0
SPEAKER_01
The following is a conversation with Nicole Perlroth, cybersecurity journalist and author of This Is How They Tell Me The World Ends, The Cyber Weapons Arm Race.
0
SPEAKER_01
And now a quick few second mention of each sponsor.
0
SPEAKER_01
Check them out in the description.
0
SPEAKER_01
It s the best way to support this podcast.
0
SPEAKER_01
First is Linode, Linux Virtual Machines.
0
SPEAKER_01
Second is InsideTracker, a service I use to track my biological data.
0
SPEAKER_01
Third is Onnit, a nutrition supplement and fitness company.
0
SPEAKER_01
Fourth is Roka, my favorite sunglasses and prescription glasses.
0
SPEAKER_01
And fifth is indeed a hiring website.
0
SPEAKER_01
So the choice is computation, health, style, or building an amazing team.
0
SPEAKER_01
Choose wisely, my friends.
0
SPEAKER_01
And now onto the full ad reads.
0
SPEAKER_01
As always, there s no ads in the middle.
0
SPEAKER_01
I try to make this interesting, but if you skip them, please still check out the sponsors.
0
SPEAKER_01
I enjoy their stuff.
0
SPEAKER_01
Maybe you will too.
0
SPEAKER_01
This episode is sponsored by Linode, Linux Virtual Machines.
0
SPEAKER_01
It s an awesome compute infrastructure that lets you develop, deploy, and scale what applications you build faster and easier.
0
SPEAKER_01
This is both for small personal projects and huge systems.
0
SPEAKER_01
Lower cost than AWS, but more important to me is the simplicity and quality of their customer service with real humans, 24-7-365.
0
SPEAKER_01
Their motto is if it runs on Linux, it runs on Linode.
0
SPEAKER_01
I have not shut up in saying how much I love Linux, every single distribution.
0
SPEAKER_01
Gentoo, Arch Linux, everything based on Arch Linux.
0
SPEAKER_01
Ubuntu, everything based on Debian.
0
SPEAKER_01
I used to use Gentoo.
0
SPEAKER_01
Did I already mention Gentoo?
0
SPEAKER_01
There s Linux Mint, all the sexy new flavors based on the old school.
0
SPEAKER_01
Of course, there s Red Hat and Fedora and all that.
0
SPEAKER_01
Anyway, I love Linux.
0
SPEAKER_01
I love computer infrastructure.
0
SPEAKER_01
What else can you say?
0
SPEAKER_01
Linode is awesome.
0
SPEAKER_01
Visit linode.com and click on the create free account button to get started with $100 in free credit.
0
SPEAKER_01
This show is also brought to you by InsideTracker, a service I use to track my biological data.
0
SPEAKER_01
They have a bunch of plans, most of which include a blood test that gives you a lot of information that you can then make decisions based on.
0
SPEAKER_01
They use machine learning algorithms to then analyze that data, and that comes from blood data, DNA data, fitness tracker data, all that to provide you with a clear picture of what s going on inside your body, and to offer you science-backed recommendations for positive diet and lifestyle changes.
0
SPEAKER_01
This, to me, feels like the future.
0
SPEAKER_01
It s obvious that
0
SPEAKER_01
medicine, lifestyle, all your decisions come from your own personal data.
0
SPEAKER_01
By the way, this is something that comes up more and more, the privacy of that data, the control over that data is really important.
0
SPEAKER_01
Getting that right in the future will be a very difficult problem.
0
SPEAKER_01
But what isn t difficult is to understand that decisions should be made based on information coming from your own body.
0
SPEAKER_01
And that s what InsideTracker is about.
0
SPEAKER_01
For a limited time, you get 25% off the entire InsideTracker store if you go to insidetracker.com slash lex.
0
SPEAKER_01
That s insidetracker.com slash lex.
0
SPEAKER_01
This episode is also brought to you by Onnit, a nutrition, supplement, and fitness company.
0
SPEAKER_01
They make AlphaBrain, which is a nootropic that helps you support memory, mental speed, and focus.
0
SPEAKER_01
I use it not every day, but when I want to boost
0
SPEAKER_01
my thinking, the clarity, the focus, the mental speed in a deep work session, a particularly difficult deep work session when I have to struggle through a hard problem.
0
SPEAKER_01
That s when I ll take AlphaBrain.
0
SPEAKER_01
It s a boost, a rocket launcher for my mind.
0
SPEAKER_01
One thing I should mention is the thing that makes a work session hard
0
SPEAKER_01
is when there s a lot of tangents, a lot of side roads that lead to a dead end and force me to backtrack.
0
SPEAKER_01
That is the most exhausting thing.
0
SPEAKER_01
So yeah, in those cases, I ll sometimes take an alpha brain and it really helps.
0
SPEAKER_01
Anyway, go to lexfriedman.com on it to get up to 10% off AlphaBrain.
0
SPEAKER_01
That s lexfriedman.com on it.
0
SPEAKER_01
This show is also brought to you by Roka, the makers of glasses and sunglasses that I love wearing for their design feel and innovation on material, optics, and grip.
0
SPEAKER_01
Roka was started by two all-American swimmers from Stanford, and it was born out of an obsession with performance.
0
SPEAKER_01
I met one of said founders, they have a place here in Austin.
0
SPEAKER_01
I love it when not only the product is great, but the people that make the product is great.
0
SPEAKER_01
And obviously the product I love, it s designed to be active in, extremely lightweight, the grip is comfortable but strong, and the style is...
0
SPEAKER_01
Just like I like it.
0
SPEAKER_01
It s classy, it s minimalist.
0
SPEAKER_01
Holds up in all conditions.
0
SPEAKER_01
I ll wear it while wearing a suit.
0
SPEAKER_01
I ll wear it while running, running gear.
0
SPEAKER_01
Freezing weather, super hot.
0
SPEAKER_01
You know, I wore it through the Austin 100 degree summer.
0
SPEAKER_01
Check them out for both prescription glasses and sunglasses at Roka.com and Entercode Lex.
0
SPEAKER_01
Save 20% off on your first order.
0
SPEAKER_01
That s Roka.com and Entercode Lex.
0
SPEAKER_01
This show is also brought to you by Indeed, a hiring website.
0
SPEAKER_01
I ve used them as part of many hiring efforts I ve done for the teams I ve led in the past.
0
SPEAKER_01
They have tools like Indeed Instant Match that gives you quality candidates whose resumes on Indeed fit your job description immediately.
0
SPEAKER_01
I am one of those people that believe that a great team is not just about productivity.
0
SPEAKER_01
A great team is a source of happiness.
0
SPEAKER_01
It s a source of meaning.
0
SPEAKER_01
It s a source of personal growth.
0
SPEAKER_01
Hiring is the most important thing for those of us that spend a significant percentage of our life at work or working on something we love.
0
SPEAKER_01
It doesn t feel like work.
0
SPEAKER_01
And one of the reasons it might not feel like work is because you re working with people you love, you respect,
0
SPEAKER_01
that challenge you, that excite you, all those kinds of things.
0
SPEAKER_01
And that s all about hiring.
0
SPEAKER_01
So, you should be using the best tools for the job.
0
SPEAKER_01
Anyway, right now, get a free $75 sponsored job credit to upgrade your job post at indeed.com slash Lex.
0
SPEAKER_01
Terms and conditions apply.
0
SPEAKER_01
Go to indeed.com slash Lex.
0
SPEAKER_01
This is the Lex Friedman Podcast, and here is my conversation with Nicole Perleroth.
0
SPEAKER_01
You ve interviewed hundreds of cybersecurity hackers, activists, dissidents, computer scientists, government officials, forensic investigators, and mercenaries.
0
SPEAKER_01
So let s talk about cybersecurity and cyber war.
0
SPEAKER_01
Start with the basics.
0
SPEAKER_01
What is a zero-day vulnerability and then a zero-day exploit or attack?
0
SPEAKER_00
So at the most basic level, let s say I m a hacker and I find a bug in your iPhone iOS software that no one else knows about, especially Apple.
0
SPEAKER_00
That s called a zero day because the minute it s discovered, engineers have had zero days to fix it.
0
SPEAKER_00
If I can study that zero-day, I could potentially write a program to exploit it.
0
SPEAKER_00
And that program would be called a zero-day exploit.
0
SPEAKER_00
And for iOS, the dream is that you craft a zero-day exploit that can remotely exploit someone else s iPhone without them ever knowing about it.
0
SPEAKER_00
and you can capture their location, you can capture their contacts that record their telephone calls, record their camera without them knowing about it.
0
SPEAKER_00
Basically, you can put an invisible ankle bracelet on someone without them knowing.
0
SPEAKER_00
And you can see why that capability, that zero-day exploit would have immense value for a spy agency or a government that wants to monitor its critics
0
SPEAKER_00
or dissidence, and so there s a very lucrative market now for zero-day exploits.
0
SPEAKER_01
So you said a few things there.
0
SPEAKER_01
One is iOS.
0
SPEAKER_01
Why iOS?
0
SPEAKER_01
Which operating system?
0
SPEAKER_01
Which one is the sexier thing to try to get to or the most impactful thing?
0
SPEAKER_01
And the other thing you mentioned is remote versus like having to actually come in physical contact with it.
0
SPEAKER_01
Is that the distinction?
0
SPEAKER_00
So iPhone exploits have just been a government s number one priority.
0
SPEAKER_00
Recently, actually, the price of an Android remote zero-day exploit, something that can get you into Android phones, is actually higher.
0
SPEAKER_00
The value of that is now higher on this underground market for zero-day exploits than an iPhone iOS exploit.
0
SPEAKER_00
So things are changing.
0
SPEAKER_01
So there s probably more Android devices, so that s why it s better.
0
SPEAKER_01
But on the iPhone side, if I, so I m an Android person, because I m a man of the people.
0
SPEAKER_01
But it seems like all the elites use iPhone, all the people at nice dinner parties.
0
SPEAKER_01
So is that the reason that the more powerful people use iPhones, is that why?
0
SPEAKER_00
I don t think so.
0
SPEAKER_00
I actually, so it was about two years ago that the prices flipped.
0
SPEAKER_00
It used to be that if you could craft a remote zero-click exploit for iOS, then that was about as good as it gets.
0
SPEAKER_00
You could sell that to a zero-day broker for $2 million.
0
SPEAKER_00
The caveat is you can never tell anyone about it.
0
SPEAKER_00
Because the minute you tell someone about it, Apple learns about it, they patch it, and that $2.5 million investment that that zero-day broker just made goes to dust.
0
SPEAKER_00
So a couple years ago, and don t quote me on the prices, but
0
SPEAKER_00
an Android zero-click remote exploit for the first time topped the iOS.
0
SPEAKER_00
And actually a lot of people s read on that was that it might be a sign that Apple s security
0
SPEAKER_00
was falling and that it might actually be easier to find an iOS zero-day exploit than find an Android zero-day exploit.
0
SPEAKER_00
The other thing is market share.
0
SPEAKER_00
There are just more people around the world that use Android.
0
SPEAKER_00
And a lot of governments that are paying top dollar for zero-day exploits these days
0
SPEAKER_00
are deep-pocketed governments in the Gulf that wanna use these exploits to monitor their own citizens, monitor their critics.
0
SPEAKER_00
And so it s not necessarily that they re trying to find elites, it s that they wanna find out who these people are that are criticizing them or perhaps planning the next Arab Spring.
0
SPEAKER_01
So in your experience, are most of these attack targeted to cover a large population or is there attacks that are targeted towards specific individuals?
0
SPEAKER_00
So I think it s both.
0
SPEAKER_00
Some of the zero-day exploits that have fetched top dollar that I ve heard of in my reporting in the United States were highly targeted.
0
SPEAKER_00
There was a potential terrorist attack.
0
SPEAKER_00
They wanted to get into this person s phone.
0
SPEAKER_00
It had to be done in the next 24 hours.
0
SPEAKER_00
They approached hackers and say, we ll pay you X millions of dollars if you can do this.
0
SPEAKER_00
But then you look at when we ve discovered iOS zero-day exploits in the wild, some of them have been targeting large populations like Uyghurs.
0
SPEAKER_00
So a couple years ago, there was a watering hole attack.
0
SPEAKER_00
Okay, what s a watering hole attack?
0
SPEAKER_00
There s a website, it actually had information aimed at Uyghurs, and you could access it all over the world.
0
SPEAKER_00
And if you visited this website, it would drop an iOS zero-day exploit onto your phone.
0
SPEAKER_00
And so anyone that visited this website that was about Uyghurs, anywhere, I mean, Uyghurs, Uyghurs living abroad, basically the Uyghur diaspora, would have gotten infected with this zero-day exploit.
0
SPEAKER_00
So in that case, they were targeting huge swaths of this one population or people interested in this one population, basically in real time.
0
SPEAKER_01
Who are these attackers?
0
SPEAKER_01
From the individual level to the group level, psychologically speaking, what s their motivation?
0
SPEAKER_01
Is it purely money?
0
SPEAKER_01
Is it the challenge?
0
SPEAKER_01
Are they malevolent?
0
SPEAKER_01
Is it power?
0
SPEAKER_01
These are big philosophical human questions, I guess.
0
SPEAKER_00
So these are the questions I set out to answer for my book.
0
SPEAKER_00
I wanted to know
0
SPEAKER_00
are these people that are just after money?
0
SPEAKER_00
If they re just after money, how do they sleep at night, not knowing whether that zero-day exploit they just sold to a broker is being used to basically make someone s life a living hell?
0
SPEAKER_00
And what I found was there s kind of this long-sorted history to this question.
0
SPEAKER_00
It started out in the 80s and 90s when hackers were just finding holes and bugs in software for curiosity s sake, really as a hobby.
0
SPEAKER_00
And some of them would go to the tech companies like Microsoft or Sun Microsystems at the time, or Oracle.
0
SPEAKER_00
And they d say, hey, I just found this Zero Day in your software and I can use it to break into NASA.
0
SPEAKER_00
And the general response at the time wasn t, thank you so much for pointing out this flaw and our software will get it fixed as soon as possible.
0
SPEAKER_00
It was, don t ever poke around our software ever again, or we ll stick our general counsel on you.
0
SPEAKER_00
And that was really sort of the common thread for years.
0
SPEAKER_00
And so hackers who set out to do the right thing were basically told to shut up and stop doing what you re doing.
0
SPEAKER_00
And what happened next was
0
SPEAKER_00
they basically started trading this information online.
0
SPEAKER_00
Now, when you go back and interview people from those early days, they all tell a very similar story, which is they re curious, they re tinkers.
0
SPEAKER_00
You know, they remind me of like the kid down the block that was constantly poking around the hood of his dad s car.
0
SPEAKER_00
You know, they just couldn t help themselves.
0
SPEAKER_00
They wanted to figure out how a system is designed and how they could potentially exploit it for some other purpose.
0
SPEAKER_00
It doesn t have to be good or bad.
