MCSC 2026: Intelligence View – Cyberspace as the Future Arena of Political Conflicts?

Good afternoon, everyone.

How wonderful to be here and have the opportunity to be with you.

From Brunswick Group, a partner of the Munich Cybersecurity Conference, and I'm a former British national security official and led on cybersecurity, the cybersecurity program of the UK.

At the moment, I'm short two generals.

So, u- unless they come up, I- you're going to have...

Uh, please, please come up.

Who have I got?

Here we, here we are.

Come on up, and I'll introduce you when you're here.

How are you?

Nice to see you.

Fantastic.

So the title of this, um, the title of this session is Cyberspace, Uh, the Future Arena of Political Conflict.

I think we might argue that, uh, it isn't the future, it's the present.

But there we are.

And, um, uh, who better to speak to this than two senior, uh, intelligence leaders with practical experience of conflict in the cyber domain and beyond?

Um, Vice President of the German Intelligence Service, the BND, Dag Baer, and, uh, General Paul Nakasone, who is former commander of the US Cyber Command and of the National Security Agency.

So, um, I'm gonna ask a few questions just to get, get you going, then we'll see what dialogue we get.

Um, Dag, maybe I could start with you.

I mean, governments are the actor of last resort in this domain, and what's having greatest deterrent effect from your perspective?

What balance are you making between capability, attribution, alliances, or resilience?

Yeah.

Paddy, thanks, thanks a lot.

Um, in the weeks preceding that particular conference, Paul and myself were trying to catch up.

Little did we know that we would do so with all of you attending our catch-up.

Um, so, but starting with your question, Paddy, I mean, it's pretty loaded at the very moment.

And knowing about your background, uh, no wonder as why you're just putting me on the spot with that one.

Because talking about deterrents, uh, at the very moment, uh, we have an ongoing discussion in Germany to put active cyber defense into legislation.

So publicly discussing what you're able, uh, to do against cyber threats, uh, and being restricted by law is, uh, not a very clever way in exposing your strengths and weaknesses.

Uh, but however, here we are.

Um, I think we heard in one of the preceding panels that, uh, resilience is important.

I still w- would say so.

It, uh, it is.

Um, it's a base layer you need to be resilient.

But I would s- argue that from a German perspective, we're still not up to standard.

And however, uh, just being resilient alone, you can't absorb all of the threats by just being simply resilient.

You need to be active in defending.

Whether you call it active defense or just active measures, I think i- is just semantics, uh, not capabilities.

Um, so you require capabilities, uh, from a national perspective to fight cyber threats.

Um, and openly talking about those is a very difficult, uh, subject, because you're losing a point in deterrents.

Yeah.

Um, uh, a part of deterrents is creating ambiguity.

Uh, so leave your opponent, um, guessing what you're able to do against the threats, uh, especially when they're more upstream.

And it's not, I would say, not desirable to having red lines, um, discussed in public, especially when those red lines only apply to your own actions.

So, i- if you publicly state what you not do, it's not very deterrent.

Uh, because then you just, uh, elaborate on a plan that others can use to circumnavigate your capabilities.

Um, so that's, uh, the, I would say, sort of the strategic advice I would give for free.

Um, uh, uh, uh, the thing is...

I mean, and that there's, there's a reason to that.

Um, I just see that talking about deterrents, uh, at least, uh, for almost two decades, for historical reasons, has become sort of a lost art.

Um, when it comes to, um, how you deter, is cross-domain deterrents working?

So can you deter cyber r- risks by switching to a different domain?

Uh, it would be very interesting, uh, question.

But, uh, coming back to, to capabilities, not being too, um, overly elaborate on that one.

Um, if you actively apply your capabilities, um, you, to some extent, uh, have a de- disclosure of what you're able and doing.

Not only what you're allowed to do, what you're capable of doing.

So, um, I'll use an example how you try to deal with that particular problem.

So in NATO, they have this so-called SCPA process, sovereign cyber, um, provided by, uh, voluntary allies.

Uh, it's, for those of you not in the know, um, im- imagine a dark room painted black.

It's pitch black, no windows.

There are mice in there you are trying to catch.

And now you get in with five different people, uh, bringing in black cats.

So, and those black cats are hunting mice in that room.

