Security expert warns against getting lulled into complacency in the Indo-Pacific

Rob, thanks for joining us

Let's start with a bit of an introduction to yourself and your rather remarkable background in this space for anyone a bit unfamiliar

Sure, thanks. Thanks for having me. My name is Rob Hargis. I'm the president and founder of Crux Advisory

We're a small boutique advisory firm, largely crisis management, lots of focus on critical infrastructure, and lots of focus on Indopaycom

So you put all that together, and I think truth in advertising here, I was a guest up until a couple minutes ago

and good crisis management. I think we had some scheduling issues here

And as they say about good journalists, never become part of the news. My advice to all of you, and it's early in the day yet

but as a conference attendee, never become part of the program. So I appreciate the opportunity to fill in

And hopefully we can address the Venn diagram overlap of some cyber and some Indo-Paycom topics here today

So let's start a bit more broadly, 50,000 foot view, when you look at the broader challenges in Indo-Paycom

What are some of the most distinct and important realities that you would want more Americans to know about or pay closer attention to Sure sure I think we as many of you probably spent time in Iraq and Afghanistan and elsewhere what you would always tell the new folks coming into country is don

get complacent, right? Complacency is what kills. Looking at your telephone while you're at a

stoplight, not having situational awareness, those are the types of things that end up hurting us

And when it comes to Indo-PACOM, I think we're very focused on our daily life, day-to-day

not just in the national security community, in the economic community, in the public policy

community, but also in our daily life, and are we prepared for contingencies that emanate from

the Indo-PACOM region? If we're not thinking about that, it's the equivalent of not preparing

for hurricane season if you live in the Gulf states as we get into that time of year. You know

it's coming. You're not quite sure when. You're not quite sure what the intensity is, but it's

going to happen, whether it's this year or next year. So what I would urge people to do and what

I would urge professionals in this room to do is be a little bit of a disciple on having

critical awareness of those types of threats to infrastructure and to the dynamics of how

we live, regardless of the country you're from. I see some unfamiliar uniforms so I going to presume we haven changed the Army pinks again right here in the front So it not just an American thing It an Australian it a UK it a US it a Canadian It anybody that might get in the middle

most particularly between China and Taiwan. And I think what we're not fully aware of

are the non-kinetic threats and the non-kinetic preemption that will likely occur before a straits crossing

or an incremental blockade of Taiwan. And those are the things that I would do as a red team participant

And I spent a lot of time on red teams in a past life of the Pentagon where Sun Tzu said it best, I think, over 2,000 years ago

the greatest generals that ever lived, you've never heard of because they never had to go to war

They defeated their enemies through political, economic, and social means. And so a lot of what I do, a lot of what we do at Crux Advisory

is work with companies on critical infrastructure protection. We work with small and medium-sized cities, municipalities, and towns in the U.S., the U.K., and Australia

And we look at the threat vectors, the non-kinetic threat vectors, that we already see appearing and emanating out of the PRC And what I mean by that is you can go back over the course of the last two years plenty of public testimony on Capitol Hill from the FBI from SISA

about threat vectors and APTs, adaptive persistent threats, that are already inside of our critical infrastructure

And that would include what we call the typhoon series of adaptive persistent threats or threat actors

Volt Typhoon, Flax Typhoon, Silk Typhoon. Pick a typhoon. Some are inside of our ISPs, our Internet Service Providers

Some are inside of our critical public works. Some are inside a lot of our SCADA and OT technologies and IoT, Internet of Things

And what's occurring is, and as we're looking at these threat actors that are inside our critical infrastructure

They're not doing anything. It's a very unusual behavior. They are what we consider L-O-T-L, living off the land

So think about that crazy survivalist with the cabin up in the woods

He's completely disconnected. And you go, what's he prepping for? We have the equivalent of those threat actors already inside and proven, confirmed

There's lots of public testimony on it. It just hasn't really hit the general public yet