Galvanick CEO Josh Steinman - spies, stuxnet, cyber, and securing critical infrastructure

Joshua Steinman is the co-founder and CEO of Galvanick, a cybersecurity company building tools to secure industrial infrastructure and AI systems. In this episode of World of DaaS, Joshua and Auren discuss: Foreign spies in tech companiesVulnerabilities in critical infrastructureLessons from Stuxnet and UkraineBuilding resilience against cyber threats Looking for more tech, data and venture capital intel? Head to worldofdaas.com for our podcast, newsletter and events, and follow us on X @wor...

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:02Auren Hoffman?

  Hello fellow data nerds. Welcome to World of DAS. I'm your host, Orin Hoffman, CEO of Incubate and GP of Flex Capital. Discover more episodes, get weekly data as a service news, original content, articles on data and more at worldofdaas.com. That's world of DAS, D-A-A-S, dot com. Hello data nerds. My guest is Josh Simon. Josh is the co-founder and CEO of Galvanick, a cybersecurity company building tools to secure industrial infrastructure and AI systems. Previously, he served as the Deputy Assistant to the President and Senior Director of Cyber Policy at the National Security Council under the first Trump administration. Josh, welcome to World of DAS.

• 0:45Speaker 01

  Orin, great to be here.

• 0:47Auren Hoffman?

  I'm super excited. Now, I'd love to dive in on spies. I assume every big tech company unwittingly employs tons of foreign spies. What do you think's the rate of infiltration? Is every good intelligence agency around the world in every major tech company?

• 1:05Speaker 01

  The benchmark that I have for this, it was a report to the Twitter board that was put together by their chief security officer, who I believe at the time was a guy named Mudge Zatko during Elon's purchase, pre-X. And what he essentially admits in that report is that they found instances of numerous nation-states that literally had straight-up assets inside the company. Saudi, India, I think the Israelis, a few others. Just yesterday, someone was talking about how one of the Israeli firms that was being used by Twitter to verify identities was then turning around and working with a doxing network in Europe to go after people.

• 1:50Speaker 01

  So the whole point here is just, there's a lot of surface area. And when companies don't even have it in their mind that, oh, there might be other interests at stake in this person's employment, it just opens up a world of opportunity.

• 2:04Auren Hoffman?

  And the person could be like a full on spy. Or I know in some of the cases in the Twitter, they were being either bribed by agencies or maybe their family was threatened or something like that to give them information.

• 2:17Speaker 01

  One of the most interesting aspects of having lived in that world for a long time is that you realize just how dangerous mirror imaging can be. Mirror imaging is this concept where it doesn't even have to be in the intelligence or foreign policy world, but we project onto other parties, our own assumptions and our own patterns. You think, oh, the intelligence community, you're an American. And you're like, oh, that person's the NSA or the CIA or this or that. The United States is a country of over 330, 340 million people, 380 if you count the people that are here illegally, but they don't count, so we'll go with 330. 330 million people.

• 2:58Speaker 01

  And essentially the control schemas that we have are very different than almost any other country. And so I often like to remind myself that espionage is conducted for a reason. And it's not even the reason that those organizations inside the United States conduct espionage.

• 3:18Auren Hoffman?

  Cause it could just be like to win a contract or something or whatever. There could be a lot of different reasons.

• 3:22Speaker 01

  Yeah, to achieve national objectives. And then you sort of ask yourself, well, what is a nation? You look at certain countries and there's 35, 40, maybe 50 serious clans or families that run that country. And so when you ask what's their national interest, it's going to be the national interest of those families. Those families probably control major industry in those countries, finance, et cetera.

• 3:49Speaker 01

  So when it's like, what's the purpose of an intelligence community in that country? In many ways, it can manifest itself in different ways. It can manifest itself in very prominent families that have children that come to the United States. And then those children, maybe they were born here. And till the Supreme Court decides the birthright citizenship case, those folks have US citizenship. They get jobs in very prominent companies. And then they essentially guide company policy or process in a way that is favorable to their family, their clan, maybe their country. You have to remember that it may not look like what we expect it to look like.