So, uh, and of course, they are successfully doing so.

But, uh, in the aftermaths, everybody can claim, "Is- wasn't my cat."

Um, or, "It was my cat."

So how you disguise your capabilities in a construct like this is a very interesting problem, because you're going to want have your opponents just being there.

And my last point is attribution.

...

um, I think that's a very difficult subject, especially i- in Western democracies, eh, to have lawful actions a- against your opponents if you're restricted by l- legal framework requiring you to attribute whom you're acting against it.

So, that's a problem with, uh, us covering several dilemmas.

And I'll leave it to that.

Uh, t- that's great.

Paul, can I, can I bring you in?

I, you were a great advocate of collaboration, practical collaboration, to counter cyber adversaries, including sending US folk forward in a way that hadn't been done before.

H- how do you see that partnership and collaboration now at a time of, you know, uh, unprecedented geostrategic tension?

Well, I think first of all, let me, uh, congratulate Peter and, uh, all the organizers.

First time I've ever stood in line to come into the m- Munich Cyber Security Conference.

Fantastic.

It's great.

Um, but three o- three thoughts here.

So, first of all, I, I think the national cyber director this morning, Cain Cross, said very, very well.

Sean said, "Hey, we don't want to be alone.

Uh, we don't want to be alone, no one wants to be alone in cyberspace.

You are much better together than you are alone."

That's the first piece that we should always remember.

The second is that, um, you know, working together doesn't mean just governments, armies, militaries working together.

It also means working with the private sector, working with academia, working with others that are in every single day operating in cyberspace.

And the last thing I would just share with you, Paddy, is just, uh, again, there are a number of different options in terms of what you want to do in cyberspace, but it begins with information and sharing information.

And information goes to intelligence, and intelligence goes to techniques, and techniques goes to common baseline upon which we operate.

You have to begin, though, with that first part is, we're gonna share information.

So, so you've referred to the private sector role, which I, I strongly agree with you.

And, and Dag, I wonder, um, whether you could comment on, o- on how you're seeing that evolve, the public-private partnership and, uh, and the weight we put upon private actors to, uh, eliminate tasks for you, so to speak.

I have to be very candid about this.

I mean, and it's speaking for, uh, an organization which is, um, at least born out of, to some extent, um, governmental, um, actions, uh, thereby, you know, subject to a certain level of

bureaucracy, of fighting for funding, uh, for size, uh, and the ability to scale, uh, which is r- by that threat's landscape we are just addressing over here, uh, is something which is a core capability.

You need to able, to be able to scale, uh, to answer the threat.

Um, so that's, that's, uh, the first remark I would, um, offer, Paddy.

And the second one is, um, we are at a structural inflection point, I would say, uh, because most of the technologies which, uh, in the nearer future or even in the present are already required to address a threat

landscape is not owned by governmental agencies.

So, I mean, you've been, at least touched on AI already.

So, most of the capabilities we will require in the future, eh, eh, from an intelligence agency perspective is not owned by us.

Yeah?

It could be made available to us, and what kind of mandate and contract, uh, remains to be seen.

But most of the knowledge with its, uh, provided to intelligence in the future, uh, will be gained through any kind of AI, AGI, uh, and provided to, uh, intelligence

agencies.

So, how you gonna manage, um, I would say, uh, governance of knowledge and how it is gonna be applied?

It has to be a subject of intense collaboration between intelligence agencies, uh, in the industry.

And, you know, you have been listening to Sean talking about technology stacks.

Most of those technology stacks, uh, if I w- if I like it or not from a BND perspective, i- it's still owned by the US.

Any kind of large language model, uh, most of our opponents can use for free, uh, is located, uh, either in Silicon Valley or, or where else.

Um, so, and I have to come to terms with that particular, uh, uh, s- very simple fact and just make it work in our advantage as well.

How you gain knowledge, um, how you govern it, and how you just make the governance into your advantage in covering it, uh, will be of, I would say, the highest priority for almost any intelligence agency.

And if you just go back to classical cyber threat intelligence, um, we already are there, that we just require corporate business providing, uh, cyber threat intelligence, um, to make it manageable, uh, from our perspective.

