Episode 70: Kim Zetter on Understanding the Realities of Cyberthreats and How Code Has a Story to Tell

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hi, I'm Matt DeVoe, the CEO of OODA and today on OODACast we have Kim Zetter. Kim is an award winning investigative journalist and author who's written on cybersecurity and cybersecurity related issues for entities like Wired, Politico, New York Times Magazine, Washington Post and others. Has broken many, many stories in this space around NSA surveillance, WikiLeaks, stories around the hacker underground, and a particular focus on electronic voting machines back before it was in vogue to be covering those topics. Also the author of what I consider to be kind of the best knowledgeable book on stuxnet with Countdown to Zero Day, Stuxnet and the launch of the world's first digital weapon. And also the producer of a substack newsletter that I'm a big fan of called Zero Day. And we'll include links to the book and the newsletter below as well. So Kim, welcome and thanks for joining us.

Thanks for having me. Matt. This is great because you and I have talked about talking for a while and we very rarely connect except in passing at conferences. So glad to have this time.

Yes, it's actually excellent. So I would love to just get your origin story, how you get started as a journalist and particular interest how you got involved in covering cybersecurity issues so early on.

Well, it was completely random. I was editing this series of philosophy books and I've been living overseas and had just come back and I'd taken on this job and ran into a friend from college on the street who worked for PC World magazine and she convinced me to apply for this job as a features editor there. I really didn't have any interest in technology, wasn't a technology person, but because it was features I thought, well, maybe it's more narrative writing rather than really technical. So I thought I'd get six months. I didn't really think I'd last at it. But the month after I started, one of my colleagues who now is a threat intelligence researcher, he got out of journalism. Name is Andy Brandt. He had just returned from the DEFCON Hacker Club conference in Las Vegas and he was describing this really wild community of hackers who organize conferences like any other business industry, where they talk about vulnerabilities that they found in systems and hacking them. And I was so fascinated by it. I asked him to take me with him the next year when it arrived and he did and he started introducing me to people and that's really what pulled me in, I still don't have an interest in technology per se, but my interest is in the community, particularly the hacking community and the larger security community and the issues around it, like the ethical issues, the surveillance, privacy issues, all of that. That's really what fascinated and what pulled me in.

Excellent. What year did you first attend Def Cone?

I think it must have been 2000. It was right after Cult of the Dead Cow had released back Orifice and I think that that was in 1999. And so they were back at DEFCON in 2000 as well with an updated version of that. And they were on stage throwing out raw meat to the audience in 110 degree heat in Las Vegas in an unconditioned room, an air conditioned room. So yeah, so it was in the early days of DEFCON and the community, which was a really good time to start.

Yeah, I actually was in that room for both the 99 and the 2000. So fond memories.

Not many women in the room.

No, no.

At that time.

Yeah. And you know, you can see that in the audience shots. And if you saw that, I think it was New Year's Eve. CDC did that special session on the DEF Con Discord server and they released some footage that was kind of their behind the scenes leading up to that definitely was an interesting reflection of again of the early community, especially back then. There was a lot of skepticism, I know, because as part of that community and just entrusting journalists and interacting with journal. So how did you bridge that gap and establish kind of such deep roots in the hacker community? Was it just through presence or what would you attribute your success around that?

I, you know, oddly I didn't have a problem with that really. I think it was the novelty of being female at the conference. It actually helped, I think to some degree. But it was also just the early connections that I made. I mean, some of the early connections that I made were with people who were organizers of the conference or you know, longtime respected elders of the conference, like Richard Thame, who's a former priest who serves as kind of a father figure. And each year at defcon he would give this phenomenal talk on. It's hard to actually describe what he talks about because they're just so wide reaching. But you know, just sort of meeting key people like that. They became my ambassadors in introducing me to other people and telling other people, you should talk to Kim, she's really serious about this. And then really, you know, as a journalist, everything is on you after that, after the initial introduction, if you show that you're serious. If you show that you want to get things correct, then you start to establish a reputation and then people are more willing to talk with you when they read your stories. And I mean, I've always said that you're only a journalist is only as good as their sources. And you really have to know who are the right people to talk to and who are the people you should ignore. And if you talk to the right people, you know, I just found that people were so patient with me in explaining technical details and really helping me understand concepts in those early days. And that really made a huge difference with my stories.