0
SPEAKER_00
But they were basically kind of beat down for so long by these big tech companies that they started just silently trading them with other hackers.
0
SPEAKER_00
And that s how you got these really heated debates in the 90s about disclosure.
0
SPEAKER_00
should you just dump these things online?
0
SPEAKER_00
Because any script kiddie can pick them up and use it for all kinds of mischief.
0
SPEAKER_00
But you know, don t you want to just stick a middle finger to all these companies that are basically threatening you all the time?
0
SPEAKER_00
So there was this really interesting dynamic at play.
0
SPEAKER_00
And
0
SPEAKER_00
What I learned in the course of doing my book was that government agencies and their contractors sort of tapped into that frustration and that resentment, and they started quietly reaching out to hackers on these forums.
0
SPEAKER_00
And they said, hey, you know that zero day you just dropped online?
0
SPEAKER_00
Could you come up with something custom for me?
0
SPEAKER_00
And I ll pay you six figures for it so long as you shut up and never tell anyone that I paid you for this.
0
SPEAKER_00
And that s what happened.
0
SPEAKER_00
So throughout the 90s, there was a bunch of boutique contractors that started reaching out to hackers on these forums and saying, hey, I ll pay you six figures for that bug you were trying to get Microsoft to fix for free.
0
SPEAKER_00
And sort of so began or so catalyzed this market,
0
SPEAKER_00
where governments and their intermediaries started reaching out to these hackers and buying their bugs for free.
0
SPEAKER_00
And in those early days, I think a lot of it was just for quiet counterintelligence, traditional espionage.
0
SPEAKER_00
But as we started baking the software, Windows software, Schneider Electric, Siemens Industrial Software, into our nuclear plants,
0
SPEAKER_00
and our factories and our power grid and our petrochemical facilities and our pipelines, those same zero days came to be just as valuable for sabotage.
1
SPEAKER_00
and war planning.
1
SPEAKER_01
Does the fact that the market sprung up and you can now make a lot of money change the nature of the attackers that came to the table or grow the number of attackers?
1
SPEAKER_01
I mean, what is, I guess, you told the psychology of the hackers in the 90s, what is the culture today and where is it heading?
1
SPEAKER_00
So I think there are people who will tell you they would never sell a zero-day to a zero-day broker or a government.
1
SPEAKER_00
One, because they don t know how it s going to get used when they throw it over the fence.
1
SPEAKER_00
You know, most of these get rolled into classified programs and you don t know how they get used.
1
SPEAKER_00
If you sell it to a zero-day broker, you don t even know which nation state might use it.
1
SPEAKER_00
or potentially which criminal group might use it if you sell it on the dark web.
1
SPEAKER_00
The other thing that they say is that they want to be able to sleep at night.
1
SPEAKER_00
And they lose a lot of sleep if they found out their zero day was being used to make a dissonance life living hell.
1
SPEAKER_00
But there are a lot of people, good people, who also say, no, this is not my problem, this is the technology company s problem.
1
SPEAKER_00
If they weren t writing new bugs into their software every day, then there wouldn t be a market, then there wouldn t be a problem.
1
SPEAKER_00
But they continue to write bugs into their software all the time and they continue to profit off that software, so why shouldn t I profit off my labor too?
1
SPEAKER_00
And one of the things that has happened, which is I think a positive development over the last 10 years, are bug bounty programs.
1
SPEAKER_00
Companies like Google and Facebook and then Microsoft and finally Apple, which resisted it for a really long time, have said, okay.
1
SPEAKER_00
We are going to shift our perspective about hackers.
1
SPEAKER_00
We re no longer going to treat them as the enemy here.
1
SPEAKER_00
We re going to start paying them for what it s essentially free quality assurance.
1
SPEAKER_00
And we re going to pay them good money in some cases, you know, six figures in some cases.
1
SPEAKER_00
We re never going to be able to bid against a zero-day broker who sells to government agencies.
1
SPEAKER_00
but we can reward them and hopefully get that to that bug earlier where we can neutralize it so that they don t have to spend another year developing the zero-day exploit.
1
SPEAKER_00
And in that way, we can keep our software more secure.
1
SPEAKER_00
But every week I get messages from some hacker that says, you know, I tried to see this zero-day exploit that was just found in the wild, you know, being used by this nation state.
1
SPEAKER_00
I tried to tell Microsoft about this.
1
SPEAKER_00
two years ago, and they were gonna pay me peanuts, so it never got fixed.
1
SPEAKER_00
There are all sorts of those stories that can continue on.
1
SPEAKER_00
And I think just generally, hackers are not very good at diplomacy.
1
SPEAKER_00
They tend to be pretty snipey, technical crowd, and very philosophical in my experience, but diplomacy is not their strong suit.
1
SPEAKER_01
There almost has to be a broker between companies and hackers, where you can translate effectively, just like you have a zero-day broker between governments and hackers, because you have to speak their language.
1
SPEAKER_00
Yeah, and there have been some of those companies who ve risen up to meet that demand, and HackerOne is one of them, BugCrowd is another, Synack has an interesting model, so that s a company that,
1
SPEAKER_00
You pay for a private bug bounty program, essentially.
1
SPEAKER_00
So you pay this company.
1
SPEAKER_00
They tap hackers all over the world to come hack your software, hack your system.
1
SPEAKER_00
And then they ll quietly tell you what they found.
1
SPEAKER_00
And I think that s a really positive development.
1
SPEAKER_00
And actually, the Department of Defense
1
SPEAKER_00
hired all three of those companies I just mentioned to help secure their systems.
1
SPEAKER_00
Now, I think they re still a little timid in terms of letting those hackers into the really sensitive, high-side classified stuff.
1
SPEAKER_00
But, you know, baby steps.
1
SPEAKER_01
just to understand what you were saying, you think it s impossible for companies to financially compete with the zero-day brokers with governments?
1
SPEAKER_01
So like the defense can t outpay the hackers?
1
SPEAKER_00
It s interesting, you know, they shouldn t outpay them because what would happen if they started offering $2.5 million at Apple?
1
SPEAKER_00
for any zero-day exploit that governments would pay that much for is their own engineers would say, why the hell am I working for less than that and doing my nine to five every day?
1
SPEAKER_00
So you would create a perverse incentive.
1
SPEAKER_00
And I didn t think about that.
1
SPEAKER_00
Until I started this research and I realized, okay, yeah, that makes sense.
1
SPEAKER_00
You don t want to incentivize offense so much that it s to your own detriment.
1
SPEAKER_00
And so I think what they have, though, what the companies have on government agencies
1
SPEAKER_00
is if they pay you, you get to talk about it.
1
SPEAKER_00
You know, you get a street cred.
1
SPEAKER_00
You get to brag about the fact you just found that $2.5 million, you know, iOS zero day that no one else did.
1
SPEAKER_00
And if you sell it to a broker, you never got to talk about it.
1
SPEAKER_00
And I think that really does eat at people.
1
SPEAKER_01
Can I ask you a big philosophical question about human nature here?
1
SPEAKER_01
So if you have, in what you ve seen, if a human being has a zero day, they found a zero day vulnerability that can hack into, I don t know, what s the worst thing you can hack into?
1
SPEAKER_01
Something that could launch nuclear weapons.
1
SPEAKER_01
Which percentage of the people in the world that have the skill would not share that with anyone, with any bad party?
1
SPEAKER_01
I guess how many people are completely devoid of ethical concerns in your sense?
1
SPEAKER_01
So my belief is all the ultra-competent people, or very, very high percentage of ultra-competent people are also ethical people.
1
SPEAKER_01
That s been my experience, but then again, my experience is narrow.
1
SPEAKER_01
What s your experience been like?
1
SPEAKER_00
So this was another question I wanted to answer.
1
SPEAKER_00
Who are these people who would sell a zero-day exploit that would neutralize a Schneider Electric safety lock at a petrochemical plant?
1
SPEAKER_00
Basically the last thing you would need to neutralize before you trigger some kind of explosion.
1
SPEAKER_00
Who would sell that?
1
SPEAKER_00
And I got my answer
1
SPEAKER_00
Well, the answer was different.
1
SPEAKER_00
A lot of people said, I would never even look there, because I don t even want to know.
1
SPEAKER_00
I don t even want to have that capability.
1
SPEAKER_00
I don t even want to have to make that decision about whether I m going to profit off of that knowledge.
1
SPEAKER_00
I went down to Argentina, and this whole kind of moral calculus I had in my head was completely flipped around.
1
SPEAKER_00
So just to back up for a moment, so Argentina actually is a real hacker s paradise.
1
SPEAKER_00
People grew up in Argentina and, you know, I went down there, I guess I was there around 2015, 2016, but you still couldn t get an iPhone.
1
SPEAKER_00
They didn t have Amazon Prime.
1
SPEAKER_00
You couldn t get access to any of the apps we all take for granted.
1
SPEAKER_00
To get those things in Argentina as a kid, you have to find a way to hack them.
1
SPEAKER_00
The whole culture is really like a hacker culture.
1
SPEAKER_00
They say it s really like a MacGyver culture.
1
SPEAKER_00
You have to figure out how to break into something with wire and tape.
1
SPEAKER_00
And that means that there are a lot of really good hackers in Argentina who specialize in developing zero-day exploits.
1
SPEAKER_00
And I went down to this Argentina conference called Echo Party, and I asked the organizer, okay, can you introduce me to someone who s selling zero-day exploits to governments?
1
SPEAKER_00
And he was like, just throw a stone.
1
SPEAKER_00
Throw a stone anywhere and you re gonna hit someone.
1
SPEAKER_00
And all over this conference, you saw these guys who were clearly from these Gulf states who only spoke Arabic.
1
SPEAKER_00
What are they doing at a young hacking conference in Buenos Aires?
1
SPEAKER_00
And so I went out to lunch with kind of this godfather of the hacking scene there, and I asked this really dumb question, and I m still embarrassed about how I phrased it.
1
SPEAKER_00
But I said, so, you know, will these guys only sell these zero-day exploits to good Western governments?
1
SPEAKER_00
And he said, Nicole, last time I checked, the United States wasn t a good Western government.
1
SPEAKER_00
The last country that bombed another country into oblivion wasn t China or Iran.
1
SPEAKER_00
It was the United States.
1
SPEAKER_00
So if we re gonna go by your whole moral calculus, just know that we have a very different calculus down here.
1
SPEAKER_00
And we d actually rather sell to Iran or Russia or China maybe than the United States.
1
SPEAKER_00
And that just blew me away.
1
SPEAKER_00
Like, wow.
1
SPEAKER_00
You know, he s like, we ll just sell to whoever brings us the biggest bag of cash.
1
SPEAKER_00
Have you checked into our inflation situation recently?
1
SPEAKER_00
So, you know, I had some of those like reality checks along the way.
1
SPEAKER_00
You know, we tend to think of things as, is this moral, you know, is this ethical, especially as journalists.
1
SPEAKER_00
You know, we kind of sit on our high horse sometimes and write about a lot of things that seem to push the moral bounds.
1
SPEAKER_00
But in this market, which is essentially an underground market, the one rule is like Fight Club.
1
SPEAKER_00
No one talks about Fight Club.
1
SPEAKER_00
First rule of the zero-day market, nobody talks about the zero-day market on both sides because the hacker doesn t want to lose their $2.5 million bounty and governments roll these into classified programs and they don t want anyone to know what they have.
1
SPEAKER_00
So no one talks about this thing.
1
SPEAKER_00
And when you re operating in the dark like that, it s really easy to put aside your morals sometimes.
1
SPEAKER_01
Can I, as a small tangent, ask you, by way of advice, you must have done some incredible interviews.
1
SPEAKER_01
And you ve also spoken about how serious you take protecting your sources.
1
SPEAKER_01
If you were to give me advice for interviewing when you re recording on mic with a video camera,
1
SPEAKER_01
how is it possible to get into this world?
1
SPEAKER_01
Is it basically impossible?
1
SPEAKER_01
So you ve spoken with a few people, what is it, like the godfather of cyber war, cyber security, so people that are already out.
1
SPEAKER_01
And they still have to be pretty brave to speak publicly.
1
SPEAKER_01
But is it virtually impossible to really talk to anybody who s a current hacker?
1
SPEAKER_01
You re always like 10, 20 years behind.
1
SPEAKER_00
It s a good question.
1
SPEAKER_00
And this is why I m a print journalist.
1
SPEAKER_00
But, you know, a lot when I ve seen people do it, it s always the guy who s behind the shadows, whose voice has been altered.
1
SPEAKER_00
You know, when they ve gotten someone on camera, that s usually how they do it.
1
SPEAKER_00
You know, very, very few people talk in this space.
1
SPEAKER_00
And there s actually a pretty well known case study in why you don t
1
SPEAKER_00
talk publicly in the space and you don t get photographed.
1
SPEAKER_00
And that s the gruck.
1
SPEAKER_00
So, you know, the gruck is or was this zero-day broker, South African guy, lives in Thailand.
1
SPEAKER_00
And right when I was starting on this subject at the New York Times, he d given an interview to Forbes and he talked about being a zero-day broker.
1
SPEAKER_00
And he even posed next to this giant duffel bag filled with cash, ostensibly.
1
SPEAKER_00
And later he would say he was speaking off the record.
1
SPEAKER_00
He didn t understand the rules of the game.
1
SPEAKER_00
But what I heard from people who did business with him was that the minute that that story came out, he became PNG d.
1
SPEAKER_00
No one did business with him.
1
SPEAKER_00
You know, his business plummeted by at least half.
1
SPEAKER_00
No one wants to do business with anyone who s going to get on camera and talk about how they re selling zero days to governments.
1
SPEAKER_00
It puts you at danger.
1
SPEAKER_00
And I did hear that he got some visits from some security folks.
1
SPEAKER_00
And that s another thing for these people to consider.
1
SPEAKER_00
If they have
1
SPEAKER_00
those zero-day exploits at their disposal, they become a huge target for nation-states all over the world.
1
SPEAKER_00
You know, talk about having perfect OPSEC.
1
SPEAKER_00
You know, you better have some perfect OPSEC if people know that you have access to those zero-day exploits.
1
SPEAKER_01
Which sucks because
1
SPEAKER_01
I mean, transparency here would be really powerful for educating the world and also inspiring other engineers to do good.
1
SPEAKER_01
It just feels like when you operate in the shadows.
1
SPEAKER_01
it doesn t help us move in the positive direction in terms of like getting more people on the defense side versus on the attack side.
1
SPEAKER_01
But of course, what can you do?
1
SPEAKER_01
I mean, the best you can possibly do is have great journalists just like you did interview and write books about it and integrate the information you get while hiding the sources.
1
SPEAKER_00
Yeah, and I think, you know, what HackerOne has told me was, okay, let s just put away the people that are finding and developing zero-day exploits all day long.
1
SPEAKER_00
Let s put that aside.