• 4:31Speaker 01

  It may not look like some intelligence officer going to someone and being like, hey, I need you to take this thumb drive and put it into a computer one day and then don't ask any questions and never tell anyone again. Sure, it'll look like that, but there are going to be other cases where they're like, if you see examples of people insulting this, that, or the other, you should really use your position to try and prevent that or make policy against that so that it doesn't happen because it offends our sensibilities. You have to remember that if you were to go onto Google right now and start searching around for stuff related to Tiananmen Square, you have to ask yourself,

• 5:11Speaker 01

  have the search results around those terms been altered or in some way affected by folks algorithmically, who may have an opinion on those types of topics? And the answer is, what we see in the Twitter files was absolutely. And so I extrapolate that out to essentially every big tech company because the targets are just too juicy.

• 5:37Auren Hoffman?

  It could just be like, cause chaos on Slack, complain about things. Let's bring random grievances up.

• 5:45Speaker 01

  I mean, that's the classic CIA manual for trickery and deception that was used during the Second World War and given to partisans behind access lines to encourage them to sow chaos and throw sand in the gears. That's like a particular type of operation. I'm more talking about you run operations to achieve national objectives. So the point that I'm making is there may be people in these company, I guarantee you there are people in these companies that are there that are achieving national objectives that doesn't match up to what an American would say, oh, it's an intelligence operation. It's like, uh, ish.

• 6:24Auren Hoffman?

  Essentially, what they're doing is they're often guiding a very large company, whether it be a Google or Facebook or whatever it might be, Microsoft, they're guiding a very large company to help achieve the ends of their country or their clan. And obviously, this is usually not in the company's best interest to do that. How do companies guard against this? What can they do to reduce that? Obviously, you can't go all the way to zero. If you had somebody hacking, you know, you'd want to reduce that. What can you do to reduce it?

• 6:56Speaker 01

  It's really hard. I think you just have to be very mindful of who you're hiring, where you're putting them in your company. Certainly, there are mechanisms that are used across the US government, and in fact, they're used in tech as well, where you'll have code reviews, reviews of new commits, et cetera. Part of it is that you just have to be realistic about who your personnel are.

• 7:20Auren Hoffman?

  But you can make an assumption that every intelligence agency in the world that's decent has assets in OpenAI.

• 7:28Speaker 01

  Oh, no question. I would be willing to bet a large amount of information that OpenAI is completely penetrated by multiple intelligence agencies and has been for a while.

• 7:38Auren Hoffman?

  They have to be. Why would you not do that if you're a smart intelligence agency?

• 7:42Speaker 01

  No, I guess the point that I'm making is what can you do? Well, you need to be realistic about who your employees are. And then you have employees that may not have the same interests reviewing each other's work. You wouldn't pair people up that maybe have similar pejorative interests.

• 8:00Auren Hoffman?

  When we think about industrial companies, industrial companies could have lots of problems. There could be kinetic things that happen with industrial companies. If you think like power plants or factories or other types of things. And I imagine a lot of these companies just are not that hardened. Hackers can attack these companies.

• 8:19Speaker 01

  Interesting Wall Street Journal article dropped last week where sources from the Biden administration were relaying to the reporter that in December, they had high level talks with the Chinese. And the Chinese essentially admitted to the Biden reps that they had prepositioned malicious cyber tools on American critical infrastructure and had been for some time. Now, if you read or listen or watch the annual threat assessments that the directors of national intelligence have been giving to Congress every year for over, I think it's seven years. Each one has said, hey, with increasing amounts of clarity

• 9:02Speaker 01

  that foreign adversaries have been prepositioning on American critical infrastructure. It's one thing for like our intelligence community to say that to Congress, even in the open, even in unclassified forum. It's quite another to have the adversary themselves sit down with you, as reported in this Wall Street Journal article, and say, oh yeah, we're prepositioned on your critical infrastructure.

• 9:26Auren Hoffman?

  It's used as a bargaining chip or a threat or something. I mean, obviously, we already knew that. It's not like we didn't know that.

• 9:32Speaker 01

  It's one of these very interesting. People say, oh, it's the wilderness of mirrors. They'll talk about how countries can and do interact with each other. It's like one thing to know something about someone else. It's another thing to know that they know that you know it. But it's then even like another thing for you to know that they know that you know. I know that's weird. You have to think about it in terms of what's going on in the social interactions. And can you sort of feign ignorance? Because in many of these cases, you have these weird interactions with people. You never know if someone like really gets it or not. You're saying things, you're trying to be esoteric, you're trying to drop hints,

• 10:15Speaker 01

  and you imagine that they're sort of picking up what you're putting down. And so the act of like really declaring something very openly, it's unnatural. It's not normally done.

