Bug bounties: the good and the bad of computer security

Verge editor-in-chief Nilay Patel talks to founder and CEO of Luta Security Katie Moussouris. Moussouris has a long history in computer security, working at Microsoft and the Department of Defense creating their first bug bounty programs to incentivize catching and reporting security bugs and vulnerabilities in software systems. Nilay and Katie discuss the good and bad of bug bounties, encryption dilemmas with consumer devices, voting security in elections, and overall how we keep our software and networks secure. Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  College football is back. So Hilton called to me, the superstition concierge, to make your fan rituals a reality. Need a room to match your lucky number? We got you. Want to make sure our team doesn't wash your lucky jersey? Oh, that smells lucky. Hilton's unmatched hospitality can keep up with any superstition. Even a marching band wake up call at 5:55 and 55 seconds. Hit it! When you need a team that will do whatever it takes on game day, it matters where you stay. Hilton, for the stay.

• 0:31Speaker 01

  This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online make sense? There's no place like Chrome. Check responses set up required. Compatibility and availability varies, 18 plus.

• 0:56Nilay Patel?

  Hey, everybody. It's Niall from Vergecast. Really interesting interview episode this week. I talked to Katie Messrs, who's the founder and CEO of Luda Security. Katie has a long background in computer security. She actually created the first bug bounty program at Microsoft, the first bug bounty program at the Department of Defense. A bug bounty program is when an organization says, hey, we know there's bugs in our software. If you disclose them for us, we'll pay you for them. As you would expect, Katie has a lot of thoughts on what bug bounty programs are good for, what they're not good for, what they incentivize, and what blind spots they create. So we talked a lot about that. We talked a lot about encryption on devices. The governments desire to break encryption on things like the iPhone, why that's a bad idea. Obviously, Katie had a lot of thoughts about that. And we talked a little bit about the pandemic and election security.

• 1:38Nilay Patel?

  Just a fascinating conversation, an enormously important perspective on how we keep our devices and our networks secure. Check it out. Katie Messrs, founder and CEO of Luta Security.

• 1:51Nilay Patel?

  Katie Musteris, you're the founder and CEO of Luta Security. Welcome to the Vergecast.

• 1:54Speaker 03

  Thank you so much for having me. I really appreciate it.

• 1:56Nilay Patel?

  I am very excited to have you on. I want to talk to you a lot about how we sort of find and fix vulnerabilities in our software. It is a theme of the modern world, but I want to give people first just a sense of your background. So you are the founder of Luta Security. You've worked at the Department of Defense. You've helped to popularize the bug bounty system that I think drives a lot of the security conversation right now. Just give people a sense of your background.

• 2:20Speaker 03

  Oh, boy. Well, if I started at the beginning, I would say that I was a nerd in my room who taught myself how to program much like a lot of other nerds. So that was, you know, me at eight years old with a Commodore 64. But if we fast forward a little bit...

• 2:33Nilay Patel?

  Some things happened.

• 2:34Speaker 03

  Yeah, things happened. Situations occurred, and also the internet happened, right? I don't know. I don't know if people can tell by my hot pink hair that I'm actually 45 years old in real life. And the thing was, you know, when I was learning how to hack as a teenager, it was the late 80s, early 90s. That was the very beginning of the internet. So my background basically was learning how to hack at a very young age, finding like-minded people online in the earliest, you know, kinds of social media that predated even AOL, you know, and all that stuff. And then from there, you know, back then, you couldn't make a living hacking because we didn't have a lot of infrastructure that was dependent on computers, you know? We definitely used them to get to the moon,

• 3:18Speaker 03

  but, you know, they were... Personal computing wasn't really a thing until the mid to late 80s, anyway. So background-wise, you know, I was a molecular biologist for a while. I worked on the Human Genome Project. Then I kind of transitioned into systems administration, taking care of a bunch of networks that were constantly being under attack. And because they were under attack, I had to learn to scan them myself. So that was basically where I dusted off my hacking skills. And I was working at MIT at the time. And then from there, I moved to San Francisco in 1999 and became a professional Linux developer. So I was a coder for a living. And I also saw what, you know, what it really took to ship enterprise code and support it, which is, you know, part of it is being responsible

• 4:03Speaker 03

  for fixing bugs. I started the security program there at that Linux operating system company, and I was actually fixing the bugs myself because I was a developer. So, you know, from the perspective of bug hunting, bug fixing, all of that stuff... I've basically worn all the hats in this, in that type of industry. And I have a love of empathy for all sides. So when, you know, fast forward, I was a security consultant, meaning a professional hacker, hired to break into places. This was in the early 2000s. My company that was a small consultancy, you know, at the time called AtStake, was acquired by Symantec. And at Symantec, I continued doing that work and I founded Symantec Vulnerability Research, which was kind of like Google Project Zero, if you're familiar with that team.

• 4:48Speaker 03

  They look for vulnerabilities outside of Google products and third-party products. So I actually started a similar team way back in 2004, 2005 at Symantec. So anyway, from there, you know, I was still doing that professional penetration testing work, hunting for bugs. But I also noticed that our customers weren't getting that much better, right? And it started pissing me off because I was like, I want my work to be meaningful. And why do I keep coming back to the same customers and we find the same types of bugs? So, you know, when Microsoft offered me a job as a security strategist, is what they called it, even though I wasn't going to be hacking for a living anymore, I was like, you know what, maybe this is a chance for me to make a bigger impact in the software

• 5:29Speaker 03

  security industry and hopefully get people on a better page. And at Microsoft, I started a bunch of programs, including their first bug bounty program. And that was what caught the attention of the Pentagon and they invited me to start briefing them, which eventually led to the Pentagon's first hacking program called Hack the Pentagon, which we launched four years ago, right at, as I was leaving my last company and starting my own company. So that pretty much brings you up to speed with like, almost everything I've done, except, you know, some of the waiting tables jobs I had to do to pay the bills, right?

• 6:03Nilay Patel?

  So what's really remarkable to me about that particular story and your journey is the same thing that I think is remarkable about the tech industry at large right now. None of this existed before, and now it exists at scale. And there's an element where people just take it for granted that bug bounty programs exist. There's an element that we take it for granted that LTE networks exist. But they didn't exist before. And our assumptions in building them, I think we take a lot of them for granted, that they exist and they exist in this form. But they don't, we've only had one run at them. We've only had one sort of basic iteration of things like bug bounty programs. What have we learned? Because the, the basic idea is obviously very clever, right? We're going to provide an incentive for you to find our vulnerabilities and the, the market will like do the job for us.

• 6:48Nilay Patel?

  What, what have you learned as you've been setting that stuff up? What were the core assumptions here?

