Maria Vermasas (2:57)

That's exactly it. Because that, that was the conversation we had when we got back was when you go to something like this, because you are effectively, we were standard stuff. You're handled, you know, like, we were escorted at all times. Of course, this is not shocking or anything like that. This is just standard procedure. The narratives that you are shared, the things that you are told, this is what they want you to know. And there's a reason they're telling you this. There's a reason they're communicating this all with this. So for us, it's like you can try to read between the lines, but it's also doesn't have to be that complicated. It's like they're specifically a story that they're communicating to the world. And to me, it was like a message of coherence. Like that's the other C. That wasn't maybe said, but it was like they're trying to convey a sense of, yes, we're doing these three Cs of what the collaborate, cooperate, coordinate. But it's also that they're a coherent alliance that is working together. And again, two months later, here we are going is it. But at that time, it certainly seemed that way, or at least that was what they were trying to project. And I would love for it to continue to be that way. We are continuing to work together. We are continuing to share information in ways that make sense for our respective nations. Not everything's gonna be shared all the time, but what can and should be will be shared with expediency. And we want you to know that. And we also want our adversaries to know that. And it's like that. I mean, we understand our job as being the media is like, that's the story that they wanna tell. In a way, we're a conduit for that. Whether or not people sign on to that is not our thing. I mean, we have no way of saying, yes, they were successful in that or not. But this is what we were able to see. This is what they shared with us. And this is the message that they wanted us to know that they wanted to convey. Yeah, take that for what you will.

Liz Stokes (4:44)

Yeah, that's exactly what I was telling my family exactly when I was coming back and they were asking me, what did you go over there for? I was like, well, we went over there to interview NATO and have them tell us what they really wanted us to know. And that's exactly what we did.

Narrator/Host (Maria Vermasas) (5:04)

To a regular person who doesn't live and breathe cybersecurity, sometimes the stakes can seem a little bit abstract.

Maria Vermasas (5:11)

Sure.

Narrator/Host (Maria Vermasas) (5:11)

When systems come to a crashing halt, that much is obvious and unavoidable. But a lot of the time it's an IT problem with IT solutions. So just let it handle it right. But yeah, systemic society wide crises like what estonia experienced in 2007 can happen to anyone, anywhere. And certainly a lot of smart, hardworking people are training to prevent that from happening. But that threat is the undercurrent of so much of what drives the work being done at the NATO cyber range. And it's funny that. What did you go to do and see over there? Question was one that Liz and I both got from a lot of people in our lives after we came back. And I think maybe it was disappointing to some folks that we didn't have flashy stories about some crazy cutting edge high tech to share, nothing bonkers to blow people's minds. Instead what we saw was actually, dare I say it, kind of mundane. But it being mundane is to me what made it so important that a massive international organization like NATO has devoted a place and serious time, two weeks remember to getting people together to get better at something to me is notable. Yes, military organizations train news at 11, but think about it, they are still taking two weeks out of their day to day operations to train. Despite the impact, they see the value in taking that time to refine their communication and coherence in the cyber realm. How many private sector cybersecurity organizations can say the same?

Liz Stokes (7:06)

So Maria, I know that you and I have been producing this together for the past, what, two months now. We've been scripting, writing everything. We've been trying to put into words exactly what happened while we were over there. How has it been going for you? What are your thoughts on things? Do you have anything that you'd like to share?

Maria Vermasas (7:26)

