EP155 Cyber, Geopolitics, AI, Cloud - All in One Book?

Security warning.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior PM for Threat Detection, now at Chronicle, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our listeners at the Cloud Security Community page. You can find the link to that in our show notes. Anton, this is a personally delightful episode for me because it goes all the way back to the beginning of my interest in cybersecurity with Professor John Savage from Brown University.

Yeah.

You know, with this opener, I almost feel like I'm not really needed here. Like, I can give—

You're right.

I could just gush for the next 2 minutes.

A very short pithy remark and just like hand it back to you because it's so magical.

It is so magical. And what is especially magical to me personally is not only do we have John, we have Derek joining us from the Naval War College representing only his own views. And Derek is in many ways what I might have become had I stuck with political science. He's a political scientist who fell into cyber later in his career, John is a computer scientist who fell into cyber later in his career, and the book we talk about, Security in the Cyber Age, is a magical bringing together of these perspectives. And so maybe without any further ado, let's welcome today's guests. Today we are joined by Derek Reveron, professor and chair of national security at the US Naval War College. These are his personal views, listeners. Doesn't represent the DOD, doesn't represent the Navy, doesn't represent the Naval War College. Just his personal views. And to my immense, indescribable delight, we're also joined by Professor John Savage, the Anne Wong Professor Emeritus at Brown University, and the guy who kicked off my whole interest in cybersecurity. So first off, John, Derek, thank you so much for joining us today. This is our second book episode, and I think in many ways a total counterpoint to our previous one on Security Chaos Engineering. On that book ep, we couldn't get away from talking about the COVID and I think the COVID on On this one is a super interesting way to intro. Where did this cover come from? What's the COVID art story?

Well, my son Christopher, who lives next door, came over to see me one afternoon when I was in the process of using DALL-E 2 to create a design for the COVID just as an experiment. And he said, Dad, I'll be right back. And he went home. He said, but before he left, he asked, what's the message of your book? And I said, the message is that cybersecurity is a whole-of-society problem. Everyone has a role to play.

Hmm.

So what he did is he went home, brought up Midjourney, and then he created 2 seed images, one designed to convey the idea of society. So his prompt was metropolis, planes, trains, Park with picnics and all kinds of transports. And the second seed conveys the idea of complexity with the prompt underground scene, water pipes, wires, computer cables, computer wires. And then he provided the prompt metropolis above ground Art Deco vector. And what you see on the COVID is the result.

That's amazing.

That is.

It is amazing.

So generative AI makes an appearance, of course, at the very first seconds of the episode. So we almost have to ask you the questions focused on applicability of gen AI to the domain of relations and war. And in the past episodes, we've had people who argued that it is just one more tool added to the tool stack. Somebody equated it with autocomplete on a phone. After all, it's also ML-based.

That might have been me.

Probably, Tim, yes. And there are also people who clearly highlight GenAI as a harbinger of, you know, AGI or bigger things to come. So in your impression, is generative AI going to be a game changer in international relations and war, or is it just another tool for a stack?

No, it's a great question. And if John and I are completely honest, so we worked on the book for about 5 years, I think, from the very first email that I sent him, do you want to write a book? to the time the book came out a couple of weeks ago. And in the original outline, we did not have an AI chapter.

Hmm.

