Unspoken Security Ep 6: What if Paying Ransom was Illegal?

And the third reason I'm kind of pro-banning payments is I think it'll force cultural changes for both private and public organizations to adopt more of a security-first mentality. So I think tactically, in terms of backups, culture will get improved if the threat actor's primary focus is financial. You want to have the most efficient business possible, you're going to take your ransom somewhere else.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cyber security professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started. This is how legends are made. Hello and welcome to another episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or are first-time listeners, I'm a traditional intelligence guy who spent nearly 20 years in the intelligence community, both within the US Air Force and then as a defense contractor. Most of that time was spent at NSA. I've been in the private sector for about 8 years now, primarily building or helping other people build effective intelligence-driven security practices. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! The goal of this podcast is to bring all of these elements together with some incredible guests and have authentic, unfiltered conversations, even debates, about a wide range of challenging topics most of us are facing every day. This will not be the typical polished podcast. You might hear or see my dog. She's literally over here sleeping right now. People may swear here. We may argue or debate, and that's all okay. Think of this as a podcast. It's a conversation. You know, it's like, like one you might overhear at a bar after a long day at one of the larger cybersecurity conferences. These are those conversations we usually have when nobody's listening. Today, our guest is Brian Stack. He's the Vice President of Engineering and Dark Web Intelligence at Experian. Before his current role, Brian has been a leader for over 20 years in engineering and product development. So he's getting kind of old like me. He has a bachelor's in computer and systems engineering from RPI, Rensselaer Polytechnic Institution, and a master's in computer engineering from UC Irvine. So Brian, anything I left outta your, uh, profile background, anything you want to add?

Yeah, I would say so. Just like you, I did actually start my career working for Lockheed Martin, doing a lot of military work and had the whole top secret clearance and kind of that whole dog and pony show before I had my own business for several years, then got into the private sector and obviously working for Experian. So definitely seen it all, so to speak, across different markets.

Yeah, that's a good point. I'm glad you mentioned the clearance piece. I actually, I Should have probably put that in the original one, but it's better for you to, to mention it than for me to, right? So, so both of us, yeah, have that background. We've done some, some work on the cleared side and seen it from both sides, right? And, and you've been doing really cool stuff at Experian. I know you and I, you know, presented together, uh, earlier this year on some cool dark web stuff. So I, I mean, I, I could talk to you about 1,000 things. It'd be a lot of fun for sure. You know, to do that, I'd love to get in deeper on some of those things. Today though, today we're going to focus on just one thing. We're going to talk about ransomware. So the title of today's episode is Pay the Ransom, Go to Jail. All right. Yeah, maybe it's a little bit dramatic. I like dramatic titles, but it does lead us into the discussion I want to have today, which is, you know, about the challenges we're all facing with ransomware and the debate over when, if ever, it's okay to pay the ransom. But before we tackle that, for those who might not be entirely familiar with all the ransomware issues, like the first question we should go into is what is ransomware? How big of a problem is it? Okay. It's multiple questions. And what are you seeing on the experience side? You know, regarding this challenge. I know you guys do a lot in this area. So let's start there. Talk to me a little bit about what do you see in ransomware? Describe it to folks that are listening and, you know, some of the challenges there.

Yeah. So yeah. So great initial question, AJ. So not all ransomware is the same and there's actually, you know, generally right now there's about 4 types and it's really about how the ransomware goes down, how the extortion goes down. So there's kind of single extortion ransomware. Which is what most people think of ransomware. You know, a threat actor comes in, they lock your system, and they say, you know, give me, give me $10 million. There's, uh, the double extortion technique was created a few years ago where they, they lock your system, they exfiltrate data out, and often will publish some of that on the dark web. Triple extortion, they, they'd like to turn the heat up a little. So again, here's the evolution of, right? So triple is, yep, they lock your systems, they exfiltrate data, but they'll also layer on maybe some type of DDoS attack. Attack on maybe your public network, on your internal networks, whatever they can get, you know, whatever they can hit to again disrupt your systems, disrupt maybe again, if you're a private company, disrupt your profit flow. If you're a public company, disrupt a school, a hospital, again, turn up the pressure. The one that came out recently, and I think it was the C-Lock ransomware gang, quadruple extortion. So they did all the previous three, plus they took that data they exfiltrated and they started to publish it more to the surface web. On, on social media. So to be like, hey, let's say, you know, company, I don't want to name many companies, but Company X, you're, you're a customer of, they would hit that Facebook page or, or Twitter feed for that company, be like, hey, customers of Company X, we have your data. Maybe you should give them a call and have them pay the ransom. So again, involving the consumers or the clients of a company to again, increase, increase the pressure to, to pay the ransom.

That's, uh, that one's wild to me. So I know that's relatively new, right? And I remember you were the one that first introduced it to me. I hadn't seen it yet. And I think that's incredible. You know, it's, I don't want to root for the bad guys or the criminals in this case, but you know, we got to give them credit for, for, you know, you showed the maturity, right? That there's a process here that there's growing and changing and getting to the point of saying, hey, we're going to make this public and actually have the public put pressure back on the victim really in this case. Right. So, you know, like you said, putting some of this stuff online to push the retailer to say, hey, You know, we're the criminals. We've stolen all your information. The company you do business with doesn't care enough to pay us. Maybe you should make it more difficult for them, right? Raising the heat and the pressure on those companies. I think, I mean, you got to give them credit. They're creative, but, but it makes it so complicated, right? You said this was, you know, single was what we all knew originally ransomware, right? Now you got double, triple, you got quadruple ransomware. Like this is just, and it's an amazingly difficult a problem, it seems like. You know, what are you seeing in terms of like costs and impact for this? Like how widespread is this? How, how expensive is this?

Yeah, so it has been growing and you'll, you'll hear that like identity theft has grown. You always kind of hear that metric, right? But it's been about 30% growth over the last 5 years. And so my team on the dark web, we've been scouring, we've been doing this for a long time and we see more and more of these, the kind of the, the double extortion where the data's exfiltrated out, Showing up on a lot of these dark, dark websites. So about 13% growth. The, the average ransom is just under $2 million, about $1.8 million. Now, now some of the extreme cases, what was it? The, the National Health Service out of the UK. They were, that was a $100 million ransom that was asked for them. More recently, so, you know, probably more close to everyone's memory, you know, Vegas got hit over the summer. MGM, Caesars, and that was in the, the $10 to $30 million range. Caesars did pay according to some of the reports. MGM is still undetermined whether they paid or somehow they had their, their data backed up enough to restore their systems. Mm-hmm. I haven't heard a clear, I haven't seen a clear written article distinguishing either, either way. But again, start hitting Vegas, you're in the, you're in the $10 to $30 million range that some of these ransoms are trying to get out.

