[00:43] Anticipatory Cyber Threat Intelligence

Jonathan Knepher:
So you gave us a couple little, examples earlier, but, are there are there any more recent discoveries, that you've made that you're able to talk about and and share with us? I I think it's just fascinating to get the the kind of real, you know, tangible what's going on out there, kind of like our own little crime drama here. So

John Cohen:
No. I'll tell you one of my favorite stories quite frankly because it was like, okay. This is interesting. We were tracking the online activities of a specific Iranian linked hacking collective. And what we found is that initially they were claiming that they had taken down a major city police department's website through a cyber attack. And we were able to reach out to that department and find that actually the claim of attribution or the claim of responsibility was valid. But then what they started doing on that forum where they were bragging about what they were able to do and how that this website was still down and people were validating that they started saying, okay, so where should we attack now next? And what they were organizing around were the pro Palestinian protests that were taking place in cities across the country at the time. So they they began in a sense crowdsourcing if this is the right use of that word crowdsourcing nominations for who they should attack.

John Cohen:
And then we would see initially that someone would say, okay, well now, we think the votes are in and you're suggesting we go after this city and then they would begin their cyber attacks. So we were able to track that and get information into cities. I just thought that was it was actually really interesting and what it demonstrated to me is that for far too long, when we think about cyber threat intelligence, we think about the highly technical data that we can share regarding, you know, the the construct of a piece of malware or the other technical technique that's being used to penetrate a network to exfiltrate information, critically important information. But what it, but what that incident said to me is, you know what, If we can also, in addition to that technical data provide, what I would call anticipatory intelligence because we're seeing so much of the activity of these cyber groups is being is being planned out in the open because that's part of their objective. So one of the things we're looking at hundreds of these types of forums now every day so we can gain greater insight into what these collectives which are which are increasingly motivated by political or even extremist ideological beliefs, what they're tending, what, you know, what systems they're intending to target, how they're intending to do it and what they're hoping to do. And hopefully that will help, when looked at in combination with the technical sort of cyber threat intelligence will help companies or governments be better prepared to deal with what's coming down the road.

Jonathan Knepher:
Yeah. I think that that that, like, ahead of time understanding is just that's where a lot of a lot of positive can come from this, I think, to prevent stuff in advance. Are you a how are you able to get that information in a timely manner to everybody who needs it? Right? Like, you mentioned a lot about law enforcement. I assume there's processes there. But also, like, what if you saw certain threats coming towards the private sector or, you know, you mentioned both faith based and financial industries, like, how can you get that information out fast enough for it to be meaningful?

John Cohen:
Yeah. I mean, that's one of the that's one of the the the specific issues that we're working on as we seek to, as Rachel describes, scale this up, and you know, it's relationships with the other ISOCs that deal with those industries. It's, you know, luckily having been the acting undersecretary of intelligence at Department of Homeland Security, I have a pretty good roadmap of how to get information into the hands of whether it's law enforcement or a city leader or a private sector company. You know, I've had a lot of meetings with with the CISOs or the CEOs of major companies, but I wouldn't necessarily build a program around my relationships. But so that's part of the challenge. And I think it comes to, you know, as we look at this idea, one of the recommendations in the framework was the establishment of a threat clearing house. Part of that would be forming the right partnerships with the other ISACs, with the other industry groups, with groups like InfraGard, but at the FBI, so that you can, when you discover a threat, you can get it to the right folks. Look, I'm very confident and because we do this every day, if we're if we pick up a specific threat of an individual posting online that they're intending to travel to a location and conduct an attack, We can get that in the hands of that police chief, that sheriff, that fusion center literally within seconds.

John Cohen:
I'm totally confident. I'm a little less confident to your question, John, that if I saw a Fortune 100 company being targeted, you know, you know, how quickly I can get that into the hands of the, those that are, are being, so that's one of the things we're working on with external groups and internally as well.