And John kind of raised it probably about 2 years ago. It was about a year before everybody started talking about ChatGPT. So even though, right, I appreciate the intro, my personal views, you know, certainly I think as people think about AI, you know, as a tool, I think that's true. And also as a game changer, I would say at this point, The fears of Skynet taking over the Defense Department, I'm not concerned about that yet. And I think partly culturally, you know, the US thinks centralized control, it's simply an anathema to our military philosophy. And I would also say it's the point of the internet of being decentralized. I will say the Defense Department, like every other organization, you know, in the United States, has been trying to figure out how to use AI effectively. Even 3 weeks ago on November 2nd, the Defense Department released a new AI adoption strategy. It has been building on previous work over the last 5 years or more. And DOD says we've been using AI for about 60 years in different systems. To be practical, you know, I started to think about like, what would it look like? And sort of steal a little bit from how drone technology, you know, it's often defined as drones are effective in the dull, the dangerous, the dirty. I'm gonna add the dollars. And so the dull, AI is really helpful with computer vision. You know, the United States collects terabytes of geospatial imagery Constantly, and without AI, it's human beings, you know, staring at it to find what we're looking for. So that's the dull, a great application that I think works. The dangerous: the U.S. characterizes its relationship with China and Russia in competition when the U.S. does its assessment of China, and it's extremely dangerous. China has been building up its coast with anti-ship missiles as well as its navy, world's largest now. And so on the AI front, the Defense Department is developing this concept of the loyal wingman, where you would have a piloted aircraft, but also have AI-controlled aircraft that can go into the dangerous zone to maybe attract, to figure out where those missiles are gonna come from, protect the human being. The dirty AI-enabled robots, you know, of course, to go into contaminated areas. And then finally, the dollars. You know, the Defense Department is a large organization. It spends annually somewhere $850 to $900 billion a year.

But That's so much money. That's an incredible amount of money.

It's a lot of money. It hasn't been able to pass an audit. And so it has been looking to AI like other businesses. Just how do we become more efficient in terms of our back office processing? Not glamorous like a loyal wingman program. Probably more important because tax dollars are precious and we all want to be good stewards of the taxpayer.

Okay. I want to pick at this just a little bit more because you have a whole subsection in the book in chapter 9 about lethal autonomous weapons. And I think that is like, Genie right in the neck of the bottle. We're seeing it a little bit in the battlefields of Ukraine. Where, where are we at with that? And is that too late to put the stopper in the bottle?

Yeah.

I mean, I think, you know, unfortunately Ukrainian people are fighting for their survival from Russia's invasion 2 years ago. And, you know, there's an old adage, nobody learns faster than when someone's shooting at you. And so Ukraine, right, has a very high-tech industry and they've sort of marshaled that. with cheap drone technology and has been using AI to really, you know, integrate either what's going on on the battlefield or, of course, with drones. So I think it's a part of today's warfare, and I think it's only gonna grow in the future because, you know, it, it can be cheaper. And I think probably most importantly, it protects human lives. The downside of that, it might prolong conflict because oftentimes, right, conflict can be bloody.

Yeah.

And if we sort of move into this era where it's machines that are fighting machines, conflicts might endure much longer than they have when populations get exhausted.

Before we leave this topic, I'd like to jump in here with one more observation, which is that artificial intelligence is not well understood even by the people who've trained them. You know, the concept was introduced in 1943. It wasn't until 2012 when Geoffrey Hinton and whatever, and the other wrote this paper which revolutionized the way the training of neural nets. But my view is that AI should not be deployed in critical applications until the people who train them understand them and can explain their behavior, which they can't do now. And to quote a colleague at Brown, Ellie Pavlik, who recently spoke at a meeting at Brown, she said, The science of AI has yet to catch up with the technology.

That sounds about right.

That's actually a fair assessment. It's not as funny as Tim would make it sound to be because this actually makes total sense. And science, historically even, we had things when we built things and then science came later, as opposed to normal kind of people have a perception, science and engineering. But it's really not how much of the history was, right? Yeah, probably from some book I recently read. But it blew my mind a little because I was in this, like, Scientists first, engineers next. But it's really not. Since Newton's times, it hasn't been like this. And I think AI is a great example from today, which is a little scary.

Just a little.

Just a little.

But I experienced a revolution when I was an undergraduate at MIT. The faculty had taken all the traditional material that was taught before the Second World War— I was born just before the Second World War— and they redid all of the coursework By bringing analysis in, bringing physics and science, and they put electrical engineering on a good solid basis. That hasn't been done with AI. It will come. People are beginning to work on the problem. But I think that for me, I think you have— one should go slow with the deployment of AI until some of these really important issues are addressed.

Okay, so on that dramatic note, I wanna switch a little bit from From this super exciting subject to actually the book. And I think that I probably wouldn't embarrass anybody by saying that Tim hasn't written the book yet.

Not yet.