1
SPEAKER_00
What about the, you know, however many millions of programmers all over the world who ve never even heard of a zero-day exploit?
1
SPEAKER_00
why not tap into them and say, hey, we ll start paying you if you can find a bug in United Airlines software or in Schneider Electric or in Ford or Tesla.
1
SPEAKER_00
And I think that is a really smart approach.
1
SPEAKER_00
Let s go find this untapped army of programmers to neutralize these bugs before the people who will continue to sell these to governments can find them and exploit them.
1
SPEAKER_01
Okay, I have to ask you about this from a personal side.
1
SPEAKER_01
It s funny enough, after we agreed to talk, I ve gotten, for the first time in my life, was a victim of a cyber attack.
1
SPEAKER_01
So this is ransomware, it s called Deadbolt.
1
SPEAKER_01
People can look it up.
1
SPEAKER_01
I have a QNAP device for basically kind of coldish storage.
1
SPEAKER_01
So it s about 60 terabytes with 50 terabytes of data on it in RAID 5.
1
SPEAKER_01
And apparently about four to 5,000 QNAP devices were hacked and taken over with this ransomware.
1
SPEAKER_01
And what ransomware does there is
1
SPEAKER_01
It goes file by file, almost all the files on the QNAP storage device, and encrypts them.
1
SPEAKER_01
And then there s this very eloquently and politely written page that pops up.
1
SPEAKER_01
It describes what happened.
1
SPEAKER_01
All your files have been encrypted.
1
SPEAKER_01
This includes, but is not limited to, photos, documents, and spreadsheets.
1
SPEAKER_01
Why me?
1
SPEAKER_01
A lot of people commented about how friendly and eloquent this is, and I have to commend them.
1
SPEAKER_01
It is, and it s pretty user-friendly.
1
SPEAKER_01
Why me?
1
SPEAKER_01
This is not a personal attack.
1
SPEAKER_01
You have been targeted because of the inadequate security provided by your vendor, QNAP.
1
SPEAKER_01
What now?
1
SPEAKER_01
You can make a payment of exactly 0.03 Bitcoin, which is about $1,000, to the following address.
1
SPEAKER_01
Once the payment has been made, we ll follow up with transaction to the same address, blah, blah, blah.
1
SPEAKER_01
They give you instructions of what happens next, and they ll give you a decryption key that you can then use
1
SPEAKER_01
And then there s another message for QNAP that says, all your affected customers have been targeted using a zero day vulnerability in your product.
1
SPEAKER_01
We offer you two options to mitigate this and future damage.
1
SPEAKER_01
One, make a Bitcoin payment of five Bitcoin to the following address.
1
SPEAKER_01
and that will reveal to QNAP, I m summarizing things here, what the actual vulnerability is, or you can make a Bitcoin payment of 50 Bitcoin to get a master decryption key for all your customers.
1
SPEAKER_01
50 Bitcoin is about $1.8 million.
1
SPEAKER_01
Okay.
1
SPEAKER_01
So first of all, on a personal level, this one hurt for me.
1
SPEAKER_01
I mean, I learned a lot, because I wasn t, for the most part, backing up.
1
SPEAKER_01
much of that data because I thought I can afford to lose that data.
1
SPEAKER_01
It s not like horrible.
1
SPEAKER_01
I mean, I think you ve spoken about the crown jewels, like making sure there s things you really protect.
1
SPEAKER_01
And I have, you know, I m very conscious security-wise on the crown jewels.
2
SPEAKER_01
But there s a bunch of stuff like, you know, personal videos.
2
SPEAKER_01
They re not like I don t have anything creepy, but just like fun things I did that because they re very large or 4K or something like that, I kept them on there thinking RAID 5 will protect it.
2
SPEAKER_01
You know, just I lost a bunch of stuff, including raw footage from interviews and all that kind of stuff.
2
SPEAKER_01
So it s painful.
2
SPEAKER_01
And I m sure there s a lot of painful stuff like that for the four to 5,000 people that use QNAP.
2
SPEAKER_01
And there s a lot of interesting ethical questions here.
2
SPEAKER_01
Do you pay them?
2
SPEAKER_01
Does QNAP pay them?
2
SPEAKER_01
Do the individuals pay them?
2
SPEAKER_01
Especially when you don t know if it s going to work or not.
2
SPEAKER_01
Do you wait?
2
SPEAKER_01
So QNAP said that please don t pay them.
2
SPEAKER_01
We re working very hard day and night to solve this.
2
SPEAKER_01
It s so philosophically interesting to me because I also project onto them thinking, what is their motivation?
2
SPEAKER_01
Because the way they phrased it on purpose, perhaps, but I m not sure if that actually reflects their real motivation, is maybe they re trying to help themselves sleep at night.
2
SPEAKER_01
Basically saying, this is not about you.
2
SPEAKER_01
This is about the company with the vulnerabilities.
2
SPEAKER_01
Just like you mentioned, this is the justification they have
2
SPEAKER_01
but they re hurting real people.
2
SPEAKER_01
They hurt me, but I m sure there s a few others that are really hurt.
2
SPEAKER_00
And the zero day factor is a big one.
2
SPEAKER_00
QNAP right now is trying to figure out what the hell is wrong with their system that would let this in.
2
SPEAKER_00
And even if they pay,
2
SPEAKER_00
If they still don t know where the zero day is, what s to say that they won t just hit them again and hit you again?
2
SPEAKER_00
So that really complicates things.
2
SPEAKER_00
And that is a huge advancement for ransomware.
2
SPEAKER_00
It s really only been, I think, in the last 18 months that we ve ever really seen ransomware exploit zero days.
2
SPEAKER_00
to pull these off.
2
SPEAKER_00
Usually 80% of them, I think the data shows 80% of them come down to a lack of two-factor authentication.
2
SPEAKER_00
So when someone gets hit by a ransomware attack, they don t have two-factor authentication on, their employees were using stupid passwords.
2
SPEAKER_00
You can mitigate that in the future.
2
SPEAKER_00
This one, they don t know.
2
SPEAKER_00
They probably don t know.
2
SPEAKER_01
Yeah, and it was, I guess it s zero click because I didn t have to do anything.
2
SPEAKER_01
The only thing I, well, you know, here s the thing.
2
SPEAKER_01
I did, you know, basics of, you know, I put it behind a firewall, I followed instructions, but like I wasn t, I didn t really pay attention.
2
SPEAKER_01
So maybe there s like, maybe there s a misconfiguration of some sort that s easy to make.
2
SPEAKER_01
It s difficult when you have a personal NAS on.
2
SPEAKER_01
So I don t, I m not willing to sort of say that I did everything I possibly could.
2
SPEAKER_01
But I did a lot of reasonable stuff and they still hit it with zero clicks.
2
SPEAKER_01
I didn t have to do anything.
2
SPEAKER_00
Yeah, well it s like a zero day and it s a supply chain attack.
2
SPEAKER_00
You know, you re getting hit from your supplier.
2
SPEAKER_00
You re getting hit because of your vendor.
2
SPEAKER_00
And it s also a new thing for ransomware groups to go to the individuals to pressure them to pay.
2
SPEAKER_00
There was this really interesting case, I think it was in Norway, where there was a mental health clinic that got hit and the cyber criminals were going to the patients themselves to say, pay this or we re going to release your psychiatric records.
2
SPEAKER_00
I mean, talk about hell.
2
SPEAKER_00
In terms of whether to pay, that is on the cheaper end of the spectrum.
2
SPEAKER_01
From the individual or from the company?
2
SPEAKER_00
Both.
2
SPEAKER_00
We ve seen, for instance, there was an Apple supplier in Taiwan.
2
SPEAKER_00
They got hit and the ransom demand was 50 million.
2
SPEAKER_00
I m surprised it s only 1.8 million.
2
SPEAKER_00
I m sure it s gonna go up.
2
SPEAKER_00
And it s hard, you know, there s obviously governments and maybe in this case, the company are gonna tell you, we recommend you don t pay or please don t pay.
2
SPEAKER_00
But the reality on the ground is that some businesses can t operate.
2
SPEAKER_00
Some countries can t function.
2
SPEAKER_00
I mean, the under reported storyline of colonial pipeline,
2
SPEAKER_00
was after the company got hit and took the preemptive step of shutting down the pipeline because their billing systems were frozen, they couldn t charge customers downstream.
2
SPEAKER_00
my colleague David Singer and I got our hands on a classified assessment that said that as a country, we could have only afforded two to three more days of Colonial Pipeline being down.
2
SPEAKER_00
And it was really interesting.
2
SPEAKER_00
I thought it was the gas and the jet fuel, but it wasn t.
2
SPEAKER_00
We were sort of prepared for that.
2
SPEAKER_00
It was the diesel.
2
SPEAKER_00
Without the diesel, the refineries couldn t function.
2
SPEAKER_00
and it would have totally screwed up the economy.
2
SPEAKER_00
And so there was almost this national security economic impetus for them to pay this ransom.
2
SPEAKER_00
And the other one I always think about is Baltimore.
2
SPEAKER_00
When the city of Baltimore got hit, I think the initial ransom demand was something around 76,000.
2
SPEAKER_00
It may have even started smaller than that.
2
SPEAKER_00
And Baltimore stood its ground and didn t pay.
2
SPEAKER_00
But ultimately, the cost to remediate was $18 million.
2
SPEAKER_00
It s a lot for the city of Baltimore.
2
SPEAKER_00
That s money that could have gone to public school education and roads and public health.
2
SPEAKER_00
And instead,
2
SPEAKER_00
it just went to rebuilding these systems from scratch.
2
SPEAKER_00
And so a lot of residents in Baltimore were like, why the hell didn t you pay the $76,000?
2
SPEAKER_00
So it s not obvious.
2
SPEAKER_00
It s easy to say don t pay because why you re funding their R&D for the next go round.
2
SPEAKER_00
But it s too often, it s too complicated.
2
SPEAKER_01
So on the individual level, just like, you know, the way I feel personally from this attack, have you talked to people that were kind of victims in the same way I was, but maybe more dramatic ways or so on, you know, in the same way that violence hurts people?
2
SPEAKER_01
How much does this hurt people in your sense, in the way you researched it?
2
SPEAKER_00
The worst ransomware attack I ve covered on a personal level was an attack on a hospital in Vermont.
2
SPEAKER_00
And, you know, you think of this as like, okay, it s hitting their IT networks.
2
SPEAKER_00
They should still be able to treat patients.
2
SPEAKER_00
But it turns out that cancer patients couldn t get their chemo anymore because the protocol of who gets what is very complicated.
2
SPEAKER_00
And without it, nurses and doctors couldn t access it.
2
SPEAKER_00
So they were turning chemo patients away, cancer patients away.
2
SPEAKER_00
One nurse told us, I don t know why people aren t screaming about this, that the only thing I ve seen that even compares to what we re seeing at this hospital right now
2
SPEAKER_00
was when I worked in the burn unit after the Boston Marathon bombing.
2
SPEAKER_00
They really put it in these super dramatic terms.
2
SPEAKER_00
And last year, there was a report in the Wall Street Journal where they attributed an infant death
2
SPEAKER_00
to a ransomware attack because a mom came in and whatever device they were using to monitor the fetus wasn t working because of the ransomware attack.
2
SPEAKER_00
And so they attributed this infant death to the ransomware attack.
2
SPEAKER_00
Now on a bigger scale, but less personal,
2
SPEAKER_00
when there was the NotPetya attack.
2
SPEAKER_00
So this was an attack by Russia on Ukraine that came at them through a supplier, a tax software company in that case, that didn t just hit any
2
SPEAKER_00
government agency or business in Ukraine that use this tax software.
2
SPEAKER_00
It actually hit any business all over the world that had even a single employee working remotely in Ukraine.
2
SPEAKER_00
So it hit Maersk, the shipping company, but hit Pfizer, hit FedEx, but the one I will never forget is Merck.
2
SPEAKER_00
it paralyzed Merck s factories.
2
SPEAKER_00
I mean, it really created an existential crisis for the company.
2
SPEAKER_00
Merck had to tap into the CDC s emergency supplies of the Gardasil vaccine that year because their whole vaccine production line had been paralyzed in that attack.
2
SPEAKER_00
Imagine if that was gonna happen right now to Pfizer or Moderna or Johnson and Johnson, you know, imagine.
2
SPEAKER_00
I mean, that would really create a global cyber terrorist attack, essentially.
2
SPEAKER_01
And that s almost unintentional.
2
SPEAKER_00
I thought for a long time, I always labeled it as collateral damage, but actually just today, there was a really impressive threat researcher at Cisco, which has this threat intelligence division called Talos, who said, stop calling it collateral damage.
2
SPEAKER_00
They could see who was gonna get hit before they deployed that malware.
2
SPEAKER_00
It wasn t collateral damage.
2
SPEAKER_00
It was intentional.
2
SPEAKER_00
They meant to hit any business that did business with Ukraine.
2
SPEAKER_00
It was to send a message to them too.
2
SPEAKER_00
So I don t know if that s accurate.
2
SPEAKER_00
I always thought of it as sort of the sloppy collateral damage, but it definitely made me think.
2
SPEAKER_01
So how much of this between states is going to be a part of war, these kinds of attacks on Ukraine, between Russia and U.S., Russia and China, China and U.S.?
2
SPEAKER_01
Let s look at China and U.S.
2
SPEAKER_01
Do you think China and U.S.
2
SPEAKER_01
are going to escalate something that would be called a war purely in the space of cyber?
2
SPEAKER_00
I believe any geopolitical conflict from now on is guaranteed to have some cyber element to it.
2
SPEAKER_00
The Department of Justice recently declassified a report that said China s been hacking into our pipelines and it s not for intellectual property theft.
2
SPEAKER_00
It s to get a foothold so that if things escalate in Taiwan, for example,
2
SPEAKER_00
They are where they need to be to shut our pipelines down.
2
SPEAKER_00
And we just got a little glimpse of what that looked like with Colonial Pipeline and the panic buying and the jet fuel shortages and that assessment I just mentioned about the diesel.
2
SPEAKER_00
So they re there, you know, they ve got in there.
2
SPEAKER_00
Anytime I read a report about new aggression from fighter jets, Chinese fighter jets in Taiwan, or what s happening right now with Russia s buildup on the Ukraine border, or India-Pakistan, I m always looking at it through a cyber lens, and it really bothers me that other people aren t.
2
SPEAKER_00
Because there is no way
2
SPEAKER_00
that these governments and these nation states are not going to use their access to gain some advantage in those conflicts.
2
SPEAKER_00
And, you know, I m now in a position where I m an advisor to the cybersecurity infrastructure security agency at the DHS.
2
SPEAKER_00
So I m not saying anything classified here, but I just think that
2
SPEAKER_00
it s really important to understand just generally what the collateral damage could be for American businesses and critical infrastructure in any of these escalated conflicts around the world.
