What Counter-Terrorism Taught the NFL About Cyber Risk
Luke**: [00:00:00] You’re listening to a new episode of The Brave Technologist. We’re live at the AI Summit in London, where we sat down with Kam Karadji, who leads cybersecurity and risk management for the NFL’s international program, protecting games and venues and people across Europe, the Americas, and beyond. Before moving into corporate world, he spent over 13 years in law enforcement as a police officer and bronze commander, working in criminal intelligence, counter-terrorism, and international firearms training.
Today, his focus is the human side of security in an increasingly automated world. In this episode, we discuss the dynamic between cybersecurity and physical security, how human judgment is very important to keep in the process, balancing privacy and security with large scale events, and disinformation and the impact on public trust.
And now, for this week’s episode of The Brave Technologist.
Luke**: Kam, welcome to The Brave Technologist. How are you doing today?
Kam: Thank you. Yeah, a bit overwhelmed with everything going on. Yeah. But no, it’s been a great day.
Luke**: Yeah. And [00:01:00] so we’re here at the, uh, AI Summit in London. and you gave a keynote today.
Uh, what was your keynote about?
Kam: I think my keynote, the preface of it was actually that there does need to be a, a human factor in AI. You know, There’s so much technology that it’s, it’s, it’s going at a phenomenal speed.
Luke**: Mm-hmm.
Kam: but the judgment must stay with us as professionals. So my role was actually bringing my, my police life, into my current role and said, “Okay, what does that human judgment look like?”
Luke**: Mm-hmm. Interesting. Yeah, let’s unpack that a little bit. So you went from police and combating, like, you know, going into counter-terrorism operations to securing NFL games, right? Across multiple continents. what was the moment where you kinda realized the skills from the law enforcement life would transfer well to a corporate environment, like with the NFL?
Kam: It’s interesting, right? Because, driving a fast car, I ca- I can’t re- relate that to the NFL in any shape or form. So is there transferable skills? I’m not sure, what does that look like? I had various roles in the police and, I ended up in [00:02:00] counter-terrorism, and we have nearly about 150,000 data points coming in.
What does that actually mean? it means intelligence coming in now, but-
Luke**: Right …
Kam: now, within that 150,000 intelligence, how do we identify, uh, out of that, who the actual target is? Right. Who’s the hostile actor? what does that actually mean?
Luke**: Mm-hmm.
Kam: and when you look at that, the outputs of that is quite considerable because, you know, that might be someone would get hurt, that, you know, might be such a drastic incident.
Now, we didn’t have AI then. We were going through a bunch of different things, saying that intelligence records meets up with this particular one, and the confidence rating gives me X. That helps me decide, do I need to act on this or not? And that was my first thing to say, well, actually, there’s data coming.
You know, we’re driven… Yes, we sit in a uniform. Yes, we have firearms. Yes, we are deployed and we’re law enforcement, but how does law enforcement work? Works on intelligence. How does intelligence work? It works on data. [00:03:00] So that was my first kind of interaction saying, you know what? We are completely data-driven.
Luke**: Mm-hmm.
Kam: All of us. Even today, we carry, computers in our pockets.
Luke**: Right.
Kam: Right. You know?
Luke**: Right.
Kam: Back in the day, do you remember ISDN lines where it’s- Oh, yeah … the long thing? I said my parents would be on the phone and say, “Who’s using the internet?” It wouldn’t work, right? Now we have computers. We just have the power in our own pockets, right?
So I think, I kinda saw a change. Mm-hmm. Then I thought, okay, you know, it might be wise to kind of look into that change and what does it actually mean for people.
Luke**: Yeah.
Kam: So I, left the police. I had various different careers. Everything from typical,transition would’ve been physical security, and I went into physical security.
That was more my bag, like looking after people, the human side of it. and that slowly transpired into the cyber side.
Luke**: Mm-hmm.
