Meet the NSA’s hacker recruiter

Published Wed, Oct 1 201411:06 AM EDTUpdated Mon, Oct 6 20143:25 PM EDT

The National Security Agency has a recruiting problem.

Rocked by the Edward Snowden disclosures and facing stiff competition for top talent from high-paying Silicon Valley firms, the nation's cyberspy agency is looking to recruit a new generation of college hackers and tech experts. And through one new program, the agency is cultivating students as young as eighth grade.

For the NSA, the explosive growth of the Hacking Economy means today's students have far more employment options than a generation ago–and the agency has to adapt to a changing workforce's expectations.

National Security Agency headquarters, Fort Meade, Maryland

Source: NSA | Wikipedia

The man the NSA has turned to for help solving its recruiting problem is an avuncular 32-year NSA veteran named Steven LaFountain, who has been tasked with building up a "cybercurriculum" for tech-savvy students at 20 to 25 American universities–and making sure a steady flow of top minds continues to go to work for the nation's technical surveillance agency. Officially, it's known as the Centers of Academic Excellence in Cyber Operations.

Recently, CNBC sat down with LaFountain in a conference room at NSA's National Cryptologic Museum, next to the agency's sprawling headquarters in Ft. Meade, Maryland, to talk about recruiting in the post-Snowden era. Surrounded by artifacts of cryptographic history from the American Revolution through the code-breaking efforts of World War II to the earliest supercomputers, LaFountain explained how he's trying to bring in the tech-savvy minds that NSA needs to stay competitive in the future. He defended his agency–and downplayed the impact of the Snowden disclosures on this generation of technologists.

What follows is an edited transcript of that conversation.

CNBC: So explain the impact of the Edward Snowden disclosures on your ability to recruit.

LaFountain: Actually, I don't think it's been damaging to our ability to recruit talent, in that many of the students that I talk to, anyway, that I interact with, they're interested in the tech. Right. They're not bothered by, let's say, the politics of things like that. They're interested in the technology. They want to get into cybersecurity. They want to learn what we do here.

CNBC: Are the students you're recruiting aware of Snowden?

LaFountain: Oh, absolutely. How can you not be?

CNBC: What's the reaction to it?

LaFountain: Well, I typically don't talk to them about that. I'm talking to them about what exciting things they can do here from a technical perspective. And it rarely comes up, to tell you the truth, in conversation with them.

CNBC: How do you prevent yourself from being the guy who recruits the next Edward Snowden?

LaFountain: That's a good question. We have other processes … security process that look into backgrounds and polygraphs and all that, and hopefully that will prevent that. You know, when I'm recruiting, I'm looking for the technical talent. I'm looking for the people that have the right mind-set that question things. That don't just say, 'That's how it's supposed to work, so it works that way.' You've got to question: 'How can I get it to do things it's not supposed to do?' That's really what the whole cybersecurity business is about.

CNBC: Post-Snowden, the analysis was that part of the challenge for the NSA was that this generation of technologically-savvy students shares a different ideology than previous generations of boomers and Gen-Xers. These young folks today are much more libertarian, they're much more of the information-wants-to-be-free mind-set. So are you finding a different mind-set among the 20-somethings that you're recruiting now?

LaFountain: There certainly is that mind-set out there. And it's been out there probably all along; it's just more prevalent and more prominent today. More noticable. But there are lots of students out there that I think aren't bothered by the politics of things. They do understand the need to protect information. Some people will always believe that there's a conspiracy, but you know there is a need to protect information so that the government and the agency can do its mission.

CNBC: How did you feel personally when you saw the Edward Snowden disclosures?

LaFountain: I was probably a little ticked off, I'd say, because I believe in what we do here at the agency and I understand the reason why we have to protect the information that we protect and the things that we do—you know, the mission we have to perform to protect the nation. And so anything that I think goes against that, that might damage that, of course it kind of would upset me. It might upset most people.

Our people need to understand that, okay, so you can't go and do that in your personal life, right? You can't do that against family, against friends, against neighbors. You've got to still be a model citizen in cyberspace.
Steven LaFountain
National Centers of Academic Excellence in Information Assurance/Cyber Defense

CNBC: Do you think there's a sense that the people inside the NSA have been motivated by Snowden on his side of the argument? There's been talk that now there is a second leaker inside the NSA putting out stories to Greenwald and others. Do you think there are people here who say, 'He's right about some stuff?'

LaFountain: I've run across a few people in my career that sometimes might question things, but in general, no. I think everybody really firmly believes the mission we do and that we're doing the right thing. We're doing it within the authorities given to us by our laws and our government. And so we're doing what is best for the nation.

CNBC: How tough is it for you guys to compete with Silicon Valley? I imagine that for your top tech and mathematical students in the country, there's just an enormous draw to go out and participate in the gold rush going on out there and to get paid enormous amounts of money, stock options and everything else. How do you convince those guys to come here and work for government salary instead?

