UVA Alum Shares His Experience in Cybersecurity During the 2020 Election

Krebs, a 1999 graduate of UVA’s environmental sciences program, began by detailing his unique path after graduating from UVA to being appointed by Trump as the first to lead the federal cybersecurity agency, formed in 2018 under the Department of Homeland Security. The agency is a successor to the National Protection and Programs Directorate, which was launched in 2007.

After his graduation from UVA, Krebs headed south to be a scuba dive master in the Caribbean, but realized it wasn’t all it was cracked up to be, so he went back to Washington, D.C., and took a job in maritime incident response.

“This goes back years, and even through today, where I feel like I kind of get drawn to incidents. I kind of thrive in a high-stress, high-risk incidence response,” Krebs said.

One of his clients while he worked in maritime incident response was the U.S. Coast Guard, which was rolled up under Homeland Security after 9/11. Shortly after, Krebs earned his juris doctorate from the Antonin Scalia Law School at George Mason University before ending up as an employee at Homeland Security under George Bush’s administration. During the Obama administration, Krebs transitioned back into the commercial sector to take a job at Microsoft overseeing their cyber security policy in the United States.

In March of 2017, Krebs was hired as senior counselor of the secretary of Homeland Security, and later that year he was appointed as the assistant secretary for infrastructure protection under the National Protection and Programs Directorate. Several months later, he was confirmed as the director of the cybersecurity agency.

“This was right after the 2016 election, obviously, and right after the intelligence community released the assessment of Russian interference in the 2016 election,” he said.

At that time, election infrastructure was labeled critical infrastructure, setting in motion a plan to retire old voting machines, especially those electronic versions that didn’t require paper ballots.

“In 2016, according to the Center for Election Innovation and Research, David Becker's organization, they estimated that just under 80% of votes were cast with a paper record – so, a voter verifiable paper audit trail, where the voter's intent is recorded on something that can be audited after the fact.”

Krebs prioritized converting the remaining states that were primarily using the direct recording equipment over to using paper ballots. Pennsylvania and Georgia were on that list, and his agency was successful in helping them move to safer and more secure election protocols. This would prove pivotal after the 2020 election, as both states’ voting records were recounted and audited.

“The fact that they could go back and make an audit again and again – Georgia recounted three times – this gave us the confidence to say that it was, in fact, a secure election. I have to say, if they were still on DRE’s in the way it came down to Georgia and Pennsylvania, it would've been hard to say that with the same level of, of confidence,” he said.

After Trump fired Krebs, Krebs teamed up with former Facebook Chief Information Security Officer, Alex Stamos, to launch the Krebs Stamos Group, a cybersecurity consultancy.

Today, Krebs helps international corporations with their cyber resiliency in the face of a growing onslaught of hackers, many of which are nationalized.

He sees this playing out in Ukraine, where he and his company monitored the disinformation coming from Russia prior to the invasion of Ukraine last week. He also helped prepare Ukraine for cyber-attacks on its digital and physical infrastructures, which have been ongoing during the assault. He says he consulted with clients who do business in Eastern Europe about expectations during an attack and how to be prepared. Krebs shared that he believes there is a lot of vulnerability to mid-level, service-oriented service industries because those attacks can disrupt supply chains.

He also shared with students his belief that as societies grow ever more dependent on connected devices in their daily lives, the need for cybersecurity professionals will only become more important.

“Everything’s got some technological dependency. It's not going to get easier. It's going to get harder,” he said. “That’s for the rest of human history, it's only going to accelerate. So, there's a lot of work out there for y'all.”