• 6:51Speaker 03

  Well, I mean, the first iteration of bug bounties was actually in the mid 90s. It was Netscape browser offered the first bug bounties and it was, I think it was a thousand dollars if you found a security bug. And that was the only bug bounty in town. And actually Dilbert, the comic Dilbert did a, or you know, Scott Adams did a comic, a Dilbert comic about it back in 1995 saying, you know, the pointy haired manager was like, I'm going to start a bug bounty and pay, you know, for, for every bug that's found. And Dilbert and the other engineers go, I'm going to write me a minivan. Like I'm going to basically go and code myself some bugs so that I can then claim the bug bounty. So this idea of what we call perverse incentives was actually already identified by a comic

• 7:36Speaker 03

  author like way back in 1995. So we still actually struggle with perverse incentives in the bounties, you know, the more modern bounties, but we didn't really see much new under the bug bounty sun until 2010, so a decade ago. And that was when Google started offering bug bounties. I was at Microsoft about three years into my career at Microsoft and my superiors in the Microsoft Security Response Center were like, so, uh, you know, this bug bounty thing that we've publicly sworn we would never pay for, for bugs publicly, we said that? Yeah, we'd like you to look into it, right? So they, so, you know, suddenly a competitor. And, and if you take into account like the competitive landscape, that's really what drove Microsoft to take a second look at doing bug bounties because at the time IE was

• 8:20Speaker 03

  still the dominant browser. Firefox, you know, which was the inherited recoded version of Netscape Mozilla was, you know, a distant second and Chrome was brand new, right? So Chrome browser was brand spanking new. It didn't have sort of the legacy bugs and all of this engineering technical debt to, to deal with. And so, yeah, they offered a bug bounty. I mean, it was this flashy thing. They wanted to, you know, get help from the outside world. They wanted to use it as a conduit for not just bug reporting, but also potentially hiring people into that group. And, you know, I think at the time, like Chrome was only like two years old. And so, i.e. sensing that Chrome was gaining market share at an alarming pace,

• 9:04Speaker 03

  decided that, you know what, we should take a second look at this bug bounty thing and see if it's something where, you know, we can participate. So that was kind of the modern entry into the bug bounty space. And so, the, the critical issue was that Microsoft had over 800 supported products and services. So there was no way we were gonna slap a bug bounty onto all of that because we were already, you know, I mean, seriously, we were already, to this day, they still receive over a quarter million non-spam email messages per year going into secure at Microsoft. So why on earth would you be like, you know, waving this green flag in front of the bug bounty bulls out there going, "Toro, Toro", you know, just come and get, come and get more, spam us out, you know? So they basically didn't want to increase volume.

• 9:48Speaker 03

  So we had that challenge to manage. And the, the bug bounties I came up with at Microsoft were very in tune with the fact that, one, we were already getting bugs for free, right? Bugs that would sell on the offense market for six figures or more.

• 10:01Nilay Patel?

  Wait, just unpack what that sentence means, because it's, it's cool.

• 10:04Speaker 03

  So the offense market, you know, some people call it the black market for bugs, but it's not a black market if it's not illegal, right? The offense market includes, you know, governments purchasing exploits and vulnerabilities for use on criminals and terrorists and, you know, adversaries of any kind, nation-state adversaries. It also includes crime organizations buying exploits and vulnerabilities for, I don't know, crimes, right? So that's kind of the big overarching offense market. It's basically you're buying a bug or an exploit in order to use it against someone as opposed to a bug bounty, which is part of the defense market. And that's basically where you're buying a bug in order to fix it, right? So there's price differences there.

• 10:48Speaker 03

  The offense market tends to pay, you know, a hell of a lot more. But, you know, we already knew from the experience at Microsoft, who paid nothing until 2013, that you don't need to pay people to get them to turn in a bug because they actually primarily want to see the bug fixed, right?

• 11:06Nilay Patel?

  Yeah.

• 11:06Speaker 03

  So I wanted to make it easier for people, you know, let's say Little Timmy needs braces, for them to say, "You know what, I've got this bug. It's worth something on the offense market. Little Timmy needs braces. Oh, but I actually want to see it fixed." And so I didn't want to have to have them make that hard choice, you know, right? So. Create some kind of a bug bounty. Try and create incentives for the things that you most want to learn about at the times that you most want to learn about them. And that's kind of important for how we structured the Microsoft bug bounties. You know, at least the initial ones. And then, you know, go from there and see if the market responds. So, one of the things we did for IE was, we knew Internet Explorer had plenty of free research coming in where these bugs would have been worth, you know, at least $100,000,

• 11:50Speaker 03

  if not more, on the offense market. But people were choosing to give them to us for free. The problem was, they were choosing to give them to Microsoft for free after the beta period was over. And we were like, "Why is that? Why are they like, doing all this research during the beta period and literally not telling us until after the beta is closed? It's kind of the worst time ever, right, to hear about the bugs." And we figured it out. It was basically that the only incentive they had, uh, you know, was getting their name in a Microsoft security bulletin. And if the-

• 12:22Nilay Patel?

  Wow.

• 12:23Speaker 03

  Yeah, if the bug only affected the beta and no earlier versions of IE, as in, "Brand-new code, you know, or brand-new thing." We wanted to hear about it during beta, but they wouldn't get their credit, so they would hold on to it, right? So, we were like, "Uh-oh. How about we offer them credits and maybe a little bit of money in form of a bug bounty at the beginning of the next IE beta period?" Which is exactly what we did. And it was super successful. I mean, we got 18 vulnerabilities during the first 30 days of the IE 11 beta period, and I paid probably about $28,000 total for all of those bugs with, you know, proof-of-concept exploit code and everything. And what's more is that because it was at the beginning, not only could we get all of

• 13:07Speaker 03

  them fixed before the beta was closed, but we actually used those bug submissions to look for other adjacent bugs in the area of code. And we fixed so many more than were even reported, just because, you know, where there's smoke, there's fire, and some of these outside sets of eyeballs really helped us out and spot things that we had missed. So, it worked great. And that was also why the Pentagon was like, "Hey, we've got a lot of complex systems and we probably can't bounty everything at once, and you managed to do it at the biggest software company in the world, so why don't you come on down to the Pentagon and tell us how you did it?" So, that was actually how, you know, how I got invited to the Pentagon the first time.

• 13:44Nilay Patel?

  So when you go to a place like the Pentagon, Microsoft obviously owns and operates most of its code. It's actually different now, like they've bought so many other companies, but at the time you were there, Microsoft, fairly monolithic software company. Pentagon is not in that way, right? They have a lot of vendors, they have a lot of outside consultants, they have a lot of interconnected systems. How did you manage that? Because that seems like a much harder problem, and also the stakes of that seem correspondingly higher, I should say.