Excellent. I love that that you brought up Richard. His are my favorite presentations every year. I always make a point of going in. I love the technical talks. I love after so many years, for me it really is an opportunity just to see and hang out with friends and what I call the carpet club, you know, the sitting on the floor and drinking Red Bull and talking about interesting ideas. But Richard, you know, I've described him as kind of the hacker shaman. I mean, he addresses such a wide range of issues and I have a bunch of pull quotes that I'll use from his presentations every once in a while, especially when talking about Facebook and digital media. He had a great quote a few years ago. He said, we are known better than we know ourselves. And that really struck me as kind of appropriate given all the data harvesting data science. Yeah, no, absolutely. I feel like that sometimes to someone who's never been to DEF con. How would you describe it? You know, especially in kind of its modern day incarnation, which is much larger. Much broader.

Yeah, I'm not so crazy about the larger incarnation today. It was such an intimate conference at that time being held at the Alexis Park Hotel. And it was really, you know, it was, we took over the hotel. There wasn't anything else happening in that. And just even the landscape of the hotel was, you know, these, the hotel rooms were like apartments. There wasn't an internal hall. All of the apartments were, you know, in these standalone buildings with doors that opened outdoors and then three pools in the center. And so we took over the hotel and those pools were our entertainment throughout the entire conference. And everyone was there until, you know, 4, 5, 6am Everyone gathered in a single spot. And now it's just so sprawling, you know, among. I think it's now three different hotels. And to go from one talk to another, you know, can take you 20 minutes or more just to get through the busy hallways. And then there's just so much happening because you've got the main DEFCON talks and then you've got all of these villages that are happening simultaneously. And I just feel overwhelmed by it all now. And I usually just sort of pick a village that I want to spend the weekend in and stay there because it's just really too much trying to get around and the lines and everything. It's just become too big for good.

Yeah, it's interesting. You know, I think all of us that were around in the Alexis park days agree that that was kind of the heyday of the event. That's the one that people have the most affinity for. And like you said, it was so much more manageable today. When I go to DEF con, there are people that I want to see that I don' because of the size. And I remember, you know, the Alexis park days, you could do that lap around the pool at one o' clock in the morning and I could run into everyone that I wanted to see. So there was something kind of special about that.

Yeah, it also feels like there are just so many more distractions. In Vegas. We were off the strip with Alexis Park, I guess about a mile away, and there wasn't a lot happening around that, so people had to intentionally leave the grounds to go look for other entertainment. Whereas, you know, today the conference is right, you know, in the gambling center, and there's just so much going on that a lot of people don't even go to the talks or participate in the conference. They go there just for Vegas. So it's a different atmosphere entirely.

Definitely is. You know, I think there's a lot of value, as you said, to taking the village approach. I mean, it's almost like DEFCON is the organizing entity and the village has become the sub conferences where you get back to that, you know, a little bit more intimate feeling or the sky, skyboxes, things of that sort. So interesting. So I'd love to talk about the book. So what led you to research and write the book? What was kind of the aha moment?

Well, I was watching the research unfold on Stuxnet that Symantec was doing. I mean, Brian Krebs wrote the first piece when this zero day code had been discovered by researchers in Belarus at the company Virus Blockada. And they posted it online and then couldn't take it much farther than their initial analysis. Then Symantec picked it up and Symantec started publishing periodic blogs as they made more progress through the code. I. It was just really fascinating to me. It was like a detective story. Of watching them pick this apart. And it took them, you know, four full months before they had everything completely reversed and digested. And that's really what pulled me in, was this idea of finding a piece of code. It's a mystery. You don't understand what it's doing. You don't understand really what it's targeting and piecing all of those that puzzle together. But I wouldn't have written a book about it, because I did write an article about that. I wrote an article about that detective story, but I wouldn't have written a book about it unless I thought that there was more there. What really pulled me into this extent story was also the geopolitics around it. Why was this decision made to target Iran for this instead of diplomacy or some other means of getting Iran to come in line? And so it was really that. It was the. The whole issue of the geopolitics around it that I could include and the history of how we got here, of using the first digital weapon, or I'll put a caveat there. It's the first digital weapon that we know about and that is publicly known. There may have been other pieces of malware causing physical destruction, perhaps used by Russia that we've never been able to pinpoint or attribute. You know, there are a lot of times explosions at facilities, and there's sometimes a mystery around what caused it. So I'm not saying that we don't know that there. There might have been other attacks like this, but it was the first known attack. And so that was really also what pulled me into writing a book. You know, this was sort of. This was very groundbreaking. And I wanted to understand how the US Came to this point, because I was convinced when I started the book that this was not the first time the US had done this. And that was the surprise for me to discover that it actually was the first time, simply because there were just so many legal restrictions around this before.

