Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Jim Langevin, former chair of the Congressional Cyber Caucus and Democratic Congressman from Rhode Island, reflects on his belief that cybersecurity remains a bipartisan issue. He emphasizes the importance of collaboration between government and the private sector, and the potential of artificial intelligence in enhancing cybersecurity.
Listen to the episode
S4 E3 · Cybersecurity as a Bipartisan CauseWE'RE IN! Podcast · 25 min
Key takeaways
Vulnerability disclosure needs a real response Langevin says white hat hackers mainly want a robust vulnerability disclosure program at every agency and business, and to know someone will answer and actually fix what they report.
Lawmakers need technical staff He has no technical degree and relied on expert staff; he wishes every member of Congress had a staffer who understands cyber policy and can brief them before votes.
Bipartisan work created the National Cyber Director The National Cyber Director position passed only because of cooperation among the Cyberspace Solarium Commission, Senators Angus King and Mike Rounds, Mike Gallagher, and Langevin.
Cuts without review set cyber back Langevin supports finding efficiencies but warns that cutting CISA budget, staff, and state and local election security funding with a chainsaw rather than a scalpel moves cybersecurity backward.
AI skills now shape hiring He cites findings from Governor McKee's AI work that well over 60 percent of employers would hire someone with AI skills and less experience over someone with more experience and no AI skills.
Notable quotes
Cybersecurity is not just government's responsibility. It's not just the private sector's responsibility. It's a shared responsibility…
…you don't have to be smart enough to have all the answers, you just have to be smart enough to know where to go and get them, and so you surround yourself with really bright people.
Without the people and the resources there, we're going to be taking a step backward on cybersecurity, not forward.
…we need to apply this with a rational approach and a surgical approach using a scalpel as opposed to using the sledgehammer or the chainsaw…
Questions this episode answers
Why did Jim Langevin attend DEF CON as a member of Congress?
He was invited and believed it was important to engage with the security research community, since cybersecurity is a shared responsibility. He said many white hat hackers just want someone to listen and act on what they report. Read this section
Is cybersecurity still a bipartisan issue?
On balance, Langevin says yes, pointing to his work with Republicans like Will Hurd, Mike Gallagher, and Senator Mike Rounds, and with independent Senator Angus King. He worries that too few lawmakers are taking a leadership role. Read this section
What does Jim Langevin think of the cuts to CISA?
He is troubled by cuts to CISA's budget and personnel, especially funding for state and local election security. He says that without people and resources, cybersecurity takes a step backward. Read this section
Why does the 2015 information sharing law matter?
It removed legal barriers that kept companies from sharing threat information over fears of collusion or anticompetitive claims. Langevin says it never fully reached its promise but helped, and he wants it reauthorized soon. Read this section
What advice does Jim Langevin give young people interested in cybersecurity?
He tells them many jobs are still unfilled and that, as digital natives, they have skills they may not realize. He encourages them to pursue cybersecurity while also learning to use AI. Read this section
About the guest
Jim Langevin is a former Democratic congressman from Rhode Island and former chair of the Congressional Cyber Caucus, who chose not to seek reelection in 2022. At the time of recording, he is distinguished chair of the Institute for Cybersecurity and Emerging Technologies at Rhode Island College, a strategic advisor for Paladin Capital Group, a policy ambassador for the National Organization on Disability, and chair of Rhode Island Governor Dan McKee's AI task force. He served on the Cyberspace Solarium Commission and championed the creation of the National Cyber Director position.
Is? We're in. You testing the security of your applications the way an attacker would? If not, why not? Synack is now FedRAMP moderate authorized, giving government agencies added support to build security testing that advances cyber resilience and zero trust goals. The Synack platform gives cybersecurity leaders a clear view of exploitable vulnerabilities with its penetration testing and managed responsible disclosure programs, all supported by the Synack Red Team of vetted security researchers. To learn more about Synack's FedRAMP moderate authorized platform for testing internal assets, head to synack.com. That's synack.com.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer. And joining me today is congressman Jim Langevin, former chair of the congressional cyber caucus and democratic lawmaker from Rhode Island. Jim, thank you so much for joining.
Now I wanna jump right into the political side of things. You chose not to seek reelection in 2022, which feels like two political lifetimes ago. Seeing how congress is currently operating, does that leave you breathing a sigh of relief?
Well, let me just say, both for me personally and professionally, it was the right time to leave. I was able to leave on my own terms undefeated. While I was young enough and healthy enough to do other things, I I wanted to start a next chapter. And and I I I left for me at the at the right time. I'll put it that way.
