Cyber without borders: Standing guard 210 kilometers from risk.
Liz Stokes: Hello, and welcome to our final episode of our three-part series on NATO's 2025 cyber coalition exercise. I'm Liz Stokes. In this last chapter of our journey, Maria Varmazis and I step back, not just to recap what we saw but to reflect on what it all means. Throughout this episode, you'll hear our reflections woven between the moments, conversations, and scenes we brought home with us. The past, present, and future blur a bit here; but that's because that's how this story unfolded for us. This is a story about vigilance, solidarity, and what's at stake when cyberdefense both secures and defies borders with very real consequences. And, as we move through it, we'll be reflecting right alongside with you.
Maria Varmazis: Maria Varmazis here. I am in Orlando, Florida with my colleague, Liz Stokes.
Liz Stokes: Hello.
Maria Varmazis: And we are actually here for Commercial Space Week in Orlando, Florida. Nothing to do with NATO.
Liz Stokes: Yeah.
Maria Varmazis: But, you know, we're here on another assignment. So we figured we would, since we're here in person, get together and talk about our NATO experience. It was two months ago now, just about, right?
Liz Stokes: Yeah.
Maria Varmazis: Yeah. It was about almost two months now, so we've had some time to digest it a little bit. So I'm curious if anything stood out to you on that specific day when we had the tour of a cyber range.
Liz Stokes: Yeah. I remember well. First of all, it was a great experience; and I know that you and I are both very appreciative that we got to go and do that.
Maria Varmazis: Oh, yes. Yep.
Liz Stokes: It was very apparent that it was -- I don't want -- the word that's coming to mind is secretive. Of course it's secretive. It's NATO.
Maria Varmazis: It's military. Yeah, yeah.
Liz Stokes: But, I mean, Maria, you and I walked in; and we walked into a SCIF.
Maria Varmazis: Yeah, yeah. Yep.
Liz Stokes: Everything was boarded up. We could not see anything. Yeah. I mean, it was just -- it was very interesting getting in there and kind of seeing nothing, while we went to see a lot. And it was very informative, and we learned a lot. We also -- it was very secretive --
Maria Varmazis: Yeah.
Liz Stokes: -- like most, you know, military things are.
Maria Varmazis: Yeah.
Liz Stokes: And, I mean, that's fine.
Maria Varmazis: Yeah.
Liz Stokes: We went to learn, and we did
Maria Varmazis: Yeah.
Liz Stokes: And we went to witness, and we did.
Maria Varmazis: We did.
Liz Stokes: We witnessed. We witnessed exactly what they wanted us to witness --
Maria Varmazis: That's exactly it.
Liz Stokes: -- and yeah.
Maria Varmazis: Because that, that was the conversation we had when we got back was, when you go to something like this, because you are effectively, we were standard stuff, you're handled, you know. Like, we were escorted at all times. Of course. This is not shocking or anything like that. This is just standard procedure. The narratives that you were shared, the things that you were told, this is what they want you to know. And there's a reason they're telling you this. There's a reason they're communicating this all with this. So, for us, it's like you can try to read between the lines. But it's also -- doesn't have to be that complicated. It's like they're specifically a story that they're communicating to the world. And, to me, it was like a message of coherence. Like, that's the other C that wasn't maybe said. But it was like they're trying to convey a sense of, yes; we're doing these 3Cs of what, the collaborate, cooperate, coordinate. But it's also that they're a coherent alliance that is working together. And, again, two months later here we are going, is it? But, at that time, it certainly -- it seemed that way, or at least that was what they were trying to project. And I would love for it to continue to be that way. We are continuing to work together. We are continuing to share information in ways that make sense for our respective nations. Not everything's going to be shared all the time, but what can and should be will be shared with expediency. And we want you to know that, and we also want our adversaries to know that. And it's like that -- I mean, we understand that our job as being the media is like that's the story that they want to tell. In a way, we're a conduit for that. Whether or not people sign on to that is not our thing. I mean, we have no way of saying, yes, they were successful in that or not. But this is -- this is what we were able to see. This is what they shared with us, and this is the message that they wanted us to know, that they wanted to convey.
Liz Stokes: Yeah.
Maria Varmazis: Take that for what you will.
Liz Stokes: Yeah. That's exactly what I was telling my family, exactly. When I was coming back and they were asking me, What did you go over there for?
Maria Varmazis: Yeah.
Liz Stokes: It's like, we went over there to interview NATO and have them tell us what they really wanted us to know. And that's exactly what we did.