It is not a hint that he should, but the point is that this— I did have an experience interacting with a second author for a book, and it's always a very sort of not always painful, but kind of an exciting and tricky process. So you wrote the book, and it's a book on a very controversial, kind of like high-energy, exciting subject. So how did this come to be and how did you work with each other? Maybe Tim can learn it and will help his book in the future.

What Anton is saying is he wants me to write a book with him.

No, no. Well, the podcast may be good enough for us.

But how did you two come together on this?

That's the future. I've always wanted to write a book optimized for audio and have not been able to figure out how to do that. But no, to your question, so John and I met In 2015, then Rhode Island Governor Gina Raimondo established the first Cybersecurity Commission in the United States. And so she drew from academics and practitioners from around the state, and that's how John and I met. We come from very different places. You know, he helped found the computer science department at Brown and has spent his life thinking about information theory and computer science and helped educating students like Tim. You know, I'm coming from a national security background. You know, I work at a place we think about conflict prevention. So we, you know, bring very different perspectives. But what we had in common is we were both teaching courses on cybersecurity and policy. And it was about 5 years ago, as I said, you know, I sent John an email saying, hey, do you want to write a book? And it was something as simple as that. And John said, sure. And we sort of got together, and that's at least how I remember it.

Mm-hmm.

And I don't know if we ever had Frustrations. I mean, I, I think I probably frustrated him, and there was one time because chapters 2 and 3 have a lot of notation and math in it, and I did like a global font change and I ruined all his notations.

Guys, we're doing the nervous laughter here.

But he didn't get mad, so that was maybe the frustrating part. But, you know, I was able to bounce ideas on, you know, how different things work. Uh, but John, I don't know how you think about You know, the collaboration?

I think it's been a great collaboration. This is my 4th book, and the first one I wrote alone, as well as the 3rd one. The 2nd I wrote with 2 students just after they graduated from Brown, and it was much harder writing with them than it was writing with you. And in fact, I think it was easier to write this book than it was to write the 2 others that I wrote alone. And the other thing that is important about this book is it brings together a political scientist and a computer scientist. And for several years before I retired from Brown, I tried to get the political science department to take an interest in this topic, and I failed. And then I went to a friend who served on an important committee with me from economics, who subsequently became the Dean of the Faculty, and I proposed that he get involved because economics plays an important role in this subject. Political science does as well, computer science, strategy. It's a topic that's so very broad, but it is, I think, representative of what happens when new technology emerges. I recall learning from someone who gave a talk in the early days of cybersecurity who said That the city of New York was excited by the advent of the automobile around 1900 because they had a terrible pollution problem, and this was horse manure. And if you think about the time, at that time there were no streetlights, street signs, stop signs. There was no rules concerning who could run a wagon, what conditions the wagon had to meet for safety purposes. We had to have legislation for that. So you can see that this is just— this whole topic of cybersecurity and artificial intelligence, communication networks, global connectivity, all those issues introduce some fascinating new problems, I think.

So what's interesting to that is it's such a good connection of the progress of technology with the problems that everyday people face. One of the things I love about this book is this quote from Ted Nelson about this being too important to be left to the priesthood. And I can't believe he said that in 1974, like the foresight in that quote. Aside from the book and aside from the courses you teach, how do we make this more accessible to the people that it impacts every day, which is to say everybody?

Yeah, I think I probably found that quote and I liked it because of the timing, but it reminded me of the French statesman Georges Clemenceau, who once said, war is too important to be left to the generals. And the idea is what happens is when we get a new field, the experts come to dominate. We create our own vocabularies, our own circles, our own bubbles. goals, and we don't break from them. And so maybe the point, right? So tech changed a lot since 1974 when he had this idea. Human nature hasn't. And so I think what Nelson believed, and we certainly still believe, is everyone should be able to understand computing. That problem has gotten really hard since 1974. But the point is, I think it is up to the experts and sort of, again, what motivated us to write this book is to write it in a way that, you know, we're college professors, so write students first to help them. But I think an average person could pick up the book and then learn, you know, from the beginning on what the challenges are. Because I think our big takeaway, you know, from working together is it's a team sport. You know, as we start thinking about these issues that we can't simply silo off a group of experts to kind of develop these ideas because cyber is everything, right? AI is everywhere now. And we can't just leave it to a few people to kind of explain it or understand it or, or sort of just wave the hand and say, trust us.