Yeah, I mean we've touched on sort of the meta challenge, for lack of better terminology, of geopolitics seismically shifting underneath our feet as we came back from this trip. It's now early January and now suddenly the United States position in NATO is extremely in question. And also the United States is threatening its own allies. Like how? I mean, just on a personal level, I'm just trying to make sense of this all and I'm aghast, for lack of better term. I mean, scared as hell, shocked, confused, angry. Like I'm feeling all of these feelings and this is just me and my, my read of that situation while trying to think, okay, I'm trying to tell this story about these incredible people that we met from so many NATO allied nations, trying to be, you know, not too emotional about it. But I mean, I can't lie, it was a very affecting visit seeing all those people working on these incredibly difficult problems. Working on cybersecurity defenses for a whole bunch of different countries, but also coordinating with their teams back home that we couldn't see, and knowing that these are the people who are either working on keeping their country secure or working with the people who would be doing that, Both of which is extraordinarily hard and in many cases, both at the same time. Coming from the corporate cybersecurity world, I know even within a corporate situation, these are extraordinarily hard problems. But when you're talking about military and civil network defense, critical infrastructure defense, this is the stuff that nobody gives any credit to, nobody thinks about until it fails. And of course, it's always under resourced and it's so crucial for human life. So it's just like that whole duality of this is the stuff that keeps civilization going and yet nobody knows about it. These are like our unsung heroes. It's like meeting those unsung heroes, right? And of course, they're all very humble about it and they're all very modest. And I want to make sure that as I'm scripting their story, that I'm giving them the respect and gravitas, if that's the right word to use here, that they deserve. There were so many unsaid things, you could feel the weight of it. That's, I guess the thing I've been struggling with is you could feel the weight of how important their mission is. I could feel how serious it was for them. And I've met many defenders in my day in the cybersecurity realm, but this was a different echelon. Even though this was an exercise, I

Narrator/Host (Maria Vermasas) (9:58)

can only begin to imagine what they're

Maria Vermasas (10:00)

dealing with in their day to day and the stakes for them. And then being in a country that is on the border with Russia, you know, a nation that is pretty adversarial right now, the stakes are really explicit and just like they're right there, the people, especially in Estonia. This is very life or death for them. I mean, think about how many times we saw the Ukrainian flag flying, right? It was everywhere. The Ukrainian flag colors were absolutely everywhere. I mean, this is life or death. It really, really literally is. And I guess for me it's like, am I communicating the stakes well enough? Am I, am I getting across that this is not just some, you know, if we get hacked, maybe some of our PII gets breached. Not great, but, you know, nobody's gonna die. That's not the situation these folks are dealing with. These are people who are dealing with literal life or death stakes. I felt that when we spoke with them, and it just felt heavy to me, but, like, you know, somebody's got to deal with it.

Narrator/Host (Maria Vermasas) (10:56)

Right.

Maria Vermasas (10:56)

And I'm just. I'm wondering to myself, am I doing a good enough job in communicating that I don't know.

Unidentified Field Reporter/Participant (11:10)

So I'm not sure if this is

Narrator/Host (Maria Vermasas) (11:11)

a good idea right at the moment.

Maria Vermasas (11:12)

Maybe we should proceed somewhere else.

Unidentified Field Reporter/Participant (11:17)

Let's go down the street this way. Should we go down this way?

Liz Stokes (11:25)

I was just making sure.

Maria Vermasas (11:26)

Do you want to go down that way?

Unidentified Field Reporter/Participant (11:32)

Are you still recording? Okay, so the situation is we are in the center of Tallinn Old Town, and we. You just turn down a side street very close to the Christmas market, and the Russian embassy is right there. And the fence right in front of the Russian embassy is absolutely plastered with protest posters, handmade, all of them protesting the Ukraine war. Messages like, stop killing people, Putin has blood on his hands, things like that. And it's very significant to me also that every other visible flag immediately on the edges of the embassy are very proud Estonian flags held open in defiance. Again, it just drives home the stakes that we've been talking about the last few days. And for many people, these kinds of things are theoretical, but here it's not. It's very real. But otherwise, life goes on. And it's an otherwise ordinary street in the part of Old Town looks like all the rest of them, except when you turn that corner, that fence is.

Maria Vermasas (12:45)

And that.

Unidentified Field Reporter/Participant (12:45)

The Russian flag, of course, right above it tells you exactly what's going on. Yeah, there was an armed guard that came outside as we were sort of standing in front of it, because, you know, we were standing there with our backpacks and a whole bunch of gear, and I'm sure we probably looked super suspicious.

Maria Vermasas (12:59)

So we were like, we're gonna get a move on.

Liz Stokes (13:01)

Now.

Narrator/Host (Maria Vermasas) (13:07)

When Liz and I chit chatted with our hosts during our visit, whenever we mentioned that we really had been enjoying our time in the Old Town, inevitably people would drop their voice to a whisper and ask, did you happen to go past the Russian embassy? Did you see what was going on there?