Interesting. So, kind of you felt that the code had a story, but then the geopolitical environment in of itself was a story. Is that what you were hoping that readers got out of it, to kind of understand a. The kind of the origins and kind of the mystery of unraveling Stuxnet and identifying exactly what happened in a little bit of the. On the attribution side, as well as explaining the why we got there? Was that what you're hoping that the audience or readers would get out of the book at the time?

Yeah, and I. And I also wanted them to understand what people at these Security companies do. I mean, antivirus researchers, you know, had been. They've been at the forefront of really major outbreaks like the I love you virus and the Melissa virus. And there were all of these sort of crisis points where some massive worm starts infecting things, and these people on the front lines go to work round the clock to decipher this and create protections for them. But I never really fully understand what their job entailed. And watching the semantic researchers take this apart really pulled me into that. And I wanted other people to see and understand how this industry works. And really, first responders is a great description of them and the kind of things that they do. We see this with solar winds, and we see this with the more recent hafnium Microsoft Exchange attacks, where there's a swarm of activity now among groups that are cooperating with each other's different security companies. And that's fascinated me, that cooperation. But there was one other thing that was important for the book, and I didn't really fully understand it until after the book published and I started getting comments from people, and that is that this issue of offensive warfare, cyber warfare, was not publicly discussed. And it was certainly never publicly acknowledged by the US that it was engaging in this. So here was this new era of warfare that the US Was entering into and engaging in without any kind of public debate about the policy legitimacy of this, about whether this was the right step to go into, and what would be the implications for US Infrastructure if the US Starts engaging this. It wasn't something that anyone was allowed to talk about it because it was all classified. After I wrote the book, what I got was, surprisingly, I got a lot of invitations to military bases to come and talk, talk about this with military personnel who also were completely in the dark about what their own government was doing. And there were many people that said that they were grateful for the book because it allowed them now, first of all, to know what the government was doing, but also to understand about the capabilities, because if they were in charge of defending government systems, they needed to know what the state of the art was. And so I was really happy that the book was able to create, I guess, a platform for public discussion about this. Actually, there was a attorney, a lawyer, general counsel, who worked for the nsa, and he teaches some political science classes, international relations classes. And he invited me to come in and speak to his class a few times. And he said to me, this isn't something that I could have ever talked about in class, but I can assign your book, and now we can talk about, you know, really significant policy issues because this is now in the public domain. So I didn't realize that. That I didn't realize that issue when I went into the book, but was really glad that readers found it useful and valuable for that afterward.

Excellent. Was that Stu Baker? That.

No.

Okay. No, just curious. I like that angle of being able to, you know, once the book is out there, it allows folks that have been involved in those topics that had clearances are able to talk about about the book. They're not able to talk about operations, et cetera. But it definitely does open it up.

Did you.

Did you feel like the message resonated with industry with regards to the implications for the future, given the fact that this was in essence, you know, an attack against critical infrastructure and the fact critical infrastructure here in the United States is primarily private sector domain? I know there's the obvious non proliferation aspect around stuxnet, but there's also the critical infrastructure component. Was that message resonating at the time or did it take a few years for that to catch up?

