#328 Kevin Mandia - The Man Who Exposed China's Military Hackers

Kevin Mandia is CEO of Armadin, where he leads the company's mission to secure some of the world's largest and most complex environments. A globally recognized cybersecurity leader, he is also a General Partner at Ballistic Ventures, mentoring and investing in the next generation of cybersecurity entrepreneurs. Best known as the founder of Mandiant and former CEO of FireEye, Mandia helped redefine the cybersecurity industry through pioneering digital forensics, the groundbreaking APT1 report exposing state-sponsored cyber espionage, and his leadership during the SolarWinds attack. Today, he continues to shape cybersecurity strategy, national security policy, and the future of AI-driven defense. Privacy isn't Paranoia. It's Protection. Download Glacier - https://srs.site/glacierapp Website - https://theglacierapp.com Shawn Ryan Show Sponsors: Get 10% Off your entire order & take advantage of Ridge’s Annual Sweepstakes by going to https://www. Ridge.com/SRS #Ridgepod NO PURCHASE NECESSARY. Open only to legal residents of the promotion territory, who have reached the age of majority in their jurisdiction of residence. Void elsewhere & where prohibited by law. Enter by 9:00 a.m. USPT on 8 September 2026. 2 winners, prizes total ARV: up to approx. $539,165 CAD / £284,170. Skill-testing question required in CA. See Official Rules at ridge.com/pages/rules for complete eligibility, entry instructions, how to enter without a purchase, entry limits, prize details, odds, and restrictions. Sponsor: The Ridge Wallet LLC. Get started with Claude at https://claude.ai/srs and use promo code srs for access to all features mentioned in today’s episode. Visit https://betterhelp.com/srs. #ad Go to https://calderalab.com/SRS and use code SRS for 20% off your first order. Kevin Mandia Links: Armadin - https://www.armadin.com Ballistic Ventures - https://ballisticventures.com LinkedIn - https://www.linkedin.com/in/kevin-mandia-0a07173 Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:05Speaker 00

  Kevin Mandia, welcome to the show. Yeah, Sean, thank you. Man, cyber, cybersecurity. I've had to say it, cyber, cyber. Cyber. We got this. You ready? I'm ready. All right. We're gonna make it cool. Man, I have been, uh, yeah, I always thought cybersecurity was boring until I started researching you for this interview. Holy shit, man. Yeah, it's a... What a fucking badass. It's a weird world, you know, I've walked the halls of a lot of the headlines people read in cybersecurity and the press never really gets it, you know, nobody really understands what it's like to be a victim of a cybercrime, you know, whether it be someone hacking you

• 0:45Speaker 00

  to steal all your corporate secrets or extorting you, you know, and, yeah, hey, you gotta serve a higher purpose, mine's always been, you know, the phone rings, I answer it, and it's a CEO on the other side saying, hey, you know, we're getting ransomed and damn it, we're not paying it, and my response is always like, hey, man, we're not paying it, you know, let's show up, uh, but it's a, Sean, let's see if we make this interesting for everybody, you know, because I remember a judge, I had testified once in a case and the judge is like, this stuff's so cool, I can't wait till there's like a NCIS show on it or something like that, I'm like, man, if you could see the war room in a cyber case, it's just really quiet, it looks like your back room right there with those guys in it, you know what I mean?

• 1:27Speaker 00

  Everybody's clicking on a computer going clickety-clackety, there's nothing to see, but you can see the emotional changes in the victims, you know what I mean, you can see it on their faces, so we'll make it real. What is, let's talk about what does a victim go through? Yeah. You know, like a worst-case scenario for everybody here. You know, there's nothing, here's bad, you're an executive at a company and somebody breaks in and your email gets released, it's now Google searchable, every, you know, you're at, let's say you're at a Fortune 100, Fortune 500 company, and your photos get released, you know, things like that, your private thoughts get released, I've seen, I've been in the room with executives when their email got posted, nobody ever should have to go

• 2:09Speaker 00

  through that, I just, it's just a terrible thing to see, even I get physiologically like I can't eat and I'm like, man, this is, this is bad, so I think that's the worst thing, it personally impacts people, it gets exaggerated, the press does search your emails, they do write articles about people, um, and it's happened to actors, you know, their photos get stolen, it's hap, it happens to kids, like during our interview today, it's gonna happen to some 20-year-old college kid, you know, where their photos get stolen, nobody should ever go through that stuff, um, so to me, those are the ones that hurt the most, um, companies survive them, you know, you get back up and running, you get your operations running, uh, you get over the reputational hits that, that happen sometimes, I just feel for the people that, you know, go through losing their email.

• 2:54Speaker 00

  Yeah. And by the way, it goes in stage, they lose their email and like a month later they lose their family, you know, I mean, some of these things are pretty bad. Is that how they always start, they always start at your email? No, the intrusions are all different, right, it depends on who's doing it, you know, you have the modern nations, China and Russia, um, Iran, North Korea, uh, North Korea hacks for money, take them off, but China hacks for espionage, you know, so if they break into your company, they'll break into the defense industrial base, they'll break into any company doing business in China, and they steal emails, they steal things, communications, but they don't post it online, Sean, they don't extort you, they follow rules of engagement that whatever their doctrine is, they follow it, but it's not destructive,

• 3:38Speaker 00

  they don't change your data, they're kinda like the polite hackers, um, but criminals, it's gotten hard, I mean, because they wanna monetize any breach they've got, so they, they pull on every thread to monetize it, right, they'll, if, if, the Sean Ryan Show got compromised, what they would try to do to you is steal your emails, steal things that matter to you and say, we're gonna share it with the world, unless you pay us $5 million, $10 million, and, uh, those are the ones that are, you know, you're always making the least bad of 10 decisions, you know, so, so, shortest answer, people hack for espionage and security, securing a nation, people maybe even hack, you know, espionage to me supports diplomacy, uh, and then people hack for criminal reasons, and then probably there's a third,

• 4:23Speaker 00

  they just hack for the game of it, you know, the attractive nuisance of it, and I don't really respond to too many of those, you know. What do you recommend for people that, like, individuals, not, not executives, but just individuals who have had their photos, their emails hacked, do they pay the ransom? Oh, it depends, meaning it's already happened? Yeah. It is, I've never said pay the ransom or don't pay the ransom, I've never said that, but I've been in the room when people think about it, and I've sat there going, man, I think I'd pay this one, like, if you're a hospital, somebody breaks in and they've encrypted every machine so they're unusable, and they say, for $10 million, we're gonna hand you back a key to unlock all your machines again. Jeez.

• 5:06Speaker 00

  You got two options, you're either getting every doctor in a room saying, what surgeries can we do, which surgeries can we not do, um, or you're evacuating patients, or you're diverting ambulances, or you're paying a ransom, and that situation, I'd never opine, but boy, if I said, oh, I get it, you know, I'd pay that one and get back online, so I've seen people pay extortions and pay ransoms, and the difference is, a ransom is to like get a key to decrypt your things, like people will ransom and say, I've hacked into your network, I've shut down 10,000 machines, for $10 million bucks, I'll turn them back on for you, and, and that one, you know, if lives are at stake, or you wanna protect

• 5:46Speaker 00

  the privacy, uh, the second, the extortion is, I've hacked in, I've stolen emails, I've stolen client data, I've hacked the law firm and I've taken your briefs, yeah, those extortions are really painful, it's, I will release the data unless you pay me, and I, and I see people pay it because you're protecting your customers, or you're protecting, um, people in general, so hospitals will pay, law firms would pay, um, yeah, it's a tough decision, and I'm, luckily, I've never had to make that decision, I hope I never have to, that's brutal. Damn. Yeah. Yeah, think about it. How do you even know that they're gonna stop if you pay them?

• 6:31Speaker 00

  Well, exactly, like, they're only capable of one bad thing, right, and then they're done, and you don't, it, the, the reality, though, is, usually, if you're getting extorted, it's highly probable whoever's extorting you is in a safe harbor like Russia, I've not, others have written that they've seen Chinese actors do this, I have personally never seen a Chinese actor extort a company, or even ransom a company, so I think culturally the Chinese really don't do this, uh, it comes out of Russia, and the, the good news is this, if somebody in Russia hacks Company A in the United States, extorts them, and Company A pays that extortion, let's say they paid $20 million in Bitcoin, an anonymous currency, and then they still leak the data, the reality is, is people just stop paying

• 7:16Speaker 00

  the ransom, so I actually think there's a governance over in Russia of, oh, if you get paid, you don't post, because otherwise people will stop paying, and they've got a good racket going, so it's been my observation, when people pay, the vast majority of the time, the data does not leak. Makes sense. There are exceptions, Sean, it's rare, um, I can count the exceptions on a single hand. Wow. And there's probably over a thousand times we've responded to these things. How often is this happening? Every day, every single, during this call, during, I mean, this interview, it'll happen to somebody, can you believe that? During our interview, an 80-year-old American woman will probably lose 200 grand of her

• 7:58Speaker 00

  life savings, during our interview, a company will get compromised and probably extorted for $5 to $10 million, it is happening at a rate, and this is not a fear, uncertainty, and doubt thing, nobody knows the rate, so then you go to the government and say, well, how much money is getting paid in Bitcoin every year to Russian organized crime? It's in the billions of dollars. Holy shit. Billions, like, the lowest estimates are billions, so all we know is the lowest bounds, but, as I sit here today, people I've worked with are definitely responding to extortion cases and trying to figure out, and there'll be a new one today, a, a big one. Wow, damn. And they're handled quietly, discreetly, or sometimes they're front-page news, you never really know. Wow. Yeah. Well, you're the guy to talk to about all this.

• 8:43Speaker 00

  Yeah, and, yeah, exactly, and I sit there and say, hey, let's, yeah, by the time we get that phone call, Sean, like, that there's been a breach, there's been an extortion, it's, it's, uh, it's tough, you know, there's nothing you can do about it, except... Work through it.

• 8:58Shawn Ryan?

  How do you know? How did you meet Joe Lonsdale? He's the one that connected us.

• 9:01Speaker 00

  Oh, yeah, Joe.

• 9:02Shawn Ryan?

  Joe, thank you for that.

• 9:03Speaker 00

  So, that's a great question. I, you know, first we live in, well, he's a Texan now. Right? Uh, so he lives outside of Austin, but when he moved to Woodside, California. He has a place there and, uh, so we met there. And in general, it's a small community. You know what people are doing? And, uh, he, he and I just knew of each other, you know? I knew what he had done with Palantir. Uh, he knew I was the cyber person and just over time you get, you know? If something happened and he would give me a call, hey, listen, we got a company that needs this or a company that needs that. And, you know, I've been in the cybersecurity domain for 34 years. Sooner or later, you're either good at it or you're not doing it, you know? I like to think I'm still pretty good at it. So that's kind of it.

• 9:47Speaker 00

  You know, when people need, when people had a computer intrusion, we had a unique. My company kind of responded to every breach that mattered. And, and so I think I'm on speed dial for a lot of these folks and probably Lonsdale. I'm on his speed dial when something bad happens somewhere.

• 10:03Shawn Ryan?

  Right on.

• 10:04Speaker 00

  Yeah. I'm the emergency room doctor for, uh, cybersecurity incidents.

• 10:09Shawn Ryan?

  That's a perfect way to put it.

• 10:10Speaker 00

  Yeah.

• 10:11Shawn Ryan?

  Let me give you a quick introduction here.

• 10:13Speaker 00

  Yeah, thanks.

• 10:14Shawn Ryan?

  Kevin Mandia. You have 30 years on the front lines of American cyber defense. You began your career as a United States Air Force officer, serving as a computer security officer at the Pentagon and as a special agent in Air Force counterintelligence. In 2004, with no outside funding, you founded Mandian and spent the next decade building it into the gold standard for incident response. Author the groundbreaking APT-1 report exposing China's PLA unit 61398 in a sweeping cyber espionage campaign targeting over 140 US companies. A revelation that reshaped global cybersecurity policy.

• 10:57Shawn Ryan?

  Led with transparency during the SolarWinds breach, publicly disclosing the compromise of FireEye and helping uncover one of the most significant cyber attacks in US history, impacting multiple federal agencies. Oversaw the four, oversaw the $5.4 billion acquisition of Mandian by Google, one of the largest cybersecurity deals ever, and led the company through integration as the CEO. Most recently, you are the founder of Armadon, a pioneering autonomous AI agents designed to identify and exploit vulnerabilities like nation-state attackers, backed by a record

• 11:39Shawn Ryan?

  $189.9 million raise from top-tier investors, including Incutel, the CIA's investment arm.

• 11:47Speaker 00

  That's right, they are in.

• 11:50Shawn Ryan?

  Why not?

• 11:52Speaker 00

  We're in America.

• 11:53Shawn Ryan?

  How was it working with Incutel?

• 11:55Speaker 00

  Why not? You know, I, I, when you get into offensive cyber, the cyber domain's been contested my whole life, your whole life, Sean, literally. I mean, it, it's something that people that are faceless, nameless, and have no risk and repercussions can rob people, hack people, extort people, steal information, and they can do it from 10,000 miles away, you know? And so when we started, you know, Armadon, the whole thing was we want to support the United States government. Like, the cyber domain is contested. That's at least when, when it is contested. During times of peace, it's contested. Imagine during a time of war, what it might look like, you know? So, um, yeah, getting Incutel involved, to me, it just felt like the right thing to do.

• 12:39Speaker 00

  You want to service the intelligence organizations and, and the military.

• 12:42Shawn Ryan?

  It makes sense. I'm, I am curious, so, because nobody's really come out and said that they have them as an investor.

• 12:49Speaker 00

  I don't think we did. I don't know how you knew that. It wasn't the first one I would have listed. Because now, you know, you try to do business in Germany, they're gonna be like, oh, the US government's in, inside of Armadon. They're not. It's just, you want to support the warfighter, you want to support our intelligence agencies, and you want to believe, you know, America can be the beacon on the hill still, so.

• 13:08Shawn Ryan?

  Do they have any specific stipulations that they want insight into your company that other, that other venture capital firms are not gonna, are not gonna have access to?

• 13:18Speaker 00

  Well, you know, it's funny that we're talking Incutel, because the latest Dan Brown book, Incutel are the bad guys.

• 13:25Shawn Ryan?

  No shit.

• 13:26Speaker 00

  True story. They're the bad guys somehow. It's been my career, like, I'm biased. I believe in the institutions of the US government. You know, I served in the military. People can, people can, every institution can have its downsides and upsides, but you look at the missions of what we try to do, we try to do the right thing, you know? And, uh, it's the fastest way to bring capability to the intelligence agencies and to the military is, is through Incutel sometimes. And I believe in what we're doing, uh, and I want to make sure the American warfighter has the advantage in the cyber domain. That's simple. Do they have covenants? I'm sure they do. You know, did I sit here and memorize them for your show? No. I do know they, you know, they'll attend the board meetings when we have them.

• 14:09Speaker 00

  And as an entrepreneur, uh, you'll learn, if you haven't yet, man, board meetings can be long. And, uh, and I've been the operator at board meetings. I'm trying to push these things off as long as I can, you know? Let's start them when, when finally, we will start board meetings. That's the problem. I, I was unfunded the first time, so I didn't have board meetings for the first seven years of Mandian. But now I've done funding and I'm like, should I be doing a board meeting yet? And I'm just gonna sit quietly. Now someone will listen to the show and say, okay, Mandy, I have a board meeting. I'm not gonna really schedule them until someone's begging for them, you know? But I'm sure Incutel will show up and, uh, and the others will show up. But we are so early on. What's the value in a board meeting?

• 14:51Shawn Ryan?

  Yeah.

• 14:52Speaker 00

  You know, it's, it's, uh, they think there's value. What are you doing with their money? Uh, for me, it's let us prove ourselves and, and let's get some things done first. So I'm not sure I need a 90-day cadence yet.

• 15:03Shawn Ryan?

  Right on.

• 15:04Speaker 00

  Although I probably just spoke my mind and I'll have one in two weeks now.

• 15:09Shawn Ryan?

  Yeah.

• 15:12Shawn Ryan?

  I've been using Ridge for a while, and what I like about them is they take everyday gear and make it cleaner, tougher, and more functional. Wallets, power banks, luggage, travel gear, all the stuff you actually carry and use. In fact, their power banks, I just got three charges off one bank at the airport. Amazing. And now Ridge is back with their annual sweepstakes for the sixth year, and this one is insane. Two winners get to choose between a Lamborghini Uracan Storato, a Hennessy Velociraptor, a custom Ford Bronco, or $100,000 in cash. I'd probably take the Velociraptor. It's got 558 horsepower, twin-turbo, and it's basically American muscle built into an all-terrain

• 15:57Shawn Ryan?

  truck. That's a hard one to pass up. Even if you don't win, Ridge is still worth checking out. Their power bank has built-in cables, wireless charging, MagSafe compatibility, and enough power for up to three full phone charges. Their wallets are slim, durable, and built for everyday carry. Ready to upgrade your wallet and maybe your ride? For a limited time only, head to ridge.com and use code SRS at checkout for 10% off your order and a chance to win Ridge's biggest sweepstakes ever. A Lamborghini Uracan Storato, a Hennessy Velociraptor, a Ford Bronco, or $100,000 in cash. No purchase necessary to enter, but every dollar you spend gets you more entries. That's ridge.com and use code SRS.

• 16:42Shawn Ryan?

  After you purchase, they'll ask you where you heard about them. Please support our show and tell them our show sent you.

• 16:51Shawn Ryan?

  As you guys know, once upon a time, I was a Navy SEAL, and then I contracted for CIA. We were hunting ISIS, Taliban terrorist organizations. China was there, Russia was there, the Iranians were there, and everybody's kind of collecting on each other. One thing I learned is how important encryption in protecting your data is. That experience has just always made me extremely paranoid about what's being sucked out of my phone, what information are people getting? I wanted something that could protect everybody. And so we turned it into an application. We call it the Glacier App. We have secure DNS. Now, what's secure DNS? Well, very simply put, secure DNS keeps your phone from being exploited while you're browsing the internet.

• 17:36Shawn Ryan?

  Just a couple of buttons, your phone's protected, you got yourself a burner number or more. You hit connect, done. You're protected. This is like the real James Bond shit. MI6 CIA-level stuff made in the US. TheGlacierApp.com or just go on the App Store and look up the Glacier App. Take your privacy back. Download Glacier today.

• 18:06Shawn Ryan?

  Well, uh, before we get too into the weeds here, this is gonna be a fascinating interview. I don't think anybody can make cyber as exciting as you can. And with your backstory.

• 18:16Speaker 00

  Yeah.

• 18:17Shawn Ryan?

  Wow. But, uh, everybody gets a gift.

• 18:19Speaker 00

  Oh, thanks.

• 18:20Shawn Ryan?

  And we got you a couple.

• 18:21Speaker 00

  Thank you.

• 18:22Shawn Ryan?

  Oh, thank you. Those are Vigilance League gummy bears made in the USA. Legal in all 50 states. Not that you have to worry about that being out in Cali, but.

• 18:31Speaker 00

  And I'm the guy that, true story, it's in South Hall right now in the hotel. There's a little white bag on my table with your gift in it. So, uh, I'm gonna send you something as well. And I apologize, I didn't bring it with me. I was so eager to get here. I ran out to the car without it.

• 18:44Shawn Ryan?

  No sweat. I got you one other thing too.

• 18:46Speaker 00

  Okay.

• 18:47Shawn Ryan?

  This is the most exciting one. So.

• 18:50Speaker 00

  There you go.

• 18:51Shawn Ryan?

  Yes. So that is, that's just an iPhone.

• 18:55Speaker 00

  Yeah.

• 18:55Shawn Ryan?

  But that is, that has our new application in there. So.

• 19:01Shawn Ryan?

  I got really paranoid through some of the interviews that I've been doing.

• 19:04Speaker 00

  This for me?

• 19:05Shawn Ryan?

  This for you. I want, I want your honest feedback on that. So.

• 19:10Speaker 00

  You'll get it. Wow, thank you.

• 19:12Shawn Ryan?

  So I'll give you the backstory. So I started getting paranoid about a lot of the people that I'm connected with.

• 19:18Speaker 00

  Okay.

• 19:18Shawn Ryan?

  In the US, out of the US. Then we did an interview in Taiwan with Baoshi Kim.

• 19:23Speaker 00

  Okay.

• 19:24Shawn Ryan?

  You know all about China. We're gonna talk about it later. So. I started getting really paranoid and I wanted, I wanted about my.

• 19:31Speaker 00

  Right, right.

• 19:32Shawn Ryan?

  My email, about my texts, about, you know, my phone being secured. So I started asking a lot of the former buddies of my, or buddies of mine that were former intel guys, hey, what is the latest and greatest black phone? Um, and so I got pointed this company called Glacier.

• 19:50Speaker 00

  Okay, yeah.

• 19:50Shawn Ryan?

  And, um, so Glacier was started by a, a handful of former intel guys over at NSA. And so I got to talking with them. I got one of their phones and their phones are awesome. They, they secure VPN, all American VPN, secure DNS. They will upload and, and take away your footprint. So like when we went to Taiwan, they uploaded a false footprint, got rid of it when we got back home. Can re-upload it if we go back. So nothing looks fishy. Uh, and then they have, also they have, uh,

• 20:29Shawn Ryan?

  virtual numbers. So I talked to them a lot about how to disappear off the internet. And they basically said, hey, you, you have to, you need to keep that number, your real number sacred. So what we have here is.

• 20:41Speaker 00

  That's awesome.

• 20:42Shawn Ryan?

  You can put in.

• 20:42Speaker 00

  Proxy to it.

• 20:43Shawn Ryan?

  Any area code you want. It'll give you a list of burner numbers.

• 20:47Speaker 00

  It's got a great case.

• 20:48Shawn Ryan?

  Thank you.

• 20:50Speaker 00

  It's like bulletproof, right?

• 20:51Shawn Ryan?

  Well, so it was hard, but we got it on the iPhone.

• 20:54Speaker 00

  Nice.

• 20:54Shawn Ryan?

  And because nobody, nobody wants to use an Android. So that was a challenge.

• 21:01Speaker 00

  Yeah.

• 21:03Shawn Ryan?

  The device is extremely expensive. So, uh, when I talked about going into business with them, I said, hey, you know, this is really expensive, uh, for the everyday user, not only for the device, but for the subscription.

• 21:15Speaker 00

  Right.

• 21:16Shawn Ryan?

  As well. Uh, a lot of money. And so I said, what would be great is if we could, we could dub this down into an application that's a lot more consumer friendly. So we took everything, almost everything that Glacier has, put it into an app. And, uh, like I said, it's, it's, uh, it's a full blown security suite on your privacy app on your phone. But, uh, so I'd love your honest feedback.

• 21:40Speaker 00

  You'll get it. And it's weird. So now, one of the things I had to learn throughout my career is how to solve the read, write, store and delete data. What's the app really do? You know, so we'll end up kinda reversing it. We'll kind of try to figure that out. Um, but I think you're right to be paranoid. You know what I mean? It is a strange world where, you know, the digital exhaust we leave behind is way high, way higher than people think. Every time you browse the web, you know, whether you say, hey, I want cookies or don't want cookies, you're getting them. You know, we, we had a, a company come in and pitch us on a, we got a cookie tracker. And I'm like, you know, we didn't invest in it, but we went out and just tested their software during, you know, while the entrepreneur was pitching us on, hey, listen, this is, this is what happens.