[06:15] Navigating Disinformation, Protected Speech, and Legal Boundaries

Rachael Lyon:
In that vein and, you know, sowing disinformation on social channels externally, you know, is there how do you navigate things of reporting when there are issues of protected speech? For example, I know this has come up in the past. I mean, how do you walk that line?

John Cohen:
Yeah. So very, very important question. So as I mentioned before, my program does nothing in the area of content moderation or content removal. We don't work with the social media companies directly. And, and I think that that's being done on for, for very specific reasons. But more importantly, the way we've designed our entire effort is, as I mentioned before, we focus on forums that we can associate or content we can associate with a specific threat actor community or a specific threat actor. So if we're looking at something, I can articulate a connection with Russian intelligence services, with North Korea, with China, with Iran, with Hezbollah, Hamas, Al Qaeda, Islamic State or a criminal organization or a violent group or cause here in The United States. Secondly, you know, if we are looking at content and we're gonna report on it, we have to be able to articulate a direct connection with physical threat activity.

John Cohen:
So, you know, I'm not my team isn't gonna sit there and post a report saying, hey, a bunch of neo nazis had a convention and they were suggesting that, you know, you know, certain steps be taken. That's not something we're going to report on. What we would report on is if we started seeing video, and this is actually a real case, we started picking up on anti government websites, a one minute video that had been, posted that showed a series of five to seven second vignettes of police officers being shot, police officers being stabbed, police officers being lit on fire. The video was preceded by a PowerPoint slide that basically said violence is the only answer. And the video was scored to a song called Kill the Police. So the message of the video was pretty clear. What really incurring what really sort of pushed it into the category of information described how to engage in pre operational surveillance of an intended law enforcement target, how to build an explosive device, how to create an ambush encounter, how to carry out an ambush, how to circumvent, you know, law enforcement investigations. And so when we produced our product, we not only talked about the potential threat directed at launch as a result of the also describe the types of tactics and techniques that an attacker would use.

John Cohen:
So we have stayed very focused on that driving our content. So, you know, again, if we're talking about Russian efforts to disrupt the election through the posting of online content, we're gonna focus primarily on online content such as that, which we did see during the election where they were using AI generated video depicting, you know, allegedly votes being destroyed in a polling site and then accompanied that by saying you cannot trust your local election. It's time to rise up and take and use violence. And again, we imposed in in providing that content to local officials, it was within the context of saying you need to be prepared to counteract this type of content, not, hey, we're going to remove this content from being online. And what we actually saw during this past election is there were several events in Georgia, Michigan, Pennsylvania, where that type of AI generated video content was introduced into the ecosystem, was amplified by foreign threat actors, was accompanied by messages calling for, you know, calling into question any results of the election. But very quickly, state and local officials were able to counteract that narrative and say, no, this isn't real, this isn't happening. This is part of an information operation by an by a foreign government trying to disrupt our election. So focus on threat actors, focus on real threats.

John Cohen:
Don't get into content moderation and content removal. And as as strongly as people may disagree with hate speech and and other views that are expressed online, as as as fearful as it may make people. And as much as there needs to be a societal discussion on how we're gonna deal with that, that's not what we're dealing with. Because as you pointed out, you can promote that type of speech, and and you're protected by the constitution in doing it. What you're not protected, is to engage in criminal or violent activity and further. And so that speech, I often say this when I'm talking to law enforcement, it's not the job of law enforcement to police thought it is the job of law enforcement to prevent criminal activity and acts of violence that may be motivated by extremist views or even political beliefs. It's the violent activity. It's the criminal activity that they should be focusing on, not simply, you know, trying to manage the the content that's being promoted online.

Jonathan Knepher:
Yeah. Wow. Those are some pretty scary scenarios that, that you've pointed out. And, you know, I think that goes to kind of the next little area here we wanted to talk about. Right? Like like, that's obviously a mechanism for sending out instructions and maybe even recruitment almost. But what are you seeing kind of overall for threat actors using these platforms overall for coordination, recruitment, and so on. And and what kinds of things, are are important, to do. Alright? Like, I think your point on, like, letting the information stand is important because you don't wanna also force them further underground.