Well, it became because stuxnet targeted critical infrastructure. Not the normal kind of critical infrastructure because this was, you know, secret infrastructure for Iran's nuclear program, but the same kinds of systems, the Siemens industrial control systems, are used in all kinds of critical infrastructure around the world. And the Stuxnet attack really shone a light on the vulnerabilities and the potential for targeting these systems. And so there was suddenly a lot of attention focused on an area that the security community had really ignored. They were all focused on IT systems and it completely ignored the operational networks. So I think that, I mean, that was an eye opener for a lot of people and a lot of people started studying that in infra security. But with regard to those private companies, for private entities that own and operate critical infrastructure in the U.S. there was obviously a greater awareness of this, but there was still a reluctance to spend money on it because they still felt like they're not going to get targeted. Why does someone want to come after a water treatment plant? That seems such a ridiculous question now in 2021 to even ask that. But that's what they were asking in 2010 when Stuxnet was uncovered. If your competitors weren't investing in cybersecurity, you didn't see a reason to invest in it yourself. Even though there was increased importance and they now understood the issues, it still wasn't hitting home for them to take action. And we still see this, like in the facilities that have been struck recently where like the water treatment plant in Florida that got hit in some cases. In that case, I would say the issue there wasn't so much as they were ignoring the threats or the risk. They simply didn't have the resources. And this is the case with many water treatment plants that are run by small municipalities and they may have one or two people on their IT staff, let alone no one doing IT security, and they just don't have the resources for doing it. So the awareness was there immediately after the stuxnet attack, but there was still a lack of initiative to do anything about it, a lack of applying resources. And we're still seeing that. That's still a problem.

Yeah, that kind of jives with my experience. In the early days, I had written just a quick essay that I think was called just Private Sector Implications of Operation Olympic Games, which was the code word around some of the stuxnet activities. And it resonated with the public policy people that I interact with, but not so much with the corporate folks that just didn't. They didn't. Couldn't draw the line from an attack in Iran conducted by the US Government to attacks against them as a critical infrastructure.

Well, not even just that, because you could sort of see, well, Iran, of course, is a target of the US for political reasons, but why would someone target us when the Russians took down the electric grid in Ukraine in 2015, 2016. And I wrote a story for Wired at the time about how they got into the business network. They stole credentials, they backed out of the business network and came in through the VPN using stolen credentials. They were able to do that because there was no two factor authentication. Then after I wrote that story, there was a security guy that contacted me who works on critical infrastructure in the U.S. he thanked me for writing the story because he was now printing it out and taking get to all of his customers who have resisted him for years in implementing two factor authentication. And that just. It just sort of strikes me again where we are. 2015, 2016, critical infrastructure operators in the US were not implementing two factor authentication, and they still aren't in many cases. So there's this real disconnect between, okay, seeing the attack somewhere else and really recognizing, okay, this is a warning sign for you. No one takes action until it's too late or until one of their direct competitors gets hit.

I just did a quick Google search. It was June 2012 that I wrote that piece quite a while ago. And again, at the time it wasn't really resonating with the private sector folks, even though it was a clear point of it. It was very small call to arms was that they were now going to be a target. So it's been six or seven years since the book was published. What, what lessons or observations do you think still persist today?

I think that the still persists that, you know, no one's going to hack us. I think the Colonial Pipeline incident is a good example of that. You know, ransomware attacks have been targeting. Started targeting hospitals in around 2013, 2014, and made a lot of headlines. And then other industries don't recognize that, oh, it's hospitals, okay, they're going after hospitals. It's just a real disconnect, imagining yourself as a potential target. And I think Colonial Pipeline has talked about how much it invested in security in recent years. But I think that one thing, one interesting thing that the Colonial Pipeline incident showed us is that even if your operational network doesn't get touched in an attack, if the business network gets taken down, it is directly affecting your operational network. And so I think we're switching now from an awareness of needing to not only secure systems, but really having solid operational integrity plans for what you're going to do when something happens. I don't think Colonial Pipeline really had a plan in place, and that's why they were down for six days. And if there's any lessons to be learned here, it's that for other companies to really evaluate the plans that they have, the response plans that they have, not just for getting, you know, not just for, you know, calling in forensic experts and law enforcement, all that, but really an operation continuity, business continuity plan about how they're going to continue to operate if they get hit with something like this.

Yeah. Or even varying versions of that. Right. I mean, as I understand it, and it's not an incident that I worked on personally, but really the OT systems weren't impacted at all. But because the telemetry couldn't be ingested into the business networks, they couldn't operate the pipeline from a business perspective. So it was less about industrial control systems and more about being able to bill for distribution of resources through the pipeline.