I was gonna say, I I see you've taken on a number of advisory and mentorship roles since leaving congress. So in addition to serving as distinguished chair of the Institute for Cybersecurity and Emerging Technologies at Rhode Island College, what have you been up to?
I'm doing some work with the disabilities community. I served as policy ambassador for the National Organization on Disabilities. The NOD's primary mission is to increase employment opportunities for people with disabilities. I'm also a strategic advisor for Paladin Capital Group, which invests in early stage technology companies, especially with cybersecurity and artificial intelligence, so busy there. Then I'm advising a handful of companies. It's been an interesting and a great next chapter, especially at Rhode Island College. We are helping to educate the next generation of cyber professionals and cyber defenders in a field that is vastly under resourced, where there are thousands of jobs in Rhode Island that go unfilled in cybersecurity right now, and there are, by conservative estimates, over a half a million jobs in cybersecurity that go unfilled nationally, and that number is only expected to grow.
That's fantastic. And, yeah, you mentioned the the the cybersecurity talent crunch that we have. I know that was an issue that certainly drew your attention well in the in the halls of congress. In fact, you were, I believe, if not the first and certainly among the first US lawmakers to have attended the the DEFCON cybersecurity conference, which listeners of the podcast are no doubt familiar with. But why did you go there?
Well, I I went to DEF CON because first of all, was invited, and I I also believe that it's important to engage with the cybersecurity research... Researcher community or the hacker community as by... Known by by other names. Cybersecurity is not just government's responsibility. It's not just the private sector's responsibility. It's a it's a shared responsibility, and really, we need to work together to make the Internet more secure, and we obviously know that the internet was never built with security in mind. We kind of layered security or tried to, you know, on top of this open architecture, this free and open architecture, and I found, you know, over the years that there are many white hat hackers that really just want someone to listen and to work with to try to make the Internet function the way it was originally intended. And the cybersecurity researcher community is allowed to offer, and they just want to know that if they find something that they can report it and someone's going to do something about it.
So I thought it was a great opportunity to engage. My staff obviously briefed me on DEF CON and said, this is something you should do. And Yeah. Was able to do a number of things in terms of... Spoke out there and then met with a number of people that that attended DEF CON.
Now hacker culture has its own kind of ethos and way about it. What what does it mean to be a hacker friendly member of congress? I've seen you styled as a, quote, hacker friendly member of congress.
Well, again, like I said, it's about willing to to listen to people that are trying to do the right thing. People like Josh Corman, who founded I Am The Cavalry, and... Because Jeff Moss has engaged with policymakers as well from Black Hat. And I think there's a number of other people over the years that I've had the opportunity and the pleasure to to meet. And it means that we're gonna partner where we can in terms of making the system better, work better, programs like the hack the Pentagon program that Ash Carter put together, and that was a... I I think it was a a wonderful example of how government, private sector, and white hat hackers can partner to find vulnerabilities and then report them, getting them to mediate it. And I think we need to continue to do more to engage in collaboration and finding pathways where we find vulnerabilities that can be recorded.
I looked at it as a partnership, so I know that probably one of the things that most white hat hackers would like to see is a robust vulnerability disclosure program at every department and agency, at every business, let's say, and a way to report vulnerabilities when they're found and then know that they're, you know, someone's gonna pick up the phone, answer the phone, answer the email, and actually respond and do something about closing off the vulnerability.
That's a really good point because I know that's been a huge source of frustration for well meaning hackers over the years if you just get absolutely the phone slammed on you, the email's gone unresponded to, and here you might be sitting on something that an actual bad actor could exploit and and use to their advantage and to the detriment potentially even of US national security. It's... You know, that's a hugely important issue. I'm glad that you you called that out. Now we talk about DEFCON. It's not always the friendliest turf in a way. I mean, I think sometimes hackers like to give, especially politicians, a hard time about, you know, technical know how, maybe grill you a little bit on whether you know all the zeros and ones and what's what's working. But what's something that you wish every member of congress, you know, however fair or unfair that reputation might be of, like, not understanding the techie side, but what is something that you wish everybody understood about cybersecurity? It doesn't have to be technical. Just just some facet of the issue.
Well, that we... Obviously, everyone knows we rely on the the Internet every day. We use the Internet now every day. Computers are... Use computers as a way of life. And certainly, I I wish that all policymakers, whether it's in Congress or at the state local level, took cybersecurity much more seriously and made it a priority. It is true that, you know, what the white hat hacker community will say in terms of members of Congress may not have the technical know how to engage in really strong cybersecurity themselves as individuals. I buy one, for example, I don't have a technical background. I got my undergraduate degree in in political science and public administration. I had a minor in economics. And I got my Master's in Public Administration. So I don't have a tactical computer degree, but I know cyber policy, I know how to make laws, and my grandfather's old device was, you don't have to be smart enough to have all the answers, you just have to be smart enough to know where to go and get them, and so you surround yourself with really bright people.