Maria Varmazis: To a regular person who doesn't live and breathe cybersecurity, sometimes the stakes can seem a little bit abstract. Sure. When systems come to a crashing halt, that much is obvious and unavoidable. But a lot of the time it's an IT problem with IT solutions, so just let IT handle it, right? But, yeah. Systemic society wide crises like what Estonia experienced in 2007 can happen to anyone, anywhere. And certainly a lot of smart, hard-working people are training to prevent that from happening. But that threat is the undercurrent of so much of what drives the work being done at the NATO Cyber Range. And it's funny. That "What did you go to do and see over there?" question was one that Liz and I both got from a lot of people in our lives after we came back. And I think maybe it was disappointing to some folks that we didn't have flashy stories about some crazy, cutting-edge high tech to share, nothing bonkers to blow people's minds. Instead, what we saw was actually, dare I say it, kind of mundane. But it being mundane is to me what made it so important, that a massive international organization like NATO has devoted a place and serious time -- two weeks, remember -- to getting people together to get better at something to me is notable. Yes; military organizations train. News at 11. But think about it. They are still taking two weeks out of their day-to-day operations to train. Despite the impact, they see the value in taking that time to refine their communication and coherence in the cyber realm. How many private sector cybersecurity organizations can say the same?
Liz Stokes: So, Maria, I know that you and I have been producing this together for the past, what, two months now. We've been scripting, writing everything. We've been trying to put into words exactly what happened while we were over there. How has it been going for you? What are your thoughts on things? Do you have anything that you'd like to share?
Maria Varmazis: Yeah. I mean, we've touched on sort of the meta challenge, for lack of better terminology, of geopolitics seismically shifting underneath our feet as we came back from this trip. It's now early January, and now suddenly the United States' position in NATO is extremely in question. And, also, the United States is threatening its own allies. Like, how -- I mean, just on a personal level, I'm just trying to make sense of this all. And I'm aghast, for lack of a better term; I mean, scared as hell, shocked, confused, angry. Like, I'm feeling all of these feelings. And this is just me, my read of that situation while trying to think, okay. I'm trying to tell this story about these incredible people that we met from so many NATO allied nations, trying to be, you know, not too emotional about it. But, I mean, I can't lie. It was a very affecting visit. Seeing all those people working on these incredibly difficult problems, working on cybersecurity defenses for a whole bunch of different countries but also coordinating with their teams back home that we couldn't see and knowing that these are the people who are either working on keeping their country secure or working with the people who would be doing that, both of which is extraordinarily hard and, in many cases, both at the same time. Coming from the corporate cybersecurity world, I know even within a corporate situation these are extraordinarily hard problems. But, when you're talking about military and civil network defense, critical infrastructure defense, this is the stuff that nobody gives any credit to. Nobody thinks about until it fails. And, of course, it's always underresourced. And it's so crucial for human life. So it's just like that whole duality of this is the stuff that keeps civilization going; and, yet, nobody knows about it. These are like our unsung heroes. It's like meeting those unsung heroes, right? And, of course, they're all very humble about it; and they're all very modest. And I want to make sure that, as I'm scripting their story, that I'm giving them the respect and gravitas, if that's the right word to use here, that they deserve. There were so many unsaid things. You could feel the weight of it. That's I guess the thing I've been -- I've been struggling with is you could feel the weight of how important their mission is. I could feel how serious it was for them. And I've met many defenders in my day in the cybersecurity realm, but this was a different echelon. Even though this was an exercise, I can only begin to imagine what they're dealing with in their day to day and the stakes for them. And then being in a country that is on the border with Russia, you know, a nation that is pretty adversarial right now, the stakes are really explicit. And just like they're right there. The people, especially in Estonia, this is -- this is very life or death for them. I mean, think about how many times we saw the Ukrainian flag flying, right?
Liz Stokes: Yeah.
Maria Varmazis: It was everywhere. The Ukrainian flag colors were absolutely everywhere. I mean, this is life or death. It really, really literally is. And I guess for me it's like, am I communicating the stakes well enough? Am I -- am I getting across that this is not just some, you know, oh, if we get hacked, maybe some of our PII gets breached. Not great but, you know, nobody's going to die. That's not the situation these folks are dealing with. These are people who are dealing with literal life or death stakes. I felt that when we spoke with them, and it just felt heavy to me. But, like, you know, somebody's got to deal with it, right? And I'm just -- I'm wondering to myself, am I doing a good enough job in communicating that. I don't know. So I'm not sure if this is a good idea right at the moment. Maybe we should proceed somewhere else. Let's go down the street this way. Are you sure we're not due for any -- should we go around this way?
