Ryan Rambo: 26-Year Counterintelligence Veteran on How to Prevent Corporate Espionage — Insider Threats, Spy Recruitment & Protective Intelligence | Be Yourself Podcast

Ryan Rambo

26-Year Army Counterintelligence Veteran & Founder of IXN Solutions — on corporate espionage, insider threats, and how to spot a recruited spy

Watch on YouTube IXN Solutions
44 minutes
Counterintelligence · Insider Threats · Elicitation

Listen to this Episode

About the Guest

Ryan Rambo — Counterintelligence Veteran & Founder of IXN Solutions

Ryan Rambo has spent his career on the defensive side of espionage: finding the people who try to steal information, and teaching everyone else how to spot them before it's too late

He works with founders and security teams on the two things he says come first — classifying what data would actually end the company if lost, and knowing who in the building you trust with it

26 Years in Counterintelligence
Army operations and investigations, from overseas government assignments to the corporate world
The Belarus Case
a director of cybersecurity planned a trip to Belarus to meet a pen pal from the Russian Embassy. Ryan's team read it as early-stage recruitment and intervened
$43 Billion Corporation
built an insider threat program from scratch for 28,000 employees across 165 locations
IXN Solutions
Identify, Exploit, Neutralize — training, fractional insider threat support, the 351X case-management technology, and the CI Press podcast

Key Quotes

"

he defined counterintelligence as the discipline of protecting against adversaries outside your walls while catching the enemies inside. So, it's the cat and mouse game of the intelligence community.

Ryan Rambo
"

happy employees don't steal your stuff. They don't sell it for money. They don't take it to a competitor... if I can identify a toxic leader, I can almost guarantee you where your next insider threat's going to come from.

Ryan Rambo
"

one of the the best elicitation techniques that anybody can use is to make a wrong statement... an American must correct you... they can't wait to give you all of the information and show you how smart they are.

Ryan Rambo

Episode Chapters

0:00 Episode Intro 1:42 What is Counterintelligence? 3:20 What is so Intoxicating about Espionage 4:30 Counterintelligence Stories 8:59 Building Counterintelligence Programs 11:44 How NOT to Become a Spy 15:25 Identifying and Exploiting Threats 19:28 Preventing Corporate Espionage 22:03 Counterintelligence Services 25:25 What Makes a Great Counterintelligence Specialist 28:33 Cybersecurity and Data Breach 31:30 Advice to Business Owners 37:45 How to Hire Trustworthy Employees 39:40 Best Elicitation Method 41:43 Contact Ryan