You know, on the note of writing for college students, I think there was only one place in the book where I wished I had a better background in set theory to understand what I think John was trying to say there.

Yeah, that brings back memories, not always pleasant ones. So switch subjects.

On that point, let me say that I have learned by teaching and trying to bring material that was originally at the graduate level down to the undergraduate level. That it's very challenging to boil down and recast knowledge that you've acquired that's needed by people who are not experts, but it can be done, and you just have to keep working at it.

It's kind of like the maybe apocryphal quote about writing a shorter letter if you had more time. It really does take time to simplify these things.

It does indeed, exactly.

So I want to switch subjects, not because I want to avoid words like set theory.

He wants to get away from set theory.

Okay, fine, I want to get away from set theory because it brings back some of my grad school memories that are sometimes triggering to an extent and all that. So this is—

This is the Cloud Security Podcast.

It's the Cloud Security Podcast. Thanks for the reminder. So I wanted to touch, we wanted to touch the connection of cloud to security in this cyber age, potentially cyber warfare, things of that sort. So I guess one can hypothesize that certain things became easier, certain things became harder. There's data sovereignty. There's kind of like, People went to cloud, and then they want to build little clouds in different places. So what's your assessment of shift to cloud, and how does it impact security in the cyber age from your point of view?

We ended up writing a chapter about this, and I would say it was one of the hardest to conceptualize because on the one side, right, is living in the United States where we sort of have, right, great connectivity, data moves freely, efficiently. The idea of what does sovereignty in cyberspace look like became really hard. And then once I started to think about it, it was really about regulation, you know, because we can see around the world data localization laws, you know, focus on supply chain and things like that. But once we started writing it, it became my favorite because it sort of illustrates, I think, a real nice geopolitical tension from my perspective. So you have the US that has an internet freedom agenda. And of course, US-based tech companies, they're global. But on the other hand, you have governments around the world pushing back against that as sovereignty violations. And the two run into the problem because all of a sudden, if you can't megascale like US tech companies want to because of laws, it undermines the whole business model. And so, that led to how do we think about little bit is who the internet is for and then who's responsible for cybersecurity. And to overly generalize, because I'm a political scientist and that's what we do, if we take a country like Russia, right, for example, the main mission, right, is to protect the state, the government. And who does that? The FSB, right, the internal intelligence service. If we take an organization like the European Union, the law there is to protect individuals. Protect individuals from whom? I think really companies and the idea of the EU has really tried to promote and protect human rights in cyberspace. And then we look at the US and it's largely a self-help system. You know, Google is required for securing Google. The famous hack, right? Sony in the US gets attacked by North Korea and there's a bit of blaming the victim, you know, of how bad their networks were. But at the same time, I sort of think it's unreasonable. Should US corporations be postured to protect themselves against foreign intelligence services? Right now the answer is yes. But, you know, there's a lot of debate in the United States, should the US government get more involved to help them?

But isn't that crazy, Derek? I was talking about this at an internal event a couple months ago. I was talking about exactly that question of cyber is the only place where companies have the onus of defending against states. It's not as if Google has to operate air superiority fighters or anti-missile defense systems. Why do we have to fight nation-state level funded activity against our networks?

What?

Why? I mean, the question was asked by various people since mid-2000s, probably like so, like 20 years. And ultimately the answer is, sorry buddy, you're buying air defense. Well, in cyber world.

You're buying cyber air defense.

Yeah. The answer is like, Does this question sound illogical that you operate essentially equivalent cyber— sorry, air defense on your building? Yes, it's illogical. Sorry, you're installing it. Like, that's where we live, right? Like, we all accept it for granted.

Yeah. In the book, we cite Rob Joyce, who used to be head of Tailored Access Operations. And I've gotten to know him, and he's a very nice guy, very clever. And what NSA has done is they created the Cybersecurity Directorate, which he now heads, And what they do is they work together with CISA, the Cybersecurity and Infrastructure Security Agency, to encourage collaboration amongst people in common areas, information sharing amongst them and with the CISA. And NASA uses VirusTotal, which is a website where it will post malware that it's discovered on apparently U.S. networks. And, you know, they also, as we point out in the book, are engaged in defend forward and what's the other term?

