Fireside Chat with Jibran Ilyas

All right.

All right, well, again, good morning to those of you that made the effort to be on time. I'm sure as we go along, we shall have other people that join us. So we wanted to get back on track to do fireside chats. We have a lot of people as a part of Open Chicago who have done some amazing things, certainly Jibran being one of them, and we'll introduce him in a few minutes. But now that things are opening up and things are getting better, our thought was that we will start at least this month with a fireside chat on Zoom, and then hopefully we can graduate to an in-person event. So we're in the process of planning for the balance of 2021 and certainly hoping that we'll have a more robust in-person things to do in 2022. Open Chicago has been very vibrant. Things have been going along. Certainly we've been doing as many things as we can helping the community. Some things you guys see, some things you don't. And the back, we did have a good participation in our luncheon that we hosted last month. So for those of you who made that luncheon, again, thank you. For those that we missed, I'm sure we'll be able to catch up with you guys again in person very soon. The other thing is we do have new members. I don't think any one of them are on the call, but Ali, Musani, Qasim, and then Ashofla Khani are the three that joined us as new charter members this this past month. So hopefully when they're on the call. We will be able to welcome them. For those of you that are on the call that are not charter members, certainly would encourage you to look at Open Chicago, look at our website. The website is all updated, open-chicago.org. For those of you that may not be familiar, our plan is to disseminate a lot of information about Open and upcoming events through our website. So do please visit that. after visiting, if you feel that charter member is something that you are interested in, certainly feel free to reach out to us. I would love for those of you on the call that are not charter members to think about maybe joining us in that fashion. And then the last thing I wanted to share before I turn it over to Haris is that we are planning a business pitch competition. We call it a Spark Competition sometime in November. Obviously, looking ahead basis of how COVID does, working with the hotels, working with the staff, trying to make sure that we're still able to host an in-person event. So that's why we haven't announced an exact date, but right now we're in the midst of planning for sometime in mid-November. And our goal would be to allow our startup companies here in the US to be able to pitch in front of a large audience through Open Chicago and certainly other chapters and giving them an opportunity of showcasing what their business is and what they're doing. We will certainly have a prize as well. We've got a couple of sponsors that have agreed to be official prize donors and more to come on that. So what I would say is those of you on the call and you may know others who run companies and there are startups, please do let them know. On our website, the form is already up. They can certainly apply and let us know who they are and we can keep them. And as we develop the whole plan for the annual meeting, we can then reach out to those companies and let them know and get them prepared for the official startup competition. The way I envision is that these companies would apply to us, we would screen them out, we would do kind of like a Shark Tank. We would do a session with them just to make sure that all the things are covered, and then certainly on the day of the annual meeting itself, they would be able to go up on the stage and present their company's value proposition to the audience. So that's what the plan is. With that in advance, Jibran, thank you so much for willing to be our speaker today, and at this time I'd like to turn it over to Horace Ahmed. our chairman, who's going to take the next segment of introducing Jibran and then certainly the fireside chat.

Thank you, Amir, for that overview, and good morning to those who are here and those who are going to view this later on their own time and convenience. This is a series of talks that we've been doing for many years, as you know, the idea being to share the journey and evolution that we go through in our careers and in life. So I'm, I'm absolutely thrilled that today we get the opportunity to go through that conversation with our charter member and a friend, Jibran Ilyas. I, I, you know, there's a couple of things I want to share before we get started. A, I like Jibran because our son is called Jibran, and that makes— that always makes me happy when I speak with him. But more importantly, I've had the privilege and pleasure of observing Jibran's own growth and ascendancy over the last decade or so that I've had a chance to know him. So what we do with these conversations, we keep this— And if I— I'll ask you all who are joining to stay on mute so the experience, the audio experience is better.

Listeners, thank you for that.

What we do is we just, you know, unplug and talk through, and we'll take your— if you have any questions, put them in chat, and we'll open this up after we go through a few rounds of conversations with Jibran for all of you to kind of share. It's a small intimate group. So let me, let me ask Jibran to begin with Um, and I'll talk in terms of journeys because that's all they are. I mean, if you think about, uh, what we go through, um, uh, scientists tell me that on average we have about 30,000 days when you take the average lifespan of us humans at this point. So we go through various chapters in our lives. Um, I'll ask Jibran, um, to talk about his journey. So we'll break this into a few chapters. His first journey from Pakistan, where Jibran was born, to the United States. So talk, talk us through that aspect, and then we'll build on the different journeys that you've gone through, if that's okay, Jibran.

