The setup
Jeffrey Starr and Craig Schultz had somehow sold QCRI a consulting engagement. On paper, in the NPSI Project Plan drafted 12/29/2013, the objective was ambitious. The plan would promote QCRI as “Qatar’s National Center of Cyber Security Excellence” across a full year of work: research and white papers on advanced persistent threats, development of detection and defense methodologies, a cyber test bed and reference architectures, and organizing national critical-infrastructure responses and red-team analyses.
The plan’s spine was a one-year work program in four task areas: understanding Qatar’s threat landscape, synchronizing with stakeholders and partners, building out QCRI’s cyber test bed and reference architectures, and assessing emerging security technologies. The first month was the critical one. The job was to get QCRI in front of the Ministry of Interior, MOI, as the government sponsor and land the first “lighthouse stakeholder”, then adapt the workflow to that stakeholder’s real threats. Qatar Petroleum and Qatar National Bank were the named candidates. On the ground, that first-month sprint of meetings is essentially the trip this entry describes.
The team, as the NPSI “who we are” deck listed us:
- Dr. Craig Schultz, CEO
- Dr. Jeffrey Starr, COO
- Dr. John Nitao, Senior Modeler / System Architect. He’s the dual-PhD mathematician from the NeoPrime “scan and plan” work.
- Paul Vilevac, VP Development & Chief Security Architect, on the ground as delegation lead
- John Compton, Senior Director, Cyber Risk Assessment. A very senior linguist, and the delegation’s relationship anchor.
- Andre Gironda, Senior Director, APT Forensics and Red Team Analysis. My friend from the AZ hacker days and later Corrigo, and my pick for skilled practitioner.
The way I’d joke about the roles on the ground: I was there as the agent, and Dre was the technical support. The delegation dynamic really did run on each of us playing a distinct part. Craig and Jeffrey originated and sold the work, and our QCRI point of contact was Omar Al Rawi of Qatar Foundation.
Craig’s wife gave us pre-deployment cultural training, covering norms and gotchas for how engagements would actually run: first meetings; the ritual of a home invitation and a host presenting his collection or treasured items; formal meetings with leaders that turn informal; delegation dynamics, where locals would naturally orient to John Compton as the eldest member; observance of the Friday Jummah, the Muslim counterpart to Shabbat, and what not to do during it; and some basic Arabic.
The arrival
We all flew separately. That was hard on me. I was sick as a dog, got dropped at the arranged lodging late at night with no local currency, and ended up drinking sink water. Andre arrived next, and together we worked out the ATM and the walk to the city center, which had everything. The first lodging was dorm-like student housing. We later relocated to a hotel just above the Souq Waqif, which was amazing.
Day one was at QCRI’s offices in the famous Tornado Tower, meeting our point of contact, a young Qatari man, and the staff. He often did not come along to the external meetings. A local “fixer” coordinated our interactions.
All of it unfolded against the 2022 World Cup build-up, including the from-scratch construction of Lusail City north of Doha, which was fascinating to watch.
How we worked: the engagement blueprint
Our method was deliberate, and it’s the real throughline of the whole Qatar run. We wrote the initial assessments to give us broad latitude to inspect before committing to any deeper engagement. The idea was to scope the relationship loosely enough up front that we could look hard at the real environment first, then decide where to go deep. Andre, for his part, built much of our wireless assessment kit out of parts he bought locally in Qatar: improvised field gear, assembled on the ground.
So the flow was consistent. Present who we were and what QCRI could do. Tour and inspect the real environment. Collect and assess, often with purpose-built or improvised tooling. Deliver findings, frequently summarized and sometimes reported only orally. And, above all, build trust toward a committed follow-on. Latitude to inspect first, trust as the closing move. That’s the blueprint every one of the engagements below was built on.
The engagements
The first month’s job was to walk into each institution, present who we were and what QCRI could do for them, scope an engagement, and move it toward a pilot. Over roughly two weeks in January 2014 that meant a sequence of meetings. A running theme across most of them was that more than one host quietly wondered whether we were Western intelligence, NSA or CIA. It was equal parts obstacle and dark comedy. Specific security findings per institution stay discreet.
Ooredoo / Qtel, the national telecom and ISP, was the first meeting. We visited their datacenter and presented the plan. They gave us a datacenter tour, which got cut short when someone raised the concern that we might be NSA or CIA. Amusing.
Qatar Petroleum, national oil and gas, was the anchor “lighthouse stakeholder,” and roughly 60% of the country’s GDP. That made its security a national-interest question more than a corporate one. The first visit was the usual rhythm: present the deck, talk to their people, arrange follow-ups. It sat in the familiar regulatory frame of CIIP, ICT Qatar / Q-CERT, and ISO 27001 / 27005, and QP offered several days of their own staff’s participation toward a SCADA-centric pilot.
Qatar’s financial-markets regulator, the SEC equivalent, was brief, and it didn’t develop further.