And I was fortunate to have really bright and talented people that did know the technical aspects, both cyber policy and cybersecurity, how computers were. So you you... I wish every member of congress had someone on their staff that that is a technical expert, understands cyber policy, it would help make a priority. So as as as bills come up for consideration, or for hearing, or votes on the floor, that that they'll have a member of their staff that can do the deep dive on the research, and properly brief the member, so that the member of congress is making an informed decision. And that's how lawmaking works, right? Like, I know that members of congress have to know a little bit about just about everything, but nobody knows everything. You know, you have to rely on the the talented people you have around you to make sure that they are doing the deep dive and then can synthesize it down to what the member can then, you know, know are the pros and the cons, and read the bill, read the legislation, and then make an informed decision.
Well, and not to harp on it too much, but I think that's why there was a sense, certainly in the cybersecurity community, that your visit along with former representative Will Hurd, a Republican out of Texas, to DEF CON was pretty momentous in the in the sense that it was somewhat of a uniting of the policy side and the techie know how hack into things side. You know, I think they were tinkering with voting machines one of the years you were there and trying to find vulnerabilities to to protect the security and integrity of US elections, which is no small task. There's this sort of DC adage that's accepted that cybersecurity is somehow this this magical bipartisan issue, right, that everybody likes cybersecurity. Is that still true? Is cyber still bipartisan? And and how have you seen the ground shift on that front during Trump's second administration so far?
So so on balance, I still do think that cybersecurity is a bipartisan issue. I was, of course, thrilled to be able to go out to DEF CON with Will Hurd, and he and I still remain friends and friendly, even though he and I have moved on from Congress and are doing things in the private sector now, but he was one of the early voices that we need to do more about cybersecurity. And by the way, Congressman Mike McCaul, congressman Mike Gallagher, two other Republicans that I worked with, Dutch Ruppersberger on the Democratic side was someone I worked closely with, and a number of other people. So it was bipartisan then, and I still believe it's it's bipartisan now. Not enough people that are taking a leadership role on cybersecurity, but I know, thankfully, senator Angus King is still there. I served with him on the Cyberspace Solarium Commission. He's an outstanding United States senator, an independent, and and looks for ways to find the bipartisan counter Brown on both cyber treaty and and other important issues facing congress.
Senator Mike Rounds is a Republican congress... Senator that that took an interest in cyber. Both senator King and and senator Rounds were extremely instrumental in helping to get a bill across the finish line that I had championed for for about a decade, and that was the creation of the National Cyber Director, a Senate confirmed position with the executive officer of the president, and without the leadership, the the Cyberspace Solarium Commission, and Senator Kings and the Rounds and Mike Gallagher and myself all partnering together in a bipartisan way, that legislation wouldn't have made it across the finish line. Now have a national cyber director and executive officer president. So
Such an important role. I mean, for those who don't know kinda how the sausage gets made in the executive branch, like, having a point person designated to an issue like that is so critical to get it the attention that it deserves. It's not easy to find callouts for that if you don't have that sort of central resource and and person to go to.
I hope that that role, it will continue to grow in importance, whether it's the Trump administration or or future administrations, and I hope that cybersecurity remains... It remains a a bipartisan issue. I am concerned about the cutbacks I've seen at, for example, at CISA, the Cybersecurity Infrastructure Security Agency, another agency that I help work on, work to create and strengthen, and properly resourced over the years. And unfortunately it's taken a turn CISA's budget and personnel were cut, and especially there was a cutting of funding for things like election security to state and local governments. That's really troubling, that's concerning, because that's a resource that was being used to close off an aperture of vulnerability that existed. Know, I've often said that we'll never be 100% secure, there's no such thing as perfect cybersecurity, but we can close down that aperture of vulnerability to something that is much more reasonable than it is today, and newer technologies like artificial intelligence, of course, will help to do that, but you still need the people, right, to do lot of the work, and you can have all the great policies and technologies in place.
Without the people and the resources there, we're going to be taking a step backward on cybersecurity, not forward. And that's... I'm troubled by the cuts to CISA's budget and personnel.
That's been... Know, I live in Capitol Hill in DC, and and obviously, you know, the Department of Government Efficiency, that's the talk of the town here. The the CISA cuts in particular, I will say, have been a little bit of a head scratcher for me too, mostly because I'm remembering CISA was stood up under the first Trump administration. So I I... Maybe it's naive of me to think that there might be some sort of desire to... For continuity there a little bit. But, no, really good points. And I I I guess big picture, looking even beyond CISA, how are you gauging Doge's impact on agencies writ large with the hand in cyber? Because, obviously, it's not just CISA.