Persistent presence.

Hackback. No, they're not defend forward and hackback.

I thought it was really interesting in the book where you talk about the jurisdictional issues that NSA faces and their roots. I didn't realize that posse comitatus came about post-Civil War. It's amazing the historic legacy we run into here.

Yeah, and to try to answer your question more directly, Tim, I think partly because in the early '90s, you know, so if sort of what becomes the internet grows out of a Defense Department program, ARPANET, you know, in the early '90s it was sort of split between sort of a military network and then National Science Foundation funded it for a while, NSFNET, and then it became commercialized in the '90s. And so I think, you know, partly my answer is really from bureaucratic politics is You know, the IT industry sort of predates US government involvement on security. So, you know, where border protection or airspace protection, every country sort of conceptualizes national security in that very traditional way. And I know what— can I put you on the spot? What year was Google founded?

'97.

Okay. So you'll put ish, right? So in the '90s. So in the '90s. But, you know, to give you a sense, like US Cyber Command, which is the military cyber arm, 2010, CISA, which is the civilian, 2018.

Ah.

The National Cyber Director to have a single person in the US government point of contact, 2021. And then to sort of reconstitute a Department of State Bureau of Cyber Diplomacy with an ambassador, Nate Fick, 2022. So part of the answer is, you know, the US government has been behind, but I think that's also consistent with the culture where there's largely a laissez-faire approach to the economy. And I think a super laissez-faire approach to the tech industry, which is both a government predisposition, but I would also say tech industry wants to be left alone, right? Very different cultures, West Coast versus East Coast. And then all those other things that kind of go along with differentiation. Yeah, that's fair. And then you just look historically at political culture. And that's why we sort of pulled in— maybe this is sort of the thing that Like, I could bring in as a political scientist saying, look, this is like 19th century stuff. This is not new.

Sure.

Sure.

Sure.

And when we talk about Section 230 and whether shield laws for liability, you know, we go back to the 18th century. This, this is not a new discussion. This is an extremely old discussion.

Yeah. I just looked. Do you know when the Wright brothers first flew?

1903.

1903. Do you know when the FAA was created? 1958.

Yeah. That's a great— right?

So this is then normal, right?

So maybe this is just normal. John, I wanna ask you kind of the same question, but in the opposite computer science clothes. What do you think about the intersection of cloud and the emergence of cloud versus, you know, national security from a technology and cybersecurity standpoint? How does that change the game?

Well, you know, as Rob Joyce again has observed, when you use the cloud, you are leaving your security perimeter. and you're putting your crown jewels on someone else's platform. And my understanding is, although I've never worked with the cloud, is that cloud providers do provide some security features, but you as an organization are responsible for the way your people use the systems. And, you know, so is it this shared responsibility? And I think often companies don't understand that there is a shared responsibility and don't prepare for it. They think they're just going to reduce their costs when they move to the cloud. And I'm sure that creates a problem for the cloud providers as well as for the companies.

Tell me about it.

Exactly.

And as they say, the story goes on and there's some exciting consequences right before the end.

Yeah, of course.

I mean, you know, once you get into a hypervisor, break the security of a hypervisor, You got access to everybody's files and that's happened, hasn't it?

There have been some interesting bugs in, I will say unnamed other clouds recently that had cross-tenant data access vulnerabilities. I'll say I actually have built security features into the hypervisor. And so I take advantage of the hypervisor to look for malware at scale, which is pretty cool. But it is a change for sure.

Are you using artificial intelligence? At the hypervisor level?

You know, it's funny.

Maybe you can't answer that question.

I do use AI. One of my teams does real-time classification of every Bash script that we see executed in our customers' containers. And it turns out you can spot a lot of badness that way because it's a very common sort of intermediate tactic for an adversary. It's, you know, write once, run anywhere. Even I can write a decent Bash script. And so you get initial execution in some workload, you use Bash to do your second stage and persistence and other stuff. And so you can actually spot interesting zero-day activity just by seeing their downstream stuff.

