Memoirs of a DoD Red Teamer, Vol 3: The Friends in the Foxhole
Vol 2 ended with the throughline that small teams with limited resources can still produce good work, but the cost of that work falls on the people doing it. I closed by saying that this post would be about the people who made the cost bearable.
This one is harder to write than the last two. The technical and organizational material I can lay out in a tidy way. The people, I cannot. I am going to do my best. Some of the people in this post deserve their own posts down the road, and they will get them. This one is the introduction. The fuller pictures come later.
Lance
Lance Cain came to the red team from the infantry side. He was a grunt who went cyber, and he hit the ground running.
The pattern with Lance was easy to spot from the first month. He had the energy of someone who had decided this was the work he wanted to do, and once he had decided, he attacked it the way you would expect a Marine with a few years of infantry experience to attack a problem. Head down. No drama. Whatever the next thing was, he was on it. I have worked with a lot of people in this field. Lance is in the small group I would put forward without hesitation if you asked me who to hire.
He was my right hand for most of my time on the team. We have published research together. Some of that work came out of nights in a hotel room, the cell taking turns staring at the same problem until somebody cracked the next piece. I will write about that initial work in future posts. The short version is that the partnership produced real output, and the writeups that came out of it are still in circulation.
What Lance has gone on to specialize in is Mac. He has been compounding it ever since. He is at SpecterOps now, and at this point if any Mac-related research, tooling, or technique comes out of SpecterOps, Lance’s fingerprints are on it in some way, whether the byline credits him explicitly or not. That kind of depth does not happen by accident. It happens because somebody decided, years earlier, that this was going to be the thing they got really good at, and then they put in the work, every day, for as long as it took.
He has been doing it for as long as it took. He is still doing it now. He earned every byline he has, and I would not bet against the ones that are still coming.
The other thing about Lance is that he made the work fun. Not in a clowning around way. In a "this is a hard problem, let's figure it out together and enjoy doing it" way. That quality, the willingness to enjoy a hard problem in real time while you are inside it, is one of the rarer things to find in this field, and it is what separates a team that operates from a team that just grinds through. Lance brought it to the room.
Pete
Pete McKernan joined the red team around the same time I did. It’s always hard joining a new team and integrating, but Pete and I hit it off right away. The short version is that we figured out within about ten minutes of the first real conversation that we had both come up as technical controllers before finding our way to cyber. That shared background is a particular kind of shorthand. You can skip a lot of explanations and get to the actual problem.
Pete is the kind of operator who you want in the chair when something is going wrong. He is calm under pressure in a way that is hard to fake. He has a strong technical foundation, and a sense of humor that gets sharper the worse the situation gets. That last part is the part I want to spend a minute on, because it is the thing that most defined working with Pete during those years.
Pete was the joker. He kept things light. No matter where we were, no matter what we were doing, Pete brought the energy of standing around the smoke pit shooting the shit with your friends. Hotel room at two in the morning, third night in a row, infrastructure on fire? Pete was telling a story. Government conference room with leadership about to walk in? Pete was making the side eye joke at someone on the team that nobody else was supposed to catch. Operations center in the middle of a serious push? Pete was finding the one thing in the situation that was actually funny and pointing at it.
That is not a small thing. Long stretches of intense work wear people down, and the teams that survive those stretches are the ones that have somebody in the room keeping the mood survivable. Pete kept the mood survivable. He made the work fun. That is the headline.
He also writes, which the rest of the team mostly did not at the time, and he writes well. Several of us, Pete included, publish over at itsbroken.ai when we have something lighter or more AI-flavored to say. The tone of my own writing owes something to his voice, by his own admission, and I am happy to admit the influence. Friends sharpen each other's writing the same way they sharpen each other's operations.
The other thing about Pete is that the partnership we built during those years did not end when one of us left the Marines. It carried forward. It is, in fact, the reason there is a company on the horizon. More on that in its own post.
Becky
Rebecca Allor deserves her own post. She is going to get one. This is the short version.
I knew Becky before either of us was on the red team. We had been at the same unit for a few years, in different shops, before we ended up in the same shop in the months leading up to both of us moving on. She got out of the Marines. I went to Okinawa. Then years passed. When I got to MCCOG and started crossing paths with the red team, there she was, on the team, doing the work. The re-meeting was one of those moments where you realize the world is smaller than you thought it was.
We rebuilt the friendship inside the work. Red teaming was the obvious common ground. Firearms were another. The biggest bond, though, was a shared love of lifting things repeatedly. Somewhere along the way we became close friends, and we have been close friends since.
One thing the rest of the team will confirm without prompting is that Becky was the one who made sure we ate. We had a pattern. Becky would ask whether we were going to get food. The rest of us would say fifteen more minutes. Then we would say fifteen more minutes. Then we would say it again. After enough rounds of the fifteen-more-minutes loop, the energy in the room would shift, Becky would explode on us, and the whole team would know that it was time to pack it in for the day. We came to depend on it.
The food was not really the thing, though. The food was the byproduct. The thing was that we were pushing too hard, and not eating was the most visible symptom of pushing too hard, and Becky was the only person in the room who was tracking the symptom against the underlying problem. We were heads-down inside the work, telling ourselves we were on the verge of breaking through, when what we actually needed was an hour away from the screens. Becky was reading the room better than the rest of us were. She knew when the team had passed the point of useful output and was now just grinding for the sake of grinding. She knew the reset would make the next stretch of work better than the one before the break. We knew it too, in some part of our brains, but we were inside the problem and could not act on it. She could. She did.
