And he is right – in the world’s largest and most complex international real-time cyber defense exercises, Locked Shields 2024, the team of Latvian and NATO units won 1st place. Last year, the combined team of Latvia and Luxembourg took 4th place.
Mandelis compares the Cyber Defense Unit of the National Guard to a closed club where everyone knows each other, but in public, no one talks about being a volunteer in this unit. Also, the number of people in this unit is not disclosed – this approach is due to national security reasons. However, Mandelis himself is open to communication and speaks with great pride about his unit. Learn more in this interview from Labs of Latvia.
At the beginning of the full-scale war started by Russia in Ukraine, we at Labs of Latvia published an invitation to apply for the Cyber National Guard, which became one of our most-read and popular articles on social networks. What exactly is a Cyber Guard?
Although the name Cyber National Guard has become ubiquitous, the correct name is the National Guard Cyber Defense Unit. It was established in 2013 with the idea of involving information technology (IT) specialists in the National Guard and supporting the armed forces. It was clear that inviting high-level specialists from the civilian environment and providing them with the same salary as in their existing work is a very difficult challenge. Therefore, the idea arose to create a separate unit of the National Guard, where these specialists would be gathered and thus strengthen the country’s cyber security.
In fact, such an idea is fantastic – not all countries have such units where volunteers who work daily in paid positions in various companies and organizations, such as the banking or telecommunications sectors, also work in this unit in their free time (You'll find the cyber defense concept outlined in the attached document in English).
It’s not just an interest group – it’s a serious organization where IT specialists from different fields come together, exchange experiences, make contacts, and act as a bridge between industry and the military sector. If someone from the unit sees suspicious activities in their company, they tell us about it as well, and it may turn out that something similar is happening in another organization. And then the communication begins.
What is not discussed in public is discussed here.
Yes, they come together and look for solutions. It’s like a closed club where volunteers exchange information, share experiences, and gain a broader perspective in an area that people do not usually pay attention to daily. We strengthen our cybersecurity with our knowledge and desire to help the country. This is the added value of a Cyber Defense Unit – the best of the best are here.
Are they studying here, performing some tasks, or solving real daily challenges in national security?
There are various lessons and courses where you can gain additional knowledge. The studies are more aimed at preparing for some bigger operations. But people learn a lot by asking questions. You should be like a sponge that can absorb information and process it. Because if you don’t ask experienced guys, you won’t learn anything from them. When you regularly ask questions and get on their nerves, they will explain.
We also go to schools and talk about cyber hygiene. In previous years, we focused a lot on our internal bubble of armed forces, working with their training, but over time we realized how important it is to educate the public. If we educate society at all levels, from schoolchildren to senior citizens, we will cover all age groups. Sooner or later, the aunt who gets a call at 2 in the morning saying in Russian that her bank account has been hacked will know that this is not something normal.
It is very important not just to teach people how not to make mistakes, but to teach them how to think critically and evaluate whether something is real or not. You can be taught how to avoid clicking on suspicious links and recognize fake emails, but criminals learn too. Therefore, the most important thing is to teach critical thinking.
If each of us has done our homework, we will be a tough nut for an attacker to crack, and we will be more difficult to deal with because we will understand how to act, how to protect ourselves, and how to protect our families.
The Cyber Defense Unit has been operating since 2013. How has it changed over time?
The unit will be celebrating its 11th anniversary this year, and I have been part of it for seven years. I have seen how it was in the beginning and how it is now. It’s like day versus night.
In the beginning, everything was new, and everyone wanted to brag that there was such a unit. Many people wanted to join, but it was not really clear how to structure them. The first thing I did was implement the structure.
How did you know how to do that?
My previous experience was not related to IT. I must say frankly – when I agreed to join this unit, I thought that I had thoroughly mixed up the door. But the volunteers themselves and their activity helped me.
Once I gained their trust, I realized I could move mountains.
I like that in this unit, volunteers come with their own ideas, they have their own vision. They come from the industry and know not only their field but also understand the military field, as a result of which it is clear how these two fields can be integrated and improve our unit.
In the beginning, we were three professional servicemen in the unit, but now there are many more of us. I have built a fantastic team that works like clockwork. Everyone has their own area of responsibility, everyone does their own thing.
In the beginning, our mistake was that we appointed the technically strongest guys as team leaders. However, they are so passionate about the technical side that they forget their most important job – leading the team. It took time to create a different structure, but it worked.