And yeah, they could have avoided that with two things. I mean, one, they didn't have to put the billing system on the business network. They could have kept it on the operational network. All they're doing is they're taking data from the operational network about what customers are receiving, what amounts of gas they're receiving, and then sending that to the business network to invoice. But you could easily structure that invoicing system on the operational network. So if the business network gets taken down, you're not affected there, but also simply having a manual backup plan. I mean, if you can't do automated billing, do you have a plan for doing manual billing that you can implement, you know, within an hour or two after you're struck by something like this? One thing that we saw in the Ukraine power grid outage was that the outage only lasted about between three to six hours for most customers. And the amount of time that you had that you didn't have electricity was simply how far away your electric distribution equipment was from the headquarters, Meaning that they couldn't reinstate electricity remotely. They had to send out workers physically to these outposts in order to manually reconnect the breakers. But they did have that ability to do it. And if they didn't have that ability to physically reconnect, if the entire system was completely automated, then the outage would have lasted much longer. And so this idea of having thinking through this process of everything is, you know, is based on efficiency, business efficiency. And I'm sure that that's why the billing is done with on the business network. But, you know, everyone has to have a plan for when that efficiency system goes down. And Colonial pipeline didn't.

Interesting. Oftentimes they don't think through with any level of granularity about downstream impacts as well. And they think, well, we can't bill customers, we need to shut it down. They don't envision that Matt DeVoe is here in Virginia unable to fill his car up with gas. I remember working.

Well, there's another aspect to that downstream. In fact, it was actually an upstream issue in this case. One of the stories that I wrote for the substack was I was talking to someone who worked for an upstream fuel provider that actually feeds fuel into the Colonial pipeline that goes to customers. It turned out this person was telling me that the control system networks on their fuel farms are directly connected to Colonial pipelines control systems. And when Colonial pipeline went public with the fact that they'd been hit with this ransomware, these upstream providers panicked. And they were concerned that that ransomware was going to travel from Colonial pipeline control systems to their own control systems. And so they completely disconnected from Colonial pipeline. So, you know, these kinds of interconnectivities between industries, between providers, and, you know, the whole supply chain now becomes potentially a target, even if they're not a target, you know, a target of opportunity if they're connected. And we don't really understand all of these connections after I wrote the story about, you know, Colonial Pipeline taking down the pipeline in part because they couldn't bill. And then the upstream providers disconnecting from Colonial Pipeline. There were people in government who reached out to me and said they didn't have any idea about these potential issues. So even people that are sort of in the business or in the responsibility is to be providing oversight of critical infrastructure didn't fully comprehend the interconnectivity issues here.

Yeah. And the cascading impacts as well. Doing red team against a Metro Transit Authority that was a blend of passenger and freight rail. And one of the systems that we're targeting is something that's incredibly difficult and costly to replace. I remember saying, well, if we took this down, what would be the backup plan? And they said, well, the backup plan is that we operate in manual mode. And I said, well, what does that mean? So we actually start to send flagman out to route to the trains on the rail. And we would be at, if we're lucky, you know, we'd be at 20% capacity. And I said, well, how long would you be operating that way? This. Well, for probably about six months, which is the replacement time on this particular piece. And I said, has anybody talked to the factories, to the government, to the grocery stores? There's going to be huge impacts if you reduce your rail capacity by 80%. And they weren't thinking through that. They were just thinking through, oh, no, we have a backup plan. Things are going to slow down, but we can run it. And for the businesses impacted, running at 20% is basically denial of service for all practical purposes, unless you're high priority. So getting them to think through that, you know, like you said, also just the aspect of, you know, people not realizing that you can have ransomware on some business systems in a pipeline provider that impacts their personal ability to drive their kids to soccer. I think this, certainly if ransomware is doing anything, it is waking people up with regards to the personal impact and the personal dependency that they have on these infrastructures.