So go ahead, please. Sure thing. Thank you, Haris, for, first of all, for a very, very kind introduction, and secondly, for conducting this. I'm so honored, and thank you, Open, for the opportunity as well. So yeah, I'll start with the Karachi journey. So I was born and raised in Karachi, early '80s, and basically did my primary schooling from there. I was basically, I would say, until 3rd grade, a very, very shy kid, just a true introvert. I think one of the bigger reasons was I used to play a lot of cricket in Karachi. And, you know, growing up in the '80s, '90s, I think that was one thing that, you know, every kid, almost every kid did. So, and my brother and my sister, you know, they were like these top students and I was nowhere near. In fact, my claim to fame was I was the only dark kid in the family because of getting all this tan from cricket. So everybody would introduce my brother as this, yeah, he got this really high percentage in metric, and my sister, she like topped my brother, and now here's Jibran. So he's not very studious, but, you know, he plays cricket. And, you know, not in a condescending way, but more in a You know, that doesn't even look like one of us. So I basically, you know, grew up just having, you know, short of confidence. But then came grade 3 when I kind of really, really wanted to be with the, you know, with the crowd. So I think my sister actually took up the challenge and she said, okay, well, we are going to work on this kid and we'll let him play cricket, but there will be some rules. So I think 3rd grade was the first year when I came first in my class, and that was like a huge jump because I used to be like, you know, not even in top 10. But that's when I realized, like, you know, when you do put your mind into something, it pays off. And it used to be very close. I had very, very tough competition. But 3rd grade, 4th grade, 5th grade, that is when I kind of I'm on my own. And, you know, one thing I realized was that you— a lot of people would say, okay, well, this person is very academic and the other person is very sporty. So these are 2 different things. But I realized that when I was doing well in school, I was even better cricketer. I actually made the under-14 team and I was at the top of my game. So you know, the confidence that was coming from one aspect, it was feeding into the other. So that was— I carried this through 8th grade, 9th grade. I did a couple months of 9th grade in Pakistan, and then I came over to the U.S. So, and my family, my father came here in late '80s, so it was just me, my mom, my sister and my brother, and then my brother came in early '90s for school. So it was, for the most part, it was just me, my mom, and my sister there most of the '90s. And then '97 is when I came here and started high school, and the city high school. It's— I don't know how many of you are from Chicago, but it's called Sun High School, right in Chicago, right in the center.

And Excellent. Well, wonderful. That's— and you shared a couple of inflection points starting with the 3rd grade and getting a bit more focused and the move there. So you do your high school here, then where did you go to college?

So I went to DePaul for undergrad. So it was when I was a junior in high school, there was this competition. I think it was an organization called Gear Up Chicago, and they were offering like free scholarships to different schools. But what they had was they had a game show that mimicked Who Wants to Be a Millionaire.

Hmm.

So they had this citywide competition, and then they would pick about 15 students For the actual show. So first I made it to the show from my school, from SEM, and then I think I was the 4th person who got to sit in the hot seat after like 3 went up until like 9, 10, and 11 questions, and then, then I got there. So I think I was one racing against time and then— I just wanted to get all 15 right, but In Pakistan, you know, in Karachi especially, I think we learn a lot by road. So, वो तो ना रखता मारने तो there were they gave us like a huge book of 3,500 some questions, and I was like, you know, this is my chance. 3,500 questions ये तो memorize कर लूँगा मैं। So so I basically sat. I think it was like spring break. I would start like eight in the morning. go all the way up until night. And I learned a lot, 3,500 questions. I think I still could answer a few. But that is what got me at DePaul. They gave me like, like, I was able to answer 15 questions on a TV show. And then they gave me a full ride to DePaul, not just for school. But I think the most, one of the most important things was I was able to dorm as well. So, and step away from home and lived on campus and that had a huge impact.

Interesting. Fascinating. I did not, I did not know this, the game show stuff. So what did you, when you joined DePaul, a great school by the way, what did you plan to study and where did you end up graduating?

Good question. Yeah. So there were changes of plans. I started, so my brother was this, you know, very geeky tech student, and he had done his undergrad from UIC, but then he did a master's from DePaul. So I was always like trying to emulate him, you know. So I went to DePaul very happy thinking that I'll do exactly what he did. So he was more into development, coding, programming. I started with that, but I realized like after year 1 that I did not like it at all. nor I was as good. So I kind of struggled. I think for a good 6 months, I just didn't know what I was doing. I was a little down. I thought that, hey, this is my calling, like IT and computers, but it didn't turn out to be that. So I started, you know, I still have the interest in computers. And right around that time, there was a lot of viruses coming into people's computers. And, you know, the networking was big. Napster was big around that time. So a lot of people, you know, that is when, because of Napster and this peer-to-peer, you know, connection in computers, there was the security issues that were rising, cybersecurity issues. So that is when I found this. I just didn't know what it was called or what it was going to turn out to be, but I did decide that, hey, I think this is fun. I want to do this. So I, you know, spent a few all-nighters taking some viruses out of my own computer. And then there was this— DePaul had this field called telecom, which wasn't like cybersecurity, but it was the closest at the time. They would teach networks and operating systems. So I think cybersecurity is kind of like a secondary skill because the first skill, the fundamental skill, is really the networks, the infrastructure, and the operating systems. And then comes, you know, the security on top of that. So that's what I learned at DePaul, and that's where I went into. It was called Networks Technology. That was the degree. Yeah, I think second, second year I had this change, and it, it taught me quite a bit. DePaul was a really good techie, and, you know, we learned the right amount of fundamentals, but there was a lot of, you know, new-age learning as well. Their, you know, side programs, like it was called like IPD program, which if you had enough electives, like 6 or 7 electives left, you get— you've got to do this capstone. So that happened at Apple.

So you found a passion in the world of networks and cybersecurity and get picked up. And talk about the inflection point, if you can, in your technical journey. I think you worked for a few different companies earlier on. When was it that you sort of really started to kind of, you know, hit it? You found your technical expertise, you found your voice in this, at that point, fast-growing field of cybersecurity.

Yeah, I think it was— so when I graduated, I was working at a financial firm because Chicago has a lot of those, right?