2
SPEAKER_00
Because just generally,
2
SPEAKER_00
Our adversaries have learned that they might never be able to match us in terms of our traditional military spending on traditional weapons and fighter jets, but we have a very soft underbelly when it comes to cyber.
2
SPEAKER_00
80% or more of America s critical infrastructure, so pipelines, power grid, nuclear plants, water systems, is owned and operated by the private sector.
2
SPEAKER_00
And for the most part, there is nothing out there legislating that those companies share the fact they ve been breached.
2
SPEAKER_00
They don t even have to tell the government they ve been hit.
2
SPEAKER_00
There s nothing mandating that they even meet a bare minimum standard of cybersecurity.
2
SPEAKER_00
And that s it.
2
SPEAKER_00
So even when there are these attacks, most of the time we don t even know about it.
2
SPEAKER_00
So that is, you know, if you were going to design a system to be as blind and vulnerable as possible, that s pretty good.
2
SPEAKER_00
That s what it looks like, is what we have here in the United States.
2
SPEAKER_00
And everyone here is just operating like, let s just keep hooking up everything for convenience.
2
SPEAKER_00
You know, software eats the world.
2
SPEAKER_00
Let s just keep going for cost, for convenience sake, just because we can.
2
SPEAKER_00
And when you study these issues and you study these attacks and you study the advancement and the uptick in frequency and the lower barrier to entry that we see every single year, you realize just how dumb software eats world is.
2
SPEAKER_00
And no one has ever stopped to pause and think, should we be hooking up these systems to the internet?
2
SPEAKER_00
They ve just been saying, can we?
2
SPEAKER_00
Let s do it.
2
SPEAKER_00
And that s a real problem.
2
SPEAKER_00
And just in the last year, we ve seen a record number of zero-day attacks.
2
SPEAKER_00
I think there were 80 last year, which is probably more than double what it was in 2019.
2
SPEAKER_00
A lot of those were nation states.
2
SPEAKER_00
You know, we live in a world with a lot of geopolitical hot points right now.
2
SPEAKER_00
And where those geopolitical hot points are, are places where countries have been investing heavily in offensive cyber tools.
2
SPEAKER_01
If you re a nation state,
2
SPEAKER_01
The goal would be to maximize the footprint of zero day, like super secret zero day that nobody s aware of.
2
SPEAKER_01
And whenever war is initiated, the huge negative effects of shutting down infrastructure or any kind of zero day is the chaos it creates.
2
SPEAKER_01
So if you just, there s a certain threshold when you create the chaos, the markets plummet, just everything goes to hell.
2
SPEAKER_00
So there s- It s not just zero days.
2
SPEAKER_00
We make it so easy for threat actors.
2
SPEAKER_00
I mean, we re not using two-factor authentication.
2
SPEAKER_00
We re not patching.
2
SPEAKER_00
There was the shell shock vulnerability that was discovered a couple years ago.
2
SPEAKER_00
It s still being exploited because so many people haven t fixed it.
2
SPEAKER_00
So the zero days are really the sexy stuff and what really drew me to the zero day market was the moral calculus we talked about.
2
SPEAKER_00
particularly from the U.S.
2
SPEAKER_00
government s point of view.
2
SPEAKER_00
How do they justify leaving these systems so vulnerable when we use them here and we re baking more of our critical infrastructure with this vulnerable software?
2
SPEAKER_00
It s not like we re using one set of technology and Russia s using another and China s using this.
2
SPEAKER_00
We re all using the same technology.
2
SPEAKER_00
So when you find a zero day in Windows, you re not just leaving it open so you can spy on Russia or implant yourself in the Russian grid, you re leaving Americans vulnerable too.
2
SPEAKER_00
But zero days are like, that is the secret sauce.
2
SPEAKER_00
That s the superpower.
2
SPEAKER_00
And I always say like every country now, with the exception of Antarctica, someone added the Vatican to my list, is trying to find
2
SPEAKER_00
offensive hacking tools in zero days to make them work.
2
SPEAKER_00
And those that don t have the skills now have this market that they can tap into where, you know, $2.5 million, that s chump change for a lot of these nation states.
2
SPEAKER_00
It s a hell of a lot less than trying to build the next fighter jet.
2
SPEAKER_00
But yeah, the goal is chaos.
2
SPEAKER_00
I mean, why did Russia turn off the lights twice in Ukraine?
2
SPEAKER_00
I think part of it is chaos.
2
SPEAKER_00
I think part of it is to sow the seeds of doubt in their current government.
2
SPEAKER_00
Your government can t even keep your lights on.
2
SPEAKER_00
Why are you sticking with them?
2
SPEAKER_00
Come over here and we ll keep your lights on at least.
2
SPEAKER_00
There s like a little bit of that.
2
SPEAKER_01
Nuclear weapons seems to have helped prevent nuclear war.
2
SPEAKER_01
Is it possible that we have so
3
SPEAKER_01
so many vulnerabilities and so many attack vectors on each other that it will kind of achieve the same kind of equilibrium like mutually assured destruction.
3
SPEAKER_01
That s one hopeful solution to this.
3
SPEAKER_01
Do you have any hope for this particular solution?
3
SPEAKER_00
Nuclear analogies always tend to fall apart when it comes to cyber, mainly because you don t need fissile material.
3
SPEAKER_00
You just need a laptop and the skills and you re in the game.
3
SPEAKER_00
So it s a really low barrier to entry.
3
SPEAKER_00
The other thing is attributions harder.
3
SPEAKER_00
And we ve seen countries muck around with attribution.
3
SPEAKER_00
We ve seen nation states piggyback on other countries  spy operations and just sit there and siphon out whatever they re getting.
3
SPEAKER_00
We learned some of that from the Snowden documents.
3
SPEAKER_00
We ve seen Russia hack into Iran s command and control attack servers.
3
SPEAKER_00
We ve seen them hit a Saudi petrochemical plant where they did neutralize the safety locks at the plant and everyone assumed that it was Iran, given Iran had been targeting Saudi oil companies forever.
3
SPEAKER_00
But nope, it turned out that it was a graduate research institute outside Moscow.
3
SPEAKER_00
So you see countries kind of playing around with attribution.
3
SPEAKER_00
Why?
3
SPEAKER_00
I think because they think, okay, if I do this, like, how am I going to cover up that it came from me because I don t want to risk the response.
3
SPEAKER_00
So people are sort of dancing around this.
3
SPEAKER_00
It s just in a very different way.
3
SPEAKER_00
And, you know, at the Times, I d covered the Chinese hacks of
3
SPEAKER_00
infrastructure companies like pipelines.
3
SPEAKER_00
I d covered the Russian probes of nuclear plants.
3
SPEAKER_00
I d covered the Russian attacks on the Ukraine grid.
3
SPEAKER_00
And then in 2018, my colleague David Sanger and I covered the fact that U.S.
3
SPEAKER_00
Cyber Command had been hacking into the Russian grid and making a pretty loud show of it.
3
SPEAKER_00
And when we went to the National Security Council, because that s what journalists do before they publish a story, they give the other side a chance to respond.
3
SPEAKER_00
I assumed we would be in for that really awkward, painful conversation where they would say, you will have blood on your hands if you publish this story.
3
SPEAKER_00
And instead, they gave us the opposite answer.
3
SPEAKER_00
They said, we have no problem with you publishing this story.
3
SPEAKER_00
Why?
3
SPEAKER_00
Well, they didn t say it out loud, but it was pretty obvious they wanted Russia to know that we re hacking into their power grid, too, and they better think twice before they do to us what they had done to Ukraine.
3
SPEAKER_00
So yeah, you know, we have stumbled into this new era of mutually assured digital destruction.
3
SPEAKER_00
I think another sort of
3
SPEAKER_00
quasi norm we ve stumbled into is proportional responses.
3
SPEAKER_00
There s this idea that if you get hit, you re allowed to respond proportionally at a time and place of your choosing.
3
SPEAKER_00
That is how the language always goes.
3
SPEAKER_00
That s what Obama said after North Korea hit Sony.
3
SPEAKER_00
We will respond at a time and place of our choosing.
3
SPEAKER_00
But no one really knows
3
SPEAKER_00
like what that response looks like.
3
SPEAKER_00
And so what you see a lot of the time are just these like, just short of war attacks.
3
SPEAKER_00
Russia turned off the power in Ukraine, but it wasn t like it stayed off for a week.
3
SPEAKER_00
It stayed off for a number of hours.
3
SPEAKER_00
NotPetya hit those companies pretty hard, but no one died.
3
SPEAKER_00
And the question is, what s gonna happen when someone dies?
3
SPEAKER_00
and can a nation state masquerade as a cyber criminal group, as a ransomware group?
3
SPEAKER_00
And that s what really complicates coming to some sort of digital Geneva Convention.
3
SPEAKER_00
Like there s been a push from Brad Smith at Microsoft.
3
SPEAKER_00
We need a digital Geneva Convention.
3
SPEAKER_00
And on its face, it sounds like a no brainer.
3
SPEAKER_00
Yeah.
3
SPEAKER_00
Why wouldn t we all agree to stop hacking into each other s civilian hospital systems, elections, power grid?
3
SPEAKER_00
pipelines, but when you talk to people in the West, officials in the West, they ll say, we would never, we d love to agree to it, but we d never do it when you re dealing with Xi or Putin.
3
SPEAKER_00
or Kim Jong-un, because a lot of times they outsource these operations to cyber criminals.
3
SPEAKER_00
In China, we see a lot of these attacks come from this loose satellite network of private citizens that work at the behest of the Ministry of State Security.
3
SPEAKER_00
So how do you come to some sort of state-to-state agreement when you re dealing with transnational actors and cyber criminals, where it s really hard to pin down whether that person was acting alone or whether they were acting at the behest of the MSS or the FSB?
3
SPEAKER_00
And a couple of years ago, I remember
3
SPEAKER_00
I can t remember if it was before or after NotPetya, but Putin said, hackers are like artists who wake up in the morning in a good mood and start painting.
3
SPEAKER_00
In other words, I have no say over what they do or don t do.
3
SPEAKER_00
So how do you come to some kind of norm when that s how he s talking about these issues and he s just decimated Merck and Pfizer and another however many thousand companies?
3
SPEAKER_01
That is the fundamental difference between nuclear weapons and cyber attacks is the attribution, or one of the fundamental differences.
3
SPEAKER_01
If you can fix one thing in the world, in terms of cybersecurity, that would make the world a better place, what would you fix?
3
SPEAKER_01
So you re not allowed to fix like authoritarian regimes and...
3
SPEAKER_01
You have to keep that, you have to keep human nature as it is.
3
SPEAKER_01
In terms of on the security side, technologically speaking, you mentioned there s no regulation on companies, United States, what if you could just
3
SPEAKER_01
or the snap of a finger, what would you fix?
3
SPEAKER_00
Two-factor authentication, multi-factor authentication.
3
SPEAKER_00
It s ridiculous how many of these attacks come in because someone didn t turn on multi-factor authentication.
3
SPEAKER_00
Colonial pipeline, okay?
3
SPEAKER_00
They took down the biggest conduit for gas, jet fuel, and diesel to the east coast of the United States of America.
3
SPEAKER_00
How?
3
SPEAKER_00
Because they forgot to deactivate an old employee account whose password had been traded on the dark web, and they d never turned on two-factor authentication.
3
SPEAKER_00
This water treatment facility outside Florida was hacked last year.
3
SPEAKER_00
How did it happen?
3
SPEAKER_00
They were using Windows XP from like a decade ago that can t even get patches if you want it to, and they didn t have two-factor authentication.
3
SPEAKER_00
Time and time again, if they just switched on two-factor authentication,
3
SPEAKER_00
some of these attacks wouldn t have been possible.
3
SPEAKER_00
Now, if I could snap my fingers, that s the thing I would do right now.
3
SPEAKER_00
But of course, you know, this is a cat and mouse game, and then the attacker s on to the next thing.
3
SPEAKER_00
But I think right now, that is like, bar none, that is just, that is the easiest, simplest way to deflect the most attacks.
3
SPEAKER_00
And, you know, the name of the game right now isn t perfect security.
3
SPEAKER_00
Perfect security is impossible.
3
SPEAKER_00
they will always find a way in.
3
SPEAKER_00
The name of the game right now is make yourself a little bit harder to attack than your competitor or than anyone else out there so that they just give up and move along.
3
SPEAKER_00
And you know, maybe if you are a target for an advanced nation state or the SVR, you know, you re gonna get hacked no matter what.
3
SPEAKER_00
But you can make cyber criminal groups, Deadbolt is it, you can make their jobs a lot harder.
3
SPEAKER_00
simply by doing the bare basics.
3
SPEAKER_00
And the other thing is stop reusing your passwords.
3
SPEAKER_00
But if I only get one, then two-factor authentication.
3
SPEAKER_01
So what is two-factor authentication?
3
SPEAKER_01
Factor one is what, logging in with a password?
3
SPEAKER_01
And factor two is like, have another device or another channel through which you can confirm, yeah, that s me.
3
SPEAKER_00
Yes, usually this happens through some kind of text.
3
SPEAKER_00
You get your one-time code from Bank of America or from Google.
3
SPEAKER_00
The better way to do it is spend $20 buying yourself a Fido key on Amazon.
3
SPEAKER_00
That s a hardware device.
3
SPEAKER_00
And if you don t have that hardware device with you, then you re not gonna get in.
3
SPEAKER_00
And the whole goal is, I mean, basically, you know, my first half of my decade at the Times was spent covering like the copy.
3
SPEAKER_00
It was like Home Depot got breached, News at 11, you know, Target, Neiman Marcus, like who wasn t hacked over the course of those five years.
3
SPEAKER_00
And a lot of those companies that got hacked
3
SPEAKER_00
What did hackers take?
3
SPEAKER_00
They took the credentials.
3
SPEAKER_00
They took the passwords.
3
SPEAKER_00
They can make a pretty penny selling them on the dark web.
3
SPEAKER_00
And people reuse their passwords.
3
SPEAKER_00
So you get one from, you know, God knows who, I don t know, LastPass.
3
SPEAKER_00
The worst case example, actually, LastPass.
3
SPEAKER_00
But you get one, and then you go test it on their email account, and you go test it on their brokerage account, and you test it on their cold storage account.
3
SPEAKER_00
You know, that s how it works.
3
SPEAKER_00
But if you have multi-factor authentication, then they can t get in, because they might have your password, but they don t have your phone, they don t have your Fido key, you know, and so you keep them out.
3
SPEAKER_00
And I get a lot of alerts that tell me someone is trying to get into your Instagram account or your Twitter account or your email account.
3
SPEAKER_00
And I don t worry because I use multi-factor authentication.
3
SPEAKER_00
They can try all day.
3
SPEAKER_00
Okay, I worry a little bit, but it s the simplest thing to do and we don t even do it.
3
SPEAKER_01
Well, there s an interface aspect to it, because it s pretty annoying if it s implemented poorly.