Jonathan Knepher:
Right? It's best to be able to to read what they have to say.

[12:26] The Mechanics of Online Recruitment and Coordination by Threat Groups

John Cohen:
Yeah. So interesting issue. So back in 2012, we started seeing this is one example, but which I think gets to your your question. Back in 2012, we started seeing groups like Al Qaeda in the Arabian Peninsula, and Hezbollah and even ISIS affiliates change their playbook, right? Up until that point, They primarily would recruit people in person. They would evaluate them. They would try to indoctrinate them with their extremist views. They would ultimately have them travel to a training camp where they would be trained in specific skills associated with different type of attack techniques. And then ultimately they would be deployed to conduct a physical attack and furtherance of their strategic objectives.

John Cohen:
But we saw their playbook expanding in twenty twelve, twenty thirteen time period where they started posting increasingly posting content online. And at first they would post that content and try to encourage direct communications. And then as time went by, they would post content that was not only meant to be inspirational, but also educational, where they would they would try to inspire people, who are vulnerable to being influenced by this type of content and then give them directions on how to do it. Here's how you do a vehicle ramming attack. Here's how you build a bomb. Here's how you engage in a mass shooting. And that really began back then. What we've seen since then is a shift where still they do still do some of the traditional terrorism activities that we've constructed this incredible capability to detect and mitigate.

John Cohen:
But increasingly, they have found that there are so many people in Western society today that are nervous and scared and angry and don't like the direction that their society is going in or their life is going in. They feel they've been treated unfairly. They've increasingly come to believe that violence or destructive behavior is a as a legitimate way to express their opposition to government policies, to express their own views, to express their own sense of grievance. And they also have come to learn what we've been talking about here today is that these people are spending huge amounts of time online consuming content. And very often for those who are really struggling with mental health issues, they are looking for content that validates their interest in using violence. And so they may go from extremist forum to extremist forum until they ultimately cobble together their own sort of blend of ideological beliefs. And then they will go out and conduct an attack. And then the terrorist group that, you know, is this is found to be on their social media or on their phone, will claim responsibility to it.

John Cohen:
So how do you combat that? Right? Because, you know, I, we have a very robust counterterrorism system that picks up communications between operatives and terrorist group leaders. We have the ability to track travel in such a way that if you're traveling to a terrorist training camp, we will pick up on you. We're, we're not so good at seeing what Rachel's looking at on her computer while she's sitting in her living room. And she's spending, you know, six hours a day looking at different informational forms. And, you know, but what I will tell you is that accompanying that behavior are observations made by people who know the person who may be at risk of engaging in violence. They are noticing, you know, whether they communicate with this person online or in person, they're noticing changes in their behavior. They're noticing themselves connecting with ideological belief systems and espousing them whether it's online or in person. They're noticing what we call them, law enforcement leakage activities, which are articulations of intent to engage in activities.

John Cohen:
Very often, they're also seeing other behaviors, maybe the acquisition of firearms, acquisitions of large amounts of ammunition. They're hearing there's expression and commentary about, who the focus of the grievance is for the person who may be planning the attack. And, you know, we often hear people say after a mass shooting or after, you know, a domestic event, oh, this person wasn't on the radar screen. That's total BS. What we have found as we have looked at mass casualty attacks is that they're always on the radar screen. Just we've been looking at the wrong radar screen and that's why we don't detect it. So my point of going through all of that is to say, is part of the solution is understanding, you know, the types of attacks and the types of behaviors associated with those who are vulnerable to being influenced by these content. And when those, when those reports come in, take them seriously, and, and, and, and, and evaluate the risk posed by that individual.

