Pod Insights The Jedburgh Podcast #148: America's Grey War - Former Boeing Chief Security Officer and President of Hostage US Dave Komendat About this episode National security isn’t led solely by government entities and the military. Public-private sector partnerships often drive many of our national security decisions.
To dig into the importance of the private sector in defense of America, Fran Racioppi https://www.linkedin.com/in/francisracioppijr/ sat down with Dave Komendat https://www.linkedin.com/in/dave-komendat/; a 36-year Veteran of Boeing; one of the world’s largest defense contractors and a critical component of America’s economy.
Dave retired after serving as The Boeing Company’s https://www.boeing.com/ Chief Security Officer, where he ensured the safety and security of over 170,000 employees and $77 Billion in annual revenue.
Dave and Fran discussed how private companies partner with the US government, how security has evolved since 9/11, and how to build a culture of security in our companies and as a nation. They also break down the magnitude of Boeing, its impact on the aviation and defense industries, and the future of aviation security across a multitude of threats.
Dave is also the Chairman of Hostage US https://hostageus.org/, a non-profit supporting the families of American hostages and those wrongfully detained, as well as hostages and detainees when they return home. They take a few minutes to unpack hostage diplomacy and how America’s adversaries are using unlawful detention as a tool to compete with American power abroad.
Watch, listen or read https://linktr.ee/franracioppi our entire National Security series. Follow the Jedburgh Podcast https://www.instagram.com/jedburghpodcast/and the Green Beret Foundation https://www.instagram.com/greenberetfoundation/ on social media. Watch the full video version from Epigen Technology https://epigentechnology.com/in Arlington, VA on YouTube https://www.youtube.com/@jedburghpodcast as we show why America must continue to lead from the front, no matter the challenge.
The opinions presented on the The Jedburgh Podcast and the Jedburgh Media Channel are the opinions of our guests and creator and host Fran Racioppi. They do not necessarily reflect the opinions of the Green Beret Foundation and the Green Beret Foundation assumes no liability for their accuracy; nor does Green Beret Foundation endorse any political candidate or any political party.
Highlights:
0:00 Introduction
2:16 We’re in a grey war
5:52 The Chief Security Officer
7:33 Assessing risk
15:12 Public-Private Security Partnership
20:24 Starting as an intern
24:13 Building a successful team
33:05 Leading in a massive organization
37:15 Embracing a security culture
39:50 The relationship between safety and security
46:36 Duty of care
50:45 The rise of insider threats
55:22 Boeing on 9/11
59:15 Airplane cyber-security
1:04:23 Next generation of security leadership
1:10:34 Hostage US
1:20:00 Daily Foundations of Success
Quotes
“I think we’re in a grey war.” “The Chief Security Officer at most corporations is a thinker. They’re a strategist. They’re a risk manager.”“You can’t go into a CEO everyday and the sky is falling. You lose your credibility.” “Different leaders have different risk tolerances.” “Be empathetic with people doing jobs that don’t get a lot of fanfare.”“The longer I was in a leadership role, the more I valued when people told me ‘that wasn’t very good.” “We ran security like a business. We tried to demystify what we did.” “I didn’t want to be viewed as a necessary evil. I wanted to be viewed as a necessity.”“The worst thing you can do is deliver a product that’s already been compromised to the warfighter.” “If you only call people when you need something, you don’t have a relationship.”
Transcript 15,629 words · 2 speakers
Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.
0:04 Fran Racioppi? Welcome to the Jed Burke Podcast. I'm the creator and host, Fran Rochopie. Each episode, I speak with transformative leaders, visionaries, drivers of change, and those dedicated to winning, no matter the challenge. The Jed Burke Podcast is founded in the lineage of the special operations Jed Burke teams of the past, and is an official program of the Green Beret Foundation, supporting our nation's US Army Special Forces and their families. National security isn't led solely by government entities and the military. Private industry has significant influence on America's national defense plans, and public-private sector partnerships often drive many of our national security decisions. To dig into the importance of the private sector in defense of America, I sat down with Dave Kamandup, a 36-year veteran of Boeing, one of the world's largest
0:49 Fran Racioppi? defense contractors, and a critical component of America's economy. Dave retired after serving as Boeing's Chief Security Officer, where he ensured the safety and security of over 170,000 employees and $77 billion in annual revenue. Dave and I discussed how private companies partner with the US government, how security has evolved since 9/11, and how to build a culture of security in our companies and as a nation. We also break down the magnitude of Boeing, its impact on the aviation and defense industries, and the future of aviation security across a multitude of threats. Dave is also the chairman of Hostage US, a nonprofit supporting the families of American hostages and those wrongfully detained, as well as hostages and detainees when they return home. So we take a few minutes to unpack hostage diplomacy,
1:32 Fran Racioppi? and how America's adversaries are using unlawful detention as a tool to compete with American power abroad. Watch, listen, or read our entire national security series. Follow the Jed Burke Podcast and the Green Beret Foundation on social media. Listen on your favorite podcast platform, and watch us on YouTube as we show why America must continue to lead from the front, no matter the challenge.
1:56 Fran Racioppi? Dave, welcome to the Jed Burke Podcast. Awesome to be here. Thanks for inviting me. You spent your career assessing risk, the drivers of risk, and then informing leadership and making decisions based on risk in different Areas of the world. As you look across the world right now, what do you see happening in this global environment and why now?
2:16 Speaker 01 Thanks for the softball question. I appreciate it.
2:19 Fran Racioppi? I like to make it easy.
2:20 Speaker 01 Hey, I think where we're at right now is I think we're in a gray war. And for folks that aren't familiar with that term, it's really a conflict that is not kinetic. So you've got those near peers that we talked about China, Russia, North Korea, Iran, and others in the world that have taken advantage of the time that we spent taking care of that global threat on terrorism to build their own capabilities. And during that time, they've been able to create industrial capability in their countries, create technological capabilities in their countries, where they are now able to have an impact on this country.
3:02 Speaker 01 And some of it is visible and some of it is invisible. We know what's going on. Director Ray spoke about this several times over the past month where the Chinese have absolutely infiltrated the infrastructure of this country and have a capability, if they choose to do so, to have an impact. And those impacts could be very far reaching for the average person in this country. And I don't think most people really understand what that would look and feel like. To have a denial of service from electrical perspective, denial of service from a water perspective. You think about it when we all go through a windstorm or just a power outage in our neighborhoods. Four, six hours, people are losing their minds, right?
3:44 Fran Racioppi? Oh, yeah.
3:45 Speaker 01 Think about if you were going four weeks, six weeks before the grid was restored in your particular area, what would happen? Things break down pretty quickly in that setting. And so those types of capabilities with any one of those countries is a real possibility. And it's something that we need to think about. It's something we need to plan for. And from the private sector perspective in US industry, some of those gray war tactics are being deployed against US companies. Because those US companies create capability for the US government. The US government doesn't really build or produce anything. The private sector does it all for them. So whether it's intelligence, on platforms that are used by the military,
4:28 Speaker 01 other capabilities, that all comes from the private sector. So those countries leverage that. They know that, they know where things are built. And those companies, both overtly and covertly, can be targeted. And their capabilities can be impacted. So that has a real impact on the private sector. And we need to think about it. As a chief security officer, you need to understand, are you in one of those verticals? That would likely be targeted. And if so, what have you done to the extent possible with your company to plan for it from a business resiliency perspective? So it's, I think, a big time challenge out there. And there are a lot of folks that do think about it. There are a lot of folks that haven't given it any thought.
5:13 Speaker 01 And that's what's kind of scary.
5:15 Fran Racioppi? Well, let's dig into that definition of the role of the chief security officer a little bit more. It's, I think it's evolved, certainly over the past 20 to 30 years. In most organizations, what you see now is it's a senior leadership level. Whereas if you look back in the past, it was kind of an add on. Oh, what do they do? They do gates and guards, gates and guards. Can you talk about the evolution of the role? First, how do you define the role of the chief security officer? And then second, talk about the evolution of the role over the last 20 years.
5:45 Speaker 01 In the most simplistic terms, I always try to find little analogies. So it's the Ray Donovan of corporations, the fixer. If anybody's ever seen that show on HBO. That's really what the role is. And I'm, I'm being sarcastic, but I'm not. Whenever there's a major issue in a corporation, and it doesn't fit neatly into a particular basket. Take the pandemic, for an example. Those things have a tendency to end up with the chief security officer. And the question is, well, why does that happen? And the reason it happens is the chief security officer at most corporations is a thinker. They're a strategist. They're a risk manager.
6:26 Speaker 01 They have the desire to look over the horizon and anticipate what could happen. And then what would they do about it if it did? And so as these things occur around the world, I think senior leaders in the C-suite have seen that their chief security officers have been proactive and have come to them, sometimes well in advance of an incident actually occurring, and telling them, hey, this is something we need to pay attention to. This is something we need to invest in, and here's the why. And over the years, many of those predictions have come true. And so the confidence and the expectations surrounding a chief security officer have grown or risen to the point where you mentioned that it's a very senior position now in most corporations,
7:09 Speaker 01 reports up to a senior leader, and plays a significant role in that company's risk management process.