Well, first of know, DOGE is looking for efficiencies. They're looking to to cut out government waste or redundancies. I'm all for that. If we can if we can do it in a, you know, a thoughtful, deliberative way, I I think it's can... Maybe there's going to be some positives that come out of it, but we need to apply this with a rational approach and a surgical approach using a scalpel as opposed to using the sledgehammer or the chainsaw, sweeping aside years of talent and, you know, dedicated people and programs before you actually had a chance to actually do the deep dive around what's working, what's not, and how can we bring efficiencies and get a better bang for the buck for the taxpayer. I'm all for that. And especially on on cybersecurity programs, maybe there's too much stovepiping, and we need a more enterprise type approach to cybersecurity so that we've got better situation awareness and and, you know, information sharing more effectively.
Right. And then often when you take that approach, we've seen this play out too where you might need to even rehire or sign on... Sign some of the contracts back again after nixing them. And Exactly. It's... It'll be interesting to see how it plays out. And what will you be looking out for the next couple years of Trump's second term here?
Well, again, where are we going to strengthen our cybersecurity efforts? How are we going to do that? How are we going to protect the .net network more effectively? How are we going to protect the .gov network more effectively? And how will we partner with the private sector, and state, local, tribal, territorial governments to make sure that they are more secure as well. We're in this together, and we want to make sure that we have the right focus, and talent, and programs, and resources in place to make us as cyber secure as possible. And again, it is a partnership. No one has all the answers, and I don't know if there's going be a more of a shift toward state and local, as you know, you take on more responsibility, but if we're going to do that, then how are we going to resource that? We need to make sure that the state and local government is a properly resourced, and CISA, of course, nobody's in charge of protecting the .com world.
We don't have a general or a director sitting on .com directing that certain vulnerabilities need to be closed off. The American people, of course, wouldn't want that level of intrusion in their private networks, so I'm mindful of protecting privacy and civil abilities. But again, you need to have that partnership, and wherever government can bring in resources or can information share more effectively, we need to do that. So what I will be looking for, case of point number one, is that the Information Sharing Act of 2015 is for reauthorization, I believe it's in September. Now I understand that secretary Kristi Noem has called for reauthorization of that information sharing bill when she was at the RSA conference. I'm hoping that that act gets reauthorized sooner rather than later, and not wait till September to do it, but that was a hard fought piece of legislation to get across the finish line, because when I first started in cybersecurity, one of the things I said, well, okay, if we...
Since there are vulnerabilities, when cyber attacks are going on, we need to just share that information broadly at network speed, so that everybody is protected, and then you find out that, well, the corporate lawyers say, not so fast, we're not sharing information because we don't want to be accused of collusion or anti competitive practices, so there was a number of things that we had to do to make sure that we were protected. So we passed the information sharing bill, and that was what we thought brought down a lot of barriers to... In the legal blocks in the road for information share. Unfortunately, it didn't... It never really came out to be the panacea, the whole... You know, the... Realized the full promise that I really hoped that it would, but it it did help, and we wanna continue that the ability for for companies to information share so that we are more secure.
Right. At minimum, breaking down, like you said, some of those liability concerns that large corporations might have and making sure that everybody's operating with some of the same intel is still better. Certainly better than no protections in place at all and no no act of twenty twenty fifteen. Mentioned earlier, I did wanna circle back to the AI point. I I just... You just kinda flicked at it that this is, you know, obviously, it's kinda mandatory to talk about these days. And certainly in your in your role at road... At Rhode Island College, I imagine that's coming up a lot with students and with, you know, people wanting to stay at the forefront of these emerging technologies. How do you see generative AI and, you know, these agentic technologies that seem to be the buzzword of the day affecting the balance of of cyber offense and defense?
Yeah. Like like with any new technology, I see AI really enhancing cybersecurity, and there's gonna be a lot of upsides that relate to AI. But like with any technology, you know, the bad actors will also take advantage of it for their advantage as well, and and they're going to use it to find ways around cybersecurity protocols that are that are put in place. We just hope that there's more of an upside than downside, but I think that that that AI, we're already seeing it, that AI can detect anomalies much more quickly than than it had been in the past. It can analyze vast amounts of data, So hopefully it will make cybersecurity more effective. If you think about the concept of digital twinning, which is a virtual model of a physical or virtual system, and if you are able to monitor a network in real time and see anomalies as they're happening, that in and of itself should help the things that need to be acted on most quickly.