John Cohen:
So I'll give you a sort of a personal story. You know, my son went to a high school in the county that I live in and, and several years back, there was a student who had been expelled, from that high school and he was angry. He felt a sense of grievance. He began posting on Instagram, threats that he was gonna go back to the school and engage in a, in a shooting. Some other students saw those Instagram posts. They went to the school resource officer. The school resource officer had had the understanding and the knowledge to say, look, this online content is disconcerting. Our department police department had what they called at the time of threat management unit, which included officers who were trained in mental health issues and also collaboration with mental health professionals.

John Cohen:
They did what is known as a threat assessment investigation. They looked at the person's online activity, They looked at the person's physical behavior and they assessed that this person was high risk of engaging in violence. And then they took steps working with the local courts, working with mental health community, working with the school, working with the parents to mitigate the potential risk posed by that individual. They to this day believe that if, if they would not have taken action and they would not have taken these steps, he would have walked into that school and shot people. And that's the school where my son went. So while this is an issue that I work on every single day, you know, it has hit home as well. But that's, but I think it's a great example of what we need to be doing. It's not just monitoring what's online.

John Cohen:
It's important to evaluate online content. So you know what the threat actors are trying to do, what type of behavior they're trying to inspire, but also being able to recognize the warning signs exhibited by individuals who are actually being influenced by that content and maybe traveling down the path of engaging in illegal activity or even violent activity and then having the right relationships in place at the local level so that you can assess the risk posed by that individual and then take steps to manage that risk so that we don't have tragedies that occurred, you know, yesterday at Florida State University, or I realize this may be showing this may be airing at a time that's down the road. So, when this was recorded, there was a shooting yesterday at Florida State University, but there have been other mass casualty attacks over the last several months, you know, in schools, and in other locations. There have also been multiple attacks disrupted by law enforcement. That's because it goes back to one of the first questions you asked me, you know, you know, are we prepared? We are getting there and it's primarily occurring in state and local jurisdictions across the country because they have a better understanding of the threat and they are taking the steps needed to address this rapidly evolving this, this threat that's evolving at internet speed. And, and to be able to, and that's why we're starting to see, you know, while we still are experiencing horrific tragedies like the one recently in Florida, we are also seeing attack after attack being disrupted.

Rachael Lyon:
It's clearly a different mindset is needed today. We've talked a little bit about that. And, you know, particularly if you're a leader with an organization or, you know, you're you're in the public sector, you know, how how can you start training people in in ostensibly, you know, if you wanna thwart a criminal, you have to think like a criminal. And, you know, so, so much of cybersecurity are defensive, you know, tactics, but, you know, do we see an escalation of more offensive strategies here, that people need to start thinking about? Or, you know, how do we how do we get people in the mindset of, you know, this is how we need to be thinking about these in order to get ahead of the threat?

John Cohen:
It's awareness and understanding. I mean, look, there's there's a lot of areas where politics are valuable, right? I mean, the exchange of ideas in this country, is an important aspect and fundamental to how this this country has evolved and survived and addressed major problems that have confronted it. Where we shouldn't have politics is, when it comes to having an accurate, objective understanding of the threat environment. And I think, you know, as if we live away from Washington for a little while and look at what's going on in the state and local communities, I think that's where that objective conversation is taking place. And to me, everything you asked about depends on, you know, governors, mayors, police chiefs, sheriffs, state police heads, heads of fusion centers be up to date on how the threat is evolving and, you know, and and not be constrained because they continue to operate in the operational stove pipes or using the operational definitions that applied to past threats. So I'll give you an example. One of the places where we've really struggled is in the area of mass casualty attacks that are ideologically motivated. Right.