Liz Stokes: I was just being --
Maria Varmazis: Or do you want to go down this way. Are you still recording? Okay. So the situation is we are in the center of Tallinn Old Town, and we just turned down a side street very close to the Christmas Market. And the Russian Embassy is right there. And the fence right in front of the Russian Embassy is absolutely plastered with protest posters, handmade, all of them, protesting the Ukraine war. Messages like stop killing people, Putin has blood on his hands, things like that. And it's very significant to me also that every other visible flag immediately on the edges of the embassy are very proud Estonian flags held open in defiance. Again, it just drives home the stakes that we've been talking about the last few days. And, for many people, these kinds of things are theoretical. But here it's not. It's very real. But, otherwise, life goes on; and it's an otherwise ordinary street in the part of Old Town. Looks like all the rest of them except when you turn that corner, that fence is -- and that -- the Russian flag, of course, right above it tells you exactly what's going on. Yeah. There was an armed guard that came outside as we were sort of standing in front of it because, you know, we were standing there with our backpacks and a whole bunch of gear. And I'm sure we probably looked super suspicious. So we were, like, we're going to get a move on now. When Liz and I chitchatted with our hosts during our visit, whenever we mentioned that we really had been enjoying our time in the Old Town, inevitably, people would drop their voice to a whisper and ask, Did you happen to go past the Russian Embassy? Did you see what was going on there?
Liz Stokes: Happening upon the Russian Embassy in the middle of their Christmas Market was probably one of the things that, like, threw me the most because I was not expecting to see, you know, 20 Ukraine flags on the surrounding embassies --
Maria Varmazis: No.
Liz Stokes: -- just in solidarity --
Maria Varmazis: Yeah, yeah.
Liz Stokes: -- with what was going on.
Maria Varmazis: And it makes sense, given Estonia and Ukraine's history.
Liz Stokes: Yeah.
Maria Varmazis: Like, they're -- they're brothers.
Liz Stokes: You don't realize it until you witness it firsthand --
Maria Varmazis: Yeah.
Liz Stokes: -- which is exactly what we did.
Maria Varmazis: Yep. I mean, it's like one of those things that I knew, I've known. But, when you're actually on quite literally the front lines where -- especially where the cybersecurity attack happened, the 2007 attacks, right, where they just -- they know -- everyone just says 2007; everybody knows what you're talking about, right? Estonia knows. Estonia knows well how much higher the stakes are.
Liz Stokes: I mean, only after us researching that heavily did I even fully grasp what the 2007 and cyberattacks did to Estonia.
Maria Varmazis: Yeah.
Liz Stokes: And I think, again, it's like one of those things where you have to kind of -- you have to witness it firsthand.
Maria Varmazis: Estonia is fiercely determined to keep their independence. And their solidarity with Ukraine, a fellow former Soviet republic, is obvious from the moment you step off of the plane. The Ukrainian flag is absolutely everywhere in Estonia, as I mentioned a bit in previous episodes. And it often flies at the same level and equal honors as the Estonian flag. Skyscrapers were lit up yellow and blue. Even city tree Christmas lights were solely in yellow and blue, Ukrainian flag colors. People in Estonia understand very well that whatever happens to their Ukrainian brethren could very well mean them next. Estonia is also very proud of being part of NATO. Aside from seeing NATO's flag flying proudly on flagpoles and the like, even when I was at Tallinn airport heading home, I saw a pin souvenir that featured the Estonian and NATO flags. Actually, I still have it here on my desk, still in its cellophane. I don't think I've ever seen the NATO flag with that level of prominence in a tourist tchotchke shop before, right next to the key chains and the fancy chocolates. And, honestly, I'm trying to remember the last time I saw the NATO flag flying anywhere in the United States. While we often say cybersecurity is a global, borderless business, that might be easy to say when your adversary is not literally right next door. When you are in Estonia, it's just about impossible to forget that the stakes are a mere 210 kilometers away at the Russian border. Estonia, as a former Soviet republic, became independent with the fall of the USSR in 1991. The legacy of the Soviet years are fading in this uber modern, tech-forward nation. But the physical reminders, from the languages spoken to the Soviet-era buildings and, yes, sometimes even the statues, those physical reminders, they are still there. What would you like people to take away from it?
Liz Stokes: It's a great question. I mean, I definitely want people to learn the history. Again, I sat there for hours after we got back, learning, ingesting.
