Welcome to Texas Talk.

I'm Gilbert Garcia, metro columnist for the San Antonio Express-News.

On this show, we bring you in-depth one on one conversations with some of the most fascinating figures in Texas politics, sports, culture and business.

John Dickson is one of this country's foremost experts on cybersecurity issues.

For nearly 20 years, the former Air Force intelligence officer served as the principal of the Denim Group, a San Antonio based firm specializing in helping companies guard against computer network breaches.

In recent years, Dixon has chaired a committee dedicated to fixing the deficiencies of San Antonio International Airport.

On tonight's show, he'll talk about the ambitious new redevelopment plan for the airport, San Antonio's economic future, and what he sees as this country's biggest cybersecurity threats.

Let's get started.

John, thanks for being on Texas Tech.

Glad to be here.

Well, about six years ago, San Antonio Mayor Ron Newberg asked you to chair an airport system development committee looking at options to improve the San Antonio Airport, which has been something that people have complained about for for ages.

Last month, City council saw the first renderings of what this planned redevelopment will look like.

Did you ever think when you accepted the mayor's appointment that it was the process would take would take this long?

No, not at all.

And I communicated publicly to the committee that we thought maybe a year to two years.

Yeah.

So yeah.

So it's a topic of popular discourse, I think is the way that whenever whenever, you know, the timeline comes up as a topic with the committee, they're like, I remember when John said two years tops.

So we were dealing with the COVID 19 pandemic.

I'm sure that slowed things down.

Yeah, I think none of us had an idea how long we do now.

And I mean, it has been a generational activity.

I think the term that comes to mind is a passion project.

Almost everybody has stuck with us on this committee, but it has been, you know, an effort to correct what we view as a, you know, a historical problem that we've had that you and I think some of your colleagues in other roles have have been pretty outspoken about.

But, I mean, we fly we know that we fly all the time.

So absolutely, there have been various arguments made as far as what should be done with the airport.

You've heard people say that the existing airport is too landlocked.

There's not enough space there to do a major expansion.

There have been suggestions that about acquiring land in some other part of the city to build a new airport.

There are suggestions that San Antonio and Austin try to collaborate on a regional airport.

When you when you and this committee got together, did you explore all these different ideas?

I mean, how much did you look at different possibilities?

I mean, all of them.

All of them.

It was pretty wide open for it.

We started the process and the first thing we did is we said, we're going to keep this fact based.

Mm hmm.

And the facts led us very quickly to the outcome that our site, the existing footprint of the airport, more than handled future growth.

So there was no path to a regional airport whatsoever for a variety of reasons, including the fact that FAA didn't want that.

And the FAA, through its granting process, really dictates what regions do in their airport.

I think in the history, recent history of the airport world, maybe only one airport funded it on their own and that might have been Branson, Missouri, is is the running story.

The most recent airport that I'm aware of on a grand scale was the Denver International Airport.

And that now is 30 or 40 years ago that was built so no path.

And if you look at a snapshot of the airport facility, you can quickly see on the right of Terminal A, there's a lot of real estate in the left of Terminal B, a lot of real estate as well.

So within two years we answer that question and it was unequivocally it will fit.

The other thing we debunked was this issue of a regional airport.

And it's it's quite true the moment that Austin got a visit, from what I call the BRAC theory, when the Base Realignment and Closure Commission said you have bergström and it's wonderful.

I think there are 2000 foot runways at the moment that happen.

Austin never, ever had a inkling or a thought about doing a regional airport with us.

They had that problem solved and I would argue this to I mean, Austin and San Antonio are just far enough apart, particularly the northern parts of Austin, the southern parts of San Antonio, that that was just the geography, wasn't in our favor.

Yeah.

The the plan $2.5 billion redevelopment includes a terminal C, which has square footage.

I think that's greater than the existing terminals.

A and B combined.

You're talking about 2028, I think for terminal C to be ready.

Sorry.

That's correct.

What kind of impact do you think this is going to have on the San Antonio economy?

I think disproportionately huge.