John Cohen:
And why have we struggled? Because very often, as I mentioned before, these people will come to the attention of local officials. They will deploy a crisis intervention team, meaning a team of law enforcement people who are specifically trained to evaluate the mental health condition and the risk posed by an individual. We've seen example after example where, while they're doing that mental health assessment, they will see extremist content on the person's computer, and they'll refer it to a joint terrorism task force to see whether this is a domestic terrorism case or a foreign terrorism case. It gets confusing at this point because when they look at the content, they will find that it doesn't fit into the neat definitional category that allows them to as either foreign terrorism or domestic terrorism. The content may be a combination of Islamic State content, a little white supremacy with some incel beliefs, which is involuntary celibate, along with the expression of some sense of grievance and sprinkled in throughout all of that are references to different Internet subcultures. And so if you are a case agent on a joint terrorism task force who has specific guidance of when they can conduct an investigation, You look at this content, you say, I can't. Is this mental health? Is this is this, you know, terrorism? Is it ideologically motivated violence? Is this person just upset because is workplace violence? And and what law enforcement is increasingly coming to understand is it doesn't matter, right? There's an expression that exists now in the profession called salad bar extremism. And that just basically means that people who are using ideological beliefs as the validation for engaging in violence will actually combine elements of different ideologies in order to find the justification that they need to go out and conduct a school shooting or a workplace shooting.

John Cohen:
And so we've got to factor that in. And the only way that you can adapt your investigative techniques is by actually understanding how the threat is evolving. If you still look at narcotics trafficking or even terrorism the way we did, you know, in the months that followed nine eleven, you're gonna miss a lot of warning signs and we have missed warning signs. There are a number of shootings that have taken place after an individual was evaluated mental health wise, after they were looked at preliminarily by a JTTF that could not make the connection with, the traditional definition of terrorism. And they went on to other things only to have the person go out and commit a mass shooting.

[25:14] Media Narratives, Social Echoes, and Societal Impacts

Rachael Lyon:
That's a you've seen a lot in your career. I can only imagine. And, you know, I I'd be interested in all this. I mean, because of the extremism of what what we've seen, I mean, is there one thing that stands out to you, throughout your career that kind of caused you pause, particularly maybe in a good way or in a wow, this is something we've got to got to get in front of with?

John Cohen:
Yeah. There's a couple of things. Now I really get myself in trouble. I think what has given me real pause is that we are seeing, what's that word? A codependency almost between the content that's being promoted by threat actors for illegal purposes and the mimicking of that content for, you know, in an effort to generate ratings if you're on TV or even to to mobilize a political base. I think the reason why Russia, China, Iran, North Korea and terrorist groups use information operations, to conduct, criminal or, or threat related activities is because they were right. Whereas a society vulnerable to being influenced by this content, and they promote content in a very thoughtful and carefully planned way that allows them to achieve their objectives. But those playbooks also work for non threat related purposes. And so what worries me is when I see language being promoted on a pro Al Qaeda and, you know, accelerationist anti government forum.

John Cohen:
And then I'm hearing those same words as part of our political discourse. There's an amplifying effect and that troubles me greatly. What gives me encouragement, however, is that we're beginning to understand this, right? We definitely need to have a discussion as a society on where we want to be as a society as it relates to, you know, the social political narratives that are being used successfully by many. But at the same time, law enforcement has to have a clear understanding of how these, the, these activities, you know, come together to enhance the threat environment we're dealing with and then be prepared to take that into account as they're proactively trying to prevent attacks. You know, when I see media figures using the same words that were contained in manifestos or documents posted by individuals who conducted the Christ church shooting in New Zealand, the shootings at synagogues in San Diego and, Pittsburgh, and shooting at a Walmart store in El Paso, you know, that's troubling to me. It doesn't mean it's the intent of those media figures to inspire violence, but their use of that language, you know, has an impact on the threat environment, all the same. And we've got to come, we've got to, as a society need to figure out how we're gonna deal with it. Quite frankly, that's not my job.

John Cohen:
My job is to understand the threat environment and make sure law enforcement has the tools so that they can prevent those types of mass shootings, whether they're targeting a synagogue, people in a synagogue or a church or in a Walmart store or who are targeted because of their gender identity, ethnicity or the fact that they work in government.