So I—

but Realized that there wasn't a security job. So I struggled for about 8 to 10 months before I actually got like a security job. So even when I got that security job, the function that I was in, it was, it was what you call security operations center. So you call it like a glorified IT help desk, you know, in this space focused on security. So I did a year of that, was pretty average, but when I got into this field called digital forensics, that is when I think I really found that, hey, this is a new field. I could actually make a difference by some research, by writing white papers and whatnot. So I think it was 2007 or 2008, that is when I discovered a new sort of malware which kind of was the it virus or malware in the credit card industry. So I think that is when I realized that it was— I found something special. I didn't know, actually. My boss, I give him a lot of credit, he said, hey, you found something really, really cool. Do you want to submit this to DEF CON? I was like, DEF CON, the hacker conference in Vegas. I didn't think I could get in. So no, before that it was Black Hat USA that we applied to. So I worked really, really hard, a lot of all-nighters, like looking at 10 years of past papers of like how, which submissions get accepted and whatnot. And then we get this letter from Black Hat saying that, yeah, while your submission was really good, you didn't get a unanimous yes. So try next year. So that is when we were very disappointed, but there was another conference in Vegas right after Black Hat that's called DEF CON, which is equally prestigious, but Black Hat, I think, has this groove to it. So we applied to DEF CON and that's where we got in. So when I got into DEF CON and I presented there in front of a huge audience and they actually thought that the content was valuable, That is when I thought, hey, I'm gonna do this every year.

Oh yeah.

So 2008 was the first one, and then I think we did 2009, we got in, and then 2010, it was funny, we were actually a little late in our submission and they asked us, hey, don't you wanna complete your trilogy? And we have Track 1 available. Track 1 is, by the way, the biggest track in DEF CON. That felt great when we had— we were doing a lot of research and people were actually inviting to the biggest conferences. So that worked out pretty well. That's when I thought, okay, digital forensics is a really cool field and I can contribute to the field.

No kidding. I mean, if you're getting invited as a speaker to the premier event, you're more than contributing. You are now exhibiting thought leadership. So congratulations. So when did you get recognized by Crain's in the 40 Under 40 list? Is it about the same time?

No, Crain's came pretty late. So I had already done my stint at Trustwave. So a couple of great things happened at Trustwave. Number one, this whole— these old talks. Number two, You know, the company itself was doing really well, and then we had formed this partnership with the Secret Service to actually teach them the new age digital forensics. So that— and then we were also like working with them because, you know, we were a private company, right? We can't bust the doors and, you know, arrest hackers. So whatever findings that we would give to the Secret Service and, you know, the other law enforcement agencies, they would actually make the arrest. So That all happened until 2013. Uh, so I took a sabbatical in 2013 and I left the country. I was helping out, uh, some political party in Pakistan and came back, uh, and struggled.

Oh, wow.

Actually, what happened was when I, uh, broke my career in 2013, when I came back, I struggled for at least a year and a half. Uh, and then, uh, Cranes happened in 2017. So that happened when I actually had a comeback also. I think from like 2015 to 2017, I had this— I think I can now talk about it. I had this really huge case in my career called— I don't know if you've heard of Yahoo getting breached.

Mm-hmm.

So what happened with Yahoo, it started out small. But it was, I think, in the breach history books, this is the number one data breach because there were 3 billion accounts that were at risk. So I happened to actually lead that digital forensics investigation from my company, Stras Friedberg, at the time. So that, that was huge. And then other things were happening, again, submitting papers to different conferences. So 2017 is when I got nominated, and I think I got accepted that same year. So that happened, that came much after. So pleasant surprise. I didn't even know that somebody would nominate me and somebody would— there would be enough votes to get me in. But that was 2017.

Huge achievement because there's a coveted award. I mean, you got the 3rd largest city in the country with tons of people who've done really well. So to be nominated, to be selected, it's a huge deal.

We're so proud of you. Thank you.

So one thing I've always been interested in, so here's an immigrant kid who comes to the country and now you're consulting with the US government, you are doing work for the Secret Service.

How did that work? I don't know. I didn't, I mean, it was very natural. Like, I didn't, you know, realize at the time that all that was happening. Now I look back and, you know, I do think about it, that it was pretty special when— especially when we were training Secret Service in, you know, doing forensics in this new age. I think forensics field, digital forensics field, has gone through several evolutions. So I feel That everybody that I've met in the field, they've been super kind. I think never ever I felt that it was— I know we, you know, here we talk about racism, we talk about lack of opportunities.

Mm-hmm.

Yes, there are times when I feel that, and sometimes You know, I used to travel a lot, you know, before COVID and there will be times when it would feel like, oh, you know, why am I that random one always? There came a point when, when I wasn't selected, I was kind of scared. I was like, hey man, you didn't do your job right. I'm supposed to get pulled over. So, but, but that, you know, I think I never let it go to my head and I just kept the focus right on the work. I was enjoying the work so much that, you know, didn't realize what all was happening around me. It was just like, hey, these are the bad guys, we need to get them behind bars. Now the challenge really was because US doesn't have extradition treaties with a lot of countries. So we would— Secret Service would actually monitor and they would wait for them to go to a NATO country before they would get arrested. But we needed to give them very, very solid evidence because you know, proving tech and proving crime in a court of law is a whole different ballgame. You know, me and you can talk tech and I can convince you, but convincing a judge and having all the documentation behind, that is— there's no piece of cake. It's really, really tough. So I, you know, at that time, I just, I was just focusing on, hey, how do I accomplish that rather than figuring out like what was going on around me. So I realized that much later that, oh, That was cool. I was— I have these— they give you these challenge coins. So I have a collection of those. And at that time, I think Obama became president. So they gave me a tour of Obama's car. And that was pretty cool. And I felt like, oh, why didn't I realize it then? Now I look at that picture and I go, oh my God, that was pretty cool. That was the US president.

No, fantastic. I mean, I think speaks to the singular focus that you had, that any of the perceived barriers that people think of didn't really apply to you. I mean, you were— your expertise was sought at the highest levels of government. So at some point, I mean, you mentioned, you know, you had interests, you, after sort of attaining a technical expertise, you know, what I refer to as the next jump that people have is from success to significance. So you felt there was something else missing that you started to contribute, um, on, on the political landscape. So speak of that. And by the way, just as a comment here, um, OPEN is a nonpolitical organization, but we are interested in people's leadership and contribution in all fields. So we're interested for our audience, you know, Why that move? What drove that move? And, and what did you contribute there?