• 10:24Auren Hoffman?

  Especially in the world of foreign policy, intelligence services.

• 10:28Speaker 01

  For a senior Chinese official to be like, oh yeah, we're prepositioning your infrastructure. You guys come to the aid of the Taiwanese, we're gonna take it down. I've been making this joke even in public for many years. How do you know when the Chinese are gonna invade Taiwan? What's the first thing that's gonna happen?

• 10:43Auren Hoffman?

  I assume all of our power is gonna go out and our internet and.

• 10:46Speaker 01

  Exactly. The joke is traffic lights on Oahu stopped working. So that's a joke, but it's definitely another thing for like a senior ministry or state security official or a senior. The Chinese Communist Party in China is the entity that has an army. China as a country doesn't have an army. It would be like if the Democrats had an army. They call it the People's Liberation Army and Navy and all these other things, PLA and PLA AF. It's a totally different thing for a People's Liberation Army officer to just sit there and be like, oh yeah, we've got that and we know that you know that, but now we're telling you that we know that you know that. And we know that you know that we know that. So we can all speak frankly here about what we expect you to do or not do.

• 11:29Speaker 01

  So if you think about that, you just realize you just go down the list of everything that we have in the United States that enables us to not only project force into the Pacific or into Europe, but also like live a normal life, water purification, energy, power, sewage, all these things. What we've seen over the past few years is that a lot of these types of infrastructures are very vulnerable.

• 11:59Auren Hoffman?

  It's hard to get better at defending it. When you're a financial institution like a bank, you're getting attacked all the time and they're actually trying to execute the attack by stealing money. That is usually the goal of the attack on a bank. And so therefore you have a lot of experience with defending and understanding and you know, often when you have been successfully hacked because you see money go and there's all these things. Whereas with a power plant or a factory, you don't have that feedback loop to know. They're only going to take it down in an extreme circumstance. So I imagine it's just much, much, much harder. First of all, I assume that the targets are softer to begin with. And then it's much harder to defend than a bank.

• 12:39Speaker 01

  One of the reasons that they're such challenging environments is because they sort of get built once 10, 20, 30 years ago and then operated in perpetuity. And surely there may be upgrades, things like that. But this isn't an infrastructure. These aren't products. These aren't things that get renewed regularly. It just creates a lot of opportunity. There also really isn't an incentive to protect them. Unfortunately, that's like one of the most depressing things to realize is that you can look at a bunch of industries. You can look at rail, which is really critical. You can look at water to some degree, power. The energy industry has done pretty well, actually, I really have to admit. Even the defense manufacturing industry, there's really no incentive

• 13:23Speaker 01

  to protect the factories that make the stuff that we use to defend the country. And if you look at rail and water, two very prominent examples of very basic cybersecurity guidance coming out from the regulatory agencies that oversee those industries, and the industries themselves just hitting the ceiling, objecting, going to the Hill. In various cases, they're just like, this would be completely unreasonable. Just asking for a basic staffing and spending. It's really hard. It's like the sort of principal agent problem because the minute that something happens, everyone's going to instinctively just say, oh, the government's going to take care of it. When in reality, the thing that should have been happening all along is these

• 14:08Speaker 01

  companies should have been paying more attention. And not to say that it's easy for them. The way that I would sort of scope this whole thing is that we have been enjoying the benefits of digitization for probably 40 years now, longer likely.

• 14:26Speaker 01

  And what we should have been doing is pricing in the risk as we enjoyed those benefits. And we haven't been, we've basically just been free riding off them. The piper's coming. We just haven't created architectures that enable us to try and soften the blow.

• 14:44Auren Hoffman?

  What did our adversaries learn from the Stuxnet hack? There, we essentially were able to go into some older Siemens turbines, able to get those turbines to maybe rotate faster than they should have been rotating. I imagine a lot of our adversaries went through the code, understood that code, maybe even use that now against our own stuff.

• 15:07Speaker 01

  Those are centrifuges being used to enrich uranium for the Iranian nuclear program. The allegation is that code was deployed through various and creative and diverse means to essentially overwrite some of the instructions, give them new instructions on how fast to spin. And that caused a cascading reaction that destroyed a bunch of those machines, which were very sensitive and had likely been smuggled into Iran to do that. The big lesson there was just that the physical world is just as vulnerable to cyber attacks as the digital world. Now, that was a very exquisite operation, whoever ran it.