• 22:25Speaker 00

  And we went to a medical site that everybody uses. And when we connected to it, Sean, of course we got the prompt, do you want to accept cookies or not? We're like, hell no. We got a bunch. We got over 900 cookies just by doing one search on one site about a specific disease. And those cookies come onto your hard drive. And then when you go to other sites, you're letting like a marketing company know, or you're letting a PR firm know, or in this case, we looked at all the cookies. And one of them was .ru. Like we were sending our IP address and the sites we were visiting to somewhere in Russia. And so this, this whole, yeah, like everybody, we have a whole generation, by the way, that's probably waiving the right to privacy by posting everything on, you know, Facebook,

• 23:09Speaker 00

  you know, Meta. And, um, but I, I get it. You know, it's right. It's like, if I had to give one privacy tip, use iOS devices, use, use Apple.

• 23:20Shawn Ryan?

  Really?

• 23:21Speaker 00

  Yeah, totally. You just, it's not, you, you, if you look at, by the way, simplest metric in the world on, hey, what's really secure? Look at the payouts. If somebody has a zero click exploit for the iOS phone. It's, in some places it's $20 million, you know, and Apple itself, I think you can get four to six million on the bug bounty program. Like if you find a zero click, someone just like, hey, that looks interesting. They don't touch anything. Um, iOS is hard to compromise and they really, anyone who's on offense and can compromise it, it'll probably be a modern nation and they're really coming after you. Um, but that doesn't mean it's undoable. So I love the fact that you picked iOS as the platform. I think that's right.

• 24:06Shawn Ryan?

  Thank you.

• 24:06Speaker 00

  Um, and, uh, and I think more and more people probably should think, where's my data going? Who's getting it?

• 24:15Shawn Ryan?

  Well, the, the other thing that I've actually can't believe, I forgot to mention is there's, there's data blocking. So everything getting sucked out of your phone is no longer getting sucked out with that application. So it's, uh, we'll put the link in the description for anybody that wants to check it out. But you just mentioned. So when I was researching you and we were, you were talking about the China, um, that was a section I was in, the China, uh, what is the six one?

• 24:43Speaker 00

  61398.

• 24:44Shawn Ryan?

  61398.

• 24:46Speaker 00

  61398, yeah.

• 24:46Shawn Ryan?

  And when I was researching that, you had mentioned that if anybody had done business in China, you're compromised.

• 24:52Speaker 00

  Pretty much.

• 24:53Shawn Ryan?

  Isn't Apple doing China, business with?

• 24:55Speaker 00

  Well, they probably were compromised in some way. The interesting thing about Apple, my whole career, Apple's never called and said, hey, man, can you respond to a breach here? So. And there's a couple, like, if I went through the whole Fortune 100, there might be eight of them that didn't hire us to respond to a breach and that's it. And Apple's one of them. And, and they've always, there's a couple of places, you know, Goldman's one, you know, they have usually homogenous networks, very similar, lots of tight controls. If anything does happen, they detect it quickly and respond quickly. Um, and, and Apple's always struck me as one of those companies that's pretty damn good at security, you know, I mean.

• 25:31Shawn Ryan?

  Good to hear.

• 25:32Speaker 00

  Yeah, it's, it's, it's just, there's something different about them. I mean, think about what they did with the iOS. They closed it. It's not like you can just write an app and do it. You've got to use their libraries, their APIs and publish it their way. You know, no one really jailbreaks the iOS phone to put whatever they want on it. So if you, for the most part, you almost have to hack yourself to hack your iPhone. You know, a window should pop up, hey, this software is unsafe. And you have to go, I'll take it, you know?

• 26:01Shawn Ryan?

  Gotcha.

• 26:01Speaker 00

  And hit it. So except for the, the rarest of cases is you're really targeted by like a foreign intelligence service. That's about the only way I think you're gonna see a phone get popped.

• 26:11Shawn Ryan?

  Okay.

• 26:12Speaker 00

  Yeah.

• 26:12Shawn Ryan?

  Okay.

• 26:13Speaker 00

  Which.

• 26:13Shawn Ryan?

  That's good to know.

• 26:14Speaker 00

  Yeah, no, it's a good selection. So.

• 26:17Shawn Ryan?

  Thank you.

• 26:17Speaker 00

  Thank you.

• 26:18Shawn Ryan?

  You nailed it. Right on. Well, let's, uh, so let's, I want to do a full blown life story.

• 26:22Speaker 00

  All right, I'm ready.

• 26:23Shawn Ryan?

  Where'd you grow up?

• 26:25Speaker 00

  Where'd I grow up? Formative years, Pittsburgh, Pennsylvania during like the crappiest decades of living in Pittsburgh.

• 26:31Speaker 00

  Yeah. We were winning Super Bowls. That's about the only thing we were winning.

• 26:34Shawn Ryan?

  Yeah, not a bad thing.

• 26:35Speaker 00

  Seventies and eighties, every steel mill closing down. You know, I still remember, uh,

• 26:42Speaker 00

  Probably nineteen eighty-three, eighty-four, coming home from school, my dad, I did, you know, dawned on me, my dad never sat at the kitchen table unless he was eating. And I came home from school one day and A, he was home, B, he was sitting at the kitchen table, and then it hit me, something's different, and he lost his job, you know what I mean? And I remember in an instant, you know, non-verbal communication could say it all sometimes, I instantly thought, man, he'd pick cancer over this, you know what I mean? And so Pittsburgh was a rough place to grow up, and I spent, you know, the late seventies and early eighties there, and then moved away from there and then went back to there. And I still remember when we left, I'd go, man, I don't ever want to go back there. And then three years later, my dad's like, hey, we're heading back. So anyway, formative years, Pittsburgh, great people, tough town.

• 27:26Speaker 00

  I think if you lived in Pittsburgh from nineteen seventy to nineteen eighty-five, all you saw is, you know, tough place. Damn. Probably like Detroit, you know what I mean? Sister city Detroit, I feel for that place. Yeah. What were you into as a kid? Football, right? It's Pittsburgh, you know, football, baseball, basketball. I was the youngest of four boys, I think that matters, you know, you got somebody, you got to live in, Alice Cooper fan, and your older brother, you know, you learn about rock music, you know, I was ten years younger than my oldest brother, so I got a real education on music early. Everybody played football, everybody, you know, it didn't matter where, you know, it's

• 28:06Speaker 00

  a, you go in the backyard and pummel each other, you had to, you know, so it was football, baseball, basketball, and then you go to entertainment, it was like Magnum P.I., Quincy, shows you probably don't know, I mean. Oh, no, I know Magnum P.I. You got Fresh Prince of Bel-Air, I got Quincy. The, but you get it, it was, you know, Pittsburgh was a black and white city, you know, you move away from that and you get to see color, but in Pittsburgh, what I meant by that, it's just, it was gray, it was, it was like, it felt like it was always winter, you know, and in hindsight, you don't know it till you leave it and look back on it, it was a depressed state, like, the people were all struggling, you know, period, you know, and I was in one of the nicer towns, but I think I was into sports, you know, and then I had a father

• 28:51Speaker 00

  who's, who's old school, right? Old school is, hey, son, get A's. What that meant is get A's or I'll kick your ass. Yeah. Get A's or. We had a similar upbringing. Life's gonna get real hard for you. I mean, I didn't, I didn't want to find out what the alternative was. I found out, wasn't great. Yeah. Well, you know it then, right? I mean, my dad had a set of rules that if you broke them, you did get hit, and it was fast, I always was like, how does this large man move so quickly, you know? But he was consistent about it, you know, and people are like, hey, corporal punishment is bad. For me, at the youngest of four boys, I think it was necessary in a way, you know what I mean?

• 29:31Speaker 00

  Like, we were probably gonna be pretty, my dad liked to order, quiet, clean, and I don't think you would get that naturally, without some enforcement, you know, and at the edge, as they say, and my dad had that, so I knew every time when I was gonna be disciplined, it never surprised me, other than how fast he could move to do it. And by the way, would've done no good to run, because that would've just made it worse, you know, you just gotta stand there and take, and it wasn't like he beat me, it was just, you know, he had a discipline to it. And so, you know, going back to the original question, what I was into was probably saying that every teenage boy in Pittsburgh was into sports, except I was a Vikings fan for some damn reason. Well, yeah, brought up. Figured that one out.

• 30:14Speaker 00

  So how did, how did you, were you into cybersecurity by the time you joined the Air Force? No, it didn't even exist, so I get in the Air Force in ninety-three, but, you know, I graduated college in ninety-two, and back then, there was a little bit of a lag, you know, we had the Clinton years, there was a lot of rifts going on, and you could do ROTC and never actually get orders, you know, so it was an interesting time for the military, it was time of peace for the most part, we had done Kuwait in the nine, you know, nineteen ninety, Desert Storm, so I graduated college in ninety-two, but I grew up, you know, I thought Magnum P.I. was cool, you know, he's former military, he was, you know, he solved cases, I always felt like you, you gotta have a mission bigger than self, you gotta, you know, want to contribute to society, and I grew up a forensic fan, I mentioned Quincy

• 30:58Speaker 00

  earlier, I used to watch Quincy going, hey, man, let's solve cases. I did computer science in college from eighty-eight to ninety-two, because I grew up with Pong, I still remember the first Pong game, Nintendo. Wow. In television, The Odyssey by Magnavox, like, I grew up with the whole Atari twenty-six-hundred, you grow up these games, and that kind of gets you into computers, so by the time nineteen eighty or nineteen eighty-one, I'm ten or eleven years old, my Christmas present was the TRS eighty color computer, like, other kids are asking for, I don't know, Stretch Armstrong and Rock'em Sock'em Robots, and I'm like, hey, man, can I get a computer? And my dad, my mom, my grandparents all pitched in and bought me like this seven-hundred-dollar

• 31:42Speaker 00

  Christmas present, which back then is like, are you kidding? That's like better than a car back then, actually, Sean, so in hindsight, I should probably be more thankful. So nineteen eighty, eighty-one, I get my first computer, and even though I'm playing football, baseball, basketball, running track, and out, just pummeling people, and I'd come in and be like, hey, man, I like this computer crap, you know, so I kind of grew up with the computer. I got computer science ROTC at a small school in Pennsylvania called Lafayette College, where I went all out, I took a pencil, filled out the common application, applied to one school, got in and went there, you know? There was none of this twenty schools, ten schools, I had like no plan B, I just applied

• 32:22Speaker 00

  to Lafayette, did ROTC at Lehigh, and did computer science, and I got stationed at the Pentagon in nineteen ninety-three. And the way I got into cybersecurity was, I got stationed at Pentagon with six second lieutenants, and, and we were all waiting in line to go in to see an O-six, a colonel, full-bird Air Force colonel, we were stationed at what was called the Seventh Communications Group, and we're all, you know, chicken shitting out in the hallway, who wants to go first, what do, what do people want to do? And I like to tell you, there's this elaborate plan for me to go into cybersecurity, but what really happened is I went first, I was like, I'll go meet the colonel, I'll go figure

• 33:03Speaker 00

  this crap out, so I just get first in line, and I go in, and the, and the O-six behind the desk gives me a, and literally, it was a whole thing, you go in, you know, stand at attention, go to at ease and, and wait, and he lays out five options for my next couple of years, here's what your assignment can be, so I actually had a choice, and all the choices were bad, and it was the weirdest thing, Sean, right at the end of it, I still remember it, he was like, oh, oh, and we have one slot left, one job left, to do computer security, that's what he called it, and I remember thinking all five options prior to that were horrible, like, it would've sentenced me to death, it was like job control language mainframe programming in the basement of the Pentagon.

• 33:47Speaker 00

  When he said there was one slot left, I'm a sucker for there's only one left, you know, and so I'm like, I'll take that, there's only one left, that's valuable, and, and, you know, in hindsight, I backed into new, you know, it ends up playing out very well, I loved forensics, I ended up getting a master's in forensic science at GW on my own time while serving, and computer security worked, like, immediately, I had this job doing computer security, and what it was is, who's accessing what? And about a year into me doing that job, it was nineteen ninety-three, the Air Force put eyes on the network for the first time, and for the first time ever, we started watching, what are people doing on the network?

• 34:29Speaker 00

  So I kind of got to grow up with computer security, you know, we started watching people, the Department of Energy created a tool called the Automated Security Incident Measurement Tool. Interesting. It's free, and we deployed it at the Pentagon, and for the first time ever, we could see, what are people doing, like, what files are they transferring, and what commands are they doing, and where are they logging into? And when we lit it up, right away, we recognized, wait, we're not the only ones on this network, you know what I mean? Who are these other people on it? And so by nineteen ninety-five, I cross-trained into the Air Force Office of Special Investigations from Computer Security to do computer intrusion investigations.

• 35:08Speaker 00

  The military was starting to use the internet, you know, from ninety-three onwards, so we had to start figuring out who the hell's on our networks and what the hell are they up to? Who was on the networks? First one I ran into was China, literally, go all the way back to, I think it was summer ninety-five, might've been summer ninety-six, one of those summers, we, you know, at that point, we had the Air Force Computer Emergency Response Team, the Air Force had one, I don't think the Army had one yet, I don't think the Navy had one yet, and then the government had one, called US CERT, out of Carnegie Mellon University in Pittsburgh, and.

• 35:48Speaker 00

  So maybe there's something in the water in Pittsburgh to get you into this stuff. But I, I remember there was a West Coast University. I'm in the Air Force Office of Special Investigations and our ASAM boxes showed something like 20 Air Force bases were logged into from one university. What the hell's going on? Like, no university should be logging into that many, you know, Wright-Patterson Air Force Base, Oak Ridge, Lawrence Livermore, Los Alamos. Oh, shit. Wright-Patterson, all of them. And they were, and, and so I flew out to the university and at that timeframe, I'm in the United States military, I go to this university and I'm like, do you mind if I monitor all traffic to and from this machine? Now, everybody's listening to this, it'll be like, the government watches everything. We really didn't.

• 36:34Speaker 00

  Back then, I had to brief the judge advocate general, hey, this is what I want to do. And to the Air Force's credit, if we did a, what we would call a wiretap, and there was nothing fruitful in it, oh, it got killed fast. Like, you had to have fruitful, real results. Or Jack was gonna be like, stop it, get out. There, there, there was a great control to not wantonly watch. But the university allowed consent. Still like that? Yeah, I don't know. You know, I often wonder if the military is the same as when I grew up, maybe a topic for later, because to me, but then it absolutely was. I remember going, man, I need to tap this because someone's coming from somewhere in the world into this system, and then from there to all these military installations.

• 37:18Speaker 00

  So I got consent to monitor, to the colleges or the universities' credit, they were like, yeah, go ahead and do it. And then I, I, the way I did taps back then, I just ran software on the machine itself. You know, it was, it was a Unix machine, and I watched all incoming traffic. And the first day, I'll never forget this, Sean, summer of 95, or 96 is when I was two. The very first day I did the tap, somebody was logging, this is how you go one hop back every time, like when some, if somebody hacked you, we'd only know the first, like IP address or first address they came from. But in computers, you can connect to connect to connect to connect, and they're called hop points. And everybody obfuscates where they're really sitting. If you're sitting in Russia and hacking, you know, the Pentagon, you're not going straight from .ru to Pentagon.

• 38:04Speaker 00

  You're going from .ru to the UK, to China, to, you know, wherever you want. How do you pick those? They compromise them first. Like, if you're on offense, you have a network that you use to launch your attacks, and for the most part, you almost have a team that maintains that compromised infrastructure for you. So if I'm a foreign intelligence service, I have a team that maintains access on all these intermittent sites, not my real targets, just sites like universities and businesses. And it's called a non-attributive network of victim machines. At least, this is how other nations do it against the United States. And then they have their operators use that infrastructure. And that's exactly what we ran into in this case.

• 38:47Speaker 00

  I do this tap at a West Coast university, the very first morning, I go in and like, download the files to look at what happened. Somebody came directly from Beijing into West Coast University, using the account of a Chinese foreign national that went to this college but had since graduated, and logged into 37 or so military installations. And each login was somewhat haunting. They use a user ID like S. Ryan, and then a passphrase. Then the next one, they would go to like Wright-Patt and go, John, J. Smith, and the right passphrase. They were validating accounts at all these different places, and I had the right choke point to see all the traffic. They, they came to this one machine, logged into Wright-Patt, logged out.

• 39:32Speaker 00

  Logged into Los, Oak Ridge, logged out. Logged into, you know, Los Alamos, logged out. Wright-Patt, keep going down the list. And they never fat fingered the passphrase, they got in every time. And I remember thinking, how do we fix this? Like, you can't, you call 37 bases, who do you call? They were hitting Army, they were hitting Air Force, they had, you know, the Marine Corps, they hit us all. I mean, just, just for the viewer context here, those are the most secure, secret military bases that the US has. Yeah, it's just the protocol. Just listed off there. Yeah, and it was just, it was the Defense Research and Engineering Network is essentially what these guys are in. And, and the unfortunate reality in hacking, or fortunate if you're the offense, like,

• 40:16Speaker 00

  if I break into the Pentagon, it's just a matter of time before I break into all the other military installations. If you break into an Ivy League school, you're gonna end up being able to hack all the Ivy Leagues, because that's just where the traffic goes, that's where the information is shared. And, and that's what happened here. I don't know where they originally broke into, but it was extensive. And that was in the 90s. So, and I remember, there was no one to call. Like, that case went on for like 10 years. I mean, it had code names and classified names, and it just kept going. There was nowhere, I was a first lieutenant at the time. I mean, what do I do? Call the base? Like, hello, operator, I need the cybersecurity guy. There wasn't, there was no way to remediate it, that simple.

• 41:00Speaker 00

  So instead, what we ended up doing is running an operation largely run by the military jointly with the FBI, and we did counterintelligence, we just watched it. And then we found the Russians. For me, every day, let's just shortcut, it is 2026, my first incident response is 1995, so it's been 31 years. I would say every day of my 31 years, we've been responding to an intrusion out of China, somewhere on the planet, here, every single day. And by the way, not just one, way more than that. So they have mass, they have just the scale that they can operate at, that's pretty, pretty high. And then probably, the Russian SVR had counter forensics earlier, so they would go dark on us.

• 41:45Speaker 00

  And back in my day, Sean, if I responded as an Air Force Special Agent, what was amazing to me, if I responded to Russia, every time we caught them, they just went away. They're like, ah, you got us, we're, we're gonna go away for now. And there was almost like rules of engagement. If they got caught spying, they just went away. And you can tell when someone's monitoring what you're doing, you can find the tools we use, or you can see that we're starting to remediate and clean up around you, or we shut off the account that you're using, or we change passphrases. And the Russians never let us observe them, period. From, literally, from 1995, 1996, anytime I responded to a Russian-based intrusion, they were super stealthy.

• 42:27Speaker 00

  That did change right around 2015, where they got louder, and probably they stretched their mission too much to do counter forensics and counter surveillance stuff. But they had a 20-year run where we'd, we'd have them in our sites and lose them, and I went years not finding them. Like, literally, we're like, we know they're out there, because that's their day job. You know what I mean? They're paid to hack us. You know, they show up every day, bad into a building and do it. But most of those cases probably got classified, and I was on the outside by then. But they were really hard to find. China was more like a tank through a cornfield. I mean, they were just like, they didn't care if we saw them. They didn't do counter forensics, they didn't change the data, they didn't extort, they didn't do anything, they just stole everything, you know? Who's, who, who do you think is better?

• 43:12Speaker 00

  It sounds like Russia's better at it. You know, for the vast majority of my 31 years responding, Russia was better. Better tradecraft? Yeah, their operators really didn't like getting caught, you know? And they just, here, here's an example. Like, I think China just had so many people, Sean. Like, I, I just said the other day, I knew a lot about religion, because I took art history. I feel like I know a lot about the Chinese culture, just by responding to intrusions. They definitely threw people at it. And here's an example. If, if a, if a Russian hacked your machine, what they would do is they would bring their own way to search your machine. They would hack your computer, then they'd upload a file that would search everything on your machine, looking for specific keywords, whatever they're after.

• 43:56Speaker 00

  Or they'd just grab your email. And even when they grabbed email, they would minimize it, they'd grab like the last month's worth, or something like that. They were always very precision strike. If a Chinese operator got on your machine, alphabetically, file by file and directory by directory, they'd look through your machine. Because they had, and I thought about it, they have human capital. There, there's eight hours in the day, there'd be an operator on a keyboard going, I'm on Sean's machine, let me just look at this file. And, and literally, they almost did it alphabetically. The second thing I noticed is, early in my career, the SVR would always steal, the Foreign Intelligence Service out of Russia, the SVR, would always steal specific files respondent to what they wanted. They were just real good at that. The Chinese would just compress a whole directory and steal it.

• 44:41Speaker 00

  Like, if you ever used like zip or something like that, they would say, oh, this directory called Documents looks interesting, I'm gonna take the whole thing. So I could actually tell who the operators were, just by the data theft. I'd be like, that was Russia, they took 32 files. That was China, they took three terabytes, you know, of everything. Because China would even steal operating system files that were the same on every machine. But it's just they had operators that would go, that was an interesting directory, I'll take everything in it. That was an interesting directory, I'll take everything there. I'm sure they had a unit that was more precise, more stealthy, every nation does, but China took front seat in 2020. You know, every year at the end of, so from 2004 to 2020.

• 45:25Speaker 00

  Five, I worked at Mandiant, you know, my company. And, and we, at the end of every year, I'd be like, hey, guys, brief me on the coolest cases we got. And for the most part, I got involved in those during the year. It was in 2020 where I saw the Chinese government break in using what's called a zero day attack. There's no patch to it. Similar to like when we were talking earlier about Stuxnet. Zero days are attacks that work against an application and you can't stop them. They will simply work. And the goal of a hacker is to get remote access to your machine. So I can be 10,000 miles away and get to your phone, or 10,000 miles away and get to your server or desktop. And then it's usually, I want your email. I want your files that you've created.

• 46:07Speaker 00

  I want reports that you're writing about our supreme leader, or whatever it might be. And in 2020, the most expensive offensive attack was done by China. They used multiple zero days to break into a defense industrial based company. And everything they did, they were special. Like, everything they did had to be custom crafted for that environment. And that is, in my whole career, that is very, very rare. And China did it. So I'd say China's number one now for scale, scope, and sophistication. And then China decided to get stealthy in 2020 as well. They weren't prior to that. They decided to, from a forensic standpoint, leave less fingerprints.

• 46:50Shawn Ryan?

  Wow.

• 46:52Speaker 00

  And Russia went the other way, by the way. Russia is now like, we found them, you know? And I think Russia, with conflict and everything, they're just operating at such a scale and scope that they can't, they don't have enough operators to clean up after themselves. It's very manual to clean up after yourself. It is not, it takes a human intelligence on a keyboard to say, I don't want to leave a trace on this machine, so I have to edit the log file, take myself out, you know? So the, the count of forensics of Russia is down a notch or two right now.