Yeah. And it's. And it's really on these companies to recognize that responsibility. The responsibility isn't just your shareholders. You know, the business continuity issue, like you said, it has all of these cascading effects. It's not just the continuity of your own business, but the continuity of everyone else, every other business that your business is servicing. And so, I mean, it really does become not just a national security issue, but an economic issue, a global, you know, national economic issue and potentially global economic issue. When, you know, when we look at the meat processing issue, the ransomware attack there, where, you know, Australian, Brazilian based company, but Australian plants and US plants are shutting down. And then those directly affect McDonald's and, you know, everything else. The chains are just remarkable when you really sit down and map them.

Yeah, absolutely. So be curious. When you started to interact with some of the folks in the National Security policy space in the military after writing the book, was there anyone that was saying, man, I wish we were doing more of this. I wish they were using cyber as an alternative to kinetic, or that this is a wave of the future. Were they viewing this as kind of a one off novelty?

Oh, no, they. I mean, it was definitely. We're glad that. We're glad our government is doing this. We're glad that they're using this as a tool and engaging in this. There was never any. I mean, there was some like, well, it's only a matter of time before it's turned back against us. But it was mostly, I'm glad to hear that the government has this power. So, yeah, I think that, I mean, I think that there is a lot more that the government is engaging in. Obviously the Snowden leaks gave us some. Some idea of the extensiveness of all of this, but I think that things, you know, still get skewed when we're looking outwardly at what Russia and China do. We're very good in our government of talking about what adversaries are doing to us, but we're all doing. The US Is doing the same elsewhere. They may not be taking down commercial entities, but they're certainly in a position to do that if they want.

Do you feel the fact that these tools persist and that we did have this great story to tell around Stuxnet serves as a deterrent for some of these cyber attacks because they do get dissected. They do leave kind of this residual evidence that someone can analyze and attribute over time. Do you think that that has contributed to any of the hesitancy around further use of these tools for maybe less strategically important targets?

I think that it's funny because when stuxnet was discovered, there were people that were saying they thought it wasn't discovered, but that it was revealed that the U.S. government or the Israelis intentionally wanted it to get caught as a warning to Iran and to other adversaries about what the capabilities were. I don't really. I don't really buy that. I don't think that this was intentionally exposed, but I think that there was some recklessness involved in it and maybe some. I don't care if it gets exposed because it has, you know, a double win. It causes damage and it also is a warning to others. I think that when we have things like WannaCry and NotPetya and the colonial pipeline and things that make a lot of headlines and the government is pushed into responding simply because of how widespread these are, I think it does put entities maybe on, you know, there is a warning to them. The government has done, the US Government has done a lot and particularly point to the Russian election affair interference in 2016 where Obama at a summit spoke to Putin directly and said lay off the election stuff. So I think it does have some effects when these things are discussed openly, when there are, you know, a lot of government statements about, you know, we're not taking anything off the table in terms of our response. I definitely puts people on warning, on notice that the government is going to engage in some kind of response and potentially retaliation. So I think it does keep some things in check. But I think that there's also just the inherent deterrence involved in knowing that if you take down any critical infrastructure intentionally, that opens you up to a response. China, for example, is deeply embedded in US networks, but they're not taking down the electric grid, they're not taking down commercial entities because their economy is very closely tied to the US Economy. So there are a lot of motivations here or anti motivations other than just straight deterrence. There are a lot of other considerations that that help deter. I'm not sure if that's a straight answer.

Yeah, no, it makes sense. Yeah, it jives with my perspective. And we have a slide that I use that talks about those with the capability lack the intent for those same deterrence factors that you cited. Economic interdependence, fear of global condemnation, the retaliatory escalation into into kinetic response and that those with the intent lack the capability. That we're still lucky in some regard that there hasn't been a terrorist equivalent organization that's had the technical capability to target critical infrastructure in the ways that some of the sophisticated nation states could.

They don't need to have it themselves. They can purchase it. I mean, there are plenty of mercenaries that will provide it for them if they actually do want to go that route. But with terrorist organizations, they, you know, they're more after fear involving blood and that kind of thing. So they simply haven't, I think, taken an interest in ones and zeros. Attacking ones and zeros.