There is a particular kind of stamina that comes from having someone on the team who is willing to put up with any number of fifteen-more-minutes increments but who has a clear breaking point past which the team is going to eat and go home. Becky was that. We always knew where the edge of the day was because she was the one who would tell us when we got there. We pushed every time. She called it every time. The combination worked because both halves of it were honest.
The food thing is the light version of who she is on a team. The heavier version is the part of the friendship that has carried both of us through some hard stretches. We were each supportive when the other lost our fathers. We have helped each other through the kind of personal weight that nobody on the outside really sees. The clearest version of that, for me, is the story I want to close this section on, and it is one I will tell in more detail in her dedicated post when I get to it.
The day my dad went into a coma after a motorcycle accident, Becky and I were on an op together when the news came through. I was a long way from home, a long way from my family, and the work was not the kind you can walk out of in the moment the phone rings. The op had days left to run, and I was the person responsible for what was happening on the ground. I was going to be in the desert for several more days no matter what I wanted.
Becky was the person right there and the only one I told. I was the lead, and I needed to put on a strong face for holding the op together. She was there holding me together. She picked me up, both literally and otherwise. She handled what needed handling on the ground so I could deal with the part of it that was mine to deal with. She got me through the days until I could get back to my family.
She also knew that sitting in a hotel room with my phone for three days was going to be its own kind of damage. So she decided we were going to Joshua Tree.
It was supposed to be a day hike. The brief was “be back at the car by sunset.” We made it to the top, watched the sunset from where we were, and then, several beats later than we should have, realized we were considerably further from the car than we had remembered. The way back was longer than the way out had felt, the light was going, and we had to put some real effort into getting back without doing something stupid. We laughed about it then and we laugh about it now. It was exactly what I needed in the moment, and Becky was the reason it happened.
The trip did not fix anything. There was nothing about my dad’s situation that a hike was going to fix. What it did was get me out of the hotel room, out of my own head, and into a piece of country where the only thing I had to think about was where my next step was going to land. That was the thing I needed.
I do not have a clean way to describe what it means to have someone on the team who can absorb that kind of moment without flinching. I just know what it was like to be on the receiving end of it. The willingness to drop what you are doing and drag someone into the desert because they need it is the kind of friendship that does not come around twice in a career. I may be three times her size, but she has carried me further than most. I have been one of the people she leans on since, and I expect that to keep going both ways for as long as we are both around.
She gets her own post. I am looking forward to writing it.
Clint
Clint passed away a few years ago. This is the hardest paragraph in this post, and probably in this series.
Clint was a C# phenom and a command-and-control framework specialist of the kind you do not see often. He was the heart of the team and, functionally, the single person who maintained the Marine Corps Red Team’s long-term persistence capability. That is not an overstatement. The work he did was load-bearing for the team in a way that I do not think anyone outside the building fully understood at the time. He worked quietly, he produced relentlessly, and he made everyone around him better.
He was also, as a person, the kind of teammate who you wanted to be in a room with. Generous with his time. Generous with his expertise. Quick with a joke. He cared about the people on the team in the way that only someone who is paying attention can. He noticed things. He showed up.
He is going to get his own post. It will not just be from me. The people who worked with him are going to write it together, because no single piece of writing is going to do him justice and the collective version is the right version. If you knew Clint and you are reading this, you already know what I mean.
The Rest of the Team
I am not going to list every name. The people I worked with on the Marine Corps Red Team know who they are, and the ones who are still in the work know that the relationships did not end when the uniform came off. The team was small enough that everyone mattered. There was no dead weight to carry. There was, every day, someone who was carrying something for you, and every day, someone you were carrying something for.
I think about that team a lot. The conditions we worked under produced something that more comfortable conditions would not have. We needed each other in a way that I do not think I have fully needed any team since. The combination of small headcount, real operational responsibility, limited resources, and difficult organizational placement made the team into something tighter than its individual members would have produced on their own. The friendships are still real. The friendships are why the work mattered.
What the People Made Possible
The reason this post is in the middle of this series, instead of at the end of it, is that the people are not the epilogue. The people are the substrate. Everything I have already written about the work, and everything that is coming in Vol 4 about the operations and the inspections and the hard organizational moments, depends on the people I just described.
A small team without resources cannot produce on talent alone. It produces on cohesion. Cohesion is not an abstract concept. Cohesion is the specific quality of Lance staying late because the work is not done. The specific quality of Pete keeping the mood survivable when the situation should not have been survivable. The specific quality of Becky making sure the team actually ate and went home at the end of the day. The specific quality of Clint quietly maintaining the part of the system that everyone else depends on without ever making it a performance. The team produced because the team was the kind of team it was. The output was downstream of the people.
I have thought a lot, since leaving the Marines, about how to recreate that kind of cohesion in environments that have more resources and less forced intimacy. The answer is not obvious. I do not have a clean theory yet. What I do have is a clear understanding of what it looks like when it exists, because I lived inside it for several years, and the bar that experience sets is one I am going to spend the rest of my career trying to live up to.
Vol 4 picks up with the operations. The good ones, the long ones, the ones where the defenders pulled the plug and gave themselves awards, and the lead-in to the longest op of my life.
This was a stretch of my career working inside the Department of Defense, and the descriptions in this post have been generalized to keep the focus on the experience and the people rather than the tradecraft. Personnel referenced in this post publish or have published publicly under their own names. No units, dates, locations, techniques, or outcomes are presented in a way that would identify specific systems or people. Where details have been generalized, they have been generalized on purpose.