Yeah, I, uh, so I'd say I think I started doing, um, that work, you know, around 2013-ish, but I was always inclined towards it. I think the earliest time I remember is even in Karachi, um, when it used to be just me, my sister, and my mom, uh, living. So I So my mom liked being very active and, you know, not just organizations, but just helping people as, you know, as part of her personality. So I always loved that part. It was always— I didn't understand like what she would do that everybody would treat us like royals. But I now understand that, you know, she was so helpful in the community, in our neighborhood, in our family, just anywhere she could be. And we didn't have much at the time, but whatever we had, she was able to find a way to, you know, contribute. So I loved that part, and that's where it came from. So when I came here, I think right when I won this scholarship, I think you might know this gentleman named Mujahid, Dr. Mujahid Ghazi.

Mm-hmm.

He recruited me in his radio station. It was called like Asian Broadcasting Network. So I used to do a show, um, like a youth show. We'd play like Pakistani pop songs from like the '90s or like— so that was this community show that I think Amer Bhai would also call in sometimes. Um, so that's what started it here. And by virtue of just being part of his organization, he used to attend a lot of fundraisers. Like every weekend there would be something, so he would just take us along. Uh, so learned a lot from him. And when I got to DePaul, I started this Pakistani Student Association. I, you know, when I got there, there was this organization called SASSA, the South Asian Student Association, and they would celebrate Diwali. They would celebrate a lot of events. I was like, what about our Eid? Amani Chandrat Eid Juni celebratory. So basically got some students at that time and we started this DePaul PSA and that went on to win some awards. So I felt like, okay, you know, this is, this, this is a lot of fun. I would say that I won, I earned the best friendships of my life when I served the causes. And even here, like, I look at the faces here at HOPEN, like you, Amey Rai, Professor Amna, you know, all this is, this has been great, right? So just, but when you're part of organizations and when you're serving a cause, you make the best friendships. So I think 2011, 12, 13, that was a time when, um, well, I was, uh, volunteering for a lot of organizations like, uh, Zindagi Trust where my wife used to work. Um, and actually I even found my wife through a cause. She was the next president of Nepal PSA, so that's where I met her. Um, so, uh, when I was working for these, um, organizations like Zendagi Trust, I had this realization that yes, it is great, every bit helps, but, uh, I don't know how many years it's gonna take to earn that change that I really am hoping for, that I get to see in our lifetimes. So that's when I realized that, okay, if, if you can get government support behind the initiatives, things could be accelerated.

Right.

And if you have a person who will work for that, you can achieve those goals much faster. So that 2012, I saw hope. I actually quit my job in 2013, went to Pakistan, served the campaign, had a very disappointing loss, came right back, built the career back again. 2018, did the same thing again. That time we actually had some success. So I really feel that just the short of all that is that I feel that there's a dearth of people, like educated people, good people, like they're scared of going into that territory. And one thing that I miss the most is that sort of crowd. So I feel that more than ever, I think we need to actually assert ourselves and try to break those barriers. It's not easy, I'll say that, but I feel that whatever little that I'm able to achieve for the masses, that, you know, gives me a really peaceful sleep at night and that makes me feel that, okay, career, yes, all good. We need that too for our families and for ourselves, but I think the greater satisfaction is really when you're able to make a difference in the community.

So you were looking to create bigger impact.

Faster, faster, bigger.

Yeah.

Fantastic. No, that's wonderful. And along the way, as, as sweet as the Cranes recognition is, but I'm sure when you were recognized as a Pride of Pakistan recipient, that must have been pretty special.

So talk about that. How did that feel? That was the biggest high. I was giving interviews to Pakistani TV channels like, hey, you've You've got DEF CONs, you've got Black Hat, got all these achievement screens. And I was like, you know, but this is— there's no comparison because just getting honored by your own country, that was very, very special. And that was that too for cybersecurity. Because I think from 2013 when I got involved in Pakistan, I also got involved in the cybersecurity field scene there. So in Islamabad, we would do this conference called Cyber Secure Pakistan. Pakistan every year. And then I think in my second run of my career, I started teaching too. So I started teaching here at Northwestern University, and I thought, hey, wow, wouldn't it be great if I am able to take some of the course material that I've created for the Pakistani audience? And I will tell you, Haris, when I taught there, I think the first time I did that was 2018 or 2019. When I did that, I found those students so smart that I was done in my with my material in like sixty percent of the time that I spent here. So I felt like okay, this is going to be huge, right? If people learn cybersecurity there, they can actually inspire like a huge a new generation of cybersecurity experts. And that time, you know, in Pakistan, hacking or cybersecurity was just like मेरा कोई Facebook hacker किसी के मेरा Facebook hack हो गया स्कूल कर दो. Somebody find a password for Gmail that I've lost, or I know this person that I really want to hack. Jabran, can you help me with that? And I'm like, no, this is not cybersecurity. That is just you know passwords and whatnot. So I have to basically tell the students that hey, hacking is not just defacing websites. It's much more than that. There are there's not just cyber criminals, but like nation states out there to might to hurt the interests of. by some people. So that, uh, whole thing, I just kept up with that, um, did train a lot of people there. And when I got rewarded for that, that felt really good. Um, I was actually participating in this initiative of the President of Pakistan. It's for iVoting. So a lot of the expats, we've been wanting to vote for a number of years. But, you know, the number one risk is the cybersecurity, right?

Yeah.