Full Transcript

BTW: This episode of the Be Yourself Podcast is produced by Beverly Media. Also on the show:
Bradley Orford-Hall — From Burnout to Purpose: Reflecting on Why, Building Belief Systems, and Finding What Truly Matters →
0:00 Episode Intro
Ryan We had this one individual um and he was a director of cyber security. So he had access to the keys to the kingdom. He came up onto our radar screen because of foreign travel. He wanted to take uh a trip to Bellarus, which is odd, you know, and most Americans don't take a weekend trip to Barus uh just for fun.
Sergey You're coming from the other side. I had James Lawler who actually was recruiting spies. He also gave me these uh main motivators for people to betray their countries. I'm curious, do you have some antidote?
Ryan Jim and I were two sides of the same coin. He was on the human intelligence side, I'm on the counter intelligence side. He's trying to recruit spies and we're trying to, you know, prevent that. And so what we try to do from an education standpoint is teach them what an approach will look like. It's very subtle. Uh there's a lot of elicitation that happens.
Sergey Who are more prone to giving up uh intellectual property secrets?
Ryan In American culture. Um uh one of the the best elicitation techniques that anybody can use.
Sergey Welcome to the Be Yourself podcast, the podcast on expressing our true selves. Today, my guest is Ryan Rambo, who's a 26-year Army counter intelligence veteran who runs a corporate space with IXN Solutions. He's also a host of CI Press podcast that talks all things counter intelligence. Ryan, welcome to the show.
Ryan Sergey, thank you so much for having me.
Sergey My honor, I'm very, very interested in knowing more. So, can you tell me what have you done for the most part. What was the mission of your work as a counter intelligence officer?
1:42 What is Counterintelligence?
Ryan Yeah. So, there's a lot to counter intelligence. Actually, there's five primary functions of counter intelligence. I'm not going to name them this morning because I haven't had all of my coffee yet. Uh but the one that I was most uh involved in really were operations and investigations on the defensive counter intelligence side. So what does counter intelligence mean? Uh because people have this, you know, mystical thought process of counter intelligence. And it's scary to a lot of people, but honestly, uh the best definition I've ever seen was by an author named Robert Bear. And he's and he defined counter intelligence as the discipline of protecting against adversaries outside your walls while catching the enemies inside. And so really, if you're taking a look at intelligence disciplines, there's the human intelligence who are trying to use people to steal information. And from a counter intelligence side, we're trying to protect that information so it doesn't get stolen. So it's the cat-and-mouse game of the intelligence community. But what a fascinating career. I love talking about it. that I've been involved in counter intelligence now for over 25 years and it's just as exciting today as the first day that I became a counter intelligence professional.
Sergey What is the most exciting thing about counter intelligence?
3:20 What is so Intoxicating about Espionage
Ryan Well, I I love the history of it. I mean, espionage has is the second oldest profession known to man. I mean, it's been happening for 7,000 years. And uh so there's a lot of similarities in the way that espionage has historically been done, but each new addition of technology uh like AI and the internet back in you know 20 30 years ago. So every new iteration of technology just changes it just a little bit. But fundamentally it's about people and so counter intelligence to me um is fascinating because of the people that are involved with it. And I guess as I've gotten older, uh, Sergey, yeah, I start to appreciate people and the uniqueness of people more every day. And, uh, it just fascinating to me, the psychology of it, uh, the the intrigue of it and the history of it. I've just become I've fallen in love with counter intelligence as a discipline.
Sergey Okay. So, 26 years. Can you tell us a story that maybe stands out the most and that you tell your buddies that impress people the most?
4:30 Counterintelligence Stories
Ryan Well, I won't talk about my government time because some of that's still hidden behind a secrecy bell and I don't want to get in trouble. Uh but in the in the corporate space, the the closest thing that I can relate counter intelligence to is there's two different disciplines actually. Protective intelligence is what some people call it. And then the other one is insider threat programs. And so I was working for a major corporation. I was about a 43 billion dollar corporation with 28,000 employees and 165 locations worldwide. And so I would start in the morning and since we were a global company, my mornings would start with uh dealing with Middle East uh issues, you know, the Persian Gulf, Iran, Saudi Arabia, Kuwait, UAE. Then in the afternoon or late morning, I would deal with European issues. Uh then during the uh like afternoon time, I would deal with the United States and then in the evening I would be working India and Pacific region issues. So, a great great job. I had to be well-rounded and well versed on all of the geopolitical activities that were taking place at the time. So, it was fascinating. I mean, it was never a dull