The Former Head of NSA on the Future of U.S. Cybersecurity

Since retiring, General Nakasone is continuing his mission as the founding director of Vanderbilt University's Institute of National Security. He also serves as a board member and advisor to some of the world's leading technology companies. General Nakasone is also being recognized with this year’s Impact in Cyber Award, being presented at The Cipher Brief Honors Dinner in Washington in March.

I spoke with General Nakasone on Friday for the State Secrets Podcast. Below are highlights from the conversation, lightly edited for length and clarity. You can also listen to the full interview of the State Secrets podcast available wherever you listen to podcasts.

THE INTERVIEW

Kelly: You've argued that persistent engagement really changed the cyber battlefield. Looking back, where do you think it succeeded beyond expectations and where did it fall short against adversaries like China and Russia?

Gen. Nakasone: I think when we think about cyber, remember, this is a very dynamic environment. When I took over as both the commander and director in 2018, we were coming out of the 2016 elections. And one of the guidance points from President Trump and the secretary of defense was that we can't let this happen again. We cannot have a foreign nation attempt to influence our elections.

We looked at what we had done and what had occurred and we came to the realization that this is not an episodic event where we can just come and do our business and then leave. We must be engaged every single day. And so this idea of persistently engaging with our adversaries was born. It worked quite well in terms of the security of the 2018, 2020, 2022 and 2024 elections. It's worked against a series of different adversaries, Iran, Russia and China. But I think the point is that the environment is dynamic. To your point, as we look at greater scale and scope of adversaries like the Chinese, persistent engagement must also change. We need new partners, new techniques and new technologies. Those are things that we must be able to look at and be able to practice every single day.

Kelly: Midterm elections are coming up later this year. There is certain to be a lot of politics and political messaging around those elections. What are you focused on strictly from a cybersecurity awareness perspective when it comes to securing the midterms?

Gen. Nakasone: As a private citizen, I'm very, very interested in what foreign adversaries might try to do to influence our election. That's what the National Security Agency and U.S. Cyber Commander focused outside of the United States. I want to make sure that there is no nation that can influence what goes on in our electoral processes. That was what I was doing as a military member, and that's what I'm focused on now as a private citizen.

Kelly: Is there more that you can do from the private sector side in terms education? What are you trying to do at Vanderbilt?

Gen. Nakasone: We're really trying to do three things at the Institute of National Security. First, we’re building the next generation of national security leaders. Whether those leaders are in the private sector or the public sector - it's very, very important that we're able to do that.

The second thing we're trying to do is to provide pragmatism to theory. This is one of the things that Vanderbilt and our Institute takes great pride in by saying, ‘Hey, there's a lot of theory out there, but let's make a pragmatic approach to securing the critical infrastructure or looking at new ways in terms of being able to identify and solve hard problems.’

And the third thing we do is we educate. I mean, that's what great universities do. That's what Vanderbilt does. Whether we’re educating our students or whether we’re educating our faculty or whether we’re educating the broader public, that's what we're trying to do at the Institute of National Security.

Kelly: Cyber deterrence is an issue that comes up a lot. Is cyber deterrence something that exists today or are we still stuck in this model of continuous contact without any clear red lines?

Gen. Nakasone: I don't think cyber deterrence is the same thing as nuclear deterrence. Certainly, that's not an analogy I would use. But here's what I would use: we need to be very, very proactive in what we do to be able to secure the domain that we utilize for so many things every single day. And so again, this idea of persistent engagement, I would tell you that that's the right way we've got to approach it. But we need greater partnerships, we need greater technology with greater scope. And I think there are new ideas that need to come to fruition here. So, as the national cyber director gets ready to release his national strategy, I look forward to what he's going to say about how we involve academia or the private sector or private citizens in terms of what we can do to secure this domain that's so important to our nation.

Kelly: There's a whole lot of breath holding over when that national strategy will be released. What are some of the key components of the new strategy that you hope to see?

Nakasone: I'm hopeful to see a very, very strong focus on partnerships. What is it that the government does best? What is it that the private sector does best? What do we, as private citizens need to be able to do? I'm also looking for a component of, ‘How do we look at this and look at our threats differently?’ There's a broad range of threats that we face in cyber states, nation states, non-nation states, criminals. These are all different areas that need different approaches. I'm looking for a strategy that can take care of all of that. And any great strategy should motivate us, should make us think, ‘Wow, this is exactly the way we want to be able to do things and to conduct ourselves to solve these tough problems.’