3
SPEAKER_01
So actually, bad implementation of two-factor authentication, not just bad, but just something that adds friction is a security vulnerability, I guess, because it s really annoying.
3
SPEAKER_01
I think MIT, for a while, had two-factor authentication.
3
SPEAKER_01
It was really annoying.
3
SPEAKER_01
The number of times it pings you, like,
3
SPEAKER_01
it asks to re-authenticate across multiple subdomains.
3
SPEAKER_01
It just feels like a pain.
3
SPEAKER_01
I don t know what the right balance there is.
3
SPEAKER_00
It feels like friction in our frictionless society.
3
SPEAKER_00
It feels like friction.
3
SPEAKER_00
It s annoying.
3
SPEAKER_00
That s security s biggest problem.
3
SPEAKER_00
It s annoying.
3
SPEAKER_00
We need the Steve Jobs of security to come along and we need to make it painless.
3
SPEAKER_00
And actually, on that point, Apple,
3
SPEAKER_00
has probably done more for security than anyone else simply by introducing biometric authentication first with the fingerprint and then with face ID.
3
SPEAKER_00
And it s not perfect, but if you think just eight years ago, everyone was running around with either no passcode, an optional passcode, or a four-digit passcode on their phone that anyone, think of what you can get.
3
SPEAKER_00
when you get someone s iPhone, if you steal someone s iPhone.
3
SPEAKER_00
And props to them for introducing the fingerprint and face ID.
3
SPEAKER_00
And again, it wasn t perfect, but it was a huge step forward.
3
SPEAKER_00
Now it s time to make another huge step forward.
3
SPEAKER_00
I wanna see the password die.
3
SPEAKER_00
I mean, it s gotten us as far as it was ever gonna get us.
3
SPEAKER_00
And I hope whatever we come up with next is not gonna be annoying, it s gonna be seamless.
3
SPEAKER_01
When I was at Google, that s what we worked on is, and there s a lot of ways to call this active authentication or passive authentication.
3
SPEAKER_01
So basically you use biometric data, not just like a fingerprint, but everything from your body to identify who you are, like movement patterns.
3
SPEAKER_01
So basically create a lot of layers of protection where it s very difficult to fake, including like face unlock, checking that it s your actual face, like the liveness tests.
3
SPEAKER_01
So like from video, so unlocking it with video, voice, the way you move the phone, the way you take it out of the pocket, that kind of thing.
3
SPEAKER_01
All of those factors.
3
SPEAKER_01
It s a really hard problem though.
3
SPEAKER_01
And ultimately,
3
SPEAKER_01
it s very difficult to beat the password to have a security.
3
SPEAKER_00
Well, there s a company that I actually will call out, and that s Abnormal Security.
3
SPEAKER_00
So they work on email attacks.
3
SPEAKER_00
And it was started by a couple guys who were doing, I think, ad tech at Twitter.
3
SPEAKER_00
So, you know, ad technology now, like it s a joke how much they know about us.
3
SPEAKER_00
You know, you always hear the conspiracy theories that, you know, you saw someone s shoes and next thing you know, it s on your phone.
3
SPEAKER_00
It s amazing what they know about you.
3
SPEAKER_00
And they re basically taking that and they re applying it to attacks.
3
SPEAKER_00
So they re saying, okay, you know, if you re, this is what your email patterns are.
3
SPEAKER_00
It might be different for you and me because we re emailing strangers all the time.
3
SPEAKER_00
But for most people, their email patterns are pretty predictable.
3
SPEAKER_00
And if something strays from that pattern, that s abnormal.
3
SPEAKER_00
And they ll block it, they ll investigate it.
3
SPEAKER_00
And that s great.
3
SPEAKER_00
Let s start using that kind of targeted ad technology to protect people.
3
SPEAKER_00
And yeah, I mean, it s not going to get us away from the password and using multi-factor authentication, but you know, the technology is out there and we just have to figure out how to use it in a really seamless way because it doesn t matter if you have the perfect security solution if no one uses it.
3
SPEAKER_00
I mean,
3
SPEAKER_00
When I started at the Times, when I was trying to be really good about protecting sources, I was trying to use PGP encryption.
3
SPEAKER_00
And it s like, it didn t work.
3
SPEAKER_00
You know, the number of mistakes I would probably make just trying to email someone
3
SPEAKER_00
with PGP just wasn t worth it.
3
SPEAKER_00
And then Signal came along and Signal made it wicker.
3
SPEAKER_00
They made it a lot easier to send someone an encrypted text message.
3
SPEAKER_00
So we have to start investing in creative minds in good security design.
3
SPEAKER_00
I really think that s the hack that s gonna get us out of where we are today.
3
SPEAKER_01
What about social engineering?
3
SPEAKER_01
Do you worry about this sort of hacking people?
3
SPEAKER_00
Yes, I mean, this is the worst nightmare of every chief information security officer out there.
3
SPEAKER_00
You know, social engineering, we work from home now.
3
SPEAKER_00
I saw this woman posted online about how her husband, it went viral today, but it was her husband had this problem at work.
3
SPEAKER_00
They hired a guy named John.
3
SPEAKER_00
and now the guy that shows up for work every day doesn t act like John.
3
SPEAKER_00
I mean, think about that.
3
SPEAKER_00
Think about the potential for social engineering in that context.
3
SPEAKER_00
You apply for a job and you put on a pretty face, you hire an actor or something, and then you just get inside the organization and get access to all that organization s data.
3
SPEAKER_00
A couple years ago, Saudi Arabia planted spies inside Twitter.
3
SPEAKER_00
Why?
3
SPEAKER_00
Probably because they were trying to figure out who these people were who were criticizing the regime on Twitter.
3
SPEAKER_00
They couldn t do it with a hack from the outside, so why not plant people on the inside?
3
SPEAKER_00
And that s like the worst nightmare.
3
SPEAKER_00
And it also, unfortunately, creates all kinds of xenophobia.
3
SPEAKER_00
at a lot of these organizations.
3
SPEAKER_00
I mean, if you re going to have to take that into consideration, then organizations are going to start looking really skeptically and suspiciously at someone who applies for that job from China.
3
SPEAKER_00
And we ve seen that go really badly at places like the Department of Commerce,
3
SPEAKER_00
where they basically accuse people of being spies that aren t spies.
3
SPEAKER_00
So it is the hardest problem to solve.
3
SPEAKER_00
And it s never been harder to solve than right at this very moment when there s so much pressure for companies to let people work remotely.
3
SPEAKER_01
That s actually why I m single.
3
SPEAKER_01
I m suspicious that China and Russia, every time I meet somebody, are trying to plant and get insider information.
3
SPEAKER_01
So I m very, very suspicious.
3
SPEAKER_01
I keep putting the Turing test in front.
3
SPEAKER_01
No.
3
SPEAKER_00
No, I have a friend who worked inside NSA and was one of their top hackers.
3
SPEAKER_00
He s like, every time I go to Russia, I get hit on by these 10s.
3
SPEAKER_00
And I come home, my friends are like, I m sorry, you re not a 10.
3
SPEAKER_01
It s a common story.
3
SPEAKER_01
I mean, it s difficult to trust humans in this day and age online.
3
SPEAKER_01
So we re working remotely, that s one thing, but just interacting with people.
4
SPEAKER_02
on the internet, it sounds ridiculous.
4
SPEAKER_02
But because of this podcast in part, I ve gotten to meet some incredible people.
4
SPEAKER_02
But it makes you nervous to trust folks.
4
SPEAKER_02
And I don t know how to solve that problem.
4
SPEAKER_02
So I m talking with Mark Zuckerberg, who dreams about creating the metaverse.
4
SPEAKER_02
What do you do about that world where more and more our lives is in the digital sphere?
4
SPEAKER_02
One way to phrase it is most of our meaningful experiences at some point will be online.
4
SPEAKER_02
like falling in love, getting a job, or experiencing a moment of happiness with a friend, with a new friend made online, all of those things.
4
SPEAKER_02
Like more and more, the fun we do, the things that make us love life will happen online.
4
SPEAKER_02
And if those things have an avatar that s digital, that s like a way to hack into people s minds, whether it s with AI or kind of troll farms or something like that.
4
SPEAKER_02
I don t know if there s a way to protect against that.
4
SPEAKER_02
That might fundamentally rely on our faith in how good human nature is.
4
SPEAKER_02
So if most people are good, we re going to be okay.
4
SPEAKER_02
But if people will tend towards,
4
SPEAKER_02
manipulation and malevolent behavior in search of power, then we re screwed.
4
SPEAKER_02
So I don t know if you can comment on how to keep the metaverse secure.
4
SPEAKER_00
Yeah, I mean, all I thought about when you were talking just now is my three-year-old son.
4
SPEAKER_00
Yeah.
4
SPEAKER_00
He asked me the other day, what s the internet, mom?
4
SPEAKER_00
And I just almost wanted to cry.
4
SPEAKER_00
I don t want that for him.
4
SPEAKER_00
I don t want all of his most meaningful experiences to be online.
4
SPEAKER_00
By the time that happens, how do you know that person s human, that avatar s human?
4
SPEAKER_00
I believe in free speech.
4
SPEAKER_00
I don t believe in free speech for robots and bots.
4
SPEAKER_00
And look what just happened over the last
4
SPEAKER_00
six years.
4
SPEAKER_00
We had bots pretending to be Black Lives Matter activists just to sow some division, or Texas secessionists, or organizing anti-Hillary protests, or just to sow more division, to tie us up in our own politics so that we re so paralyzed, we can t get anything done.
4
SPEAKER_00
We can t make any progress, and we definitely can t handle our adversaries.
4
SPEAKER_00
and their long-term thinking.
4
SPEAKER_00
It really scares me.
4
SPEAKER_00
And here s where I just come back to just because we can create the metaverse, just because it sounds like the next logical step in our digital revolution.
4
SPEAKER_00
Do I really want my child s most significant moments to be online?
4
SPEAKER_00
They weren t for me.
4
SPEAKER_00
You know, so maybe I m just stuck in that old school thinking, or maybe I ve seen too much.
4
SPEAKER_00
And I m really sick of being the guinea pig parent generation for these things.
4
SPEAKER_00
I mean, it s hard enough with screen time.
4
SPEAKER_00
Like thinking about how to manage the metaverse as a parent to a young boy, like I can t even let my head go there.
4
SPEAKER_00
That s so terrifying for me.
4
SPEAKER_00
But we ve never stopped any new technology just because it introduces risks.
4
SPEAKER_00
We ve always said, okay, the promise of this technology means we should keep going, keep pressing ahead.
4
SPEAKER_00
We just need to figure out new ways to manage that risk.
4
SPEAKER_00
And you know, that s the blockchain right now.
4
SPEAKER_00
Like when I was covering all of these ransomware attacks,
4
SPEAKER_00
I thought, okay, this is gonna be it for cryptocurrency.
4
SPEAKER_00
Governments are gonna put the kibosh down, they re gonna put the hammer down and say, enough is enough.
4
SPEAKER_00
We have to put this genie back in the bottle because it s enabled ransomware.
4
SPEAKER_00
I mean, five years ago, they would hijack your PC and they d say, go to the local pharmacy, get a e-gift card and tell us what the PIN is and then we ll get your $200.
4
SPEAKER_00
Now it s pay us five Bitcoin.
4
SPEAKER_00
And so there s no doubt cryptocurrencies enabled ransomware attacks, but after the Colonial Pipeline, ransom was seized.
4
SPEAKER_00
Because if you remember, the FBI was actually able to go in and claw some of it back from DarkSide, which was the ransomware group that hid it.
4
SPEAKER_00
And I spoke to these guys at TRM Labs.
4
SPEAKER_00
So they re one of these blockchain intelligence companies.
4
SPEAKER_00
And a lot of people that work there used to work at the treasury.
4
SPEAKER_00
And what they said to me was, yeah, cryptocurrency has enabled ransomware.
4
SPEAKER_00
But to track down that ransom payment would have taken, if we were dealing with fiat currency, would have taken us years to get to that one bank account or belonging to that one front company in the Seychelles.
4
SPEAKER_00
And now, thanks to the blockchain, we can track the movement of those funds in real time.
4
SPEAKER_00
And you know what, you know, these payments are not as anonymous as people think.
4
SPEAKER_00
Like we still can use our old hacking ways and zero days and, you know, old school intelligence methods to find out who owns that private wallet and how to get to it.
4
SPEAKER_00
So it s a curse in some ways in that it s an enabler, but it s also a blessing.
4
SPEAKER_00
And they said that same thing to me that I just said to you.
4
SPEAKER_00
They said, we ve never shut down a promising new technology because it introduced risk.
4
SPEAKER_00
We just figured out how to manage that risk.
4
SPEAKER_02
And I think that s where the conversation unfortunately has to go is how do we in the metaverse
4
SPEAKER_02
use technology to fix things.
4
SPEAKER_02
So maybe we ll finally be able to, not finally, but figure out a way to solve the identity problem on the internet, meaning like a blue check mark for actual human, and connect it to identity, like a fingerprint, so you can prove you re you, and yet do it in a way that doesn t involve the company having all your data.
4
SPEAKER_02
So giving you, allowing you to maintain control over your data, or if you don t, then there s complete transparency of how that data is being used, all those kinds of things.
4
SPEAKER_02
And maybe as you educate more and more people,
4
SPEAKER_02
they would demand in a capitalist society that the companies that they give their data to will respect that data.
4
SPEAKER_00
Yeah, I mean, there is this company, and I hope they succeed, their name s PIIANO, P-I-I-O-N-O, and they wanna create a vault for your personal information inside every organization.
4
SPEAKER_00
And ultimately, if I m gonna call Delta Airlines to book a flight,
4
SPEAKER_00
They don t need to know my social security number.
4
SPEAKER_00
They don t need to know my birth date.
4
SPEAKER_00
They re just gonna send me a one-time token to my phone.
4
SPEAKER_00
My phone s gonna say, or my Fido key is gonna say, yep, it s her.
4
SPEAKER_00
And then we re gonna talk about my identity like a token, some random token.
4
SPEAKER_00
They don t need to know exactly who I am.
4
SPEAKER_00
They just need to know the system trusts that I am who I say I am, but they don t get access.
4
SPEAKER_00
to my PII data.
4
SPEAKER_00
They don t get access to my social security number, my location, or the fact I m a Times journalist.
4
SPEAKER_00
I think that s the way the world s gonna go.
4
SPEAKER_00
Enough is enough on sort of losing our personal information everywhere, letting data marketing companies track our every move.
4
SPEAKER_00
They don t need to know who I am.
4
SPEAKER_00
you know, okay, I get it.
4
SPEAKER_00
You know, we re stuck in this world where the internet runs on ads.
4
SPEAKER_00
So ads are not gonna go away.
4
SPEAKER_00
But they don t need to know I m Nicole Perlera.
4
SPEAKER_00
They can know that I am token number, you know, x567.
