for action. It's kind of an attack and a constant readiness mindset. That's it. And I think it has been helpful to you as Cyber Command to help, bring a warfighting culture to cyberspace. So I would be in the camp that says, let the services do what the services have to do.

[00:07:00] I think it's very difficult. Cyber is in everything, as you well knoW. There are cyber threats in every piece of kit that we have. There's the information, environment that we have to fight through. So I would argue that every service needs its experts in this domain.

[00:07:15] From 2015 to 2018, you know, my job was to figure this cyberspace thing out, figure if, can we get on target here? Can we figure out how to do warfighting in this domain? Taking what I learned there in those three years, I put on my third star. And I had another smart commandant, General Bob Neller, who said we need to figure this information fight out. As a three star in the Pentagon in my last three years, my job was to create the information warfighting function, which is, how do you best bring together cyber, space, influence, intelligence, communications, And strategic narratives, Blake, the com, your com,

[00:08:00] Blake: Little bit of strategic narratives in there. Appreciate the shout out.

[00:08:02] Lori: Right? Yeah, it's not unimportant today, especially.

[00:08:06] How do you bring all of those things together in a comprehensive way and then compete more effectively in the information environment? And so,

[00:08:16] Blake: Task. Yeah, no

[00:08:17] Lori: Yeah, so like, yeah, but, but really for the last six years, my job was to kind of bring this different kind of way to think and compete to the Marine Corps.

[00:08:27] Not easy, because the Marine Corps, as I have said, are, we are the first to fight. their first term. They're between the ages of 19 and 23 years old. Their job is to be ready, ready, ready. Right? Their job is to be forward deployed, to give our nation's decision makers, decision space by being on the ground today.

[00:08:51] Right? That's our job. This whole information fight is kind of a different animal. How do you begin to bring these different thoughts into that culture? 

[00:09:01] Blake: I think as a civilian layperson here listening to some of your points. It makes a lot of sense, right? You have different skill sets sitting with different branches of the armed forces. And it's not like you give the US Air Force exclusive domain over the air domain, right? Like you have other services touching that.

[00:09:17] Similar to cyber, everybody's got to operate to some degree in cyberspace. It's just the world we live in now. And that comment segues well into my next question, which is how did you coordinate with the other branches of the armed services and with U. S. Cyber Command writ large to avoid duplication of effort or just to be as effective as possible.

[00:09:38] Lori: So the way that they organize the force in U. S. cybercrime is number one, each service is responsible for defending its own terrain, right? So you start there, but in the defense DoD information network, the DoDen. So think about the Marine Corps Network, the Army Network, all of those networks as a DODIN, D O D I N F O R M A T I O N E T W O R K.

[00:10:01] We all contribute, and there is a common three star commander who also works for the four star U. S. Cyber Command. So in defense of the DODIN, we all provide our own forces and we defend our own networks. So that's job one as a Cyber Service Component Commander. Job two is to provide cyber forces to the other geographic combatant commanders that are separate, that are all around the world, right?

[00:10:29] So think the commander of Indo Pacific Command out in Hawaii, commander European Command, Southern Command, Northern Command. So the whole globe is broken out geographically. And then you have functional commanders, like Space Command, like STRATCOM, like Transportation Command, Like Special Operations Command, who's also a global. So each of the service cyber components are assigned to multiple geographic combatant commands. My job at Marine Forces Cyber was to provide direct support to Special Operations Command. So I created cyber protection teams to defend SOCOM's network. And we created offensive teams at the time to provide support to Special Operations Command's missions.

[00:11:20] Now it has changed over the years, I'm giving you kind of the way it was. It continues to evolve, I think, because cyber continues to evolve. But that's how it's worked. You're provided you're given tasking by U. S. Cyber Command. And you have these direct support relationships to the other, combatant commanders that are out there.

[00:11:39] And then you are inside their staff, you're providing, support to their missions, you're defending their networks. That's how it works.

[00:11:47] Blake: That's helpful. And, stepping back to your own career for a second, I read that you're the third woman to have achieved the rank of Lieutenant General three star in the Marine Corps. What was it like to climb the ranks?

[00:11:59] Lori: well, it was fun. I mean, I certainly wouldn't have stayed 35 years if I didn't. If I didn't enjoy working with Marines, and really, Blake, I'll just say that that's what keeps you in. You just can't imagine working with a more focused or mission driven or just extraordinary group of Americans.

[00:12:20] I loved being a Marine and I loved working with Marines. I feel like I got really lucky. you know, I mentioned that I was in an MOS, a military occupational specialty, that enabled me to command. And in the Marine Corps, if you want to be successful, you have to command.

[00:12:36] You have to stand in front of a formation, and you have to be in charge, and you have to do well. It was good. It was a good run. All right. I, as a lieutenant colonel in command, I took command in Kuwait and then deployed twice into Iraq, into the Fallujah area. And then as a colonel, it just so happened that the command that I took over was going into Afghanistan.