Liz Stokes (13:23)

Happening upon the Russian embassy in the middle of their Christmas market was probably one of the things that, like, threw me the most, because I was not expecting to see, you know, 20 Ukraine flags on the surrounding embassies just in solidarity with what was going on.

Maria Vermasas (13:41)

And it makes sense, given Estonia and Ukraine's history, like, they're brothers.

Liz Stokes (13:44)

You don't realize it until you witness it firsthand, which is exactly what we did.

Maria Vermasas (13:48)

Yep. I Mean, it's like one of those things that I knew, I've known. But when you're actually on quite literally the front lines where, especially where the cybersecurity attack happened, the 2007 attacks, right, where they just, they know. Everyone just says 2007. Everybody knows what you're talking about.

Narrator/Host (Maria Vermasas) (14:04)

Right.

Maria Vermasas (14:04)

Estonia knows. Estonia knows. Well, how much higher the stakes are.

Liz Stokes (14:10)

I mean, only after us researching that heavily did I even fully GRASP what the 2007 cyberattacks did to Estonia. And I think again, it's like one of those things where you have to kind of, you have to witness it firsthand.

Narrator/Host (Maria Vermasas) (14:25)

Estonia is fiercely determined to keep their independence and their solidarity with Ukraine, a fellow former Soviet republic, is obvious from the moment you step off of the plane. The Ukrainian flag is absolutely everywhere in Estonia, as I mentioned a bit in previous episodes, and it often flies at the same level and equal honors as the Estonian flag. Skyscrapers were lit up yellow and blue. Even city tree Christmas lights were solely in yellow and blue Ukrainian flag colors. People in Estonia understand very well that whatever happens to their Ukrainian brethren could very well mean them next. Estonia is also very proud of being part of NATO, aside from seeing NATO's flag flying proudly on flag poles and the like. Even when I was at Tallinn airport heading home, I saw a pin souvenir that featured the Estonian and NATO flags. Actually, I still have it here on my desk, still in its cellophane. I don't think I've ever seen the NATO flag with that level of prominence in a tourist tchotchke shop before, right next to the keychains and the fancy chocolates. And honestly, I'm trying to remember the last time I saw the NATO flag flying anywhere in the United States. While we often say cybersecurity is a global borderless business, that might be easy to say when your adversary is not literally right next door when you are in Estonia, it's just about impossible to forget that the stakes are a mere 210km away at the Russian border. Estonia as a former Soviet republic became independent with the fall of the USSR in 1991. The legacy of the Soviet years are fading in this uber modern tech forward nation. But the physical reminders that from the languages spoken to the Soviet era buildings, and yes, sometimes even the statues, those physical reminders, they are still there.

Maria Vermasas (16:41)

What would you like people to take away from it?

Liz Stokes (16:43)

It's a great question. I mean, I definitely want people to learn the history again. I sat there for hours after we got back learning, ingesting My whole flight

Maria Vermasas (16:55)

over and back, I was reading so much. Yeah. Hours and hours.

Liz Stokes (17:00)

And I don't, I mean, you guys don't have to do that. That's what we're here for. But I think you should learn about what happened because not that it's never going to happen again. It can happen again.

Maria Vermasas (17:10)

It probably will. You're right.

Liz Stokes (17:12)

Yeah, it probably will. And you know, it's like in ways

Maria Vermasas (17:15)

that we can't imagine.

Liz Stokes (17:16)

Yeah, it's the age old thing of, oh, it's never going to happen to me. Well, you never know.

Narrator/Host (Maria Vermasas) (17:20)

Yeah.

Liz Stokes (17:21)

Honestly, just learning about that history, kind of taking that into consideration and learning about what NATO now does to kind of help protect these allied countries is something that I want everybody to take

Maria Vermasas (17:35)

away of to me, in addition to what you said, because you're right on, you are absolutely right on. The thing that I walked away with, and maybe this is also because this is what NATO wanted me to walk away with and I will totally fess up to that, was that when I think of cybersecurity in general, I'm not going to say, you know, the technical problems are fixed now. It's like wildly not correct. But for years the emphasis has been on just, you need the shiny tool, you've got this problem, we've got a tool to fix it. And it was really remarkable to me that NATO was not focusing on that. Like, there was a tool that they showed us about, it was vsic. CISC was the hardest acronym to say ever.