• 14:13Speaker 03

  Yeah, I mean, the legalese alone, to set up the Pentagon's initial bug bounty pilot, was daunting, right? Because if you look at current events with nation-state hacking and the way the United States has decided to address hackers from acting on nation-state orders from China, for example, is the DOJ actually indicts them by name, you know? So what we had to do is we had to figure out how to walk a line of saying, in legalese, we welcome hackers, you know, if you see something, say something, except if you're a nation-state, in which case you're totally not authorized and we can still go after you, right? So we had to basically come up with this, you know, sort of swim lane for authorizing

• 14:57Speaker 03

  the friendlies without accidentally authorizing every nation-state in the world to like, "Come at me, bro." And so that was fascinating. But I gotta say, it was really the work of the folks inside the Pentagon to help, you know, they called themselves bureaucracy hackers, but they basically, you know, I would come in with my expert expertise, you know, outside expertise about incentives and working with hackers and all that stuff, and the ways to structure these programs so that you didn't die, you know, a volume of cases. But they were the ones who actually went through and got all the approvals. So I've got to name check them here, you know, you've got to forgive me, but they deserve all the credit for getting this stuff approved. The first person to invite me to the Pentagon, his

• 15:39Speaker 03

  name was Michael Solmeyer, and he's Sultan of Cyber on Twitter, he's a great follow. But he was actually the Director of Policy, Cyber Security Policy, for the Office of Secretary of Defense at the time that I was at Microsoft, and he was the first person to invite me there. And then when he left, his successor, Lisa Wiswell... Was really like kind of the chief bureaucracy hacker and she had gotten, I mean, she had gotten decorated by the president for multiple of her work in cybersecurity across all of government DOD. But, you know, without these internal Sherpas, and then there was also Charlie Snyder, who was also in the Office of Secretary of Defense as well.

• 16:21Speaker 03

  And between, you know, essentially those three insiders at the Pentagon, there would have been no way to get this done as an outsider, even coming from the largest software company in the world. So there was, you know, absolutely this internal push. And then I gotta hand it to former Secretary of Defense Ash Carter, because, you know, there were a lot of middle management folks in the Pentagon that basically were saying, "Are you crazy? We're going to invite hackers to come at us. Are you actually nuts?" And Ash Carter basically said, "You know what? We're gonna do this because we do need to embrace the, you know, the cybersecurity folks outside of our five sides.

• 17:03Speaker 03

  And we also need, you know, a better pipeline for cybersecurity workforce in the government. And you know what? We're just gonna rip the Band-Aid off." And so I gotta give credit to all the folks inside the Pentagon and, you know, the folks who basically pushed those boulders uphill. But yeah, for my part, you know, I basically, I told them, "Look, this is the game theory and economic theory that went behind, you know, the Microsoft bug bounties. And here are the ways in which we can structure things such that you also don't die of, you know, of bug bounty." Yeah, so that's essentially where my work continues, you know, to this day in my own company, is helping people not die of premature bug bounty, right? Premature bountification.

• 17:44Nilay Patel?

  So that brings me all the way back to my first question, which is, the system kind of didn't exist. And now it's at the point where not only has the Pentagon implemented it, but you and I have already talked about it in terms of economic incentive. You just said there's a game theory behind it. There's like rigorous academics underlying how the systems work. And you're now like at the place where not only is the government and the military using it, but you're helping other companies set that stuff up. So that implies that it worked, right? Like, this was a theory and it got to a place of some success and sort of fixed understanding. But right before we started talking on the show, you mentioned to me that it's not a cure-all. Like, it doesn't, it doesn't solve every problem. So where are the failings of a bug bounty system?

• 18:29Speaker 03

  Well, right now, honestly, the failings I've got to see is in the commercial implementation of bug bounties. So, you know, my company basically goes in and assesses, you know, organizational maturity, like, are you ready for this? Can you handle the truth? And a lot of the questions we ask, organizations are like, "Yeah, but we want to do this industry best practice thing called a bug bounty, and we know that you you make all these big bug bounties, so just make us a bug bounty." And I'm like, "But you haven't actually been able to keep up with patching the systems that you know are out of date. You don't, how can you actually deal with this additional volume?" And they say, "Oh, but we'll just hire a bug bounty service provider, and they'll take care of everything for us." And I'm like, "Wait a minute, wait a minute. What

• 19:12Speaker 03

  part about your internal patch processing did you not understand from like, the rest of the questions, right?" Because they're sitting there going, "No, no, we've been told we can outsource this." So where I see the big failings, and I see it as failures of both sides of the marketplace. I mean, ideally, I mean, I used to work for a bug bounty company. I believed in this model as, "Hey, why don't we make it easier to connect companies with hackers and make it safer for everybody? And, you know, eventually, the companies and the governments will become more secure, and eventually, the hackers will also not only stay out of jail and make a living, but they'll skill up, right? You know, because ideally, what you want to see in the whole world is enough, you know, no low-hanging fruit anymore, right? You want to see people actually addressing

• 19:57Speaker 03

  those bugs themselves, preventing them ideally, but even if, you know, they accidentally coded up some low-hanging fruit bugs, to be able to detect them themselves, not rely on third-party, you know, randos on the internet to come tell you about this low-hanging fruit. So where I've seen this failing is that commercial bug bounty platforms, basically, their business model is, "You stay bad at security, so that there's a lot of low-hanging fruit to be found." And the relatively low-skilled labor that hangs out on the bug bounty platforms, with very few exceptions, um, you know, there are highly skilled folks on these bug bounty platforms, but it's literally, I think I read the latest report from one of the leading

• 20:40Speaker 03

  bug bounty platforms, out of 600,000 registered users, 146 of them, 146.

• 20:49Speaker 03

  Have ever made more than $100,000 in their entire lifetime on the platform.

• 20:54Nilay Patel?

  Wow.

• 20:55Speaker 03

  You know, a professional penetration tester, even 15 years ago when I did this, already starting salary was over $100,000. So, we're not seeing actually, you know, a good evolution of the state of security as a result of these programs. We're also not seeing a good evolution of the state of cybersecurity workforce. We see a huge bottom of the pyramid, which is kind of the folks who are able to run free or, you know, nearly free tools, scanning tools, and kind of give you the low-hanging fruit reports, and they're making up the majority of bug bounty hunters. And this tiny little top of the pyramid of highly skilled workers, you know, that is literally less than 200 people are at the very, very top. And that's despite these companies being in existence for the last eight years.

• 21:40Nilay Patel?

  It's so funny that you are describing an economic model for cybersecurity, for hacking, that looks an awful lot like a user-generated content platform economic model. Like, you could have just described YouTube, or Instagram, or any of these other platforms that promises lots of people access, but only rewards a tiny fraction of the folks. Is that, is that an accurate analogy?

• 22:06Speaker 03

  Absolutely. I mean, the rules of bug bounty are only the first one to, to report a unique bug gets paid for it, right? So, think of all the low-hanging fruit. You could be spraying and praying your scanning tools, but to even make money on something that was very easy to find, you just have to be the first one in, right? And so, there's a whole lot of, of unpaid labor that goes into these platforms. And then, let's say, even if you're, you know, you're operating at higher, you know, sort of higher technical levels and finding more esoteric bugs, we hear complaints left and right of companies, you know, sort of saying, "Oh, we knew about that bug already, so we're not going to pay you, it's already in process of getting fixed," you know? So, there's a whole bunch of stuff where people are not getting what they signed up

• 22:51Speaker 03

  for, and I, I look at it as yet another failed implementation of the gig economy marketplace right now. And, you know, we all had a lot of high hopes that gig economy would help a lot of people, and it's not been turning out great for, for, certainly for the labor side of things. But in the case of bug bounty, it's not turning out great for the buying side, the hiring side either. They, you know, again, they're not, they're not able to access huge new labor workforce. Um, those tiny number of people who are fairly highly skilled and making good money on these platforms. They maybe don't want to give up their lifestyle. A few of them have, you know, a few of them have decided to work in-house at companies. But they're kind of preserving their bug bounty, moonlighting abilities on the side, you know, and everything.