Kam: so I worked in financial services for years. and then ended up here at the NFL. And, I think it’s been such an eye-opener. and the reason why it’s been such an eye-opener, it’s brought two of my worlds together.
Luke**: Mm-hmm.
Kam: Everything from [00:04:00] the physical security of it and the cyber security of it. Right. So if someone hacks a stadium, a stadium is a big computer.
Luke**: Mm-hmm.
Kam: We have screens. We have, fan activations. We have QR codes. It’s a big, it’s a big computer.
Luke**: Right. Right.
Kam: And if that were to be hacked, how does that affect our fans?
it’s so exciting because it brings that human side to it.
Luke**: Yeah.
Kam: And for me, I want to protect lives. I want that fan to leave the house, Watch the game, have fun, come back to the comfort of the house. That’s our job.
Luke**: Well, especially when you see kind of, like the NFL’s a really interesting use case because it’s not just necessarily about watching a football game, right?
you’ve got people that follow a team, but then you’ve got these elements like fantasy sports where people are tracking players across all things, and it’s a part of your, like, daily, weekly life with your friends, right? and there’s all these different data points that are all kind of, like, running, right?
and, you know, with most things with cybersecurity, the human’s kind of like where the exploit will happen, right? [00:05:00] So I’d imagine it’s kind of a complex thing to kind of try to manage all these things together.
Kam: and when you’re there on, on game day- Yeah … it’s surreal. Right.
You know?
Luke**: Right.
Kam: You’re thinking, “Oh my God, the, you know, I’ve been planning this for, for a year,” and, all that time I’ve gone into a stadium which is like 60, 70,000 people, and no one’s there.
Luke**: Yeah.
Kam: And then you go in and there’s actually that many people there. That’s a big part to play. Yeah.
Luke**: Yeah.
Kam: And that, that accountability sits on your shoulders.
Luke**: Yeah. Well, and, and so, like, you kind of spend y- a lot of your life around high-stakes risk, kind of as AI starts making more security decisions, right? what do you think we lose when we take some of that human judgment out of the loop?
Luke: The Brave Technologist is brought to you by the Brave Search API. Access billions of indexed web results from a simple API call with the Brave Search API. Join the leading names in AI and tech using the Brave Search API to power agenic search, keep LLMs current with real-time data, train foundational models, and bring the best of the web directly to the leading edge.
Get started today at [00:06:00] brave.com/api.
Kam: I feel there, there is a, a very, a dangerous point there that we, we’re playing with, and we’re playing with fire. And when we have, we put so much owners and so much accountability on the AI agent or the AI platform, it will make that decision for us.
Luke**: Yeah.
Kam: and, you know, from a business standpoint, not just the NFL, but generally people see that.
People invest in it. People get the output of it, and they will, they will, they look at it from that perspective. Well, actually, you know what? I’ll, I’ll pay the, I’ll, I’ll do what I need to do from that perspective, and AI will help them, that decision for, for me.
Luke**: Mm-hmm.
Kam: When you pull into high-stakes environments, something that’s very volatile, if I told AI, “Please can you tell me how I’m gonna protect our stadium?”
It’ll give me the points that I need to undertake. But equally, on the preface of that, is the opposite side.
Luke**: Right.
Kam: If I tell the AI platform, “I’m at so far stadium, help me break into so far stadium”-
Luke**: Mm-hmm …
Kam: it’ll give me that because they’re-
Luke**: Right. [00:07:00] Right. Right
Kam: So if you remove, the human element out of it, it becomes this volatile pot-
Luke**: Right
Kam: of issues.
Luke**: Yeah. Yeah.
Kam: I, and, and we’re back to square one again. I sell my service to myself back to being a very young officer going through these 150,000 data points.
Luke**: Right. Right. Right. Well, and, and there’s also, like, there’s that human judgment, right, like, that you have where machines don’t necessarily operate that way.
