Reframing IT Leadership and Decision-Making for Tribal Councils

A few years ago, I stood before our Tribal Council to ask for a major cybersecurity investment. In the seconds before I started speaking, I noticed something about myself that mattered more than anything I had prepared. I felt nothing.

In meetings where real work is about to happen, I usually feel a low hum of alertness, a sense that the room is leaning toward what's coming. That morning the hum wasn't there. The council members and executives sat back in their chairs. They were polite and ready to listen. They had also already decided what kind of meeting this was: another budget request from the IT department.

Nobody in that room was wrong to expect that. For years, IT had been treated as a cost center, and IT requests followed a predictable path. The council would ask reasonable questions, then approve part of the request or defer it for further study. I had walked that path before, and I knew where it led.

Earlier in my career, I brought cybersecurity decisions to leadership the conventional way. I was technical, thorough, and wrong about my audience. I presented security as an IT initiative, and leadership treated it as one. Funding came back partial or postponed, and the question that mattered most never came up: what does this organization owe the people it serves when it comes to protecting them?
 

Those meetings taught me to watch for a room that has settled into the wrong frame. A frame decides which questions get asked. Inside the budget-request frame, the council would decide whether to fund an IT project. The real decision was whether to accept responsibility for protecting the tribe's members, assets, and sovereignty from a threat that didn't fit the cost-center picture. If the meeting stayed inside the first frame, the second question would never be asked.

So before I said a word about technology, I had to change the frame.

I started with an acknowledgment, not a proposal.

I told the council that any request I made had to be measured against the community's most pressing needs. I said I understood the weight of what they had been chosen to carry, and that they were the guardians of the tribe's future. I called the money they oversee what I believe it is: sacred money. Every dollar spent on cybersecurity is a dollar that isn't going to health care or housing. Any investment I proposed had to serve their responsibility before it could justify itself on technical grounds.

That took about a minute. Most of us skip that minute. We walk in, explain the problem, present the solution, and ask for what we need. It is efficient, and it is usually how decisions are made. But an audience that doesn't believe you understand its position listens defensively and spends the meeting deciding whether you've earned the right to ask. That acknowledgment changed how the rest of the meeting was heard.

Then I told a story.

I described a health clinic in another state that had been paralyzed after a single deceptive phone call. An attacker impersonated an employee and talked the help desk into handing over a password. From there, ransomware did the rest. Doctors and nurses were locked out of patient records. Pharmacies couldn't fill prescriptions. Patients' sensitive data was stolen. Families were left without care.

I let it sit for a moment. Then I told the council that the story wasn't about a distant organization. It was a warning about us. I asked them to imagine the clinic was ours, the locked records belonged to our members, and the services that stopped were our own.

The room changed. People leaned forward. The executives stopped taking notes and started listening. Council members who had been sitting back were now sitting upright.

The story was true, and that mattered. A hypothetical would have received an illustration. Something that had actually happened to a community like ours carried the weight of fact. And the story did more than hold attention. It moved the conversation out of the budget-request frame and into the responsibility frame, where the rest of the meeting could happen.

People remember stories, not slides. Long before there were council chambers, communities passed down what mattered through stories told by people who had lived them. A council chamber is still a room full of people who remember that way.

With the frame changed, I laid out three paths.

The first was the Path of Unacceptable Risk. We could do nothing and hope a major attack never reached us. That choice wasn't free. It was the cost of a catastrophic event multiplied by its likelihood, and our community couldn't absorb that number. I named this path first because it was the one the room had quietly been considering when it walked in. Once it was said out loud, it looked unworkable.

The second was the Path of the Impossible Fortress. We could build our own security operations center, staffed around the clock with elite security professionals. I told the council what that would cost each year and which community programs it would draw from. I also told them the truth about talent. A tribal government in rural Northern California can't compete for those people, and a small team trying to cover every hour of every day would burn out.

The third was the Path of Smart Partnership. We could bring in a 24/7 managed security partner that would work as an extension of our own team, with expertise and coverage we couldn't build ourselves, at a predictable cost, and operating right away.

None of the three was a straw man, and that is why the structure worked. Doing nothing is a choice organizations make every day. Some IT directors do build their own security operations centers, and some succeed. The partnership path had to withstand the objections a careful council should raise, including vendor lock-in, ongoing cost, and the risk of relying on an outside company for a core capability. If I had stacked the deck, the council would have seen it, and the meeting would have collapsed back into a budget debate.

Because the paths were real, I didn't have to argue for the third one. The council could see for themselves why it was the only one that let them meet their responsibility. The question had moved from "Do we trust Robby's recommendation?" to "What does the situation require?"

I didn't close by asking for approval.

I told the council that the decision in front of them wasn't whether to fund an IT initiative. It was how to fulfill a duty they already held. They were the governing body of a sovereign nation, responsible for protecting their members, data, and sovereignty. I wasn't asking them to take on that responsibility. They had accepted it when they took office. The investment was simply the form that responsibility had to take.

That could sound like a persuasion technique, so it is worth being precise. I wasn't making the council feel that a decision was theirs when it really belonged to someone else. The budget-request frame had cast me as the one asking and the council as the one approving. Naming the duty returned the decision to the people it had always belonged to.

The council approved the investment that day. No one asked for more time or a deferral for further study.

One of our partners is CrowdStrike, and the company has published the story of what happened next.

One night, my phone rang at 1 a.m. Their team had found an attacker's tool on one of our servers, an exploit nobody had publicly disclosed yet. I was still waking up while they explained it. By the time I understood what had happened, they had already isolated the server, removed the threat, and confirmed the environment was clean. Other organizations spent the following days trying to find out whether they had been breached. We already knew.

That is what the council bought. Not software, and not an IT line item. Years earlier, I had asked myself what would happen if an attack hit us at 2 a.m. on a Sunday, and I didn't know. Now we do. The council has since renewed the partnership.

I told this story in more detail in a TribalHub webinar with CrowdStrike in July 2025: "Cyber Sovereignty in Action: Threat Intelligence, Tribal Resilience, and the Paskenta Story".