• 23:36Speaker 03

  Um, so yeah, we're, we're just not seeing the whole gig economy as expressed in bug bounty platforms working out for either side of the equation.

• 23:45Nilay Patel?

  So what I, just to keep this analogy going, maybe past its breaking point, but I'm gonna try. Um, when, when we're critical of a YouTube or Instagram, a thing that is real there is, that's working out great for YouTube and Instagram. They have no incentives to fix it because they're, they're reaping all the reward. I would imagine, at least, you know, there's more actual money sort of flowing through the bug bounty ecosystem. And there is the very real threat of, hey, there's vulnerabilities in our software. So it does seem like there's some incentive to change it, to change that model. What changes have you seen coming or does that incentive just not exist?

• 24:22Speaker 03

  Well, I mean, you know, after leaving one of the bug bounty companies, I stayed on as an advisor for well over a year or pretty close to a year. And, you know, worked with them on various, you know, mutual customers. And I've worked with, um, you know, I've had customer overlaps with a lot of the bug bounty companies, if not all of the major US ones. And the thing I keep seeing in their business model is that I would like to help organizations get more mature, right? So fewer low hanging fruit bugs, more esoteric bugs. But all of their business models depend on there being kind of chum in the water all the time of low hanging fruit. So they don't want the process delays of, you know, that my company usually goes in and says, are you ready for this?

• 25:06Speaker 03

  Have you invested internally on finding the bugs yourself? Did you know it's up to 45 times cheaper if you actually identify, you know, security bugs in the design phase, right? And that basically ends up delaying the adoption of bug bounty, which isn't appropriate for everyone, and certainly not appropriate if you can't even, you know, patch the bugs you already know about. So I think the inherent conflict that's come up with the different business models, you know, bug bounty versus, you know, the advisory services that my company provides, is that, you know, bug bounties can help with a tiny fraction of, you know, what you already need to do for vulnerability management, but it's being positioned as the easy button for it.

• 25:48Speaker 03

  And I think that, you know, we're seeing, we're seeing a lot of companies come to grips with the fact that they're having breaches still, even if they have a bug bounty, or they can't bounty everything, and so their most critical stuff, like you, I mean, there's one airline who has a bug bounty. They've had a bug bounty for a little over four years. That's United Airlines. Is it on the planes? No, it's on the websites. It's against the website, right? So how are we, you know, how are we safer in the skies? Well, we're not. But the appearance of looking like you're doing diligence when it comes to vulnerability management, I think that's where commercial bug bounty enablement platforms have been pushing, is like, look, you know, just look really busy.

• 26:33Speaker 03

  Yeah, you're playing whack-a-bug, you know, and everything, and this is super inefficient, but you can say that you take security very seriously and you're fixing all these low-hanging fruit bugs and whatnot. We won't call them that. We'll just say that, you know, there are all these bugs, and that it's super valuable. And then when you get breached, maybe you won't get in trouble because you can say, well, we, we tried, we had a bug bounty, and just nobody reported that particular issue to us. So I don't know. I mean, I would love to say that, you know, this is all evolving in the right direction, but frankly, you know, I've seen it devolving, especially in the last couple of years of the, of the commercialization of bug bounties.

• 27:13Speaker 00

  College football is back. So Hilton called to me, the superstition concierge, to make your fan rituals a reality. Need a room to match your lucky number? We got you. Want to make sure our team doesn't wash your lucky jersey? Oh, that smells lucky. Hilton's unmatched hospitality can keep up with any superstition. Even a marching band wake-up call at 5:55 and 55 seconds. Hit it! When you need a team that will do whatever it takes on game day, it matters where you stay. Hilton, for the stay.

• 27:44Speaker 01

  This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome, that's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online make sense? There's no place like Chrome. Check responses set up required. Compatibility and availability varies 18 plus.

• 28:11Nilay Patel?

  So I want to take, you brought up a few things so far that I want to just take a step back and talk about. The first one is the notion of the offensive market, which pays a high rate for vulnerabilities, and the idea that a bug bounty system maybe doesn't pay as much, but can balance out that market. That has led, I've talked to a few folks about it, a lot of people have a lot of thoughts about this, like complex academic economic modeling thoughts over how you get nation-states paying a million dollars and then Microsoft paying $28,000, how that actually still balances the market. Are those numbers changing? Do you see, do you see that economic kind of relationship between the offensive and defensive payments for vulnerabilities changing? Are the rates going up? Are they going down?

• 28:56Nilay Patel?

  What does that look like? How does that work?

• 28:58Speaker 03

  Well, Apple announced that they were going to start paying over a million dollars in their bug bounty program.

• 29:04Nilay Patel?

  You walked right into where I was going. This is great.

• 29:07Speaker 03

  And that's a terrible, terrible idea.

• 29:10Nilay Patel?

  Yeah.

• 29:10Speaker 03

  And the reason it's a terrible idea is that, look, I know Apple pays their security engineers quite a bit of money, right? But essentially, they already employ people who are supposed to be designing their products and services such that they don't have those flaws, you know, those kind of full remote takeover of the phone type of flaws. They're supposed to be designing them securely from the get-go. Number one, that's what their employees are supposed to do. Number two... If they miss something in the design, they're supposed to catch it in testing again themselves internally. So what this does when they create something like a million dollar or a million dollar

• 29:51Speaker 03

  plus bug bounty is that they're basically saying to their internal employees, one, no, we're not going to give you a million dollar bonus for doing your job every time. You know, so that's, that's a little demoralizing. But two, they're also kind of saying that, you know what, if you don't want to go to yet another company meeting or team meeting or group stand up this week or whatever it is, you know, or you got a bad review or didn't get a promotion that you thought you deserved, you know what, just leave the company and in the one year timeout or whatever it is, just come back and you can just collect a million dollars, you know.

• 30:25Nilay Patel?

  Wow.

• 30:26Speaker 03

  So what it does is it honestly, it breaks their labor pipeline. It breaks the pipeline for them to continue to attract and retain the personnel that you want in-house designing these things, secure from the get-go. And I told them this, of course I did, but you know, they were like, well, yeah, but we think that we really want to give people, you know, more of a choice between the offense market and the defense market. And I pretty much laughed like Jabba the Hutt. Like, whoa, whoa, whoa, whoa. You know, like, because essentially it's like, they're, they're, they're presuming that the offense market can't just like laugh like Jabba the Hutt and add a zero to the end of whatever they're paying. Like, oh, you make it one million, we make it 10 million, no problem.

• 31:10Speaker 03

  Like, it literally doesn't matter.

• 31:12Nilay Patel?

  Unpack that a little bit. I don't think people know that, that the prices are that high or the value is that high.