moment, but we had this one individual um and he was a director of cyber security. So, he had access to the keys to the kingdom. And one of the things that uh we discovered through the course of our investigation uh and he and he popped he came up onto our radar screen because of foreign travel. He wanted to take uh a trip to Bellarus which is odd you know and most Americans don't take a weekend trip to Barus uh just for fun. And through the course of having this conversation with him as he's telling me about this trip that he's about to take, uh he's he says, "Yes, I I had a pen pal uh who worked at the Russian embassy during the 1980s, which again people typical Americans don't have Russian pen pals." Um and so you know as he's telling me this story and he's and you know finally 20 25 years after he met this pen pal he's finally going to go meet me her and Minsk Beller roots. Well that sounds a lot like espionage to me or at least the beginnings of espionage. Um and and so of course I alerted the community and said hey I think this is a problem. I think this guy is either one a recruited asset and he doesn't know it or he's about to become a recruited asset and may be kidnapped whenever he travels overseas. And so just an example of understanding how espionage unfolds over time, understanding the psychology of this person at that moment. I mean, he was just going to meet a girlfriend in his mind. He didn't see any danger in this at all. Um but then putting all the pieces together and then involving the right government agencies to make sure that one we prevent him from getting kidnapped or even worse and then also protecting sensitive information the American citizen uh from those who may wish to do them harm. So that that's one of the most interesting cases I've run um in the corporate space. Now, there's been some great ones in the government space, but like I said, each case is different. Each case unfolds differently, and it's just fun to to be involved in in this business.
Sergey So, I'm curious, you were a part of the organization or you were like a contracted specialist? you were like so you were a full-time uh employee who was responsible for uh the counter intelligence support. Right.
Ryan Yeah. And it was very unique at the time. Uh it was around the 27 2017 time frame. So counter intelligence in corporate America hadn't really evolved yet. I mean everybody was still focused on cyber security. There was a lot of focus on counterterrorism. I mean because we were just coming out of the global war on terrorism at 911 and you know we're starting to transition from counterterrorism to counter espionage
8:59 Building Counterintelligence Programs
Ryan and so it I was in a unique position where I had the opportunity to build this counter intelligence program inside you know a $43 billion company uh which was unique at the time and boy I'll tell you our HR uh professionals were very nervous about it our legal team was very nervous about it cyber our security, physical security, our culture teams, believe it or not, were very very nervous about having a organic in-house counter intelligence until we we went around and had these conversations to say, "Look guys, I'm here to protect you for from the bad things happening, and that's my only role."
Sergey But you were using things like Polygraph, which wasn't pleasant, I assume, right?
Ryan Not in the corporate space. um we we really didn't do that in the corporate space. Uh I think that would probably be a little bit too far to to take a program. Now, of course, it's available to to companies these days. Uh however, in in my situation, we didn't do that. So, we leveraged more um one of the primary things that we did is training and awareness. you know, making sure that everybody understood the threat that we were facing and also what it looks like when somebody makes the approach to try to collect and gather information from you. And then there was a a whole liaison campaign that I did with each one of the different elements and leaders within inside the corporate environment to make sure that one they they could trust me. You know, I wasn't going to go tell stories behind people's back. I wasn't trying to be sneaky or or anything like that. So, they had to get a level of comfort with me. Uh, and so it spent I it took me about six months to really build those really trusting relationships. And then the the next key was was to set up oversight and control of the program. And to accomplish that, I I gave oversight and control to HR and legal and said, "Hey, I'm not going to do anything involving an employee unless you approve me doing it" and they immediately got buy in and they started to see the way that we went about our business. And they absolutely loved it. And what they found out was that it actually strengthen culture because now we have a security team that's down at the individual level. Hey, making sure this employee is safe. It's hard to do for 28,000 employees, you know, but I mean that that's kind of the the approach that you have to take with it and and you have to be a real person. You have to be authentic. You have to care for people um while at the same time protecting a high level organization.