So, like, f- whether it’s false positives or things just, like, that are not considered because a machine doesn’t think about it the same way that you do, there were things kind of like can get way off the rails. I feel like it’s a really good point you bring up around kinda that human, that human element- Yeah
right? I think, like, you’re working on the, the NFL’s international program, right? that means you’re kind of working across different legal jurisdictions, right, like, uh, and cultural norms and threat landscapes and, and all that. Like, how do you build a coherent security strategy with all of those factors at play?
Kam: I think we live in a [00:08:00] very volatile world- Yeah … as you know, and keeping politics out of it. when we live in a very, um- world where, where we don’t understand the full picture of it, what that situation awareness looks like, it means that when we go into these countries, it does prove a challenge.
Luke**: Yeah.
Kam: And, and the first, uh, first three to four months, if not longer, it’s really understanding that cultural norm.
Luke**: Yeah, yeah.
Kam: And really actually getting to use, getting to know your stakeholders you’re gonna be working with, the stadium you’ll be working with, the partners you’re gonna be working with.
Because I think if we fail to do that, and fail to acknowledge and be educated ourself-
Luke**: Mm-hmm …
Kam: we can’t do a, a, a playbook to say, “Well, actually this is a rinse and repeat.” It doesn’t work like that.
Luke**: Yeah.
Kam: And, you know, we- it’s considerably different from us to be a London game to Paris, to Paris to, Munich or Berlin.
we have to be educated.
Luke**: Yeah.
Kam: and part of our education is also looking at what that red tape looks like as well.
Luke**: Yeah, yeah.
Kam: You know? Like, if you look at it from a [00:09:00] NFL perspective, all the data, all the player telemetrics, the, the owners, the teams, the stadiums feed into the NFL. Great, that’s fantastic.
We now become our part of data.
Luke**: Right, right. Right? Right,
Kam: right. So if I now go into play in a different country, they’ll say, “Well, you know, you’re part of data, you can’t leave our country.”
Luke**: Right.
Kam: So it does prove a challenge. Yeah. Uh, but absolutely we work through it, but the other part is that there are elements of it that we can’t just, can’t cross that line.
Luke**: Right. Right. No, that makes sense. I mean, and, and it’s interesting too, like how these things have played out sometimes where, you’ve got athletes doing things, you’ve got fans, you’ve got owners, you’ve got all these different, people that, uh, have all these different levels of education around cultural norms that are different, right?
Like, and kind of, uh, you can’t spend all the time educating every single one of them, but like, try to make something where it’s adaptable to all of that has gotta be quite a challenge. so I think like, in a major venue environment like the NFL where you’ve got like cameras and biometrics how do you think about the, the tension between the operational security and something like [00:10:00] privacy when you’ve got all of those people in one location?
Kam: It, it proves a challenge.
Luke**: Yeah,
Kam: I would imagine. I’m not gonna lie. You know, um, it’s, you know, it- when you buy a NFL ticket, it’s not just you buying a ticket.
Luke**: Right.
Kam: You know, your data is coming into our stream. We know that X person has got a ticket. We know where that X person resides at. We know what country they come from.
Luke**: Uh-huh.
Kam: And that’s, that’s a, a lot of personal data just there and then on a very simple snapshot. You bought a ticket, NFL knows that ticket.
Luke**: Right. Right.
Kam: You then marry that up with access control coming into a stadium. Look at biometrics, look at facial recognition. Looking at all those other data points that now feed you and build you a better picture.
So I now say, well, uh, fan X, I know mo- more about that fan X than I ever wanted to know about.
Luke**: Right, right, right.
Kam: Because you, if you were an NFL diehard fan, I’d put you to stadium and I know what team you support. Right. I know you wanna go and [00:11:00] buy merchandise. I’ll show you how to get to the merchandise shop.
So- Right … I’m al- already building a behavior analytics on you. So I know you spent so much money on ticket. I also know that you want to go to the shop.
Luke**: Right.
Kam: And you want to go to a fan activation. I, uh, you wanna do more activities for the NFL or be part of an activity. That costs money.
Luke**: Yeah.