So. That's incredible. Like, and, and it's a pretty profitable business, it sounds like. It doesn't sound like it's all that hard to accomplish either. I mean, we see this happening everywhere, right? So the barrier to entry must not be remarkably high. But yeah, you're talking tens of millions, $100 million, you know, ransoms. So it's not just you and me getting hit. I mean, I know regular people still get hit occasionally too, but you know, it sounds like they're really targeting these, these large corporations, which makes sense, right? That's where the money is.

Well, well, that's what they, right. And that's what we've seen where I think the shift about 5 years ago was that with a lot of these data breaches, you know, this data was used by organized crime or others, and they'd monetize it. They would sell the data. Now they learned, boy, this is just so much easier. Let me just do that and potentially get paid on both sides. Do the ransom, have the data exfiltrated, person pays the ransom, but then they still monetize that data for another attack somewhere else or use it to layer in future attacks. So, you know, they're trying to, again, as a business, they're trying to operate, you know, they're trying to maximize their asset, which is, hey, we've stolen this data. Like, how do we maximize profit for that? And ransom is just another piece of that, that, you know, that value chain for them.

Yeah, that makes sense. Well, and with the Vegas one, right? So I was in Vegas not long before this. A lot of us were at Black Hat and DEF CON. It was not us. It was not related to the Black Hat and DEF CON conversation for anybody wondering. But, you know, Vegas basically prints money, right? I mean, it's We've all been there, right? I don't know. I don't know anybody who walks away winning often. It's just how it works, right? It's fun. How much money are they, I mean, how much money are they losing when the, when the floor's down? They're just printing money, right? So, I mean, does it, in their case, did it just make more sense? I mean, we don't know if they paid it in, like you said, you think one did, we're not sure about the other, but the math probably made sense, right? How much, do we have any idea how much money they generate hourly on the floor? Like any guess?

I have no idea. I mean, it, it depends. I mean, it depends on, on the, on the casino, but yeah, you know, you're talking about millions and millions of dollars per day. And again, I think also for MGM, there was the casino piece, but also it hit like the rewards program. I think some of the things in terms of the hotels and being able to get reservations. So this was, you know, this was a catastrophic event. It wasn't just, hey, you know what, our, our daily cut of the casino's getting hit. It was, you know, just, and then just the overall brand, just being able to consumers who are there and say like, I can't get a room, I can't get my reservation. The reports I saw was Caesars, again, they had a third, it was a $30 million ransom. According to public records, it's, they pay $15, so they're able to negotiate it down.

Oh, 50% discount. What a deal. What was that deal there? Yeah, they really worked that one out. Well, I know, I, I mean, I got notification. I'm in the rewards programs for, for both, you know, casino groups. And yeah, I got notified, right, that there was the breaches, which is unfortunate. And it was a lot of data, right? Wasn't it like terabytes of data that was taken in this?

It was terabytes. Yeah, it was, I think around 6, uh, 6 terabytes of data from MGM, Caesar. It was a, I think it was a roughly around, around, around the same, the same amount. So. Very, you know, large amounts of data. And, and again, they, you know, you don't know how those negotiations go. Like, hey, we'll be sure to destroy the data. Like, you know, are they going to do that?

Of course they're not. Yeah.

Or they'll, right? So yeah, you may get your data back. It may be unlocked, but in terms of, you know, verification that they deleted the data, that's never going to happen.

Sure. Yeah. That's, uh, that does add to the complication, right? I know we're going to talk a minute about, you know, whether it should even be legal to pay, but then the question, of course, forgetting the legality for a minute.

Yeah.

If you do pay. A, do you get your data back? I mean, sometimes you can't. Some of these groups don't even have the ability to decrypt it, right? If you do get it back, does that mean they've destroyed all copies? Pro— probably not. I mean, why would you, right? Why wouldn't— if you're a criminal, right? Why would you hold onto the data and still sell it, right? Make more money. So, you know, it's, you might get access to your stuff back, but it's hard to say that you're actually gonna have it protected. For, for these, do we know who did this? Like the Caesars and, and MGM, for instance? Do we know anything about the group?

Yeah, it was, oh God, it was, uh, Spider, uh, Scattered Spider. Was, was the supposedly the ones who did it. Again, some of the times, unless they come out publicly and say, and even if they do come out publicly and say, you don't, you don't know if they're trying to piggyback off someone else sometimes. So, you know, they're a little, you know, so, but according to the reports, it was Scattered Spider.

Got it. All right. So, all right. So great job, by the way. I really appreciate you taking some time to kind of walk through, hey, what is ransomware? And, you know, from single all the way up to quad, you know, pretty impressive stuff and some stories about this. So it's, it's really interesting, right? And it's been a longstanding business for criminals, a really effective one. So let's talk a little bit about, you know, the main point we kind of want to get into here, which is paying the ransom, right? What if, what if paying the ransom was illegal? I mean, people have talked about this before and like, listen, I've always told people don't pay the ransom. I think, I think the FBI says don't pay the ransom. A lot of people do. Rare exceptions, life and death, you know, ransoming hospital systems. I understand that. I've also had previous discussions with guests, you know, and we've been honest and said, yeah, I may recommend that. But if, if the most important data in the company was ransomed, And, you know, you're the CEO and you've got to give a briefing to the board next week. There's a lot of cases where they're going to pay whether we like it or not. But putting that aside, what if paying the ransom was illegal? Like, do criminals even care about the law? Would it do us any good if paying the ransom was illegal? I'm curious about your thoughts.

Yeah. So, um, uh, I've leaned towards, yeah, we should definitely make it illegal. And the reason is, it, it, one of my pet peeves kind of just in the information security, cybersecurity space in general is we look at all problems through the lens of we got to buy a tool to solve it. Right? And I feel like we need, we need, we need as an organization, like, as a culture within the community and as thought leaders to be like, not everything needs to be solved with some brand new tool or now some generative AI tool that's going to fix this. Right? I think looking at novel ways, and I think this is potentially one novel way of doing it. And specifically kind of the Caesar, the recent thing made me think about it even more. So apparently it came out afterwards that Caesar was hit before MGM. So if Caesar had told Scattered Spider, it's illegal in Nevada, we can't do it. My, my assumption is that, guess what? MGM wouldn't have gotten hit, right? Because they would have moved now. They probably would have hit a casino in California or somewhere in New York. Or they would have been like, oh, you know what? Vegas is kind of off limits. That's, that's my—

Do you think that really would have happened? You think criminals wouldn't have said, we don't care if it's illegal, we're going to hit you anyway? You think they really would have just moved on someplace else like that quickly?