• 15:50Speaker 01

  And so I think that in the intervening nearly 20 years, think about that, 20 years, Wikipedia says development since 2005, public acknowledgement or uncovered in 2010. So even then, okay, 15 years, but you got to imagine happened before then. So 20 years, you have this very prominent example. Because think about it this way, and this is how we used to talk on NSC in very unclassified generalities. Here's an even better example. How else would you have accomplished that mission? There's a great operation, probably one of the greatest special operations missions in Second World War history. The Nazis were pursuing a different strategy to achieve a nuclear weapon.

• 16:32Speaker 01

  They were using heavy water to create nuclear reactions that they could weaponize, put onto bombs. The Nazi program was relying on deuterium, which they were using to catalyze the nuclear reaction for the bomb. So in order to produce it, it's incredibly energy intensive, and they had to have lots of power. And one of the places where they were doing this was in Norway, where they have enormous hydropower stations. So hydropower, basically just like free energy. If you can harness it right, if you can build these stations the right way, and it drives down your kilowatt hour cost.

• 17:17Speaker 01

  Norsk Hydro is a company that has built a bunch of these power stations in Norway, even during the time of the Second World War. And you can do a lot of things with that, including aluminum smelting, which is very energy intensive. And so the British Special Operations Executive put together a group of Norwegian partisans, trained them in a whole bunch of skills, parachuted them into the Norwegian hinterlands, and had a bunch of teams converge on one of these facilities in order to destroy it enough to ruin the heavy water manufacturing process that the Germans were running. I think the op took over a year to plan

• 18:02Speaker 01

  and a month plus to execute, lives, money, et cetera. So one year, call it tens, if not hundreds of millions of dollars. Fast forward 70 years later, and it's a line of code. So you have to imagine what's going on is we're creating optionality for our war making apparatus to accomplish things that would have taken an industrial infrastructure, a delivery mechanism, a trained staff, effective platforms. And we're just completely creating a new paradigm that enables them to be delivered electronically.

• 18:40Auren Hoffman?

  If you're in the government, if you went back into the government, we have to harden these targets more so they're harder to hack. But in some ways, maybe that's impossible. Is the bigger strategy just resilience? Okay, you take down six power plants, but whatever. We can get the other ones running, and then we can make these come back up over time. Or we can bring things up. Is that the key thing in the end?

• 19:03Speaker 01

  If you were to ask me for my magic solution, it would be a mix of capability to run manually. For critical infrastructure and separate from the digital systems that enable you to have digital control. Second, not to plug the company, but like what we're doing at Galvanick, which is continuous monitoring for industrial systems and networks. You can operate digitally, but you have to watch everything, every single source of data within the four walls of that facility, watch it very carefully. You have to have baselines, be able to understand what patterns look like, understand what malicious activity looks like digitally. Then you need the ability to essentially cut off the digital systems. And then you need the ability to operate

• 19:43Speaker 01

  manually. And then I think you do need redundancy and resilience and the ability to reconstitute. If you were to sort of put those things together and pursue them in concert, I think you'd have a pretty good plan. That's certainly what we have articulated with the president articulated for a very long time during the first admin in terms of the strategy to pursue. It's hard, and you've got to corral a whole bunch of people together. These systems aren't built singularly. So they're very complex. The power grid's very complex.

• 20:16Auren Hoffman?

  If you think of the Russian-Ukrainian war that's been going on for the last three years, I would have thought if you had told me that Russia was going to invade Ukraine, that they would have been extremely successful in taking down the factories and the power and all this other stuff, because obviously they're great hackers. And then I was talking to somebody recently, and he said, well, the reason they weren't as successful is because they had been hacking them for so long that it was this cat and mouse game. They actually helped build that resiliency over the 10 years prior to that. Obviously, we don't have that here in the US, where we've seen that level of trying to shut some of these things down. Do you think that argument holds?

• 20:56Speaker 01

  Not only does it hold, but it was definitely how we were sort of thinking about things from 2017 to 2021. The Russians had gone after the Ukrainian

• 21:07Speaker 01

  Critical infrastructure, commercial infrastructure in various ways for a decade plus. The Na'petchus cyber attack in 2017, which caused tens of billions of dollars of damage worldwide, was essentially the Russian military targeting the Ukrainian economy through the Ukrainian version of QuickBooks, which then, the spreading mechanism that they used, enabled it to just spread worldwide, affecting the British hospital system, ports in the United States, chocolate factories, drug factories, a whole bunch of other things that were not the intended targets. The Black Energy incident, where the Russians went after the Ukrainian power grid, supposedly, same thing.