7:17 Fran Racioppi? When you talk about the classification of risk, and so one of the primary responsibilities of the chief security officer is to inform and provide that risk classification based on threats to senior executives for decision-making. When you look across the environment that you operate in, how do you actually assess risk and then provide that recommendation?
7:44 Speaker 01 Well, there are a number of ways you can do it. One of the ways that I used to do it was to look at, what are the things out there that would be most impactful to our people, our property, and our information? And then take a look at, once we understood what that threat landscape looked like, that was our inherent risk.
8:04 Speaker 01 What steps could we take to mitigate that risk? That would become our residual risk. What were we willing to do and invest in? And once we made those investments and made those decisions, what risk level were we willing to tolerate, right? And you've got those things that are high risk, low frequency. You have those things that are low risk and high frequency in your portfolio and you have everything in between. And it's a matter, it's a balancing act really. Because you can't go into a CEO or the executive leadership team of a company every day and the sky is falling. You lose your credibility. So you've got to go in with a strategy and the way you communicate risk and make sure
8:46 Speaker 01 that they know exactly what they need to know, when they need to know it, at the level of detail that gives them the opportunity to weigh in and say, I agree with what you're doing. I agree with the investment. I'm going to give you more money because I think it is a risk. I agree with that position and I want to help you. It's really kind of, for me, it was a learned skill. When I first started out, I didn't have what I would consider all those skills. And you learn them over time. And I would say that most of my peers would say the same thing. You come in with a thought process, a mindset, the way you assess and look at risk, the way you communicate it, the way you influence is a learned skill.
9:28 Speaker 01 And every corporation has a different culture and you have to understand and learn your culture and what's going to be effective. And when you go someplace else, completely different culture, completely different mindset, you got to relearn those skills all over again.
9:41 Fran Racioppi? When I was a young chief security officer, I learned some of those lessons the hard way, I think, as we all do. And I would have a tendency to fight every battle. And every time someone didn't agree with me, try to pin them down and say, no, this is why it has to happen. You have to do it like this without understanding sometimes the broader picture, the broader context. Someone who we both know very well, Ron Iden from Disney, once told me, you have to be willing to assume risk and have an incident sometimes if people don't agree with you after you've kind of beat them up about it. Because you can't go to the mat on every issue. Talk for a second about how do you accept that?
10:26 Fran Racioppi? And how do you, when someone tells you, hey, we get it? We're not going to do that, though.
10:31 Speaker 01 Yeah, I think it kind of goes against what you would think would be logical, right? You're like, well, we've got to mitigate everything. Well, that's impossible. You can't. There's only so many people. There's only so many dollars and you have to make the best risk decisions that you can. But I think the best way to do that is really to be transparent about what is likely? What's the likelihood that it's going to occur? What's the impact if it does? How will we react? What will our people say in the company if this were to occur? What will the public say? What will the government say? And all those have to be factored into that decision. And some of them are risks that you look at and you go, eh, we could survive that. It's, is it damaging? Yeah, is it a super big deal? No.
11:16 Speaker 01 Then there are other things where you just say, that's unacceptable, right? You just can't accept that risk. And so you do everything you can to try to mitigate it. But different leaders have different risk tolerances. And what I tried to do all the time was my pitch, if you were my CEO, would be, I'm going to tell you what the risk is. I'm going to tell you why I think it's a risk. I'm going to give you the information on it. You're the risk owner and you get to decide. I'm going to give you three or four options on what we could do. And I'll give you a recommendation, but at the end of the day, you're the risk owner and you need to tell me what you're comfortable doing and then we'll go do it. And so that was always kind of helpful to make sure that they understood that this wasn't just my decision.
12:00 Speaker 01 This was a collaborative decision we were going to make. And whether it was the CEO of the company, the CEO of a particular business unit, the boss of my division, didn't matter. Each one of those people owns some risk in some of these decisions we're going to make. And I think reminding them that they played a part in it, that it wasn't all me. I might be the execution branch of risk mitigation, but they're the risk owner. And so we've got to decide what are we going to do and not do.
12:29 Fran Racioppi? I think that is one of the most important aspects of leadership, just general leadership, is why do we have hierarchy in leadership? A lot of times, people will think, well, you have hierarchy in leadership because, you know, somebody's been there longer, or someone has to be in charge. It's not really about being in charge. Part of being in charge is your level of assumption of risk. And so as you elevate up a hierarchy in an organization, really what you're being asked to do is make a decision based on higher and increasing levels of risk. That's why you have hierarchies in organizations. And I think for me, that was one of the most important lessons that I learned and
13:10 Fran Racioppi? had to come to grips with was I'm not necessarily the one who's always going to have to answer this if it goes wrong because I've provided that input, but it wasn't my decision to make. So I have to be comfortable in that.
13:25 Speaker 01 And I think any chief security officer goes through that kind of growth and realization where there are certain things and certain decisions that you make as a chief security officer that you won't. They're your decisions. You don't need to ask anybody else. You're the subject matter expert in a particular area. And the expectation is you're going to make that decision. There are other ones that have a much broader impact. They have an impact to the company reputation. They have an impact to the company bottom line. And those are decisions that you can't make in a vacuum. You have to seek out the counsel and the approval of other leaders in the organization because, quite frankly, they are the ones that are going to be impacted. And you don't want to surprise them with a decision if, God forbid, you have a major
14:10 Speaker 01 incident and they're unaware of a position that you took and why you took that that has an impact on them. That's never a good day for a chief security officer. So you don't want to surprise people.
14:24 Fran Racioppi? I want to ask about the public-private partnership. One of the roles that we have as chief security officers is to embrace the private and the public sector relationship. I always took it a little bit for granted because I came from the public sector. So, working with organizations like the FBI was inherent in what we did. I mean, I worked very closely with them. There were multiple deployments, training, and I would forget that, well, this is not common in most organizations. You don't just get to walk into an FBI field office and have a conversation about security. But you do, depending on what company you lead their security operations for, because so many companies like Boeing, for me, when I was at Snapchat, you have information and
15:06 Fran Racioppi? you have risks and you have threats that are at the national security level. And so you have to create those relationships and build those. There's organizations like DSAC, we call it DSAC/OSAC, the Domestic Security Advisory Council and the Overseas Security Advisory Council. You've been very active in your career in both of those organizations. Can you talk for a minute about what are those organizations and why are they important? And why do we, as chief security officers, have to go out and forge those relationships?
15:36 Speaker 01 Yeah, I think both of them play really critical roles when you talk about public-private partnerships. So, let's start with DSAC. And the reason for that is because we're going to have the DSAC Annual Meeting this week in a couple of days. DSAC is comprised of the FBI and Homeland Security and around 749 US corporations. And the whole goal there is to help protect the economic infrastructure of the United States. And so, to do that, you've got to form this kind of trusted partnership. And the only way to protect those assets within the private sector is through information sharing. And you've got to build a trusted relationship.
16:15 Speaker 01 And that's, I think, always been the hardest part, is the FBI and DHS does critical national security work. They're out there every day protecting the citizens of this country, yet they have information that's really important. And on the other side, you've got the private sector, which owns 80% of the security infrastructure in this country. And you've got very qualified senior security leaders, many of which that have come from all different branches of the federal government. And there has to be a forum and a way for those two groups to get together, left of boom, and make sure that information's being shared effectively.
16:54 Speaker 01 And so the DSAC program started out in 2005 and has steadily grown to where it's at today. And is it perfect? Not yet. There's always that, that kind of push and pull on the private sector would like to have information quicker. And sometimes we're able to get it. Both DHS and the FBI are trying and finding ways to be more communicative with the private sector and they've come a long way. The meeting that we're going to have on Wednesday is a great example of that. A lot of information will be shared. OSAC, the Overseas Security Advisory Council, has been around for a long time, 40 years.
17:34 Speaker 01 And that was set up to help protect American interests and American citizens around the globe. And it's got thousands of people that are companies and individuals that are members of it. And same premise, it's about sharing the best information through the State Department with the private sector, NGOs, faith-based organizations, and educational institutions to keep all of those people that are involved in those entities outside the United States as safe and secure as possible. And it works really well. And so I think those two examples are the largest organizations by far, but there are
18:16 Speaker 01 a lot of grassroots, local, community-type, city-based organizations that do the same thing, that bring the FBI and companies within that special agent in charge's their area of responsibility together. And they have basically many DSAC meetings all the time. What's going on with local crime? What's happening here? What's happening there? The private sector is able to share what's happening within their own companies. What are the trends that they're seeing? And so that two way street is really pretty powerful. And I think post nine 11, it has made a big difference in the security, both within the private sector and helping the public sector really understand and leverage the capabilities that these companies have.
19:01 Speaker 01 You know, from the work you did, there's some pretty sophisticated intelligence operations within these companies nowadays with some really, really highly skilled people and some great tools that are out there that rival, in many cases, what our own government can put on the table. So when you pair those up together in an effective way, it's a pretty powerful tool.