Kelly: You talk a lot about partnerships. I'm proud to say that Sir Richard Moore, who just recently stepped down as the chief of MI6, is also a fellow honoree at this year's Cipher Brief Honors Awards for his impact through alliances, because alliances and partnerships are so critical. Can you talk a little bit more about how you see partnerships evolving in the future given how dramatically technology is changing the battlefield in cyber?

Gen. Nakasone: Before I talk about that, let me just take a step back and congratulate my fellow honorees, Gilman Louie and Sir Richard Moore and Janet Braun and David Ignatius. These are true giants of what has gone on. I think to be mentioned in this same category of honorees, is really very humbling. I congratulate each one of them. And I'm really looking forward to the HONORS dinner on the 13th of March.

With regards to partnerships, we just had the honor of hosting Sir Richard Moore at Vanderbilt University for a talk. And one of the things that we both agree on very strongly is that we're much better together than we are separately. What I'm always trying to emphasize in partnerships is that we can do things much better collectively than we can alone. As you take a look at what Richard Moore has done throughout his entire life, it's been a series of incredible partnerships that he's been able to foster. I feel the same way. This partnership needs to expand, it needs to be broader and it needs to be inclusive of more nations, more technologies, more industries that can help us be even more secure in the future.

Kelly: Let’s talk about China. What do think Beijing has learned from Russia's performance in Ukraine and do you think anything surprised them?

Gen. Nakasone: I think the first thing that they probably were surprised at is how much the United States intelligence community knew about what was going to take place on the 24th of February 2022. And the administration released that information publicly. I'm sure that shocked the Chinese.

The second thing I think they learned is that the Russians were not that good. And what has occurred over the past three plus years of seeing the loss of life and the loss of equipment, that must have really provided a pause to the Chinese as they think about the future.

The third thing that they've clearly demonstrated is that they've learned they cannot stop supporting Russia. They are the number one supporter of what Russia has been able to do in Ukraine - and continues to do. And even with that, they have not been able to overcome the Ukrainians. Those are the three lessons that I think the Chinese probably have thought about as they look back on the three plus years of this conflict.

Kelly: Do you think China is more likely to use cyber operations as a prelude to any kind of kinetic conflict with Taiwan?

Gen. Nakasone: One of the things that I think the department and certainly I have agreed with is that probably the first shots of any future conflicts are going to take place in cyber and space. And I would include space in that as well. Space is a competitive advantage for our nation, just as cyber is. But as any adversary looks to the future, I don't think they say, ‘Hey, let's go ahead and just wait for this conflict to take place. Let's make sure if we're going to take on the United States that we nullify their competitive advantages’ and the competitive advantages begin with space and cyber.

Kelly: Kevin Mandia, whom you’ve worked with over the course of your career, told how incredibly good Russia is in cyber. They once sort of dominated the cyber conversation. Do you think they're still a top tier cyber adversary? Or has the war in Ukraine exposed a lot of their structural weaknesses?

Gen. Nakasone: I would agree with Kevin that they are a top power in terms of their cyber capabilities, but they're not the best power. Of our adversaries, clearly, it's the Chinese. In the sense of their scale and their scope of what they're able to do, it's much different than what the Russians can do. But there's no one, none of our adversaries today can replace what the Russians are able to do in the information operations space. They are masters at it. And I think that's one of the ways I think about vigilance in the future. I think about how we protect ourselves from that.

Kelly: Let's talk about technology. You focus so much on this. AI is rapidly changing, intelligence collection and analysis also. What do you think is the most dangerous misconception that policymakers have about AI's role in national security right now?

Gen. Nakasone: If we're going to talk about AI, the first thing we need to do is return to the advent of ChatGPT in November of 2022. What have we seen in terms of change? And this is one of the things that I think is important for all of us to realize in what a little over three years, we have seen prompts go to text, to video, to recordings, to reasoning, to deep research. And now to agents. This is the landscape upon which we see AI operating today. I think one of the great misconceptions about artificial intelligence is believing we can just go ahead and put in a prompt and that’s all that’s going to occur. It's not that simple. It still requires a human component to what you're going to do. If you want to be a power in AI, you need four things. You need chips, you need data, you need energy. And the final thing is you need talent. And those are the four components that I think most people don't think about when they think about artificial intelligence.