I think, first of all, you know, in the context of the new terminal, whatever we're going to call it, a new concourse and a combined terminal is going to be larger than terminal A will be combined.

But more importantly, you're going to see that it has elements of design that, number one, really communicates sense of San Antonio, sense of ourselves and our history and culture that really reflect a modern aspect in this.

And it really will hit you when you land here in four years.

The interesting thing with that our committee found out was that we didn't have any of that before.

We didn't have, you.

KN and Antonio, it was a fairly specific process and we understood that it came up.

I think this changes a lot.

I, I did let the mayor, manager and others know and, and he's signs the aviation director that about a week ago I took an Uber back from Austin and the Uber driver was talking about how cool the airport designs were and the Uber driver was most interesting.

So I think a lot of this is important for us.

And it also sends a message to places like Austin where many of our future passengers live and to northern Mexico, where I think many of the passengers that come into city live.

You know, there's been kind of a competitive resentment that a lot of people seem to have had about Austin and all the economic growth and opportunity that they've had.

And years ago, you made the point that San Antonio, rather than taking that attitude, we should sort of feel thankful that we have this proximity that there there's some benefit to San Antonio from that.

Do you still see it that way?

I my personal opinion is, you know, most of the cities in the U.S. would trade to have the problems that we have in San Antonio economically.

I mean, like like the truth is, is whatever survey you look at, Austin is typically one or two, but we're typically four or five.

We're in the top ten.

We're right behind them.

So we would be the you know, again, if you live in places like Rochester and other places, you might be envious of what we have down here.

I've also believe that whether we view ourselves as a region, the rest of the world is starting to view us as the San Antonio Austin region.

I hear it more frequently from outside than from within, and I've always viewed from a competition standpoint, we should view it as a region.

Denim group had an office up in Austin where I was in Austin once a month, if not more than that, all the time.

I was there last week.

So what I see from a region standpoint is there's a bunch of security companies up there, a bunch of cybersecurity thought leaders.

So I find myself collaborating and being up there frequently, so less so than other parts of Texas.

So if we view it more as a region, I think there is some potential positive outcomes for San Antonio.

Now, your parents were from San Antonio, but you were in a military family, so you grew up, you've lived all over the place.

Ultimately, you ended up enlisting in the Air Force yourself.

Was there an expectation in your family that you would pursue military service?

Not really.

It's funny.

So my dad and mom went to Brackenridge High School.

That was high school.

Our school president, senior class president.

Mom was head cheerleader, which is.

And we moved around and ended up here.

But no, there's really never any pressure.

We ended up I got accepted to West Point and to A&M, and I went in the commissioning program at A&M in the core cadets.

But always I kind of went there because I thought if it didn't work out, I didn't like it.

I could quit the Corps and stay in the university versus West Point.

But I ended up getting a commission, stayed in for seven years, and I'm glad I did.

It's a huge part of me and my background, but to my father's credit, he never really pressed pressure me.

He's an A&M grad and a professor at West Point, and he pretty much just laid it out and said, You pick.

And I went to A&M and they kind of, believe it or not, in the early eighties, treated me like a football recruit.

And I went to a basketball game.

I spent the night with the Corps and then, you know, the next thing I know, I saw that I had no hair.

Yeah.

Yeah.

Now, after you were in the Air Force, you were you were part in an Urban Administration program at Trinity University, basically on a path to be to be a city manager with San Antonio City manager Eric Walsh.

And that program at the same time.

Eric was the year above, I think.

David Marquez David Smith, Ruby Perez, Marc Webb a bunch of our classmates end up doing particularly well and landing in different places, so I'm glad I did that.

But what I learned right afterwards is, you know, I really enjoyed the cybersecurity stuff in the college and the kind of pull me back into that.

So the airport is a way that I, I kind of scratch that itch.

Yeah.

Now, during that period, everything around 1994, probably at the time when you were still thinking that you were going to pursue Urban Administration, you worked as an intern in then Mayor Nelson Wolf's office.

Correct.

What are some of the highlights as you look back.

On the highlights for number one, I didn't get paid for, was there.

Lowlight?