The Ministry of Interior was the most structured meeting, and the most distinctly Qatari. We went to their HQ, and staff brought us into a conference room with twenty to thirty of their cyber and IT staff, most in uniform. John used his linguistic skills to prepare the room, then handed to me to present, as he did throughout. Afterward they asked us to wait, then showed us into the top official’s office. He sat behind a huge desk, we sat on couches, and tea came. We discussed engagement plans and timing, with John the focus but routinely passing to me. But it went well, as the next invitation proved.
A few days later the fixer called. We’d meet the Minister and his top people in Lusail, one evening, in an enormous lobby ringed with tent-like private enclosures. We were escorted into the tent, the hosts in traditional linen garb, with one person of roughly equal rank paired to each of us. John sat with the Minister, I sat with the head of state information security, and Andre with their top incident-response / threat-intel lead. The fixer then left us to it. This was the “critical meeting,” and it was almost entirely about building trust, over dates, tea, and conversation that ran for hours. It ended with a commitment to follow up.
Community of interest, or COI. The plan also had QCRI engaging a broader set, among them a QP regional security meeting, Qatar National Bank, and a SIRT. The goal was to seed follow-on “lighthouse” engagements in other industry segments. The longer-term vision was three reference architectures: SCADA / energy, banking, and enterprise.
My role / what I did
Delegation lead on the ground. I ran the external meetings, set the technical agenda, and did the practitioner work alongside Andre. John Compton was senior linguist and relationship anchor, and the QCRI point of contact opened doors. The deliverables the plan put on me and the team for month one were concrete: a memorandum back to QCRI on the MOI and first-stakeholder meetings, with findings and recommendations; a white paper on forecasting threats and control measures, building on Dr. Schultz’s November 2013 Qatar Foundation panel; a memo on the QCRI test-bed priorities; and a memo recommending emerging technologies to test. In practice I was the one translating between QCRI’s academic framing, the institutions’ real operational problems, and a scope of work each side could actually sign up to.
Net result
I teed up all of it, mostly as the thoughtful presenter and the author of the engagements, and the trip did what month one was meant to. It produced real relationships at MOI, capped by the Minister’s “critical meeting” in Lusail. An improbable thing to have pulled off: a small US team, fronted by me, walking into the national oil company, the national telecom, and the interior ministry of a Gulf state and scoping engagements at each.
But as the program moved toward its follow-on phase, things at Triverium were taking a turn, and the fixer’s promise to also introduce me to Qatari investors for Triverium evaporated. I chose to return home. Dennis Groves replaced me. He’s an OWASP co-founder, a DevSecOps-manifesto co-author, and a friend of Andre’s. Fittingly, the QP engagement actually went better with Dennis in the seat. He and one of QP’s senior people had done their master’s together at Royal Holloway, University of London, known for its information-security program. And that was the end of my adventures in Qatar.
What I learned
- Cross-cultural engagement at the national-institution level is its own discipline. The cultural training mattered as much as the technical content: who defers to whom, how a formal meeting becomes an informal one, what a home invitation means, and when not to push. Reading the room was half the job.
- Culturally normative behavior doesn’t always translate to a US org’s expectations, and vice versa. It’s a lesson that rhymes with the RMS experience.
- The hardest part of selling security isn’t the tech. It’s scoping something the other side will actually commit to. At QP it was getting them to put their own people and a pilot on the table.
- In that part of the world, trust is the deliverable. The MOI “critical meeting” wasn’t a technical review. It was hours of dates, tea, and conversation, one host paired to each of us. And the recurring suspicion that we were NSA or CIA was a standing reminder that who they believed we were mattered more than any slide.
Key people
- Dr. John Nitao, dual-PhD mathematician and Senior Modeler / System Architect on the NeoPrime team.
- John Compton, very senior linguist, “Senior Director, Cyber Risk Assessment” on the deck, relationship anchor, and eldest of the delegation.
- Andre Gironda, the practitioner Paul tapped. “Senior Director, APT Forensics and Red Team Analysis” on the deck; hacker-days friend; later Corrigo.
- Dr. Craig Schultz and Dr. Jeffrey Starr originated and sold the engagement through NeoPrime. CEO and COO on the deck.
- Omar Al Rawi, QCRI / Qatar Foundation point of contact.
- Dennis Groves, OWASP co-founder and DevSecOps-manifesto co-author. Originally a friend of Andre’s, he replaced Paul in Qatar for the follow-on phase and remains a good friend. He and a senior QP figure were Royal Holloway master’s classmates, which helped the QP engagement.
Technologies / methods
The NeoPrime assessment framing, scan-and-plan and risk-driven prioritization, carried into the engagements. The institution-specific subject matter spanned SCADA / ICS security for distributed “intelligent oil field” assets, telecom supply-chain and equipment-trust questions, NOC/SOC operations and monitoring maturity, and mobile / LTE device management. All of it mapped against ISO 27001/27005 and Qatar’s CIIP / Q-CERT regulatory context. The one-year plan also scoped a QCRI cyber test bed, covering malware reversal, security-product performance testing, secure data storage/transfer, large-data analytics, sandboxing/attribution, and training. Beyond the test bed, it scoped the evaluation of emerging security technologies: active deception, rogue-wireless detection, SCADA/serial-port devices, advanced DLP, and smart-grid security.