It, I think it would've, again, they're running a business. So if, if, if Caesars came back and said, no, it's illegal for us, we can't do it. There's these obstacles for you getting this.

Mm-hmm.

And probably we're not gonna be able to overcome. You're gonna go where you have a, have a greater chance of succeeding in your business. And so forget about the illegal part. Like these are difficult clients now. Where are easier clients?

Right.

Can go to casinos in New York, in California, and they don't have the law. And so let me, let me, that's the position I'm thinking of how it could work.

That's, and that's really interesting. I mean, I know you do too, you know, talk about how criminals, criminals like the pathways to resistance, right? You know, the number one thing for criminals, cyber, physical, whoever it is, is success, right? I want to get in, I want to get out, I want to make my money. I don't, I want a low risk of getting caught. I want low friction. I just want to move on. So, I mean, in that regard, I think what you're saying resonates, right? If it's too difficult to do it in Nevada, I'm going to move someplace else. You know, the flip side, of course, is they might push the issue at first. I don't know that they would, I don't know that they pivot on immediately. I suspect if I was the criminal, I might challenge that and be like, well, let's find out, let's hit you anyway. But I think it might start the process, right? If nobody pays, then it wouldn't take long, I suspect, before they move on. But then that brings up the question, then if we made it illegal, wouldn't it have to be federal? Like if it's illegal at the state level, you just said it, they're going to move. Hey, Nevada says can't do it. It's illegal. All right. Criminals are going to hit New York. They're going to, a lot of states have gambling, for instance, using casinos as an example, could be banking, could be anything. So doesn't that mean we'd have to make it a federal law as opposed to a state law? And then, then criminals theoretically would stop hitting American companies. Do we go that far? And has any of this even happened yet? Are there state laws out there?

There, there, there are. So North Carolina in April of 2022. So, so a little over a year ago. They put in a pretty strict one. So that, that law, without going into the, the, the gritty gritty details, basically says you cannot pay ransom, but you also cannot interact with the ransomware gang in any fashion. So you can't even have a communication with them, right? Florida law came in shortly after that, July of 2022. So a few months after this, I think the Florida law probably has it right. Being that they said you can't pay the ransom, which I think is kind of what we're saying is kind of the foundation of what we're trying to experiment with here. But they said you can communicate with the ransomware actor. The reason I think that's useful is, so I'm thinking, like you said, practically, something's happened. You know, you're the VP of Engineering, you're the CISO, you're at least trying to debug and being able to communicate with the, the threat actor, maybe you can at least discern what systems they hit, Maybe how they got in, right? So that, that open community, at least making communication possible, may allow you to maybe figure out like what exactly happened, how to patch it in the future, or, or, or again, how to, how to, how to recover, give you a better probability of being able to figure out how to recover from it and make sure that it is eradicated from your system as you try to move forward. So those two laws exist.

Hmm.

I'm not right now. I'm not. So I'm not leaning. I would, I lean towards states trying this out. Because maybe I'm totally wrong. Maybe doing this has some crazy unintended consequence I can't see. Right? So doing it across on a federal level, I'd say let's have, I mean, the beauty of the United States is we are a republic. We have different states. We can experiment. And so I think this is a great way to experiment on this to see what works and what doesn't work. So I'm glad to see that both North Carolina, Florida and in North Carolina both have slightly different laws. So we can see maybe which one works a little bit better.

Yeah, I mean, that's a really interesting point. I like, I like the idea of it being experimentation, right? You know, unintended consequences. Listen, anybody who's worked in Intel, anybody who's worked in the military, we all understand second and third order effects. You, you plan for these things and then you wait and see what happens. And a lot of times our plans are wrong, right? So there's so many things we can't account for, you know, would this anger criminal groups? Could they, could it be the opposite effect? Could they say, well, we're going to hammer all of you in this state to prove a point and drive these laws out? So, You know, maybe it, maybe it has a, an effect we hadn't considered as opposed to them just pivoting on. So I think that's a good point. And, and I think you mentioned to me before we started, I know there's a few other states that are kicking around some laws too. Arizona, Pennsylvania, New York, and I think Texas you mentioned are all kicking along different possibilities about banning payments, right? So I think it'll be interesting to see. I, the North Carolina and Florida laws, you know, you said they're 2022, so they've actually been around for a little while. I don't know, I don't want to put you on the spot. I don't know if we have any data that shows whether ransomware attacks have gone up or down in those states or anything. I don't know if We've gotten to that kind of data yet.

I, I, I don't think we have enough, enough time has passed to get any type of significant trends. I haven't seen any major ones in those, in those areas, in those specific states. But I, you know, I haven't done enough due diligence to see if some of the soft targets, you know, small schools and others that, you know, may have been hit. And some of these laws, so again, like the Florida law is, is very specific around government institutions, local governments.. So they're not necessarily tied to, to private, private companies. So again, figuring out is this purely, you know, state-run businesses and organizations or affiliates, or is this something more, more broad across the, the entire state, including private and, and public institutions? So again, another variable to figure out.

That's, that's a good one to, to mention too. So I know, you know, here I'm in Minnesota, we've had, you know, ransomware attacks on Education, the, the public school systems here have been hit and, and nationally that's been an issue, right? Attacks on public schools are up on, on public institutions, schools being a big part of it, have, have gone up dramatically as I recall over the last year or so. You know, because those institutions generally are underfunded in terms of cybersecurity and, and therefore may not have the resources they need to, to protect proactively or to react, you know, they don't really know what to do a lot of times, right? Unfortunately, they also don't have the money. So ransoming a public school system tells me you don't know much about how much we fund our public schools in America, but You know, it's, I've seen that go up. So it's interesting. You mentioned there's been the public and private sector, you know, implications here, right? Because public sector, obviously the government has more authority to tell the public sector what they can or can't do, I suppose. I'm curious. So, you know, some pros and cons, right? If we made ransomware illegal, you know, some of the outcomes we would expect to see, you know, what, what are some of the, you know, good reasons for trying to get this and maybe some of the negatives you've already considered?