19:21 Fran Racioppi? Let's talk about your career.
19:23 Speaker 01 Well, this will be brief.
19:26 Fran Racioppi? He's been 36 years at Boeing.
19:29 Speaker 01 One small correction, Boeing slash McDonnell Douglas. I started out at McDonnell Douglas.
19:33 Fran Racioppi? Who was acquired by?
19:34 Speaker 01 Correct.
19:35 Fran Racioppi? By, but what did you start out as?
19:37 Speaker 01 Well, I started out as an intern, actually. I was in school and finishing up in typical athlete fashion. I was an athlete in college.
19:47 Fran Racioppi? What'd you play?
19:47 Speaker 01 I played football.
19:48 Fran Racioppi? All right.
19:49 Speaker 01 And missed my internship, my junior year. So in a panic, I'm trying to find an internship. I was a criminal justice major and got connected with Douglas Aircraft in Long Beach. So I started out as an intern, did an internship with them for about six months, got brought on as a summer hire and then was hired full time. And I came in as what was called an entry level industrial security rep. So I was responsible at the time for when you got your initial security clearance, I would give you your security briefing, tell you all the things you couldn't, couldn't do, document control audits, all those types of things. So it was a very entry level, kind of cut your teeth type of role.
20:29 Fran Racioppi? And from there, you worked your way up?
20:32 Speaker 01 I did, but I had a lot of help. I had people in my corner all throughout my career that for some reason saw some potential in me and gave me some different and unique opportunities. Some at the time, I never understood why. I didn't necessarily like what I was being asked to do, but every one of those opportunities, every different role I took in the security organization, um, helped me. And what it helped me do throughout my career is. Be empathetic with people doing jobs that don't get a lot of fanfare in the security organization. The security officer, the firefighter, the lock and key person, the person in the badge
21:13 Speaker 01 room, all of those jobs which are really critical in the day to day infrastructure of a corporate security organization. Most people don't think about it too much. But when I ultimately was promoted to Vice President and Chief Security Officer of the Boeing Company, one of the things that I told myself, and I think I remain true to it with my entire career, was to never forget what it was like to do some of those other jobs. Because I didn't start out as a Vice President, I started out as an intern. And understanding what it took to do many of the jobs that were in the security structure at the Boeing Company, I think made me a better leader because I knew what it took. I knew that a lot of those jobs were hard.
21:58 Speaker 01 And when it would come time for budget, or when it would come time for reductions in force, I felt like I made better decisions because I knew what it would take to keep those organizations viable and what those people needed to do their jobs. So I was very lucky. I had a director early in my career at McDonnell Douglas who put us through kind of an in-house rotational program where we would spend a couple of months in different functions within our security organization. And I really got to learn what it took on the ground floor to get a lot of things done in the organization. And I always kept that with me. That was one of the best gifts somebody ever gave me from a leadership perspective was that opportunity. And so I tried to carry that throughout my career.
22:42 Speaker 01 I felt it was a really kind of important learning tool that I never wanted to allow myself to forget.
22:49 Fran Racioppi? Values are really important to organizations, especially when we're talking about the development of a culture and how do leaders build a culture in an organization. Special operations SOCOM uses these, we call them the soft truths, special operations, forces truths, there's five of them. You hit on number five. Number five is that most soft require non-soft support. So what do we mean? It's great to be the cool guy, it's great to be the pilot, the guy wearing the green beret, wearing the Navy SEAL trident, but at the end of the day, you don't get anything done without the backend support, the lock person, maintainers
23:30 Fran Racioppi? of aircraft and equipment, the communications folks, the weapons folks, nothing happens without those people. And so it's ingrained in great organizations to always be thinking about, this is a team effort. There's not an I here. And you might be, that's your job. Your job might be the one who's out there at the tip of the spear, where the rubber meets the road, but you didn't get there by yourself and you can't achieve your mission without everybody else.
23:58 Speaker 01 Yeah, I agree with you a hundred percent. And I think it's important that when you're a leader in an organization like that, that you reinforce that point all the time. We're one team. It takes everybody to make the team successful. You can't have one part of the team not performing well and expect everybody else to perform well. And I think it's also important to take time to recognize people, to dig deep in the organization and call people out. One of the opportunities I had was when I was there, I would do a regular webcast, usually once a month, once a quarter. And we would talk about what was happening in the organization, the good, the bad, and the ugly. And I would always leave about a half an hour at the end for people to be able to call in with questions, email us questions, and everything was on the
24:41 Speaker 01 table. No matter what we were going through, if I was allowed to talk about it, if I hadn't had to sign an NDA, I would talk about it. And I think that for me, one of the things about leadership that was important to me, and I learned this from a number of leaders that I had the privilege of working under.
24:58 Speaker 01 Leadership to me isn't that hard. It's about treating people with respect, being honest with people, being transparent and being humble. Because if people can see, and in a lot of these conversations, we talked about some really unpleasant things. We're very transparent about when we're gonna have to go through layoffs. And I would tell people, here's the target I was given. Here's what I did to try to achieve that target without impacting anybody's job. Here's the number of jobs unfortunately I have to impact. And it didn't make the message necessarily any easier. But I think people believed that what they were hearing was the truth.
25:40 Speaker 01 Because I want to, I remembered when I was a young security rep. I was in my mid twenties. Had been with McDonald Douglas for three or four years. And they were going through a difficult time. And I ended up on the layoff list. And I remember at that time, people walking by my little tiny cubicle and kind of putting their hand over their face. And nobody would really talk to me because they all knew I was on this list. And I felt like a mushroom, right? I didn't know what was going on. I'm a young kid. I've got a wife. I've got a kid. And I'm trying to figure out, am I gonna have a job? And ultimately, I didn't get laid off. But I remembered that feeling. And I remember that through my entire career. So when I got put in those positions where
26:24 Speaker 01 I was the one that had to deliver that news, I wanted to be as transparent with people as quickly as I could be. So that they knew what was going on. So they felt like they had some control. When I was in that situation, I didn't feel like I had any control. Because I didn't know what was going on. So I promised myself, I would never do that to people. I would make sure they knew what I knew, when I knew it. So they could make their own decision. Did they want to stay and ride it out? And take a chance? Or did they want to look for a different opportunity? So.
26:54 Speaker 01 Long answer to your short question, but I really think it comes down to just being respectful and honest and transparent and empathetic with people. If you can do that, you probably can be a pretty decent leader.
27:08 Fran Racioppi? Or in the people business, at the end of the day, regardless of what we do, we've got to take care of people. And communication, I think I hear you really talking about communication strategies too. When I work with organizations, I talk about the three components of communication where you have the sender, the message and the receiver. And too often, we as leaders will default to the first part of that, the sender. How do we feel when we send a message? When in reality, the most important part of any communication is the receiver. What feeling, what result, what action do we want to exhibit out of the receiver of this message? And when we start thinking in terms of that and put our own
27:53 Fran Racioppi? personal feelings and pride aside, because then we can effectively communicate with people because it doesn't matter how we feel. What matters is, is the person we're speaking to doing what we need them to do and feeling the way that we need them to feel. Because if they're not, then we haven't effectively communicated with them.
28:16 Speaker 01 I agree with you 100%. And I think what I did and what I always recommend to other leaders is you've got to find those truth tellers in your organization. So that when you deliver some type of message and you're spot on, I thought it went great, right? But you need those truth tellers to come back and either tell you, A, that was really good, and here's why. And these are people that are not impressed by the org chart, right? They're going to tell you what you need to hear, not what you want to hear. And I had several of those people that I grew up with in the company. That I knew always had my back, but would always be brutally honest with me. And so there were times where I thought a message had been well delivered. And I was informed pretty quickly afterwards, you missed the mark.
29:00 Speaker 01 There were other times where I thought it was like, not that great. And I got really positive feedback. But it's really important to have people on your team that are willing to come and tell you that afterwards. And that trust that you're not going to shoot the messenger, right? Because it's easy to get caught up in your own Kool-Aid. And you need those people around you that are going to come back and say, hey, that was spot on. We've got good feedback on it. Hey, you missed the mark and here's why, here's the impression that people got. Or, hey, it went okay. Good job. So having folks like that and being willing to take that input and not get defensive about it. Cause that's the other thing, you can ask people for input afterwards. And then if you defend yourself, you lose all that credibility.
29:45 Speaker 01 Nobody's going to give you any input.
29:47 Fran Racioppi? Yeah. Tell me how I did, but only tell me if I did the good.
29:50 Speaker 01 Exactly, exactly. And it's a hard thing to do. Nobody likes to sit there and, and be told, oh, that wasn't very good. Right? But I think at least the longer I was in a leadership role, the more I valued when people told me that wasn't very good.
30:06 Fran Racioppi? Well, inevitably too, there's less and less people who are willing to tell you when you're wrong, the higher up you go to.