Sergey You know, it's interesting because you're coming from the other side. I had James Lawler who actually was recruiting spies. So that he was interested in people associated with the government uh with from other countries that the United States were interested in. So uh and he named he listed like 10 qualities uh of uh highly efficient case officers. He also gave me these uh motivators for people to betray their countries. I'm curious, do you have some antidote? How do you prepare a person? How do you train uh an HR team to you know to train the people or whoever to not give away sensitive stuff? Do you have any mechanisms that can Yeah. can can can defend the the organization and its culture?
11:44 How NOT to Become a Spy
Ryan Yeah, 100%. So, first Jim Lawler, who I love and I consider a really good friend. Yeah. And a great author. And so Jim and I were two sides of the same coin. He was on the human intelligence side. I'm on the counter intelligence side. So there's this cat and mouse game uh that these two intelligence disciplines play. And I love it. He actually came to my hometown and we we gave a joint kind of presentation together. I just love that guy. He's so brilliant and such a talented person and a wonderful friend. So, uh, but you know, from a different perspective, I mean, he's trying to recruit spies and we're trying to, you know, prevent that. And so, what we tried to do from an education standpoint is teach them what an approach will look like. You know, it it and it's not uh it's very subtle. Uh there's a lot of elicitation that happens. Uh it's almost like a business transaction. It looks like a salesperson coming up to you and they're asking you different questions to identify those personality traits, motivations, vulnerabilities. And so through the course of our education process, we say, "Okay, look, this is what it looks like when somebody like Jim Lawler approaches you and starts asking you questions." And in Jim's world, what he's always trying to do is get to that second date and third date and fourth date. So, so whenever he makes the approach, I mean, after he talks to you for a few minutes, if he ever gets to the point it's like, "Would you like to go have dinner or coffee or something like that," a person should automatically associate that with, "I'm on the road to becoming a spy." And so, uh, so casual conversations usually are just casual conversations, but if it if it feels like you're being dated or hit on, you probably are. And so, uh, we teach employees to be non-committal. You know, it's not, it's like, yeah, coffee sounds great, you know, but can we maybe do that in a couple of weeks, three weeks, next month or something like that, uh, so that they have time to come back and report it to counter intelligence professionals so that we could kind of craft the scenario to put people like Jim in a bind. And it that's the whole point of that that process the counter intelligence process is to identify that human case officer and then identify exploit and neutralize which funny enough our company's name is IXN Solutions. Identify exploit neutralize that's what it all stands for. But you want to identify someone who's already converted in a way, right?
Sergey So you're looking for uh rats. Sorry for like this strong word, but in a in a way.
15:25 Identifying and Exploiting Threats
Ryan Well, it's not just that. We want to identify the person that's trying to recruit our people.
Sergey So you're trying to identify and find people like Jim. Exactly. Wow.
Ryan Yes, exactly right. We want to identify that person as a foreign human intelligence officer. He's trying to to cause harm either to our people, our technology, our companies, or our country. So, we want to identify him and then either exploit him. You know, it's like, oh, okay. So, you you're looking for let's exploit that.
Sergey Game within a game.
Ryan Yeah. Right. Or or neutralize, you know, is shut it down. Like nope this is you're not going to get this information. So I mean from a counter intelligence perspective once we identify somebody trying to collect information now we have all kinds of options available to us. Uh but it really starts with identifying and that's what we train uh our employees to to be very mindful of. It's like, okay, there are people out there that are trying to collect information on you, and as counter intelligence professionals, we see the world through your eyes, and we're looking to identify those people that are, you know, nefarious or trying to collect information.
Sergey Have you ever had instances where you successfully identify a case officer and your employee was working with you to exploit them?
Ryan Yeah. So, um it happens. Absolutely. I mean, that's the whole point of the game. And, uh I was in an overseas location, not going to name it. Um, and we had, you know, a foreign government official who was assigned to, uh, one of their consulates, uh, who had approached one of our employees. And that employee, uh, believe it or not, was properly trained, knew how to react to it, knew who to report it to, and within 17 days of that approach by a foreign national to one of our employees, um, we were able to neutralize them. So, we identified that that person was uh not who they said they were. Uh that they posed a threat uh to the United States government and to one of our employees. And working with, you know, the the host nation, the country that we were in, their their security and intelligence services, we were able to get that person kicked out of the country. Um which is a win for us. I mean, so there was no there was no opportunity to exploit the relationship, but neutralizing is just as effective. Uh because