Kelly: At what point do you think AI stops being an enabler and starts becoming a vulnerability, especially inside military and intelligence decision-making loops?

Nakasone: Artificial intelligence is just like cyber. It’s really just like any capability. It has both its strengths and weaknesses. If we focus on agents, they will able to do all of these things for us. But you're going to want to understand what they're doing, and then protect those agents from those that may try to make the agents do something they shouldn't be doing. One of the things that artificial intelligence shows us is that there are great capabilities here. But there are also incredible challenges with regard to being able to have visibility on them, have control over them, protect them, and then be able to truly understand what they've done.

Kelly: Should the U.S. be willing to accept less explainability in AI systems in exchange for speed and advantage?

Gen. Nakasone: Whenever we talk about a technology, there must be transparency of that technology. We must have a degree of security and feeling of safety that this technology is going to be utilized and that it comports with our norms and values - that it does things we want it to do. This is important. When I think about that, speed is an incredibly important capability of artificial intelligence. But I would also say security is the other ‘S’ that we can't ever forget.

Kelly: What does the next five or ten years look like to you?

Gen. Nakasone: One of the things we don't talk a lot about that I'm very excited about is being able to use artificial intelligence in an enterprise manner, being able to use these models to take a look at code and correct bad code, that is really the responsibility for the vast majority of weaknesses in our cybersecurity posture and is one of the things that we should be able to correct immediately.

The second thing is, wouldn't it be wonderful if we can continue to use artificial intelligence to discover new cures, new medicines for diseases that we have not been able to be able to address in our lifetimes? And the final thing I'm really excited about is using artificial intelligence for education - being able to look at a broad classroom of users – both the smartest and those that are struggling – and giving them the same ability to advance given the fact that this artificial intelligence is almost like a tutor to those students. That's a fairly heady thing that I think about when I think about the next five years.

Kelly: You also sit on several boards and serve as an advisor to a number of companies. I'm wondering from that position, do you see the cyber landscape any differently than you did when you were serving in government?

Gen. Nakasone: One of the things I’ve certainly realized, and I realized it to a degree as the director of NSA and as commander of U.S. Cyber Command, but that I realize even more fully now, is the power of ingenuity within our private sector. If you look at what is being done in places like Silicon Valley and Austin and Seattle and Boston and in Nashville and other places throughout the United States, it's truly amazing. And I say that as we look at our future, one of the things that I always emphasize to audiences is that our government should be focused on the things that we have competitive advantage in. And everything else - we should have our partners do. So, I'll bring that back to the National Security Agency.

No one breaks code or makes code better than the NSA. Everything else, we should have partners with. That's a little bit of my realization as I've made the journey from military officer to private citizen.

Kelly: Now that you’re in the private sector, how do you feel about the dual-hatted role over NSA and Cyber Command?

Gen. Nakasone: My thoughts on the dual hat really haven't changed since I was the commander and the director for six years. And that is within a domain of cyberspace where speed, agility and unity of effort really matter. Having one person that directs both organizations, one that has all of the authorities to do what we need to do to defend and to provide offensive capabilities in cyberspace, and one that has the intelligence components and capabilities that are second to none in the intelligence community, is important. Having one person direct that and say, this is what we need to focus on, is an advantage to the nation, particularly when we have a series of adversaries that at times have larger components than what we do. I think that this is really the secret sauce for what we do in cyberspace.

Kelly: What lessons have you learned from that model?

Gen. Nakasone: I want to share two lessons that I think are relevant for those that are in the private sector. The first is among the best pieces of advice I received early on in my tenure. It was from a retired four-star who said to me, ‘Paul, these two jobs are easy.’ And it was like, you know, day three of my tenure and I could barely find my desk. And he said something that I never forgot. He said, ‘What is it that only you can do that the organizations depend on you to do? And once you figure that out, you'll focus your time on those things.’ It took me a little while to really understand truly what it was that only I could do as both the head of NSA and of Cyber Command. But once I did, that's what I focused on. And that really allowed me to be able to shine a light on the areas that we had to and to get after and understand better the challenges to our nation.

The second piece of advice I received was also really important. And that was that you must be able to communicate. You must be able to talk to a number of different audiences; Congress or the White House or the Secretary of Defense or your own workforce. I really learned very early on that being able to communicate was one of the things that I had to do effectively. And being able to communicate not only with those in government, but also the public sector and for someone who spent his life in the intelligence community, talking in a room of people who were listening and asking questions was something that I had to become comfortable with.