Maria Varmazis: Yeah. My whole flight over and back, I was just, like, reading so much.
Liz Stokes: Taking it all in.
Maria Varmazis: Yeah. Hours and hours.
Liz Stokes: And I don't -- I mean, you guys don't have to do that. That's what we're here for. But I think you should learn about what happened because not that it's never going to happen again. It can happen again.
Maria Varmazis: Probably will.
Liz Stokes: I -- you're right. Yeah. It probably will. And, you know, it's like --
Maria Varmazis: In ways that we can't imagine.
Liz Stokes: Yeah. It's the age-old thing of, oh, it's never going to happen to me. Well, you never know.
Maria Varmazis: Yeah.
Liz Stokes: Honestly, just learning about that history, kind of taking that into consideration and learning about what NATO now does to kind of help protect these allied countries is something that I want everybody to take away of.
Maria Varmazis: To me, in addition to what you said -- because you're right on. You are absolutely right on. The thing that I walked away with -- and maybe this is also because it's what NATO wanted me to walk away with. I will totally fess up to that -- was that, when I think of cybersecurity in general, I'm not going to say, you know, the technical problems are fixed now. It's -- that's, like, wildly not correct. But, for years, the emphasis has been on just you need a shiny tool. You've got this problem? We've got a tool to fix it. And it was really remarkable to me that NATO was not focusing on that.
Liz Stokes: Yeah.
Maria Varmazis: Like, there was a tool that they showed us about -- it was VCISC. VCISC was the hardest acronym to say ever.
Liz Stokes: It is a very --
Maria Varmazis: It's just a beast of an acronym. But they were really all about humans talking to humans, humans understanding humans, humans understanding how to work with humans. It's like, okay. The tools are really tertiary, at best. It was, how do we communicate to each other? How do we understand what each other needs? That's interesting to me, that we're going back to really the core human problem and solution of working together. And an alliance needs to be good at that. And, I mean, that's kind of the core of what it is, what it means to be in an alliance. The North Atlantic Treaty, better known as NATO, and its official text was written On April 4, 1949. We have to think about how different the world was back then. Well before the internet was even a glimmer in DARPA's eye, cybersecurity was added in as a domain of expertise to NATO in 2017 with space added in 2019, by the way. Certainly, the nature of warfare has changed a lot, as have the broader geopolitical contexts, especially since Russia's invasion of Ukraine in 2022 and US President Trump's reelection in 2024. Just a month after coming home from the NATO exercise, the future of the United States' role in and with NATO seems profoundly uncertain. And, putting all of my own personal and political viewpoints on that aside, the idea of leaving an alliance like NATO, from a cybersecurity perspective, really gives me pause, to say the least. Effective defense and offense are always stronger as a collaborative, cooperative, coordinated exercise. Remember those 3Cs that Commander Kaplan kept saying? How can you possibly maintain any kind of advantage over adversarial activity when no one's sharing information with you. Nobody's catching your blind spots. Nobody's covering you when you inevitably hit a language, cultural, mindset, process, technological -- you name it -- barrier. If you consider the United States to be ahead of the game in the cyber realm -- and, sure; many of us do -- genuinely, how long do we think a technological head start in cybersecurity possibly could last if we're basically going it alone? Two months after my trip to Estonia, all I can think about is the many wonderful people that I met in Tallinn and the many Ukrainian flags flying high and proud next to the Estonian flags and that NATO flag pin at the airport and everything that is at stake, explicitly and implicitly, when an alliance frays, when promises aren't kept, when trust is eroded slowly and then seemingly all at once. When defense is not cooperative, collaborative, or coordinated anymore, it's definitely not cohesive. And, at a certain point, it won't be very effective, either. With the stakes being as high as they are, this won't be just a problem for our most elite of cybersecurity defenders. It will become everyone's problem. Thank you for listening to this third episode of our Three Part series. We do have a little bonus that we'll be dropping in the podcast feed for you. That's my audio reporter's notebook with clips that I recorded while in Tallinn walking around or freshly out of the SCIF or at four in the morning trying to get the coffee machine to work. If you are interested in the more unfiltered experience from this assignment, the reporter's notebook is for you. Think of it as a bonus Episode 4, if you will. This episode was produced by Liz Stokes. Mixing, editing, and sound design by Tré Hester. Our executive producer is Jennifer Eiben, with content strategy by Ma'ayan Plaut. Peter Kilpe is our publisher. And I am your host, Maria Varmazis. Thank you so much for listening.