So they got a bunch of experts globally and local experts and they formed a committee. So I'm part of that task force. So it's, it's, it's really, really tough waking up in the middle of the night, getting ready, taking a shower, putting on a coat and, you know, being in front of the president and some other people. But when you got— you get rewarded like a Pride of Pakistan Award, that was pretty special. We got to attend the parade in Chakrapuria in Swambad in a very special enclosure. They called it Pride of Pakistan enclosure. The Army Chief came, the President came and greeted us. But the most exciting part I'll tell you for about that whole journey was the 4 to 5 days that I spent with the cohort. There were 100 people that they nominated for the Pride of Pakistan Award. Those people, so inspiring. I mean, there were some big names like, you know, Ali Sadpara, the mountaineer's son, you know, Faisal Eddy, you know, Eddy's son, HSY, the designer. But I think the more inspiring people were these kids, literally like, you know, achieving like 10 years old, 14-year-old, 10-year-old. So those people, I think the most special thing that I got from there was this— we have this WhatsApp group with those 100 people, and they are just flooding their achievements. I mean, I kid you not, they're going to become like really big ambassadors of Pakistan. And for them, I get, I get more excited because they got honored by the state. They got to attend, you know, the very prized parade, and they got a luncheon by the, at the time, well, he's still the DG ISPR. So that was pretty cool. And then their interviews were flooded on Pakistani TV channels. So they're so inspired, they want to achieve so much more. I feel like, you know, it was great to be just part of that group and just watching them like do wonders. And when you read their profiles, I think they're about to make their website of this, this batch. When you, you would, you would cry out because their backgrounds are like some people lost their parents in like, you know, terrorism in Pakistan. People have had very, very rough beginnings. Uh, there's like this poor that we know, and then there's like a very different poor in some parts of Pakistan. So I, when I met them, got to learn their stories, I was so humbled. I was like, I don't think I deserve it. They deserve it so much more.

Oh, we, we think you deserve it. And, you know, one of the, one of the things that is endearing about you is that, you know, your achievements are not shabby by any means. But you've got genuine humility and you're speaking about all the others who were part of your cohort group and that is the mark of a good leader. So we're absolutely proud of all the things you've done.

Let's open this up.

Let's— we've got a few folks here who've been listening to your journey, your learnings, your growth. If you can just please come off mute, ask any questions of Jibran. Go right ahead, please. And welcome to some new faces, some guys who've recently joined. I see Qasim Khan, a recently joined charter member, and a few others. Some pictures are not showing, so go ahead. Anyone got a question for Jibran?

I'll kick it off. I mean, I came— I came— first of all, thanks, thanks to Amarbay and Haris and everybody, and Jibran, always a pleasure listening, listening to you. And so I'll kick it off since it's my first one, so maybe a bit more enthusiasm here. But first of all, congrats to all the achievements that you have, Jibran. So 2 questions. I mean, I'll probably take an opportunity just selfishly in terms of picking on your expertise to just say your thoughts on ransomware and all that good stuff that is going on in the industry. I think it'll be just good to hear your opinion as an expert in that field. And if I If we can get to it, the second question, as I was listening to you, is what would be your thoughts in terms of your engagement of someone who have been active here in States and being, you know, getting involved back in Pakistan in a way to give, you know, contribute back? What's the biggest lesson learned and what's the biggest tip you would share with anybody who might be sort of looking to do the same? So with those two, I'll let you come back to me.

Sure, I'll start with ransomware. That's been my favorite subject lately. So what has happened since the Colonial Pipeline incident, there's a lot of attention, right? So I've had to give more briefings, the CEO briefings, than any other time. So what's happening is that ransomware, it used to be, you know, one size fits all. Now it's very targeted. Now somebody— before it would be like one malware going out to you know, hundreds and thousands of organizations, and when they would click, they would all have to pay one, you know, one price, same price. But now attackers are realizing that, hey, if we attack a gas pipeline, we probably have a higher chance of making money. If we attack a hospital, we have a higher chance of getting the ransom because their systems are dependent on IT, right? Same with the transportation companies, any companies, any kind of companies that are very dependent on IT. If you encrypt the files, if you bring down the servers, that is when you have the highest likelihood of payment. So that has happened. And not just that, there are some groups that are working in tandem. There is one group that just gets in the network, they sell access on dark web. So you might have heard of that term. So they advertise something like, I have this Midwest Airlines network access and I'm selling this for $50K, or I have this biggest hospital in this area. If you want access, you pay $100,000 and get access. So there's that group. Then there's a group that is actually coming into the network. And one other thing that they're doing because of all the awareness over the years for ransomware, a lot of people have good backups. So if they get encrypted, they can recover through their backups. But what's— what attackers do these days, they also exfiltrate data. They take the data before encrypting the data. So that's like a double opportunity of ransom. So if a company says, yeah, by the way, we will recover on our own, we don't need the decryption key, so we're not going to pay you these millions of dollars, So they are able to ask for ransom by saying, hey, by the way, we have 10 gigs of your data. What if we release it out there to your customers and whatnot? So the ransomware industry has become very, very lucrative for these hackers. And what's happened is, if you heard of this DarkSide ransomware crew that was behind Colonial Pipeline, they're There are ransomware operators and ransomware affiliates. Some people create the code and then some people just deploy it. So the bar of entry in coming into this game is pretty easy. I mean, you could pretty much like go to dark web, download any sort of ransomware, get access and start, you know, if you know a little bit of cybersecurity or computing, you can do some damage. So what has happened lately is a big crackdown. You probably saw when Biden met Putin not too long ago, cyber was on the agenda. And right around that time, there were some groups in Eastern European countries that were getting arrested. So right now is the time when, like, the hackers are kind of being careful. I mean, but if you ask me, like, from the calls that we get over the weekends and every day, they're still loud out there. But I think the bigger ones are just kind of waiting and seeing what happens. But this industry, just to kind of finish off, it used to be like $100,000 used to be a huge amount for a ransom. My latest one, the demand for ransom was $36 million and the company settled for $14 million. Yeah, so it's fascinating when you talk to the attackers. A lot of people, you know, from outside also think that, hey, what if you pay $14 million and you don't get the decryption key. I will tell you, I'm betting at $1,000 that has never happened to me that we've, you know, after making the payment, you haven't got your key back because that's their business model. So if you pay $14 million and you don't get it, you're gonna make some noise about it and then nobody will pay that hacker group. They'll say, okay, well, this hacker group doesn't honor the payment. So everybody, not only that, I actually, for my last client, I wrote like about 9 demands. Like if we're gonna pay you $14 million, this is something that you have to do. The one that you're gonna laugh at is, uh, I said, hey, you have to submit, submit an intrusion report. Like, how did you hack and where are you still in the network? And no kidding, they actually wrote one. They actually wrote one, uh, pretty decent.