Yeah. So I'd break it up into two pieces. One, just think about just kind of the rationale against just paying ransomware, like in general, like, you know, what, what, what are the kind of the motivations of ransomware? What are some of the issues, right? And so you have no guarantee of data recovery, as we said, like, generally, Ronnie, again, if, if someone's purely a ransomware gang, their business is to build— it sounds crazy, but to build some level of trust that you pay us, we'll honor that, and we won't, we won't hit you again. But again, there's no guarantee, depending on who you're dealing with.

Sure.

The other piece is copycats, right? If you're paying the ransom, you're endorsing copycats. And some of these ransomware gangs are, are purely a business, but others do fund, you know, terrorist organizations and other things. So again, you're, you paying a ransom, you're not only promoting crime, you could be promoting, you know, terror organizations across the world. There's, in the same way, you know, the United States doesn't quote pay, you know, pay off terrorists because they don't want to kind of repeat attacks. Again, if you do that, maybe not for your business, but for other businesses like yours, again, if you're a public education system, a hospital, you're a soft target, you're, you're allowing, you're encouraging that type of behavior. If you're a big business, public perception, again, depending on which ransomware gang you're paying, You know, obviously there's a lot of, you know, some of the current wars that exist. If those organizations are tied to, you know, whether Russia or Ukraine, some of the stuff going on in Israel and Gaza, if they're tied to those organizations, there could be a brand issue with your company, depending on which ransomware gang and where they're located, you paying them. And then just the security investment piece, I think of you're taking money that you probably should be investing internally to improve security. So, so just like the, those are just broad strokes about when you pay ransomware, here are some of the negative pieces specifically around legislation. I think by doing this, you remove the financial incentive piece from these attackers hitting governments, private institutions. Second, I think restrictions on the ability to purchase decryption keys. So you've, in other words, you can't get the decryption key, will force these institutions to really put together a better plan around not just their security. Security is really hard, right? It's always changing, right? All it takes is that one, that one. I mean, again, we talked about Vegas earlier. They have some great IT security folks. They can make a lot of money. They invest a lot in security and they still got nailed really hard.

Absolutely.

Right. But I think what a lot of businesses don't do is the backups, right? The restoration and backups because it's expensive. Oh, you know, what's the chance of a catastrophic event? So they don't do it, or they only back up like key pieces of data, not everything. Yeah. So I think it'll change that, hey, we need to— we're going to assume everything's going to get locked down for a true catastrophic event. Like, how do we recover from that? So I think it'll improve that. And the third reason I'm kind of pro banning payments is I think it'll just change— it'll force cultural changes for both private and public organizations to adopt more of a security-first mentality. So I think tactically, in terms of backups, culture will get improved. And I, I, I do believe it will. Again, if, if the, if the threat actor's primary focus is financial, so forget about kind of the nation states and the anarchist groups, which are different ones. If you're an organized crime organization, you're going to just, you're, you want to have the most efficient business possible. You're going to take your ransom somewhere else.

Yeah. I mean, that's a good point, right? I mean, most of these are criminal enterprises. Yes. There's some nation state. I mean, if it's hacktivists, if you're pulling stuff for political reasons, Whole different set of motivations. The laws probably won't do much there, I don't imagine. But, but your point is, is valid in that most of this is criminals, right? Uh, this is a, this is a big business and criminals, again, their number one concern is success. They want to get in, they want to get out, they want to get caught, they want to make money. And so it's financial incentive by far. So what you're saying is, you know, legislation could really remove a lot of the financial incentive. Makes good sense. I think that the next two points were really interesting in that you talked about, you know, being, uh, removing the ability to, to buy the decryption keys, right? Because you can't pay for them anymore. And forcing that, that change in culture. Because I think, I think it's an interesting point. I don't think it was mentioned to me when I've talked about this in the past that there's probably a sense that, well, you know, worst case scenario, we'll just pay the ransom. Like that's the backup plan, right? Is if, you know, backing things up is difficult and having all these positions in place where we can pull things again. So, and maybe it's expensive, although storage is certainly getting much cheaper. So maybe they just think of it as a safety net, as you know, If something horrible happens, well, at least we can always just pay. And what you're saying basically is, well, that would get ripped out. You wouldn't have that as an option. So now you're going to have to be more proactive because there is no fallback position of just, ah, just pay the bad guys. And I think the pieces you mentioned earlier, you know, these are the ones I talk about all the time too. If you pay the ransom, you're going to get hit by ransomware again. Like you're on the list, you're a known payer now. So you're, you just, you've told people you're a payer. So why wouldn't they hit you? You've proven that you're, you're weak. In terms of standing up against these things. No offense, Tampa, when I say weak, you might just not be in a position to be strong enough, but you've proven you know the backups, you're confident, all those things, right? And, you know, the negative public perception is an interesting one. You talked about with, you know, with all the politics, right? So if you end up paying a ransomware group that supports one side of a war, now you're labeled as supporting that war, I guess. I mean, you might not have intended to, but you are, right? You're funding this war whether you like it or not, which is big. And, you know, the security investment component you mentioned, which is of course huge. It's funny how many organizations don't have enough money to pay for security proactively. No, no, I keep cutting the budgets. You know, we can't prove the ROI on this. We better not spend. And then all of a sudden they come up with $30 million for ransomware. So, you know, it's funny, apparently you have the money when you need the money, right? In some cases, and not everybody, of course, this isn't a blanket statement, but you make a good point. If you just said, hey, we're never going to pay ransomware, you know, we're not going to pay the ransom groups, that's money we could be putting into other places. Because I'm sure some organizations are budgeting for this. Obviously there's cyber insurance tied to this, I'm sure too. So there's, there's a payment into that, but, you know, if, if all these changes happen, I think we covered some of this, but, you know, how much do we think criminals would care? You know, again, their, their goal is financial. We know that. So, you know, there'd be some changes in, in this, but, you know, I'm curious, you know, how much do we really think they care? What would it do for the, you know, groups that are doing, say, cyber espionage? What does it do for organizations that are motivated by politics instead? You know, is this, would this have any effect on them?

Yeah. And so, yeah, my position is, and I think you mentioned this earlier, right? If, if it's, if your motivation is political, right? So I think what was it, the Sony hack from North Korea a few years ago?

Absolutely.