• 31:18Speaker 03

  Well, the offense market was already inflating the prices, right? They were already basically, you know, making it perfect for defense contractors like Raytheon and whatnot to bid on these, you know, defense, defense contractor prices, right? So they were already making the prices really, really high. And the hilarity that the defense market, you know, thinking that you have to outbid the offense market, that was, that was an academic question that I and some other folks at MIT Sloan School and Harvard Kennedy School took on as a research project when we ourselves modeled the system dynamics of the vulnerability economy and exploit market. So we released some of that research, you know, several years, like half a decade ago,

• 32:00Speaker 03

  you know, and, and it still gets brought up today because some of it is part, part of it is the labor market that we looked at. And that comes up, you know, with the stratification of labor, you know, the very tiny number of highly skilled versus the the huge number of not as highly skilled, um, you know, and not getting paid very much hackers in these bug bounty platforms. But, you know, the other bit was we, the academic question we asked ourselves was, is it possible to corner the market on bugs by outbidding it? Right? You know, i- is that even possible? Can you, can you use the lever of money? And the, the answer was no, you know, you can't. Um, one, because the offense market doesn't need to constrain itself to who it could hire in the future in-house, right?

• 32:43Speaker 03

  They don't have that, um, you know, that mission of actually trying to design these products to be more secure. They only have the mission of doing their offense work. And so they can just jack up the price as much as they want. And that is why, you know, raising prices past the point where you could reasonably pay developers and testers to come into your organization and work for you, raising bounty prices past that point is a losing game. And yeah, hence the Jabba the Hutt laughter and me being like, you don't realize that the offense market can outbid you in a nanosecond, you know?

• 33:19Nilay Patel?

  Yeah.

• 33:20Speaker 03

  So raise it as much as you want. They don't have the unintended consequences of basically cutting off their own labor supply by doing it, which the defense side does.

• 33:30Nilay Patel?

  That's really interesting. So you're saying Russia, we'll just pick on Russia because it's easy. At this moment in American history, we're gonna, we're gonna pick on Russia. Um, Russia can't just like flood the market with money and collect every extent vulnerability that's out there.

• 33:44Speaker 03

  They could try, you know, there are people who wouldn't have given it to them, uh, for any amount of money, including the people who continue to report bugs for free to, you know, almost every vendor, right? But, so the offense market, like I said, can raise their prices at any time. It's, um, it's a question of what motivates hackers when they find a bug. And I usually liken that to, uh, everyday people contemplating what to do at an intersection with a yellow light, right? You know, you find a bug and you're kind of at a crossroads. And what do you consider when you're at a yellow light? Well, it's different every time, right? You know, what time of day is it? Do you know that there's a speed trap nearby? Do you have passengers in your car that you care about? Right? And like, you know, should you stop suddenly?

• 34:29Speaker 03

  And will that jar the passengers more? Or should you just go on through? So, looking at every bug, every researcher comes to that same yellow light choice about, what do I do with it? Do I report it to the vendor to get it fixed with or without a bug bounty? Or a cash reward? Like, do I just care about this technology enough that I want to secure? Like, I use it, or my family uses it? Or something like that? And that drives a lot of behavior, researchers. So even if they know they could get more money for it on the offense market, they're basically like, yeah, but, you know, there are passengers in my vehicle that I care about at this yellow light of decision-making. And so I'm going to give it to the vendor for free, even though they don't have a bug bounty and everything, um, because I just, I just care and I want to see it fixed. So, um, price is not the most effective lever,

• 35:13Speaker 03

  and certainly not the most effective lever to use on the defense side. Um, there's another issue, which I don't know if we have time to talk about, but it's also frankly a violation of existing labor laws. So like, forget about the new California labor law for, you know, that's affecting gig economy marketplaces like Uber and Lyft, um, and will also actually affect gig economy marketplaces like bug bounty platforms. Forget about the new California law. The existing labor laws were already, um, questionable under bug bounties. And I say questionable because at Microsoft, they've got a lot of lawyers. And, uh, they looked, you know, it's like they have like a few lawyers.

• 35:51Nilay Patel?

  Yeah, one or two.

• 35:52Speaker 03

  Yeah, they looked into that question, um, when I was starting, uh, to do research on how to make Microsoft's bug bounties happen. And the answer was, yeah, it's probably a violation of labor law. Actually, it totally is. And there's a few reasons for that. One, you can't claim that it's not part of your core business to secure your software. Right? So if you're a software company, you can't be like, no, no, no, not part of our core business. We don't need to hire for that full timers, you know, not at all. So you can't make that argument that, no, no, this is contract work only. Um, second, it actually ends up, depending on how long it takes the researcher to come up with the thing that they're submitting to you, it can violate minimum wage labor laws. So it could be, yeah, so if you pay like a thousand bucks,

• 36:36Speaker 03

  but it took them like three months, guess what? You have violated some, some, uh, pretty serious, um... You know, minimum wage labor laws. And further, that whole rule, remember that, you know, only the first person to come up with the valid vulnerability report gets paid? Well, the second person who came up with the exact same bug and maybe did all of the things that you asked them to do, like did equality write up, you know, steps to reproduce it, who sent you some proof of concept exploit code so that you could run it and test it yourself, they did all that work too, and they get paid zero, which is certainly well below even the lowest minimum wage in the United States, right? Yeah, so there's all kinds of problems with the bug bounty economy as it's implemented

• 37:19Speaker 03

  now, not the least of which are these trends with the, you know, kind of misplaced trying to outbid the offense market, which can't be done, and, you know, the inherent problem in labor law violation, which now we're seeing a lot more of that because Uber and Lyft have been under the spotlight.

• 37:36Nilay Patel?

  So I want to pull it back to Apple again, because right before Katie and I started talking, there was yet another encryption hearing on Capitol Hill. Bill Barr really wants a backdoor into the iPhone. Every time somebody wants to unlock an iPhone, another company pops up, Celebr Bright says they can do it anyway.

• 37:53Speaker 03

  Right.

• 37:54Nilay Patel?

  The market for cracking an iPhone seems very, very hot, right? Because Apple won't provide this backdoor. Apple has, I would describe it somewhat gently, is a contentious relationship with the security industry. How are they handling all of this stuff? Because it seems like the, the offense market for the iPhone is just extraordinarily hot, right? And then there's other methods, other, you mentioned Project Zero from Google, they come at Apple just like head on all the time. Another contentious relationship. How do you see that playing out right now? Because that seems like, as you point out, there is a lot of economic modeling to be done here, and it seems like that product in particular is probably like the center of a lot of debate and controversy.

• 38:36Speaker 03

  Well, okay, so first of all, there's a lot to unpack with that, right? The backdoor question. I usually address the backdoor question, you know, in two ways. One, you know, if you build in a backdoor... You're you're building in the inherent weakness that somebody else will find, somebody else will use, and even if used as directed by, you know, sort of only our government or whatnot, you're trusting that our government stays true to its values in the entirety of its execution of of that access to the, you know, via the back door. That's a lot of trust to extend to, you know, not just our government, but also to anybody

• 39:21Speaker 03

  who's safeguarding the secrets that are, you know, that basically are the keys to unlock that back door. So back doors are a bad idea, okay? Like, that's basically like, bad idea, it's gonna get abused. If you build it, they will come, and they, meaning everybody who, you know, who who wants access there. And then, on the other hand, a lot of people will mistakenly make moral judgments about selling to the offense market, saying, you know, you either turn it in for free or do a bug bounty defensively, or you're a bad person. And I'm like, whoa, whoa, hold on here. If we all agree that back doors are bad, then how else should our government with a

• 40:02Speaker 03

  warrant go after a terrorist's iPhone, except without with with an exploit that they bought, right? How can they go after child molester rings with a warrant and install some of this, you know, some of this software, you know, on these devices and track them? How will they do that without a back door, unless you also support the offense market sale of exploits? So I support the offense market sale of exploits for these reasons, right? And I think they're actually a much better solution. I would much rather have a tiny group of specialized skilled individuals in the world able to sell to, let's say, our government for law enforcement purposes, and yeah, you're still trusting that they're not gonna abuse it and whatnot, you know, and everything.