We also realized that there are a lot of people who want to join the unit – more than we can accommodate. We had to figure out how to select the right guys and girls. Four years ago, we created a testing system. I provided direction, and volunteers developed a selection system that works fantastically. We check each applicant at different levels and offer each specialist the most suitable role for them. To make this possible, I invest a lot of time in interviews, talking to each one individually. For example, a couple of years ago, one computer science teacher wanted to join our unit but she was afraid of the exam. Although she did it quite well. And you know what she’s doing now? She is one of the main people who talks to all the new people who will be taking the test – she is in the right place.
Isn’t it the case that the unit accepts all interested parties?
No, no. I can’t say the exact ratio, but in the last selection, we took 11 or 12 out of about 20 applicants. There are only so many places, and I choose the best of the best. And I choose not only by points but also by test notes that indicate a person excelled in one task or another.
When talking to the applicant, I already have a clear idea of where I see them in the overall beehive. And I say – you can go this way or that way. It is important for me to give a person the opportunity to be in the field that his eyes shine on. Sometimes they don’t want to do the same thing as everyday at all.
And if you don’t like the particular role, there is an opportunity to change it within the unit. This democratic approach makes our unit unique. I also don’t ask anyone to call me commander. I don’t need it.
When I came to the interview, I was thinking exactly how to behave and what to say to security. Have I come to see Major Mandel? Commander Mandel?
When my folks address me as Major Mandel, I know something is wrong. It is not important for me to be addressed by rank because I myself speak to everyone as an equal.
I never look at ranks, but at personality – that’s the most important thing, not how many diamonds, stars, or anything else you have. What matters is who you are as a person, with whom to communicate and drive things forward. This is a key element that helps you find contact better. I also don’t make volunteers wear uniforms – that creates a boundary.
No less important is trust. I know that if I call this guy, he won’t ask why I’m calling him; he’ll ask, “What should I do? Where should I be?” There are many such people in our unit.
To outsiders, it seems that a person’s position or title is very important in military structures.
This is important in specific cases, but when working with volunteers, it is crucial to speak as equals. “Divide and rule” does not work here. In my opinion, a person who dedicates their free time to strengthening the security of our country should be respected. Every commander must consider that volunteers have their own lives, hobbies, and families. Just like me, but in addition to all this, volunteers find and dedicate their time, knowledge, and experience to improve the security of our country. It’s fantastic!
But how is it practical? I’m assuming that you have a relatively “normal” working schedule yourself, which probably ends just as the time to devote to the Cyber Defense Unit begins for volunteers.
My working hours never end; someone calls or writes to me all the time. There are active national guards who write even at 11 in the evening and know that I will answer if there is something really important.
However, I try to separate my private time a bit, and at some point, the phone is in silent mode. But if something really happens, they know how to reach me even when I’m resting.
I like that our national guards respect the fact that I have said I will be on vacation during a certain period and do not bother me unnecessarily. And I also try not to disturb them unnecessarily.
What does “without need” mean in this case?
Well, yes, it’s hard to define, to my mind. It is difficult to draw a line. My working hours are nine in the morning to five in the evening, but since I’m a professional soldier, it’s 24/7. And if my soldier wants to talk to me in the evening, I will not refuse him. I try to answer everyone – if not immediately, then after a while. If someone texts me at 11 in the evening and it’s not that important in my opinion, I will reply the next day because I know that if I start replying, a chat that never ends will start.
I understand that we cannot talk about numbers very freely, but just to get an idea – how many such volunteer specialists are there in the Cyber Defense Unit?
There are several hundred of us, that much I can say. And the number is growing.
But there are not thousands of them.
No.
Will there ever be? Or should there be?
You know, I’m not aiming for a specific number. It’s definitely not in my best interest. What matters is that each new volunteer is not just another name on my beautiful list. It should be someone I know, someone I would recognize in the middle of the night or on the street and say hello to.
It’s not like the number of volunteers is growing rapidly. Every now and then, someone leaves the unit and others join.
But overall, our number is growing. There was a lot of interest in 2014 when the Maidan and everything else first started in Ukraine, and again in 2022, when a full-scale war began.
It was a tough test for the unit: a significant number of applications came in every week. The most positive thing is that those who came during that wave are now among the most active volunteers in the Cyber Defense Unit. We are like one big family.
I’m sorry, but when I hear this term, the only thing that comes to my mind is: functional or dysfunctional family?
I would call it a family in the sense that we can trust each other, get in a boat and row for a while without scratching each other’s eyes, and find solutions to different problems.
With these people, I have this cool feeling like I’ve known them for years, even though we’ve only known each other for a few years. These are cool people doing good things together.
We all work together; the unit does not need people who have been listed here for years but have not been seen in real life for a long time. And inactive volunteers are a separate story. I try to delve into the problems of each person, and why they don’t come. Maybe it’s our fault, and we haven’t ensured the proper circulation of information, or maybe the person feels insecure and needs to be encouraged. There have been times when I feel like a dad trying to raise his own child. However, there are positive cases when a person understands the rules, and we give them a chance.