• 21:52Auren Hoffman?

  Essentially, they're getting better about, okay, we gotta go offline. We have to go to the manuals.

• 21:56Speaker 01

  The Ukrainian power grid notoriously during that incident, as it has been reported publicly, was manual enough that they were able to essentially roll back away from the digital systems. And my guess, I don't have any insight here, but my guess is that they took that to heart over the intervening period from that incident forward. Whereas you go to publicly traded board of like a big energy company today, and you're like, hey, we want you to have the ability to operate manually, and we want you to exercise that twice a year. And they're gonna be like, son, I've got quarterly earnings to meet, and you want me to spend 500 man-hours a quarter? On what? I've got fancy software that I bought from SAP 12 years ago that does this.

• 22:41Speaker 01

  Go sit in the corner. I'll call you if I need you.

• 22:43Auren Hoffman?

  And what are some of your learnings on things like backdoors on Chinese chips? And how do you think about that?

• 22:49Speaker 01

  I think you have to assume that anything that comes out of China, there's a capacity for it to be compromised by the Chinese Communist Party, by the Chinese intelligence apparatus. Do I think that means that everything is compromised? No. But the point is, you plan so that you can understand the range of possible scenarios that you might encounter. You just have to build that in as a planning assumption. And I think anyone that doesn't do that is doing themselves and their constituents a disservice.

• 23:17Auren Hoffman?

  How do you think about things like DeepSeek? Supposedly, the people behind DeepSeek were able to accomplish a fairly impressive model on lower cost with maybe not the most advanced chips, et cetera. How does that, do you think, affect our policy of what we should export, what we shouldn't export, et cetera?

• 23:35Speaker 01

  There's a bunch to unpack there. Obviously, Jensen showed up in Beijing yesterday. I look forward to seeing the outcome of his tussle with the President of the United States. From what I've read, and I'm no expert, Nvidia's a great company, and I hope they do well. They're doing well. At the same time, I've heard 20% to 30% of high-end Nvidia chips end up making their way to China. There's no way that the leadership of that company doesn't know that. There's no way. And so, there's a bunch of things going on here. One, there's trade conversation happening between the President and the leader of the Chinese Communist Party. Then there's a conversation about trade, there's conversations about Taiwan, there's all these things happening. Then there's a conversation about reshoring.

• 24:19Speaker 01

  I urge all these folks, all these chattering heads, although they get paid not to, but you sort of have to give the President, like, the latitude that he needs, because I think he's probably one of the smartest people alive today. Having worked for him for four years, gone in with that assumption, it was just validated time and time again when I worked for him. I think there's a lot going on. I'm open to a bunch of options. I think that he's got amazing judgment, so we'll see what happens there. But for the Nvidia crowd, they just have to understand, the jig is up, everybody knows that they're skirting the sanctions. So the question is, what are they going to do in exchange? Everybody knows now, and they've known for a while. The same thing with the CCP officer sitting across from the Biden people in December

• 25:04Speaker 01

  being like, hey, just so you know, we're totally on your infrastructure. It's like the mask-off moment, where now everyone has to publicly acknowledge that we all know what's going on. Nvidia's second biggest market is China. They know, we know it, and we know that they know it, and we know that they know that we know it. Let's have that conversation now. And so I think that'll be very interesting. We'll see how it plays out. I wouldn't want to get in front of the president in terms of how to handle that.

• 25:28Auren Hoffman?

  Now, when you were in government, you wrote a white paper that eventually turned into the Defense Innovation Unit, DIU. DIU seems like it's worked out super well, cut through a lot of bureaucracy, et cetera. What did we do? And obviously, there are books about it and stuff, but why did it work? Would so many other things to reform and do other things like didn't work over the years?