Right? You did a movie that came out like that, that won't change. Like that'll happen, right? Their motivations are, are, are, are different. But again, most of the folks who are mature ransomware gangs, they're organized crime organizations. Yeah. Some of them do have tentacles into other places that fund different things politically or, or, or through terrorist organizations. But again, most of their primary business is financial. And so just like, again, think about it. You're running a business. You're always looking at how to make things efficient, how to get the most EBIT out of something, right? And so when you have a— framed it as a difficult— you have a difficult client with potentially a long procurement process to get that ransom because now they got to go get an exception from the government. Like, What, why, like, why are you going to, unless the payday is $100 million, like, why are you going to deal with that? Like, just go hit 5 hospitals that, you know, there's, you know, they got that, they got plastic surgery units that make a lot of money. We'll get, we'll get a million from each of those. Done.

Yeah, that's a good point. Well, and you know, hey, maybe they'll just ramp up business email compromise, which still costs, you know, what is it, 10x what ransomware costs worldwide anyway. That's a whole different discussion, by the way. Ransomware is important. I'm glad we're chatting about today. We got to have some discussion about business email compromise at some point. But yeah, I think you make, you know, a lot of good points there, you know, so there'd be some changes. It wouldn't do much for the political stuff, you know, in the espionage, you know, it's challenging. But I think you said it like it also depends on the payout, right? You know, if the ransom, if there's real money to be made in it, if there's, and they're all real money, there's Vegas money to be made and if there's bank money to be made in it, You know, they may be willing to go a bit further and push a bit harder. I would, I would gamble that not to use a pun for Vegas, but then if it's small time, you know, right. I think, you know, the risk reward is also part of everybody's business model, including criminals.

Right.

I'm sure they're willing to put in more time and effort and be a little more patient. I mean, I've seen some groups. I'm noticing that you've seen this too. The customer service has really ramped up in ransomware over the last several years, right? Where there's platforms and they'll actually give you customer service. Like if you're calling Best Buy or something for a computer problem to help you buy your Bitcoin and, and where do you put the money? Like, it's amazing how professionalized some of this has become, right?

Well, right. And so like I tie it back to something we talked about, like, hey, the Florida law looks maybe it's better, right? Because it allows you to at least talk to the threat actor to maybe get some information. I could see them saying, you know what, we'll hit a few Florida places. We know we're going to get the ransom, but we'll charge for customer service. We'll charge to tell them what we did and how we did it. Like, it'll be low, you know, it'll be our bronze package. Yeah, you know, here it is, you know, we'll take $100K off and we'll tell you like what we did. It's red teaming.

It's guerrilla red teaming at that point. You didn't hire us, but we did it anyway. And now you're going to pay us to show you what we did. But it's not really a ransom anymore. It's just, it's guerrilla red teaming. They'll remarket themselves.

Correct.

Correct. No idea for the rest of the groups out there, by the way.

Joke about it. Right. But again, they're creative. They're very creative. And I could very easily see something, something like that happening.

Yeah, I could too. That's sad, but true. I mean, I sit here and laugh about it, but yeah, these guys, they are creative, as you said, and they're business people. You know, these groups are not everyone's the same, of course, but a lot of these are really professionalized business groups. And yeah, they'll, they'll find a way to pivot on some of this stuff, but we got to try something, I think. So, you know, All right, moving on to the third of the three questions, at least the main questions we have here. So we've talked about what ransomware is. We've gone through some of the, you know, the details about it. We talked about maybe we should make it illegal, whether it, you know, whether it be federal, whether it be state and some of the, you know, pros and cons of that. But what do we think? And again, we won't get all of them obviously here, but we should probably at least lay out some ideas on unintended consequences or exceptions that would happen if there were these new laws, you know, so, you know, what are your thoughts about that? First figuring state level, you know, I mean, aside from the fact I worry this would pit states against each other and we should probably talk about that part too, but what are some of the unintended consequences and, and some of the exceptions you could see to a law like this?

Yeah, I mean, so I, I think some of the unintended consequences is, is potentially, maybe there is a, a, a, a revenge piece where they say, you know what, we're going to hit you harder to try to break the law. Potentially, you know, potentially this could make things worse. That's, that's that, that is a variable on the table. I think also some of the looking at, again, most of the laws are structured around, you know, public institutions, government-run agencies. That could just shift a lot of things towards, you know, private schools and private hospitals, right?

Sure.

Within, within the state, which could have, could have, have an issue. I think trying to figure out what is the right, what is the right parts of these laws in terms of can you communicate, can you not communicate? Maybe is there just a limit? The type of, are there exceptions around the type of data that's exfiltrated or stolen? Like if it's MRIs and health records, does, should there be an exception there? My initial gut is probably it shouldn't matter because I often get asked that question a lot of, hey, you know, We talk, I might talk about how my guys, you know, see data breaches with MRIs and CAT scans and, well, why do threat actors care about that? They don't, they care about the PII attached to those records. They don't, you know, they're not going to, there's no blackmail of, hey, we know, we know you have ALS.

We know you have cancer.

Right, right, right. So, like, I think people view that as much more sensitive data, but when you boil it, boil it away, it really is just about the personal information and, and being able to hack into somebody's email account, stuff like that. So the, the, I don't think there needs to be a carve out for that, but maybe somebody could, could, could, could make the case for some of those situations. Maybe they need some exemptions.

Well, and if they're just holding the system hostage, right? Forgetting the data for a minute, if they've rocked up the system, I mean, there's got to be, I assume exigency, you know, using a legal term, would come into play, right? If it's life and death, if you're holding a hospital system hostage, all their systems are locked up, you know, think of the casino, but it's a hospital in this case, right? So now I can't perform surgery because none of our systems work. You know, we've got people that are on life support and now we can't trust the monitoring systems, et cetera. So I assume in that case, there would have to be some sort of an exception. Unfortunately, that would, you would also have to deduce would raise the, raise the interest in targeting life and death situations, right? Targeting hospitals, you know, so there's, there's an unintended consequence I would imagine there and that bad guys are going to realize, well, hospitals can pay, they have to pay, you know, exigent circumstances. So let's just really hammer the hospital systems. Because law or no law, they're going to pay. So I mean, I guess I'd worry about that part.