when you when you're a foreign country and one of your human case officers uh gets PNG'd as what we called it persona non grata and kicked out of the country. It sends ripple effects through that organization. Now they have to look at every operation that they run. You know, are they compromised? or you know is anybody has anybody penetrated our our office building? I mean so now they have to really do their due diligence and assessment to see if they're operating in a secure manner and so from a counter intelligence perspective it was a huge win and that those are the types of things that we're constantly trying to do and I don't know you probably read in the newspaper every day there's a spy or there's you know somebody being caught across the globe perhaps happens in Europe all the time. Uh it happens in the United States all the time. Uh and yeah, like I said, it's the second oldest profession in the world. I mean, people commit espionage daily.
Sergey Yeah, this is fascinating because the temptation to earn a money or as Jim told me a lot of people want to pay vengeance to to you know like a lot of people are not feeling that they are treated fairly or something and they just want to snap back. So, and it's interesting how there are people like you who uh on a human level and on a legal level, let them understand that it's not the best that's the best idea.
19:28 Preventing Corporate Espionage
Ryan Yeah. Well, Jim said it best. Uh I was having a conversation with him uh and he said it best. He said, "Happy employees don't steal your and commit espionage." Well, and he's very right. And so when if we go into an organization, we talk about culture a lot because happy employees don't leave the company. They don't steal your stuff. Uh they don't sell it for, you know, money and and all of that. They don't take it to a competitor. And so whenever we go in from a counter intelligence perspective, one of the things I like to do is give me your organizational uh surveys, show me where the bad leaders are, the toxic leaders are. Because if I can identify a toxic leader, I can almost guarantee you where your next insider threat is going to come from. Uh I would also take a look at teams and uh figure out who has the highest turnover rate in a team. Um I I was having a conversation with a client the other day and he said, "Well, what are the statistics for insider threats?" And we we gave him the standard Gallup poll, you know, 30% here, 30% there, 20%. And I just looked at him. I said, "What's your what's your turnover rate?" He said, "Well, you know, in our management and executive team, it's about 10%." He said, "But from our individual contributors to our middle management, it's about 25% annually." I said, "Well, there's your insider threat statistics that are very specific to your company." Those are the people that are going to leave your organization or unhappy and they're going to steal your information either give it to a competitor, start their own company or sell it on the open market to the highest bidder. And so it's a way of from an HR standpoint to really drill down and and take a look at your organization and assess do I have an insider threat program or a problem or not.
Sergey Let's talk more about your company, IXN Solutions. Who are your customers right now and uh what are the types of requests that you help uh right now? What is the prevailing one right now?
22:03 Counterintelligence Services
Ryan So we have we have two different sides to the company. Um, we have our government side where we provide uh training and awareness and services to the United States government, which is fun. I mean, it's our opportunity as a bunch of old, you know, gray beard guys to go and give back and teach from our experiences to the next generation and help build them up. Uh, which is something that we're totally committed to do and and we love doing that. And then on the commercial side, we actually have four different pillars that we offer as our offerings. The first one is training and awareness. Again, from a counter intelligence standpoint, that's our bread and butter. We want to get in front and train as many people as we can about threats and risk, how to react or recognize, react, and report it. R3 is what we call it. Uh and so that's that's number one, training and awareness. The second one is our fractional insider threat program or fractional counter intelligence offering. And so what I found in the corporate space once you build the program uh and it takes about a year to 18 months to fully build out a relevant functioning insider threat program or counter intelligence program. After that 12 months to 18 months, you're in maintenance mode and you probably don't need a full-time employee. And so what we do from a fractional insider threat program is to go and build it and then you call us when you need us. Uh and we teach people how to monitor it. So it saves the company money and it saves them from having a full-time employee that over time it's not going to have that much to do. The third thing that we do uh is we have a technology that we call 351X. Uh what what I experienced whenever I was in the commercial space is that we were managing these security programs through spreadsheets, share drives, emails and it was horrible and counter intelligence uh incidents and insider threat incidents aren't, you know, immediate red flag moments. It's not like a cyber security thing. It builds over time and you start to see indicators and patterns and that sort of stuff over time and then you piece that together to identify an insider threat. So, uh, 351X is that case management tool that allows us to to document and store information to tell that story over time. And then the fourth thing that we do is our thought leadership pillar and that's where we have the CI Press podcast. And so that's part of that thing. It's where we're trying to demystify counter intelligence to share the stories of the legends that were in counter intelligence and then also do special topic discussions where, you know, if new relevant news events come out or case studies, we dive deep into that to educate the next generation on hey this is what you should be looking at from a counter intelligence perspective.