[00:12:59] And so in that capacity, as a CO of what was Camp Leatherneck, which was the furthest western, US camp that adjoined. British camp, so I worked for about a year with British counterparts and, I had for the first time as a woman having an area of responsibility, I had what we call an AO assigned to me, not because I was a woman, because I was, I was the CEO of the camp, but that happened to be a first.

[00:13:30] And then I was selected for general officer right after that. And then just, because the cyber thing was coming up and because the timing worked for me, I was able to stick around a little while. just promoted our fourth three star in the Marine Corps. And while, the Marine Corps is a very small organization, we should be further along than that.

[00:13:53] Blake: Hmm.

[00:13:53] Lori: I'm proud of what I did, but I wish we were further along, quite frankly. We lose a lot of good women. I think It's hard to have a career, to do well, to command, to have a family, so it's very, very difficult and people make tough choices.

[00:14:07] Blake: If a young woman came up to you , and was saying, Hey, I read, read up about the Marines, super excited about the mission set. Seems like a really interesting, crew of people. What would you say? What would you say to somebody who might be considering? Well,

[00:14:25] Lori: With a ton of enthusiasm. I loved it. I really did. I, and listen, when I came into the Marine Corps after graduating from the Naval Academy, there was a few MOSs. There were a few specialties then that were where women could do what I was able to do, like there is nothing they can't do right now.

[00:14:45] Everything is open. Women couldn't fly in the Marine Corps. We have three astronauts right now. They wouldn't allow us to go aboard ship. And back in the late 1980s, the way you made your mark was you go on, you go aboard ship with the Navy. That's what we do. We're forward deployed. And by policy, women weren't allowed to do that. Combat exclusion is no more. You can go do what you gotta do. And I think that's appropriate and right. It's just a righteous mission. Go defend this nation. I would be very encouraging.

[00:15:20] Blake: and I think the kind of alluded to basically a lot of progress that's been made on that front. And I think kudos to you for helping trailblaze that pathway. I mean, really there, that doesn't just happen automatically, right? We don't just advance as a nation or as a armed services brand.

[00:15:35] So, so I think, for listeners, I'm sure they appreciate the contributions that you've made on that front. Do you think that the cyber industry? Needs to invite more diversity, whether it be of gender background, thought, professional, military experience. And if so, how?

[00:15:54] Lori: I think diversity is really important and it's not, you know, I think about diversity from a mission perspective. I want the input of as many different types of people as I can possibly get. The fascinating thing about cyber to me, and the thing that I used to talk about in recall the time was It does not respect lines on a map.

[00:16:13] It does not respect borders. It does not respect any of that. So you fundamentally have to rethink how you organize your brain to get after cyber, operations. And to think about opportunities that might be available for cyber operations. And in that case, I want one of everything.

[00:16:33] Think about a toolbox. Think about having every tool available to you for whatever your problem might be. That's the name of the game with cyber. It's across whatever kind of diversity you might think. Being a cyber commander, listen, I have to tell you, I didn't, I understood communications.

[00:16:52] I did not understand cyber. There's so much signals intelligence that goes into it. There's so much all source analysis. There's so much, legal that goes into, there's so many pieces that, that contribute to a really healthy cyber environment. And I had to learn that while I was in command and what it really helped me to understand is I needed to know as a commander in cyber, who was blocking my access to the good ideas that were out there, right?

[00:17:24] So when you think about the hierarchical organization where colonels are keeping their Lance corporals or the lieutenants from making it into the boss's office, I needed to break those barriers down because I needed the good ideas, right? So the good ideas are coming from the youngsters and they're coming, right?

[00:17:40] So Yeah, that's a long answer to a short question,

[00:17:43] Blake: No, no, it's a good answer. Yeah.

[00:17:45] Lori: You need access to every perspective and every experience that might be out there.

[00:17:51] Blake: Well, and it's funny you say you knew relatively little about cyber. I feel like even just by acknowledging that you probably just made yourself a better commander. I'm always skeptical of somebody who comes in, you know, it hasn't been around that long as a domain, really, like really, especially cybersecurity.

[00:18:04] And so anybody who claims to know it all is, I just, I just have my doubts. 

[00:18:09] Lori: it goes to like, you never learn while you're talking. You learn when you're listening, right? And so if you're doing all the talking, you're not getting smarter. Humility really is the name of the game.

[00:18:20] Blake: We've spoken a little bit about some U. S. operations and our setup and how we're kind of preparing in the cyber domain. Let's talk about our adversaries and some of our competition here, so to speak. I've read a little bit about some of China's influence in hacking operations in the U. S. How has that threat evolved in recent years?