4
SPEAKER_02
And they can let you know what they know and give you control about removing the things they know.
4
SPEAKER_00
Yeah, right, to be forgotten.
4
SPEAKER_02
To me, you should be able to walk away with a single press of a button.
4
SPEAKER_02
And I also believe that most people, given the choice to walk away, won t walk away.
4
SPEAKER_02
They ll just feel better about having the option to walk away when they understand the trade-offs.
4
SPEAKER_02
If you walk away, you re not gonna get some of the personalized experiences that you would otherwise get, like a personalized feed and all those kinds of things.
4
SPEAKER_02
But the freedom to walk away is, I don t know,
4
SPEAKER_02
I think really powerful.
4
SPEAKER_02
And obviously what you re saying, there s all of these HTML forms where you have to enter your phone number and email and private information from every single airline.
4
SPEAKER_02
New York Times.
4
SPEAKER_02
I have so many opinions on this.
4
SPEAKER_02
Just the friction and the sign up and all those kinds of things.
4
SPEAKER_02
I should be able to, this has to do with everything.
4
SPEAKER_02
This has to do with payment too.
4
SPEAKER_02
Payment should be trivial.
4
SPEAKER_02
It should be one click and one click to unsubscribe and subscribe.
4
SPEAKER_02
and one click to provide all of your information that s necessary for the subscription service, for the transaction service, whatever that is, getting a ticket, as opposed to, I have all these fake phone numbers and emails that I use now to sign out, because, you know, you never know if one site is hacked, then it s just going to propagate to everything else.
4
SPEAKER_00
Yeah, and there s low-hanging fruit, and I hope Congress does something, and frankly, I think it s negligent they haven t, on the fact that elderly people are getting spammed to death on their phones these days with fake car warranty scams.
4
SPEAKER_00
I mean, my dad was in the hospital last year, and I was in the hospital room, and his phone kept buzzing, and I look at it, and it s just,
4
SPEAKER_00
spam attack after spam attack, people nonstop calling about his freaking car warranty, why they re trying to get his social security number, they re trying to get his PII, they re trying to get this information.
4
SPEAKER_00
We need to figure out how to put those people in jail for life.
4
SPEAKER_00
And we need to figure out why in the hell we are being required or asked to hand over our social security number and our home address and our passport, all of that information to every retailer who asks.
4
SPEAKER_00
I mean, that s insanity.
4
SPEAKER_00
And there s no question they re not protecting it because it keeps showing up in spam or
4
SPEAKER_00
identity theft or credit card theft or worse.
4
SPEAKER_02
Well, the spam s getting better, and maybe I need to, as a side note, make a public announcement.
4
SPEAKER_02
Please clip this out, which is if you get an email or a message from Lex Friedman saying how much I, Lex, appreciate you and love you and so on, and please connect with me on my WhatsApp number and I will give you Bitcoin or something like that,
4
SPEAKER_02
Please do not click.
4
SPEAKER_02
And I m aware that there s a lot of this going on, a very large amount.
4
SPEAKER_02
I can t do anything about it.
4
SPEAKER_02
This is on every single platform.
4
SPEAKER_02
It s happening more and more and more, which I ve been recently informed that they re now emailing.
4
SPEAKER_02
So it s cross platform.
4
SPEAKER_02
They re taking people s, they re somehow, this is fascinating to me because
4
SPEAKER_02
They are taking people who comment on various social platforms, and they somehow reverse engineer, they figure out what their email is, and they send an email to that person saying, from Lex Friedman, and it s like a heartfelt email with links.
4
SPEAKER_02
It s fascinating, because it s cross-platform now.
4
SPEAKER_02
It s not just a spam email.
4
SPEAKER_02
bot that s messaging us and a comment that s in a reply, they are saying, okay, this person cares about this other person on social media, so I m going to find another channel, which in their mind probably increases, and it does, the likelihood that they ll get the people to click, and they do.
4
SPEAKER_02
I don t know what to do about that.
4
SPEAKER_02
It makes me really, really sad, especially with podcasting, there s an intimacy.
4
SPEAKER_02
that people feel connected and they get really excited.
4
SPEAKER_02
Okay, cool, I wanna talk to Lex.
4
SPEAKER_02
And they click.
4
SPEAKER_02
I get angry at the people that do this.
4
SPEAKER_02
I mean, you re...
4
SPEAKER_02
It s like the John that gets hired, the fake employee.
4
SPEAKER_02
I mean, I don t know what to do about that.
4
SPEAKER_02
I mean, I suppose the solution is education.
4
SPEAKER_02
It s telling people to be skeptical on stuff they click.
4
SPEAKER_02
That balance with the technology solution of creating a...
4
SPEAKER_02
maybe like two-factor authentication and maybe helping identify things that are likely to be spam.
4
SPEAKER_02
I don t know.
4
SPEAKER_02
But then the machine learning there is tricky because you don t want to add a lot of extra friction.
4
SPEAKER_02
that just annoys people because they ll turn it off.
4
SPEAKER_02
Because you have the accept cookies thing, right?
4
SPEAKER_02
That everybody has to click on now, so now they completely ignore the accept cookies.
4
SPEAKER_02
This is very difficult.
4
SPEAKER_02
To find that frictionless security.
4
SPEAKER_02
You mentioned Snowden.
4
SPEAKER_02
You ve talked about looking through the NSA documents he leaked and doing the hard work of that.
4
SPEAKER_02
What do you make of Edward Snowden?
4
SPEAKER_02
What have you learned from those documents?
4
SPEAKER_02
What do you think of him?
4
SPEAKER_02
In the long arc of history, is Edward Snowden a hero or a villain?
4
SPEAKER_00
I think he s neither.
4
SPEAKER_00
I have really complicated feelings about Edward Snowden.
4
SPEAKER_00
On the one hand, I m a journalist at heart and more transparency is good.
4
SPEAKER_00
And I m grateful for the conversations that we had in the post-Snowden era about the limits to surveillance and how critical privacy is.
4
SPEAKER_00
And when you have no transparency and you don t really know, in that case, what our secret courts were doing, how can you truly believe that our country is taking our civil liberties seriously?
4
SPEAKER_00
So on the one hand, I m grateful that he cracked open these debates.
4
SPEAKER_00
On the other hand,
4
SPEAKER_00
When I walked into the storage closet of classified NSA secrets, I had just spent two years covering Chinese cyber espionage almost every day.
4
SPEAKER_00
and this sort of advancement of Russian attacks that were just getting worse and worse and more destructive.
4
SPEAKER_00
And there were no limits to Chinese cyber espionage and Chinese surveillance of its own citizens.
4
SPEAKER_00
And there seemed to be no limit to what Russia was willing to do
4
SPEAKER_00
in terms of cyber attacks and also, in some cases, assassinating journalists.
4
SPEAKER_00
So when I walked into that room, there was a part of me, quite honestly, that was relieved to know that the NSA was as good as I hoped they were.
4
SPEAKER_00
And we weren t using that knowledge to, as far as I know, assassinate journalists.
4
SPEAKER_00
We weren t using our access to, you know, take out pharmaceutical companies.
4
SPEAKER_00
For the most part, we were using it for traditional espionage.
4
SPEAKER_00
Now, that set of documents also set me on the journey of my book, because to me, the American people s reaction to the Snowden documents was a little bit misplaced.
4
SPEAKER_00
You know, they were upset about the phone call metadata collection program.
4
SPEAKER_00
Angela Merkel, I think, rightfully was upset that we were hacking her cell phone.
4
SPEAKER_00
But in sort of the spy eats spy world, hacking world leaders  cell phones is pretty much what most spy agencies do.
4
SPEAKER_00
And there wasn t a lot that I saw in those documents
5
SPEAKER_01
that was beyond what I thought a spy agency does.
5
SPEAKER_01
And I think if there was another 9-11 tomorrow, God forbid, we would all say, how did the NSA miss this?
5
SPEAKER_01
Why weren t they spying on those terrorists?
5
SPEAKER_01
Why weren t they spying on those world leaders?
5
SPEAKER_01
You know, there s some of that too.
5
SPEAKER_01
But I think that there was great damage done to the US s reputation.
5
SPEAKER_01
I think we really lost our halo in terms of a protector of civil liberties.
5
SPEAKER_01
And I think a lot of what was reported was unfortunately reported in a vacuum.
5
SPEAKER_01
That was my biggest gripe.
5
SPEAKER_01
that we were always reporting the NSA has this program and here s what it does and the NSA is in Angela Merkel s cell phone and the NSA can do this and no one was saying, and by the way,
5
SPEAKER_01
China has been hacking into our pipelines, and they ve been making off with all of our intellectual property, and Russia s been hacking into our energy infrastructure, and they ve been using the same methods to spy on, track, and in many cases, kill their own journalists, and the Saudis have been doing this to their own critics and dissidents, and so you can t talk about any of these countries in isolation.
5
SPEAKER_01
it is really like spy eat spy out there.
5
SPEAKER_01
And so I just have complicated feelings.
5
SPEAKER_01
And the other thing is, and I m sorry, this is a little bit of a tangent, but the amount of documents that we had, like thousands of documents, most of which were just crap, but had people s names on them.
5
SPEAKER_01
Part of me wishes that those documents had been released
5
SPEAKER_01
in a much more targeted limited way.
5
SPEAKER_01
It s just a lot of it just felt like a PowerPoint that was taken out of context.
5
SPEAKER_01
And you just sort of wish that there had been a little bit more thought into what was released, because I think a lot of the impact from Sony was just the volume
5
SPEAKER_01
of the reporting, but I think, you know, based on what I saw personally, there was a lot of stuff that I just, I don t know why that particular thing got released.
5
SPEAKER_00
As a whistleblower, what s the better way to do it?
5
SPEAKER_00
Because, I mean, there s fear, there s, it takes a lot of effort to do a more targeted release.
5
SPEAKER_00
You know, if there s proper channels, you re afraid that those channels would be manipulated.
5
SPEAKER_00
Like, who do you trust?
5
SPEAKER_00
What s a better way to do this, do you think, as a journalist?
5
SPEAKER_00
This is almost like a journalistic question.
5
SPEAKER_00
Reveal some fundamental flaw in the system without destroying the system.
5
SPEAKER_00
I bring up, you know, again, Mark Zuckerberg and Meta.
5
SPEAKER_00
There was a whistleblower that came out about Instagram internal studies, and I also am torn about how to feel about that whistleblower, because from a company perspective that s an open culture,
5
SPEAKER_00
how can you operate successfully if you have an open culture where any one whistleblower can come out, out of context, take a study, whether it represents a larger context or not, and the press eats it up.
5
SPEAKER_00
And then that creates a narrative that is, just like with the NSA, you said, it s out of context, very targeted.
5
SPEAKER_00
to wear while Facebook is evil, clearly, because of this one leak.
5
SPEAKER_00
It s really hard to know what to do there, because we re now in a society that s deeply distrust institutions.
5
SPEAKER_00
And so narratives by whistleblowers make that whistleblower and their forthcoming book very popular.
5
SPEAKER_00
And so there s a huge incentive to take stuff out of context and to tell stories that don t represent the full context, the full truth.
5
SPEAKER_00
It s hard to know what to do with that, because then that forces Facebook and Meta and governments to be much more conservative, much more secretive.
5
SPEAKER_00
It s like a race to the bottom.
5
SPEAKER_00
I don t know.
5
SPEAKER_00
I don t know if you can comment on any of that, how to be a whistleblower ethically and properly.
5
SPEAKER_01
I don t know.
5
SPEAKER_01
I mean, these are hard questions.
5
SPEAKER_01
And, you know, even for myself, like in some ways, I think of my book as sort of blowing the whistle on the underground zero-day market.
5
SPEAKER_01
But, you know, it s not like I was in the market myself.
5
SPEAKER_01
It s not like I had access to classified data when I was reporting out that book.
5
SPEAKER_01
you know, as I say in the book, like, listen, I m just trying to scrape the surface here so we can have these conversations before it s too late.
5
SPEAKER_01
And, you know, I m sure there s plenty in there that someone who s, you know, the US intelligence agency s preeminent zero-day broker probably has some voodoo doll of me out there.
5
SPEAKER_01
And, you know, you re never going to get it 100%.
5
SPEAKER_01
But I really applaud whistleblowers like, you know, the whistleblower who blew the whistle on the Trump call with Zelensky.
5
SPEAKER_01
I mean, people needed to know about that, that we were basically in some ways blackmailing an ally to try to influence an election.
5
SPEAKER_01
I mean, they went through the proper channels, they weren t trying to profit off of it, right?
5
SPEAKER_01
There was no book that came out afterwards from that whistleblower.
5
SPEAKER_01
That whistleblower s not like, they went through the channels, they re not living in Moscow, you know, let s put it that way.
5
SPEAKER_00
Can I ask you a question?
5
SPEAKER_00
You mentioned NSA, one of the things it showed is they re pretty good at what they do.
5
SPEAKER_00
Again, this is a touchy subject, I suppose, but there s a lot of conspiracy theories about intelligence agencies.
5
SPEAKER_00
From your understanding of intelligence agencies,
5
SPEAKER_00
the CIA, NSA, and the equivalent in other countries, are they, one question, this could be a dangerous question, are they competent, are they good at what they do?
5
SPEAKER_00
And two, are they malevolent in any way?
5
SPEAKER_00
Sort of, I recently had a conversation about tobacco companies that kind of see their customers as dupes, like they can just play games with people.
5
SPEAKER_00
Conspiracy theories tell that similar story about intelligence agencies, that they re interested in manipulating the populace for whatever ends the powerful.
5
SPEAKER_00
in dark rooms, cigarette smoke, cigar smoke-filled rooms.
5
SPEAKER_00
What s your sense?
5
SPEAKER_00
Do these conspiracy theories have kind of any truth to them?
5
SPEAKER_00
Or are intelligence agencies, for the most part, good for society?
5
SPEAKER_01
Okay, well, that s an easy one.
5
SPEAKER_00
Is it?
5
SPEAKER_01
No.
5
SPEAKER_01
I think it depends which intelligence agency.
5
SPEAKER_01
Think about the Mossad.
5
SPEAKER_01
They re killing every Iranian nuclear scientist they can over the years.
5
SPEAKER_01
but have they delayed the time horizon before Iran gets the bomb?
5
SPEAKER_01
Yeah.
5
SPEAKER_01
Have they probably staved off terror attacks on their own citizens?
5
SPEAKER_01
Yeah.
5
SPEAKER_01
None of these, intelligence is intelligence.
5
SPEAKER_01
You can t just say they re malevolent or they re heroes.
5
SPEAKER_01
Everyone I have met in this space
5
SPEAKER_01
is not like the pound your chest patriot that you see on the beach on the 4th of July.
5
SPEAKER_01
A lot of them have complicated feelings about their former employers.
5
SPEAKER_01
Well, at least at the NSA reminded me to do what we were accused of doing after Snowden, to spy on Americans.