Sergey Well, I'm curious to know because you mentioned that you had a unique chance to build the entire branch or division from ground up in that big company and um what makes a great counterintelligence leader? So, what do you pass on to the next generation of people who want to get into this space?
25:25 What Makes a Great Counterintelligence Specialist
Ryan Well, I will tell you um you know with technologies you if you're going to advance a technology a car, an airplane, what you just layer on more technology, you know, you add a better radar, you add full self-driving mode and stuff like that. for a counter intelligence professional, a human, uh the best way to to get better is through training, through reading, that sort of thing. So, uh I if I was to pass on some knowledge to a next generation counter intelligence professional, I would say read. And it doesn't have to be non-fiction books, which sometimes can be a little bit dry. It can be fiction books. We mentioned Jim Lawler. Jim's written three books and they're all fiction, but they tell a great story. And the reason why he writes fiction because if he told the true story, he'd probably get put in jail for violating security law or secrecy law. So, read your fiction, read your non-fiction, and really go and seek that training and awareness um to to get better. Now, within an organization, when you're building a program, it's the same thing. I mean, it's going out and having the ability to communicate with people, uh, to build trusting and lasting relationships, giving up control where needed so that people can, you know, actually look over your shoulder and see what it is that you're trying to do, and uh, have a clear understanding of what it is that you're trying to accomplish. So, if you have all of those things, one, you could be a well-rounded counter intelligence professional or insider threat professional. Uh, and then you'll build a program that people trust, that they can't wait to have a conversation with you. They think you're the most interesting guy in the room, and normally you're not, but you fake it to the point that you are. Uh, and then you make it fun for everybody. And I think that's the key to success from a counter intelligence standpoint. And I think one of the things that's really hurt the counter intelligence community is that we become too secretive. That we hide behind our vault doors in a building with no windows and so people are like they have no idea what you're doing and so they don't trust you. Uh and we have to change that mindset, that culture of counter intelligence to where yes, come and talk to us. You know, we're here to help you. Help us, help you, protect you. You know what I mean?
Sergey So, hackers become more and more, let's put it, creative. And with AI, I'm guessing things can really become difficult. Um, but I think this is a different topic. It's a topic of protecting data. Is this an adjacent kind of thing? How are you guys, you know, balancing this out?
28:33 Cybersecurity and Data Breach
Ryan Yeah, wonderful. Great question. And there was a recent statistic that came out that said all of 60% of all cyber security intrusions and data breaches actually involved a human somewhere. uh so there was somebody on the inside who compromised their credentials or allowed access. So what we're finding today in the corporate world especially and probably in the government as well is that cyber security tooling has become so advanced uh because they're leveraging AI too and they're really the firewalls the security that's in place that most adversaries can't do like a blunt force penetration of a network. And so I have to give it to the cyber security community, they have done most of the hard work to build that perimeter defensive approach and a layered approach to make sure that they stop most breaches. What we do find though is that uh like I said 60% of breaches now involve a human and so our adversaries understanding that cyber security tooling has gotten so advanced have tried to go around the wall and penetrate those systems by, you know, unsolicited correspondence, that's people, you know, reaching out to you through LinkedIn,
Sergey doing social media stuff. You won a lottery or something, yeah.
Ryan Yeah. And it's easier to manipulate and find vulnerabilities in humans than it is in cyber security systems these days. So, uh, so I think, you know, finding that disgruntled employee, and I think Reddit might be one of the more interesting social media platforms that hackers are using these days because people get on Reddit and really, really air all of their grievances. And for whatever reason, they're the ones, you know, and I think if I was a really kind of aggressive hacker, Reddit would be the platform that I would seek my targets out and form those relationships and say, "Yeah, you're really pissed off. You're really mad at that company. Great. Let's do something about it." You know, give me your password, give me access to the network, and let me do some real damage, let's get back at them together.