So, there are many companies, uh, in the room already, uh, I'm not naming them, uh, who provide substantial support to what intelligence agencies do use nowadays.

S- can I just follow up on that?

I think it's important.

Um, we've talked about public-private partnership for many, many years.

We've done more, I think, over the past couple years than we had done in the previous five years.

But we're not at a level that we should be happy with.

The scope and the scale and the speed of what we're doing now does not help us enough to be able to address what our adversaries are doing to us.

And so we have to think, I, I believe, much more creative in terms of what we're doing.

So, l- let me give you an example.

Um, let's figure out what our competitive advantages are on the public side and what are the competitive advantages on the private side.

I will tell you, on the public side, one of the things is we have incredible intelligence, and we have incredible ability to provide that to a number of different partners.

You know, how do we do that in a way that we share and we protect our sources and methods?

The second thing is, I would, I would give you an example.

One of the things that we had done quite readily at the National Security Agency and US Cyber Command is provide free scanning to the defense industrial base that wanted to have it- ...

scanning, scanning.

It's just incredible in terms of what you're able to do with just a simple thing like that, or protective DNS, any of that type of work.

This is what we have to do, and we have to do it at a much greater scale and much quicker than we're doing, you know, than we've, we've ever done before, Paddy.

So, uh, uh, if I may come, um, so there is a, a general transformation in intelligence going on anyway.

So what I would call sort of a democratization based in capabilities as well as in targets.

Yeah.

Because we are just, uh, that's not, we're not talking about a classical threat landscape.

It's evolving, you know, it's all encompassing.

It's a whole of government threat landscape already.

So the citizens are a target.

Corporate business is target.

Critical infrastructure is target.

So, um, uh, you have to have corporate business industry, uh, a- and private business subscribe to the simple fact that they require intelligence as well.

So, and as just Paul elaborated, if you can provide methodology to do so, uh, that- that's- that's fair.

Uh, we require, you know, the, the corporate business capabilities to be able to scale, uh, where the classical target set is attacked, um, and the, you know, the abundancy of data, which is just provided by having a democratization of

target sets is just flabbergasting.

Yeah.

So I have to, to, to cope with that, uh, as a society, not only as an intelligence agency.

Yeah.

So-

But I think it, but I think it's even simpler than that.

I just, uh, you know, I, I firmly believe that it's, you know, in terms of how do we set this up between what our government is doing and what we can provide.

A- again, coming back to what we've done at NSA and Cyber Command, two different organizations, cybersecurity collaboration center under advisement, utilizing Slack channels to be able to provide this information in an unclassified facility, doing this from a number of different locations, and just having a conversation ongoing.

One of the most important things is, you know, there are things that the private sector sees that we certainly don't see.

We don't have the authorities and, and sometimes the policies to do things in different parts of the world to include our own country for very good reason.

But boy, they do.

And wouldn't it be nice to be able to understand what's going on?

And then we could say, "Hey, this is what we're seeing as well."

So-

You got us all, you know, up and running, Paddy, with that one.

Um, there are two things I just, uh, want to sort of re- no, one, uh, simple fact I'm gonna re-address that is, um, especially if you look down and in, into the nations, um, and I, we just started off by,

uh, we should be able to share information.

So we are still in silos and stove-piped, um, whether it's government, whether it's non-governmental, whether it's within the government, uh, how are you gonna share information with other governmental agencies?

I mean, it's so over-regulated.

Um, e- even if I just be, I'm able to obtain information, um, it's not simply, uh, allowed to share it.

So that's, that's, we are living in silos.

We continue to do so.

Um, and this is detrimental to one important factor, which hasn't been, uh, brought out, uh, I would say, to, to the right level.

This is speed.

Uh, um, we are just living in an area of continuous contestation under ever-more time constraint.

So the, the timelines are compressed evermore, and the more we see in AGI, timeline's getting ever smaller, and especially for Western democracies, w- when you see your decision cycles, uh, um, it, it's, they're not adaptive to the

speed we're seeing over there.

So talking about attribution in the first question, how much time it does take to have at least, um, a lawful attribution.

I mean, that's, uh, that may take a year.

Um, we are talking about, uh, a fracture of a day, which is required to attribute something to, to cope with that.