Kam: That is also a data that we have on your behalf.
Now, we touched upon different countries. Um- If you’re watching that game in a different country, I can’t take that away.
Luke**: Uh-huh, uh-huh.
Kam: So it’s a very time-sensitive thing. Interesting. I… If I say, if I’m playing on a Sunday, I’m in town for a week. So the whole week I have your data, I can play around with data, I can manage it.
Um, but from a data privilege perspective, when I leave, you stay there.
Luke**: Interesting. Interesting. Yeah. Yeah, yeah, I didn’t realize it was, uh, time-gated that way. it’s really interesting.
what do you think about the threat of disinformation or cyber operations kind of designed [00:12:00] not to cause physical harm, but to erode public trust in major institutions, like the league or, you know, elsewhere?
Kam: So I think we, we work with two streams.
Uh, one of them is a technology stream-
Luke**: Yeah …
Kam: and, and one is a reputational damage stream.
Luke**: I see.
Kam: Yeah. So when, when you look at just, forget the physical security element of it, but we just primarily focus on the cyber side. If there was a cyber attack and there was a breach of data-
Luke**: Mm-hmm …
Kam: that breach of data not only affects our operations as the NFL, it operates the, the teams of, uh, operation.
It affects, uh, the players’ information.
Luke**: Mm-hmm.
Kam: All that mistrust can go into the betting industry.
Luke**: Mm, mm.
Kam: It then, if it goes in the betting industry, that has a knock-on effect on market, um, on the market reach of that particular stake-
Luke**: Interesting …
Kam: or that club. That club is a business decision, right?
Luke**: Right, right, right,
Kam: right.
So, so now I’ve just come to across a, a bit of a attack path. I’m saying, well, um, I send misinformation about player X, that goes in [00:13:00] the betting industry, that ultimates that market.
Luke**: Yeah.
Kam: That does, has a knock-on effect business-wide commercially to that club.
Luke**: Interesting.
Kam: So it’s an n- it’s, uh, this, this, uh, attack path.
Yeah. It’s amazing to kind of replay.
Luke**: I think it’s very dynamic, too, ‘cause you got, like, players, clubs, league- Yes … right? Like, all different, channels, right? and all different, terms and clauses, all that stuff. the whole prediction market thing is just, it, I bet it’s a new challenge, right?
Like, uh-
Kam: It’s, and it’s so interesting.
Luke**: Yeah,
Kam: yeah. And it’s so interesting. Yeah. You know, like, when you think about it, if you’re a normal fan and you bet on team A to beat team B, that might, in your opinion, be just a simple bet.
Luke**: Yeah.
Kam: But how does that, um, that market transaction, how does that have a knock-on effect on the business?
And when you, when you replay that out, your hands are tied.
Luke**: Right, right, right. Well, and now you even got, like, you know, college players that are starting to get compensated, too. It’s like this- Yes … whole other dynamic in behavioral patterns and things like that are already being established from a, a earlier- point.
This is [00:14:00] super interesting. if you could get every leader to internalize one idea about trust, control, and technology, what would it be?
Kam: I think, I’m in a different peer group to… when I look at this, whole study piece on is it people, is it process, is it technology? And I think genuinely in, in the coming years it’s going more away from technology.
AI will advance. Mm-hmm. Um, you will have super chips that will advance. You will have agentic AI that will advance.
Luke**: Mm-hmm.
Kam: But the people that a- don’t advance around it is the accountable person, which is you as a leader.
Luke**: Hmm.
Kam: I am the strong mindset that we invest in people, we invest on those soft skills that will not only help you internalize that decision-making, but it will also help the business make that accountable decision for you as well.
Luke**: I see. Makes sense. Makes sense. so kind of looking at the future, right? are you optimistic about where we can end up in the next five to 10 years with AI and… I mean, you’re seeing these things like, you’ve got [00:15:00] everybody from politicians to author, celebrities, you know, all these different types of people all getting together.
there’s these major threats that are happening in public all the time. and all this data and now with AI there, are you optimistic about where we’re going, with capabilities like, in the next five to 10 years with being able to, like, kind of manage all of this or…?