Sergey I never thought about, you know, protecting anything before I got something, you know. So it seems like in life, you know, I even make this joke that when you're not rich, you don't have this problem of trying to protect your fortune. So um what is the general advice that you give to people who are building businesses or building companies, hiring more people? Is there any best practice or philosophy that a founder like me, I'm growing my media agency right now? Uh we're in this really hockey-stick growth right now and I'm hiring a lot of people. So what are the things that maybe you advise people who grow businesses and who deal with lots of people and whose information could be potentially interesting to some parties?
31:30 Advice to Business Owners
Ryan Well, start now. It's number one, start today, you know, start. And really it's a two-prong problem, right? And so, you're going to have data and you're going to have intellectual property. So, there's the data classification side, you know, this is all of the the things that make my company great, you know, and categorize it like if I lose this, my company is over. Yeah. And then tear it down from there. And then on the other side of that is personnel security. Who do I trust the most? Who do I trust a little bit less? Who are the people I don't trust at all, but I still need them to do work? And then you marry those two together. So the people that you trust the most, you give them the most access to information. And then you tear it down. Um, and so I always tell companies, I mean, first, a lot of times I'll ask them like, "Do you have a data classification system?" They're like, "No, what's that?" I said, "Well, how can you, you know, if you don't understand your own intellectual property, your own data, and what's sensitive or not, then there's no way that we can protect it. So, you got to go through the data classification piece, then the personnel security piece. Um, you know, and as you're growing, it's a real challenge. I mean, because you have to get that information out. You have to bring people into the organization to help you grow. You don't have a lot of time to vet those people, to check their backgrounds and all of that. There's some laws that prevent you from really doing that due diligence in a prehire scenario, but once they're onboarded, you can do some more, you know, you can do some deeper dives. Uh but what happens in most companies these days, as soon as you go through the hiring process and you hire an employee, on day one they get issued their company laptop, they get issued a company phone, and then they gain access to the network, right? So before you even know an employee, you're already giving them the keys to the kingdom. And Tesla had a really good case. It's probably about four years ago and it involved a Russian immigrant and he came to the United States and applied and got hired at Tesla specifically to steal the full self-driving technology. It was that important to him. So he was tasked by somebody, we think the Russian government potentially, to get hired at Tesla to steal that technology and then leave and go back. And within a month of him being hired and issued his laptop, you could already start to see him do that exfiltration events on the network. He was stealing that code, that technology to bring it to somewhere. And so, so I would again just to kind of summarize, data classification, personnel security, marry those two up. So it should be trust levels, you know, and then be careful how you onboard people and maybe give them a period to kind of test out how much you can trust them over time. You know, maybe a 90-day probationary period where you give them access to this much information and then after 90 days you give them a little bit more and as they build trust and you start to see them as a person, then give them the keys to the kingdom is what I would recommend, if you can do it.
Sergey I just It's interesting because I just granted an access to files from my new big client to my new hires. So these are people who I hired who I had a number of conversation and they look trustworthy, but you might never know. I don't want to be paranoid, Ryan. I think this is the line that you have to walk. I mean, being paranoid and being adequate with your people, but actually I sent them a message saying, "Hey guys, don't try anything." And they replied, because in a way they're like a team who I've subcontracted, right? So, they're not exactly on my squad because in media production sometimes you hire more personnel, but yeah, they said that we're interested in long-term relationships. So, I'm more of a human type of leader, so I want to trust people, but I once I already had a pretty bad case when I was in my first business. Like I was not careful enough to sign something, you know, and that cost me a business pretty much. So right now all these things I pay much more attention to them. And yeah, and what you're saying is that yeah, you if you've been through blood and sweat and tears with this person, give them the access, right? But again, I think they might work with someone, so you got to teach them how to hire. So, so this sprinkles down through the organization.