• 25:49Speaker 01

  I wouldn't want to claim exclusive credit. There were other teams that were working on it in the Pentagon. The way in which I had advocated for that was directly to the Chief of Naval Operations and the Director of the National Security Agency, for whom I wrote a white paper, because I was going out to Silicon Valley on behalf of the Chief of Naval Operations. It's all over now. Everybody's moved on. I'm just going to say it. So I was working directly for CNO. I was a military officer. This is back in 2013. And Ben Coleman, at the time, wrote this article, said, "The military needs more disruptive thinkers." It became the number one blog post ever read on, I think, War on the Rocks at the time, and shared all over the Pentagon, shared all over the services. And the Chief of Naval Operations, Senior Officer in the Navy, called Ben to the Pentagon,

• 26:32Speaker 01

  to his office in the E-ring, and was basically like, "All right, son, I'm tagging you in. Go find me some heretics." Ben was tasked to work with a three-star and went out and found 10 people that just didn't fit in. In the Navy, I was one of them. And CNO brought us in and was like, "Look, go find asymmetric opportunities for the United States Navy, and you have my support, and we'll get you money." So one of the projects that I was working on in 2013 was bringing augmented reality to the fleet. So I flew out to Google, talked my way into Google X, and convinced them to allow me, on behalf of the United States Navy, to join the Google Glass Explorers program.

• 27:15Speaker 01

  Google Glass was like the little heads-up computer. So I bought a bunch of them. I had a team of programmers working with me and this other program manager, a civilian, and we started building apps for Google Glass that you could put on a Navy ship. To just speed up what you would call like the John Boyd Oodaloop, Observe, Orient, Decide, Act. When you're on the bridge of a Navy ship, there's a ton of information that's coming in to the people that are there that are standing watch. And if you can just provide very specific information that they always want to see right there in their field of view, it just makes things faster. So the theory was, okay, we'll make our guys faster, more nimble, et cetera.

• 27:58Speaker 01

  In the course of doing that, I was talking to all these folks at Google who were like pulling me aside after the meetings and being like, hey, look, there's this huge movement to stop taking meetings with the Department of Defense because everyone and their mother comes out here and they take meetings all over the company and they never ask for anything. Nobody understands what's going on and it's a waste of our time. And it goes all the way up to the executives and they're thinking about cutting it off. As a military officer, I was like, I understand what's happening here, twofold. One, you have retiring officers that are looking to come out and essentially talk their way into tech companies by just showing up and being like, hey, look at me, I'm wearing a uniform, I'm retiring soon, wink, wink, nudge, nudge.

• 28:41Speaker 01

  On the other hand, in a much more non-cynical approach, by 2013, everyone knew that tech was going to be important in warfare. And whenever a new commanding officer takes command of a unit, they'll go out and they'll talk to all the places, they'll go get a capabilities brief from all the other units that interact with them. It was some mix of these two things that was going on, where you'd get crazy special forces units coming out and talking to Google X, whatever, and they just want to know what's going on. With those types of capability briefing meetings, you never have an ask. You just want to know what they do and who to talk to in case you need it. I synthesized all this information, I took it back to CNO and I was like, look, we need to create an embassy-style function, can be the entity that owns relationships in Silicon Valley.

• 29:27Speaker 01

  And then when you have unit commanders or other senior officials come out, they go see that embassy and the embassy makes sure that they're maintaining those relationships. And when they need to, they'll bring those visitors into these critical meetings, but they'll manage those relationships as a way to continue building them. So I wrote that white paper. I advocated for it at a bunch of conferences in public. Didn't think it was going anywhere. The week I was getting off of active duty after almost eight years, I got a phone call from the Pentagon and they're like, oh yeah, Joint Chiefs and CNO and SecDEF have been discussing this and they're literally going to stand it up next week. I left active duty and I just called up my friends and I was like, hey, put me in as

• 30:07Speaker 01

  a reservist and me and Ben Coleman joined DIU right at the beginning as what we call plank holders on the reserve side.

• 30:15Auren Hoffman?

  That's cool. Now, a lot of people, especially in tech, are kind of extremely negative on defense primes. Where do you stand on it? How do you think about it?

• 30:24Speaker 01

  This task force I was telling you about is called the Chief of Naval Operations Rapid Innovation Cell. We would travel places, talk to users, so to speak, talk to senior officials, junior folks, what's going on at the edge. One of the biggest conclusions we came to in 2013 was that we needed new primes to be able to natively go after these emerging warfare capabilities. We built one of the first autonomous unmanned underwater vehicles. We co-developed it with a university. We were out talking to Sail Drone in 2013. We found them in the bay and went to go talk to them. They were like doing whale watching and we were like, I want a thousand of these things in the South China Sea.

• 31:07Speaker 01

  And they were like, no, no, we started this company to watch whales. So we were thinking about autonomy. We were thinking about augmented reality. We were thinking about 3D printing. Ben put a 3D printer on a aircraft carrier in like 2014.