So I'm hopeful that AI will bring a lot of of good things, but we have to prepare for the downside. I'm actually chairing the governor's AI task force right now, because governor Dan McKee wants Rhode Island to be well positioned to take advantage of the upside of AI, but again, protecting against its downside.
Right. Right. And as with any new technology, there are gonna be vulnerabilities introduced. There are gonna be adversaries leveraging it, as you mentioned. Kinda TBD. I feel like I I always ask that question of who's it gonna help more attackers or defenders? But I I think the jury's still out, and it's still a little too early to tell. But it's it's always interesting to hear perspectives on that. Now this is obviously a cybersecurity podcast. We've spent some time talking about CISA and hackers and cyber policy making, but your tenure in congress was marked by... And and in state government before that was was marked by action on a a range of issues, you know, health care, environmental protections, accessibility, and advocacy for people with disabilities. You mentioned that briefly at the outset. What's an issue outside of cyber or tech or AI that you wish cyber practitioners would would pay more attention to or or that they could benefit or learn from?
One of the things we're doing at at Rhode Island College is we offer a a major and a minor in cybersecurity, but we also offer a major and a minor, two minors in artificial intelligence, and one of those minors in artificial intelligence doesn't require, it's not a technical degree, it doesn't require a technical background, it's actually applications of AI. So we're looking kind of holistically across any field, whether it's in the medical field or in education, financial field, how can you use AI tools to be effective at your job, and to be more productive, and you know, take out the mundane aspects of doing a job that may be a lot of, you know, and a boring, a dead entry, but AI will help to automatically populate a lot of the information for the employee. So I I would like to see more people being proactive about upskilling, and that's what we hope to be able to facilitate.
It's one of the findings in the governor's AI task force. We're also gonna be offering credentialing programs. One of the things that we'll do, we're offering credentialing in cybersecurity right now to help people get their foot in the door. So it doesn't require, let's say, a two or four year degree to get into the field of cybersecurity. Getting a credential will get you on the path toward hopefully a good paying job, and and we'll do the same thing with artificial intelligence as well. But you're looking at things like k through 12 education. It's gonna be important both for the teachers and for the students to understand how to use AI, and those are things that I'm working on right now as well.
This segues into an issue that you spoke to briefly earlier, but I wanted to circle back to, which is that notion of the talent gap, right, and getting people, whether k through 12, onward into higher education, interested and engaged in a cybersecurity career. Now,
course, there's so much market uncertainty. You're seeing the private sector slow down in some respects. There have been changes in government functions and agencies and cuts. What are you saying? If somebody comes to you and says, congressman, I I am interested in a career in cybersecurity, a young promising student, what do you what do you say to them?
Well, there was still a lot of jobs that go on field... In the field, and and I would tell young people, especially today, don't overlook the fact that you're growing up as a digital native and understand technology far better than someone say like myself, who I've had to kind of grow up learning about computers as I've gone and look back and say, okay, how does this technology work? Where kids these days take to technology like fish to water, and they have skills that they probably not even aware that they have, but it's just intuitive for them. And so I would still encourage people, I still do to encourage them to look at a field like cybersecurity, also harnessing the skills of artificial intelligence. It's going to be increasingly important in the job market going forward to be familiar with AI. One of the statistics that we came across in our work on the government's AI commission, Governor McKee's AI commission, is the fact that well over 60%, I think it was in the upper sixties percent of employers were...
Are more likely to hire an employee that has some AI skills, but less experience over an employee that has a lot more experience but no AI skills. AI is going be increasingly more and more relevant as a skill to have and to master, and you don't necessarily have to have a degree in it, but you have to be familiar with how to use the technology and and be effective at it.
I'm trying to integrate it more into my workflows and daily life as well. It... It's a whole new skill to learn. And, yeah, I I appreciate your point. Don't underestimate that if you're coming into it as a digital native and and have just been, you know, using these apps and AI tools. I've had an 18 old, and it's kind of alarming. I I don't even... We try to shelter him from technology and phones as much as possible. But if he gets his hand on a phone, he already knows how to swipe. Where did you pick that up? How did you learn that? It's it's really amazing. So finally... And thank you so much for your time and insights today, congressman. But we we do have a question that we ask all of our guests on the podcast, which is what's something that we wouldn't know about you just by looking at your LinkedIn profile?
they competing? I hope so. I love both. So... Yeah. Yeah. So that's really... That's definitely... That's not on my LinkedIn page, so... But I'm I'm a huge Star Wars fan. So... Yeah. That's that's good.