You know, fascinating. It used to be the principle was never negotiate with terrorists. These are terrorists, but it's, as you use the term, it's become, uh, more mainstream, uh, it's become a business model, and, uh, it is probably one of the single largest threats to governments as well as multinational corporations?

Yeah, it's the availability of data, right? I think so. When President Biden got involved, I think one of the suggestions from the administration was, why are we paying? Let's just not pay. But a lot of businesses stood up and said, if you don't pay, you don't realize it's not that you can have your best people and reverse engineer the encryption. Then the way the encryption works, well, in simple terms, it's asymmetrical encryption. You have a private key and public key, and the private key is with the hackers. So there's no way that you can reverse engineer that. You need that key from them to decrypt your data. So a lot of businesses said, no, let's not do that. Let's try to raise the cost on these attackers by forcing these governments to make a rash and then just keep cracking down. So that's what's going on right now. I don't know what comes next, but everybody's involved with every ransomware incident. There's a whole lot of attention that's coming from the president's office now.

Let's go to the second part of Kasim's question, which was, I believe, about giving back to the country of origin. So you've touched on this, but if you can briefly speak to that. Before other questions come in.

Sure. I think, Kasim, well, thank you for that question. I, like I said earlier, I mean, I love it when folks like us try to get involved. It is not easy. I'll say that there's a lot of resistance sometimes. There's lack of trust as well. I think our dilemma living here is that sometimes when you try to get top clearance here, they say, oh, but you were born in Pakistan. And then when you try to serve Pakistan, they say, well, you've lived your half of, you know, most of your life in America. So we have this, you know, very unique challenge that you have to maneuver through. But I would say that if you know the right people, that's the way to go. I remember, like, I think when I wanted to get in, like emailing, that's what we do in the US. Nothing helped because I don't know. Not— So long story short, if you want to contribute, I would love for you to tell me like which department, which field, and I can— I'll be so happy to introduce you and, you know, see to it that you are able to get the opportunity to serve. So I think use me as that bridge. I'd love to help out, but you just be prepared for some resistance, some, you know, lack of trust. That just goes along. If you're persistent, they also say, what's it, the admin is good तो यू नो कुछ करने तो वरना ये पीछे पड़ा होगा। One of the secrets to success, right, is to just just stick with it. Oh yeah yeah no no two ways about it and I think the your persistence will will be there. There's a thank you.

I just have a question of Jibran. Jibran, I think a lot of laymen people ask that why all of a sudden in the past so many years, this whole hacking has become so, so much more common. I'm sure, as you said earlier, hacking has been going on for years and years, right? But it's been in the limelight more. I don't know if it's just because of Russia and the election interference, but it's just something you hear every day now. It's become a part of your daily life. So can you talk about that? Is that— technology that's, that's made this happen?

Yeah, I mean, think about this, right? So there's different kinds of hackers. So I'll just name the 4 common kinds. One is like insiders, right? Like people in your company trying to dismantle maybe. Then there are like hacktivists who don't like what you're doing and they, you know, do some hacking. Then there are cyber criminals for profit. But the oldest kind is the cyber espionage kind, the nation states you know, trying to steal confidential data. So that has been going on for like decades, right? But now because everything is going to, you know, technology, that's where the attacks are. And the thing is with the US, there are very strong laws that if you are— if you have a data breach, you have to report.

That's right.

So GDPR in Europe as well, you know, they give you 72 hours to report. So you hear about this more here in US and UK. It's because of the laws. If you're not— if you don't do investigation, then you won't know. So I feel like a lot of people who— a lot of countries who are getting digitized now, they will go through similar fate. It's just that we are so much dependent on technology and we're doing these investigations that we know of it now. But you mentioned the elections, right? So A lot of people think when you talk about hacking elections is actually the hacking of the voting machines, but it's a hybrid. So there's some social engineering involved. There's perception management. And everybody thinks that, oh no, they changed the votes on the voting machines. But if you think about the Hillary campaign, right, Hillary versus Trump, a lot of it was just the timing of the stolen data release. So if you think about this email that was leaked from DNC chair against— so against who was against Hillary in Democratic race?

Oh, Bernie.

Against Bernie.