5
SPEAKER_01
you have no idea the amount of red tape and paperwork and bureaucracy it would have taken to do what everyone thinks that we were supposedly doing.
5
SPEAKER_01
But then, you know, we find out in the course of the Snowden reporting about a program called Lovin 
5
SPEAKER_01
where a couple of the NSA analysts were using their access to spy on their ex-girlfriends.
5
SPEAKER_01
So, you know, there s an exception to every case.
5
SPEAKER_01
Generally, I will probably get, you know, accused of my Western bias here again, but
5
SPEAKER_01
I think you can almost barely compare some of these Western intelligence agencies to China, for instance.
5
SPEAKER_01
And the surveillance that they re deploying on the Uyghurs, to the level they re deploying it,
5
SPEAKER_01
And the surveillance they re starting to export abroad with some of the programs like the watering hole attack I mentioned earlier, where it s not just hitting the Uyghurs inside China, it s hitting anyone interested in the Uyghur plight outside China.
5
SPEAKER_01
I mean, it could be an American high school student writing a paper on the Uyghurs.
5
SPEAKER_01
They want to spy on that person too.
5
SPEAKER_01
You know, there s no rules in China really limiting the extent of that surveillance.
5
SPEAKER_01
And we all better pay attention to what s happening with the Uyghurs because just as Ukraine has been to Russia in terms of a test kitchen for its cyber attacks,
5
SPEAKER_01
The Uyghurs are China s test kitchen for surveillance, and there s no doubt in my mind that they re testing them on the Uyghurs.
5
SPEAKER_01
Uyghurs are their petri dish, and eventually they will export that level of surveillance overseas.
5
SPEAKER_01
I mean, in 2015,
5
SPEAKER_01
Obama and Xi Jinping reached a deal where basically the White House said, you better cut it out on intellectual property theft.
5
SPEAKER_01
And so they made this agreement that they would not hack each other for commercial benefit.
5
SPEAKER_01
And for a period of about 18 months, we saw this huge drop off in Chinese cyber attacks on American companies.
5
SPEAKER_01
But some of them continued.
5
SPEAKER_01
Where did they continue?
5
SPEAKER_01
They continued on aviation companies, on hospitality companies like Marriott.
5
SPEAKER_01
Why?
5
SPEAKER_01
Because that was still considered fair game to China.
5
SPEAKER_01
It wasn t IP theft they were after.
5
SPEAKER_01
They wanted to know who was staying in this city at this time when Chinese citizens were staying there so they could cross match for counterintelligence who might be a likely Chinese spy.
5
SPEAKER_01
I m sure we re doing some of that too.
5
SPEAKER_01
Counterintelligence is counterintelligence.
5
SPEAKER_01
It s considered fair game.
5
SPEAKER_01
But where I think it gets evil is when you use it for censorship, to suppress any dissent
5
SPEAKER_01
to do what I ve seen the UAE do to its citizens, where people who ve gone on Twitter just to advocate for better voting rights, more enfranchisement, suddenly find their passports confiscated.
5
SPEAKER_01
I talked to one critic, Ahmed Mansour, and he told me,
5
SPEAKER_01
You know, you might find yourself a terrorist, labeled a terrorist one day, and you don t even know how to operate a gun.
5
SPEAKER_01
I mean, he d been beaten up every time he tried to go somewhere.
5
SPEAKER_01
His passport had been confiscated.
5
SPEAKER_01
By that point, it turned out they d already hacked into his phone, so they were listening to us talking.
5
SPEAKER_01
They d hacked into his baby monitor, so they re spying on his child, and they stole his car.
5
SPEAKER_01
And then they created a new law that you couldn t criticize the ruling family or the ruling party on Twitter.
5
SPEAKER_01
And he s been in solitary confinement every day since on hunger strike.
5
SPEAKER_01
So that s evil.
5
SPEAKER_01
That s evil.
5
SPEAKER_01
And we don t do that here.
5
SPEAKER_01
We have rules here.
5
SPEAKER_01
We don t cross that line.
5
SPEAKER_01
So yeah, in some cases, I won t go to Dubai.
5
SPEAKER_01
You know, I won t go to Abu Dhabi.
5
SPEAKER_01
If I ever want to go to the Maldives, like too bad, like most of the flights go through Dubai.
5
SPEAKER_00
So there s some lines we re not willing to cross.
5
SPEAKER_00
But then again, just like you said, there s individuals within NSA, within CIA, and they may have power.
5
SPEAKER_00
And to me, there s levels of evil.
5
SPEAKER_00
To me personally, this is the stuff with conspiracy theories, is the things you ve mentioned as evil are more direct attacks.
5
SPEAKER_00
But there s also psychological warfare.
5
SPEAKER_00
So blackmail, so what is,
5
SPEAKER_00
What does spying allow you to do?
5
SPEAKER_00
It allows you to collect information if you have something that s embarrassing, or if you have like Jeffrey Epstein conspiracy theories, active, what is it, manufacturer of embarrassing things, and then use blackmail to manipulate the population or all the powerful people involved.
5
SPEAKER_00
It troubles me deeply that MIT allowed somebody like Jeffrey Epstein in their midst, especially some of the scientists I admire that they would hang out with that person at all.
5
SPEAKER_00
And so, you know, I ll talk about it sometimes.
5
SPEAKER_00
And then a lot of people tell me, well, obviously Jeffrey Epstein is a front for intelligence.
5
SPEAKER_00
And I just, I struggle to see that level of competence and malevolence.
5
SPEAKER_00
But, you know, who the hell am I?
5
SPEAKER_00
And I guess I was trying to get to that point.
5
SPEAKER_00
You said that there s bureaucracy and so on, which makes some of these things very difficult.
5
SPEAKER_00
I wonder how much malevolence, how much competence there is in these institutions, like how far, this takes us back to the hacking question, how far are people willing to go if they have the power?
5
SPEAKER_00
This has to do with social engineering, this has to do with hacking, this has to do with
5
SPEAKER_00
manipulating people, attacking people, doing evil onto people, psychological warfare and stuff like that.
5
SPEAKER_00
I don t know.
5
SPEAKER_00
I believe that most people are good.
5
SPEAKER_00
And I don t think that s possible in a free society.
5
SPEAKER_00
There s something that happens when you have a centralized government where power corrupts over time and you start surveillance programs.
5
SPEAKER_00
It s like a slippery slope that over time starts
5
SPEAKER_00
to both use fear and direct manipulation to control the populace.
5
SPEAKER_00
But in a free society, I just, it s difficult for me to imagine that you can have something like a Jeffrey Epstein, a front for intelligence.
5
SPEAKER_00
I don t know what I m asking you, but I m just, I have a hope that for the most part, intelligence agencies are trying to do good and they re actually doing good for the world.
5
SPEAKER_00
when you view it in the full context of the complexities of the world.
5
SPEAKER_00
But then again, if they re not, would we know?
5
SPEAKER_00
That s why Edwin Snowden might be a good thing.
5
SPEAKER_00
Let me ask you on a personal question.
5
SPEAKER_00
You have investigated some of the most powerful organizations and people in the world of cyber warfare, cybersecurity.
5
SPEAKER_00
Are you ever afraid for your own life, your own wellbeing, digital or physical?
5
SPEAKER_01
I mean, I ve had my moments.
5
SPEAKER_01
I ve had our security team at the Times called me at one point and said, someone s on the dark web offering good money to anyone who can hack your phone or your laptop.
5
SPEAKER_01
I describe in my book how when I was at that hacking conference in Argentina, I came back and I brought a burner laptop with me, but I d kept it in the safe anyway.
5
SPEAKER_01
it didn t have anything on it, but someone had broken in and it was moved.
5
SPEAKER_01
You know, I ve had all sorts of sort of scary moments.
5
SPEAKER_01
And then I ve had moments where I think I went just way too far into the paranoid side.
5
SPEAKER_01
I mean,
5
SPEAKER_01
I remember writing about the Times hack by China and I just covered a number of Chinese cyber attacks where they ve gotten into the thermostat at someone s corporate apartment and
6
SPEAKER_01
they ve gotten into all sorts of stuff.
6
SPEAKER_01
And I was living by myself, I was single in San Francisco, and my cable box on my television started making some weird noises in the middle of the night.
6
SPEAKER_01
And I got up and I ripped it out of the wall, and I think I said something embarrassing like,
6
SPEAKER_01
fuck you China, you know.
6
SPEAKER_01
And then I went back to bed and I woke up and like, it s like beautiful morning light.
6
SPEAKER_01
I mean, I ll never forget it.
6
SPEAKER_01
Like this is like glimmering morning light is shining on my cable box, which has now been ripped out and is sitting on my floor and like the morning light and
6
SPEAKER_01
I was just like, no, no, no.
6
SPEAKER_01
I m not going down that road.
6
SPEAKER_01
Basically, I came to a fork in the road where I could either go full tinfoil hat, go live off the grid, never have a car with navigation, never use Google Maps, never own an iPhone, never order diapers off Amazon.
6
SPEAKER_01
you know, create an alias, or I could just do the best I can and live in this new digital world we re living in.
6
SPEAKER_01
And what does that look like for me?
6
SPEAKER_01
I mean, what are my crown jewels?
6
SPEAKER_01
This is what I tell people.
6
SPEAKER_01
What are your crown jewels?
6
SPEAKER_01
Because just focus on that.
6
SPEAKER_01
You can t protect everything, but you can protect your crown jewels.
6
SPEAKER_01
For me, for the longest time, my crown jewels were my sources.
6
SPEAKER_01
I was nothing without my sources.
6
SPEAKER_01
So I had some sources.
6
SPEAKER_01
I would meet the same dim sum place, or maybe it was a different restaurant, on the same date, you know, every quarter, and we would never drive there.
6
SPEAKER_01
We would never Uber there.
6
SPEAKER_01
We wouldn t bring any devices.
6
SPEAKER_01
I could bring a pencil and a notepad.
6
SPEAKER_01
And if someone wasn t in town, like there were a couple times where I d show up and the source never came.
6
SPEAKER_01
but we never communicated digitally.
6
SPEAKER_01
And those were the lengths I was willing to go to protect that source, but you can t do it for everyone.
6
SPEAKER_01
So for everyone else, it was signal, using two-factor authentication, keeping my devices up to date, not clicking on phishing emails, using a password manager, all the things that we know we re supposed to do.
6
SPEAKER_01
And that s what I tell everyone.
6
SPEAKER_01
Don t go crazy, because then that s the ultimate hack.
6
SPEAKER_01
Then they ve hacked your mind.
6
SPEAKER_01
whoever they is for you.
6
SPEAKER_01
But just do the best you can.
6
SPEAKER_01
Now, my whole risk model changed when I had a kid.
6
SPEAKER_01
Now it s, oh God, if anyone
6
SPEAKER_01
threatened my family.
6
SPEAKER_01
God help them.
6
SPEAKER_01
But it s, it changes you.
6
SPEAKER_01
And, you know, unfortunately, there are some things like I was really scared to go deep on, like Russian cybercrime, you know, like Putin himself, you know, and, and it s interesting, like, I have a mentor who s an incredible person,
6
SPEAKER_01
who was the Times Moscow bureau chief during the Cold War.
6
SPEAKER_01
And after I wrote a series of stories about Chinese cyber espionage, he took me out to lunch.
6
SPEAKER_01
And he told me that when he was living in Moscow, he would drop his kids off at preschool when they were my son s age now.
6
SPEAKER_01
and the KGB would follow him and they would make a really like loud show of it.
6
SPEAKER_01
You know, they d tail him, they d, you know, honk, they d just be a wreck, make a ruckus.
6
SPEAKER_01
And he said, you know what, they never actually did anything, but they wanted me to know that they were following me and I operated accordingly.
6
SPEAKER_01
And he says, that s how you should operate in the digital world.
6
SPEAKER_01
know that there are probably people following you.
6
SPEAKER_01
Sometimes they ll make a little bit of noise.
6
SPEAKER_01
But one thing you need to know is that while you re at the New York Times, you have a little bit of an invisible shield on you.
6
SPEAKER_01
If something were to happen to you, that would be a really big deal.
6
SPEAKER_01
That would be an international incident.
6
SPEAKER_01
So I kind of carried that invisible shield with me for years.
6
SPEAKER_01
And then Jamal Khashoggi happened.
6
SPEAKER_01
And that destroyed my vision of my invisible shield.
6
SPEAKER_01
Sure, he was a Saudi, but he was a Washington Post columnist.
6
SPEAKER_01
For the most part, he was living in the United States.
6
SPEAKER_01
He was a journalist.
6
SPEAKER_01
And for them to do what they did to him pretty much in the open and get away with it, and for the United States to let them get away with it because we wanted to preserve diplomatic relations with the Saudis, that really threw my worldview upside down.
6
SPEAKER_01
And I think that sent a message to a lot of countries
6
SPEAKER_01
that it was sort of open season on journalists.
6
SPEAKER_01
And to me, that was one of the most destructive things that happened under the previous administration.
6
SPEAKER_01
And, you know, I don t really know what to think of my invisible shield anymore.
6
SPEAKER_00
Like you said, that really worries me on the journalism side that people would be afraid to dig deep on fascinating topics.
6
SPEAKER_00
And, you know, I have my own,
6
SPEAKER_00
Part of the reason, like I would love to have kids, I would love to have a family.
6
SPEAKER_00
Part of the reason I m a little bit afraid, there s many ways to phrase this, but the loss of freedom in the way of doing all the crazy shit that I naturally do, which I would say the ethic of journalism is kind of not, is doing crazy shit without really thinking about it, is letting your curiosity,
6
SPEAKER_00
really allow you to be free and explore.
6
SPEAKER_00
I mean, whether it s stupidity or fearlessness, whatever it is, that s what great journalism is.
6
SPEAKER_00
And all the concerns about security risks have made me become a better person.
6
SPEAKER_00
The way I approach it is just make sure you don t have anything to hide.
6
SPEAKER_00
I know this is not a thing.
6
SPEAKER_00
This is not an approach to security.
6
SPEAKER_00
This is like a motivational speech or something.
6
SPEAKER_00
It s just like, if you can lose, you can be hacked at any moment.
6
SPEAKER_00
Just don t be a douchebag secretly.
6
SPEAKER_00
Just be like a good person.
6
SPEAKER_00
Because then, I see this actually with social media in general.
6
SPEAKER_00
Just present yourself in the most authentic way possible, meaning be the same person online as you are privately, have nothing to hide.
6
SPEAKER_00
That s one, not the only, but one of the ways to achieve security.
6
SPEAKER_00
Maybe I m totally wrong on this, but don t be,
6
SPEAKER_00
secretly weird.
6
SPEAKER_00
If you re weird, be publicly weird so it s impossible to blackmail you.
6
SPEAKER_00
That s my approach to the situation.
6
SPEAKER_01
Yeah, well, they call it the New York Times front page phenomenon.