LaFountain: Well, I think there's a number of reasons why students come here. Some of them, you know, want to do good for the nation, they want to come work here or in some other government entity. Many of them realize that they come here and they can get some incredible experience very fast. So in our STEM [science, technology, engineering and math] areas, in our high-tech areas, we have a higher-than-average attrition rate. Because they come here, they build the skills, and then they're very, very employable outside. And so I've been in offices at the agency over my career here where we've had a 30 percent turnover rate every year because the skills are just that valuable. And then they go out and they go join the gold rush, as you say, and make the money. But a lot of them stay.

CNBC: How do you compete with that?

LaFountain: Well, some of it is the work that we do here. The work is very exciting, very interesting. Some of the work we do here you can't do outside. When I first came to the agency 32 years ago, I never expected to still be here today.

CNBC: Can you guys really compete with a Google? You must be looking for the same type of talent that Google's looking for.

LaFountain: Well, we are. Certainly, were looking for those smart people. And clearly, we lose a lot of incredibly talented people to Google and Facebook and Microsoft and all these other places. But we also get a lot of very, very smart people as well. Because some people just have this—this motivation to do what they think is right, to work for the government. Clearly, large numbers of our workforce could leave today and go get a higher-paying job elsewhere. But they believe in the mission.

CNBC: On this college recruiting program that you're launching, you're now seeing the first wave of graduates hired by the NSA. Where do you see this program in five years?

LaFountain: Well, in five years I think we'll be fully where we want to be. I think we'll have the number of schools that we want in the program. The program requires that schools re-designate as a center of excellence every five years. So we'll have gone through the first wave of that, and I think that we'll see that the original schools will strive to continue to be designated as centers of excellence for cyber operations. And I think—I hope—that we will see the pipeline of students that we're expecting coming to NSA, going to cybercommand, going to FBI, going to the places that need the skills that we're trying to build.

One of the requirements of the program also is not just the technology, not just understanding the technology, but the schools are required to teach the ethics of computer security—of being a good citizen in cyberspace, if you will.

CNBC: What are the ethics of cybersecurity?

LaFountain: Well, largely it's just being a good citizen in cyberspace. Right?

CNBC: But part of what you're trying to do at the NSA is steal information. I mean, that's what the NSA is for.

LaFountain: Well, we want to have people that have those skills, but you want to make sure that it's applied in a legal manner, right? We have a legal authority to do that, to gather foreign intelligence, but our people need to understand that, okay, so you can't go and do that in your personal life, right? You can't do that against family, against friends, against neighbors. You've got to still be a model citizen in cyberspace.

CNBC: So what you do at work stays at work?

LaFountain: Absolutely. Yeah, absolutely. A lot of our people still have their own home systems. They've got to keep it to what they're allowed to do on their home systems.

And actually, if I can, I'd also like to mention we've created a new program just this past summer. We've come to the realization that we need to reach back further than college to get kids interested in cybersecurity. A lot of studies show that by the eighth or ninth grade, kids are either turning to STEM or they're turning off from the STEM fields. And so we want to … want to get more of them interested cyberspace. So just this summer, in partnership with the National Science Foundation, we created a program we're calling "Gen-cyber," sponsoring cyber-related summer camps for middle and high school students and teachers around the country. We call this our prototype year. We had six camps. The reaction was overwhelmingly positive. One of our camps had 172 high school students in it. I visited the camp; I talked to about 25 students. Every one of them said, 'This is great. It's better than I expected. Can't wait to come back next year.'

CNBC: What do they do in these camps?

LaFountain: What we ask the camps to do to start out is just to give students the fundamental awareness of cybersecurity so they understand the threats that are out there on the Internet and basic things that they should do to protect themselves. Some of the camps did some more technical things. Some did introduction to secure programming. Another program did an introduction to wireless networking and wireless security. And the students are really, really into it.

CNBC: Those were eighth-graders?

LaFountain: Those students were 10th-graders that did the wireless, but it was kind of cool. Because they had all this equipment, and they did a wireless scavenger hunt, so they had backpacks using the little antennas coming out of the backpack. They're going around this college campus trying to find these rogue access points that had been set up. So it really was just giving them a good introduction to that technology, which is an important technology today. So that's a program we hope to grow in the coming years. To eventually reach out to all 50 states, I hope.

CNBC: How many students do you think you need to pull into the NSA in order to keep the pipeline flowing?

LaFountain: My estimate would be for the specific skill areas that I'm trying to build, it's in the small hundreds. And that's why you know in our program we intend to keep the number of schools fairly small. We're thinking maybe 20, 25 schools will be enough to provide the pipeline of students that we need.

CNBC: And what are the specific things that they're learning inside that program? What you need them to know?

LaFountain: Well, so for example, low-level programming. Programming in assembly language, programming in the C programming language. That is really the language that is at the guts of operating systems. That's where most cybersecurity vulnerabilities are. That's where most exploits are performed. And that's the area that schools have gotten away from because that's not where the big visible jobs are today. Today it's all in mobile programming, Web programming.

CORRECTION; The proper name of the NSA program is the Centers of Academic Excellence in Cyber Operations.