30:12 Speaker 01 I don't disagree with that, but I think you can create a culture where people are willing to do that. If they can see that. They can give that feedback or others have given that type of feedback. And they still get raises and they still have a job and you still talk to them. Then they're like, hey, I'll, I'll take a shot. I'll tell them something and I think that's really important.
30:35 Fran Racioppi? Yeah. There's an aspect there too, that I talk about of autonomy. People want to know that their input's valued, that the organization doesn't necessarily need to be run the way they want to do it. It doesn't mean we throw out all of our policies and standards because someone doesn't agree. But people want to feel like they have input. People want to feel like they have a voice. And there's that, when they do their job, there's some level of them being able to do it in a way that they think actually works. And feedback is by and large, often one of the best ways to show that people have autonomy in an organization is when you're receptive to feedback.
31:15 Speaker 01 Agree 100%.
31:17 Fran Racioppi? There's a magnitude to Boeing, to, I had a chance to sit down with Rich Davis last year at GSX, and we talked about an organization like United and even Steve Bernard, who I spoke, I'll give him a shout out because I talked to him last night in preparation for this. And he was at Sony. I mean, these organizations are massive. And Boeing's one of the largest global aerospace manufacturers. When we think of airplanes, we think about Boeing, but they also make helicopters, rockets, satellites, missiles, and everything in between that runs those things, right? They're the largest exporter in the US. There's, I think it's about, it's over 150,000 employees
32:01 Fran Racioppi? right now, 77 billion in revenue in 2022. And yes, as we've seen time and time again, the airline industry writ large and the defense industry, but specifically a company like Boeing is a critical piece of the American economy and American infrastructure to the point that it's in that too big to fail box in a lot of ways. Talk about the magnitude of an organization like that. And when you come in and your job is to manage security in a global company of that scale, how do you prioritize? How do you manage that? How do you build a team that can do that?
32:39 Speaker 01 That's a great question. And in all honesty, I don't think I realized during my tenure kind of the size and scale and scope because I grew up in it, right? I'm a 36-year employee. And so you're living in that reality every single day. You get used to it. You get used to the size. You get used to the grandeur. You get used to the, just the immenseness of the corporation, all the different things that we do from services to products to information. And so it never felt overwhelming.
33:11 Speaker 01 Until I left and then you sit back and you start kind of reflecting on your career and some of the things that the organization did and some of the people and some of the really cool things that you can talk about, some of them you can't talk about. And then it sets in, it's like, wow, there aren't too many jobs in the United States, even in the world, where you have that kind of capability in your organization. $260 million your budget, over 2,000 employees, another thousand contractors, global reach. And it never felt that big. It felt like a team, it felt like a family. And it felt that way because we had really, and still do,
33:54 Speaker 01 they have some incredible talent within that organization. And I had some incredible leaders that I worked for that gave me the autonomy to go run my business. And we ran security like a business. We tried to demystify what we did. I think one of the biggest mistakes that chief security officers can make sometimes is they don't play well with their peers. I mean, their peers know that that's the security guy or gal. And I kind of think I know what they do. But I think one of the biggest mistakes that chief security officers make is that they're not effective communicators. They don't tell their story effectively. They don't talk about the value proposition that they bring to the company. They don't have metrics that support their budgets.
34:36 Speaker 01 And when you can sit in a business meeting and your charts look the same as the lady or gentleman running a P and L, and your briefings sound like it's just like any other business, you just happen to run security, that's a pretty powerful tool. And I think I was just lucky. I was just raised in that culture and that was all I knew. So when you step away and you look back, that's when you do kind of go, wow, that was kind of cool, kind of a big job. But when you're in the heat of the moment, it doesn't feel that way. It really doesn't.
35:10 Fran Racioppi? I think people forget in security that you're there to enhance the business, to help the business function. In a lot of ways, to make sure the business can function face with risk, face with threats, or when events happen, the resiliency piece kicks in and a lot of that falls to the security department. But often what you'll see is
35:33 Fran Racioppi? Security organizations and companies that operate as an impediment. They don't engrain themselves in the culture at the most foundational level. When you look at building a security culture, how do you get a company to embrace security as a foundational component of their culture?
35:51 Speaker 01 You have to be a business enabler. You touched on it a little bit. You can't be viewed as an impediment. You can't be seen solely as a cost center. Right? I used to tell every leader I worked for, and I went through a lot of different leaders during my career. I outlasted a lot of folks. But the first thing I would tell them is my job is to say yes, and here's how. Now, my how might be different than your how, but I'm going to find a way. You're going to give me an ask. And on very rare occasions, would I come back with a hard no? I would come back with a, we can do this. And here's how it can look. You can do it this way, this way, or this way. Which way would you like to do it? And that's how we would start that discussion.
36:34 Speaker 01 We would find that middle ground that worked for you and that worked for me from a risk perspective, from the perspective of keeping people safe or products safe or information safe. And I think it's really important that people view you as a business partner. It goes back to kind of that last question. If you want to walk around and be the corporate cop, can you do that? Yeah. Do people listen to you? Yeah, when they have to. But I always looked at it where I wanted people to view this organization as a necessity. I didn't want to be viewed as a necessary evil. I wanted to be viewed as a necessity. Hey, we've got to have security at the table. We're going to make this decision. We're going to build something here. We're going to launch a product there. We're going to send people to this location.
37:20 Speaker 01 Is security in the room? We're not going to make this decision without them there. That was the goal, to always have a seat at the table. And the only way you can do that is, is by creating those partnerships where people feel like you've got their best interests at heart, too.
37:36 Fran Racioppi? I can't talk about Boeing without bringing up some of the recent events that have happened in the aviation industry, but specific that have happened in the aviation division of the company. Forty-three percent of airplanes flying in the sky are Boeing made airplanes. Flying is the safest it's ever been. And I told you before we started, I wasn't going to ask you about maintenance and, and equipment and wheels and doors, because it doesn't matter for this conversation. Because What matters is the interrelatedness of safety and security. And a lot of organizations, they may fall under the same chain of command. Sometimes the chief security may also owe safety, depending on the scale of the organization.
38:17 Fran Racioppi? How do you work and build a positive relationship with a safety department? When you're running security in a manufacturing space like you're in?
38:25 Speaker 01 Super critical because there are so many similarities between the functions in certain situations. Right? At Boeing, I had the country's largest private fire department. And so we had EMTs responding every single day throughout the country to incidents that were occurring inside of our facilities. Those could be a workplace injury where somebody injures himself on a tool. Could have been a hazmat spill, could have been a small fire, whatever the case would be. But our partners from safety would always be there also. They would probably be the next on scene other than us. And in many cases, they would be responsible for conducting the investigation and making sure that whatever occurred was not repeated again.
39:10 Speaker 01 And we would assist them in making sure that they got all the information and detail that they needed to do that well. So I really looked at that relationship as a real necessity. We didn't want to, again, surprise each other. If something had happened, we wanted to make sure they were aware and vice versa. Because we knew for Boeing to be successful, our organizations needed to work effectively together. We were in the same vertical, but they had a senior leader also for the corporation. So really important to forge that bond at the top. So the teams below see that, hey, there's no gap in between these two organizations. All of our teams understand the expectation is if you see somebody from safety or on the
39:55 Speaker 01 other side, if the safety people see somebody from security and fire, that that's your partner and the expectation is you're going to collaborate, whatever the issue is.
40:04 Fran Racioppi? When faced with a challenge, Green Berets adapt, overcome, and keep moving forward. Now's your chance to stand with them. Join the 1952 Society with a monthly gift of just $19.52 to provide critical medical devices for wounded, ill, and injured Green Berets. Your support fuels their recovery, helping them return to duty or continue serving their communities. A Green Beret's mission never stops. Neither should our support. Join the 1952 Society today and stand with those who stand for us.
40:36 Fran Racioppi? I always put a lot of time into training security officers in safety-related tasks. Because safety by and large often doesn't have personnel spread throughout a campus or a facility, but security does. And so when we talk about workplace injury, workplace events, it's most often the security personnel who's the immediate first responder to those things. And then they're the ones who are calling EMS, they're calling the fire department, they're calling police or local law enforcement. And so I always wanted to assess and understand, okay, in each of my facilities, what's the response time? Because I don't need to train a security officer to be an EMT or a doctor,
41:20 Fran Racioppi? but I need to know, when I pick up the phone, it's seven minutes, it's five minutes, it's 15 minutes before I'm going to have a first responder here. So now I need to make sure that I've trained my security personnel to bridge that gap. Same for something like Active Shooter, right? When we, when we brought in armed security personnel at critical times. It was always, look, we're not going to handle the entire incident, but I know, because we would test it and bring law enforcement in and run those tests, I know I need four minutes. And can I have enough protection and security apparatus in place to get me to four minutes? I always thought that was important.