Yeah, I guess I have a hard time of looking at the timeline of seeing someone's life being at risk where, you know, the ransomware, the threat actors come in, they lock up, you know, your MRI machines or some of the, I mean, some of the equipment now, the remote equipment is pretty amazing between hospitals and experts. They lock it up. Like you're about to start a life-saving operation. I think people are like, well, we need an exception for that case. I don't think appreciate how hard it is to get a decryption key, bring the encryption key and try to decrypt everything, restore the system with it. Not to be callous, but I feel like if someone was in that crazy situation, probably they're not going to survive it because it's probably going to take at least time to recovery, probably at least 2 hours in that situation. So it's like, I get like, oh, naturally feel like you need a life exception, like the kind of, you know, but I don't know if it's a practical problem that would, would, would, would raise that.

I mean, I guess I would advocate, I don't disagree with you, but I guess I would advocate for the exception then because let's at least not make the law become what people blame, right? Just go ahead and put the exception, let them try if they want. They're going to, if they're going to succeed or fail, that's separate, but at least we're not, we're not slowing down their abilities to try to save lives. I'd put the exception in just for that purpose. I think you're probably right that in a lot of cases it wouldn't work out the way people would want it to, but I wouldn't want anybody to be able to turn around and blame the state for the law, right? You know, so I, I think that's an interesting point. I mean, there's other issues in, you know, what do you do with multi-state corporations, for instance? You know, who has jurisdiction then? Is it where the attack took place? Is it based on where the company is headquartered? You know, will companies be able to use that as their excuse? Well, we're headquartered in a state where it's illegal, but we're going to go ahead and say the origin of the attack was in a different state where it is legal, and therefore we can— are they going to work around that? I don't have any idea how that would be enforced, I suppose.

I think so. I mean, I think that's a great question. And again, neither of us are lawyers. So I'm sure if lawyers got ahold of it, it would be, it would be, you know, an interesting, interesting write-up. I think the template already exists though around privacy laws, right? So you're a multi, you're a multinational company or you're a multi-state company. If you operate, so CCPA, the California Consumer Protection Act. You can operate in California regardless if you're headquartered in Thailand, you've got to follow that law. So I think it's more about where do you operate? If the law exists, then that just like for privacy, this, I think the same type of framework would apply here.

Yeah, I suppose that's a good point. And again, you said it clearly for those listening, neither of us are lawyers. We're spitballing ideas here on what consequences would be as intel guys. If there's lawyers listening, feel free to chime in and let us know your thoughts on this one. I'm happy to have a lawyer talk about it. You know, we're kicking around the idea. But again, originally this did start as an intel discussion of, you know, should you or shouldn't you not pay the ransom? We're just discussing the possibilities of if you go down this path and make it illegal. So none of us are pretending to be lawyers or practicing law. So if we're missing anything on the legal standpoint, just remember this is the conversation after hours at the bar at a conference. We haven't had the drinks yet this morning, but this is not a true legal discussion. So, you know, save the darts, please. Exactly.

But yeah, go ahead, Mark. Yeah.

Yeah.

So to your point of, hey, states competing. So I think you're right. So assuming like, you know, our hypothesis, you know, plays out as we think, yes, states would start to compete and all of a sudden you'd start to see, you know, whoever states have no laws on the books on this potentially getting hammered. I don't have an issue with that because I think the long view is competition makes everyone stronger over time. So, right. Like, so if this, if this If this methodology works, then yeah, fine, great. North Carolina, Florida, don't get hit. Then New York, Arizona, Pennsylvania, like, and then others. And then the United States overall starts to get stronger. And then a lot of these ransomware, you know, gangs move to different countries, right? And they're going to move where, where, wherever it's easier.

Yeah, frankly, I'd like to see that. I mean, obviously nobody wants to hear this, but if the state, if, if, if we saw that pivot, if we saw states pivot, you know, pitted against each other as a base based on these laws. It would, it would tell us the laws have an effect, right? That they're working. Right. If we do this and nothing changes, I guess the laws don't really impact, you know, the way we thought they would. Right. So I, I think, yeah, I think you, you'd have to see that as a bright side if you're one of the states getting hit more often. You don't, but maybe that's why you go to your legislature and go, well, we're gonna mimic this law, figure out which, you know, which states are getting hit less, and we're gonna, we're gonna go the direct same direction. And like you said, it could lead to a, a federal law at that point. And then the question is, would criminals go to other countries now? The US has a lot of corporations with a lot of money, so I don't know that they would all disappear because some of the biggest money's here, but it's not all of it. You know, yeah, we have casinos in Vegas, but last I checked, there's a lot of casinos around the world too. Macau is a very big place for gambling, for instance. You know, Monaco, there's other places for that. And there's certainly banks around the world. So we aren't the only targets out there. So it'd be interesting to see how that would progress from states pitted, you know, pitting against other states if they had laws, and then maybe if it became federal and then seeing if it pushed out any further. Uh, it'd be interesting. I don't know. It's, it's a, it's a, it's a hypothesis, right? I personally continue to advocate for not paying the ransom. The law, at a minimum, I think it would really be helpful, as you said, for, for state and local governments, you know, for the, for the government entities at least to be able to say, hey, you guys can't pay. We gotta stop. It's too much money getting sent out there. We've gotta have a different, different way and forcing that prioritization back to preventative work, right? The proper hygiene, proper backups. Cyber intelligence, all the things we should be doing to stay ahead of this instead of just closing our eyes and hoping we won't get hit. Math says we will eventually. And then when we do, paying it out, you know, because we're panicked and we haven't made those choices. So I'd, I'd love to see that pivot to the proactive side.

And, and, and I, and I guarantee, right, it right now, you know, folks in the, in, in the security space are all talking about, you know, generative AI and LLMs, how LLMs are gonna be, you know, be, how can we leverage them to be, you know, improve our firewalls in our, in our labs and, and all that stuff.

Sure.

And I, I mean, this is just me, just, just, just, you know, I have no, no data to back this up, but I guarantee you 90 to 95% of those organizations don't have a proper backup and restoration strategy. 100%.

Yeah.

Well, we got to keep an eye to our systems to, to help make things more secure. Right. And so like, that's where people need to really start and it'll solve not just this problem, but just other operational issue problems first.