I remember Marc Webb and I would walk from a free parking that was like six blocks south, so we didn't have to pay lose money every day.

We'd walk and carpool.

But no, it was it was fantastic.

We got a front row seat, got to see, you know, the west side gets to get to see the north side and how people reacted.

I went to a meeting with Eastside ministers and see the dynamics between the mayor and that the West side as well got to see the mayor work some of the nutrition centers at the time.

It was neat.

And how was he to work for?

It took a while for us to get wound up, I should say.

I gave I may have communicated this, but like I don't think he knew my name the first.

This is okay, but after that we have to.

We broke the ice.

It was great.

I enjoy working with him.

I love getting to work with.

I didn't I don't know if you know this on the second Applewhite campaign where we got creamed.

I was like the in theory, the the campaign manager, but was really managed by George Shipley and at the time, Cliff Morton.

So that's what I got to work with all these, you know, kind of business giving the guys.

That's where I kind of learn the who's who and how things work in San Antonio in a and a good and sometimes less than great way.

You you mentioned the denim group you were the principal and the co-founder of the denim group which was the a cybersecurity firm based in San Antonio.

When you look back at the I think it formed in 2001, when you look back at the 20 years or so that you were that you were with the denim group, what are the major what changes did you see as far as the major cybersecurity threats then?

Oh gosh, what do you start?

First of all, the two founders were Sheridan Chambers and Dan Cornell.

I came in right after that, so it's a misperception.

But they came in early.

It was just really they have less some employees, but the world's changed dramatically.

And I like to say to corporate leaders and security leaders, you know, the advances in defensive have are much better, gone faster, but like the threat has metastasized.

I'll give you a great example.

No ransomware that existed way back then.

I mean, now what the attackers have in automation, what they have with the sophisticated underground, you know, some call that the dark web.

I don't call it the dark web, but like all of that has made it so easy for the attack community, bad guys to prosecute an attack.

And the way that I tell the difference was if you 20 years ago were going to attack and hack in a bank or something, it took a lot of time and a lot of focus and effort and it looked a lot like Ocean's 11, where you put a group together, you spend a lot of time and then you go do it.

Now with the underground, you can go with Bitcoin and get, you know, attack the ransomware.

You can get Mueller accounts, you can get you can essentially get a call center like a fake call center and robocalls.

You can buy all of Bitcoin stitch together and do an entire attack on a weekend.

I mean, so the entry level is very low to that.

Now, it used to be you had a code or be able to know stuff.

Now it's like you can stitch things together and go out and do badness.

So with that in mind, given how much easier it is to to cause trouble, how well fortified do you think are, you know, are power grids, are major financial institutions are when it comes to possible attacks from, you know, hostile foreign governments, terrorist organizations or whatever, wherever it could come from?

I think the financial community, banks and investment banks and such are probably on the bleeding edge because of so much financial loss.

I mean, the amount of fraud and the amount of loss that they experience is breathtaking and typically buried in their annual reports.

So if you go out to the big banks, the big insurance companies, they'll have large, large departments and they have security operations centers that look like a massive launch facility.

I mean, it's over the top because they're they're trying to, you know, essentially stem losses that happen all the time.

If you compare that to other industries, there are orders of magnitude less, you know, prepared because the threats don't happen daily.

As far as the grid goes, the challenge that we have there is the fact that in a good way, the nation state threats Russia, China, Iran and probably North Korea have not really attacked our grid.

They've attacked the Ukrainian grid in 2014, but not our grid.

So the challenge that we have there is if they do, if they do wake up and do it, then there's there's a perceived mismatch between, you know, the Russians or Chinese and and our grid operators now having said that, we have an exceptional team here, guys that are good at this type of stuff, but the threat is always getting, you know, more sophisticated, you know, in a way that it is really a cat and mouse game that the operators are playing.

So I that's what keeps me up at night, that particular problem.

But I will let everybody know you don't have to go out and get a generator.

But just that is it is a is an area that is of of focus for many right now.

I'll just leave it that.

You know some people have taken to calling San Antonio the the you know cyber city USA.