Yeah, maybe some of these attacks will cause them to take note of some of the Havoc or, you know, that can be wreaked. From that regard, it's an interesting perspective too on the thought that we should be using more cyber and talking to the military, national security community. That was an issue that I was a huge advocate for. Actually going back to 1999 at a briefing that I gave about basically replacing some of the conventional means that we use to target critical infrastructure in normal hostility type situations and replacing them with cyber. I made the rounds again around the Pentagon with that same viewpoint with a PowerPoint deck after September 11th when it became clear we're going to go into Iraq. And I was a little discouraged that we weren't approaching, even back then some of the targeting of critical infrastructure. Instead of bombing it and having to rebuild it, let's use a cyber attack which is more recoverable to have less of an impact on the citizenry. So in one sense there was a little bit of, I want to say relief. But I was pleased to see that we were pursuing the cyber means to some of this targeting within the U.S.

Well, I mean, you know, there's nothing quite as effective as a bomb, right? I mean, even when you look at sort of the recent sabotage in, in Iran against the Natanz facility, you know, I, after, after the semantic researchers finished all of their, completed the dossier on the stacksnata attack, everything was published, you know, and it became clear from their final report that the Natanz facility in Iran had been targeted and that the worm was potentially still, you know, in that facility. Iran shut down its operations for about 10 days in order to clean out that network. And then they were back up and running 10 days later. And then we started seeing assassination of people in Iran, nuclear scientists and things like that. And we started seeing a lot of explosions happening at other nuclear facilities. So I think the cyber is great, but it's going to be limited in its effect. It's not as efficient as a bomb and it's not as fear inducing as a bomb.

Sure, yeah, no, absolutely. I can tell you a lot of the argument back then against using it was the fact that exactly this issue we just talked about was that if we had the black bag of cyber tricks that using them against, in Iraq, maybe to take down telecommunications or take down a power grid would reveal them on the network for more sophisticated adversaries. And then once they're used, they're kind of out, you can't use them again. So there was a lot of hesitancy because we were spending a pretty substantial amount of money on building some of that Tooling. The other cynical part of me, having been in the national security community in Washington D.C. for 26 years now, is I realized that the Matt DeVoe lobby of having more use of cyber to have a less permanent impact on the infrastructure, to reduce the impact on the citizens that were caught in these conflicts was a lot less strong than the lobby from the companies that get paid to go rebuild the infrastructure. So if we blow things up, there's a great contractor coming in billions and billions of dollars to rebuild the infrastructure. Of course, my cyber attack didn't offer that economic opportunity.

What was that movie? Was it the mouse that roared about a tiny country that decided to wage war on the US in order to get rebuilt by the US Yeah, I didn't see that. Yeah, not quite the same concept. But still.

You'Ve been covering this topic now for over 20 years. One question I always get asked by journalists is kind of what keeps you up at night? So I'm going to reverse it and ask you of all this stuff that you cover and the emerging threats that you get exposed to, what is the thing that you're most concerned with from a cybersecurity perspective moving forward?

Well, I think that we haven't really fully seen the impact of the data leaks issue. We saw it with the DNC hack where they break into systems and then expose the data. Actually, can I just ask you, there's a gardener outside who's very noisy. Are you hearing all that?

I'm not hearing him. Nope.

Okay, good. So there, you know, we've just sort of seen touches of that, these data hack and dump operations. And a story that I wrote last year with some colleagues involved a presidential finding that Trump had signed in 2018 that gives the CIA the ability to do these hack and dump operations. I think that we are, when we started to get into that kind of tit for tat, it becomes very dangerous. And we've had this allowance high tolerance for traditional espionage. We occasionally get the opium hacks from China, really large scale breaches where a lot of data is stolen, but it's only going to be used by that party that's stolen it. But opening that door to actually publicly publishing this kind of data is very dangerous at this point. And I think that we've only touched on that. I think that that is going to be an area. It's certainly you sort of have a mutual destruction threat there though. I mean, if Russia starts doing that a lot, then of course the U.S. can do that. And in fact, Putin accused the U.S. with the Panama Papers. He. He accused the U.S. of being behind that and exposing, you know, the financial dealings of his regime. But I think when you start going to that area, there's really no end to that, and that gets very dangerous. But another area that we haven't really seen here yet is integrity, where instead of just stealing data and exposing it, you're going in to alter data. And I think that that's really the next stage that we're going to see.