• 47:21Shawn Ryan?

  I mean, you were, you were tracking nation-state hackers before the majority of people even had email.

• 47:29Speaker 00

  Yeah, I think we were the first ones to do it.

• 47:31Shawn Ryan?

  What, when you walked into that, what would you, what was the program you were at? What was it called?

• 47:36Speaker 00

  Well, so I made it.

• 47:38Shawn Ryan?

  That's kind of where you get it.

• 47:40Speaker 00

  Yeah, yeah, yeah, so I had a master's.

• 47:41Shawn Ryan?

  You paved the way.

• 47:42Speaker 00

  Yeah, so I had a master's in forensic science, so you can think about all these intrusions I'm responding to are like crime scenes. Like, what are the fingerprints left behind by the intruders? Well, it's the malicious code they run. It's the commands they execute. It's the encryption algorithms they use. It's the type of files they steal. It's the type of targets they even compromise. And so with my forensic science background, I created a thing called an indicator of compromise. I, I, you know, I'd worked enough cases where we're like, we gotta call the fingerprint something. So the indicators, and then we started just bucketizing them. So we'd respond to company A and be like, oh, the attack came from here, they used this software. And as we bucketized or cataloged the evidence, we started just seeing the same people over and over. They used the same custom code to break in.

• 48:27Speaker 00

  Like, I'll give you a weird one. Like, if you break into, the two dominant operating systems are Unix-based operating systems, UNIX and Windows. And Mac is a Unix derivative. You know, in, in Windows, if you break in, you do what's called a directory command. I've broken in and I want to see what's on your hard drive. I'll do DIR and just kind of look at what's on there or not. And the Russians, when they break in, they do a directory listing of everything on your drive. And that's all they do. It's really smart. It's like great recon. They don't even poke around sometimes. They break in and go, just show me a map of everything on the machine. They download the map, and five days later, they come back and just take what they wanted. The Chinese would break in, show me everything, and then go through it alphabetically with

• 49:10Speaker 00

  a human, just sitting there 10,000 miles away, looking at every single file and doing it. So we even cataloged, in Unix, the DIR command is called ls for list. And we would catalog, did they do an ls-al option, or ls-la? Different operators typed it differently, and we could even get down to the speed at which they typed. I mean, we, we were tracking on a lot of cases, we, we had up to 650 criteria we had tracked, but only like 10 mattered. Long story made short, we just took the fingerprints of each group. And it turns out that Chinese did great training, and the Russians did great training, so they were actually really consistent. You know, the commands they typed.

• 49:54Speaker 00

  If you're a kid and you break into a machine, you just get undisciplined. You start going, I'll check out this directory, and then randomly this directory, and then randomly this, and I'll look over here, and I'll do this, and I'll, they're all over the place. It looks like a monkey shitfight at the zoo, right? And then you responded to SVR, and it's just all economics. They did a directory listing and left. That's it. Gone. Kids don't do that. Foreign intelligence services do that. Because they're gonna come back in after they've looked at the file listing, and just by names alone, they know what they want, or even the apps they want to steal. And at the time I started responding to intrusions in 95, we didn't export our supercomputers.

• 50:38Speaker 00

  So all our modeling and simulation of modern weapon systems were done on supercomputers. The Kray C90, the Origin 2000. The front nodes to all these supercomputers were what we would respond to. The Chinese and Russians would hack these things, and literally, they would run our modeling and simulation on our systems, but export the output all the way back to China and Russia. Isn't that amazing? So one of the first cases I ever did with Russia, they were literally running, they, they were stealing stuff, and they were running the modeling and simulation of a certain system we were creating, unclassified though, but they were exporting the display right to their desktop.

• 51:23Speaker 00

  So they were just sitting back watching, oh, there's the model, and this is how it looks. They were literally stealing it that way in 95. So, again, though, those fingerprints, that's just an example of fingerprints, the commands they type, how fast they type, the malware they use, who they target and how they operate. At my company, Mandiant, we started creating these dossiers, basically. And we were boring. We didn't know what the call, we didn't name the groups like, you know, this is Fluffy Snuggle Duck, and this group's called, you know, whatever, Bad Rabbit. We just called them managers. AP, Advanced Persistent Threat 1 was China. It actually was PL Unit 61398. And we just named them managers. And now we're up to, I don't know, 50 something.

• 52:05Speaker 00

  And that's where we have definite attribution, like, we can get you to the building they're coming out of, you know? So when we started this, we had maybe 40 groups in the first eight years that we had fingerprinted, only 40 different fingerprints for every cybercrime. Now we're in a, I don't know, 6,000?

• 52:22Shawn Ryan?

  How big was your team back then?

• 52:23Speaker 00

  Oh, by the time, I mean, it was one, me, and then we grew it to about 500.

• 52:29Shawn Ryan?

  One person for the whole country?

• 52:30Speaker 00

  Yeah, no, no, no, no, no. I, I started it, right? But we were about, by the time we're labeling groups, APT 1, 2, 3, we're 350, 350 people. All ex-government, like, at one point, Mandiant was 500 people. And I'd say 350 came from the US military.

• 52:48Shawn Ryan?

  I'm sorry, I meant, I meant.

• 52:50Speaker 00

  Oh, just the intel side?

• 52:51Shawn Ryan?

  The Air Force.

• 52:52Speaker 00

  Oh, in the Air Force?

• 52:53Shawn Ryan?

  When you were a special agent.

• 52:54Speaker 00

  When I was doing that, there was 13 of us. I think we doubled it to 26, yeah. It kept doubling, and, you know, cyber was new in, in 1995, when I was in the Air Force doing this. And so they kept doubling the teams. Now I bet it's hundreds and hundreds. Like, if, if you're a special agent in the FBI today, and you're not digitally, forensically educated, you're not very useful. I mean, you have to know how networks function, how, every case has digital evidence now. Counterintelligence, crime, espionage, all of it, period. But when I started doing this, there was like the computer-aware agent and the non-technical, non-computer-aware agent. I think that one's almost obsolete at this point, you know?

• 53:37Speaker 00

  Unless you're a great accountant, or you speak 20 languages, I don't know how you can be an agent today investigating anything without understanding digital forensics, you know? So, small team, 13, 14 of us, massively grew even while I was doing it. We were called computer crime investigators. And we did the, and, and the FBI had a thing called the CART team. I don't even remember what that stands for, but it was like computer forensic stuff. And all I can tell you is we're always, no matter what, it was almost like we had a sticking line where we're always six months behind. No matter what the case was, we were six months behind on the forensics. You know, it was like, uh, because it was real hard to keep up with all the digital evidence piling up, so.

• 54:18Shawn Ryan?

  Here at Sean Ryan Show, we cover subjects that get complicated fast. Intelligence, war, technology, and when you're dealing with topics like that, the hard part isn't just finding information, it's making sense of it all. That's why we use Claude. Claude helps us take a messy topic and start connecting the pieces. Timelines, contradictions, different angles, follow-up questions, things we may have missed. It helps us slow down the research process and think more clearly before we ever sit down for an interview. And we use it across the show. Episode prep, research, strategy, and even our hot question segment. It's become one of those tools that helps sharpen the work behind the scenes. Claude is the AI for minds that don't stop at good enough.

• 55:03Shawn Ryan?

  It's the collaborator that actually understands your entire workflow and thinks with you. Whether you're debugging code at midnight or strategizing your next business move, Claude extends your thinking to tackle the problems that matter. And with features like deep research and connectors, Claude can help pull context together from the tools you already use and turn complicated information into something that you can actually work with. Companies like Stripe and Shopify trust Anthropic with the rollout of AI in their businesses. For problems worth solving, get started with Claude at claude.ai/srs.

• 55:42Shawn Ryan?

  That's claude.ai/srs and check out Claude Pro, which includes access to all the features mentioned in today's episode. Claude.ai/srs.

• 55:57Shawn Ryan?

  Let's talk about, if we're, if we're ready for this, let's talk about exposing China, the APT one report. February 2013 released a 76-page report publicly naming PLA unit 61398, operating from a 12-story building in Shanghai's Pudong District.

• 56:19Speaker 00

  Yeah.

• 56:19Shawn Ryan?

  As the source of espionage against 141 US organizations across 20 industries unprecedented.

• 56:27Speaker 00

  Yeah.

• 56:27Shawn Ryan?

  Stole technology blueprints, manufacturing processes, test results, business plans, and executives' contacts list.

• 56:35Speaker 00

  Yeah.

• 56:38Shawn Ryan?

  How did you, I mean, huh?

• 56:42Speaker 00

  Well, this is, yeah.

• 56:44Shawn Ryan?

  This is all you.

• 56:46Speaker 00

  Yeah, but I think the government knew, you know? So this was 2013. The backstory on that is I start Mandiant in 2004, and I had a premise, let's respond to every breach that matters. Because in the cyber domain, prior to Mandiant, here was the intelligence model in cyber. It was McAfee and Symantec antivirus. You've probably heard of them, right? McAfee and Symantec. You'd run antivirus on your machine. If antivirus missed a bad file, a malicious file that was stealing your stuff, the only way Symantec and McAfee got smarter is you would be like, hey, man, you missed this malware, so I'm going to submit it to you so that you can detect it next time. Well, here's the problem. My mother's never going to find malware on her system, and Sean, you're never going

• 57:31Speaker 00

  to find it either unless you read an 800-page book I wrote that would bore the hell out of you. You know, it's hard to find this crap. It's ridiculous. So I decided we need a new intelligence model in the cyber. Let's learn from all the, all the red teams out there, the offense from Russia, China, the criminal element, North Korea. Let's respond to every breach that matters and learn from it and build the defenses. Because I thought antivirus and, I hate to say it, thinking Symantec and McAfee was securing you at that time was like believing in the Easter Bunny. I mean, it literally was so easy to evade. I was actually talking to one of your guys earlier, and we were talking about, he even

• 58:11Speaker 00

  experimented with offensive cyber and could evade AV, because all you had to do is encrypt or compress your executable, put it on your machine, and when it executed, it would decrypt itself, meaning it had no signature. So AV would miss it. So long story made short, we needed a new model in cyber. How do we build better defense? Well, let's actually get in the ring with the offense. Look at what the hell they're doing. So I think I was the first company ever started with, we're going to respond to every breach that matters. And I got to be honest with you, I didn't know if breaches would go on forever, but what I've, but I had that phrase, I think I made my first website, and you're an entrepreneur, so you know, there is no website team.

• 58:52Speaker 00

  I had to make my own website back in 2004, and I literally wrote on the website, the first phrase was, you cannot solely rely on preventive measures, and that was boring, so I went with, security breaches are inevitable. No one believed it. I think the only reason Mandiant was successful is out of premise, security breaches are inevitable. We'll respond to everyone that happens so that we can build a better defense against them. First knowledge, first mover knowledge on what the bad guys are really doing to circumvent defense. Nobody believed that premise, so we had no competition. So every damn major breach, my phone rang, I still don't know how the hell my number got out there, but we had to be good at it, and then everybody recommended us, and breaches took off.

• 59:37Speaker 00

  In 2004, when I started a company, every election year, both sides have a problem. I can tell you that right now. So in 2004, you get to respond, if you respond to Pepsi, you don't respond to Coke. If you, if you respond at the RNC, you don't respond at the DNC. But those things are heavily targeted. But in 2004, when I started Mandiant, right in the summer of 2004, we were only like, I started the company in February. By June or July, we're nine people in a basement in Old Town Alexandria, and we get a phone call from the defense industrial base, and we couldn't respond to it. We're already fully pegged responding to a breach somewhere else, because it was an election year. But it was Honeywell.

• 1:00:20Speaker 00

  And I guess I can say that now, because that was 22 years ago. They were the first ones I saw where the Chinese government that I was responding to in dot mil, the military, just went, I'm going to shoot the headlight over here and hit Honeywell now. Then they go through the whole dip. They go after Lockheed Martin, they go after Boeing, they go after Rolls Royce, they go after UTX and Raytheon. And it was considered fair game.

• 1:00:44Shawn Ryan?

  All of them?

• 1:00:46Speaker 00

  Well, you know, they'll, they are heavily attacked in the cyber domain every day by China.

• 1:00:51Shawn Ryan?

  Holy shit.

• 1:00:53Speaker 00

  Your defense contractor are coming for you. And, and these companies have, like, it's funny, people would be like, man, the banks have great security. Well, in cyber, the best security I ever saw at one point in time was Lockheed Martin. I mean, what they did on defense was, I mean, all the defense contractors, trust me, they do everything they can to secure their stuff. But they also have these joint projects that are, you know, a bunch of mad professors getting together. But in 2004, 2005, I saw the military of China suddenly expand scope and go after our defense industrial base. And that was right when Mandiant started. So all those companies hired us, and we would respond. And I remember I would brief, hey, this is a guy in Beijing doing this, and, or, you know?

• 1:01:40Speaker 00

  It was the beginning of it. You know, that's when we realized China's all over our networks. I guess I always knew it. Dot mil, dot mil felt fair game. I think nobody really expected them in China to suddenly say, hey, let's hit dot com. And then they went way down dot com. They, like, if you're a law firm, if you were, if you were an accounting firm, if you were doing business in China in any capacity, they had guys in uniform hack you. So they don't separate economic dominance from military dominance in China, probably. You know, they hack, we would hack on offense as a country for security purposes and defense purposes. China hacks for economics. So, and then since then, Sean, everything went public.

• 1:02:23Speaker 00

  General Alexander, when he was running the NSA, largest theft of IP in human history. You know, to the credit, Chinese didn't damage anything. They didn't delete stuff. In my whole career of responding to the Chinese threat actor, I only saw like one operator delete the logs once. You know what I mean? They leave everything there, but they got way more surreptitious lately. So, yeah, and since 1995 till now, China's heavily targeted our defense industrial base.

• 1:02:51Shawn Ryan?

  But what, what are you thinking when you figure out that the CCP is hacking into our defense tech companies, our, like, Lockheed, Raytheon, like, these are, these are the companies that hold the keys?

• 1:03:06Speaker 00

  Well, I think, you know, a lot of folks think when a nation targets you, you should be able to withstand it. But I've always thought, like, the analogy, I'll use this one, you are a SEAL. If a SEAL wants to rob the Lego store at the mall, they're going to evade Paul Blart, the mall cop, and rob the store. You know what I mean? No problem. When you have the Chinese government trying to hack you and you're a company, you will lose over time. There is nothing, I don't think it's reasonable for the American people to think any company can withstand a foreign intelligence service trying to break in in cyber domain. It's not. And, and so I remember early on, every victim company wouldn't tell anybody, you know?

• 1:03:48Speaker 00

  But it became, because you'd get, you'd say it, and then you'd have pundits on the hill go, hey, what a irresponsibility to let the Chinese hack you. Are you kidding? It's like your grandmother in an ultimate fighting championship. It's simply an unfair fight, and it still is today. Even for the companies that do everything they can in cybersecurity, you really don't want to come under the lens of the SVR and, and, and the MSS when they decide to go on offense. It's, it's a, it's a tough thing to do. So, so what? Yeah, so we had like eight, that's why we went public in 2013. I mean, I just told you in 2004, the first company I saw China go, hey, we're going after was Honeywell. And I just, I hate saying that out loud, I don't know if I've ever said that publicly, but with this amount of separation, they can live with it.

• 1:04:33Speaker 00

  They, and you just go, man, you know, the thermostat company, but they also made, you know, helicopters and dashboards, and they're a defense contractor. But they all had the Chinese come for them, and, and it's, it's a sucker punch. At that timeframe, there was no, actually, true story, Sean, there was no defense for how China was breaking in back then. It didn't exist. We had no software to detect it, really. You could just log in, you could just do things. There was no reasonable way to defend yourself in the cyber domain against the nation back then.

• 1:05:07Shawn Ryan?

  Shit.

• 1:05:08Speaker 00

  Yeah.

• 1:05:09Shawn Ryan?

  I mean, that's

• 1:05:12Speaker 00

  Yeah.

• 1:05:12Shawn Ryan?

  Pretty fucking scary.

• 1:05:14Speaker 00

  Just dawned on me just now.

• 1:05:16Shawn Ryan?

  Yeah.

• 1:05:16Speaker 00

  You know what I mean?

• 1:05:17Shawn Ryan?

  Well, what dawned on you back then when you saw it happening?

• 1:05:21Speaker 00

  Back then, you're more tactical, yeah, you know. Well, that's why we went public, you know, we had Mike Rogers, Congressman from Michigan, we had a Congressman from Maryland. They wanted to do, they wanted to make it so you could share when you've been compromised. Like, stop like hiding the fact that we're all in this together. They wanted to have more of team ball, like Team America. Uh, so we decided, let's help the US government with like some information sharing that when you're hacked and you know it, you can share that information and not get condemned by the government for doing it. You know, you kind of got a safe harbor. And so we, we recognized two things, kind of, there's like eight reasons why we went public with this report. I'll give you three of them.

• 1:06:04Speaker 00

  First, Mandian at the time were a bunch of ex-US soldiers. And we were like, screw China for doing this, you know what I mean? So I wasn't going to be able to stop going public. Our, my team wrote this, I was just a face on it. But we knew it was China from 2004 onwards. So it took us nine years before we finally just said, hey, man, let's just tell the world what the hell is going on here. Second, um, you could feel the governments, the government knew about this. But they didn't know what to do about it. And at least, you know, the House Intelligence Committee was like, let's pass a law that allows people to share information so we can defend each other. Um, and then the third thing was the CEOs were like, what the hell? You know, I would sit down with the CEOs of these companies and they're like, we're doing a joint project with China. Why the hell are they hacking and stealing all this crap?

• 1:06:48Speaker 00

  And, and, you know, the companies knew, hey, it's on us to defend ourselves. But they also, at some point in time, I remember thinking, hopefully, maybe if we just bring it up, the heads of state would actually come up with, hey, let's, let's knock this crap off. You can hack us for espionage, but don't hack, you know, Disney, because they're trying to open Disney China. Or don't hack, you know, whatever, a soft drink company or somebody else, because they're trying to do some bottling in China. It, it was, it was time to have dialogue. So we did go live in 2013 and, and do that. It just so happens that, um, the day that Obama was going to meet with Xi Jinping to talk about some cyber stuff in optimistic sounding Sunnyland, California in 2013, uh, that was when Snowden leaked.

• 1:07:34Speaker 00

  And that stole the show. So I, I've never, you know, I've always believed since 2004, when I first started responding as a private company to these intrusions, that neither China nor the United States really wants a whole cyber conflict. You know what I mean? Neither nation really wants it. And that, at least that's two nations that can come to the table and probably have a, a dialogue and come up with rules of engagement. I don't know if you can do that with Russia, too much criminal element. I don't think you can do that with North Korea, and I don't think you can do with Iran. But China is the one place where I've seen them follow rules. We have to infer the rules, Sean, when we respond. But China follows rules and etiquette when they hack still. Their operators are predictable.

• 1:08:17Shawn Ryan?

  Interesting.

• 1:08:20Shawn Ryan?

  What kind of stuff did they steal?

• 1:08:23Speaker 00

  It, it would be hard to say what they didn't. You know, that's the reality. And that's why General Alexander, you read the testimony from the director of the NSA, largest IP theft in history. Admiral Rogers, after him, General Nakasone, all of them kind of allude to China's kind of taken a ton. Now, there was a dialogue after that report. Here's what's amazing. At Mandian, what we were doing is we were kind of monitoring victim networks, meaning we saw traffic coming in and out with consent. And the whole defense industrial base was working together by then. They started a whole consortium where Raytheon and Lockheed and Boeing, they all worked together to figure out what's China doing? How do we thwart this? So they do play team ball now, and it's actually pretty organized.

• 1:09:05Speaker 00

  Um, but I remember, uh, at the time going, we're seeing over 70 companies a month compromised by China right now. Just in our little network of watching what they do. After we went public with that report, it went down to zero for a while. So I think they noticed, we changed behavior. Or some say, well, maybe you just lost vision on them. Because when we wrote that report, one of the things we didn't kind of say in the report is we provided that trace evidence, the fingerprints. We provided over 5,000 fingerprints of this is their infrastructure, they're using to hack us. This is the malware they're using. So all the defense companies that make software to stop it, we could just stop them.

• 1:09:46Speaker 00

  So we kind of burned their infrastructure, we burned their methods, their TTPs or tools, tactics and procedures were fried. So we fried it. So they had to go away anyway and recreate all that stuff. Um, but again, going from anywhere from 10 to 70 companies hacked a month, just in what we could see. And I could tell we probably saw less than 1% of what they were doing. Um, we'll never know, did we see 80% or 2%? It was probably closer to 2, down to zero for a few months, and then it starts creeping back up again.

• 1:10:16Shawn Ryan?

  Just for the audience, can you, can you elaborate on some of the stuff that you thought was most concerning that they got? They, they hacked access into?

• 1:10:26Speaker 00

  Uh, flag officer's email. I always hated that stuff, you know, because you get to see what contracts matter, what weapon systems matter. I, I'd never read those emails, you know, I didn't want to know, you know? But when you see a communication of a high level official get stolen, I've always felt, oh, man. Like, there's unvarnished truth in that, period. Like, no matter what we're trying to posture publicly, you really, you've got the, the backdoor story in China as to what we're thinking and how we're going to arbitrate. And I think, I, I just, that was the first, the first time I ever saw, and it was in the mid 90s, that China got flag officer's email. Just instinctively, I went, man, that's bad. First off, the good news, most flag officers didn't really use email back then. But what did you put in it?

• 1:11:11Speaker 00

  You thought it was private, you know, and I just felt, I didn't like that.

• 1:11:15Shawn Ryan?

  Like Cypernet email?

• 1:11:16Speaker 00

  No, no, I've never seen a Cypernet breach, you know? Not, not, that's got to be physical separation. I've heard rumors of it, I've never been involved in one, and I don't know, I don't, I personally don't think it's happened, but probably a physical security issue if there's a Cypernet breach, someone got to a Cypernet terminal, you know?

• 1:11:33Shawn Ryan?

  Did they get blueprints to weapons?

• 1:11:36Speaker 00

  Yeah, the, the problem we've got as a nation is we're so damn open, you know? In academia, everything that becomes classified somewhere was unclassified first, for the most part, you know? How it's used and who's using it and where they're using it, usually it's classified. But we have this, you know, you look at University of Illinois or Bona Champaign, LSU, Penn State, all these great American universities, Harvard, MIT, I can name them all. Almost all them, Berkeley, they're all doing work with the government. And you, you want to, like, the easiest thing to compromise on offense is a university, period. So go do it. And go look at the programs and, uh, you're probably, I mean, I'm given the playbook, but the, the Chinese already knew the playbook.