6
SPEAKER_01
Don t put anything in email or I guess social media these days that you wouldn t want to read on the front page of the New York Times.
6
SPEAKER_01
And that works, but sometimes I even get carried, I mean, I have not as many followers as you,
6
SPEAKER_01
a lot of followers, and sometimes even I get carried away.
6
SPEAKER_01
Just be emotional and stuff and say something.
6
SPEAKER_01
Yeah, yeah, I mean, just the cortisol response on Twitter.
6
SPEAKER_01
Twitter is basically designed to elicit those responses.
6
SPEAKER_01
I mean, every day I turn on my computer, I look at my phone, I look at what s trending on Twitter, and it s like, what are the topics that are gonna make people the most angry today?
6
SPEAKER_01
You know?
6
SPEAKER_01
And it s easy to get carried away, but it s also just, that sucks too, that you have to be constantly censoring yourself.
6
SPEAKER_01
And maybe it s for the better.
6
SPEAKER_01
Maybe you can t be a secret asshole, and we can put that in the good bucket.
6
SPEAKER_01
But at the same time, there is a danger
6
SPEAKER_01
to that other voice, to creativity, to being weird, there s a danger to that little whispered voice that s like, well, how would people read that?
6
SPEAKER_01
How could that be manipulated?
6
SPEAKER_01
How could that be used against you?
6
SPEAKER_01
And that stifles
6
SPEAKER_01
creativity and innovation and free thought.
6
SPEAKER_01
And that is on a very micro level.
6
SPEAKER_01
And that s something I think about a lot.
6
SPEAKER_01
And that s actually something that Tim Cook has talked about a lot.
6
SPEAKER_01
And why he has said he goes full force on privacy is, it s just that little voice that is at some level censoring you.
6
SPEAKER_01
and what is sort of the long-term impact of that little voice over time?
6
SPEAKER_00
I think there s a ways, I think that self-censorship is an attack factor that there are solutions to.
6
SPEAKER_00
The way I m really inspired by Elon Musk, the solution to that is just
6
SPEAKER_00
be privately and publicly the same person and be ridiculous.
6
SPEAKER_00
Embrace the full weirdness and show it more and more.
6
SPEAKER_00
So, you know, there s memes that has like ridiculous humor and I think, and if there is something you really wanna hide, deeply consider if that you wanna be that.
6
SPEAKER_00
Like, why are you hiding it?
6
SPEAKER_00
What exactly are you afraid of?
6
SPEAKER_00
Because I think my hopeful vision for the internet is the internet loves authenticity.
6
SPEAKER_00
They want to see you weird.
6
SPEAKER_00
So be that.
6
SPEAKER_00
And like, live that fully.
6
SPEAKER_00
Because I think that gray area where you re kind of censoring yourself, that s where the destruction is.
6
SPEAKER_00
You have to go all the way, step over, be weird.
6
SPEAKER_00
And then,
6
SPEAKER_00
It feels, it can be painful because people can attack you and so on, but just ride it.
6
SPEAKER_00
I mean, that s just like a skill on the social psychological level that ends up being an approach to security, which is like remove the attack vector of having private information by being your full weird self publicly.
6
SPEAKER_00
What advice would you give to young folks today operating in this complicated space about how to have a successful life, a life they can be proud of, a career they can be proud of?
6
SPEAKER_00
Maybe somebody in high school and college thinking about what they re going to do.
6
SPEAKER_01
Be a hacker.
6
SPEAKER_01
If you have any interest, become a hacker and apply yourself to defense.
6
SPEAKER_01
Every time, like we do have these amazing scholarship programs, for instance, where they find you early, they ll pay your college as long as you commit to some kind of federal commitment to sort of help.
6
SPEAKER_01
federal agencies with cybersecurity and where does everyone want to go every year from the scholarship program?
6
SPEAKER_01
They want to go work at the NSA or Cyber Command, you know, they want to go work on offense.
6
SPEAKER_01
They want to go do the sexy stuff.
6
SPEAKER_01
It s really hard to get people to work on defense.
6
SPEAKER_01
It s just it s always been more fun to be a pirate than be in the Coast Guard, you know, and so
6
SPEAKER_01
we have a huge deficit when it comes to filling those roles.
6
SPEAKER_01
There s 3.5 million unfilled cybersecurity positions around the world.
6
SPEAKER_01
I mean, talk about job security, like be a hacker and work on cybersecurity, you will always have a job.
6
SPEAKER_01
And we re actually at a huge deficit and disadvantage as a free market economy.
6
SPEAKER_01
because we can t match cybersecurity salaries at Palantir or Facebook or Google or Microsoft.
6
SPEAKER_01
And so it s really hard for the United States to fill those roles.
6
SPEAKER_01
And other countries have had this workaround where they basically have forced conscription on some level.
6
SPEAKER_01
China tells people, you do whatever you re gonna do during the day, work at Alibaba,
6
SPEAKER_01
You know, if you need to do some ransomware, okay, but the minute we tap you on the shoulder and ask you to come do this sensitive operation for us, the answer is yes.
6
SPEAKER_01
You know, same with Russia, you know, a couple of years ago when Yahoo was hacked and they laid it all out in an indictment, it came down to two cyber criminals and two guys from the FSB.
6
SPEAKER_01
Cyber criminals were allowed to have their fun.
6
SPEAKER_01
But the minute they came across the username and password for someone s personal Yahoo account that worked at the White House or the State Department or military, they were expected to pass that over to the FSB.
6
SPEAKER_01
So we don t do that here.
6
SPEAKER_01
And it s even worse on defense.
6
SPEAKER_01
We really can t fill these positions.
6
SPEAKER_01
So, you know, if you are a hacker, if you re interested in code, if you re a tinker, you know, learn how to hack.
6
SPEAKER_01
There are all sorts of amazing hacking competitions you can do through the SANS org, for example, S-A-N-S.
6
SPEAKER_01
And then use those skills for good, you know, neuter the bugs in that code that get used by autocratic regimes to make people s life, you know, a living prison.
6
SPEAKER_01
You know, plug those holes, you know, defend industrial systems, defend our water treatment facilities from hacks where people are trying to come in and poison the water.
6
SPEAKER_01
You know, that I think is just an amazing, you know,
6
SPEAKER_01
It s an amazing job on so many levels.
6
SPEAKER_01
It s intellectually stimulating.
6
SPEAKER_01
You can tell yourself you re serving your country.
6
SPEAKER_01
You can tell yourself you re saving lives and keeping people safe.
6
SPEAKER_01
And you ll always have amazing job security.
6
SPEAKER_01
And if you need to go get that job that pays you, you know, two million bucks a year, you can do that too.
6
SPEAKER_00
And you can have a public profile, more so of a public profile, you can be a public rock star.
6
SPEAKER_00
I mean, it s the same thing as sort of the military.
6
SPEAKER_00
There s a lot of well-known sort of people commenting on the fact that veterans are not treated as well as they should be.
6
SPEAKER_00
But it s still the fact that soldiers are deeply respected for
6
SPEAKER_00
for defending the country, the freedoms, the ideals that we stand for.
6
SPEAKER_00
And in the same way, I mean, in some ways, the cyber security defense are the soldiers of the future.
6
SPEAKER_01
Yeah.
6
SPEAKER_01
And you know, it s interesting.
6
SPEAKER_01
I mean, in cyber security, the difference is oftentimes you see the more interesting threats in the private sector, because that s where the attacks come.
6
SPEAKER_01
You know, when when cyber criminals and nation state adversaries come for the United States, they don t go directly for Cyber Command or the NSA.
6
SPEAKER_01
No, they go for banks, they go for Google, they go for Microsoft, they go for critical infrastructure.
6
SPEAKER_01
And so those companies, those private sector companies get to see some of the most advanced, sophisticated attacks out there.
6
SPEAKER_01
And if you re working at FireEye and you re calling out the SolarWinds attack, for instance, I mean, you just saved,
6
SPEAKER_01
God knows how many systems from that compromise turning into something that more closely resembles sabotage.
6
SPEAKER_01
So go be a hacker or go be a journalist.
6
SPEAKER_00
So you wrote the book, This Is How They Tell Me The World Ends, as we ve been talking about, of course, referring to cyber war, cybersecurity.
6
SPEAKER_00
What gives you hope about the future of our world?
6
SPEAKER_00
If it doesn t end, how will it not end?
6
SPEAKER_01
That s a good question.
6
SPEAKER_01
I mean, I have to have hope, right?
6
SPEAKER_01
Because I have a kid and I have another on the way.
6
SPEAKER_01
And if I didn t have hope, I wouldn t be having kids.
6
SPEAKER_01
But it s a scary time to be having kids.
6
SPEAKER_01
And it s like pandemic, climate change, disinformation, increasingly advanced, perhaps deadly cyber attacks.
6
SPEAKER_01
What gives me hope is that I share your worldview that I think people are fundamentally good.
6
SPEAKER_01
And sometimes, and this is why the metaverse scares me to death, but when I m reminded of that is not online.
6
SPEAKER_01
Like online, I get the opposite.
6
SPEAKER_01
You start to lose hope in humanity when you re on Twitter half your day.
6
SPEAKER_01
It s like when I go to the grocery store, or I go on a hike, or someone smiles at me, or someone just says something nice, people are fundamentally good.
6
SPEAKER_01
We just don t hear from
7
SPEAKER_00
those people enough.
7
SPEAKER_00
And my hope is, I just think our current political climate, we ve hit rock bottom.
7
SPEAKER_00
This is as bad as it gets.
7
SPEAKER_00
We can t do anything.
7
SPEAKER_00
Don t jinx it.
7
SPEAKER_00
But I think it s a generational thing.
7
SPEAKER_00
You know, I think baby boomers, like it s time to move along.
7
SPEAKER_00
I think it s time for a new generation to come in.
7
SPEAKER_00
And I actually have a lot of hope when I look at, you know, I m sort of like this, I guess they call me a geriatric millennial or a young Gen X.
7
SPEAKER_00
But we have this unique responsibility because I grew up without the internet and without social media, but I m native to it.
7
SPEAKER_00
So I know the good and I know the bad.
7
SPEAKER_00
And that s true on so many different things.
7
SPEAKER_00
I grew up without climate change anxiety and now I m feeling it and I know it s not a given.
7
SPEAKER_00
We don t have to just resign ourselves to climate change.
7
SPEAKER_00
You know, same with disinformation.
7
SPEAKER_00
And I think a lot of the problems we face today have just exposed the sort of inertia that there s been on so many of these issues.
7
SPEAKER_00
And I really think it s a generational shift that has to happen.
7
SPEAKER_00
And I think this next generation is going to come in and say, like, we re not doing business like you guys did it anymore.
7
SPEAKER_00
You know, we re not just gonna like rape and pillage the earth and try and turn everyone against each other and play dirty tricks and let lobbyists dictate, you know, what we do or don t do as a country anymore.
7
SPEAKER_00
And that s really where I see the hope.
7
SPEAKER_01
It feels like there s a lot of low-hanging fruit for young minds to step up and create solutions and lead.
7
SPEAKER_01
So whenever politicians or leaders that are older, like you said, are acting shitty, I see that as a positive.
7
SPEAKER_01
They re inspiring.
7
SPEAKER_01
a large number of young people to replace them.
7
SPEAKER_01
And so it s, I think you re right, there s going to be, it s almost like you need people to act shitty to remind them, oh, wow, we need good leaders, we need great creators and builders and entrepreneurs and scientists and engineers and journalists.
7
SPEAKER_01
all the discussions about how the journalism is quote-unquote broken and so on, that s just an inspiration for new institutions to rise up that do journalism better, new journalists to step up and do journalism better.
7
SPEAKER_01
And I ve been constantly, when I talk to young people, I m constantly impressed by the ones that dream to build solutions.
7
SPEAKER_01
And so that s ultimately why I think
7
SPEAKER_01
I put the hope, but the world is a messy place, like we ve been talking about.
7
SPEAKER_01
It s a scary place.
7
SPEAKER_00
Yeah, and I think you hit on something earlier, which is authenticity.
7
SPEAKER_00
No one is going to rise above that is plastic anymore.
7
SPEAKER_00
People are craving authenticity.
7
SPEAKER_00
The benefit of the internet is it s really hard to hide who you are on every single platform.
7
SPEAKER_00
On some level, it s gonna come out who you really are.
7
SPEAKER_00
And so you hope that by the time my kids are grown, no one s gonna care if they made one mistake online, so long as they re authentic.
7
SPEAKER_00
And I used to worry about this.
7
SPEAKER_00
My nephew was born the day I graduated from college.
7
SPEAKER_00
And I just always, you know, he s like born into Facebook.
7
SPEAKER_00
And I just think like, how is a kid like that ever gonna be president of the United States of America?
7
SPEAKER_00
Because if Facebook had been around when I was in college, you know, like Jesus, you know, how are those kids gonna ever be president?
7
SPEAKER_00
There s gonna be some photo of them at some point making some mistake.
7
SPEAKER_00
And that s gonna be all over for them.
7
SPEAKER_00
And now I take that back.
7
SPEAKER_00
Now it s like, no, everyone s gonna make mistakes.
7
SPEAKER_00
There s gonna be a picture for everyone.
7
SPEAKER_00
And we re all gonna have to come and grow up to the view that as humans, we re gonna make huge mistakes.
7
SPEAKER_00
And hopefully they re not so big that they re gonna ruin the rest of your life.
7
SPEAKER_00
But we re gonna have to come around to this view that we re all human.
7
SPEAKER_00
and we re gonna have to be a little bit more forgiving and a little bit more tolerant when people mess up, and we re gonna have to be a little bit more humble when we do, and keep moving forward.
7
SPEAKER_00
Otherwise, you can t cancel everyone.
7
SPEAKER_01
Nicole, this was an incredible, hopeful conversation.
7
SPEAKER_01
Also one that reveals that in the shadows, there s a lot of challenges to be solved.
7
SPEAKER_01
So I really appreciate that you took on this really difficult subject with your book.
7
SPEAKER_01
That s journalism at its best.
7
SPEAKER_01
So I m really grateful that you took the risk, that you took that on, and that you plugged the cable box back in.
7
SPEAKER_01
That means you have hope.
7
SPEAKER_01
And thank you so much for spending your valuable time with me today.
7
SPEAKER_00
Thank you, thanks for having me.
7
SPEAKER_01
Thanks for listening to this conversation with Nicole Perlroth.
7
SPEAKER_01
To support this podcast, please check out our sponsors in the description.
7
SPEAKER_01
And now, let me leave you with some words from Nicole herself.
7
SPEAKER_01
Here we are, entrusting our entire digital lives, passwords, texts, love letters, banking records, health records, credit cards, sources, and deepest thoughts to this mystery box, whose inner circuitry most of us would never vet, run by code written in a language most of us will never fully understand.
7
SPEAKER_01
Thank you for listening, and hope to see you next time.