I think Greg Abbott has called it the capital of cybersecurity in the state a particular interest in NSA, Texas national security agencies is sort of the that hub they've got about I think about 3000 people working on cyber security.

How much potential for growth do you think there is in San Antonio for for that industry which you've worked in for so long?

Well, there's direct growth in additional missions.

The NSA, Texas specifically gets bigger and bigger.

And I don't have any clearances and have worked in that world for a long time.

But one can count cars.

And notice the second thing is the Air Force's Air Force, US Air Force consolidated its intelligence and cyber elements out in what used to be security.

Hill In the form of Kelley Air Force Base now.

Lackland So between NSA, Texas and 16th Air Force, there's a ginormous community of practitioners.

The challenge that we have in San Antonio is their they all operate in classified environments and by definition they don't go in to their own horns.

But I think there's first of all, a lot of alumni, a lot of people that came from that world, including myself, that operate in the commercial world here, and you throw that in with the universities, UTSA, St Mary's A&M, San Antonio, they're all accredited from NSA.

We have an ecosystem there now.

The area that I really am focused on now is kind of above that from the standpoint of company creation and industry creation.

The area that we'd like to do more, I think an area of future improvement is how do we get more locally owned companies here.

We have a bunch of them in the contract around the federal contract.

Well, we have less of them in the commercial realm.

One of the things that you've talked about in the past as far as a challenge is San Antonio has comes from just IT workforce and right now we're we're kind of the early stages of assay ready to work, which is, you know, a workforce development program that you know involves sales tax revenue that voters approved in November 2020.

It's gotten off to somewhat of a slow start, but I mean, we're still in the early stages of it.

How how much hope do you have for that as far as the impact that it could have on that?

I have a lot of hope, but not so much in our industry.

I'm sure what we ended up doing is recruiting people from other places to come here.

So that's been the great kind of secret that you see is that, you know, at any given time, the companies here have been able to track people not just from California but from all over the u.s. to come here.

I along with our h.r.

Department did an informal survey about six years ago.

A different group.

And i think we realized that maybe 15 or 20% of the people went to high school.

Here in our company, the vast majority are including myself, sheridan chambers.

I graduated from high school in dallas, and then our third partner, dan Cornell in saint Louis.

So, like, we came here, they came because of Trinity.

I became came from the Air Force, but we were good at bringing people here.

And so that's kind of been yes, it is important that that particular program of recruit essentially training the people that are here.

I think the unemployment problem to solve that problem to some degree.

But but at the same time, don't discount how powerful it's been to bring people here.

And many of these people come here and they don't come back.

They don't leave.

So in a few weeks before the 2020 election, I talked with you about possible hazards when it came to the 2020 election.

And I think we knew at the time that there were there was going to be controversy.

Donald Trump was then the president was already sort of saying this is the election is rigged and there's going to be fraud and so on.

And the thing that you talked about, which I had never really thought about, was your concern about what you call denial of service attacks, where you would have maybe so much traffic on elections office websites that it would just shut things down.

The results would get held up and it would create all this, you know, a lot of distrust of the election process because people would be waiting on the results, as far as I know, that that didn't happen in a major way.

I could be wrong about that.

But but yet we had a lot of controversy about the election.

And I guess I wonder I was curious, you know, as someone who follows politics as closely as you do and you certainly know about the cybersecurity aspects of this, what can we do to sort of there's there's been somewhat of a breakdown in trust in our election process.

What what do we do to deal with it?

Yeah, and I think the saddest thing post-election has been the diversion of energy to that discussion has been about access, you know, access to polling and all that on both sides.

And that I the doomsday scenario that you laid, that you repeated, that I laid out was not it still remains, which is I don't have to quote unquote hack the election, get into a voting box or get into the aggregation points to do anything.

I just have to do a denial of service to those reporting places, you know, the night of and at the same time on Twitter or somewhere else, say like we have hacked the election.

People don't know the difference between a actual hack and denial of service.

Denial service is nothing but throwing terabytes of information at a website or other server and denying service anybody else.

So when you if you're a politico, like many of us are, you know, 6 p.m. after dinner, election night, you're sitting there on the Bear County Elections Department site hit and see when all the ballots are coming in.