• 1:12:21Speaker 00

  Um, the students, I mean, we have a bunch of Chinese foreign nationals at the schools, that's the challenge. And, you know, somebody once came to me, Sean, and they said, hey, man, if you were working at a company in another country, and Uncle Sam came to you and said, can you just take this for us? Would you do it? I went, yeah, you know, I'll do that for Uncle Sam, I'll do that for US government. You know, so now I'm unemployable at any foreign company. That's what's happening here, you know, with all the, you know, we, we went with this global economy. We said, come work here and we'll take your best and brightest. The problem is, where are their families? And, and, and, uh, and who are they truly loyal to? So I actually felt, man, you know, the compromises occurred, because you can do it from 10,000 miles away, and there's no risk to it.

• 1:13:04Speaker 00

  But I actually felt, and I remember for years, working with the defense industrial base, we always thought to ourselves, if we lock down the cyber door, are we just going to have an HR problem? Are we going to be hiring the scientist that steals everything? And most people would rather have a cyber problem than personnel working at their company stealing their stuff, you know? So it's a tough, man, when you're heavily targeted, like the DIB is, defense industrial bases, it's a, it's a complex place to secure.

• 1:13:32Shawn Ryan?

  Wow. Looks like at that timeframe, IP theft by China was an estimated 300 billion and 1.2 million American jobs per year.

• 1:13:44Speaker 00

  Impacted?

• 1:13:45Shawn Ryan?

  Yeah.

• 1:13:46Speaker 00

  Yeah, I mean, there, there's no question, like, like they want in, uh, in solar power, right? Do you think they hacked the solar power companies? Probably, probably every damn one of them. Um, you know, everybody makes fun of, you know, the space shuttles all look the same. Well, how did they get it? You know? The least risky way to spy? Cyber.

• 1:14:06Shawn Ryan?

  Period.

• 1:14:07Speaker 00

  And probably the most comprehensive. Because when you spy, you want comms, you want the communication, right? Did they ever, China ever?

• 1:14:17Shawn Ryan?

  Confirm that they did it?

• 1:14:19Speaker 00

  No, when we went live, certain quotes you remember your whole life. I'll probably get this one wrong. But when we went live, you know, we went live because we did that report in conjunction with the New York Times, by the way, deciding that they were going to go live because they had their reporters compromised. They had a reporter named Mike Barbosa from China, and the Chinese were stealing his email. And, you know, when we wrote that report, by the way, I remember it was like a movie in a way. I remember getting on the phone with David Sanger, who wrote the article for New York Times. But all of our press were compromised. They were going after Washington Post. They were going after New York Times. They were going at the USA Today. They were going after all the press because China wants to see what are you going to publish about us before you

• 1:15:03Speaker 00

  publish it? I don't know why, but they do that, especially if you have a bureau in China. And I just remember getting on a call, and on the other side, it's like, hey, it's Barbosa, you know? And the New York Times wanted to verify PLA unit 61398. So we gave them an address. And I think Barbosa went and checked it out and went, oh, man, it's like a whole bunch of noodle shops. And then there's this NSA looking thing with antenna everywhere right in the middle of them all, and a bunch of dudes in uniform going in every day. We had it right because we used Google Earth, Sean. We saw the building get built. Isn't that insane? We just watched it grow, you know, on Google. And we went, okay, that's where they're doing it from. We figured it out.

• 1:15:41Shawn Ryan?

  Are you shitting me?

• 1:15:42Speaker 00

  No, we we figured it out in a couple ways. Every once in, and you got to look every day to find it because a lot of evidence will pop up and disappear. We were finding resumes by Chinese students that were transferring schools or going for jobs. We had Mandarin speaking folks who would translate these resumes. This was before you could just use Google translator and just read everything in English. So we had to hire our own translators, and we were translating resumes. And we kept hearing about this PLA unit 61398, what people did there. And when you read the bullets, you know, you transferred from Chinese character set to English, it was basically like, you know, we hack for a living. We get our orders, and we hack those companies. That was it. And we had, we, we knew where they were.

• 1:16:25Speaker 00

  But the New York Times went public at the same timeframe about their compromise. And they were the first ones, really one of the first victims. Google was another first victim. Google's so big, when they were hacked by China, they just told everybody. And they actually withdrew doing business in China. They were just like, eh, this isn't worth it, you know? Because China does have to learn about the Chinese dissidents here and what they're doing. So bottom line, you know, whenever there's ideological conflict, you're going to see cyber activity. And we have plenty of that right now.

• 1:16:55Shawn Ryan?

  Wow, wow. You know, speaking of China, are you familiar with Polymarket?

• 1:17:01Speaker 00

  Oh, yeah, yeah.

• 1:17:03Shawn Ryan?

  Speaking of China, people on Polymarket say there is a 93% chance that China will not invade Taiwan by the end of 2026. Only 7% say that they will. What do you think? They've been talking about this for a while. I think their deadline's 2027, right?

• 1:17:23Speaker 00

  Yeah, I think that's, that's what people say. You know, to me, and this is Kevin Mandy anecdotal, you know, dad from California thinking about it, unofficial, I don't think they need to invade it. I think just population growth alone, you never know the will of a nation. Like, Ukraine surprised me how hard they're fighting back. You know, I didn't go over to Ukraine. I didn't know the Ukrainian people. I didn't know their will to be independent. I didn't know if they had a leadership for it. And I think like many Americans, when the invasion happened in, in, what, February 22, I remember thinking, well, that's going to take three days. And look where we're at, right? I mean, this is unbelievable. But then I apply that. I don't know what Taiwan would do either. But it's, it's different.

• 1:18:08Speaker 00

  It just feels like we never acknowledged it as a standalone nation, you know? I think no one really recognizes.

• 1:18:14Shawn Ryan?

  There's only 12 countries in the world that

• 1:18:16Speaker 00

  Yeah, I recognize.

• 1:18:17Shawn Ryan?

  that recognize it as its own nation.

• 1:18:19Speaker 00

  And so think about it culturally, how tight it is, you know? And then I think population wise, I've always just guessed, Sean, like, like, look at Singapore, like, I think it's 30 to 40% Chinese foreign nationals. Like, how long's it survive? You just look at population growth. At what point is, is there just a majority? So I think China could just win. Everybody says the population in China is going down. I'd be fascinated if we looked globally, is the population of the Chinese culture going down? I doubt it. So I just think that that's a tough one. I don't know I'm the wrong guy to ask. I just go on God alone, they might be winning without having to fight.

• 1:18:56Shawn Ryan?

  See, that's what I went over there. They have this thing, I mean, cognitive warfare seems to be the thing that the Taiwanese are most concerned about.

• 1:19:04Speaker 00

  Yeah.

• 1:19:05Shawn Ryan?

  It'd be, I'd be basically, in a nutshell, it's a psyop to convince the Taiwanese people that they, they still belong to China.

• 1:19:12Speaker 00

  Well, and then I just don't know throughout history, have they been offensive and warlike? You know what I mean? I just, I think they probably win through, if they, everybody says that their culture has a longer term view of things. Okay. Well, the longer term view is over time, we'll just win Taiwan over ideologically.

• 1:19:30Shawn Ryan?

  That's kind of what I'm getting at.

• 1:19:32Speaker 00

  Yeah, there's a reason why it's 93%.

• 1:19:34Shawn Ryan?

  Vote their way out of it.

• 1:19:35Speaker 00

  They don't need to go to, I think they're winning. So it's like, if you're going like this up into the right, why go to war? It's heading in the direction you want. That's just my gut, though. And I haven't read enough on it, and I should. But I even looked at, you know, I was very interested in our war, or whatever we're calling it with Iran, you know, what would China's response be? And it just doesn't seem very aggressive. It's almost like, hey, whatever's happened, and it's happened. They feel like they're not even in the scene. They're off, they've exited stage left for now. And I just feel like a country that's prepping for war might want to exert a little more muscle than that.

• 1:20:13Shawn Ryan?

  Hmm. You think they're standing up? I mean, what do you think they're? I think they're standing up because I think they're hoping that the petrodollar turns into the petron UN.

• 1:20:22Speaker 00

  Yeah, maybe. Oh, good point. Well, and I do know.

• 1:20:26Shawn Ryan?

  Longer this goes on, the more pissed off everybody's going to get at us.

• 1:20:29Speaker 00

  Yeah. I think the dialogue in DC is there's never been a ramp up of Navy in history as much as the Chinese have ramped up their Navy. If you look at Taiwan, well, that's a naval battle. That's a naval blockade. That's Navy, Navy, Navy. So there's evidence that shows it. But if you want to be a global power, I still feel like we're one of the only nations that can project force remotely. You know, I've heard we may not, depending on who you listen to, we may not be able to project in two fronts anymore. And, you know, I've always felt we were always built to at least do two, two wars at once. That may not be the case. But China's building for something, right? And you always think back to when we sent our, whatever, beautiful white ships around the world with Teddy Roosevelt,

• 1:21:10Speaker 00

  whenever you carry a big stick. And I wonder when China's going to do that, if they're already doing it. I think they're probably already doing it in parts of the world.

• 1:21:18Shawn Ryan?

  Yeah.

• 1:21:18Speaker 00

  But we'll see if they do it globally someday.

• 1:21:21Shawn Ryan?

  Yeah. You brought up Snowden earlier.

• 1:21:23Speaker 00

  Yeah.

• 1:21:23Shawn Ryan?

  What do you think about that leak?

• 1:21:25Speaker 00

  You know, I'm never a leaker. You know, I get it that the dialogue needed to happen. But I'm, I mean, I'm the wrong guy to ask. I'm pro, it is a weird sense that I've had my whole life. I got to probably, and maybe as I get older, I'm less trustworthy. But I believed in the institution of the NSA and still do. And I've known the leaders there. Nobody is trying to do the wrong thing. I really don't believe it. And, you know, there's tons of inspection there. I would almost argue, we inspect so much, we almost hamstring ourselves, you know? And so I'm in the, I don't know, I'm probably in a minority camp. I trust the NSA to do the right thing. I really do. And I, and I, but again, I've

• 1:22:06Speaker 00

  walked the halls there, and I believe in the people and the mission. And I think you should never, there's, there had, you would like to think there was another path he could have taken if that was his fight. And I, and I still believed in, you know, they looked at the violations done. I can't remember the exact code that came out of the, you know, I think they called it the Patriot Law for one, for a while. But, you know, there was a huge investigation into what were the procedures and who are the people? And they even had people from, I mean, they had left liberals, they had right wing, they had everybody. And it really came back a nothing burger from the extent, at least from my understanding of it, as to what we were really doing. So, I don't know. To

• 1:22:50Speaker 00

  me, a spy is a spy. I still believe that you can whistleblow appropriately. But I could be wrong, Sean. I would be fascinated your opinion. If I were sitting in that building, I'd never have done it. But, you know, maybe I'm a weaker person. Maybe it takes, the dialogue is good to have all the time, right? The checks and balances. That's why we had the press and freedom of the press, you know, to keep the government in check. You know, I still, I still think marketing companies probably know way more about us than the government ever could.

• 1:23:18Shawn Ryan?

  I think you're probably right.

• 1:23:19Speaker 00

  Yeah, but marketing companies won't break down your door and take your assets. You know what I mean? So we don't worry about them as much, right? So I do believe in checks and balances, and the government's got to get called out, whether appropriately or inappropriately, it's always a good check.

• 1:23:32Shawn Ryan?

  Yeah.

• 1:23:32Speaker 00

  Right? No matter what.

• 1:23:33Shawn Ryan?

  I get worried. I see both sides, too. I mean, I get worried about it. Obviously. I mean, we're just talking about Glacier.

• 1:23:40Speaker 00

  Yeah.

• 1:23:41Shawn Ryan?

  But so obviously, I get, I get really worried about it. But, but I could see both angles. But I do, I get concerned about government overreach.

• 1:23:52Speaker 00

  Yeah.

• 1:23:52Shawn Ryan?

  I do.

• 1:23:53Speaker 00

  If unchecked over time, doesn't it automatically go there? I mean, that's just a theory I've always had, is that it is a good thing to have healthy debate, no matter what spawned it, right? Whether it was, so even my opinion on Snowden, whether positive or negative, it's a great conversation to have all the time, you know? So that was kind of my take at the time. I just wish, what I don't know, and what probably nobody in the general public knows, is what were the downside problems that that created? I'm certain there were certain lives that became real complicated through those leaks, you know?

• 1:24:30Shawn Ryan?

  Yeah, yeah. Well, Kevin, let's take a quick break. When we come back, we'll get into solar winds.

• 1:24:39Shawn Ryan?

  This episode is sponsored by BetterHelp. You've heard me talk about BetterHelp for a long time, and one of the things that stands out is how many people have shared real, positive experiences with it. Therapy is personal, so hearing directly from the people who have used the service matters. BetterHelp makes those reviews easy to find at betterhelp.com/reviews, and they update them every day. BetterHelp has an average live therapy session rating of 4.9 out of 5. That's based on over 1.7 million client session reviews. That kind of feedback from people who've actually used the service speaks for itself. And getting started is simple. You answer a few questions, BetterHelp matches you with a therapist based

• 1:25:21Shawn Ryan?

  on your needs, and if that's not the right fit, you can switch therapists at any time. More than 6 million people have used BetterHelp globally, and their therapists have at least three years and 1,000 hours of hands-on experience. See the reviews, see what stands out, and see if BetterHelp is right for you. Visit betterhelp.com/srs. That's better H-E-L-P.com/srs. Looking for another way to support the Sean Ryan Show? Head to SeanRyanShow.com and check out the latest drops from Vigilance Elite. We just released new gear, including

• 1:26:02Shawn Ryan?

  this beautiful Moisture Wicking VE Performance Hat, and SRS Campfire Mugs, and you guessed it, Vigilance Elite Gummy Bears. Oh shit! Every purchase directly supports the show and helps us continue bringing you independent conversations without compromise. Visit SeanRyanShow.com and grab yours today. Alright Kevin, we're back from the break. You were just telling me a story about...

• 1:26:36Speaker 00

  Oh yeah.

• 1:26:37Shawn Ryan?

  When you exposed a 61...

• 1:26:39Speaker 00

  61398.

• 1:26:40Shawn Ryan?

  61398.

• 1:26:41Speaker 00

  It's funny, you know, even when I went live with that, I didn't know the five digits right away. You know, I remember being on like 60 Minutes, I'm like 6, 2, 4, 3, you know what I mean? It's like, you worry about those damn things, and as I got older, I forget it. But yeah, when we did that story, David Sager and Nicole Pearlrod from the New York Times, it was kind of coincided with the New York Times was compromised by a Chinese government. That's a little weird. And they decided to go live with it, and we decided, well, let's go with who did it, and what they've been doing. That's the PLA Unit 61398 thing. And it was Sager's idea and Nicole's idea, let's just put this on the front page. And I remember like the day before, I don't know where, every once in a while I think I'm an expert when I don't know shit. You know what I mean? So I'm literally on the phone with Sager, and I'm thinking, I know his job better than him. He's like,

• 1:27:26Speaker 00

  this is gonna be a big deal. I'm like, no, it's not. David, you're wrong. Nobody gives a damn about hacking. And I've been doing this for 20 years, no one's ever cared, and they still don't. I go into work the next morning, and I get in, I still remember my lights weren't even on in my office yet. And I go in, it's out, you know, in Alexandria, Virginia, it's about 7:20 in the morning, and it's live. We're on, you know, it was like February 13th of 2013, we're the front page. And I don't even remember what the headline said. And what's weird too, you're an entrepreneur, you know, it's like, no matter how good yesterday was, the only thing that matters is tomorrow. I've already been, I'm done. We're fine, we're on the front page, who gives a shit? We're off, let's get our workday done. And all of a sudden, my cellphone rings, and I answer it, and it's

• 1:28:10Speaker 00

  my now ex-wife. And her exact words, exact words were, "What the fuck did you do?" And I went, and immediately, because I'm a guy, I'm like, what left-field thing am I in trouble for now? Like, I didn't know it, why she was saying it. And I'm like, what are you talking about? You know, I probably got defensive, right? Like, what the hell are you talking about? I didn't do anything, you know? She's like, turn on your TV. And I have a TV right in my office, I turn it on, and I'm not even kidding, the very first scene I saw is a, the building, I recognize the building in the background, it's PLA Unit 61398's headquarters. And there's like a dude in a taxi going, "Drive away, drive away." And I look at the bottom, it's like, you know, or Mandy report and all this, I'm like, oh crap, what did

• 1:28:53Speaker 00

  I do? Like, I didn't even know. We didn't think about, people were like, this is a marketing drill. Really? No, it wasn't. It was a bunch of former US soldiers saying, screw this, it's Chinese New Year, let's get the report out, let's burn their infrastructure, burn their operation, give our government a tool, so the government doesn't have to point the finger at China, we'll do it for them. And let's just see what happens. And we dialed that report back. We actually had the names of a few of the soldiers. Like, we knew who they were. And we pulled, I remember, I edited those things out, I'm like, no, we're not gonna put that in there. Because I didn't know what happened to these guys for getting caught. But anyway, I ended up that day doing about 13 interviews, or something like that. And by the way, with no staff, like, nobody's handing me power bars, nobody's

• 1:29:38Speaker 00

  coordinating, I think, you know, I just ran around trying to get out the truth of it. Because what's weird is if I didn't go out and do those, Sean, those interviews, someone would make crap up, or say something, and we were on, we were in the ring. Like, you know, we were in the ring, we knew exactly what China was doing. So I just felt, let's be the voice of reason on this one, and get it out there.

• 1:29:58Shawn Ryan?

  Nobody had even heard of 618...

• 1:30:00Speaker 00

  61398?

• 1:30:01Shawn Ryan?

  61398 before, haven't they?

• 1:30:02Speaker 00

  I don't know. To be honest, I hadn't either. My team wrote it, we picked, here's what's weird, we had like three groups who could have picked them, China. There's like a little naval group, we called APT-4. We chose APT-1 for a lot of different criteria, but one was, they kinda, they weren't, they weren't the Mike Tyson in the, you know, in his prime. They were more, you know, Buster Douglas. We knew we could take the uppercut coming back from them. And so we literally picked them. And it was a tool to give, you know, Congressman Rogers, you know, something, the government, like, US government, we know, we probably know you know, but we'll let you guys have this work of art from us. So, we did it.

• 1:30:43Shawn Ryan?

  Have you heard of, you know, we were just talking about Snowden?

• 1:30:46Speaker 00

  Yeah, yeah.

• 1:30:47Shawn Ryan?

  And have you heard of this FISA thing that's going on today?

• 1:30:50Speaker 00

  FISA court stuff? No, what's happening?

• 1:30:52Shawn Ryan?

  This is a tweet from Thomas Massey, "The House passed FISA Section 702 renewal yesterday. I voted no. This was a uniparty vote in favor of unchecked government surveillance without adequate warrants or an accountability." The vote tally, the vote tally is, Republicans have voted yes, 192, 42 Democrats voted yes, nay, Republicans, 22, Democrats, 169. Total yes, 235, no, 191. Do you know what this means for...

• 1:31:25Speaker 00

  You know what I would tell the viewer, just like, in my view, at a time when I was in the US government and in law enforcement, I never, ever saw, witnessed, or knew about unchecked surveillance. Period. And I feel that's healthy skepticism for folks to have. I personally never saw it, and never executed it. In fact, it was hard for me to get the ability to do it. You really did have to go talk to judges, you really had process. So, FISA is foreign intelligence kind of taps, right? And to me, US law protects US citizens, and I think a lot of times you forget that, you know? And so, you know, bottom line, it's

• 1:32:08Speaker 00

  good for the viewer to know that. I never, ever witnessed or saw what I would consider unchecked governments.

• 1:32:13Shawn Ryan?

  I dug into this a little bit this morning, and I understand why everybody's making a big deal of it, but the way I read it and deciphered it was that, in order for the government to actually surveil you under this, you have to be in contact and talking with a foreign state actor.

• 1:32:33Speaker 00

  And there's still a FISA court.

• 1:32:35Shawn Ryan?

  That they're watching.

• 1:32:36Speaker 00

  Yeah.

• 1:32:37Shawn Ryan?

  Not just anybody from, any foreigner, a foreign state actor that is...

• 1:32:42Speaker 00

  That's already under investigation, and there's a FISA court, and that's all classified stuff, and you go and present to a special FISA judge, and you get your ability to go do it. I had to get approval for consent monitoring. Like, literally, people were like, you can monitor, I'd be like, no, I actually can't. I gotta ask, you know, my JAG if I can go do that. So, people could have asked us to come in to monitor, and we wouldn't have been allowed to do it. You know? And in cyber, at the time, some people did, you know? Like, if the, if the government knows more about what the bad guys are doing in office than anybody else, why not let the government help protect the defense industrial base? Or why not let them protect the banks, or protect a hospital? And we can't do that as a nation, because of the separation between the two. So, it just, I think, I would rest

• 1:33:26Speaker 00

  assured of fire in this country, that I've never seen, and I don't know of, and I'm in DC all the time, you know, no, there's nobody, it's not unchecked. You know? It's not, not from my...

• 1:33:42Shawn Ryan?

  That's good to hear.

• 1:33:43Speaker 00

  ... goodness, yeah.

• 1:33:44Shawn Ryan?

  That's great to hear.

• 1:33:45Speaker 00

  I guess, you know, everybody can innocently make mistakes.

• 1:33:47Shawn Ryan?

  We're leaving to hear.

• 1:33:48Speaker 00

  And, yeah. I've never had to brief a FISA court, but I've had to brief...

• 1:33:56Speaker 00

  You know, a judge, it's not easy to monitor anybody in this country. I haven't found it to be easy. Maybe it was cyber stuff. Maybe it was me. I'm not compelling Sean. I get in front and be like, we need to do this. And they'd be like, eh. But, uh, you know, anyway, I'm not worried about it. I believe in, uh, my gut is if we restrict our ability to spy, we're hurting Europe, we're hurting ourselves, we're hurting a lot of people. And so I, I think I would trust our, uh, our organizations to do their job.

• 1:34:25Shawn Ryan?

  All right. Let's move into SolarWinds.

• 1:34:28Speaker 00

  Thank you. I'll just jump right in then for you. Imagine, Sean, you're sitting at work one day. I'm, I had about 4,000 employees. I was the CEO of a public company called FireEye. And I looked down on my schedule. I'd just done a, uh, an all hands with 4,000 employees where I told them,

• 1:34:50Speaker 00

  and it was fall of 2020. So it's during COVID. And I'm doing weekly calls during COVID because you want to keep the wheels on the bus. And we have 25 year olds in Alexandria, Virginia, living by themselves and their parents won't even see them because they're so afraid of the damn, you know, of COVID. So I'm doing weekly all hands, guest speakers. I felt like I was doing the Kevin Mandia show. Every Wednesday I'd do it twice just to keep people in the ring together, uh, and entertained almost because I had a lot of, uh, a lot of folks struggling during COVID to stay motivated and stay human. You know, late COVID February, so it's November of 2020. I do my all hands where Blackstone did a $400 million investment in my company so I could split it.

