Stephen Orr '02 teaches midshipmen how to defend against cyberattacks

By Ray Feldmann on October 23, 2017

Stephen Orr ’02 casually paces back and forth in front of the classroom. The large clock on the sterile white wall reads a few minutes before nine in the morning. It would be early at a civilian college, but most of the 19 freshmen — or plebes — in this United States Naval Academy class have been awake for nearly four hours.

As Orr speaks, one student lays his head on his desk. Another unsuccessfully tries to stay awake. Some Naval Academy professors are known for demanding that weary students stand when it appears they’re about to fall asleep. Orr doesn’t buy that approach.

“I know what a tough day they have here,” he observes sympathetically, “how early they have to wake up and how late they’re up studying. So I cut them some slack.”

Despite Orr’s somewhat laid back approach, the subject matter he’s teaching is about as serious as it gets for these plebes: SY 110—Fundamentals of Cybersecurity.

“What is a cyberattack?” Orr asks out of nowhere, and suddenly all eyes are on the youthful 37-year-old. “The Department of Defense keeps battle plans for defending against ISIS on a server. What pillars would they have to infiltrate to access those plans?”

Crashing His First Computer

Growing up in rural Frederick County as the oldest of four children, Orr never imagined that one day he’d be teaching future naval leaders the six phases of a cyberattack, foot printing or “digital litter” — the trail of personal online information.

“I really thought it was going to be business,” Orr recalls when asked about what career he imagined for himself. “And then computers really took off. It was about 1986 when the first Nintendo came out. I was fascinated how you could have this controller and you could control this virtual thing on the screen.”

Orr was so intrigued, he decided one day to take a friend’s $150 Nintendo apart.

“I actually opened up a Nintendo to see what was inside of it,” he laughs, “but later I couldn’t put the screws back in. Fortunately for me, my friend’s parents were able to put it back together, and I don’t think my parents ever found out about it!”

Attending Towson University

While still a senior in high school, Orr was able to parlay that burgeoning interest in computers — his parents had bought him an early Texas Instruments model — into a part-time job at Lockheed Martin. When it was time to choose a college, Towson University’s greater Baltimore location and strong academic programs made his decision an easy one.

Orr spent four “absolutely fantastic” years at TU, majoring in information technology, and taking classes where his professors sparked his interest in problem-solving and critical thinking.

“They would say to us, ‘Here’s a problem, here’s one way to solve it, go figure out how to solve it,’” he says. “That really pushed me and got me into the critical thinking, innovative, entrepreneurial mindset that I thought a computer scientist needed to have.”

“ In the past ‘bad guys’ would have had to go up against the greatest military the world has ever known. Now all they need is a keyboard with a connection to cause pain or impact our way of life. ”

While a senior at Towson University, Orr said he was fortunate to have one particular professor who later became a mentor.

“Professor Mike Levine was phenomenal,” Orr recalls, “in that not only was he a good professor, he spent time with me, discussed things with me, and was willing to go the extra mile. I related to him the most and he really has had a lasting impact on me.

“He also helped me learn how to balance the part-time work at Lockheed Martin, which was about 20 hours a week, and still go to classes, which was fantastic,” he added. “It was a lot of work, which unfortunately didn’t leave a lot of time for activities or a social life. But it was a fantastic experience.”

During his senior year at TU, a curiosity about cybersecurity led Orr to transition from his job at Lockheed Martin to another well-known defense contractor, Northrup Grumman in Columbia. (Along the way, he would go on to earn a master’s degree from Hopkins and doctorate in computer science from Nova Southeastern University.)

Cyber Operations with the National Security Agency

“And as great as that experience at Northrup Grumman was, I realized I wanted to do more in the area of cyber operations,” Orr said.  “So I put in an application to the National Security Agency, and I’ve been there going on 14 years.”

While Orr admittedly loves his work at “the agency,” which of course he is not allowed to discuss, he also recently experienced a strong desire to contribute to the nation’s security in a slightly different way.

His wish to “give back” led him to the banks of the Severn River in Annapolis, where he is serving as a civilian instructor at one of the nation’s premier military colleges, the U.S. Naval Academy. He will teach there for three years while officially on sabbatical from “the agency.”

“My experience at the agency has been phenomenal,” Orr says. “The leadership there, the way it is structured, and the many opportunities that exist to learn new things. It’s a hierarchy but it’s also a meritocracy. If you want to go above and beyond, you have the opportunity to go above and beyond.

