How to Prepare for Your Worst Cybersecurity Day

TL;DR

Prepare for a career crisis before it happens by establishing reporting protocols, supporting employees, and knowing how to cooperate with investigators. Steven Bay’s experience as Edward Snowden’s manager shows that warning signs can look like ordinary workplace issues, while a leader’s response under pressure can affect employees, the organization, and wider security concerns.

Transcript

Hi, my name is Peter Bibe. I'm the president and CEO of Security On Demand, and I'm here today with Stephen Bey. Stephen is the director of the Threat Recon unit at Security On Demand. Welcome, Stephen. Thank you. First of all, why don't you tell us a little bit about your background? Sure. So I started out my career at the National Security Agency... Read More

Key Insights

• Career crises are inevitable according to Bay’s central message, so professionals should prepare before their worst day arrives. Preparation includes understanding reporting procedures, anticipating intense emotional reactions, and deciding how leaders will support employees when an unexpected security incident becomes personally and organizationally consequential.
• Snowden’s medical explanation was presented as a carefully constructed cover story that began shortly after his hiring. Bay says it created plausible reasons for appointments, late arrivals, after-hours work, data downloads, medical leave, and an eventual disappearance that initially appeared to be an employee welfare issue.
• Predetermined reporting protocols are important when an employee becomes unreachable. After Snowden stopped answering calls and text messages near the end of the pay period, Bay notified his supervisor, who contacted NSA Security under established procedures for handling a missing worker on medical leave.
• Warning signs can remain ambiguous until separate events become connected. Bay and security personnel searched for Snowden while news organizations began publishing leaked information, yet Bay did not suspect his missing employee and dismissed a colleague’s suggestion that Snowden might be responsible.
• A severe incident can produce immediate and irrational fears in responsible leaders. After seeing Snowden identified in the media, Bay feared blame, imprisonment, harm to his family, employee dismissals, and national security consequences before he regained enough composure to respond deliberately.
• Employee care is a leadership priority during a crisis. Bay’s first organized response was to call each of his approximately 15 employees, hear their concerns, and help them process the situation, including employees who did not know Snowden well but still felt frightened.
• Investigative cooperation can be less adversarial than anticipated. Bay expected a harsh interrogation when summoned to the FBI offices, but he instead encountered FBI and NSA security personnel who conducted a conversation about Snowden’s hiring, interview, behavior, and possible stated motivations.
• Retrospective analysis can reveal planning that ordinary management interactions concealed. Bay concluded that Snowden had prepared his departure in advance, but during the events he interpreted the reported medical difficulties as genuine and offered support, human resources assistance, and short-term disability arrangements.

Questions & Answers

Q: How can cybersecurity leaders prepare for their worst career day?

Cybersecurity leaders can prepare by understanding established reporting protocols, anticipating that a crisis may trigger intense emotional reactions, and deciding in advance how they will support their teams. Bay’s experience also shows the importance of promptly escalating an unreachable employee through the proper security chain, communicating with leadership, listening to affected employees, and cooperating openly with investigators.

Q: What warning signs appeared before Edward Snowden disappeared?

According to Bay, Snowden reported epilepsy shortly after starting work and used it to explain medical appointments, late arrivals, and staying after normal hours. Later, he said the condition had become unmanageable and that he needed two days of medical testing. After reporting poor test results, he said he could not work, then stopped responding to calls and messages.

Q: How did the medical leave story support Snowden’s exit plan?

Bay says the claimed medical condition provided explanations for schedule irregularities, appointments, and working late when fewer people were present. It also created a credible reason to take time away from work. Bay later concluded that the story had been planned and that Snowden’s final message about his medical test results was sent after he had already reached Hong Kong.

Q: What did Steven Bay do when Snowden stopped responding?

Bay became concerned when Snowden did not answer telephone calls or text messages as the end of the pay period approached. He informed his supervisor that the employee was missing and might be in danger. His supervisor then contacted NSA Security under predefined protocols. Bay and security personnel subsequently tried multiple ways to locate Snowden, including checking residences and contacting family.

Q: Why did Steven Bay not initially connect Snowden to the leaks?

The first published leaks appeared while Bay and others were searching for Snowden, but Bay still viewed the two situations as unrelated. When a close friend suggested that Snowden might be the person responsible, Bay laughed because he considered the possibility extremely unlikely. He said that such an outcome would be his worst nightmare, which became reality the following day.

Q: How did Steven Bay react when Snowden revealed himself?

Bay turned on his telephone after Sunday meetings and found numerous missed calls and messages. A friend’s message indicated that his worst nightmare had come true, and a quick search confirmed Snowden’s public identification. Bay experienced a breakdown and feared personal blame, imprisonment, damage to his family, employee dismissals, and national security consequences before gradually regaining his composure.

Q: How should a leader support employees during a cybersecurity crisis?

Bay’s response suggests that leaders should make affected employees an immediate priority, contact them directly, listen to their concerns, and acknowledge their fear. After composing himself, Bay called all of his approximately 15 employees and discussed the situation with them. He also communicated with company leadership and other relevant people while preparing to cooperate with security investigators.

Q: What happened during Steven Bay’s meeting with investigators?

Bay was asked to meet NSA Security at FBI offices and initially imagined an intimidating interrogation based on portrayals he had seen in movies and television. The actual meeting was conversational. FBI and NSA security personnel asked what he knew about Snowden, including how Snowden was hired, what occurred during the interview process, what kind of person he appeared to be, and whether he had discussed privacy-related views.

Summary & Key Takeaways

• Steven Bay joined the Air Force as a Persian Farsi linguist, worked at the National Security Agency as a cyber intelligence analyst, and later entered commercial cybersecurity. His most difficult professional crisis began after an employee he had recently hired, Edward Snowden, disappeared while supposedly taking medical leave and stopped responding to communications.

• Snowden told Bay that epilepsy required appointments, schedule flexibility, and eventually an extended absence after medical tests. Bay says the condition became a cover story that enabled late working hours, data downloads, and departure for Hong Kong. At the time, Bay responded as a supportive manager and initiated the appropriate employment procedures.

• When Snowden publicly identified himself as the source of the NSA leaks, Bay experienced fear, shock, and concerns about blame, imprisonment, his family, his employees, and national security. After regaining his composure, he contacted his 15 employees, listened to their concerns, spoke with company leadership, and cooperated with FBI and NSA investigators.