Rachael Lyon:
Wow, it's a big challenge. You know, it's how can we even or do you even start to try to when it's a societal challenge like that and so broad and sweeping? I mean, how do you start to try to course correct is or is this the trains running off the track? And so then it really is just we need to raise awareness and educate and get people to ask more questions or maybe pay better attention or, you know, and how do you do that on a global level?

John Cohen:
Like we're doing right now?

Rachael Lyon:
Yeah,

John Cohen:
we're having a discussion. We're having a thoughtful discussion. We're not falling into political rabbit holes. And, and we're, we're, we're talking about the state of the world and how it impacts things. And, you know, I have I have done, you know, I've had a lot of conversations like this sometimes in very, you know, forums on both, you know, that are tend to be more conservative and more liberal. And there are people on all parts of the ideological ideological spectrum that will have questions about these types of things. But we have to be able to talk about things. Look, I remember a time where, you know, you can talk you could talk about things with your neighbors or family members, and you wouldn't walk away from the conversation even if you disagreed thinking that they were the enemy or that they should be killed.

John Cohen:
Right. Unfortunately, we're at a place right now in our society where discussing even basic issues turns into a confrontational discussion where you're where the objective of one is to shut down the communication of the other. So I think the more that we can have conversations like this and the more we can move away, you know, I never thought I would say, you know, that I actually agree with Jim Jordan's approach. We need to move away from this idea that it's the role of government to remove content from online platforms. Right. I have come to learn that that view is absolutely right. The government should not be doing that. But that doesn't mean that we ignore the criminal and threat related activities that are being inspired, informed and facilitated every single day across this country by threat actors who are using these tools and increasingly using advanced computing in order to achieve objectives that are intended to undermine the stability of The United States to inspire violence, to have people distrust their government and to disrupt our alliances with our key allies across the globe.

John Cohen:
So we have to be able to do both. And we can only do both when we have conversations like we are today where you guys are pulling out the information and we're discussing the information in a way that I hope will resonate with people that will listen to it.

[31:48] A Nonlinear Journey Into Cybersecurity

Rachael Lyon:
I think it will. This is an important, important topic. Yeah. We could talk about this for hours. I do want to be mindful of time. But I as John knows, I love to always have a personal question, an origin story question. And, you know, I think the path to cyber is always an interesting one. For for many, it's not a direct path.

Rachael Lyon:
And I would be interested in kind of your your journey to cyber. You've been in law enforcement and cybersecurity and homeland homeland security and all these things that you've done. And the connections are kind of amazing. They seem incredibly important today. But, you know, was that planned or how did you get here?

John Cohen:
No, it wasn't planned at all. I mean, my most of my career has focused on understanding and and either through investigations or arrest arresting people or running major, you know, national programs, or national international operations have been focused on, combating criminal organizations and and terrorist groups and foreign intelligence services. I got to cyber because they went to cyber. You know, I started learning. I started learning about content that was being that was that was being promoted online when I started studying mass casualty attacks and trying to better understand, was there a way that we could, we could mitigate or reduce the risk of those types of attacks? And it took me into the online environment and because it's become inextricably interlinked with the physical environment, you know, it's the same with cyber. You know, my road to cyber wasn't because I'm a technologist. My daughter is, but I'm not. I'm I'm the opposite, right? I basically need her to help me with my phone.

John Cohen:
But what I do understand are the operations of threat actors and I and my forty year journey has focused on counteracting their activities. And today you can't look at terrorist groups or foreign intelligence services or criminal organizations and not understand how they're using cyber attacks in the in a cohesive and multidimensional way, to achieve their operational objectives. So that was that's really my my road to cyber. There's a there's a phrase that I, I use a lot. It came from a professor at Rutgers university named Jeffrey Lane. And I was in a, on a panel with him. And he said something that, that really began my active journey into this. He said, we used to think of the digital street and the physical street as, as two separate and distinct environments.