“I always thought I wanted to teach someday,” he adds. “Teaching at the Naval Academy is an opportunity for me to give back in return for what so many people have given to me along the way. So it’s a win-win.”

Safeguarding the Nation’s Interests at Home and Abroad

Orr opens the door and steps into Michelson Hall, one of the academy’s picturesque academic buildings which primarily houses computer science and chemistry classes. Dressed impeccably in tan khakis, blue oxford dress shirt, red tie and a navy blue blazer, he blends almost inconspicuously with dozens of male and female midshipmen who are hurrying to class in their black “working” uniforms and pristine white hat (known as a “cover”).

Arriving in his classroom on the second floor of Michelson, Orr chats amicably with the 14 men and five women in the room, most of whom are working on their laptops, pulling up class notes or their latest homework assignment. Unlike many college freshmen, the midshipmen in Orr’s cybersecurity and cyber operations classes are definitely not checking social media sites.

They’ve heard Orr’s somber warnings and take them seriously, at least while sitting in his classroom.

“I don’t have a Facebook account,” Orr tells these impressionable 17- and 18-year-olds. “There is a reason for that. That ‘digital litter’ that’s out there, is it being truly protected or are we just giving it away? And how can that be used against us?”

Working with Naval Academy Midshipmen

Midshipmen here, and their counterparts at the Military Academy at West Point and Air Force Academy in Colorado, come to Annapolis to learn about warfare, national defense, and safeguarding our nation’s interests at home and abroad. What they learn from Orr barely existed when he was a college freshman at TU in the late 1990’s.

“If you look back at the traditional domains of warfare in the military,” Orr tells his freshmen students, “you have air, land, sea and space. We are separated in each of these domains but within the Internet we are interconnected, so there is a persistence in that we are always ‘on.’ If you are a part of this interconnected ‘thing,’ there must be persistent defense and/or persistent offense.”

The rise of cyber operations, cyberwarfare, and asymmetric warfare lowers the barrier of entry for either rogue states, nation states, or just nefarious actors to have a true impact on this interconnected nation state that we are, he explains. In Orr’s classroom you could hear a pin drop.

“In the past the ‘bad guys’ would have had to go up against the greatest military the world has ever known. Now, all they need is a keyboard with a connection to cause pain or impact our way of life,” he says. “It can be a 16-year-old kid or a nation state. Anybody or everybody is a target.”

“Protecting data is of critical importance,” he adds. “We must demand that of those we do business with. We need to become far more vigilant and protective.”

In addition to his freshman-level intro to cybersecurity class with these plebes, Orr teaches a senior-level cyber operations course with a focus on “offensive” operations — how to infiltrate or attack computer systems. In fact, the midshipmen have even hacked a drone and turned it off in mid-flight. 

Orr points out, “The midshipmen here are hungry and motivated, they have goals set, and they already know what they want to do and who they want to be. Teaching these young men and women here is inspiring.”

At the end of each day in Annapolis, Orr drives back to his home in rural Howard County, which he shares with his wife and two young children (7 and 3).  He met his wife quite unconventionally while on assignment in Augusta, Ga., when a doctor’s office receptionist spotted him arriving for a routine appointment and said aloud in front of a packed waiting room, “Oh my goodness, you’ve got to meet my sister.”

While the doctor looked on disapprovingly, Orr sheepishly accepted the sister’s phone number, called, and made a date. The two hit it off, married one year later and recently celebrated their eighth anniversary.

“It was a textbook happy ending,”  Orr jokes. “The receptionist got to keep her job and I got a lovely wife!”

Protecting the Fleet from Cyber Intrusions

When Orr completes his sabbatical teaching assignment at USNA, he will return to “the agency,” although in a slightly different role.

“I will be going back for the mission. I’ve actually transitioned from operator to leadership, so I think I will continue in that leadership role in the cyber operations aspect of our mission. It’s only going to increase in importance; it’s only going to be more vital to the nation’s security.”

For now, Orr is intent on helping midshipmen protect the fleet from cyber intrusions. He understands and wants to impart that cybersecurity is a huge risk for them as future naval commanders and as everyday citizens.

Regardless of major, every midshipmen must learn the importance of protecting data in Orr’s introductory classes. His upper-level courses require students to complete a research topic on phishing or hacking drones or some other cyberwarfare tactic.

Not a bad gig for a guy who once had trouble reassembling some screws in a Nintendo console.

This story was originally published in the winter 2017 issue of the alumni magazine, Towson. View the current issue of the magazine.