• 40:47Speaker 03

  But a bug, you know, especially an exploit, sometimes will not succeed and leave traces. So it kind of gives the vendors and other security researchers a chance, maybe, to identify that vulnerability and get it fixed eventually, even if it's used in a targeted offensive campaign that's legally sanctioned and what everyone would agree with, like, let's let's take down some actual terrorists, or let's take down some actual child molesters. Like, everybody is down with that, you know? What we don't want to see is enabling mass surveillance, right, for ourselves or even for, you know, foreign people if it means that our cloud services, for example, are no longer able to be sold out of the United, outside of the United States. Like, that

• 41:29Speaker 03

  would have a huge economic impact to the United States. And what, you know, what would, what would happen if we're forced to install backdoors in technology, either Apple's or, let's say, Amazons or Microsoft in the cloud? If we're forced to do that, well, that smells a lot like the Snowden revelations and Prism. And there was a huge cooling effect on our ability to sell technology outside of our borders as a result of that. So, anyway, it's a long-winded, I kind of give like NPR answers, sorry about that.

• 42:00Nilay Patel?

  It's a podcast. What else are we here for?

• 42:02Speaker 03

  Right. So, but I have, you know, I mean, I just have a lot of, I have a lot of strong opinions about this because this is the dynamics of the marketplace that I, I actually do support, um, the offense and defense side of the marketplace, both, um, especially when it comes to offense use of, of exploits as opposed to having to build in backdoors for encryption, which is a bad idea.

• 42:28Nilay Patel?

  So I'm gonna just say some dumb stuff and then you can react to it. Again, a podcast, that's the, that's the idea. But, uh, this is why I was so excited to have you on. I, I, the strong opinions here, I think, are very clarifying. So what you have described to me sounds like a system that depends on a certain amount of opacity and friction, right? So, Apple builds the phone, the phone has some unknown or undisclosed vulnerabilities, someone finds it, they sell it to the Department of Justice or the, or the Department of Defense or whoever, FBI uses the exploit to crack a terrorist phone, Apple realizes, oh crap, there was an exploit, they fix the exploit, they ship the next phone, it has some X vulnerabilities, FBI buys it again, cycle repeats.

• 43:10Speaker 03

  Yeah, and that, that connecting bit of Apple figuring out that, that this exploit has been used, sometimes they don't, right? You know, if, if an exploit is used successfully, there's no trace. If an exploit crashes, then you have the opportunity, maybe, to start detecting all these crashes in the wild, right? You know, every time your, your browser crashes and it says something like, do you want to send a technical report back to Google and help improve Google? That's basically feeding into Google's telemetry and whatnot. Apple has similar telemetry, you can send crash reports from your phone. But basically, a successful exploit won't crash. What you're seeing in terms of crashes are unsuccessful exploitation attempts. So that little connector part that you were like, you know, if FBI buys it, uses it, Apple

• 43:53Speaker 03

  finds out about it, it's like, well, Apple might not find out, but they have a chance, was what I was saying, you know, they have a chance if, if, you know, if some of the exploitation doesn't work exactly as smoothly as planned.

• 44:04Nilay Patel?

  So that's the cycle broadly. Again, you have far more technical expertise than I do, but that's my dumb version of it. There's a part where Apple could just talk to the FBI and smooth out that cycle, right? And say, it's iOS 14, here's the hole, it's going away in 15, but in 15, we'll tell you the hole, right? Like, they could just do that, because that's effectively what they're doing without communicating in some broken way. Is the value of the current system that friction and opacity? Because I, I think oftentimes, the value of the system is the friction, and we don't talk about it that way. But if, if I'm the FBI director, I'm like, just rotate the exploit, rotate the backdoor every year, so bad guys don't have it, but we do, and we'll just keep going. Is that a simpler way?

• 44:48Nilay Patel?

  Is that, because I've heard that, a version of that proposed by a different set of law enforcement officials.

• 44:54Speaker 03

  So the real thing that our technology companies have to export successfully is not their technology. They have to successfully export trust, or they are dead in the water and they cannot grow anymore. We only have 376 million people in the United States, something like that. Our internet and smartphone saturation is already very, very high. You know how mobile carriers in the United States, like cellphone carriers, they basically just trade customers back and forth, right? Because there are no new customers to really get on board, you know? Yeah, I guess as the population grows, but that's their limit.

• 45:33Speaker 03

  So this can't work as a system where Apple tells our government certain things and doesn't tell anybody else, because they will absolutely fail at their main business goal of exporting trust. They, they can sell no more iPhones than they already do, probably in the United States. They're going after China's market. China has an incredible, you know, untapped market when it comes to cellphones, and even, it's not so in current years, but there was a year or two. In the rise of iPhone, where China was massively outpacing the sales in the United States of in terms of iPhone sales and driving up, you know, essentially driving up the United

• 46:18Speaker 03

  States GDP. So, yeah, I think how I would like to see things work, I mean, if that's where you're kind of going with this is

• 46:25Nilay Patel?

  Yeah.

• 46:26Speaker 03

  Is look, I would like to see no backdoors and have the the United States government and law enforcement kind of stop that, right? We've we've been at this game for more than 20 years. Over 20 years ago, it was over strong encryption that, you know, where the government was like, hey, you can't, you know, go dark on us by having the browsers support strong encryption. So we're gonna make a strong encryption to be this export controlled thing. And it actually ended up backfiring because the United States was like, well, if we can't decrypt, you know, with our technology, if we can't break the encryption, criminals are going to get away with things, terrorists are going to get away with things. They were using the same arguments during what we call the crypto wars. What was the

• 47:09Speaker 03

  what was the unintended effect of that? Well, we had to ship browsers overseas that had weak ass encryption. I don't know if you're allowed to say that, but you know.

• 47:18Nilay Patel?

  It's a podcast, go nuts.

• 47:19Speaker 03

  Yeah. So we had to ship browsers with weak ass encryption. And guess what? We built the entire e-commerce, online banking, and everything on these browsers that had, everybody knew how to break it, types of encryption. So we basically weakened security for the entire internet and the burgeoning internet economy because the United States was afraid of not being able to see encrypted traffic. So I want the United States to stop it. Like, we're done. I mean, we're we're seriously, we're we're done with this argument, you know, about like whether you can break the encryption or not. And the fact of the matter is, you can achieve a lot of the same results by buying vulnerabilities and exploits from those who are capable of creating them.