If you get a four or four error, your first reaction is like, oh no, someone's hacked.

And that's exactly it.

And all it takes is for Express-News, Texas Tribune, or somebody to put out there, Hey, you know the science down What happened in that that's that's the problem So how do you counter how do you kind of defend against that?

You have essentially protections against that denial of service.

You stand them up the night of I think many of the states have that, but not all of them.

All right.

I know we're doing in this area.

Do you know?

I don't know that that's really a question for the commissioners court.

I think they're aware of it.

I think they're.

But that's one that really only matters for a specific amount of time for like 5 p.m. til about midnight.

But as you know, the night of the elections right.

As you know, if you don't know if there's boxes are coming out, if there's ambiguity, that's a challenge.

If you can't get to the website, then there's in your head like, what happened?

They must have been hacked so that that you don't actually have to go and go to what we call the endpoint, which is the the ballot box.

That's too hard.

I mean, like, like if you're an attacker, why would you do the hardest thing possible?

And to break in all that.

Stuff about the Dominion voting machines?

I mean, that was that's.

Like, like I saw it.

I go to every security conference you could ever think of and it black hat and DEFCON.

They they have this hack the vote area but they they hack these machines in the most unrealistic terms possible where sure enough, they have some hooded kids sitting there doing this.

Like, that's the one thing that election judges can say, like, who are those two guys in the head?

Who do you look like?

They can tell that, Yeah, they look a little suspicious.

You know, we have some strength in the heterogeneous nature of our voting machines.

We don't have the same one.

Certainly not in Texas.

And again, I wouldn't attack the endpoints.

I'd I'd attack the aggregation points and the reporting points.

In 2021, the denim was acquired by a coal fired Colorado based company.

How has your life changed since then?

Well, trying to catch up and honestly catch my breath.

We were going you were.

Traveling a lot.

Traveling a lot.

And I mean, I think it's safe to say that it took a lot of time to do the run up to that acquisition.

In the post acquisition integration, we've the focus now is trying to figure out what the next thing is.

And I'm midway through that, I'm still focusing on the airport.

That's my what the good news is that's a volunteer thing that I'm focusing on.

I got that, but just trying to figure out what problem to solve.

I don't know if I have another company in me.

I know my wife and my family is not excited about that.

That's fine.

But I'd say the biggest thing is cybersecurity in general is a little bit murkier or maybe even worse off than it was 20 years ago.

So that kind of motivates me.

So I'm certainly going to stay in that space and and we'll see where that goes.

You've talked a little about wanting to do some writing.

Would it be writing about cybersecurity issues?

Absolutely.

I started that process and I have a newfound respect for those that write for a living and know the real challenge that practitioners have.

Security consultants and people that are doing it within the organizations is what they see is on the cutting edge.

But they don't have time to write about it or connect the dots.

So I hope to have an opportunity, connect the dots more.

What you've been really involved with the business community.

You've been involved with the community in many ways.

We're seeing this now with the airport.

I know you've had people approach you over the years about possibly running for office.

Is it something that you've ever given any serious thought to?

I have, and that was brief, but there's two or three things.

I've got children, so I'm not interested in hopping from 170, 80 hour a week job to another.

I think there's a number two, and I think I've said this before, I really enjoy the cybersecurity stuff and I think we're solving problems that have a more national impact, if that makes sense.

We being on City Council, for example, we could get frustrating for you.

That's the third one is that I don't you I see these people that I really envy how they do it and how they are able to to listen and to take, you know so that the citizens to be heard and and and keep a poker face.

So I admire how they've done that.

But I don't know and this is airport is the way that I kind of channeled that energy or or scratch that itch but no immediate plans.

Well, John, thank you so much for being on the Texas talk.

Really appreciate it.

It was my pleasure.

Thanks so much.

That's all for this episode of Texas Star.

Thanks for tuning in.

We'd love to hear from you.

And if you want to share your thoughts or questions, please email us at Texas Talk@KLRN.ORG We'll be back next month with a new guest.

Until then, take care.