So yeah, well, and then I, I have no doubt you're right. I don't have hard data, but I can tell you, I certainly have anecdotal. I've been around and, and, you know, organizations love to chase shiny objects and then you look and go, what are you doing in the basics? Well, the basics are kind of boring. So a lot of those don't get done. You know, how's your CMDB? Crickets. You know, how have you done a crown jewels assessment? You know, do you have intelligence requirements? You know, all these basic things. No, but you know, we do actually want to run out there and do, like I said, you know, generative AI and some of these other, you know, big flashy items, which may or may not be all they're cracked up to be, but more importantly, they aren't the fundamentals, right? Do you have a backup plan? Is your patching process in place? All these things that are boring, like, let's be honest, cyber hygiene is boring, but it's fundamental, right? You just have to have it. And people want to jump to the, to the flashy new thing, which often is the thing that'll get them the most budget too, unfortunately. And I think that's a problem. So, you know, speaking of that, being more proactive, right? And talking about, so you've seen a lot of this, right? You've seen it from all different sides. You got a great team that does a lot of research in the deep and dark web. I know, you know, ransomware really well, and I know you've seen how it's impacted folks. Do you have tips for organizations to plan for ransomware attacks to get ahead of it? You know, we've talked a little about this, but what should organizations today be doing if they're worried about this? They don't have a plan in place. How do you get yourself prepared for a ransomware attack?

Yeah. So in the event this happens, and it probably will happen at some time if you're in the security space in your career, sometime within an organization is contain first. Contain, then eradicate, then restore, right? So I think people start to, you know, something happens, they're trying to figure out how do we get this out of our system first? You got to figure out what's the scope of it. Because even if they say, hey, you know, we took your loyalty rewards database, they may or may not be in other parts of the system. So you got to first contain. Definitely, Cole, you're assuming you have cyber insurance. Most significantly, significantly large corporations and all enterprise corporations do. Medium-sized ones do. Different insurance, cyber insurance has different clauses in terms of if they'll fulfill their requirements of paying you depending on when you notify them. So some of them it's 24 hours, 48 hours. So make sure you loop in your insurance company as soon as possible. Involve law enforcement. So whether it be at a, at a state level or potentially FBI, depending on, again, the data and the type of business you run, include those. And, and like we talked about, kind of the basics that are boring and not sexy is you have to run simulations. Like, here's the, this, this happened. Get everyone's kind of ransomware muscle toned to having this happen. Because if not, it'll end up, it'll be a Friday night, you know, everyone will be, you know, getting ready for the weekend. This will happen and people will go into panic mode, right? Um, especially if you are a public publicly traded company and they couldn't get out. Like, so being able to have that muscle where you're not reacting emotionally, you're just saying, we have this plan, we've done this before. It'll help for everyone to think a little bit more clearly. Because when the pressure's on, it's events like this. I can just, can imagine what it was like at MGM in the IT department. What things were falling apart left and right, right?

Yeah, just one call after the next about all the systems that are going down. I'm sure, yeah, it was a nightmare, right? So, You know, when you talk about simulations, right? So military background, government background, we talk about you fight the way you train, right? So that's why you do as many training exercises as you do when you get out there. So for the simulations, I don't want to put words in your mouth, but I'm thinking you got to have runbooks in place. You got to have all these plans out. I don't personally think tabletops are good enough. I think tabletops and plan and books are great as a, as a step, but I think you need to do live ones. I mean, what are your thoughts about actually running this thing, you know, live? Even to the point of not scheduled, right? Scheduling it still gives people a chance to know it's simulated, et cetera. I like doing a lot of books and a lot of, you know, planning and training, get all these runbooks, all these playbooks in place and do some tabletops with leadership. But I think you gotta be able to do it live, right? And, and really just run it.

I, I, yeah. And I, I, I've never heard anybody say that and I actually love that idea now that I think you just kind of off the cuff think about it, right? Because yet you do the planning, you, everyone's kind of sort of trained. But the thing everyone forgets is, okay, this happens again. Maybe it's a Friday or maybe it's a Wednesday afternoon and you're dealing with a client and you have a big sales pitch. Everyone's priorities need to shift and change. And I think people need to know how to adapt to that situation of it's not something we can allocate and clear our schedule and get ready for. Now this has happened, you know, you know, Capital One's coming into town for a big presentation. Okay, this happened. What do you do? How do you handle that?

Exactly. And I think it's, to be clear for those listening, I've done training and exercise stuff and, you know, plant all these things before. I think it's a progression. I'm not saying you go straight to live. That would be foolish, right? You got to have these playbooks and these runbooks. You got to have leadership get together. You got to do tabletops. You can do a scheduled exercise across the org where everybody knows it's, it's, it's exercise and, you know, everything's labeled properly. I'm not saying you don't lead up to that, but I personally think at some point you just do one, at least one that's just surprising live, right? You'll, you'll get all the notes from all the other things. You'll do all the lessons learned. You'll improve. But let's see how it really works and just run it. And I realize that can be disruptive and I realize that probably doesn't apply to every business and organization, but I personally think that disruption is, that's, that's when you're really going to get the findings that you, you look for. The training findings, those are great and we see people panic in trainings and you learn from that. But let's see what happens when it's live. Like you said, what if you really have a big client meeting coming in and you just got to tell them, hey, we're, we're dealing with a security incident right now, just as you would in real life. And how do you reprioritize? How do you run it through? Because. You, you fight the way you train. It's as simple as that. And if you haven't prepared and overprepared, you're going to panic. Like, that's what organizations do. And I, I think that's a lot of times what leads people to go, just, just pay them. Like, just how, how fast can we get the money? What does it take to get them paid? Because that's the expedient approach. Whereas if you have done this to the point where it's just second nature for you, you're going to be calm and you're going to be in a better position to say, okay, here's the process. Here's the checklist. You know, hold, keep them on hold. Don't talk to them. Go to the insurance, go do all these things, right? And not have to worry so much. Now, of course, we also talked about the proactive pieces. Listen, if you have a good backup plan in place and you have all these other systems in place, you can be less concerned. You know, I've told people, if you ransom me, you're going to be really disappointed. Now, granted, I'm not a large enterprise, but if you get ahold of my laptop and ransom me, you're going to be really disappointed because there's nothing on it I care about. So go ahead. Now, please don't. I'm not encouraging people to come find me because I don't need the inconvenience of wiping my systems, but you're just not going to find much. Everything's backed up in other places and it's encrypted and I'm pretty safe. I'm one guy, of course, but it does help. I wouldn't panic, you know, and to be able to do that organizationally, have that kind of proactivity in place from your defenses and then have the training in place to know when it happens, it's not as much of a shock, right? It would be easier.