42:06 Speaker 01 I agree. And that's, you go back to how do you create trust and, and senior leadership in the company? And one of the things is being able to tell your story effectively and have the metrics to back it up. So within our company, when I was there, we could put an EMT next to someone going through a cardiac event within three minutes. So that was. From the time an employee picked up the phone and called the emergency number into our G-SOC in Mesa, Arizona, that G-SOC to dispatch the appropriate fire response at that site and that firefighter response team and/or security officer to be next to that employee was within three minutes. So why is that important?
42:48 Speaker 01 Well, it's important because if you're going to have a cardiac event and we would have a number of those at Boeing over the course of the year, you know, we have a tenured workforce there. The average age is mid to late 40s. Some facilities, it's older than that. Well, having an EMT next to somebody going through a cardiac event within three minutes gives them a 70% survival rate. Where if we had to rely on the local municipalities who have a six to nine minute response rate and then have to try to find them in our facility because they're not familiar with them, that drops down to less than 40%. And so the impact that that has on employee morale, when that team who is watching their coworker in distress
43:30 Speaker 01 sees those EMTs roll in and start to work on that person, using an AED potentially, doing CPR on them, and that person leaving the facility alive and coming back to work two or three weeks later, the impact on that team from a positiveness is immense. So those are the kinds of things where that helps you tell your story. Cause I used to be asked, well, why do we spend so much money on a fire department every year? Well, there's a million reasons why, right? I can talk about contractual language in air force contracts. We have to have standbys and all that. But the one that won all the time is we're going to have X amount of heart attacks this year and we're going to save Y amount of people.
44:12 Speaker 01 And that's the value of it. And I never had to have that argument with senior leadership. People got it right away. And you could talk to our CEO, several of them, and they could repeat that metric. And that's when I knew I won. When that little metric resonated enough with them where they would remember it on all the things they had to do every single day, all the different organizations in the company, they would remember that we will have a firefighter next to you within three minutes on average.
44:40 Fran Racioppi? I was saving it for later, but I'm going to bring it into the conversation now, duty of care. How do you define duty of care?
44:48 Speaker 01 You have a responsibility to take care of your people wherever they are, whether they're in your factory in Renton, Washington, or Charleston, South Carolina, or Philadelphia, or Shanghai, China, or in some forward operating base embedded with a special forces team supporting an activity in a hazardous country. You have a responsibility to make sure that when employee comes into work, that they leave the workplace in at least as good a condition as they walked in. And whether that workplace is 10 minutes from their home or three plane trips and 10 time zones away, you have the same responsibility. And we took that very seriously. That was one of the things that was really important to me. When we would put people in harm's way,
45:32 Speaker 01 because we do support special operations teams out in the field in countries all over the world, I made it a point to go visit those teams and see the actual conditions that they were living in. Who was protecting them? Was it US forces? That's a good thing.
45:48 Fran Racioppi? Sometimes it's not.
45:49 Speaker 01 Well, sometimes it's not, but it's many times better than third country guardian angels, where you walk in and you're like, I'm not so sure I'm comfortable with what I'm seeing right now. And yet you might have 10 to 20 people that are relying on that team, whoever it is, to take care of them and to make sure that they're going to come home. So I never bought into just getting a report. I always wanted to see for myself because I felt like if there was ever an incident in one of these countries, and there were, that I wanted to be able to look directly into that business unit leader's eyes and say, I've been there. This is what it looks like, or this is what we need to do differently. They need to do X. We're not doing that. And by not doing that, we have people at risk. So it's important.
46:34 Speaker 01 Duty of care is a major responsibility, not only for the chief security officer, but for every leader in a company.
46:40 Fran Racioppi? We saw a shift in kind of the definition of duty of care a little bit after COVID because we've changed a bit of the way that the workforce engages with the office environment.
46:53 Fran Racioppi? In our episode from GSX 23, so last year I had a chance to have this conversation with Kelly Johnston, somebody you know very well at International SOS. And we talked about where does duty of care end now? Because if you have employees who are working at home, they're not coming to the office, they're on Zoom calls all day. Where does it end? Does it extend to the somebody's home now when their workplace is their home?
47:24 Speaker 01 I would argue it does because we've given employees the opportunity to work virtually, but they're still our employees. And you know what the norm is? If you see somebody that for last two or three years, always on time, always got a spiffy shirt on or blouse on. And now all of a sudden, they're always late, they're never on camera. When they are on camera, they just don't look squared away. That should give people cause to pause and there should be a reach out to find out, hey, what's going on? When you have people physically come into the workplace, you have an opportunity to assess them. Right? You're sitting next to them for six, eight hours. And you have a chance to sit down and talk with them and you get a sense for what's going on. Maybe there's something going on at home.
48:09 Speaker 01 Maybe there's an issue with a coworker, but you get a chance to see that.
48:14 Speaker 01 You have to be a little bit more intuitive now, I think, from a duty of care perspective, when you've got a lot of people still working virtually. And the signs may not be as clear, they might be more subtle. And I think it's incumbent on all of us to take a look at those signs and go, something's not right. So we're going to dig a little deeper. We're going to have him or her come in. Or I'm going to meet him for lunch one day and we're just going to sit down and talk because I want to make sure everything's okay.
48:41 Fran Racioppi? As you're talking about that, I'm thinking about insider threat. Because as we define insider threat, we think about insider threat. The metric that is always talked about is the fact that it's the other employees who are often the first ones to identify that somebody has an issue for a lot of the reasons you just mentioned. Security is also involved a lot of times because you may have people who used to come in at the same time. They're badging at the same time every day. Now they're not, or they're trying to get into areas where they don't normally try to get into, or they don't have access to. And so there's people within the organization who can start to identify when something doesn't look right.
49:21 Fran Racioppi? An organization like Boeing, anything that works in critical infrastructure, these large defense contractors insider threat is a huge issue for many of the reasons you mentioned when we started that or countries like the Chinese have infiltrated a lot of our organizations.
49:37 Fran Racioppi? How do you look at and classify the insider threat risk that exists? And then when you think about programmatically developing something that allows you to understand what's happening inside your walls? How do you do that? How do you think about?
49:51 Speaker 01 Well, we were blessed because we had some senior leadership back in 2013 that was very open to having an insider threat program. We had a CIO at the time that was proactive and understood that we were no different than any other company, that we had these types of risks and activities going on within our fence line. And they were supportive of putting together a program that ultimately was led by our organization, the security organization, but heavily supported by the IT organization. And we had many different segments of the company that had representatives on a team that would help us.
50:30 Speaker 01 And we made some very significant investments in tools and capabilities to make sure that
50:39 Speaker 01 the technology that we were creating in the company, both for commercial and defense use, was not going to end up in other parts of the world where it shouldn't be. And we were very blessed to have an exceptionally, and they still have an exceptional program there. I can't go into the sausage making on it. But what I will tell you is it's world-class capabilities. And the results are that lots and lots of information has been prevented from leaving the company. Lots and lots of information has been prevented from ending up in some of those nation states that we talked about early on in their hands because of the investment the company made. The whole goal when we started the program was to not have a program anymore, was to
51:23 Speaker 01 create an understanding and a culture within the company where people understood that the information that was being created and worked on within the company was the company's. In many cases, it was critical to protecting the warfighter. And that that information leaving the company and going to an unauthorized and unapproved source could have really critical impact on on someone or a product. And the worst thing you can do is is deliver product that's already been compromised to the warfighter, right? He or she is depending on that platform, that system, that sensor, that communications tool to protect themselves or to execute a mission. And if it's already been compromised by the time it hits the field, people's lives
52:08 Speaker 01 are at risk. And so being able to tell that story internally resonates with people. The hard part is the vast majority of people, you know, you've got different types of insiders. You've got the people that are disgruntled and are intentionally going to do things. You've got the careless insider who just isn't very tech savvy and does something foolish and ends up exposing something. And then you have somebody that's just been socially engineered. They have no ill intent at all. They're maybe a little bit too trusting and they get socially engineered. So you've got to figure out what do you have when you identify a person of interest? What is their real intent? Was it a mistake? Are they intentionally trying to take this information?
52:52 Speaker 01 And over time, if you do this long enough, and we've been doing it a long time, you get pretty good at identifying what's going on. And you get pretty good at identifying who made a mistake and who's a real problem. And when is it time to pick up the phone and call the FBI?
53:08 Fran Racioppi? I want to ask about nine 11.
53:11 Fran Racioppi? All four planes that were involved in nine 11 attacks were Boeing airplanes. Nine 11, we all know, changed the nature of the world in every respect, but certainly advanced aviation security decades in one instant, immediately.
53:29 Fran Racioppi? Can you talk for a few minutes about specifically 9/11 and being a part of the company on 9/11 and then the immediate changes that you saw in how we actually build airplanes?