• 48:02Speaker 03

  And I think that should be like a perfectly fine thing to do, um, you know, for, for people, you know, for, for security researchers, uh, encountering that yellow light when they come up to a decision, what do I do with this? And you know what? Why not sell one for a million dollars to, you know, the NSA? If you're thinking to yourself, well, yeah, you know, they're going to use it. Um, I'm going to trust that my government will use it to, to, to do things under warrant and get, you know, take down terrorists and take down child molesters and whatever. Um, and I'm okay with that one time. And then the rest of them, I'll give over to these defensive bug bounty programs. I still get paid a little bit. It's might not be minimum wage sometimes, but whatever, I'm okay with it. You know, they get it.

• 48:43Nilay Patel?

  So I want to focus on incentives again, because there's another trend that I'm seeing, particularly as relates to security, which may be a little tangential to what people are mad about, but a bunch of smart home devices, IOT devices have reached sort of their end of life, end of support. I think most famously Sonos just said, a bunch of our speakers are going to go away. We can't support them anymore. Pull them down, buy a new one, we'll support that platform. Uh, the first generation of Hue lights just hit end of life. Philip said, we're going to turn off the bridge. Your light, your lights won't work anymore. That seems, I, I, on the one hand, I get why everyone's mad their speakers aren't going to work anymore and their light bulbs are going to stop. Like, fine, I understand the frustration. On the other side, I completely understand why these companies are saying, hey, just

• 49:25Nilay Patel?

  patching bugs for these things are an ongoing cost that we don't want to support. And so I'm wondering if like a bounty system for updating those platforms would work for those companies to sort of prolong the life, or we've just got to give up on sort of the internet of things, because you hit a point where you have a million interconnected, vulnerable endpoints and nobody wants to pay to support them. And I'm just like, we've talked so much about the economics of security, uh, so far today. Like, I'm curious for your read on that, because it seems like a very tricky problem.

• 49:56Speaker 03

  It is a tricky problem. So, you know, one of the things I loved about working at Microsoft was the perspective it gives you. You know, when you're at the biggest software company in the world. And like a 1% failure rate on the patches means millions of computers go offline. You really get a sense of scope and scale and the difficulty of maintenance of some of these operating systems. So I was still there when they were trying to murder XP and they were like, "Kill it, is it dead? No, oh god, can we kill it again? No, why are our customers making us resuscitate this thing?" So I was actually inside and I remember some of the efforts that we made. So, you know, first we tried warning them like five years in advance. Like that was like, "Hey, just, just put it in your calendar.

• 50:40Speaker 03

  You're gonna have to do a migration, put it in your budgets and everything." But here is what happened, right? The biggest customers who were relying on XP, they basically said, "Look, it's not just the operating system, it's the applications that we, our business, our business depends on these applications running on XP and we don't have the money or the time to port all these applications to the latest operating system." And then the second thing, because we were like, "Well, what if we offered you free consulting services to like rewrite those apps for you?" Like some of our biggest customers were like, "We'll totally do it, please god, just upgrade." And they were like, they were like, "Yeah, but then we'd have to train everybody on the use of the new operating system and the new this and the new that."

• 51:22Speaker 03

  And essentially, it was like, it was like trying to like find the ruins of an organization in like a moss-covered grove in the middle of the jungle. And they're just like, "Yeah, but even just getting new wood to that area would just, you know, would cost more than the GDP of the planet." And we're like, "Yeah, okay." So then we said, "Okay, fine, if you want extended support, then it's gonna be, let's say, $25 million extended support contract for next year." Thinking they would say, "Ooh, that's more expensive than we wanna pay. We'll go ahead and take the, you know, business hit and the, the training hit and we'll redo all of these apps." And they were like, "No, no, thanks for letting us know, now we can put that in the budget." And we're like, "No, wait, no, hey, hey, no."

• 52:07Speaker 03

  And then we were like, okay, fine, fine, fine. You're fine with 25 million next year, 50 million the following year. They're like, awesome, we were just doing our three-year forecast. You just saved us a lot of trouble. Thank you so much. And we were like, oh, God. You know, so basically, the problem was the business needs and the business dependencies had grown like a freaking jungle around the ruins of this operating system. And that was just one, right? So when I look at IOT, I'm like, I can see the vines approaching. You know what I mean? Like, I can see, it's like, uh-oh. You know, this is gonna be deep in the foggy, foggiest rainforest. Or kind of installed on the side of a building really high up, really hard to get to and replace, you know?

• 52:49Speaker 03

  All of these things are bad, but I don't really know the best answer to stop it. Because if you force companies to support these things forever, one, that stifles innovation, right? Because no new player could ever come into the mix and be like, I'm a three-person startup with an amazing idea, you know? And, ooh, I want to get this thing to market. Oh, but I have to agree to support it for the next 14 years. Like, XP was under support for 14 years. 14 years, right? That's not possible. So, one, you stifle innovation. But, two, let's say you say, okay, you know what? Forget about, you know, maintaining it for X number of years after. How about if you just say you'll maintain it for five years?

• 53:30Speaker 03

  And after that, you'll send sort of a kill patch that will brick the thing and force people to get a new one, so that you won't have these things out in the world, running vulnerable, because people will have no choice, right?

• 53:42Nilay Patel?

  Yeah.

• 53:43Speaker 03

  Well, that ends up screwing us over when it comes to the already insurmountable amounts of computer hardware waste. Like, literally, the planet. You know what I mean? So, we're already choking on computer waste, and especially smartphone waste, right now. You know, especially, you know, everybody is trying to get the newest smartphones, and the carriers, you know, want you to buy the new phones, even if you don't need one. And so, we've got landfills full of computers and smartphones. My God, if we add IOT devices to that, you know, because we're forcing some sort of an artificial, like, brick, you know, brick patch of death. That we send to all of them to to deal with the maintenance costs. We're we're in trouble. So I don't have a rosy picture solution to to say about that,

• 54:27Speaker 03

  honestly. I think, you know, a lot of folks are looking at right to repair type of laws, right? Where, you know, you can take over a device, you know, that's out of service from someone and, you know, reverse engineer what the device is doing and then build some kind of a a support structure on your own and maybe offer it to other people. But right now, we have current laws that prohibit essentially competing. You know, that's looked at as a, you know, unfair competitive type of of thing when you reverse engineer a product and then try to provide similar services. That's against the law in the United States, according to the Digital Millennium Copyright Act. And so you would have to

• 55:11Speaker 03

  create some sort of exemptions or a right to repair, I think, to put the power in the hands of the nerdy people, like the kids in their basements, like me, right?

• 55:21Nilay Patel?

  I love the idea that I'm going to start a legal Philips Hue cloud service.

• 55:26Speaker 03

  I think that's great, and I would absolutely connect my lights to your dodgy, your dodgy ass.

• 55:31Nilay Patel?

  100% trust me.

• 55:32Speaker 03

  Homegrown, yeah. I'll be like, he's not listening in at all. That thing has no speaker.

• 55:38Nilay Patel?