Kelly: NSA is going through a shift since the former commander was dismissed last year and don’t have a confirmed leader yet.

Gen. Nakasone: I'm really excited that Josh Rudd now has been to his confirmation hearings. I would anticipate that he's been voted out of committees, that he'd be confirmed very, very soon. And having a confirmed leader of both organizations is really the true good news story here moving forward. We need to look forward, not in the rear-view mirror, and being able to think about what are the things that he's going to need to have from a broad area of partners to help him be successful. I think about anything that we can do to make his tenure even more successful.

Kelly: When you held those roles, there was really an evolution in the partnerships between the private sector and government. Do you see that evolving under the next director as well?

Gen. Nakasone: I think it must. If you're going to look at having capacity and capability in cyberspace, you must have a series of partnerships with the private sector. And that includes both the National Security Agency and U.S. Cyber Command. But I think the partnerships don't start there. It's also international partners that I think that are really important. I think that there's a series of academic partners. Certainly, we at Vanderbilt University look forward to being a great partner to the new commander and director. But I also think there are a series of partnerships today that perhaps we haven't even thought about. Partnerships with perhaps non-government organizations or partnerships with other entities that have placement and stature within cyberspace that can assist us.

Kelly: You've worked for multiple administrations and you've done a tremendous job remaining very apolitical. In an era of election interference, of deepfakes and information warfare, how do you think the military stays neutral while defending the system? This is something that's on everyone's mind in Washington and you really seem to be very successfully navigating a difficult space.

Gen. Nakasone: First, I think that that the U.S. military and our military officers need to remember what has been an incredibly successful civil-military partnership. And remember that we work for our elected leaders. And I think it's important that we're very, very conscious of anything that we say, whether we're in uniform or out of uniform, that can be construed as being critical or being supportive or anything like that with regards to our political leaders. We have a mission to defend the Constitution.

We also have a focus outside the United States and being able to continue to do that is something that's very, very important to us. And continued civil discourse is one of the things that I really hope continues to improve and being able to listen to people and understand that they may have a radically different opinion than your own. Listening is the first part of understanding. I think that would be one of the things that I hope our future leaders continue to remember.

Kelly: Let’s close with what’s happening outside the U.S. If you had to describe to the average American how serious the threat is from China, how would describe it?

Gen. Nakasone: I think when you consider China or any adversary, one of the things you should measure is what their capabilities are in terms of their military, their economic stature, their informational powers, and even their diplomatic capabilities.

If you look at China today, think about their economy. Fifty years ago, when President Nixon went to China, they had a gross domestic product of $114 billion. Today, it's approaching $18 trillion. And to give you perspective, our gross domestic product in the United States is about $25 trillion. There's been incredible, incredible growth in their economy. Today, they're the number one manufacturer in the world. The next nine countries cannot equal the percentage of manufacturing that takes place in China every single day. Militarily, they have the largest Navy in the world - not the best - but the largest.

If you look at their information capabilities, think about TikTok. Over 60 % of the United States clicks on TikTok every single day to get their news. And then if you look at their diplomatic prowess, they've been able to establish a series of partnerships through the Belt and Road Initiative and being able to obviously bring on several partners that were never ever available to them in the past. This is a nation that has increasing capabilities and has designs not just on being a regional power but being a global power.

That's something that we as Americans need to think very hard about. And if you look at our values and what we stand for, they are dramatically different than what China stands for.

Kelly: Is there anything on your mind that I didn't ask you?

Gen. Nakasone: Let me just come back to what I do as my focus and my passion right now, which is continuing to educate the next generation of young people that are going to be part of our national security apparatus. People ask me whether I’m positive about our future. I would tell you, I am extremely positive about our future because I get to work with some of the smartest young people in America at Vanderbilt University every single day. When I look at the 18 to 20-year-olds, 22-year-olds that are thinking about the opportunities and challenges that face them, this is truly one of the things that I think provides a great dynamism to our nation.

As we close today, I would tell you that I'm incredibly optimistic as I look to the future with the young people who are coming up and I look forward to seeing what they're going to do in their lifetimes.

Read more expert insights into national security in The Cipher Brief. And find out more about The Cipher Brief HONORS Awards happening March 13 in Washington D.C.