• 1:35:35Speaker 00

  You know, so I could split my company and sell off the more mature portion of my portfolio and, and carve Mandian out to be a standalone company. Blackstone gave me the air cover to do it. So I do the announcement to the whole company. I hang up the all hands, you know, meaning Zoom call. And I looked down on my calendar and it says that my chief information security officer wants to talk to me at one o'clock. And it's a Friday. It's 12:57 and I'm not kidding. I'm about to go downstairs and grab a beer. You know, I'm like, man, this has been a long week. I just did a $400 million raise. I just wrote my presentation. It's pre-AI. I had to write all my own speeches, you know, no, no help. And, uh, and I don't know, half the company is going to be like, wait, am I going to be in the part of the company he sells?

• 1:36:17Speaker 00

  Or in part of the company he keeps? And we were still kind of figuring out which students go right and left. And it was complex and it was something that had to be done in a public market. I see this invite. I get on the phone at one and man, I should have known it was going to be bad news. You know what I mean? Chief Information Security Officer really wants to talk to the CEO. I get on the call and one of the first, and I'm getting a briefing from one of our IT guys who ended up moving into the Security Operations Center. And he's telling me that somebody is logged into our network.

• 1:36:51Speaker 00

  And, uh, and the very next thing they did after they logged in is they dumped all our user accounts and passphrases from a Microsoft tool called Active Directory. So in other words, that's like somebody broke into the hotel. And the first thing they do when they broke into the Marriott is they, they didn't grab the room key that just opened up room 101. They grabbed the room key that opens up every room. They had the master key. You don't get the master key the first time you break into the hotel. You know what I mean? So I luckily I'm a CEO that's responded to breaches this whole career because when I get that news, I literally go call board meeting. This is the one, this is the one I'm worried about. And even my sister was like, call board meeting. What the hell are you doing? And I'm like, I think this is Russia.

• 1:37:34Speaker 00

  Like they're accessing our network the way we do. That's perfect offense. Access the network that you're targeting the same way the employees access it using their accounts. And that's what whoever this was did. So 10 minutes into my briefing, my heart's saying, I'm like, well, I'm not getting that beer today. And honestly, every day, Sean, I remember going, I got the board together a couple of hours later. And I, and I think I gave them like the Sully speech, landing a plane on the Hudson. I just said, brace for impact, man. This is going to go from bad to worse. We're a cybersecurity company. Someone's in our network. They got all the keys. They've got all our accounts.

• 1:38:11Shawn Ryan?

  Did you, did you know, I mean, did you think you were the only company?

• 1:38:15Speaker 00

  No.

• 1:38:16Shawn Ryan?

  At least, yeah, which is October 2019, Russian SVR hackers inject malicious code into the SolarWinds Orion update used by 300,000 customers.

• 1:38:27Speaker 00

  Yeah.

• 1:38:27Shawn Ryan?

  March 2020, the back door goes live. US Treasury, State, Homeland Security and the Pentagon compromised for over a year before anyone noticed. December 8th, 2020, Mandia discovers Mandian itself has been hacked.

• 1:38:43Speaker 00

  Yep.

• 1:38:43Shawn Ryan?

  Red team tool stolen goes public.

• 1:38:46Speaker 00

  Yep.

• 1:38:46Shawn Ryan?

  With your company blog the same day against most legal and PR advice.

• 1:38:52Speaker 00

  Yeah, because well, we, we found out beforehand, we went live as soon as we could, but here's what held up us going live even faster. Is so Friday, I get the briefing Friday afternoon. Sunday, I, I just already scheduled a board meeting for Sunday afternoon and I luckily I did the job of computer forensics. How did people break in? It was always what happened, what to do about it. That was my job for my, every day of my career. You know, what happened, what to do about it and every computer investigation. And then sometimes who did it? And on this one, I just felt right away. It was the SVR. Just my gut went, okay, this is a problem. On that Sunday, three days or two days after I knew we were probably compromised. I would get an update every day and it just got worse every day. I'm like, man, I hope they don't get to our

• 1:39:36Speaker 00

  secret server that has all our passphrases. Like an hour later, a guy would call, hey, they, we just did forensics on the secret server. They've got it, you know? I'd be like, oh, I hope they don't grab some of our email. Day one, I called our best email investigator and said, hey, I'm pulling you off the job and you gotta go look at our email that's stored at Microsoft. He called me back exactly 47 minutes later with, we got a problem. You know, so if we didn't know to look, Sean, we'd never looked, but we knew to look, so we did. And we started noticing, why is our backup account backing up our email all the time? It's not backing up our email. They were using our backup account to log in and steal our emails. You know, and so I just went, oh, this is going to get ugly. Sunday night, I call frontline responder for a pep talk.

• 1:40:19Speaker 00

  We're working around the clock and I can tell you day one, even as an incident response company, I didn't think my team was taking it serious enough. I'm like, guys, this is the one, this is the one we're worried about. By day three, everything was changing. The team went, yeah, it's the one we gotta worry about. You know? And so I call a frontline guy Sunday night. He's working around the clock. And I, and I just happened to be talking to him and he goes, yeah, they stole our red team tools. These are tools that we use to be surreptitious and break into our customers. You know, kind of simulate the offense, simulate the bad guys. And the minute we lost them, I was like, well, can we stop them? Can we stop our own red team tools? And the answer was we couldn't. We made software to stop bad guys.

• 1:41:02Speaker 00

  The unfortunate reality is we had created all this offensive stuff that our defensive platform couldn't even stop. I'm like, I can't go live with that. You know, we got to fix this. To the credit of Microsoft, to the credit of CrowdStrike, to the credit of Palo Alto Networks, we didn't have anywhere for me to go in the government, really. I went to the NSA because it's a damn lonely world when you're compromised. Day one, by the way, I called the NSA and I told them, hey, listen, we're burned. Don't email us. Don't, don't talk to my guys. Don't email my guys. We're, we're, I have no idea how bad this is, but it's going to go from bad to worse and it did. Uh, and to their credit, they were a great ally. Second, we, we, we immediately started reversing our own red team tools to figure out how to detect them.

• 1:41:43Speaker 00

  And then we called, I called the CEOs of these companies like, hey, Nikesh, could you please have Palo Alto Networks help us out? Before we ever went public, Sean, we were working inside the community. And to the credit, these are companies that competed with us. They helped me. Thank God.

• 1:41:58Shawn Ryan?

  Wow.

• 1:41:58Speaker 00

  You know, I was like, hey, George at CrowdStrike, can you please, we were giving them the rules set to stop our cyber weapons, just in case the Russians used them. They've never used them that we're aware of, but they sure as hell learned a lot from it. And, um, boy, was I scared. Like the whole time I was like, I'm going to be the reason the internet goes down. I'm going to be the reason, you know, all hell breaks loose. So I was in a race to go public no matter what, Catholic guilt, call it. The right thing to do. I remember I got so much unsolicited advice during this intrusion from employees and the board.

• 1:42:32Speaker 00

  That I remember two things distinctly. One, every time I was advising a CEO during their own intrusion, I would tell them, this is your day job now. You gotta get through the crisis. So I remember my own voice in my head of what I told other people. Now I had to live by my own advice. It was a little weird. That almost was like, you know, bipolar. I was telling myself how to handle my own incident. Period. You know, coaching myself, the same words I told other people. But we were in a race to go live right away and I was so worried the Russians would use what they took to their credit. And thankfully they didn't.

• 1:43:10Speaker 00

  And I, I think I didn't think we were alone. Because the SVR always has multiple victims. It's not like they hack one company at once. But I could feel when I went out to the community, it starts NSA to me. I go right to them, hey, man, we got something new and novel. We don't know what the hell we're dealing with. You want to defend the military first. We do have, and then they go to Five Eyes with, we got something new and novel, and it kind of percolates through. And it does no good to go public right away because all you're going to do is scare the hell out of everybody and there's nothing they can do about it. So we did get Microsoft's help. Thank God, they showed up in a big way. Turns out they were compromised by the same people. CrowdStrike showed up in a big way, Palo Alto Networks, Fortinet, all the cybersecurity companies kind of rallied. But it was all informal. And even today,

• 1:43:53Speaker 00

  Sean, if we knew a cyber attack was coming, there's no way for the nation to go shields up with coordination. The way you do it is you call the vendors personally and go, hey, you know, we got something new and novel and we need help. I had to protect America from the very tools we had made, you know? So we did it. And I'll never forget, to my board's credit too, I went into a board meeting, this was December 8th when I went public. There was no legal obligation to go public about the breach. We didn't violate anything. We didn't lose any covered data by statute. And the lawyer's a great guy, incredible lawyer, and he gave the whole board a presentation on, you have no legal obligation to go public. And I had like five pages of notes and I was

• 1:44:36Speaker 00

  ready to fight my board with, I'm going public anyway, god damn it, and here's why. They rolled over in 10 seconds. It was the easiest board meeting I ever had, was conveying the news to the public. And by the way, here's what happens when you're hacked and you know it and you tell the world. Market cap goes down by 20% for us. We get sued right away by shareholders and you're considered negligent. And I even had a phone call. And then you're calling all your customers, and I've lived this with a lot of folks. I called one money center bank and the guy on the other end who I've known for 20 years was like, Mandy, how did you let this happen? How did you let your company get compromised? And I remember saying internally, don't lose your shit. And I just

• 1:45:16Speaker 00

  went, let this happen. And I lost my shit. I didn't let it happen. Nobody lets it happen. We have a modern nation with incredibly smart people coming after America. We're going to lose. We can't throw a perfect game every day. I was so pissed off because let it happen. Every day we woke up, I had spent every Friday, Sean, downside to my jobs is every Friday I'd get a threatening email from a ransomware actor, and they were real people. And they'd say, we're going to hack you this weekend. And the reason why is because we were preventing payouts. We'd respond to an intrusion, bottle it up so fast that companies didn't feel they needed to pay the ransom. So they would threaten us. And they did break into us and we'd have to play this whack-a-mole game

• 1:46:01Speaker 00

  with them before they could do anything. We made our own security software. We could program it any way we wanted. And we can't even stop the criminal element. That's how asymmetric this fight is. So I remember every weekend, anytime my lawyer called, my heart rate would go to 130, no matter what, you know what I mean? You had the phone ring certain times, just like, oh shit. I had it every weekend. And then so during SolarWinds, I think part of that side of me came out. I didn't let this happen. Nobody lets this happen. We're getting sucker punched here. We're giving Wayne Gretzky unlimited shots on goal. I mean, the puck's going to get in the net sooner or later, for god's sakes, you know? And that's what we're doing. So I remember just,

• 1:46:44Speaker 00

  you've had those moments where you're like, don't lose your shit, don't lose your shit, and then you lose it anyway? I had that one.

• 1:46:49Shawn Ryan?

  Just about every other day.

• 1:46:50Speaker 00

  You got it. That was one of those, you're the, don't do it, don't do it. And then, I didn't let this happen. But SolarWinds for me was a, you learn under crisis, whether you gain weight or lose weight, I lose weight. And it's weird because it's not like you're bleeding out in Afghanistan. That's what I kept telling the team. This is a cyber intrusion. We're still healthy, you know? But what I've learned is when your credibility gets attacked, or your competence gets attacked, it is, I personally don't respond well to it. You know, like every time I got a subpoena as a public company CEO, I didn't do anything wrong, but you read the first paragraph and I just get this energy like, F this, I didn't do this, you know? I got that during

• 1:47:31Speaker 00

  SolarWinds. A lot of energy to prove, we're not incompetent. We're good people that got, you know, just lost that day to a foreign intelligence service that really kicked our ass.

• 1:47:43Shawn Ryan?

  What did they get from all the government agencies, from Department of State, from Homeland? I mean, what are they getting out of that?

• 1:47:51Speaker 00

  In my experience, the Russians always had an etiquette where I've never really seen them take the top person's email. It's almost like they're like, hey, man, don't take the secretary's email. Just take all the people that report to them. You know what I mean? True story. I've always felt that.

• 1:48:06Shawn Ryan?

  It's always the emails, huh?

• 1:48:07Speaker 00

  Yeah, it is, because everything's there. They took email and they took from us our red team tools. I think it was source code for some of the victims. It was emails for some of the victims. It was methodologies. A lot of it was how do we detect them, find them, and what do we know about them? You know? To their credit, they did a lot of keyword searches, you know, so we could see what they're looking for. That's a goldmine for us. I've never seen China do it. Well, that's not true. I have seen the Chinese recently do keyword searches. And that's a goldmine for us, because you know what they're interested in. Keyword search means they hack into the machine and they say, find any document that has the word secret in it, or, you know, Hacksat in it, or whatever the hell it is. You know, they pick their words and then go. The Russians

• 1:48:49Speaker 00

  did that on us. So I could tell you exactly what, they were after our red team tools. I mean, they were absolutely after.

• 1:48:55Shawn Ryan?

  So let me, I'm just curious, let me ask you this, you know, coming from the intelligence world, I mean, you have all signs, you have code names, you have all that kind of shit. Does the USG use pseudonyms in emails? Have we started?

• 1:49:13Speaker 00

  Not that I'm aware of.

• 1:49:13Shawn Ryan?

  A tactic like that?

• 1:49:15Speaker 00

  Yeah, no, it's just, yeah, so, you know, here's the reality, we're, there was a whole idea once by a company I'd started and they'd since pivoted, where they were like, we're going to make a bunch of fake stuff. So when the Chinese steal it all, they won't know what's real and what's fake. Well, here's the problem. Even companies don't know the last version of something. We have bad enough document control and email control on our own shit, let alone this fake them out, or head fake, or code names. And I did protect their services when I was in the Air Force, I'd augment the secret service. And I can tell you, we did do code names then because the radios were probably not even encrypted. They were these big bricks we wore. And I remember the very first thing that ever happened, and I don't know if it was for show, just to scare

• 1:49:55Speaker 00

  the 27-year-old Air Force guy, but it was like Raven 1 to Raven 3. And the response was, I'm Raven 1, you dipshit. No, I'm Raven 1. And we argued about who was Raven 1 or something, you know what I mean? So, you know, you use code names, you got to change them all the time. And I don't think it's going to work. So I don't know of any real obfuscation, encrypt, and you try to keep your communications out of plain view from the Chinese. So, but SolarWinds was something that, it was a supply chain hack, Sean, where SolarWinds was a company that we all use for kind of controlling our infrastructure. And I feel bad for them in a way, you know, I mean, imagine this, I had to call them. We found an implant in their published code. That's no

• 1:50:39Speaker 00

  different than like Microsoft getting hacked and you get the next update in Microsoft and it's backdoor for the SVR to steal all your email. Or you're on your phone and you download an app and like, whoop, thank God I updated my app. And the update itself, signed by SolarWinds, had a backdoor in it, that the Russians now had a menu of, who do we want to hack today? Well, we have a choice of, at the time, 18,042 companies had downloaded the new version with the backdoor. So they had a menu of 18,042 companies. And to the Russian SVR's credit, they didn't hit everybody. They could have literally shut us all down, just delete everything, you know? If it was a destructive attack, well, there's a whole lot of data deleted right now

• 1:51:21Speaker 00

  and that's it. What they did was very precision-based, real espionage, you know, they went in and took what they wanted.

• 1:51:27Shawn Ryan?

  You described this as a special operations cyber unit?

• 1:51:31Speaker 00

  Absolutely. Yeah, I remember I went to the Senate Intelligence Committee and I said, this was a sniper shot, not a spray and pray. They went right at the 50-something, I'm aware of about 50 or so companies that are US government agencies they went after.

• 1:51:49Shawn Ryan?

  February 2021, you testified before the Senate Intelligence Committee was the most credible. You were the most credible voice in the room.

• 1:51:58Speaker 00

  Who said that?

• 1:52:00Shawn Ryan?

  Pushed for mandatory breach disclosure laws that still don't fully exist. They still don't fully exist?

• 1:52:07Speaker 00

  Yeah, there's no national level breach disclosure law that I'm aware of. That is useful or helpful in any way, shape or form. The problem we had is the privacy laws, the privacy zealots got there first and said, if you're hacked and you know it, and you lose like your personal data, Sean, then we gotta tell, you know, 48 state governments or whatever it is, now it's probably all 50. And there, so there was things to protect American citizens when they, when you lost their email or their date of birth or the social security number or their bank account number, private bank account number, it's called covered data. And that's great, but what covers the Chinese going in and just stealing all your IP? Nothing, there's no disclosure law required. And the problem with that is no company gets better from it.

• 1:52:52Speaker 00

  Like if company A is hacked today and the Chinese use all new and novel techniques to break in, no one's learning from it, you know? So if they can go to one place and say, listen, we're broken into, even if, I hate to say it, I was even a proponent of if it's defense industrial base or critical infrastructure, hell, let the best in government show up and help, because then we can go shields up, learn the tools, tactics and procedures that were successful at company A, and they should be the only victim to that breach, period. And then you just kind of create a better maginal line. You have to have a learning system. As a nation, we haven't built a learning system where we learn from everyone's compromise

• 1:53:32Speaker 00

  and we all get bolstered from, you know, all the breaches responded to, like, uh, just, I could just pick any of them, hell, it's every single brand you can name. But if you get compromised today, wouldn't you feel good about, well, at least nobody else has to go through this? You know what I mean? So I, I think if we get compromised, I would immediately say, here's the TTPs used against us, here, it, it better be a new and novel attack. I don't want anything that preexists to work against us. And we gotta get it out there to make sure we're the only victim. Uh, we gotta do that. It's no different than, you know, neighborhood watch. You see an asshole robbing a house, you better tell everybody in the neighborhood, you know? And they drive this car and they're doing this. We need that as a nation and we could do better there.

• 1:54:17Speaker 00

  We're in a neighborhood where people are getting robbed and no one's telling you they're driving a white van and there's their plate numbers and three dudes in, in the van. We need it.

• 1:54:26Shawn Ryan?

  Are we working on this?

• 1:54:29Speaker 00

  Yes, the challenge is that every time you go public, no matter what, there's never really a safe harbor for you. So unfortunately, and I can never guess, when you're hacked and you know it and you tell the government, I've never been sure what the government's response would be. And I can never tell the public's response. Example would be like when Target was breached, you know, they lost credit card numbers and they over communicated, they had great people, great talent, but people lost their job over that breach. It happened in really 2000, the end of 2013, beginning of 2014. Almost the exact same breach happens at Home Depot and nothing happened. Public wasn't in an uproar or anything, but there's something about this Target breach that it just got a lot of attention, it was during Christmas times, holidays, it's the

• 1:55:13Speaker 00

  front damn page every day. And then Home Depot, same thing happens. Someone hacks, steals credit data and does stuff. And Home Depot will say, well, we handled it better. There wasn't that big a difference in the handling of it. It's just public responded different. You know, and, and that, and maybe there's a few minor tweaks here and there between those responses, um, but I never know. And so a lot of times companies get hacked and they do disclose, and then they still have to show up and testify in front of the government. And you'll have a senator from, you know, Oregon say, well, how, how come you don't have firewalls? And you'd be like, dude, firewalls don't do a damn thing. Like, are you kidding? That's, that's a, it's not even a padlock in cyberspace, you know?

• 1:55:58Speaker 00

  It, it's a, you just get held to account no matter what.

• 1:56:02Shawn Ryan?

  Got you. Yeah. Damn, damn. Let's talk about the Colonial Pipeline and critical emphasis.

• 1:56:09Speaker 00

  Yeah, sure.

• 1:56:09Shawn Ryan?

  May 2021, dark side ransomware hits Colonial Pipeline. Forty-five percent of East Coast fuel supply. Mandiant called in to respond, six days of shutdown, $4.4 million ransom. Gas lines across the Southeast shut down.

• 1:56:27Speaker 00

  Yep.

• 1:56:29Speaker 00

  I can tell you, I found out and, and you know, with a lot of these, you never know how much is still under litigation or not, but the upside for me is you always get to see the leadership and you get to learn from them. So for me, Sean, kind of like you doing the show, I get to show up and talk to the CEO. And I just feel like Colonial had great leadership, you know, just like unflappable, calm. Yep, here's what we gotta do. Uh, but let, whenever there's a cyber attack, like when somebody ransoms you, they break in and they encrypt your hard drive. It's not like you know what's going on. Machines start to just go dark. They just shut down and some of them shut down after 30 minutes, some three minutes, some 50 minutes.

• 1:57:12Speaker 00

  And if you're, imagine being in a control room and all of a sudden, hey, my machine doesn't work. Hey, my machine's not working. Hey, I'm going down. You have no idea what the hell is going on. And you don't know if there's a physical threat, you don't know if someone cut an electric wire, you like, it, it, non-cyber people have different responses. And I feel like whether it's, it's Sony Pictures had to deal with something like this, um, so many companies have, you know, different defense firms had to deal with it. And then Colonial Pipeline, the way that one came to me is, um, I think we were responding on a Friday and somehow, some way, my young frontline responders didn't see this as national security issues, so I never got the update. My phone rings from somebody who works in the government and literally they open up,

• 1:57:55Speaker 00

  it's eight in the morning, I'm just waking up to go to the gym, um, which means that's a late morning. And I get a call from someone I know in the government, they're like, hey, are you responding to Colonial Pipeline? And I don't want to act like I don't know, so I have to say, well, let me check, you know, I'll get back to you. And, uh, actually it was weirder than that. I think he called and said, is it true the Iranians hacked the pipeline? Or something like that. And I'm like, uh, what are you talking about? And then I was like, let me go check. I called my front, and by the way, I'm thinking Colonial Pipeline, they make faucets or something, you know what I mean? So I don't even know who the hell they are. So I get on the phone with my guys, sure enough, we're responding, and then I hear what they do, and I'm lecturing my frontline nerd, because these guys are so into cybersecurity, they're like, all right, you've been breached, what happened, what to do about it?

• 1:58:38Speaker 00

  They never thought to escalate, hey, man, 40 something percent of the US fuel on the East Coast is gonna be not transmitted. I got a call from the government on that first. And that does happen for me every once in a while. I've had that happen maybe at least three times in my life. I learned, we're responding to a breach because someone from the White House called me, you know? Uh, but on this one, I got a call from somebody at an agency and then I looked in and it was definitely not Iranians right out of the gates, we knew who it was. And that's based on, again, we're cataloging forensic evidence at every breach we respond to, so we can go into like a Colonial Pipeline, look at the evidence, and plus they said who they were, makes it a lot easier, and they wanted to get paid, so you know who you're paying. You can, um, pull the evidence out and just match it and marry it up. So we're pretty confident with who they were.

• 1:59:23Speaker 00

  But on that one, it's just an example of many of them where, uh, first, there's always a fog of war, you have no idea what's happening. Um, if you're a hospital and stuff starts going down, you, a lot of hospitals be like, physically secure the hospital, like you call security and say, guard all the exits, because you don't know if there's someone on the inside doing it. You know, it, it's a weird, uncontrollable moment, but I've seen incredible leadership and I did attend a lot of the calls of Colonial where you do your daily briefs and they were just, they did, they show that you plan ahead, like do the plan that you wrote when you weren't under duress. And that's exactly what they execute, that's the best what he said. They had already kind of said, hey, if something like this happens, here's what we're gonna do. And they just pulled out that playbook and did it.