Yeah, excellent. Yeah, I kind of share that perspective. Talked a lot about trust as a target, you know, whether it's elections, you know, and the institution of elections, and reducing trust. Trust or reducing trust in the media and the government. And the one area that attackers haven't treaded into is getting us to distrust the data. You know, if my bank says that my bank account balance is X and I believe it to be Y, that becomes, you know, a very, very interesting scenario across all of these different spaces where we have dependency on accurate data.

Yeah, and I always like to go back to the Lotus 1, 2, 3 incidents. I don't know if you have any memory of this, but Lotus 1, 2, 3 software, accounting software or database software, had a bug in it that wasn't discovered for years. And it was something like the calculations at a level of pennies, but over time, you know, it adds up to a lot of money. So that kind of, even small alteration in, you know, a chemical formula or something, you know, something related to the construction of steel and fiberglass, things like that, if you alter those recipes, then you affect the structural integrity. So it's not just. It's not just trusting the data, it's trusting the. The products that are produced using data.

Yeah, that's a great point. Two more questions for you. First, we always like to ask folks any lessons learned that they have that they can share with folks that are going to be listening to the podcast. So over the course of your career, any lessons learned in covering this topic or kind of insights that you'd like to share that came from 20 years of very focused dedication.

Less things learned. I'm not sure. I'm not sure that there are lessons learned. I mean, there are journalism lessons that I've learned, not necessarily specific to InfoSec. I think that. I think it's just that what has proved, what's been proven to be over time is the need to. To have integrity as a journalist, particularly in covering this issue, because the stories like this are very easy to blow out of proportion in order to sensationalize, in order to make them stand out, especially with breaches. Right. Because we have a breach a day and you get tired of reporting on those. And so you're looking for something new that makes something stand out. And usually what the reporter is doing new is simply saying this raises things to a new level or unprecedented or whatever. They're looking for superlatives. The problem with this is that the public reads this and they become fearful about things that are just ordinary things, but also policymakers who don't understand this. I just remember July 4th holiday several years back when South Korea got hit with with multiple DDoS attacks that took down websites and took down ATM banking and things like that. And there were lawmakers in Washington D.C. that were calling it cyber warfare and were calling on a strong response from the US and so I think that the need to be responsible in reporting is so important, even more so today when there's so much attention focused on the to keep things level headed and not become a toy of the government. The US government often uses journalists to push forward its agenda and to speak to foreign nations. And I think that journalists have to maintain a level apart from the government and not be used as a as an implement of government in reporting this stuff.

Excellent. I think you've just revealed why you're the most universally respected journalist amongst my peers in the cybersecurity community is taking that approach and focusing in on the facts and actually picking the stories that have the substance to bring some novelty to the discussion instead of introducing all the fear, uncertainty and doubt or just accepting the status quo without questioning it. So thank you for that. It's much, much appreciated for those of us that live and breathe in this space every day type of journalists out there working from that perspective. Last question. I'm an avid reader of books. I don't know if you saw any of the previous oodacasts we did, but I always like to ask folks, what are you reading right now or have read recently that you'd recommend? We have a book pick.

What am I reading right now? I actually have started my next book. I have a stack of about 10 that I want to dig into so I will leave that question in terms of what I'm reading now. I did read. I read Nicole Pearlross recent book. Enjoyed that. I really liked that she was able to speak with people that ordinarily haven't been very open about this activity. I mean I covered a lot of that in the Stuxnet book as well the zero day market, but she gave a really broad overview of the different angles and people who are players in that and I thought that was good.

Excellent. Yeah, I enjoyed that one as well and recommended it and I'm trying to get her as a guest on the podcast, but I think her schedule's pretty booked given the recent release of the book. Well, thank you so much. This was excellent conversation. I love being able to spend some time with you and chat in greater detail about some of these issues. Would certainly recommend everyone read if they haven't read, read your book Countdown to Zero Day. Definitely a library favorite of mine and would encourage them to check out your substack newsletter as well, which is is it just substack/zero day?

Zetter.substack.com okay, got it.

I'll make sure we have the appropriate link in the show notes to make it easy on people. Excellent. Well, thank you so much.

Yeah, thanks for the conversation, Matt. Really enjoyed it. Thanks for listening to this Ooda Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop.com.