  Yeah, the lights are on, he discovered. So last question, speaking of dodgy tech and security, it's an election year. This comes up a lot. Outside of this sort of misinformation, election interference stuff, there's just a lot of voting technology that it appears to be going well, in some cases, and totally awry in some other cases. What is the status of that? I mean, outside of, you know, the Iowa caucus app not working because they they just like didn't do a good job building it, what is the status of our actual election security? And sort of what is the economics of securing something like that where it only happens every so often? And there's like big vendors who are providing a bunch of stuff?

• 56:18Speaker 03

  Well, okay, so election security is It is a complex matrix of vendors providing, you know, the voting technology, the voting machines, voting software, all of that stuff. There's also the layer of election infrastructure. And that's bigger than just a voting machine in terms of security. That's going to be every poll worker's machines that they bring to the polls. Every machine that is used to tally voting, um, you know, vote counts and everything. It's voter registration databases that are handled by local, you know, county and state and city governments. This is what we call like basically the election infrastructure at large.

• 57:01Speaker 03

  And it's a big old mess. I mean, you, you probably could identify from some of the descriptions of those pockets that some of it's not even centrally managed, you know, in any way, even for a given election because so much of it, so much of our democracy relies on volunteer labor. And you're not going to basically provision a bunch of brand new, fully patched Chromebooks to election workers like all of a sudden. And even if Google wanted to, that would actually violate a lot of donation laws for things like elections, right? So we've got this, this problem here. And then further, let's say, let's say, you know, it wasn't that complex and maybe there's, you know, only a few vendors involved, which is not, not true, but let's say it was.

• 57:43Speaker 03

  Election certification runs at the county level and the local level as well. There's over 800 different jurisdictions in the United States, over 800. And so let's say you were able to, oh, I don't know, crazy style, do some kind of a bug bounty, which I've already, probably I've already dissuaded a lot of people from like doing bug bounties. They're like, oh.

• 58:05Nilay Patel?

  It sounds like you have a hammer and a lot of things look like a hammer.

• 58:08Speaker 03

  Yeah, exactly. That's what I say to a lot of people. It's like, you know, please, please don't bounty the election infrastructure right now. Um, because we actually, we physically don't have time before this election to have all of those 800 counties or even some of them recertify their election infrastructure. So when I think about like, oh, hackers can help us secure the election. I'm like, yeah, like four years ago, if we had started then. We might, yeah, we might have been able to affect this election. Look, I think, I think that, you know, the experts that I love to listen to who have done a ton of work in this space, you know, is folks like Matt Blaze.

• 58:48Speaker 03

  And, you know, he's, he's a, been working on election security for over 20 years of his career. And I think that, you know, the practical matters are, we just need to have ballots that can be manually checked on paper, where there's a paper receipt that goes to every voter, so that those paper receipts could be counted in, in the event of discovering an irregularity in any of that election infrastructure. And then rate limiting and risk limiting audits in, in all the elections. Because essentially, like, there's a lot of different places where somebody could interfere with an election. It could be in the machines, it could just be in the tallying, it could be in the reporting, it could be all of these different areas.

• 59:31Speaker 03

  And there's too much to secure all at once before the deadlines, and we wouldn't really be able to get it all recertified anyway. So, listen to Matt Blaze, read his work, you know, watch his congressional testimony, and, you know, perform these elections with either, you know, with, with definitely a paper trail that, that has a receipt that goes into the voter's hands in, in the event of a recount, you know, needing, needing to, to be able to tally those. And rate and risk limiting audits for all the elections. And that's the answer. I mean, it's not as sexy as a bug bounty, but then again, nothing is. You know, bug bounty's alliterative, right?

• 1:00:07Nilay Patel?

  That's great. Okay, my actual last question, I ask this of every CEO who comes on the show, and it's really just a very selfish question, so I might improve myself. When do you work?

• 1:00:19Speaker 03

  Oh.

• 1:00:20Nilay Patel?

  When do you, when do you sit down and actually do the, the work of the individual contributor? You read emails, write emails, write memos, not meetings, not whatever. When do you work?

• 1:00:29Speaker 03

  I am a night person. I am a creature of the night. So, you know, my brain often won't turn off at night until I do some things. You know, I kind of have to offload a lot of what has been percolating in my head all day. So sometimes it's, you know, I get my best work done, like, in the wee hours of the night, you know, after 11:00 PM, before 3:00 AM, somewhere in there. And I actually tell people who work for me to never be online during those times, like, never do that. And then if I accidentally send them an email during that time, because I usually will draft them and hold them, because I don't want anyone thinking that my, my working hours are, are something that I expect of

• 1:01:11Speaker 03

  anyone who works, works for me. Yeah, if I accidentally send an email, that's, that's in a, in a weird thing, I usually say something like, "This is probably coming from the wrong time zone. Ignore it until you're in the right time zone for you to do work." But yeah, for me, myself, it's the wee hours. I'm a, I'm a creature of the night, nocturnal, naturally nocturnal, yeah.

• 1:01:31Nilay Patel?

  Are you good at context shifting?

• 1:01:33Speaker 03

  You know, they say that's what multitasking really is, like, nobody actually multitasks. It's all just like a series of, of fast context switches. I think so. I, you know, have had ADHD my entire life. I don't, I don't medicate it, so this is it. This is what happens. But, you know, there's an actual squirrel outside my office area that squirrels me in real, real time. And I will tell people very, you know, very, very much out loud on a work phone call, I'm like, "No, no, hold on, the squirrels are outside." They're like, "Oh, ha, ha, ha." I'm like, "No, real squirrels, and I must watch them now. This is important. You don't understand," you know? Yeah, I mean, I can draw the curtains, but why? You know, it's been working out. I feel like, you know, neuro, neuroatypicality is what they call

• 1:02:17Speaker 03

  it these days. I feel like we, you know, we as a species evolved with all of the different, you know, sort of neural spectrum. In order to survive as a species. So while everybody else who can concentrate on one thing at a time was totally like, I don't know, husking rice or something. I was trying to husk rice, but there's a tiger right there and I just saw it. So like, you know, I mean, the thing is we're, we're all kind of part of the tribe. And I think that, um, you know, my working style might not be for everybody. Um, but it's, it's so far it's worked out okay for me and, and the DOD and Microsoft and a bunch of other places. So.

• 1:02:54Nilay Patel?

  Exactly. Katie, this has been an incredible conversation. Thank you for spending so much time with me.

• 1:02:59Speaker 03

  All right. Thanks.

• 1:03:01Nilay Patel?

  All right. My thanks to Katie Mysteris. Super interesting conversation. Excited to have her on and we're definitely going to have her back soon. We're back on Friday with the chat show. I know we were off last week, so we got a lot to catch up on this week. As always, you can tweet at me. I'm at reckless. Love your feedback. Let me know who you want me to talk to, what you want me to cover. Like I said, just a lot going on. So I'd love to hear from you so we can focus and make the show good. So we can focus and make the show great. We'll talk to you soon.

• 1:03:27Speaker 04

  How many discounts does USAA Auto Insurance offer? Too many to say here. Multi-vehicle discount, safe driver discount, uh, new vehicle discount, storage discount.

• 1:03:36Speaker 03

  How many discounts will you stack up? Tap the banner or visit usaa.com/autodiscount. Restrictions apply.