• 2:00:08Speaker 00

  And it works, because it keeps everybody calm. Because there is nothing, it is a weird thing when you're hacked and you know it. You know, I've lived it where I'm like, man, I wonder if they're stealing my email right now, you know? What the hell's in that? Nobody knows what's in their email. So, uh, Colonial Pipeline, again, though, just all of these, whether it's Colonial Pipeline, hospital, cell company, every one of them, it's a full sprint the whole time, no matter what. Like you show up and our job is always physically impactful, Sean. Like when we show up, we have to figure out what happened, what to do about it, we're not really sleeping. Like you show up and you're just triaging and working around the clock. Um, and, uh, it's, it's, uh, Colonial was no different.

• 2:00:51Speaker 00

  Like some of these intrusions, we, we did United Healthcare. I mean, do you remember what happened to them? I think it was last year.

• 2:00:58Shawn Ryan?

  Yeah.

• 2:00:58Speaker 00

  Somebody hacked United Healthcare and ransomed them and people couldn't get their drugs at pharmacies. People literally worked themselves into hospital visits, I'm not making that up, where people literally worked around the clock till, like, one guy didn't show up at a meeting, they had to go find him and he was like passed out on the ground, they had to hospitalized him. You know what I mean? So the, these things are, uh, absolute races. Um, Colonial, the upside they had is, you know, they're not, they don't have a competitor. You know what I mean? You just gotta get it right. They didn't, and, and I think what they had is the constant, like it's everything, like when you, it's a political issue, you gotta get oil and gas. So I think they probably, you know, I'm not aware of it, but my gut is they felt an incredible

• 2:01:42Speaker 00

  immense pressure to get back up and running. You know, and most companies do, United Healthcare did, yeah.

• 2:01:47Shawn Ryan?

  I mean, I gotta be honest.

• 2:01:48Speaker 00

  It's way harder than people think.

• 2:01:49Shawn Ryan?

  4.4 million in ransom for 45% of the East Coast fuel supply seems pretty minimal.

• 2:01:56Speaker 00

  You know, I, you never, to me, yeah, you never opine whether people should pay or not, obviously, here's what I will tell you, I've never met a CEO who wanted to pay. Not like it was never the default answer, but you certainly see the logic in paying that one, right? I do, four million, yeah, I would have paid it. I, I've gone through the hypothetical, what would I have paid to keep my legal counsel's email from getting posted? Now I'm advertising to the bad guys, but I would pay to not read, the, the amount of lawsuits you get as a public company CEO, if your general counsel's email is online, it's amazing. I mean, reporters read it, they write articles on this stuff, you know? It's a, it's, um, it's a tough situation.

• 2:02:43Shawn Ryan?

  What about texts? Do they ever go after text messaging?

• 2:02:46Speaker 00

  Uh, well, do some reading on, uh, yes, is the answer. Modern nations do. And, uh, you know, both of all our cell companies have a there are certain industries that you need to withstand military-grade attacks or modern nations attacking them. Our cell companies, our phone companies are definitely one of them. They are fair game for espionage every day. Uh, last year, there was widely publicized breach in 18 Team Verizon. It was in 2024 and 25. And the advice from the FBI was, and this is pretty telling, hey, you signal.

• 2:03:27Shawn Ryan?

  Are you shitting me?

• 2:03:28Speaker 00

  No, meaning texts are in the clear and texts can be found. And, um, and cell companies are fair game. And, and in reality, they are so valuable to espionage most likely that, uh, if you're on offense against us, you're trying to place people there. You're trying to hack them. You're trying to do anything you can to make sure you maintain access uh, to the data from those companies.

• 2:03:51Shawn Ryan?

  Is Signal legit?

• 2:03:53Speaker 00

  I think Signal is like you use it. There's always ways around everything, but you have to have a massive comp like in transit signals legit, like if somebody hacked your phone, my gut is they can get to at least half the equation and maybe be able to decrypt it. That means it's a modern nation targeting you specifically. But Signal is, is infinitely better than not using it. Same with Glacier, like these things are massively annoying if you're on offense. Cause that means I can't just intercept your dialogue and read it. And I can't find it stored in plain text. I have to do a lot of work to get to that.

• 2:04:31Shawn Ryan?

  Ben, didn't they just, didn't they just? Where was I reading this? I can't remember what it was, but they broke Signal and they were able to get the messages through notifications by breaking into the app. Have you heard about this?

• 2:04:47Speaker 00

  No, there's usually workarounds like that. Like I can tell you, usually, I wouldn't say usually. In the times where we needed to decrypt something and we only had one key, we always were able to decrypt it over time. And usually there's two keys, a public and private key to something. Um, and so there was a time where we could decrypt at my company, remote desktop protocol from Microsoft. And we thought we were the smartest guys on the planet. We're like, look what we can do. If we can do it, China can do it. In reality, none of our customers cared that we could do it. But what it allowed us to do is whenever the Chinese broke in, they would remote desktop to all these machines. We could see exactly what they were doing because we could tap it. And even though it was encrypted, we could decrypt it. We thought, oh, we're awesome.

• 2:05:31Speaker 00

  Nobody really cared. Um, but the reality is, uh, most stuff today probably can't be decrypted easily till you have quantum compute come out. And then realize you have two problems. If you're worried about this, one, someone got your traffic or your data somehow. And then two, they can decrypt it, right? Um, but a quantum, that's the biggest issue with quantum compute. And that's going to come like AI, everything's coming faster than we want. When the Chinese and the Russians and others have quantum, the vast majority of things we've done in the past that they've already intercepted, tapped, stole, that's encrypted, will be decrypted. That'll be the risk we run. The secrets that we once kept will no longer be secret.

• 2:06:14Shawn Ryan?

  How far are we from that?

• 2:06:17Speaker 00

  Under 10 years.

• 2:06:18Shawn Ryan?

  Shit.

• 2:06:19Speaker 00

  For the most part, here's the good news. The Chinese really don't have a whole lot to decrypt. They accessed everything with a valid key, meaning a valid user account and passphrase. So everything was presented in plain text anyway. I actually think the threat from quantum is far less than people realize. Because for the most part, even when the Russians were stealing stuff, it was not encrypted. So the vast majority of the intrusions, I'm speaking with like 5,000 plus intrusion investigations behind me. Very rarely does an attack craft overcome encryption because they are accessing your data with your keys, your credentials. And so it's just plain text anyway. So I think quantum is not going to be a big issue. It, it is for some things, but we'll see what comes out then, Sean.

• 2:07:04Speaker 00

  You'll have a lot of good shows then.

• 2:07:07Shawn Ryan?

  I'll bet I will.

• 2:07:07Speaker 00

  Yeah.

• 2:07:08Shawn Ryan?

  It scares the shit out of me. I mean, the, the way I understand.

• 2:07:10Speaker 00

  Figure out where half is buried or something.

• 2:07:12Shawn Ryan?

  Yeah. The way, I mean, it's just, you know, people, people describe it as your banks will be done, all your passwords will be gone. Every, every financial network will be completely.

• 2:07:25Speaker 00

  I, I think AI is going to impact that more than anything because you have AI doing trades, not humans. So imagine a whole system of AI agents doing all the trades. At some point, the market's going to be managed by them, the AI agents, not humans.

• 2:07:45Shawn Ryan?

  You've heard me talk about Caldera Lab before. And lately, the product I've been reaching for the most is the good. Between being a dad, hosting the show, traveling, training, and trying to keep up with everything else. I don't have time for some complicated skincare routine. I don't want 10 steps. I don't want a cabinet full of products and I don't want something that takes a bunch of time every morning and every night. I just want one simple product that actually does something. That's what I like about the good. It's an antioxidant-rich facial oil serum made specifically for men's skin. The good is formulated with 27 botanicals and it's designed to help deeply moisturize, support skin recovery,

• 2:08:29Shawn Ryan?

  even skin tone, and visibly reduce the appearance of lines and wrinkles. For me, the biggest thing is that my skin doesn't look as dry or worn down. It feels softer, smoother and just looks healthier. And the results back it up. 96% reported healthier looking skin. 91% reported less dryness and 89% showed improved radiance and luminosity. If you're looking for one simple product that actually makes a difference, that's the good. Visit calderalab.com slash SRS and use code SRS for 20% off your first order. Again, that's calderalab.com slash SRS and use code SRS for 20% off your first order.

• 2:09:14Shawn Ryan?

  What is the worst case scenario for a cyber attack on US critical infrastructure? What is the, what is the worst case?

• 2:09:21Speaker 00

  I'll start with this. Nobody knows what would happen when the gloves come off. And there are a couple of reasons why. We're in times of basically at least ostensibly, we're at peace right now with the modern nations like China and Russia. You know, we may be fighting proxy things or ideological differences. But on defense, we don't know if we've seen 99% of their capability on offense or 20%. My gut is it's like 80%. In other words, they have stuff on the shelf, Sean, they've never deployed. We haven't seen it yet. That you save for the moment of need, right? So the first thing I would tell you, there's a book by Ted Koppel called Lights Out. And I read enough of that to go, I don't know if that happens. I don't think it's that bad, but genuinely, nobody knows what would happen if all modern nations go all out in cyber.

• 2:10:06Speaker 00

  Um, I can tell you, our kids probably aren't going to school. I can tell you some regional trains aren't running. Um, but I don't know if it's like the, there was De Niro, there was a book, a movie out on Netflix called Zero Day. And it's all about this exact situation, but it's done by Hollywood. And I couldn't make it past the first 10 minutes. Trains were crashing into each other. Um, uh, you know, some child gets killed or some people get killed in a car accident because the lights aren't changing right, uh, traffic lights. And I was like, man, I don't want to watch this. It, the, the problem is I think you're going to get a situation that there's such a rippling butterfly effect that most of society will come to an absolute, we better go back to the old way. I'll give you an example.

• 2:10:51Speaker 00

  Like there was an attack in 2021 and, and, and it worked. It, it shut down, uh, software that was used by a lot of restaurants. And I mean, you and I have been ordering food in restaurants from long before the internet, or at least, you know, someone wrote down your order. What I was amazed at is when the internet went down at about 800 restaurants, just the, the app itself that they were using got compromised. The majority of the restaurants couldn't take orders. They didn't know how to run their business off the grid. If you want to do something weird, see how many Fortune 500 companies can actually run their business if they're off the internet? The answer is probably none of them. Some aspect or most of their business might actually falter.

• 2:11:36Speaker 00

  And that's unfortunately probably what will happen if the gloves come off in the cyber domain. Um, so much will be unreliable and unpredictable. It'll impact so many weird things like your running app. Hey, how far did I run today? Oh, my running app doesn't work now. Or you're tracking calories, you can't track calories. You, uh, your schedule blows up. Your organization can't get on the grid or you can't transact or you can't sell or you can't get your money or you can't believe what you're reading. And, and there's a lot of different kinds of attacks. Like if I, I, I had the privilege a couple of times of teaching a modern warfare class at the Naval Academy, I'd show up and guest lecture. And I'd depress myself because first off, the attacks start a year out and you won't even know it's us.

• 2:12:17Speaker 00

  Yeah, I won't even give you the playbook, but when the cyber stuff happens, you know, I think we're staying home from work that day. I don't think the grid crashes. I think hospitals function.

• 2:12:29Shawn Ryan?

  You don't think the power grid crashes?

• 2:12:31Speaker 00

  I think it might crash in the Midwest. The mom and pop utilities, Sean, are going to have a problem. Maybe some of the water facilities, but it also depends on who's doing the attack and what their goal is.

• 2:12:41Shawn Ryan?

  I, I would like to dive into that a little bit more because that is one of them. That's where I thought we were going was the grids going down, water treatment.

• 2:12:48Speaker 00

  You, you better have fault tolerance. I think some will.

• 2:12:52Shawn Ryan?

  I mean, it doesn't, I mean, the way I understand the way things are going, China manufactures all of our, damn near all of our power infrastructure. The transformers, water treatment.

• 2:13:04Speaker 00

  Well.

• 2:13:05Shawn Ryan?

  And so if they're manufacturing that shit, they're putting stuff in there to be able to access it.

• 2:13:10Speaker 00

  You gotta trust the country you do business with.

• 2:13:13Shawn Ryan?

  And even the former FBI director said that they are in our power grid and our.

• 2:13:19Speaker 00

  Well, they hacked into it. Yeah, they, they have and not everywhere and that we know of. Nobody knows what will happen.

• 2:13:33Speaker 00

  The challenge, here's what I will tell you, the minimum is small municipalities are going to lose electricity. They're going to have their waterworks probably shut down. Now, again, it depends on the attack. And if we goes full monty right away versus gradual incrementalism, most wars gradually increment, depends on the actor, because there's a blunt force way to attack us that might not be as successful as a slow erosion of our capabilities. Does that make sense? Here's why. If I break into a major utility, you know, like Con Ed runs, you know, is New York City, or PG&E, or, you know, down in LA, or Southern Code, these are strong cybersecurity entities. If you broke into any of them, and tried to

• 2:14:17Speaker 00

  run malware, they probably can detect the malware with compensating controls and stop it. Or if you try to just delete everything on a machine, they'll have redundancy. So what you actually have to do is reverse. So how does this utility work? And what commands do I issue that will be unique to every single one of them, to get it to perform differently, or to impact it negatively? That's lower and slower. You got to read the freaking manuals. Does that make sense? On the littler guys, you probably can just delete everything. I call that blunt force trauma. We hacked in, and we just said, hey, delete everything, go. That might shut down municipalities. It won't shut down the bigs. They're going to keep giving you energy. The bigger problem with the bigs is the load they've got to

• 2:15:00Speaker 00

  take if things start to shut down. We saw that happen in Texas, right? They had like a early winter or late winter, and all of a sudden, the whole darn thing ripples across the state, you know, because if one utility went down, the other tried to bear the load, and it couldn't do it, and it pops down. We had that cascading in August of whatever it was, when New York went down. You know, the, you remember that happened in maybe 2003? 2004? It was 2002, maybe. I can't remember. It was August of 2003. Grid goes down in New York City, you know, and it was all peace and happiness, because it got back up in three days. But what's it like after five? You know, I was actually in New York at the time. It was really good, because people learned after 9/11 how to work together during

• 2:15:42Speaker 00

  crises. And that was August of 2003. But I also remember walking around the city going, it's August, it's hot as hell, air con's not working. How long before this thing unravels? You know, but I think if I'm on offense against us, you take out energy, you take out everything. That's healthcare, that's finance, that's everything. And I think that's, that's what you got to worry about. And then you're just going to get this weird ripple effect of regional transit not working, ATMs maybe not working. You know, life will change. So.

• 2:16:18Shawn Ryan?

  What about water treatment facilities?

• 2:16:21Speaker 00

  Hard to defend.

• 2:16:22Shawn Ryan?

  If they just made minor changes to how they treat it, to what they're putting in it, how they're

• 2:16:28Speaker 00

  They're all different, though, Sean. That's the thing. Like, there's, you're going to have to

• 2:16:32Shawn Ryan?

  They're fucking poison us.

• 2:16:34Speaker 00

  Yeah, I think you got to know more than that. I think they're going to go for, that's why I said either shutdown or alter. Shutdown is blunt force. They just, we're going to delete everything, versus we're going to change the commands being executed. And they're unique per utility. They really are. Like, you got to read the manual. That means, that being said, if I ever hack a company, I find the manuals. They're not hard to find. They really aren't. You just look at a, like, everybody stores them in the same place, and it's usually called the name of the system and the user guide. Read the freaking manual. We do a lot of assessments of these utilities. And if I were, you know, if my red team lead was sitting here, he'd be like, yeah, we usually, if we can get to the OT or operational network, that's a problem. So what you have to do is segment,

• 2:17:19Speaker 00

  the internet network is the IT network. We've all heard IT, right? You got to keep that IT separate from the OT. You better have one hell of a wall between the two. The problem is everybody has a crossover somewhere. It's almost like Nipponet to Cipernet, you know, we can go one way, but not the other. You know, you've got to figure this out. I think the small utilities are uniquely disadvantaged at the time of war. So you're from Missouri? Rontown? Probably not going to do great.

• 2:17:47Shawn Ryan?

  Yeah.

• 2:17:50Speaker 00

  Yeah, I don't even like thinking about it.

• 2:17:54Shawn Ryan?

  Well, you've got to think about it all the time.

• 2:17:56Speaker 00

  Yeah, but there's no, when you, the challenge, so here's the, let's try to, I'm not a pessimist or an optimist. I'm a realist. I do think we can have a future with AI. Everybody's going to say, AI on offense is going to create a problem. And that is true. I think it's near term pain with AI on offense, and what, you know, and we can probably get more into that. But I do see a future where AI on offense will be uniquely available, built by the good guys. That's what Armadine is doing, to train your AI on defense. The biggest problem we have in cybersecurity is there's, there's a starvation line. The big companies have great expertise, great talent, and great software to defend it. Then you hit a poverty line, and all these utilities can't defend themselves. And all the small companies can't

• 2:18:41Speaker 00

  defend themselves. With AI, we're going to get to scale the expert. The problem is, we have to live that transition period, Sean, and the advantage will go to offense during the transition period. And, and we're in that now. AI is just emerging. It will advantage offense. However, in the long run, it will advantage the defense. But we're going to have an ugly transition.

• 2:19:01Shawn Ryan?

  So when you talk about a, like a, how did you, just not, not blunt force?

• 2:19:09Speaker 00

  Yeah, blunt force trauma is like a bad hack. Like, if I'm on offense, I don't do blunt force, because I don't want you to notice I've hacked you, and I've screwed with you till it's too late.

• 2:19:19Shawn Ryan?

  So what does that look like?

• 2:19:20Speaker 00

  You slowly erode a system.

• 2:19:23Shawn Ryan?

  How would you do it?

• 2:19:24Speaker 00

  Slowly pollute the water, slowly degrade the utilities. Yeah, but I would have to read the manual, because it's unique to different things. That, yeah, I almost hate giving the playbook away, you know, because I'd already have, if I were against us, I'd already have people working there. I'd already know how to bring down the major utilities, because that one guy on the inside feeding me the manuals, feeding me the access if I needed as well. You know, so it's real hard to stop that. We have a very international culture, and not all loyalties lie in the same place. So, you know, I hate thinking about what, and I instantly, Sean, go, what, what would I do if I were against us? And I just don't

• 2:20:08Speaker 00

  like what the outcome would be. So I'm hoping that our adversaries gradually increment. We have to have a unproportionate response. If someone attacks us in cyber, our best deterrence is not in cyber. It's explosive. It's kinetic. It's, you bring the pain. That's the unfortunate reality. We are in the glass house in cyber compared to the rest of the world. You know, I think China might be too, because they have such centralized control. We may be the two biggest glass houses. You know, if you're, if North Korea hacks us, and we think, you know, we're going tit for tat by hacking back, they're in a mud hut, throwing rocks at a glass house, and we're in a glass house throwing rocks at a mud hut. It's stupid. It's not the right domain to fight the conflict in. And I think unfortunately,

• 2:20:49Speaker 00

  that's the reality. We have to, if somebody starts hacking our utilities, we have to respond very quickly and violently to that.

• 2:20:57Shawn Ryan?

  What about the financial markets?

• 2:20:59Speaker 00

  I don't even think, I started number one. And they like to think they are. You know, you talk to the banks. But to me, I've never, ever had a scenario in my head where I targeted the banks. No one gives a damn about money if they can't go to a hospital. You know, I go after electric first and foremost, probably water, you know, because it's, it's unguarded, it's hard, hard to protect, and healthcare. That's it. The financials are so well defended, and they're so good at, they can always roll back to one second ago. They have fault tolerance everywhere. They're confidence games. They cover losses. And I would put, if you could wage a war on every front in the cyber domain, yeah, I'd go after

• 2:21:40Speaker 00

  every domain. I'd go after every industry, I mean, and let them all have it. And, and I'd have AI on offense that can hack 24/7 with total recall. And that's what's common, unfortunately, Sean, is a future where all of us, there's an attempted hack against all of us all the time. It's almost that bad now, you know? But it will be that way with AI. So it's a, it's like a lot of needles coming at the balloon, and it takes one to pop it, you know?

• 2:22:07Shawn Ryan?

  How do you, I mean, what, what do you?

• 2:22:12Shawn Ryan?

  What would you tell the, just the average American to prepare for if that were to happen?

• 2:22:16Speaker 00

  Everybody needs to be able to live off the grid. You know, that's actually a fact. We tell businesses, I call them red lever events. If I'm meeting a CEO at any company, never forget how to do business the way you used to, just in case you're under conflict. Be able to dust off a book and say, okay, man, we're gonna have to do insurance claims with pen and paper again. Whatever it is, because you never know what conflict can bring and what you may have to work. Like if you're a restaurant, for God's sakes, you ought to be able to take an order without the internet and without a damn iPad. You ought to be able to write it down, walk back to the kitchen and do it. And I saw over 50% of restaurants falter with no internet, literally couldn't operate the business. In fact, waitstaff didn't even know the menu because they were so used to it. So great companies, but and by the way, critical infrastructure for damn sure.

• 2:23:01Speaker 00

  You drill the red lever events off the grid. How well do you operate? Every machine becomes inoperable right now. How fast to recover? Those are like pull the lever, what happens? And most companies, when they do those red lever events, have

• 2:23:19Speaker 00

  unique findings, like wait, I never thought about, but no one can park in the parking garage. When we come off the internet, when people badge to go into the parking garage, your badge gets digitized and sent somewhere for authorization to open the gate. No internet, no gate, traffic jams the whole block of LA. So you gotta figure out, how do people buy lunch at work? No internet, can't take visa cards. How do we, you know,

• 2:23:43Speaker 00

  I, critical infrastructure needs to operate off the grid. It needs no way to do it. It needs to be able to operate how it used to. I believe that.

• 2:23:51Shawn Ryan?

  What about for people, about for businesses?

• 2:23:53Speaker 00

  People, you know, there's no way to, unfortunately, you know, for me, for people, it's, when we're talking about the rest moments, I hate to say it, and I know you believe this, you have to at least have a family plan for what do we do if the dirty bomb goes off? What do we do if the earthquake hits? What do we do if blank? You know, great idea about technology. I do believe with proper diligence, you can know where your kids are, know where your family is and do so in a safe way. You can have protocols in place, you can communicate in a safe way. If the grid comes down, I don't know how to do that, but you can't really take down the internet in the United States. That's why it was created, survive nuclear war. That's literally how we went from packet, you know, packet switching from circuit switching.

• 2:24:37Speaker 00

  Circuit switching was one line, you sever it, no comms. The internet was created, literally, so we could communicate after nuclear fallout. That was one of its reasons. So you're not shutting down the internet here and there's ways to have redundancy. Go satellite and fiber to your house, have backups. But it's, it's virtually impossible for me to say to any individual, you should prepare to withstand an AI-based attack coming from a modern nation. That's gonna fall in the hands of, of the companies to protect us at that point.

• 2:25:12Shawn Ryan?

  Okay.