John Cohen:
Today that is not the case. The digital and physical streets are intertwined and he's right. And while I sort of always have considered myself to be, an operational, a person who focused on physical world operations, you know, intended to protect our communities or protect our nation from violence and criminal activity. I have I have been pulled into the digital street as well because that's where a lot of these operational activities are taking place.

Rachael Lyon:
So I know we're at time and, you know, John, thank you so much for this insightful and important conversation and the great work that you're doing. We need more of you out there, and to all of our listeners, thank you again for joining us this week. And, you know, you have any questions, feel free to look up John or Threatwa, the Center for Internet Security, because they are doing such important work and have amazing resources. So until next time, everybody, stay safe. 

About Our Guest

John Cohen, Executive Director, Program for Countering Hybrid Threats, Center for Internet Security

John D. Cohen currently serves as the Executive Director for the Program for Countering Hybrid Threats at the Center for Internet Security. In that role, he works closely with law enforcement, mental health, and civil society organizations across the Nation to address issues relating to the impact of social media and the Internet on crime, violence, community safety, and constitutional protections. He is also an Adjunct Professor at the Georgetown University Security Studies Program. From January 2021 through April 2022, he served as the Assistant Secretary for Counter-terrorism and Law Enforcement Policy, Coordinator for Counterterrorism and the Senior Official Performing the Duties of the Under Secretary of Intelligence and Analysis at the United States Department of Homeland Security. Prior to his most recent service at DHS, Cohen is also an on-air expert for ABC News on homeland security, terrorism, counter-intelligence, and law enforcement issues.

Cohen has four decades of experience in law enforcement, counter-intelligence, and homeland security. He has studied mass casualty attacks and is currently studying the impact of Internet-based communications technologies on crime and homeland/national security. During the Obama Administration he served as the Acting Under-Secretary for Intelligence and Analysis (I&A) and Counterterrorism Coordinator for the United States Department of Homeland Security (DHS). During his time at DHS, Mr. Cohen was a direct adviser to the Secretary and he oversaw the development and implementation of a number of high visibility Department-wide crime prevention, counterterrorism, counter-intelligence and border and transportation security initiatives. Mr. Cohen also led the Department’s efforts to establish multi-disciplinary programs focused on: countering violent extremism; preventing and responding to mass casualty/active shooter attacks; improving information sharing; and expanding DHS’ interactions and collaboration with state and local law enforcement organizations, private sector companies and faith-based organizations.

During the Administration of George W. Bush, Mr. Cohen served as the Senior Advisor to the Program Manager for the Information Sharing Environment, Office of the Director of National Intelligence, where he authored and coordinated the implementation of key components of the 2007 White House National Strategy for Information Sharing.

Mr. Cohen has an extensive background in homeland security and law enforcement operations and policy development. He was Senior Homeland Security Policy Advisor to a number of State and local officials including Governor Mitt Romney of the Commonwealth of Massachusetts and Janet Napolitano, Governor of the State of Arizona. In 2004 he was selected by the National Journal as one of the “100 Key People in Homeland Security.” He was also named “Law Enforcement Person of the Year,” by Law Enforcement News for his work in developing and establishing a national non-emergency number, 3-1-1. During the Clinton Administration, worked closely with drug treatment providers, educators and law enforcement agencies in Maryland, DC, and Virgina while establishing the Washington – Baltimore High Intensity Drug Trafficking Area Program. He also served as an advisor to the Maryland State Government on criminal justice issues and drafted the State’s first homeland security strategy after the attacks of 9-11. He has worked within the private sector and has held a variety of government positions including: Special Agent, Office of Naval Intelligence; Police Detective and Patrol Officer, City of Gardena, CA; Senior Investigator, House Judiciary Committee, U.S. House of Representatives; and Senior Policy Advisor to the Director, Office of National Drug Control Policy, Executive Office of the President of the United States. He is the recipient of a number of awards and commendations including the Drug Enforcement Administration “Administrator’s Award,” The South Bay “Medal of Valor,” and the Department of Homeland Security’s “Distinguished Service Medal.”