53:41 Speaker 01 Yeah, that's a great question. It was even more impactful to Boeing Company because we had three employees on the plane that went into the Pentagon and they were killed. So we knew early on that day, and in addition to everything else that was going on, that we had lost at least three employees. And we have people traveling all the time. So we weren't sure that we didn't have other people on some of those other flights. But 9/11 was obviously a seminal moment, not only for our company, but for many companies around the world. But when you look at aviation in particular, it was very clear that things had to be done differently going forward. And it starts from when you pull up to the curb at the airport to the time you sit down in the airplane. Every one of those kind
54:21 Speaker 01 of concentric circles of security had to be looked at, assessed, changed, and improved because it, obviously, it didn't work the first time around. Could another 9/11 type incident on an aircraft occur today that's passenger-led? Maybe, but unlikely, because I think we've already seen that the people will, will make a stand. There are a couple of things that really were enhanced. Obviously, the security of the cockpit door was an area that was worked on and significant improvements were made to that. But also to the security of the infrastructure of the aircraft. And what I mean by that is those airplanes are
55:03 Speaker 01 flying networks. And the amount of information that is moving around that airplane in-flight, the amount of information that's being transmitted to the ground and being received from the ground back and forth, that digital risk had to be addressed also because...
55:21 Speaker 01 There was a potential risk and threat associated with that. And so there have been many, many, many, many millions of hours and dollars spent on ensuring that that part of the aircraft is also safe. As a company, and not just with Boeing, but with Airbus and all the airframe manufacturers, that was such an impactful moment to have something that's really was built and developed, to move people around the world, to be able to go see friends and family and go on vacations and do something really special and making a meaningful connecting event, getting on a commercial flight and going somewhere.
56:02 Speaker 01 And to have them turned into really an article of war in the most horrific way possible was unbelievable. And I think from a company perspective, there was always the question of was it coincidental or intentional that it was all Boeing aircraft used that day? I have my own personal opinion, I'll keep it to myself, but I find it that it would be highly coincidental that it was. That my personal belief is it was intentional, it was a message. Boeing is an iconic US company and in a day of trying to attack many iconic things in this country, I think we were not a small part, but someone made an intentional decision,
56:47 Speaker 01 I believe. That's my personal opinion. It's never been backed up. If it has been backed up, I've never seen the information that says it has, but I would find it unusual that it was just by chance that it happened to be for Boeing built aircraft.
57:01 Fran Racioppi? You brought up the network, the flying network. Cause there's, I mean, modern planes and avionics, I mean, these things fly themselves.
57:10 Speaker 01 Everything is, everything. You think of, think of your Tesla, everything that you got.
57:14 Fran Racioppi? I don't have a Tesla.
57:14 Speaker 01 Well, I think.
57:18 Fran Racioppi? We fill up and we go.
57:19 Speaker 01 Yeah, there we go.
57:20 Fran Racioppi? But everything is networked and there's an incredible amount of data, as you said, coming off this. And we, we saw a lot of correlation over the last couple of weeks as we had the incident with the Francis Scott Key Bridge and the cargo ship Dolly in Baltimore, where they talked about how the network infrastructure on a cargo ship is almost nothing, especially as you, because we expect now, oh, well, you have an incident, transportation incident. Well, pull the black box. It's going to tell you everything that was going on and they're like, well, they don't have one. It's not like an airplane. I'm going to give you a conspiracy theory here to frame this up because.
57:54 Speaker 01 Do I have to answer it?
57:55 Fran Racioppi? You don't have to answer it.
57:56 Speaker 01 Can I take the fifth if I don't like the question?
57:58 Fran Racioppi? You can.
57:59 Speaker 01 All right.
57:59 Fran Racioppi? But then you can just parlay it back into the broader cybersecurity question.
58:03 Speaker 01 I'll give it my best shot.
58:04 Fran Racioppi? MH three 70.
58:06 Speaker 01 Yep.
58:06 Fran Racioppi? Disappeared over Southeast Asia in 2014. Boeing triple seven to date, the airplane has not been found. There are a lot of theories.
58:15 Speaker 01 Yep.
58:15 Fran Racioppi? Terrorism, pilot error, some sort of mechanical issue. One of the theories, and I would argue for me, the scariest one that I've heard in certain circles is that it was the target of a cyber attack. And that it was taken control of and taken somewhere or, or it was flown into the ocean. I don't need you to answer the question or what you think about what happened to it, but it brings up this question, this very real thought of the cybersecurity of the aviation industry writ large.
58:49 Fran Racioppi? Because we understand, especially up here in the Northeast, which is the most active outside of probably Europe, Western Europe, the most active aviation industry, you know, and routes in the world. What if somebody were to take control of the aviation infrastructure network and down several hundred airplanes all at once across the US?
59:12 Speaker 01 Well, if that happened, that would be a really bad day for a lot of people, obviously. What I would say, and I'm going to be careful how I answer this question for a whole bunch of reasons. I think it would be highly unlikely because there's been a lot of effort and energy for years put into making sure that that could never happen, both on an individual aircraft and systematically. All of the airframe manufacturers have aviation security groups that that is their job is to whether it's physically hardening the cockpit to looking at that onboard network and how that information flows on the network. What are the access points
59:53 Speaker 01 within the aircraft? How to protect that network? How is information encrypted and decrypted as it leaves the aircraft, hits ground stations, comes back up? All of those things, there's a lot of smart people that look at that every single day to make sure that that doesn't happen. And I would argue the aviation industry is not the only industry that would be potentially impacted by that. When you look at a cruise ship, a cruise ship is a another huge, large, floating data center. That's basically what it is. And you look at the size and scale of some of these ships now.
1:00:28 Fran Racioppi? Icon of the seas is.
1:00:30 Speaker 01 I'm not going to mention any names.
1:00:31 Fran Racioppi? Absolutely. That's ridiculous.
1:00:33 Speaker 01 But I've had this conversation with a CISO on one of the prominent cruise lines. We've had this kind of dialogue about the uniqueness of the products that we build and use because of how much capability there is. I'll just end it with this. I think it's highly unlikely. I have my own theory on what happened with 370 and it's not yours, but yours is okay. It's okay. But I don't believe that people should be worried that that is a possibility. I think that there has been an immense amount of effort put in to making sure that that's not a possibility.
1:01:12 Fran Racioppi? And you've been in the industry for a long time. For guys like me who got shotgunned into the industry out of previous careers in the military for myself and people coming from all sorts of federal.
1:01:23 Speaker 01 Yeah, but that previous career that you had, you know a lot of what's going on too. So let's not sell that short. Okay?
1:01:29 Fran Racioppi? It was a good time being there. And I've enjoyed being in the private security industry. But we've looked up to you, guys like me, I've looked up to you. We've looked up to Rich Davis and Steve Bernard and a lot of the reasons why they've been on the show because I, the best part is I get to go find those mentors and those folks who I've been able to have conversations like this with that I thought was impactful to share with a broader audience. What do you look for in the next generation of security leadership? Cause so much is evolving so rapidly. And you get to say you're quote unquote retired now, although I will tell you that you're probably busier than you were when you were not really retired. But what do you look for in the next generation?
1:02:11 Speaker 01 I will tell you, I, I wrote something today on LinkedIn. I think the next generation of security leaders is going to be fantastic. And I'm lucky because I have a son who's in the security industry and I've watched his career since he's gotten out of school and what he's been able to do very quickly, working internship at Microsoft, worked for a company called AECom, worked for Apple, now in a law firm. And he started out working in a business resiliency field. And now he's a cyber architect, self-taught. CISSP certified, took the test, had no formal cyber training. But young people today have such agile minds, they're agile thinkers.
1:02:54 Speaker 01 And I think that's one of the things in, we'll go back to the very first question you asked me tonight about, gosh, the world is just in this kind of poly perma crisis mode. What's going to happen next? And there are a lot of people that are more my tenure, that are linear thinkers in the security industry, and they have a hard time adapting to the frequency and the pace of change that occurs. And the time that I spend with young people in the security field and look at their agility, their mental agility, their ability to multitask and not be freaked out. When I say, hey Fran, yesterday I told you I needed you to work on this. And I know this morning I asked you to work on that other thing, but now I need you to do this.
1:03:38 Speaker 01 For some people that are more my tenure, that is a source of huge frustration for them. And it just, their mind explodes, they can't do it. For many of the people I see that are more my son's age, 30 ish, no problem. No problem. And they're still doing that with their AirPods on and listen to podcasts and do whatever they're doing. Their minds have been trained since the day they were born to be able to multitask effectively. And I think that that bodes well for security leaders. It's, you've got all these young people who can take all this information, process it, categorize it, risk evaluate it, and make decisions on where they're going to spend their time and energy. And I don't worry about it all. I'm excited about it.
1:04:22 Speaker 01 And I, when I go to some of these forums now and I see some of these newer faces and I talk to some of these people, they're so bright and they've got great ideas. And can somebody like me offer some advice and some experience and some situational awareness on things that have occurred? Yeah, but I just think the field is well positioned going forward. And it's such an interesting field. The one thing that we don't do well in this field, this is one of the things that we're working on through the Security Foundation, is most young people have no idea that corporate security is a great career path. We don't spend enough time at the high school level.