• 2:25:12Speaker 00

  Yeah. Apple's gotta protect us. Google's gotta protect us. Amazon and AWS needs to protect us. Microsoft protect us. CrowdStrike, Palo Alto Networks, Fortinet, Cisco. You go through the brands that we all really, you know, like use for our infrastructure, use for our applications and say, hey, guys, you gotta be able to do shields up during conflict. And they know that, you know, they're actually, I would argue, they are critical infrastructure. If we think Google Cloud's not critical infrastructure, it is. It's running a lot of businesses. So is AWS and so is Microsoft's Azure. So you gotta put them in the category of they're critical and they should have, I hate to say it, wartime protocol. What do we do?

• 2:25:55Shawn Ryan?

  What about the USG? I mean, we're talking about the capabilities of China, Russia. In the next segment after this, we'll talk about China, Russia, Iran, North Korea. But what, what are our capabilities? Are we, are we, do we have an offensive hacking arm that, that is conducting espionage on our behalf?

• 2:26:16Speaker 00

  You know, anything we do offensively is gonna be classified. And, and one of the things I will tell you is I started Armadale to absolutely benefit the offense for nations that are governed by laws. And those laws are things we aspire to abide to and, and we do it. I've always felt on gut intuition and to some extent experience, we were the best in the world.

• 2:26:40Speaker 00

  We probably still are. And, you know, but China's great. And, and the problem is Sean, AI is the equalizer between all of us. AI will enable nations like Saudi Arabia, UAE, other nations to have the same level of offense as us potentially over time. Because you can train systems, it only takes one exceptional offensive mind that can do vulnerability discovery, exploitation development, all these skills are gonna be automated into AI. And then, and so that highest tranche of talent and capability

• 2:27:22Speaker 00

  is just gonna get more distributed over the next few years. So it used to be, US was in a land of its own. Israel's incredible in offense. I'm starting to realize war makes you innovate faster and Israel could be the best in the world on offense. And maybe there's certain platforms, different nations are number one in, like the mobile platform. Gotta give some shout outs to the Israeli offensive capability in mobile. Period, right? And I don't know, how, how did you respond when pagers exploded and supply? You think about when command and control is eroded like that, who the hell wants to be part of that network, huh? The radio explodes, the pagers explode. I don't want the next thing you're giving me. You know, right? Just give me a smoke signal from a mile away now and hell, that'll probably blow.

• 2:28:04Speaker 00

  So there's a lot of nations that, that the thing about cyber is one smart person is infinitely scalable. So all you need is that one or two great offensive minds at the right time, you know, and the vulnerabilities in cyber change. Like today, there might be, first time in internet history, no zero days work. But right now, there's two 23-year-old kids working on an app that everybody's gotta have.

• 2:28:30Shawn Ryan?

  Do we know who those great minds are?

• 2:28:32Speaker 00

  Uh, different times.

• 2:28:35Shawn Ryan?

  Where they work.

• 2:28:35Speaker 00

  Like today, it could be that, um, the architecture that matters is Siemens. Tomorrow could be Parsons and the next day it could be Cisco. You, you don't know what skills you need on offense till the, the moment.

• 2:28:47Shawn Ryan?

  I'm actually talking about a foreign adversary's offense. Do we know who those great minds are? Do we know who to take out if they hit us?

• 2:28:56Speaker 00

  I would, I would think it's hard. Yeah, I doubt we know. We probably know some. You always know the lowest bounds, right? Whatever you know, it's the lowest bounds of your knowledge. But no, and I think ours aren't really well known either. I think the best offense I've ever seen, nobody knows who these guys are. Yeah, they're smart. They go home, walk their dog and they don't blog about it, you know? They don't go to Black Hat or conferences and really share what the hell they're doing. And the great thing about offense is the government's mission still draws in incredible talent. But at the same timeframe, in my lifetime, I remember growing up going, the best in the world at physics would be in the US government. The best in the world at offensive cyber would be in the US government. The best in the world at big data would be in the US government.

• 2:29:40Speaker 00

  And now that I've worked at Google or I'm familiar with Amazon and I see the paid differentials that have probably expanded massively in our lives.

• 2:29:50Speaker 00

  I'm, I'm starting to think that there's more talent on the outside, right? So, but I would put the US will always be excellent on offense. We have the, you know, and I hope we just stay there.

• 2:30:03Shawn Ryan?

  That's good to hear. Yeah. Let's take one more break.

• 2:30:06Speaker 00

  Got it.

• 2:30:06Shawn Ryan?

  All right, Kevin, we're back from the break. We had a, we had a really good discussion off camera on, on what you would do if you were going to hack into a nation. How would you?

• 2:30:19Speaker 00

  Yeah, you know, if you were, you always wonder, what would our enemies do to the United States of America? And one of the things that's unique to us, that first amendment allows any, you know, there's a, there's no line between you have to say the truth when you're speaking your mind. You know, what's the difference between a really, really bad opinion? And being out and out lying to incite a riot, you know, nobody knows where these bright lines are. With the first amendment in the United States and the freedoms that everybody's afforded for that, I think we're uniquely susceptible to manipulation to the hearts and minds of the American people. And, you know, there, what I was trying to remember Sean is sometime in, I think, August of 2015, I had one of my intel folks, we build a global intelligence infrastructure at Manden.

• 2:31:04Speaker 00

  So we had hundreds of people that spoke 30, more than 30 languages in over 30 countries. And one of these guys just walked in my room one day and said, Foreign intelligence from Russia is influencing the hearts and minds of people through these X handles, these Facebook walls, and he just unloaded. And it was like a hundred-page document. And I remember going, this feels wrong. I don't, this is before anybody ever talked about Russia's trying to influence the US elections. Well, no crap. Every nation is, right? With whatever they've got. I mean, if you're getting funding in your Liberia, wouldn't you maybe try to get a few votes for that side? I, I think there's no different, there's good people trying to manipulate hearts and minds for good reasons. But what we saw, and what I saw in the hundred

• 2:31:48Speaker 00

  pages, and we went public as a company about this with about 90 of those pages. But I remember, I think I literally flew back in and briefed Senator Warner. He was, you know, the Senate Intelligence Committee saying, I don't know what to do with this, but here's what's happening. Like, Facebook walls are being started. And when we went back and we traced it, I don't remember the details now, other than our guys were really good. They spent their whole time kind of tracing certain Russian actors. And they're like, this is them. This is them using these platforms. And all they did is amplify what already existed. They weren't even really making stuff. They're just like, let's push this issue. Let's push that issue. And they were just driving things. And people would ask, well, what side did they push? I'm not

• 2:32:31Speaker 00

  sure they gave a damn about any of that. I think they more cared about just push American people this way, both directions. You know, and I apologize, I don't remember the details as well as I did, you know, a decade ago. But I, I mean, that was the whole part of my job. It's literally, a guy just walks in my office, you're gonna want to read this. And me read it and go, what the hell do I do with this? You know? And then you just talk to people like, you know, we, we got Facebook involved. We got Google involved. There was a third, oh, X. And we did talk to their trust people. And all of us were like, yeah, this doesn't feel right. But we didn't know what to do. You know what it means? It was the earliest onset, in my opinion, of social media being used. And you can't tell what's artificial amplification versus real amplification. That's a problem, right? You

• 2:33:16Speaker 00

  can't tell if this is an issue that matters to Americans or not, based on the number of hits and number of volumes. And that stuff's feeding our algorithms and changing things. So, we gotta figure this one out. And I know a lot of work's been done since I inspected it. So I'm sure today, there's a constant whack-a-mole at these social media companies, say, that's a foreign actor, kill it, kill that. And yet, people don't want that to happen either, because it's censorship. But I can tell you, it's real. And if I were on offense against us, because of the First Amendment and your right to say anything you want, for the most part, you know, shy of screaming fire in a crowded movie theater kind of thing, we are susceptible to attacks Iran is not, and Russia is not, and China's not. They're

• 2:33:59Speaker 00

  not bastions of internet freedom. They control their press. And we can't really push back on the buttons there as effectively as you can push our buttons. So you even can look at our nation today, and many people describe it as divided. I, I can't tell, because I think people are amplifying the edge. And I think we're getting that through our media in such drastic numbers that nobody really knows what's normal anymore. And it's too easy to do, you know? So, I think if you go on offense against us, you just get us to tear ourselves apart. You know, that's what you do.

• 2:34:31Shawn Ryan?

  Psychological warfare.

• 2:34:33Speaker 00

  Absolutely. And you can, you know, and if, we've even seen that, you know, no matter what people say about the DNC breach of 2015, and the documents leaked in 2016, a lot of people don't like to talk about that. It became a political issue. But somebody hacked these servers, and somebody leaked documents. We'll leave it at that. I would say that the, to me, all of the facts did align, in my experience, to it really was the Russian GRU and SVR that did it. Just all the same tools. And what's interesting about those guys, by the way, they really used their own crap. So if you find their crap, it's them. I don't think they're leaking it out and, and giving their custom tooling to other people. And

• 2:35:19Speaker 00

  I've never seen a modern nation hack and then leak documents before. That was kind of the first. That was a escalation in my domain. China doesn't do that. They're not gonna hack Sean Ryan and then take all your email and throw them out on the internet. Russia seems to do that now. You know, it's a little bit different. But that's what I'd do. And then, what would stop you from hacking people like Hillary Clinton or Obama? They lost their emails before to what we would attribute as foreign actors. Leak, leak the emails. Make crap up in them. I mean, we are a culture now where I don't even know if you need the evidence to, to toss someone under the bus, you know? So, I think the way I'd go to war with the US is maybe what we're already seeing. You create

• 2:36:06Shawn Ryan?

  Division.

• 2:36:06Speaker 00

  Absolutely. You, you create discord. It doesn't matter. You don't even pick a side. You pick all sides. Just throw it at us. I, I would actually pick the two opposite sides and keep pushing both of them. And, and you see it. It's just, uh, it's gonna make it tough to lead in our country. And, and it's that freedom of speech. Everybody has a right to say whatever they want. And that, and so we gotta figure out how to protect that freedom while still showing, I would argue, the biggest thing we have to do is, uh, find artificial amplification of ideas and quash it. Does that make sense? Because you, you think it's like 50% of America thinks something, but it's like 3% plus amplification. But

• 2:36:47Speaker 00

  that's really hard to do. And in reality, the biggest guilty people for amplification are marketing people. You know, you have the, foreign intelligence will absolutely amplify certain ideas, but unfortunately, so do US organizations. You have to do this, or, you know, here's the cure. So it's really, it's a tough battle. And I, you know, you often study, you, you, there's a book out, you have kids now, so you're gonna have to read these things. And you look into the anxious generation, the same person that wrote The Coddling of the American Mind. And when I leave, I'll send you these books. It's a, it's a reporter. You don't even need to read the book, Sean, just look at the graphs. Ever since the iPhone came out and people use social media, depression goes skyrocketing

• 2:37:29Speaker 00

  thousands of percent. Suicides go skyrocketing hundreds to thousands of percent. They don't know anything other than, well, it all starts going bad in 2000, I think, seven, the year of the first iPhone. You don't blame Apple, but was the PC's ready for what we're actually developing? Did tech finally get out in front of us in a way where we couldn't manage the fallout from it? And to some extent, with social media, I think that's the case. It, it, social media in many ways, because of the anonymity behind it, does have the propensity to amplify the minority. It has that possibility. So anyway, it's a tough one. So if I'm on offense against the United States, I'm all hearts and minds. Fake media,

• 2:38:15Speaker 00

  synthetic media, even if you know it's fake, you won't get it out of your mind, right? You know, we even have an administration that uses it. And, and I think it's, uh, we're gonna have a future where we won't be able to tell properly between synthetic media and non-synthetic.

• 2:38:31Shawn Ryan?

  I think we're already there.

• 2:38:33Speaker 00

  Yeah, I think you're right. And so the hearts and minds, when you have a, a nation like us with this openness, I mean, we're pulling ourselves apart pretty, pretty hardcore right now. It feels that way.

• 2:38:42Shawn Ryan?

  I mean, you would even mention breaching companies.

• 2:38:45Speaker 00

  Totally.

• 2:38:45Shawn Ryan?

  And creating rifts.

• 2:38:46Speaker 00

  Oh, absolutely.

• 2:38:47Shawn Ryan?

  Within companies.

• 2:38:48Speaker 00

  Absolutely. Get the trusted business leaders. I, I hate saying these ideas publicly because you can do it. Discredit public leadership in credible ways. I don't even think you need credible ways, but just do it in credible ways. Meaning, say, you, you hacked someone and get their email, leak it. I've seen what that does to people, but leak it. Nothing stops you from adding to it. And doing it in a frenziedly sound way, or in a way where some, there's always a pundit that goes, oh, it's definitely real. I'm an expert, and that's real. It's just seem, and then you have somebody who really knows what to do and going, oh, this looks fabricated. I've worked cases where all the evidence was fabricated digitally. That was amazing to me. Couldn't believe it. At least, my opinion

• 2:39:30Speaker 00

  was, it was, and people agreed with it. In today's day and age, it's just too easy. We all have digital lives. We all rely on technology more than ever before. You have wearables that tell you how much you sleep, when you should take pills or drugs. You have wearables that might even, you may even have apps that require a prescription at some point in time, because, you know, you have something on your wrist that says you need more of something. You know, I'm sure it already exists. We rely on this text so much, but the unfortunate reality is, you can take it. You can take that data. You can skew that data. You can use it against people. All our, we have a whole generation, Sean, I think they, all their deepest thoughts is already written down, you know, in the texts

• 2:40:13Speaker 00

  they shared, in the photos they share. Maybe we've waived the right to privacy. And maybe that's the transition mankind's going through from the private life. And, you know, people didn't need to know our thoughts, did. Now, everybody knows everything we're thinking. And maybe we cross the, the chasm and just recognize it's okay to think whatever the hell you want, how dark it is, or how great it is. But we haven't crossed it yet. So.

• 2:40:38Shawn Ryan?

  Damn.

• 2:40:39Speaker 00

  Yeah. So that's what I would do on offense. That's why I taught, you know, when I was at the Naval Academy, we were talking about, and everybody was coming up with their neutron bomb, blow up GPS, and that's what we do before war. I'm like, how about erode confidence in your lawmakers and your business leaders? And how easy that is to do. And it is easy to do. One allegation creates doubt in a lot of people, whether it's founded or not. You know, so we need to have a better system to, uh, they call it a cancel culture. You know, it's tough.

• 2:41:09Shawn Ryan?

  Damn.

• 2:41:10Speaker 00

  Yeah, sorry. Dark stuff, man. We gotta end on a, we need some sunshine.

• 2:41:14Shawn Ryan?

  Well, I don't think we're gonna get any anytime soon.

• 2:41:17Speaker 00

  But the hypothetical is how do you attack us? What do we do about it? Uh, boy, is there ever a time for critical thinking, you know what I mean? And how do you teach that? How do you train that? And honestly, and I've heard you talk about this, and you're exactly right. And this is a cybersecurity episode. But when studying cybersecurity, it's directly related to ideological conflict, you know? Um, period. It really is. And people of opposite opinions gotta learn to talk and respect each other. The American way's gotta be, you can have a disagreement, still be fans of each other.

• 2:41:50Shawn Ryan?

  Yeah.

• 2:41:51Speaker 00

  You know? So we kinda...

• 2:41:52Shawn Ryan?

  We have definitely lost that.

• 2:41:54Speaker 00

  It reflects it in cyberspace, too. It really does. Like, it's, we used to be able to, and this is something that happened in my career. If you committed cybercrime in the United States, you got caught. And penalties were stiff. They were, a lot of people would argue they were really stiff. Cause judges and lawmakers didn't like the invisible crime and the anonymity of it. And they wanted to stop it because it was maybe too easy. So you have a severe penalty because of how easy it is. And, um, suddenly in the last few years, we're running the Western Hemisphere hackers, and they're not getting arrested. And I don't know why. You know what I mean? Like, in my career, I had at least a 25-year run. If you hacked from LA, oh, man, you got caught. If you hacked from anywhere in this country, you got caught. If you were doing it in Canada, you got caught.

• 2:42:38Speaker 00

  It's seemingly getting harder. And I don't know what's going on, but we do now have, in my career, we're responding to intrusions and the threat actors are on our continent. Isn't that weird? Didn't used to be the case. And hopefully, we get, you know, we get back to where we were. We push all unauthorized, unlawful internet-based activity. For the most part, we gotta get that. We ought to be able to control our backyard.

• 2:43:06Shawn Ryan?

  The internet wasn't built with your privacy in mind, but Glacier was. Open the app, tap connect, done. You're protected. Remember, privacy isn't paranoia, it's protection.

• 2:43:30Shawn Ryan?

  Do you ever wonder what it takes to make an episode of the Sean Ryan Show? In this exclusive studio tour, I'm taking you behind the scenes for an in-depth look at every part of the operation. From the editing room in the main studio to the spaces where we film Range Day content and more. You'll see how the show comes together, meet some of the people behind it, and get a closer look at the work that happens off-camera. When you become a paid member of the SRS Patreon community, you get more than just the podcast. Watch new episodes early alongside other members. Join monthly live shows with guest Q and As. And submit questions, just like you see on the show, for upcoming guests on the Protector tier. You'll also unlock exclusive Range Day videos,

• 2:44:15Shawn Ryan?

  behind-the-scenes content, and premium ambience videos that you're not gonna find anywhere else.

• 2:44:26Shawn Ryan?

  Join the Patreon community today and get access to the full experience.

• 2:44:34Shawn Ryan?

  Let's move into our four adversaries.

• 2:44:36Speaker 00

  Yeah.

• 2:44:37Shawn Ryan?

  Who are they?

• 2:44:39Speaker 00

  In cyber, you gotta go with Russia as a two-trick pony. Criminal and real foreign intelligence services, high capability. Uh, when focused, they are Wayne Gretzky on the penalty shot. You're right, they're, they're real good. Uh, China, massive scale and scope. You can add all the threat groups I tell you up, and they do not create the volume of compromise that the Chinese government does. So all of it together, criminal, Russia, North Korea, Iran, all of it together, doesn't add up to the steady tsunami of Chinese-based intrusions. And we only know what we know. But we look at, my old company, Mania, responds to over a thousand cybersecurity breaches a year, Sean.

• 2:45:22Speaker 00

  And these aren't the ones you're five minutes behind. We get hired when the scale and scope of the intrusion requires additional expertise. And that's us. And we're responding with companies that have great talent and great defense. And we're still showing up going, alright, how did they break in? And it is new and novel attacks. It is things that would work 99% of the time or higher. Um, and that's, you know, so we've gotta respond to those. And when we look at that, without a doubt, since 2004, China's led the way. We've always responded way more to breaches coming out of China. Um, they follow rules of engagement that I don't think are written down, but they are polite hackers. They don't delete your data, they don't destroy your systems. They steal things.

• 2:46:05Speaker 00

  Russia hacks for security reasons. And, you know, the SVR, in my opinion, follows probably the same rules our offense does. Um, but their FSB GRU are a little bit more broad than what we would ever probably allow. And, um, I've heard stories of Russian threat actors that hack for the government during the day and hack, you know, to make money at night. I believe it. Certainly, Russia condones all crime being done in the cyber domain, period.

• 2:46:34Shawn Ryan?

  But they, they actually, from what I've heard, both China and Russia, I mean, they have, put on classes, courses, schools.

• 2:46:43Speaker 00

  Oh, totally.

• 2:46:43Shawn Ryan?

  And in the schools, they, they, they actually just hack the US as training.

• 2:46:49Speaker 00

  Probably. I, I think with China, they'll hack not to make money, though. You know, not, not directly. Russia, they would. And so, North Korea only hacks to make money, it seems. I mean, in reality, North Korea's the only people in uniform badging into a building every day, or at least showing ID to get in, are hacking to make money because they fund themselves. Isn't that incredible? Uh, and have you heard about the North Korean IT problem? Where it's not hundreds, thousands of North Koreans have been hired by companies in the United States. Because we all started hiring remotely during COVID. We hire IT professionals, they speak English, they know what they're talking about, but they're actually North Koreans. And you hire them, and a couple of days after you hire them, they just steal all your crap and go.

• 2:47:32Speaker 00

  And sometimes, they keep working for you because you're paying them 130 grand a year. There's a, a podcast coming out by Nicole Perroth, and maybe you'll meet Nicole. She's a New York Times reporter. She's doing her story on this now. Her last podcast was on the Chinese cyber espionage campaigns. And she can do things I can't. Like, she'll say things I won't say. Or she'll talk to the victims and follow up, when I never got to do that. She saw the ramifications of companies losing their IP. I just saw what the attackers did and how to clean it up. Uh, she's doing the North Korean thing now. And when I first heard that problem, hey, North Korea, you know, has IT workers getting hired. I'd like burst out laughing, and there's no freaking way that this can be a problem.

• 2:48:15Speaker 00

  And, and I was at a conference with a bunch of heads of security from really reputable companies. And as soon as I was like laughing it off, like, five of them came up to me and started saying, hey, no, we have the problem. And when they explained what happened, I went, there's no fix for it. Dude, the fix is, you've gotta get people in the chair across from you and hire them. And the problem is, we literally hire internationally. Many US companies will hire people in Europe through Zoom, Google Meet, you know, or, or Microsoft Teams. And these are programmers that can answer the questions right. I mean, and quite frankly, they all even do the damn job for you. It just so happens you're paying someone who's working for a weapons of mass destruction unit. You know what I mean? Literally.

• 2:48:59Speaker 00

  And so, the North Koreans, you may hire them, and then they hack to steal Bitcoin. They're hacking to make money. Russia's hacking for spying and crime. China's hacking for spying and long-term economic gain through theft of IP. And Iran right now, you know, with, with what's going on, the excursion going on right now. The, um, the, it's like, the cyber domain was already a crappy neighborhood. Think of it as, it's like Camden, New Jersey. No offense, Camden, tough place. It just got five new gangs to it. You know what I mean? It's like cranking, as they say in Spinal Tap, crank it to 11. The cyber domain, if you can be hacked by an Iranian effort, they'll do so.

• 2:49:40Speaker 00

  But the way they break in right now is with, uh, user accounts and passphrases that are already on the dark web. Like, you lost your user ID and passphrase from some prior breach somewhere. Maybe your own company, maybe somebody else's. They tend to brute force login, and then they're gonna delete everything if they get in right now. Whoever they are, the gangs that wanna support the Iranian cause. So, um, yeah.

• 2:50:04Shawn Ryan?

  Do you think we'll see any retaliation from, in the cyberspace, from what, what's going on in Iran?

• 2:50:10Speaker 00

  I think right now, there's probably automated programs running on behalf of, uh, the Ministry of, uh, Security Intelligence and Security, MOIS, over there, that if it can break in, will. And then they gotta get a human operator to go do something with it. Um, it doesn't take a lot of bandwidth. If you can get, you know, you, you, you don't need a whole lot of satellite dishes to get something working for you there. Yeah, you'll see something. And it'll be real hard to tell, Sean, whether it's really Iranians or a proxy or just somebody who wants to hack for the hell of it and, you know, make some noise.

• 2:50:46Shawn Ryan?

  Which one of these, you know, out of Russia, China, Iran, North Korea?