Yeah. And I think anyone listening who is like, oh, you know what, maybe I could get this through, but I don't know if I can convince, you know, senior management because of the cost, like don't frame this purely as a security exercise, but a business continuity one. And also kind of a, a, your personnel backup plan. Because again, in a real event, maybe your director of data operations is in Hawaii on vacation and like his backup maybe isn't as great. And that at least, you know, like, hey, we need to train this person, right? You'll find out where your real personnel holes are in terms of knowledge and ability compared to where you said if you do a fully planned one, everyone's going to be on board. You're going to have all the knowledge. In a real life situation, you're going to have people who just aren't there, not away for whatever reason. And you're going to have to rely on, again, people who, you know, maybe don't have all the keys to the castle and figured some of this stuff out.

Yeah, that's a really good point. That business continuity piece, right? I think that's, that's actually, I know I've done exercises and if you have a good white team, you can also simulate that and say, okay, today this person's not here, right? You can do that, but it's still not the same as if it's live. And I think you're right to be able to say, well, we've realized there's gaps. We have training issues. You know, who's, who's the backup? Who's the third person? Do we have, you know, do we have these, uh, documents available to say, you know, who backs up whom and what are— I always call it a depth chart, right? I'm a sports guy. So, you know, what's your depth chart look like? Who fills in where and how things pivot, you know, when, when, when something goes terribly wrong, because people will be on vacation or they'll be sick or they have other issues going on, right? Or what if the key person resigned 3 days ago and then you get hit? Uh-oh. And now you've got a gap and nobody's filling that position. So I think Those are all excellent points, right? So, okay, so I think we've hit this pretty well. We've even hypothesized on some legal stuff that's probably beyond us, but it'll give some people that, you know, some, some something to chew on and talk about here. So we're running out of time here and I want to get to the point where we start closing it up. But, you know, we've talked about the ransomware piece and possibly, you know, whether we should or shouldn't pay that. And that was the big piece. But now, I mean, the question I like to ask, right, that the name of the show is Unspoken Security. So I always close. With the same question for the guests, which is, with that in mind, you know, tell me something you've never told anyone. Tell me something that's so far been unspoken.

Uh, so when I first took over kind of the dark web team at Experian, I knew a little bit about it, but you know, the in and outs and a lot of what we do is personal information, but I had heard a lot of the mytho— like I read everything I could, studied everything I could. One of the kind of the mythology of the dark web is around red rooms, which for those who may not know, it's this idea of these rooms where, you know, there's potential torture and horrible things that happen and people kind of do pay-per-view, you know, think about Dr. Evil, want laughing as he, you know, gives Bitcoin for someone to do terrible things. And so I had heard rumors and stories, so I actually dove in. And tried to explore for myself, kind of try to figure out if I could separate fact from fiction. Yeah. What, what I, my analysis was that if you, if you take a strict interpretation of red rooms of, you know, it's a pay-per-view live torture or horrible, horrible, a murder event, those are not on, on the dark web. And there are, but if you take a slightly different, more liberal view of people do post horrible things on there, you can, and, and they'll sell. Post-horrible videos of everything from torture to actual cartel murders. But the classic Hollywood kind of— the Red Room is kind of a modernization of Hollywood snuff films from the '70s, right? It's that same idea that's basically been brought up to speed in the modern world with the emergence of the dark web. But my take is they don't exist in their truest form.

Well, I mean, that's, that's good to know. That's, that's encouraging. I mean, I, I know the, you know, I've spent a little bit of time in, in the dark web, you know, strictly for professional reasons, of course. But yeah, I mean, there's a lot there, right? I mean, you can buy virtually anything. You can buy weapons, you can buy, you know, drugs, you can, you can hire a hitman. You know, there's, there's human trafficking, there's all sorts of horrible things. But it is interesting to know that the, that stereotype you talk about of like, you know, just a live torture session. For instance, that at least those don't exist, which frankly, I suspect has a lot to do with just logistics of it, to be truthful. I mean, I, I hate to put it that way. I don't think criminals are above this. Well, I think they'll do whatever there's money, but the logistics of that seem like they'd be really, really challenging.

Well, right. And some of it is technical logistics. Like, so most people think of Tor when they think of the dark web in terms of the web browser. Like, it doesn't offer streaming capabilities in order to do that kind of stuff. So there's, there are some like tech technical limitations of it that, that does— that don't make it as, as feasible. That being said, people have put stuff on Facebook Live that have been horrible events, but again, they're not, they're not pay-per-view live events. So again, it depends on your interpretation, liberal or conservative, of the actual term. But yeah, the, the true kind of letter of the law definition is, is definitely, I think, a fiction.

Well, that's good. Again, for those wondering, dark web's still full of plenty of terrible things. Don't worry, all of your favorite TV shows and movies are Mostly accurate. Anything horrible in the world is just, is down there waiting to be found. And that's why we're lucky to have guys like Brian and his team that are, that are in there ahead of us, thankfully, and hopefully ahead of some of the bad guys. So listen, we're out of time. So I'm going to wrap up at this point, but I, I wanted to thank you. I mean, I really can't thank you enough, you know, for taking the time to come today and talk to me a little bit and, you know, for us to chat about this ransomware discussion and whether it should be illegal to pay the ransom. I think it's a really interesting topic. I think you brought up some very cool points to, you know, for folks to chew on. I'm sure there'll be more debates about this and we'll see what happens with some of these laws. You already mentioned Florida, North Carolina, you know, looking to see if these other laws go through as well. Is there anything left, anything I failed to mention as we went through here? Is there anything you want to add, talk about Experian or the team or yourself or anything else you want to add before we, you know, we call it a show?

No, I appreciate the opportunity. It's always great to speak with you, AJ, and probably see you sooner than later, maybe at the next Black Hat. So, but thanks for the opportunity today.

It was great. Yeah, man. Great chatting there. No, absolutely. Thank you. I'd love to have you back sometime to talk a little bit more about what you guys do. We can talk about some other dark web stuff, you know, in 2024. So, you know, as, as the year goes on, right? So, uh, again, thank you.

Appreciate it.

For everybody listening, thanks for tuning in. Uh, you know, feel free to, you know, take the time to subscribe and like and download and all the things we need to keep this going. I really appreciate it. You know, give me feedback. If you like the show, let us know. If you don't. Let us know, you know, let's, let's figure out how we can make this better. This is really about, you know, the guests and the audience. So thanks again for tuning in to Unspoken Security. And until next time, have a good one. Be safe. That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite Podcasts. See you next time.

This is how legends are made.