Why am I forgetting Bernie Sanders? So Bernie Sanders was the front-runner, right? And Bernie Sanders was about to endorse Hillary Clinton at the DNC convention. But think about this, the hackers had that data for a very, very long time, but they chose to release that data right around the Democratic National Convention. That is when, you know, they get the biggest momentum shift. So there's some hacking and then there's like strategic release of data. A lot of people, you know, when they put the data points together, they feel like All anti-Hillary data was released right around the time when Trump was in trouble. Even like the last week when Podesta's emails were released, that was very, very close to the election. So yes, there is hacking, but there is a lot of, you know, you hear a lot of because of disinformation campaigns as well. Because, you know, once the news gets the disinformation, the fake news comes out, it's really, really hard to pull that back or you can do a lot, but it's very tough. So you're gonna see that shift from like traditional hacking of the data to like this disinformation campaigns and, you know, destruction of data. And I think one thing that scares the heck out of me is the integrity of data. So we talk about confidentiality of data, like data leaking, but think of, you know, hackers coming in and modifying data, especially like hospitals data. You know, you're sitting at a hospital, they change your blood type, or you're sitting at a hospital, they change the drugs that you're supposed to get at the hospital. So the implications are gonna be far, far more serious than just data theft. So I think it's not gonna stop. It's just gonna be more and more as we get digitized, as the world gets digitized.

We have to accept that reality. Thank you for that. I think Moin, Moin, if you can come off mute. For those who do not know, Moin is a very successful realtor and investment advisor in the Chicagoland area. Moin? He may have stepped away. Probably have time for just one more question if there was, but if not, we'll Hey, I also have my hand raised.

I don't know if you saw that.

I'm sorry.

Yeah, but hey, thanks everybody for putting this together. This is a great opportunity and I'm so glad to actually see Jibran there. So I've known Jibran for a while and I mean, thing is, the list of accomplishments go on forever. But one of my best experiences with Jibran was like, you know, in Pakistan and just to see you interact both with the leadership and also the people who were on the grassroots. It was just amazing. There are some lessons from it that I'm still learning. But one of the other experiences that really stick in my mind is, I know, Jibran, you're very competitive, especially in table tennis and anything else. But when we were playing racquetball, I was so happy that, you know what, we're going to racquetball, it's time for me to get Jibran back. I'm going to beat him and everything. Yet even though I knew how to play racquetball and he didn't, he just wouldn't give up. It was that resilience and that mindset and the focus that actually made you win. You— I mean, it wasn't due to the physical ability, it was due to— it was simply a mind over matter kind of game. And that kind of gave me a little bit of insight that even though you have a million things going on, at that time you were clearly focused on that task and you knew that you were just going to win. So I want a little bit more insight in that mindset. Like, you know, is that how you approach all your things? Is that, is that part of the— is that the key to your success?

Well, first of all, happy to see you, and you've lost a lot of weight. And thanks for calling me overweight, that even though I didn't have the physical ability, uh, but, uh, uh, thank you. Um, I think, uh, just, uh, You know where I heard that line that if you're not winning, everything else is just progress. So I think just, you know, on the broader level, I always think of when I do want to see something happen, this one other quote that I always, always raise about is that if it is to be, it is up to me. So whenever, like, if I get in, it's— I at least say that I'm going to try my best. You were one of the most fierce competitors that I've seen. My God, we actually had a fight on court. That's the part he missed. We had a fistfight as well. But we came back and it was a really, really good game. But point is, like, if you're not going to give your 100%, then why go in?

At all, right?

So be it cricket, basketball, or anything, you know, community service or career. I feel like, you know, it's, it's not— a lot of people say that, oh, you have this ability and, you know, you've had this much experience, that's why you might be more successful. But I always look out for the person who wants it more because that's the, that's the person who's going to be ultimately successful. And I think that's, that's the short mantra is that just keep at it. One of the things that I mentioned, that all-nighters a couple of times, it was always when I was trying to learn something or trying to do some research. It, you know, we talk about a lot of hacks in our field, cybersecurity, we talk about hacking. But there are lots of life hacks that you learn, like if you work, uh, like from like 10 to 2, you could probably get that, uh, work done for like 2 days because there's— there are no interruptions.

Right.

Uh, like after you. So I, you know, whenever I have pulled all-nighters, number one, I'm not rushed, and it just feels great, uh, that to just be ahead, uh, and try to, uh, get to something that you thought, uh, you even thought that you might not be able to get because of your experience or the resources that you have at your disposal.

Thanks for those tips. We got a couple more hands up and we'll get a little bit over time. Babar, go to you quick, a quick response, and then to Faisal.

Go ahead, Babar.

Nice to have Jibran bhai here. As a DePaul alum, you're a great role model and, you know, all the work you have been doing in Pakistan. So I have 2 questions. One, are we going to see you run for election next cycle in Pakistan. And second question on the cyber hacking and everything, are you seeing a shift in corporations or mid-sized businesses? Are they tightening up their practices?

Why do it?

And on my side, what we have been seeing is where, you know, a lot of hackers are actually accessing the cyber liability policies and making a demand for the exact same amount. And now insurance companies are coming back where they are putting clauses in those policies and that they will conduct an audit of their cybersecurity practices, and if the company wasn't up to that, they will deny the claim. So do you see a shift in that dynamic?