• 2:50:50Speaker 00

  Yeah.

• 2:50:50Shawn Ryan?

  Which ones, who are you most worried about?

• 2:50:53Speaker 00

  You worry about them for different reasons. I, I would say sophistication now goes to China for how they first break in. How people break in will always change. China seems to be the forerunner of what's called zero-day development now. They can find attacks that are gonna work. And then, but when they break in, they're not leaking your email to the press. They're not extorting you. Those are really complicated. So I, I would say Russian criminal, really hard to go against. There's some now Western Hemisphere criminal gangs. There's a group called Shiny Hunters, there's a few others, uh, that they break in with social engineering. They'll like call your help desk, and help desk help people. And they have whole scripts written, and they're very bold. And they get one-time authentication into your network.

• 2:51:38Speaker 00

  And they, you know, then go in and, once you can get any beachhead in the cyber domain, usually that means you take the island. Um, you just need that one boot on the ground, and you'll do fine. So you need one way to access the network, you'll, you'll spread from that. Um, the Russian criminals are really hard to deal with. The US, now we have Western Hemisphere criminals, they're really, really hard. Um, Iran's gonna delete everything right now. Probably if they get in, that's not gonna be a fun cleanup. They're all bad. I mean, that's the reality, Sean. But the public humiliation does not come from being hacked by the Chinese. That, you know, those you can handle quietly and discreetly. I think it's the Russian and the, uh, North Korean and the, and the Iranians probably gonna go public.

• 2:52:22Speaker 00

  And that just adds complexity to your response.

• 2:52:25Shawn Ryan?

  Gotcha. Gotcha.

• 2:52:28Shawn Ryan?

  All right.

• 2:52:29Speaker 00

  How are you hanging in there?

• 2:52:30Shawn Ryan?

  I'm hanging in there. Scary shit. So.

• 2:52:33Speaker 00

  Right, yeah, we gotta get more optimistic.

• 2:52:35Shawn Ryan?

  As we move into your new company, I got a hot question. So you know Claude, I'm sure.

• 2:52:41Speaker 00

  Oh, God.

• 2:52:42Shawn Ryan?

  Anthropic.

• 2:52:42Speaker 00

  Yeah, totally.

• 2:52:43Shawn Ryan?

  So we had Claude Anthropic say, I scraped the internet to ask you a question.

• 2:52:48Speaker 00

  How did it do?

• 2:52:48Shawn Ryan?

  And here's what it came up with. In 2010, Stuxnet became widely known as the worst first, the world's first cyber weapon. The US and Israel used it to physically destroy Iran's nuclear centrifuges. That was 15 years ago. Now with AGI being reported as achieved, do you think AI is the new cyber weapon? And why?

• 2:53:15Speaker 00

  Fast answer, yes. You have to use all technology to advance crime, to advance war, to advance societies. It does all of it, does good, it does bad. The invention of the gun helped the hunter.

• 2:53:28Speaker 00

  But it also helped criminals to some extent, depending on your frame of reference. AI will make the speed of intrusion, take the human out of the loop. That's what it'll do. It's too fast at discovering vulnerabilities. The, so I started Armadon and combined what's called red team consultants, the best red teamers in the world. These are folks that get paid to hack into Fortune 500 companies and see if you can stop the train or corrupt the food or shut down the grid or steal the email from the CFO. We took those guys and we're still hiring a bunch of them. And we paired them up with AI native developers and said automate what we humans do.

• 2:54:13Speaker 00

  And we started this company September of last year, Sean. Here's what I can tell you happens already. If somebody tells us, they hire our red team and says, take a look at this custom application. You build an application that you gave me here. Someone will say, take a look at this application, can you hack it? What used to take us five days with two smart humans is five minutes to 10 minutes with AI now. That already exists today. So what you see is the compression down. But it gets unfortunately more daunting. When we go on offense as humans, we only find one way in at one point in time to achieve the goal you've told us to try to achieve. Try to shut down the assembly line, try to get to our IP.

• 2:54:58Speaker 00

  We find the fastest path in, we prove it, and then you fix that. With AI, we launch 100,000 threads coming at you. It finds all paths in almost immediately, but it does a few things humans can't do. Has total recall the next time we ask it to do that. So if there's a vulnerability, it found that company A two months ago. It instinctively already knows, look for that again, just in case you didn't fix it. It's the speed, though, the fact that AI can think, learn and has total recall and can be trained. It will be the cyber weapon in the future, just like no different than drones. If you think you can fight the next war and win, you better have software that thinks, learns, and is secure.

• 2:55:43Speaker 00

  And you better hope it thinks the fastest, learns the fastest, and is the most secure to win that war. Or you're gonna lose. And that's gonna be cyber domain, that's gonna be autonomous planes, drones, you name it. So, yeah.

• 2:55:56Shawn Ryan?

  There's a follow up.

• 2:55:57Speaker 00

  Got it.

• 2:55:58Shawn Ryan?

  On a different note, by 2027, every new car in America will have an infrared camera pointed at the driver's face, and that's by federal law. From a cyber security, from a cybersecurity expert's perspective, what's your honest take on this? Does this leave vulnerabilities for our adversaries to hack American vehicles?

• 2:56:18Speaker 00

  There's been an equal and opposite compelling argument inside security since the dawn of time. If we're distributed, it's harder to beat us, but it's harder to defend us. If all are eggs in one basket, it's easier to defend, but easier to beat us. Does that make sense? Right now, we're putting data about everything everywhere. I mean, I grew up, there were no cell phones in college. Otherwise, I would never be able to be a Supreme Court justice. You know, right? Evidence would exist. Now there's cameras everywhere for everything.

• 2:56:50Speaker 00

  There's just no question, even though it's gonna get harder and harder to compromise things. I believe that. You know, the internet was pretty damn open in the 90s and I, you know, and I've lived that. It was pretty damn open in 2000, really till 2020, 2021. And we're, we're in a whole different world. AI is gonna help us write more secure code, there'll be less vulnerabilities. But at the same timeframe, should someone break in? I think the impact's gonna be far more than what it used to be in the past. You know, early on in this interview, yes, what was the worst breach we saw? And I remember going, I always hated it if a flag officer lost his email. That's just weird, you know, because they do important things. Fast forward to now, with wearable devices and our dependency on, on everything.

• 2:57:32Speaker 00

  Whole businesses can't operate if the internet goes down. So

• 2:57:40Speaker 00

  AI will be the offensive choice. And unfortunately, because of the speed of compute, AI is gonna have to be the answer on defense. And that's why Armadon exists. We will be the ultimate offense built by the good guys to train and automate the defense. And every company's gonna need a different defense. We're all gonna write our own apps. We talked about Anthropic and Claude, talk about magic. I had a computer science degree, I hate to say it. Don't tell your kids to get a computer science degree, okay? Heck, ask the CEOs of these companies, or you know, ask Dario at Anthropic. Hey, you want your kid to learn computer science? You'd probably say, ah. It's like learning Latin. No one's gonna speak it. The computers are gonna do it for us.

• 2:58:24Speaker 00

  The whole goal of Anthropic is to have Anthropic's Claude build the next Claude. At Armadon, we wanna get our AI attacker to be so good, it's building its next AI attacker. They self propagate. We, and the unfortunate reality is we have to build it or the adversary will. And it is the only way to get to autonomy. But back to your original question, yeah, we're gonna have cameras in the cars, cameras on the streets, cameras in our homes, data everywhere. I think it'll be harder to break into all that stuff, but should the break in occur? I think the impact will be grave, more grave than in the past. Now,

• 2:59:01Speaker 00

  I'm thinking today, two years from now, you should be driving a car that has something in it that instantiates normal Sean driving. And if anything happens, something very bespoke to you can recognize and say, that's not him. That's not what he wants, that's not what he does. And it may save you, it may do the opposite of that. But we are gonna have defense that can thwart attacks we've never seen before. You know, and, and do it in a way that a human's not in the loop for. Something's asking this system to do something it's never done before. They automatically get stopped and ask for a human in a loop to say, hey, listen, this has never happened in this car before? Do you really want it to happen?

• 2:59:46Speaker 00

  Or this never happened on your computer before, or on this camera before, or on your HVAC before? Do you really wanna allow it? Stuff like that'll exist.

• 2:59:55Shawn Ryan?

  Interesting.

• 2:59:56Speaker 00

  And then you'll, you'll pick in your house, you'll say, I wanna be prompted every time someone's, you know, accessing my camera. Other people, it'll get trained specific to them. It'll get one time, human in a loop, go ahead and allow it to happen. And the, and after like three times where the user says, go ahead and allow the program to do something, it'll just do it from their own end. We'll all have bespoke software. Trained by you. Your phone will end up being trained by you. The AI on your phone will know you, be personal to you.

• 3:00:24Shawn Ryan?

  There's gotta be vulnerabilities within that alone.

• 3:00:28Speaker 00

  Well, yeah, you often wonder, now we're talking to true AI Skynet story, right? One brain in the sky doesn't mean we all share one brain over time. And, and that brain will always reflect the, the culture of those who built it to some extent, right? And then all AI models, no matter what anybody says, we, we, we had to at Armadon build a way to, as soon as they updated the Frontier Labs, their models, we plug them right into our shooting range and see which ones are the best at the things we normally do now. And they'll flip and flop all the time, or they'll be about equitable. And we test them on the range, as they say. But these things, you test them day one, you test them day 20, they're already different. They're like, they're like organisms that grow. These models learn and change and sway in ways that are different.

• 3:01:11Speaker 00

  Like how we, what we get out of a model today could be totally different tomorrow. Not totally different, it's always, you know, kind, you know, to me, I haven't gotten hallucination in a long time. And I use Gemini a lot and I use Claude a lot. I'm a little bit less open AI. And I use it for real stuff every day. It's common, I'll have like Claude run in on something that I want, because it's great at making PowerPoint slides. And I'll have Gemini making some graphics for me or answering questions. I'm using them both.

• 3:01:35Shawn Ryan?

  Interesting. Interesting. Where did the motivation come from to start Armadon?

• 3:01:40Speaker 00

  Has to exist, right? It, it's, I, I, two, two things. One, I wanted our, the first motivation is, you know, my company got bought by Google and I'm an entrepreneur. You know, some people would say, once you're an entrepreneur, you can't sell your baby. I had no problem being a public company and getting bought. Company was no longer mine, I was the face for it. But if you're a great entrepreneur.

• 3:02:03Speaker 00

  At some point in time, you're also the owner, but you know, I had no problem letting it go. I was bought by Google and I went in like a lion, super like Google can change the world. It really can. The resources it has, I just didn't fit, you know? So I was a little upset in a way that I didn't fit there because I know the power and capability of that company or Amazon or Microsoft. We have great companies. They can do great things in cybersecurity and you want to be a part of that. But one thing they would never do is offense and I respect that. I get it. I wouldn't fit with a large brand. And I thought to myself, the exact thesis I had was the first intel on the internet was terrible. You had to find what Symantec missed and give it to them. The second intel on the internet, I feel I created, we'll respond to every breach that matters.

• 3:02:48Speaker 00

  And people were like, that's not even a, that's not even a market. There are no breaches. Oh, there were. We responded to all of them and we learned about the new and novel attacks first so that we could build better defenses against them. Well, the third wave of intel is we're going to create the attacks and we're going to create them before the bad guys do. And we're going to fix your problem before they come out. It's almost, you know, I guess they call it gamification in a way for viruses. But if you can create the viruses that are coming 10 years from now and inoculate today, we're ready, you know? Same thing here, but we have to build it because A, it's going to be what we're up against. And if you want to know if a bulletproof vest works, you got to shoot a bullet at it. We're going to be shooting bullets at networks. And if you withstand our bullets, the assumption and what we want to become is that seal of approval.

• 3:03:33Speaker 00

  If Armadine can't break in, oh, you're good to go. Brief the board, let them know. There's no other way to reduce your cyber risk and I actually believe that. So we started Armadine so that we can dry run and practice what we're up against. And it's common. There are no risks or repercussions to the folks stealing from us, hacking us. It's just, we haven't shown a, a means to impose risk to these threat actors.

• 3:04:00Shawn Ryan?

  So you get, you got into it a little bit, but what is the future of cyber warfare with AI coming online?

• 3:04:07Speaker 00

  Oh, boy. You will have systems dedicated, I think, so the general models are what are called horizontal models, like Anthropic's cloud is a horizontal model, right? OpenAI, horizontal model, X has a model, Gemini for Google. There's going to be very verticalized models where you train them and learn from these huge models that have read every book every human's ever written or watched every YouTube video of everything. You've contributed to models probably and you don't even know it. And you're going to, you're going to have offense against very specific things. Like we're going to end up creating models that are offense against cell phone, offense against drone, offense RF against drone, offense against Windows, offense, like deep

• 3:04:49Speaker 00

  models that are actively working the same way a human did, but at thousands and thousands of times the speed and doing the same tasks we did to try to find vulnerable code, vulnerable IP, you know, it'll all be automated and specialized for the targets they go after. It's just going to happen. And, and the sad thing is we had to build Armadine because it's automatically going to happen. Every shift change, I lived through this, Sean, in 2000, there was a guy named Alexei Ivanov and a guy named Vasili Gorchkov. At the time in 2000, Alexei was 18 in Chelyabinsk, Russia. Vasili was 25 in Chelyabinsk, Russia. These guys extorted hundreds of US companies.

• 3:05:34Speaker 00

  They would break in and what they did is they scripted everything. They even scripted, we got to do the forensics on their laptops. These two Russians were lured to the United States for jobs and the jobs they got were with the FBI. The FBI lured them over. They flew into Sea-Tac Airport or Tacoma Airport and they got arrested. And when you look at what they did, it was at a time when PayPal was just coming out, eBay was getting big. These guys had monetized that they could steal credit cards and they wrote software that would sell fictional items on eBay, buy it with stolen PayPal credit cards, and they were making money selling fictional stuff. And the whole thing was automated.

• 3:06:16Speaker 00

  They could literally hit buttons, script it and walk off and come back with, we made $72,000 selling stuff we don't even own and buying it with fake stuff.

• 3:06:25Shawn Ryan?

  Holy shit.

• 3:06:26Speaker 00

  Happened. So every shift change is embraced by every personality. AI is going to be embraced by the criminal element and it's coming. And we can't withstand it unless we build it ourselves and figure it out. So I always believed the best way to build a safe at a bank is get the best bank robber to build it for you, you know? You got to know how to rob banks to investigate a bank robbery. And I had the privilege of training thousands of FBI agents to FBI Academy. So when it came to cyber, we taught them how to break in. Get a sense of what you're up against, the actors, why they do it, how they do it. And now let's investigate what they did. And you couldn't really just start with, let's just investigate it. It just wouldn't work. You had to give them that sense of doing the criminal act and then investigating it.

• 3:07:11Speaker 00

  It's going to happen in cyber. We have to build the offensive cannon. So Armadine is going to build the cyber cannon. We're going to shoot it at the best companies in the world. And those companies, if they can withstand the blast, they're good to go. And if they can't, we're, over time with no human in the loop, building fixes to however we broke in. If we find a permeable membrane and we get through, you're going to patch it, you're going to compensate for it. And that is the future. And oddly enough, that future is scalable. Finally, you can, once we build the Aon offense versus Aon defense, we can go down to the utility in Alquippa, Pennsylvania and say the waterworks is not going to be compromised. And the small mom and pop electric company in Missouri will not be compromised because

• 3:07:56Speaker 00

  we can now instantiate a national risk policy through an offensive cyber cannon, training the defense. And it's just software. You're, you're not going to be people dependent. It really is going to happen. And will it have flaws? Will we get beaten? Yes, there will be, every once in a while, be something on offense that gets through. But you can literally use the analogy of drone swarm in the cyber domain. Like you're going to, you're going to send 3,000 drones at a city and we can only shoot down 2,990, you know? We're at the same problem in the cyber domain. We're trying, but the best part of it is it will be automated and it's actually going to raise the tide for cybersecurity for most people.

• 3:08:39Speaker 00

  And then the bigs will always have their own team still doing stuff to help secure them.

• 3:08:44Shawn Ryan?

  I'm just curious and I'm sure it's very different, but on average, how many vulnerabilities are you finding per company? And how fast do you find them with these AI agents?

• 3:08:56Speaker 00

  As I sit here today, it's never taken longer than a day to break in.

• 3:09:00Shawn Ryan?

  Shit.

• 3:09:01Speaker 00

  Yeah.

• 3:09:01Shawn Ryan?

  With any, is there anything you haven't been able to?

• 3:09:04Speaker 00

  Yeah, and here's, and here's what's interesting. So I can tell you this, I still think the best findings we had were by humans, but that's going to go away within a year. And nobody knows how fast, but AI keeps surprising us. But here's how we broke in the first time. A Fortune 100 company, it literally said, hey, break into us and see if you can break this custom application we built, very important application. We have an AI agent, they didn't even expect us to do this, but we've done this a lot. We had an AI agent go out to the dark web and go to a bunch of password brokers and we found 440 or so accounts that were the domain of this company. And all we did is tried all of them at human speed, not AI speed, because AI speed is too fast. You can rate limit and block it.

• 3:09:48Speaker 00

  Cisco routers can block fast attacks. We just logged in. Seven of the accounts actually just logged into the app. We just logged in and this is an app you don't really want people logging into. And on one of the thing, and we did it all, human speed, you saw a browser just kind of pop up on our agent's screen. It was acting like it was a human. Tried all the accounts it found, it gets in seven times, but on one of them, the app we broke into prompted, you don't have multi-factor authentication turned on. Would you like to register your phone? So we did. So now we literally hacked the company by stuff we found on the internet. And, but humans wouldn't have found it because it's really a pain in your arse. If you scripted, it's too fast and you get blocked or detected. If you have a human login every time, it takes days and it's annoying and they're

• 3:10:33Speaker 00

  going to fat finger stuff. We just all automated, no human intervention, hacked the company. That was it. And that works, I would have bought that when I was a CEO. I would have been like, I just want that. I don't even need you to try to hack my app and break in the old way with the vulnerability. Just tell me if you can log into my damn network. Because that stuff changes. Everybody thinks, oh, we have two factor authentication, meaning user account, passphrase, and then, you know, the digits to your phone or, you know, your fingerprint and all this other crap. I would want to, you can't, there is no magic wand that says, do we have two factor everywhere? It doesn't exist, but this would prove it. The attacker's view of your network matters and AI can comprehensively do that. So I'm not convinced, just yesterday I got a text, I'll show you when we're off camera,

• 3:11:17Speaker 00

  of what we did to a company yesterday. Hundred percent ownership of every machine, day one. We got into all of it. And here's the secret in cyber. So for everybody out there listening, the hardest part is getting in from the internet. Every company does everything they can to, well, at least above the poverty line in the cyber domain. The one A enterprises do about everything they can to not have a breach. They don't want to deal with it. And they're truthful about that. They hire good people and they try. If we can't get in, I would say over 90% of the time we do. But once we get in, it's easy as hell. It's all downhill skating at that point, you know? So Sean, that's just the problem right now. Everybody's built their Magino line and they've hardened that as much as they can.

• 3:11:59Speaker 00

  If we get around it, oh, it's just waltzing in the Paris, you know? It's too easy once we break in. Everything we need is on the very first machine we get to. And, and usually the Achilles heel is every company has one account that works everywhere so you can patch things, so you can fix things. You can't keep that account from us. That's just the Achilles heel. So it's funny, the very thing you use to make sure you're secure is probably the very thing that we get every time to make you insecure, you know? So anyway, we will get better. Everything, as bad as this whole three hours or so is gone, everyone's getting better in cyber defense. We are in a tough time.

• 3:12:39Speaker 00

  The offense is still uniquely advantaged. That's the problem. I think it does change in under two years. To equitable. I don't think defenses, the only advantage defense has is we should have access to the software we build to make it secure before the offense can try to hack it. That's our only advantage. We can secure our code before we publish it, get it out of the market. And the, and the anthropics of the world are making that a reality. Microsoft, Anthropic, Google, really are making it so the code we're writing is better today than worse. That is happening. So, in theory, it'll get better, Sean.

• 3:13:15Shawn Ryan?

  That's good news.

• 3:13:16Speaker 00

  Yeah. It's just, we're going through, two years from now, this dialogue would be different. I would say, you know what, we're stopping 99.9999999% of attacks now. It's just the best in the world. We never get to stop them. They are, they're scoring.

• 3:13:31Shawn Ryan?

  Wow.

• 3:13:32Speaker 00

  Yeah.

• 3:13:33Shawn Ryan?

  Well, Kevin, we're wrapping up the interview.

• 3:13:35Speaker 00

  Yeah, sure.

• 3:13:36Shawn Ryan?

  This has been, I've learned a ton.

• 3:13:38Speaker 00

  Really?

• 3:13:39Shawn Ryan?

  Yeah. So, thank you for coming.

• 3:13:40Speaker 00

  Thanks.

• 3:13:41Shawn Ryan?

  I have one last question.

• 3:13:42Speaker 00

  Yeah, sure.

• 3:13:43Shawn Ryan?

  If you had three guests to recommend for the show, who would they be?

• 3:13:46Speaker 00

  Well, I love Bruce Springsteen.

• 3:13:49Shawn Ryan?

  Bruce Springsteen. All right.

• 3:13:51Speaker 00

  Uh, three guests for your background. If you do another one in cyber, the best person that can bring this to everyone is Nicole Pearlroth, the New York Times reporter, I told you. She is exceptional on camera, and she tells better stories than I do. Yeah, because I came up through computer science and had to solve the problems. I had less of a humanity side to me. When I met CEOs, I was always like, hey, man, suck it up, deal with crisis. She's better at it. She tells better stories as to what China did, uh, what, and what the North Koreans are doing. She's more personable, more likeable. So, she's a great one for cyber. Those are the, you know, and, and I don't know, you're doing a great job. People like listening, like, I listened to Kent, the guy that you used to have.

• 3:14:33Shawn Ryan?

  Joe Kent?

• 3:14:34Speaker 00

  Yeah, I thought he was great. I'm apolitical. I want the United States to be successful. I thought he did an incredibly good job doing the same, being apolitical. People probably hate the guy. I'm probably getting in trouble saying it. I just listened to it and thought, okay, I learned something. You know, you, you listen to, you know, bottom line, you get both sides. You get, you get people that at least are well-intentioned.

• 3:14:53Shawn Ryan?

  I think that's important. I get a lot of credit for it.

• 3:14:55Speaker 00

  Yeah, I mean, it's, uh, it's important. So, anyway, I'll give you those two. Springsteen.

• 3:14:58Shawn Ryan?

  Perfect.

• 3:14:59Speaker 00

  He's getting old.

• 3:15:00Shawn Ryan?

  Kevin, I really appreciate it.

• 3:15:02Speaker 00

  Thank you. Hope to see you.

• 3:15:03Shawn Ryan?

  No matter where you're watching The Sean Ryan Show from, if you get anything out of this at all, anything, please like, comment, and subscribe. And most importantly, share this everywhere you possibly can. And if you're feeling extra generous, head to Apple Podcasts and Spotify and leave us a review.