So, uh, this is just, uh, I'm always puzzled by the simple fact that we don't talk timelines, uh, very much.

Of course, I have a military background as, as well as Paul.

So we are, you know, well-versed in just treating timelines appropriately, but, um, we had, we had a popular saying in one of the operational theaters, we have been years of shared enterprise.

Um, and you have the watches, we have the time, uh, I think we should reconsider those sayings because there is not time enough.

So, so an elephant in the room, uh, whenever Europeans and Americans are getting together, is the question of sovereignty, and in particular technology sovereignty.

And I'm not gonna put Dag on the spot because it's deeply unfair to do so.

But Paul, I am gonna put you slightly on the spot, and I'm really interested in how we capture the advantage we get through the technology partnership with US companies.

And I'm thinking of the lesson of Ukraine, where Ukraine, in a digital sense, was saved in part because of its partnership with great American companies like-

With Starlink, with Microsoft-

...

Paul-

...

a number of different pla-

Yeah.

So this is, this is the whole idea of speed, right?

But how do we measure that-

And ex-

...

and express it in a way that policy-making can?

But, but I, I think this is a, this is a really good, uh, exemplar.

Take a look at what companies like Microsoft have said with regard to their principles and how they're going to operate.

Those are important ways upon which we look at that.

They're saying, you know, we value the idea of securing our information and yours.

We value the idea of being able to work with trusted partners.

These are a series of principles, and I think, uh, American companies have done a very, very good job at that.

And, and you pointed out one example.

There are others that I would say, but as we look at artificial intelligence, as we look at quantum computing going forward, you know, I think that this is going to be the area upon which, you know, like it or not, you're going to, you're gonna work very, very closely with a series of American companies that are on

the forefront for doing this.

And I think those companies have been very forthright in being able to develop these type of principles to work with the broader world.

So I'm interested in capturing the risk in any kind of decoupling.

That's the bit that's really interesting on the previous panel.

If you're beginning to see people saying, "Well, we're not going to be able to work with some American partners in some fields," that question of how you calculate the loss you get in shared cybersecurity, that's the thing I think would almost be of most value to policymakers.

Do you want to have a go?

So in the United States, two friendly nations to our north and south, two large oceans to our east and west, do not protect us from, you know, the malware, uh, the attacks, uh, the domain of cyberspace today.

And so if we are going to couple, we, our nations are going to decouple, we do so at our own risk.

We are much better working together.

And so the idea of decoupling technology, decoupling information sharing, for someone that had done this in the public sector, it's something I'm very concerned about.

And now I'm going to put you on the spot.

You have 52 seconds- ...

in which, in which, just to give, knowing what you're doing now that you're a- you're after, o- out of service, and you're, and you're, or out of the service and are, are, are working now with the, in the private sector, how should this audience be thinking about

that challenge of AI and quantum as it comes towards them?

What, what, how should they prepare, be preparing themselves this year to do something different?

Go ahead.

So in 30 seconds, I will tell you that, uh, I am also at Vanderbilt University where I head the Institute of National Security.

We welcome all to our spring summit, '23/'24, where the chairman of the Joint Chiefs will be talking along with former Secretary of Commerce Gina Raimondo and former CENTCOM commander Erik Kurilla.

In terms of quantum computing, as we think about 2026, I would offer to all of you, I think this is the first year, and I, Recorded Future captured this very, very well, this is the first year we're going to start seeing nations expand more, more capital into

post-quantum cryptography.

We have to ensure that our national security systems, our financial systems, our ability to communicate are going to be secure in a quantum future.

And whether or not that's 2035 or it's sometime before that, Paddy, this is what you're going to see, I think, in 2026 is a movement towards that type of security.

You've got to admit, I covered a lot of ground, eh?

Ye- yeah.

So-

Do you have five seconds, Paddy, before we just-

Oh, fine, fine.

If no, I don't.

You have five.

...

crown it?

So not putting me on the s- spot with regard to politics.

So as an intelligence professional, I can afford to be very pragmatic.

So I'm not overly concerned about politics, but about de-risking and not decoupling.

Thank you.

Yeah.

No.

Fantastic.

So, um, we've covered a lot of ground.

I'm sure you'd like to join me in thanking the two, uh, excellent generals, uh, in our conversation.