1:05:02 Speaker 01 We don't spend enough time in the technical schools to let young people know, especially young people that have a diverse background, that you don't have to be a cop. You can be in this corporate security field and these are six-figure jobs and they're long tenure jobs. And you can do so many different things with them. So that's one of the things that, that we're working on now is how do we go out and communicate effectively that here's a great career path that when you're 17 or 18, sitting in high school, trying to figure out, what do I want to be when I grow up? Right? Hey, this is an option for you and it's a great field.
1:05:41 Fran Racioppi? I agree with you. My daughter's a freshman in high school and we got an email a couple of months ago from the school to the parents and it said, we have a senior internship program. And if you have a company and you're interested in participating in the senior internship program, sign up. I immediately, to my, my daughter's dismay, signed up. And I signed up twice, one for the podcast, because I think journalism is important. We want to build that at the young level, but for my security company, for FR6, which I don't talk a tremendous amount about, especially on the show, because we do some critical, mostly critical infrastructure projects for government work.
1:06:19 Fran Racioppi? I said, I need an intern for a lot of the reasons you just said, because we've got to show people that this is such an important industry. It's only becoming more and more important. We got to train them young.
1:06:29 Speaker 01 I got to tell you, these interns that we've had over the last seven, eight years before I retired, we'd try to go and, and bring anywhere from eight to 10 in, we would put them in our cyber program. We'd go to historically black colleges and universities and be intentional about recruiting young people there and their freshman and sophomore year, and then try to hold on to them for two or three cycles of internship and then hire them. And we'd give them projects to do outside of their wheelhouse stuff. And at the end of their internship, we would create triads. So three of them would, would put on a presentation of something that they worked on. And I was constantly blown away by the presence that these young people would bring,
1:07:11 Speaker 01 by their thought process, and by what they were actually able to get done in a relatively short period of time. And so if you can tell, I'm super pumped about what's out there. We just need more of them. That's the problem. We need to let more people know, come join this profession. We need you. We need your thoughts. We need your energy. We need your talents and we just have to do better. We're not good at telling our story.
1:07:37 Fran Racioppi? In your non-retirement retirement.
1:07:39 Speaker 01 Working differently.
1:07:40 Fran Racioppi? Working differently. You're the president of Hostage US. I had the, I'll call it the honor. Several years ago, I sat in a meet in an event at Sony headquarters. I had first met Steve Bernard and he said, Hey, come down to this event. It was like that night I'd been introduced to him that morning. He said, Come down to this event. And I said, What's the event? He said, Hostage US. I've never heard of it, but I want to meet you. I'll come down to Sony. And I drove down from, I rode a motorcycle, so it was only 10 minutes, but it could have been an hour going from Santa Monica.
1:08:13 Speaker 01 White line.
1:08:15 Fran Racioppi? The only way to do it.
1:08:15 Speaker 01 There you go.
1:08:16 Fran Racioppi? And I showed up and up stands this author and he starts talking about his time as a hostage in Somalia.
1:08:28 Speaker 01 Michael Scott Moore.
1:08:28 Fran Racioppi? Michael Scott Moore. And as he's speaking, I'm listening to him and I'm like, and I know that story. And it had been about three years or so since I had left Africa. And I realized about five minutes into his story that I had been briefed on this guy every day for six months. Because one of my jobs in East Africa revolved around the understanding the environment and then developing capabilities for search and rescue. And Michael Scott Moore was on a ship and they would talk about him in the intelligence briefings. And I thought I was looking at a ghost.
1:09:09 Fran Racioppi? And he was home and told his story about 977 days where he was held captive. And immediately I beelined to him when the thing ended, I introduced myself and I said, listen, I, we talked about you every day. And I just want you to know, we were looking for you. You weren't alone out there. It may have felt like that, but we were looking for you. And he hadn't been home that long. And he said, I was the first person he'd actually met who'd ever worked on his case. And so we developed a great relationship from that point on and stayed in contact. And when I started this show, he was one of the first people I reached out to. I think he was episode nine is we talked about him.
1:09:52 Fran Racioppi? And then I got involved with the organization and started going to the annual reception, became friends with Liz and developed a relationship with her. And telling the story about what is the organization and what are they doing? And then we subsequently had on Jess Buchanan last year. Her and Liz came on together. We talked about really the organization, what it does, what its focus is. And then we told Jess's story. Similar, yet very different than Michael's.
1:10:21 Speaker 01 Yep.
1:10:22 Fran Racioppi? And hers, as we know, ends with a hostage rescue by SEAL Team Six. Michael was released, thankfully not for the 25 million they initially wanted, but you know, much, much lower number many, many years later. Tomorrow, we're going to talk to Jose Pereira. Totally different story, political prisoner. Every one of these cases is so different.
1:10:43 Speaker 01 Yep.
1:10:44 Fran Racioppi? About 200 Americans are taken hostage, kidnapped, political prisoner every single year. We have some that we've talked about in the last couple of years. Brittany Griner, the Wall Street Journal reporter continues to be held by the Russians. This is real and it's happening every day all over the world.
1:11:05 Fran Racioppi? Talk about Hostage US. Why is Hostage US important? And as in your role as the president, why do you continue to advocate for this organization?
1:11:14 Speaker 01 It's important because of the impact it has on not only the hostage or the detainees' life, but also their families. And you made mention of the number, and it's roughly 200-ish a year. And so for most people, they'll never know anyone or anyone's family who was a detainee or hostage. But for those people that are impacted by it, their lives have changed forever. They will never be the same, whether they were in captivity for three days or three years. Their life has been fundamentally changed. Their family's life has been fundamentally changed. And I came into the organization through a really unique circumstance that
1:11:57 Speaker 01 I was completely unprepared for. And if you give me a minute, I'll give you the 30 seconds.
1:12:01 Fran Racioppi? Yeah, please.
1:12:02 Speaker 01 I received a call a number of years ago from a colleague that was based in the UK and he told me about a hostage family that was based in Seattle and that one of their loved ones had been held by Al Qaeda. And the negotiations were not going well. The family was running low on money and needed some help, needed some assistance to continue the negotiations. And so, long story short, I got in the car that night after hearing the story. Didn't know anything about this young man. Grabbed my wife and I told her, we're gonna go operational tonight. You're gonna see what we do. And so, we ended up going into the U District in Washington State. And we delivered some money to this family to help them get a cellphone, another cellphone.
1:12:46 Speaker 01 They had run out of cellphone dollars. And, and so, delivered the phone and had the opportunity to meet for probably less than five minutes with the captive's younger brother and his mom. His mom was probably five or six years younger than my wife. She's quite young and looked 20 years older than my wife. And his younger brother looked shell shocked. So, gave him the money, gave him my business card and said, if you need more, call me. I'll come back tomorrow, the next day, however many days in a row you need something. And so, that was on a Thursday night. I woke up on a Saturday morning and I had a one-page, full-page email from a lady that you also probably know, Rachel Briggs.
1:13:30 Speaker 01 Rachel was the original executive director for Hostage US at the time. She was the executive director for Hostage International. And she shared with me that that night, early that morning, and I'm not gonna give the individual's name because his family's still dealing with this, but that during a rescue attempt, he and another captive were killed during the rescue attempt. Seals went in, a dog tipped off that they were on their way. And during the firefight, both the hostages were shot. And so, as the US person was being transported out on the helicopter, he was still alive. So, he knew that people had come to get him. That one did not have a happy ending. And unfortunately, a number of them don't.
1:14:14 Speaker 01 But that five minutes that we spent with his family, for both my wife and I, was kinda life-altering because I've never seen that kinda pain and despair in anybody's face before in my entire life. And so had the opportunity several months later, they decided they were going to open a chapter of Hostage International called Hostage US. And I was asked to join the board, which I did. And a year and a half later, I was asked to take over as the president, which I did. And I just find it one of the most meaningful things I do. And we are blessed with some amazing family support volunteers who work with these individual families. We are blessed with pro bono partners that provide medical help, legal help, financial
1:14:59 Speaker 01 help, things that people can't even imagine, not only for the family, but for the detainee or the hostage when they return. What's been really interesting in the last about four years is we've seen the paradigm shift. When I first took over, about 75% of the families that we were helping, their loved one was taken hostage and 25% were wrongful detainees. It's completely flipped now. It's about 90 10 where it's wrongful detainees versus hostages. And the reason for that is these governments use it as a political ploy now. It's a bargaining chip to be impactful with the US government. So it goes back to what we again talked about at the very beginning. It's a way to try to leverage policy and sentiment in this country.
1:15:42 Fran Racioppi? Yeah. One of the things that I found most interesting that you don't think about is and where Hostage US puts a lot of focus because there's the phases to this. There's initial detention, capture, whatever the circumstance is, then there's the new negotiation piece. Hostage US really focuses on the families during that time and not really involved in the negotiations. And then at the back end, assuming they're they come home, the difficulty that these folks have was beyond anything I could have comprehended. And I heard that from Jess, I heard that from Michael.
1:16:24 Fran Racioppi? Simple things like you have no money. You have no credit cards. Jess talks about things like your credit report, student loans. And there's actually no mechanism by which to just go into a system and fix your credit.