• 31:19Auren Hoffman?

  When you think of these primes, it seems like almost everyone is universally somewhat negative on it. Is it graft? Is it just big companies get stale over time? Why are they so underperforming?

• 31:32Speaker 01

  Our thinking was that essentially the current primes just had not been born in the age of technology and capability that we were now seeing. And you needed new entrants, new primes to be able to integrate those new technologies. You look at an F-18 and look at an aircraft carrier. And the United States of America's ability to take 4,500 souls, man, train, equip, a floating city, put it anywhere in the world, refuel it at will, and launch a fleet of aircraft and recover a fleet of aircraft off it, essentially in perpetuity, is probably one of humanity's greatest achievements,

• 32:15Speaker 01

  probably top 100, I'd say, in terms of industrial capacity. And that's due to the defense primes that we have today.

• 32:22Auren Hoffman?

  But we were doing that well 40 years ago.

• 32:24Speaker 01

  That's right. Game respects game. There is utility in these companies. There is necessity in these companies. At the same time, they're not native to, and they are definitely connected, very well connected to the cadres inside the Pentagon that essentially want to operate business as usual. You think about what next generation conflicts may look like. Those primes have had a harder time adopting these new modalities that I think have the possibility to leapfrog American capabilities in certain ways. We talked about building new primes really from the beginning, right from 2013. Obviously, now we're seeing the emergence of companies like Anoril,

• 33:06Speaker 01

  True Anomaly, and more that are capable of operating at that very senior level. And I think it's important. I think that it's a good thing because you need to essentially have new blood that's coming in that just thinks about things very differently and isn't like, all right, we have to go out and get the next fighter contract. Hey, I want to go out and deliver new capabilities that enable us to deliver kinetic payloads, which is a thing that the fighters do. But when you've built a capability and a pipeline of people to make fighters, that becomes your focus, not the outcome.

• 33:40Auren Hoffman?

  It also depends on like, are you nimble enough? To recruit the best talent, the best talent, they can't have too much bureaucracy if they're going to create something. You know, 1962 Lockheed was getting this incredible talent who could make the Blackbird and they can make these other types of things. These were incredibly talented engineers. Were they able to recruit? My guess today is that it's just much, much harder for them to recruit incredibly talented engineers. When I talk to people there, they have to like time card themselves and there's just all this bureaucracy. They've become much bigger entities, whereas like in Andorol, you're just going to be able to recruit much more talented people. You give them stock options. It's more of a startup, et cetera.

• 34:23Speaker 01

  Look, I'm sure that's true. I am guessing though, that places like Phantom Works and Skunk Works probably still have a easy time recruiting top talent to build crazy things that we'll find out about 15 years after they start. I mean, just look at the X47. The announcement said we had been flying it for some time now. I'll let the audience ask and maybe answer for themselves what that means. We can still do like insane things. That's done with the help of the primes. So I'm not one of these guys that's out here like, oh, down with Northrop, down with Boeing, all these other places. Those companies have a place and have a heritage and a capability to do things that are really extraordinary. But the whole point here is like, you want new entrants that

• 35:08Speaker 01

  can also challenge the strategic direction and the capability. And I think it keeps everybody honest.

• 35:15Auren Hoffman?

  All right, a couple of personal questions that we ask all of our guests. What is the conspiracy theory that you believe?

• 35:20Speaker 01

  I don't know. I'm super paranoid about food and what's been going on to the American food supply. I tweet a lot about seed oils, industrial lubricants being used as food, crazy ingredients. Basically, in the past three years, I've tried to cut out nearly anything that's not natural.

• 35:36Auren Hoffman?

  It's hard to do.

• 35:38Speaker 01

  It's super hard.

• 35:39Auren Hoffman?

  All of a sudden, you just realize like, I can't eat anything.

• 35:41Speaker 01

  It's wild.

• 35:42Auren Hoffman?

  Or I have to pay like four X for my food or something.

• 35:45Speaker 01

  I'm bringing like hard boiled eggs on an airplane and they're like, do you want the little Biscoff cookies? And you look over and it's 28 ingredients and you're like, I can't have this. No, thank you.

• 35:55Auren Hoffman?

  The problem is those Biscoff cookies taste so freaking good. I love them. That's like my guilty pleasures, those cookies. United doesn't have them anymore. They still have them on America. My United doesn't have them. Sometimes I'm like, I should just fly America just for that cookie.