37:45 How to Hire Trustworthy Employees
Ryan Yeah. And hiring is hard. I mean, because you really I mean, you know, there was a comedian, I don't know who it is, but it's funny. He said, "We never show anybody our real person. We show everybody our representative." You know, it's it's, you know, it's the person that we want everybody to think that we are. uh and so especially during the hiring process and I think that we do a very poor job of interviews uh because we don't use enough elicitation and I'll give you an example and I'll say, "Hey Sergey, are you a loyal employee? What are you going to, what's your answer?"
Sergey Yes. Of course I am. I'm loyal.
Ryan I mean I would be an idiot to say not that, no I'm not loyal at all. I mean so you really can't get a true sense of a person by asking them that direct question. But you can say in an elicitation kind of style is, "Hey, Sergey, how long have you been with your company now?"
Sergey Yeah. Yeah.
Ryan And then if you said, "Hey, I was with my company for 5 years," I say, "Well, that's very loyal of you to stay with that company for five years." I mean, most people don't do that. And if you respond back, "Well, yeah, loyalty is important to me, that's why I've been married for 30 years and I worked with companies for 5 years." And now you're getting a true sense of how loyal a person is. Uh so direct questions bad. That's what everybody uses today in an interview format, which is just not great. But elicitation and understanding how to ask a question without asking a question can actually get you a better, more honest, truthful answer and get past the representative that they're trying to portray to you and really dig down into personality traits and motivations and all of that stuff. So, I would love to change the way we do it.
39:40 Best Elicitation Method
Sergey Who are more prone to giving up uh intellectual property secrets? um quiet people or loud people or is there some kind of indicators in terms of temper?
Sergey Uh I would say American people.
Ryan I will tell you that in American culture um one of the the best elicitation techniques that anybody can use is to make a wrong statement and it can involve anything. Yeah. If I was to take a look at a car or something like that and I'm like, "Well, that car, you know, that car, it can go 1,000 miles an hour, can it?" An American must correct you. It's like, "Oh, no, that car only can go 120 miles an hour on a good day. And then because it has a 4.5 liter inside," and they will tell you all of the intellectual property. Other people that are like that are educators like professors, academics, scientists, engineers. They can't help but correct you. And so from an espionage standpoint, I'll just make a wrong statement and just let you correct me and I'll sit back. I'm like, "Wow, that's really, I had no idea, you know, tell me more. You know, what about this? What about that?"
Sergey Feeding their ego. Yeah.
Ryan Exactly right. And so I don't think it's really quiet person versus loud person even though they both can be manipulated in different ways. Um but you know one of the techniques that I love from an elicitation standpoint is play that kind of dumb person, you know, like wow that's so fascinating, tell me more. You know and people thrive on it. They can't wait to correct you. They can't wait to give you all of the information and show you how smart they are.
41:43 Contact Ryan
Sergey Ryan, let's wrap up. What was your what would be your final message to our audience and where can people get in touch with you?
Ryan Yeah, I will tell you that everybody whether it's, you know, government level or corporate level, we're facing espionage, foreign intelligence, insider threats every day. And everybody's looking for an automated solution that scales faster. They're looking for a cyber security tool, an AI tool that's going to solve all of their challenges. Well, I'll tell you what you need is a person that understands how espionage works and how to deal with other people. So, take a look at counter intelligence. I know it's scary, it sounds horrible, but corporate counter intelligence programs are uniquely suited to be the glue that binds all of your other security programs together. Whether it's cyber, physical, personnel, operations, compliance, counter intelligence can sit in the middle and make sense of all of it for you and really protect your company. To learn more about it though, I would encourage you to go and listen to our podcast CI Press. We just published, I think, episode 119. So we have over a hundred episodes of, you know, the legends that have done this business telling their stories. One, it's really funny and enjoyable, but they can also give you insight on how this whole game plays out. So, with that, oh, and by the way, I love to mentor people. I love to have conversations and help people along in their career. You can reach out to me on LinkedIn, Ryan Rambo, and I'll connect with you. I don't vet anybody. I mean, please, if you're a spy, you don't waste your time. I'll catch you, but by all means, connect with me and I look forward to seeing your post on LinkedIn.
Sergey Thanks, Ryan. That was a blast.
Ryan Yeah, man. Well, Sergey, this was a great conversation. Thanks for having me again on the show.
Sergey Absolutely.