[00:18:39] Lori: It's really fascinating to see the path that China has been on. I think in the early, you know, 2020, maybe in the late 18, 19, they used to be very loud on the network. They were very loud, very clumsy. Kind of brute force kind of approach, but it was all about stealing intellectual property, right? It was about competing with us as a nation, whether it's in the defense industry, or whether it's just snatching data because a new AI was coming, or snatching our data because they're in a quantum race, right?

[00:19:13] But it was, it was, they didn't really care if you knew they were coming, they just grabbed it. And today I would say, That China is, a little bit more sophisticated than that, and I think, and we, I think we know, given, you know, what's been published, publicized about Volt Typhoon, that their approach is different.

[00:19:34] I wonder, uh, Blake, if enough people really have wrapped their brain around what Volt Typhoon really means in terms of, much more quiet Embed yourself in the critical infrastructure of your nation's adversaries and sit and wait, right? Collect still as much as you can, but you're awake.

[00:19:56] So that is a much more sophisticated deterrent than other forms of deterrence, right? And it speaks to the vulnerability that we have as a democracy. where we still need the American people to have the will to fight back. But if you take down the banking industry, or if you take down the water industry, or if you take down the electrical grid, will we have the focus and the attention and the will to be able to stop China from doing what they want to do?

[00:20:32] So, It's just a much more sophisticated approach. That's on the cyber side. I think, think about Huawei technologies and TikTok and the threats that those companies, state owned enterprises, in partnership with the CCP, where they are either helping to export or they're helping to export.

[00:20:52] Autocracy? Think about smart cities and things where it's all about control of populations and oh, by the way, all that data goes back to China anyway. These are much more sophisticated approaches and I think you just have to understand them and realize what this strategy really is so that you can effectively counter it.

[00:21:11] And then finally, I would just say on the influence side. I think that there was a Microsoft report out today, Microsoft has a threat analysis center that's doing wonderful, wonderful work, Clint Watts and his team, they're involved in kind of down ballot races, with influence operations for, politicians who may be either pro Israel or anti China. So are they out there? They absolutely are. But anything that they can do, I think, to undermine our trust in our judicial system, or our election system, or democracy writ large, they're going to do it.

[00:21:50] Blake: I know that recent, analysis from the Microsoft Threat Analysis Center that you alluded to, , also cited, in anticipation of Election Day, some influence efforts by Russia and Iran as well. Let's talk about the threat posed by Russia. We've seen them obviously carry out this quote unquote hybrid war.

[00:22:07] That Moscow brought to Ukraine. Obviously the physical component of that rightfully takes precedence. I mean, you're not going to have cyber operations that eclipse missiles bearing down on your cities and horrible ground invasions. I mean, that's just a totally different animal, but that said, from a US perspective, what should we be looking at from that and what should we be preparing for given that we're probably likelier to see Russia in the near term, at least hopefully, knock on wood, in the cyber domain.

[00:22:33] Lori: well I think we're learning a great deal, obviously. I think, Russia has a lot of game. State sponsored malicious cyber actors who are doing many things, who are very aggressive, very active, and again, without the state, owning the problem, but, but certainly, you know, you think the rise of ransomware and all those other things that are going on that, that kind of keep our attention focused here, But I think on the Ukraine side, again, Ukraine is a struggling democracy but they're a democracy, right?

[00:23:07] And so the information fight is real there. I think we're also watching a lot of electronic warfare and, we're learning a lot about, how Russia might approach a larger war. But I think you have to take a step back even from that. I personally do not believe that China or Russia want to go into a conventional war with the United States.

[00:23:30] Blake: Phew.

[00:23:31] Lori: Yes, but we are optimized as a military force. We are optimized as a nation to know when we're at war, when we're not at war. We know when we, like, when, you know, when we're at war, you know, it's, we're gonna go try to win that thing. I think we need to really understand that for Russia and this idea of hybrid war, it's fighting below the level of what they would call a conventional war.

[00:23:58] We used to say below armed conflict, but my goodness, what's happening in the South China Sea with the Philippines, it's a conflict and it's armed, but it's not war, right? I mean, so we have to understand, I think that that war in the future is going to look very different. We may never declare war because they'll keep it just below the threshold where any president has to declare it.

[00:24:26] So we have to, I think we have to wrap our brains around that. These hybrid wars where, you know, it's just this low, low level, maybe escalating every once in a while where they take a shot and then we come back down. That's kind of the step, that's the way it's going to be. And it'll be in cyber, and it'll be in space, and it'll be in the spectrum.

[00:24:46] It'll be all these areas that I think increasingly are warfighting domains. Right? Cyber is a warfighting domain. Space is a warfighting domain. I think we fundamentally just kind of have to take a step back to recognize that this isn't World War II. It is a fundamentally different construct for how great powers are competing and sometimes finding themselves in conflict.