Great.

This conversation, I'm sure we could have all day, and I wish we could, but I have to ask our traditional closing questions. One, do you two— and you're both professors, so there's no way you can't answer this question— have recommended reading for our audience? And 2, do you have tips to help people improve their cybersecurity and maybe sovereignty outcomes?

Okay, let me say I checked and we have a very large reference section in this book, 39 pages of references. Okay.

You do?

Yes.

Is there an online resource with the references?

Oh, well, I was thinking of building one. We had an earlier draft.

Oh my God, you really do. This is a ton of references.

Isn't it?

Yeah.

Wow. And so the book is, as we moved along, we are very inclined, each of us, to justify all of the material we've added to the book and add pointers to extra material so that while the book looks like it could be used at the undergraduate level, and it can, we think it also can be a basis for some graduate-level courses because it's such a rich topic.

Okay, well, I took the liberty of actually writing book titles down, and I want to commend our editor at Cambridge University Press She did not balk at 39 pages of references. I don't think all editors would be so supportive. And so, Katie, if you listen, thank you. I'll give 3 book titles. You know, one is, so the Kahneman and Tversky, Thinking Fast and Slow, or Michael Lewis's Undoing Project. I highlight that because chapter 4 is dedicated to understanding the human dimensions of cybersecurity. And what we attempted to do is apply their theory of the different types of biases and how that impacts cybersecurity. And so I think you can sort of use the examples that we have and then apply it organizationally to see how those work in your own organization. The second book that I would kind of offer, Max Smeets, based in, I think, UK now, and he wrote a book called Why States Struggle to Develop a Military Cyber Force. And so this examines where we are in the militarization of cyberspace, and then reassuringly explains there's a lot of barriers to entry. So back to an earlier question about, you know, what will future warfare look like? Max really lays out, you know, very well the challenges associated of actually operating in cyberspace in a military way. So I would highlight Max's book. And then the final one, just because I think it'll give you some insight in terms of the government. I'm fairly certain there's a good chapter in there on Google as well by David Sanger, The Perfect Weapon. And so David very much uses national security examples of when countries are attacking corporations through cyberspace and kind of lays it out. And there's also just a very good documentary based on that that he did as well, The Perfect Weapon.

He's awesome. I've loved his reporting for years. I was just flipping through chapter 4 since you mentioned it, and there are a couple of things I highlighted and I would feel bad not mentioning. One thing you talk about in here is ex ante regulation, ex post regulation. Have you seen the SEC rule about disclosing cyberattacks?

Boy, it is.

Yeah. Did you see recently that a ransomware gang reported a company they breached who had not disclosed it?

I saw that. Yeah.

How amazing is that? Like game theoretic evolution on the part of the attackers to be like, you didn't disclose that we got you. Now we really got you.

Well, that because they didn't pay the ransom, I suppose.

Yeah.

Punish them, right? Yeah. Yeah.

You also talk about in here, uh, lemons and peaches. I love the market for lemons concept as a security vendor. I've been, you know, playing in a lemon-filled market for my entire career. So that That really resonated for me as well. I thought that was actually a really enjoyable chapter.

Well, no, that's good. And I want to give John the credit too, because that was sort of his, you know, really thought. And again, it's the whole point of the book. It's got to be interdisciplinary, you know, because I don't think most cybersecurity books are not trying to bring in Kahneman and Tversky.

Yeah.

Yeah. I love that. I, you know, when in 1980, I gave a talk or '79 or so, I gave a talk When I was in the mid-'70s, I gave a talk at St. Andrews College in Scotland, and it was on circuit complexity, which is a theoretical computer science topic. And a British psychologist came up to hear my talk because he was trying to measure the time it takes for people to make decisions sitting at what's called a tachistoscope. You put up images, you have to make a choice amongst various categories, various items. And the time it took to respond was growing logarithmically. And so he thought, you know, because the time for signals to propagate through a logic circuit tends to be proportional to the depth, and that tends to grow like a logarithm with the size of the input. So we got together and he visited me. I visited him. We wrote a paper which was published in a psychology journal. As a consequence of that, I said, taught for 3, co-taught for 3 years, of course, in human memory models with 2 faculty members in the psychology department.