1:16:39 Speaker 01 Yeah, think about it. You've been gone for two years. You haven't filed your federal tax return. Right? And so your credit's ravaged and you fill out your tax. You call the IRS and say, well, I was a captive for two years. There's no box to check under your form to do that. Right? And because you talked to Jess, I'm sure she made this comment. Sure, she said, the hardest part is surviving survival. Because you had everything taken away from you. Everything, every bit of dignity, every human horrible thing that could happen to you. All your decisions are made for you. And then in an instant, it all comes back.
1:17:18 Speaker 01 And with the quickness in which we can get people back to their home country and in and out of the hospital. Three days later, you're back in your home, in your little community. And everybody's so happy to see you. And you're not ready for that. Right? You are just not ready and may not be ready for that for a long time. And most of the returning hostages and their family members will talk about the real challenges when they return and trying to figure out how to get on with their life. And the little things that you or I find either trivial or easy to do become monumental tasks emotionally and in some cases physically for people because they have no patience.
1:18:01 Speaker 01 They just struggle to come back. And many of them, most of them ultimately do. But they come back at different times. Some people, it happens relatively quickly. Other people have been back for years and they still struggle.
1:18:14 Fran Racioppi? I think one of the great parts too is you're building a community. In my work with transitioning veterans, we talk a lot about the community. You lose a community when you transition out. And so can we create a community on the outside of people who've gone through the same experiences? I think things like the annual reception, bring everyone together and give folks who've experienced these things, other people that they can talk to.
1:18:41 Speaker 01 Yeah, it's kind of a club you don't want to be part of.
1:18:43 Fran Racioppi? Yeah.
1:18:43 Speaker 01 Right?
1:18:44 Fran Racioppi? But you need, but you need some.
1:18:45 Speaker 01 Yeah, but if you have to be in the club, it's nice to know that there are other people that you can talk to. And I think that's one of the great things about what Hostage US is able to do is being able to connect people who are willing to have that conversation and share their experience and be able to tell someone, hey, what you're feeling right now, or what you're going through, it's normal. It's okay. I went through the same thing. Give yourself some grace. If you're having a hard time connecting with your family, or you're having a hard time reconnecting with your friends, and they actually are irritating you, that's okay. That's normal. It's nice to be able to have people that have lived that experience that can let you know that you're all right. Take a deep breath. You're
1:19:29 Speaker 01 all right. It takes time. You'll get through it. What you feel right now is a normal feeling. So it's unfortunate that we have to have an organization like this, but I'm glad we do. And I'm just thankful for the volunteers that we have, the sponsors that we have, the pro bono partners that we have, because they make such a difference in these people's lives.
1:19:50 Fran Racioppi? Well, I look forward to seeing everyone tomorrow.
1:19:52 Speaker 01 Yeah, we look forward to having you there.
1:19:54 Fran Racioppi? Last question.
1:19:55 Speaker 01 Okay.
1:19:55 Fran Racioppi? It's a test question.
1:19:56 Speaker 01 All right.
1:19:58 Fran Racioppi? Elite organizations, elite performers, those who operate at a high level, they always talk about habits, certain set of skills that exist that they routinely do. When we think about the Jedbergs of World War II, they had to be able to shoot, they had to be able to move, and they had to be able to communicate. Three common terms, especially if you come out of the military or law enforcement. But to me, those are foundational habits. If you could do those three things, if they could do those three things effectively without having to think about it. Then their attention could be focused on more complex tasks that came their way at any given day. What are the three things that you do every day to set the conditions for success in your world?
1:20:44 Speaker 01 Well, for me, number one is I need to take care of myself physically. So it's important every day before I start my workday that I do something physical because that has an impact, a positive impact on the rest of my day. And so whether it's treadmill, Peloton bike, treadmill, Peloton bike and weightlifting, I have to do that. If I don't do that, then I don't necessarily feel like I've done what I'm supposed to do for that day. So if I can get that out of the way first, get that physical element, it helps me clear my mind, it helps me kind of reset and gets me ready for whatever I've gone on that day. The next thing I think is just being able to take a breath during the day
1:21:26 Speaker 01 and take a pause and look around and be thankful for what you have. I've been incredibly blessed in my life with my family situation, where I live, what I get to do, the people I work with. And there are times where I never want to allow myself to take that for granted because it could be gone in an instant, right? So just being able to stop a couple times during the day and look out the window and look at the view I have, or get in the car and go to Costco with my wife because I can, right? And for years I couldn't do that, right? I can carry the waters in for stuff like that. That's important to me. And I think the other thing that's really important is I like to reach out to people
1:22:08 Speaker 01 unsolicited and just call them and be like, hey, what's up? I haven't talked to you in a long time. What's going on with your family? How's the job? What's happening here? What's happening there? Because I think that's important too, is to maintain relationships, grounding relationships. So many times we all build these relationships and they're purpose-based, right? I have to talk to this person because I work with them, or I have to do this because of that. And obviously, some of that's true with me too. But there are people that have been really impactful in my life, whether they've been a mentor, a coworker, a longtime friend, or just somebody I know might be having a hard time. And just reaching out and asking them, how are you doing? And it doesn't have to be a long conversation. It
1:22:52 Speaker 01 could be three minutes, it can be 15 minutes, but It's impactful to me in a positive way and I hope it's impactful to them too. So for me, well, not nearly as high tech and high speed is what you just shared. But at this stage of my career and my life, those are the things that are kind of important to me. And those are what keep me grounded and keep me going.
1:23:15 Fran Racioppi? I think those are great. I mean, physical care, take a pause, be thankful for what you have and reach out to people. I, I saw something the other day and it, it said that if you only call people when you need something, you don't have a relationship.
1:23:27 Speaker 01 Yeah. And we all know people who are like that, right? You see that number pop up and you're like, uh, cause you, you know, you know. And I'm sure a lot of people in the security community feel that way about me because I ask people for money all the time for different things that we're doing. But yeah, I think if you, a relationship has to be based on more than just, hey, I need some help. Right? That can be part of it, but I would hope that the only time I'm hearing from you, if that's the only time I'm hearing from you is when you need help. Then that's probably not the best situation, right? Doesn't mean I'm not going to help, but I'd like to hear from you more often.
1:24:04 Fran Racioppi? Yeah, I'll call you more often.
1:24:05 Speaker 01 All right. That's cool.
1:24:07 Fran Racioppi? Dave, you've been around the industry for a long time and like I told you before, there's an entire. You're not that old.
1:24:13 Speaker 01 I started young.
1:24:14 Fran Racioppi? You're not that old. It's true. But I told you that there's a lot of folks in the industry that look up to you. And you've mentored, whether you knew it or not, a lot of us, and we've learned a tremendous amount from watching you work.
1:24:29 Fran Racioppi? We're at a, I would say an exciting time in the world. Yes, there's challenges, but I think any generation faces their challenges and a lot of those challenges are known. Some of those challenges are unknown. And so it's incumbent upon us as security leaders to think about all of those things out there that may, may not happen. And what are we going to do? And how are we going to set the standard? How are we going to create the example, the model by which we're going to respond better, more than react to certain things. But if we do have to react to them, do we have a foundation that's been built? Watching programs and learning from programs that you've built at Boeing in your career, the work you're doing now at Hostage U.S. and through your consulting business,
1:25:14 Fran Racioppi? I think continues to motivate a lot of us. It certainly does for me. And I appreciate so much for taking the time to come down here tonight. I know you had a long flight, came in late, but you made it down here. And we were late too, so that's fine.
1:25:25 Speaker 01 It's been a real honor to join you on this. And yeah, it has taken some time, but it was time well spent and I really enjoyed it. So thank you for the opportunity.
1:25:36 Fran Racioppi? All right. We'll be in touch more often.
1:25:38 Speaker 01 Absolutely. All right. Thank you.
1:25:52 Fran Racioppi? American Jedbergs went on to form the foundation of the United States Special Forces and the Special Activities Director of the Central Intelligence Agency. Thanks for listening to the Jedburgh Podcast, an official program of the Green Beret Foundation. I'm your creator and host, Fran Richo. Join us next week for a new episode on Apple, Spotify, or wherever you get your podcasts. Check us out on YouTube for full episodes, highlights, and other long and short form content. If you like what you heard, give us a like and leave a review. Follow the Jedburgh Podcast and the Green Beret Foundation on LinkedIn, Instagram, Facebook, X, or Threads. Send your comments and inquiries to [email protected] . As former members of Special Operations Forces, the Jedburgh Media Channel and the Green Beret Foundation remain committed to supporting all generations of U.S. Army
1:26:33 Fran Racioppi? Special Forces and their families. Thanks for joining us on this episode. How you prepare today determines success tomorrow.
Previous Investing In America's Military Infrastructure: Jumping In With Arkansas Senator John Boozman Next #149: AIRBORNE - US Army Golden Knights Lieutenant Colonel Andy Moffit & Command Sergeant Major Adam Breeding (D-Day 80th Anniversary Series) Page updated November 5, 2026 · transcript and summary are machine-generated