Kam: I think I class myself as a critical friend.
Luke**: Yeah.
Kam: there’s absolutely every avenue of AI being a business enabler.
Luke**: Yeah.
Kam: You know? But it’s also changing our personal lives.
Luke**: Right.
Kam: And people don’t see that analogy or that relationship. You know, I put homework in front of my child and he comes back saying, “I’ve fixed that answer.”
Little do I know that he’s taken a a picture on a AI platform and he’s given the answer to it.
Luke**: Ah, yeah, yeah, yeah.
Kam: Yeah. So it’s not only you know, when you look at that I think sometimes you get forced into a bucket.
Luke**: Yeah.
Kam: And we all as humans, every one of us that probably attend here these type of conferences or just in general the public, have got some kind of AI [00:16:00] agent.
Luke**: Yeah, yeah.
Kam: Naturally.
Luke**: Yeah.
Kam: So what’s moving away from that, you as a, as a person, you’re not being educated, you’re just being told to prompt as well.
Luke**: Right.
Kam: You became an AI agent yourself.
Luke**: Yeah, yeah, yeah. I see.
Kam: I’m asking a question.
Luke**: Yeah.
Kam: Uh, but we, we’ve had, um, uh, voice activations on our phone. We have, you have your Alexa, you have Siri, you have a number of different things, right?
We’ve been using it for years.
Luke**: Yeah.
Kam: It’s not building your profile.
Luke**: Right. Right.
Kam: With AI, it’s now not only giving you the response you want, it’s building your profile. A- and it’s… Guess what? As an individual you become a bit more- Uh, subdued. Yeah To say, “Well, actually, I don’t know what that decision making looks like that.”
Yeah,
Luke**: yeah. I think about it a lot, with the amount of, my self that’s out there, right? Like, all these, I have 100- Absolutely … plus episodes, right, of the things and stuff, the phone calls I’m getting from people. I don’t even know if they’re real anymore. Yes. I- it’s really interesting. So, if people wanna follow your work or, what’s going on, with you guys with the NFL or, or just what you’re posting on Trust, where can they go [00:17:00] look you up?
Kam: Absolutely. You know what? One of the biggest things I always do, and i- it’s, uh, I, I believe that’s a bi- image for myself is kind of put out there what leadership really looks like.
Luke**: Mm-hmm.
Kam: yes, I touch upon technology. Yes, I look at those kind advances, but the biggest thing I do is about leading with heart and leading with soul.
And, I put my, posts quite regularly on LinkedIn.
Luke**: Nice.
Kam: please search me up. Please follow me. Uh, and, uh, and another part, you know, these kind of events does one thing special, and it’s not only just bringing technologists, people here. It’s bringing people from other fields. It’s bringing student, uh, it’s bringing, uh, uh, prospective people that want to come into the career.
That helps me massively to build m- my health, my image, and my mentoring all those individuals. I don’t request anything from that person. The only thing I want is can I help you build up in your own individual right, your own career. I don’t think 20-odd years ago did anyone help me. It was a very different world then.
Luke**: Yeah, yeah. [00:18:00] Well, no, I can’t think of a better way to end this. That’s awesome. We’ll put your, your LinkedIn in the show notes. But, uh, but yeah, this is great. And, uh, Kam, I really appreciate you making the time, and love to check back in and see how things are going in the future.
Kam: Absolutely. Thank you so much.
Luke**: Right on. Thanks, man. Take
Kam: care.
Luke: Thanks for listening to the Brave Technologist Podcast. To never miss an episode, make sure you hit follow in your podcast app. If you haven’t already made the switch to the Brave browser, you can download it for free today at brave.com and start using Brave Search, which enables you to search the web privately.
Brave also shields you from the ads, trackers, and other creepy stuff following you across the web.