Liz Stokes (18:17)

It is a very, this is a

Maria Vermasas (18:18)

beast of an acronym. But they were really all about humans talking to humans, humans understanding humans, humans understanding how to work with humans. It's like, okay, the tools are really tertiary at best. It was how do we communicate to each other, how do we understand what each other needs. That's interesting to me that we're going back to really the core human problem and solution of working together. And an alliance needs to be good at that. And I mean, that's kind of the core of what it is, what it means to be in an alliance.

Narrator/Host (Maria Vermasas) (19:01)

The North Atlantic Treaty, better known as NATO and its official text was written on April 4, 1949. We have to think about how different the world was back then, well before the Internet was even a glimmer in DARPA's eye. Cybersecurity was added in as a domain of expertise to NATO in 2017, with space added in 2019. By the way. Certainly the nature of warfare has changed a lot, as have the broader geopolitical contexts, especially since Russia's invasion of Ukraine in 2022 and US President Trump's re election in 2024. Just a month after coming home from the NATO exercise, the future of the United States role in and with NATO seems profoundly uncertain. And putting all of my own personal and political viewpoints on that aside, the idea of leaving an alliance like NATO from a cybersecurity perspective really gives me pause to say the least, effective defense and offense are always stronger as a collaborative, cooperative, coordinated exercise. Remember those three Cs that Commander Kaplan kept saying? How can you possibly maintain any kind of advantage over adversarial activity when no one's sharing information with you, nobody's catching your blind spots, nobody's covering you when you inevitably hit a language, cultural, mindset, process, technological, you name it barrier. If you consider the United States to be ahead of the game in the cyber realm, and sure, many of us do genuinely, how long do we think a technological head start in cybersecurity possibly could last if we're basically going it alone? Two months after my trip to Estonia, all I can think about is the many wonderful people that I met in Tallinn and the many Ukrainian flags flying high and proud next to the Estonian flags and that NATO flag pin at the airport and everything that is at stake, explicitly and implicitly. When an alliance, when promises aren't kept, when trust is eroded slowly and then seemingly all at once, when defense is not cooperative, collaborative or coordinated anymore. It's definitely not cohesive. And at a certain point it won't be very effective either. With the stakes being as high as they are, this won't be just a problem for our most elite of cybersecurity defenders. It will become everyone's problem. Thank you for listening to this third episode of our three part series. We do have a little bonus that we'll be dropping in the podcast feed for you. That's my audio Reporter's Notebook with clips that I recorded while in Tallinn walking around or freshly out of the skiff or at 4 in the morning trying to get the coffee machine to work. If you are interested in the more unfiltered experience from this assignment, the Reporter's Notebook is for you. Think of it as a bonus.

Maria Vermasas (22:45)

Episode 4 if you will.

Narrator/Host (Maria Vermasas) (22:47)

This episode was produced by Liz Stokes, mixing, editing and sound design by Trey Hester. Our Executive producer is Jennifer Ibin with content strategy by Mayan Plout. Peter Kilpe is our publisher and I am your host, Maria Varmazes. Thank you so much for listening.

Zero Trust World Event Promoter (23:29)

Most security conferences talk about zero Trust. Zero Trust World puts you inside. This is a hands on cybersecurity event designed for practitioners who want real skills, not just theory. You'll take part in live hacking labs where you'll attack real environments, see how modern threats actually work, and learn how to stop them before they turn into incidents. But Zero Trust World is more than labs. You'll also experience expert led sessions, practical case studies, and technical deep dives focused on real world implementation. Whether your Blue team, Red team, or responsible for securing an entire organization, the content is built to be immediately useful. You'll earn CPE credits, connect with peers across the industry, and leave with strategies you can put into action right away. Join us March 4th through the 6th in Orlando, Florida. Register now@ZTW.com and take your Zero Trust strategy from theory to execution.