You do not immediately “throw” out?
No, I spend a lot of time talking to them. Of course, correspondence is OK, a phone call is fine too, but the best approach is to sit down, have a coffee, and discuss where the problem lies. If we understand that we can no longer go this way together, I am straightforward – we part as friends. If someone sorts out their personal life, finds free time, and wants to come back, the door is always open.
Is anyone coming back?
Yes, there are. For example, there was one guy with whom we realized after a conversation that it wasn’t working out. I suggested he join another battalion. He took some time to clear his head and returned later. When he came back, he was a completely different person. It happens, but not with everyone.
I am, of course, interested in the proportion of women in the unit. How about that?
I haven’t analyzed the numbers extensively, but we have quite a lot of women – from ladies who run various public relations events to women who are technically superior to some of the men. However, overall, we don’t distinguish gender here because we are all more or less equal.
Relatively recently, colossal news came out – the Latvian and partner team won first place in the “Locked Shields” competition. How big of an achievement is that?
It is the world’s most important cyber training event organized by NATO together with cooperation countries. Representatives of the USA, Canada, Australia, Japan, and Singapore also took part in the competition.
An added twist to these lessons is that instead of national-level teams, at least two member states participate in each team. In our case, this year there was a joint team of the Latvian and NATO Communication and Information Agency.
I wouldn’t say that we are now head and shoulders above others, certainly not. But this year we did everything we could and invested a lot of time in training and improving our knowledge. And the results did not fail.
If we look back, it took us 10 years to get back into the top 3. 10 years ago we were also the first, but that competition was a completely different level compared to what is happening now.
In these exercises, real-world situations that are ongoing or have occurred are always used as the foundational scenarios, bringing the competition closer to real conditions, where the situation evolves continuously every day, every hour, every minute – just like in real life. Real situations are played out, testing each team’s ability to adapt; if unable to do so, stay somewhere in the back.
It’s a fantastic experience to deal with questions that don’t have answers. For example, in this competition, our lawyers had to deal with issues related to space matters. No one knew what to do, but a solution was found.
The most important thing here is that the team works as one; each ant knows what it must do.
For Latvians, it is not enough that they took first place this year. At least the same results are expected next year. How challenging will it be?
Obviously, everyone is looking forward to us having the same success next year. What is our purpose? Push for a result? We will again do as we have done so far – we will improve our knowledge and then the result will follow.
You can’t say that, but in my opinion, it is not so important whether it will be third, first, or fourth place. The experience we gain and the cooperation we have with each other are much more significant. The bar is high, and there will be pressure from all sides. But I tell my boys and girls – let’s calm down, clear our heads, and start preparing in October.
I liked that this year we had equally strong specialists in all areas. We know what our Achilles’ heel is, what we need to improve, and what we need to work on. And that’s what we do. And the organizers don’t stand still either – they learn from their experience and also improve their tasks. It drives us forward.
This year we learned from last year’s mistakes – we realized that there are specialists in certain fields that we lack or have too few in our team, and with the help of the Ministry of Defence, we approached the industry.
How does it happen?
We write to the company, informing them that we are forming a national team for a competition comparable to the Olympic Games. We specify the experts we need and ask to find an opportunity to assign personnel if the company has such experts. Yes, there are challenges because the training lasts five days, but the National Guard Act entitles National Guardsmen to paid leave for five days a year. Additionally, the company should expect that this person will participate in both remote and face-to-face training in the period leading up to the training.
To get into the team, is there still time to join the Cyber National Guard?
There are two ways to get on the team. One is to come from one’s workplace and say that I am, for example, a super good lawyer with experience in international law and I am ready to share my knowledge. We’ll check it out and see if we want you with us. The second is to simply join the unit and when we start forming the team, apply to one of the groups.
I don’t think joining the unit just to do ”Locked Shields” is the best idea. You don’t have to join the unit, you can also come from the industry. Once we have contacted your employer, for example, a telecommunications company, then you will be able to apply. There are possibilities.
When preparing for a competition, it’s like a second job – be in or stand on the sidelines.
Everything happens fast in cyberspace – if you don’t react quickly, you’ve probably already lost. It is important to work in harmony, everyone together, to exchange information – just like in real conditions in a crisis situation, where no one has a ready-made recipe.
This interview was first published by Labs of Latvia and is reproduced by kind permission. Find more here: https://labsoflatvia.com/en/home
For Latvian speakers, Major Mandelis also recently took part in this discussion about cyber warfare at the LAMPA conversation festival in Cēsis.