[00:25:10] And what does that mean? What does that conflict piece look like?

[00:25:15] Blake: Side note, I'm glad you gave a shout out to Spectrum. I feel like on this podcast, we haven't talked enough about Spectrum and preserving access to that in general. Maybe that's the comms, the comms background and you coming out a little bit because that's something that, that is, is really fascinating to me as far as like crowding that out, disrupting ability to, to communicate.

[00:25:36] Anyway, I'm sure we could go down a whole, whole tangent there,

[00:25:39] Lori: hey, you know, like spectrum is a finite resource and we are a hyper connected society. And so it is just getting harder and harder and harder. And, and in particular, it's very difficult. Especially with these hybrid wars, because, we're used to, as the, the biggest guy on the block, to going into another nation and owning the spectrum.

[00:26:02] That is not how it's going to be. We're going to have to kind of figure this out, and there's, there's lots of pieces to the whole spectrum, competition, I think, that have to do, by the way, with the. With the commercial race that we, the commercial competition that we find ourselves in as well.

[00:26:20] China is, you know, probably ahead of us with a 5G fight because they own more spectrum and they can do more with the spectrum, than our commercial companies have been able to do. And we'll figure that out eventually, but it'll, it'll cost us some money, it is all part of the competition.

[00:26:36] Blake: absolutely. And just to muddy the waters even more, we have AI thrown into the mix. A question that I like to ask, do you think that AI will, on balance, help cyber defenders or attackers more in the next, say, 12 months?

[00:26:53] Lori: I'd have to say that at least in the next 12 months, it's going to most help the defenders. And I think this is really about, you know, how we more effectively use data to find the anomalies. You know, I happen to sit on a bank board right now where we're really looking at, Anti fraud, anti money laundering, those kinds of things where AI can be a great value. 

[00:27:19] So really, I think in the near term, it's all about how do we optimize it for defense, but I do, it scares me a lot, what smart attackers can do. Because as you know, Blake, the cyber fight is a fight about, it's all about speed. you know, It's not the big that eat the small, it's the fast that eat the slow.

[00:27:39] you know, If you can smartly use AI to kind of weaponize vulnerabilities, if you have an access, then it's, so it's going to be, it's going to get sporty. To answer your question, I think in the near term, the nod goes to the defense.

[00:27:55] Blake: Now, you casually mentioned there that you sit on a bank board. I would be curious to hear some of what you've been up to since retiring from the Marine Corps as Lieutenant General. And I do have a follow up question about boards, but I wanted to let you bring us up to speed on what you've been up to lately.

[00:28:09] Lori: Yeah, thank you. I I sit on a couple boards. I sit on a bank board. Learning so much has opened my eyes wide open. It's a phenomenal board. And I also sit on a board at the American Public University System. So, an education, online education, that has principally served service members. And I'm a little passionate about that one, because I really believe that education is going to be what allows us to win in this competition.

[00:28:35] It's all about making service members smarter and more technology enabled, and so education is really important to me. It's interesting, Blake, I sit on the Risk Committee in the Cyber and Technology Committee of a fairly large bank, and I've learned so much, but it's, you know, where my two worlds come together here is that, if an adversary can bring down our financial system through cyber, through an information campaign, by the way, I think increasingly we have to pay attention to these narratives, because deposits can leave a bank very, very quickly just based on bad information.

[00:29:15] And, and this narrative, competition that we find ourselves in is one that we've really got to get a handle on, look at what happened during Helene and the disinformation around FEMA. FEMA's not a political organization. They're there to help people, right? I mean, so if you really kind of take a step back and go, what in the world?

[00:29:37] That is a wake up call for anybody. And how do you guard yourself against those kinds of campaigns in the

[00:29:44] Blake: That's a tough one. That's a really tough one too, because there's no, there's no silver bullet for that kind of thing. It's, I'm glad you mentioned education. I think that's a huge component, just making sure that we arm ourselves with the best, maybe not literally arm ourselves, but figuratively arm ourselves with that educational component to be able to suss out what's real and what's fake and, really interesting discussion.

[00:30:04] Really appreciate your time here today, Lieutenant General. And, finally, I do have a question that we ask of all of our guests, which is, what's something we wouldn't know about you just by looking at your LinkedIn profile?

[00:30:15] Lori: Probably that I'm, you know, I'm the youngest of five girls, and I'm still the youngest of five girls, right? Still the baby in the family, and I know my place in my family. I'll leave it at that. That's not controversial at all, but um, yeah,

[00:30:31] Blake: So

[00:30:32] Lori: yeah, you can be a Lieutenant General and still be the baby in the family, Blake, so it's all good.

[00:30:36] Blake: that's great. That's great. Well, thanks again, Lori for joining me. Really appreciate it. And a great discussion.

[00:30:42] Lori: All right. Thank you. Appreciate you having me.