• 36:08Speaker 01

  So yeah, that's probably something that I'm just really not actively angry, but I'm just disappointed in.

• 36:14Auren Hoffman?

  But is it a conspiracy or is it just one thing leads to another or something?

• 36:19Speaker 01

  There are things that I think aren't 10 people in a room getting together and talking about, and they're structural conspiracies. It's a shelling point where people are just like, well, the corn lobby is really going to support these subsidies. This weird oil that they produce as a byproduct can be used by us. And so we can go in and we know that they'll support us in the committee when we try and get the ag subsidies for this or that or whatever. And so I have a feeling that it's a conspiracy by default. There wasn't one person who was like, oh, I know what we're gonna do. We're gonna poison the American people by feeding them industrial lubricants. It was just over time consultants came in and they were like, man, you've got this byproduct. What are we gonna do with it? We gotta find a way to monetize it.

• 37:03Speaker 01

  And then they're like, yeah, but engine lubricants are better if you just make them out of complex carbon chains as opposed to this or that. So let's see what else we could do. Eventually someone was just like, oh yeah, you can feed it to animals.

• 37:15Auren Hoffman?

  All right, last question we ask all of our guests. What conventional wisdom or advice do you think is generally bad advice?

• 37:20Speaker 01

  I think this whole follow your passion thing, I'm very skeptical of it. Because I think that when you're good at something, it compounds into joy. You're like, oh, what do I enjoy? I enjoy drawing or something like that. So I'm gonna go do drawing. I'm just not sure that that's productive. Whereas like if you find a way to be excellent at something and you pursue that excellence, you derive joy out of the excellence. And so I just think that thinking more seriously about how to professionally spend your time and using as your north star, that what can I find that I can be really good at? I think it creates a virtuous cycle around joy and fulfillment.

• 38:05Speaker 01

  As opposed to starting with the sort of neurochemical, what can I do that will have a feedback loop? That will immediately bring me that dopamine hit. To me, it's much more find something to be very good at, learn what it means to be good at something, learn what it means to develop excellence, and then use that pattern that you've built to find other things to be excellent at.

• 38:29Auren Hoffman?

  When you're giving advice, because I'm sure a lot of people come to you for career advice, et cetera, you could be working on your weaknesses and getting better at those, and you could be working on your strengths and getting better at those. How should one divide their time? How should one be thinking about that?

• 38:44Speaker 01

  I try and just exclusively focus on working on my strengths. You want to identify your weaknesses, and then if there's a way that you can like 80/20 fix or mitigate those, I say do it. I'm not sure that this is good advice, by the way. It's just like how I operate. There are things that I'm excellent at. I want to go do those things. And then there are things that I'm not great at. I'd much rather find a way to bring someone else in to do those things than to try and build up that capacity myself, because I know what it took for me to be excellent at whatever it is, years, sometimes decades of work. When there's something that I'm not good at, I know what it's going to take for me to be good at that.

• 39:25Auren Hoffman?

  Sometimes a weakness, you don't go from like terrible to very good. You go from like terrible to mediocre or something. My rubric is how debilitating is that weakness? If you're just a crazy heroin addict right now, it probably does make sense to go work on that weakness. It's just completely taking over your life. But if it's like, I don't know, you're late to meetings or something, maybe that's not like an important weakness to work on. There are other things to do it.

• 39:52Speaker 01

  I think that's right.

• 39:53Auren Hoffman?

  This has been awesome. Thank you, Josh Steinman, for joining us at World of DAS. I follow you, by the way, @JoshuaSteinman on X. I love your tweets. I definitely encourage our listeners to engage with you there. This has been a ton of fun.

• 40:05Speaker 01

  Good morning. We're gonna win.

• 40:07Auren Hoffman?

  Good morning. We're gonna win. Yes, you write that all the time, which I love.

• 40:10Speaker 01

  Thanks for having me, Auren.

• 40:13Auren Hoffman?

  Thanks for listening. If you haven't already done so, please subscribe to World of DAS wherever you consume your podcasts, YouTube, Apple, Spotify, and more. And please help us get discovered by leaving a review. And check out worldofdaas.com. That's worldofdas, D-A-A-S, dot com. And of course, connect with me on Twitter, @Auren. That's A-U-R-E-N. Would absolutely love to hear from you.