No way.

That sparked my interest in cognitive psychology.

John, you've had such an amazing career.

Thank you.

That's crazy. I had no idea that you taught that course.

Yeah, yeah, I taught the first computer hardware course at Brown and co-taught the first operating systems course at Brown, and I had no— I never had been exposed to those materials as an undergraduate.

Derek, do you know the story of when John first offered the cybersecurity and international relations course?

I don't.

Oh man. So he'd just gotten back from the State Department. He put it in the course catalog with this really obscure number in like the back of the catalog, right? The like weird class section of it. And he books this little tiny room on the top floor of the CS building. It was called like the library or some nonsense. It was like around the corner from his office. John had a very nice office. And I don't know, John, you must have expected like 8 of us to show up on the first day.

There were like 40. That's exactly the number I was anticipating. And 40 students turned up the first class. Yeah. And 25 finished the course.

And we're all like crammed into this room like sardines. Like, where's John? What is all this going to be? It was great. That was, that was so much fun back then.

I was on sabbatical leave in France around 2005. I was contacted by a friend at Cornell University asking me if I'd like to sub for him and travel to Vietnam to work for the Vietnam Education Foundation. When President Clinton gave diplomatic recognition to the government of Vietnam, the condition they put was that the government had to repay a loan that was made to the government of South Vietnam, and they agreed to do that over 10, 15 years. That wasn't a huge amount of money, I don't think. But then the Senators McCain and Kerry, Vietnam vets, didn't want to put that money back in the Treasury. They wanted to create a vehicle like the Fulbright system to bring Vietnamese students to the United States for postgraduate education. And so they would send a team of people, 15 faculty members, to review applicants. And I traveled twice to do that. This foundation was actually— this— the applications and so forth were all handled by the National Academy of Sciences and Office of the National Academy of Sciences. So they had my contact information and they let me know, sent me a flyer about the Jefferson Science Fellowship Program.

Is that how you heard about it?

That's right. They bring STEM faculty into the State Department for a year. Because they have so few of those people who are hired normally. And that's what led me into cybersecurity and to this book and working with Derek, which has been a tremendous experience. And Derek is a very highly accomplished member of the Navy. He was, he retired now, but he— what is your story there, Derek?

Yeah, no, I retired in February, 33 years out of the Navy Reserve intelligence, and maybe about 7 of those on active duty. Working in different fields. And at some point, the community sort of went larger. I think in 2010, I became an information warfare officer and forced me to think a little more deliberately about sort of, right, cybersecurity and, and how all these things come together. So, yeah, no, it, it's been great. And, you know, certainly I've enjoyed working on this. I think from a teaching perspective, I teach a a course at Harvard Extension on cybersecurity, and it has been, you know, always well attended, and I get a great global audience. And so that's really nice too. And that's where some of the inspiration for the book, or at least trying to work through some of the problems, you know, comes in. Because you get your— right, European perspectives on cybersecurity can be really different, right?

It's different.

Can be very different, and let alone, right, Southeast Asian as well. And so I think it's really important to see how these things go.

I love that because we see the same thing in our listening stats. We have a very global audience for this. I have people— I was in Southeast Asia earlier this year and people were coming up to me and telling me about how they listen to the show. And I'm— the one thing I hate about podcasting as a medium is that it doesn't translate super easily. But one thing I'm very excited about with AI is the possibility that it could translate more easily. And so I think there's a market actually out there for somebody to build a website where you can plug in a podcast and it will not only translate the content but create a voice profile and then use that voice profile so that each of the speakers sounds like themselves. I think that's a business that somebody—

That's coming. It's coming.

It's coming. I've actually had to warn my parents, don't believe any phone calls that sound like me because it's so easy to do voice copies these days.

Well, my son who designed this cover said to me that we really, in our family, we need to have a pass code of some kind so that if somebody calls up and say, I'm sick and you must send me $5,000, I lost my passport.

Yeah.

You can say to them, what's the passcode? Password?

Right.

All right.

Well, listen, Derek, John, thank you so much for joining us today.

Thanks, guys.

It was fun. And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @_timpeagle. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.