Yeah. So regarding your first questions, you bet, certainly be there. But I think the more important contribution that I see for myself now is more on, you know, the digitization, the security around critical assets. Unfortunately, you know, that requires like the geography shift, so I haven't been able to do that. But that would, you know, make me feel more accomplished rather than just, you know, part of some elections campaign because that— been there, done that. I just want to make a huge difference in the security of our critical assets there. So secondly, you asked about the cyber insurance field. I've seen that shift a lot. What happens, and I'll give you some insight, On what happens. You know, like I said, the ransom amounts used to be like in 6 figures. When it was 6 figures, it was high, it was considered high. So what happened was when attackers get in the network, they also start reading the emails of the people who are making those payment decisions. So they start reading the email of friends who are talking about how much cyber insurance that we have, like what are, what are we going to get from our insurance? When they say, yeah, we can get up to $10 million or $20 million, they actually demand just like a couple of millions less because they know there are gonna be other expenses like cost of third-party forensic teams and like law firms and whatnot. So that's why the costs are high. But, and, you know, the insurance, the underwriters, they're kind of wondering like, okay, what happened? We've lost a lot of money for these payments. What do we do? So I think it's— they're well positioned to actually understand that risk, and if for that they require audits, it is actually better for you as a business because at least, you know, they will tell you that, hey, whenever Jibran or folks like Jibran, they do investigations, it's always these 5 deficiencies that, you know, 90% of the breaches are caused by that. So if they actually tell you or asking you those questions before you were compromised, before your business is intruded, that's, that's great for you because you would be ahead of the curve. And these are cyber criminals, right? Like I mentioned earlier, there are a few kinds of hackers. The cyber criminals, if you are ahead of the curve, they will move to the next target, right? It's like outrunning your friend when there's a race and lion is behind you, right? Something like that. So if you have better security than your next-door neighbor, they're gonna go— they're gonna move on. So these audits are actually great for the businesses because rather than you following ISO 27001 or NIST, some big frameworks, and trying to accomplish 100% of those requirements, you are kind of given, okay, just prioritize these 5 things and you might be okay. So it's raising awareness, which is great for the industry. Great.

We want to land in 4 minutes. So Moin, very quickly, your question and a quick response from you, Jibran, and then we'll end with Amna. Go ahead, Moin.

Okay. Jibran, salaam alaikum. Salaam alaikum, everybody. Jibran, you mentioned that one of the companies made a settlement of $34 million to $14 million.

Am I correct?

Yes, 14. Yeah, yeah. So I mean, if they made a settlement, how did they pay that amount? And then why didn't FBI, CIA, or all secret services catch those bad guys? I mean, obviously they made a payment to somewhere. Uh, so what, what is the process of making those payments and, and how they go, uh, without even being caught? Yeah, so, uh, so first of all, the payment is made in Bitcoins.

Oh, wow.

So there is a challenge in tracking it. It is, you know, technically possible to go after and whatnot, but there's just so much of this that, you know, you're— there's just— law enforcement is just overwhelmed. And the thing is, you know, the business actually chose to pay the money, right? So if, you know, the FBI or somebody goes after those hackers and tries to get that money back, the hackers can try to reinfect that business. So a lot of the businesses say, you know what, we're not just paying to get the decryption key back or, you know, to have them not publish our data, but that third big reason is so that they leave them alone. So that's part of— that's a huge part of the decision to make the payment.

Great.

Very interesting.

Ask Paul. Abna, your question please. I'm not sure.

Yeah, see, I mean, piggybacking on the same question, about 10 years ago we got hacked and I called the FBI and they were like, just pay the ransom. So, um, we know there are dinosaurs sitting in our legislature making our legislature, which are more concerned about gun laws in this century, and that's their biggest challenge at the moment, but it's not the biggest challenge— cybercrime. So what do you think, Jibran, is the biggest, um, you know, thing that we can do to make our government aware? What What's happening? What can, what can be the changes, or what can be the change we bring to this?

So I think, uh, what's happening now more than ever, uh, is the government— there are, there are a lot of forums, uh, and, you know, President Biden has been part of many as well. Uh, so that awareness is actually happening as we speak. I haven't seen more awareness in the U.S. government space ever before. And that, you know, so I don't know. So FireEye, you know, I work for a company called FireEye, which is, you know, one of the top 5 companies in the world. We got hacked in December of last year. So, and then we started tracking like, oh, how did it happen to us? We're supposed to protect other businesses. But it was a supply chain attack. So what does that mean? Like that we were able to do everything right, but we still got hacked. So what's happening now is this whole— there's this— I think it's a very common word. I'm not sure if this audience has heard of this. It's called zero trust architecture. So just consider you know, great network segmentation and just assume that we're hacked and just ask for a constant authentication for critical assets. Because what happens is that a lot of people put a lot of investment on the perimeter, but once the attackers come in— and I'll tell you how easy it is for somebody to come in, it's just one phishing email. Somebody would click on a document and, you know, the hackers will be in, and from there they're insiders and they have total access. So now the whole architecture is changing. So just to kind of simplify the words, we used to have museum-like security, like once you get into a museum you can touch everything, and now it's turning into like a castle-like security. So that's, that's the shift that we are advocating. That's the shift that is finally getting adopted. So we're right now, like cyber people are in a good space because we're being heard. By the government. So that's, that's a great thing.

Excellent, folks. We are out of time. Jibran, thank you so much. We could have talked about this for, for much more time if that allowed. Thank you for sharing your own journey, for raising our learning about this space, and hopefully our audience has picked up a few, a few tricks from him. And, you know, as he was talking through this, You know, it's— there's a lot of stuff behind it. He made it look easy. There's been a lot of hard work. There's been a lot of passion. And sure, there have been certain timings that have worked in Jibran's favor. But, you know, it's a pleasure for us to call you one of ours. You're a pride of Chicago. You're a pride of Open Chicago. Hopefully this has been a good learning and fun discussion for you all. We appreciate that. We appreciate the effort that went into planning for, for this by Amir, the executive committee, Mozammil Mosani and Babur and Faisal and all of the folks who may— who bring such discussions to our community here. With that, we'll close this. Amir, anything you want to add before we go?

Yep, just want to thank Jibran. I'm gonna turn it over to Mozammil to close, and hopefully you guys all all had enjoyed. Mazamel.

Thank you.

Thanks, Jibran.

I know we were planning this for a long time, but you were busy with all of the projects, which we understand. So as Haris and Amir mentioned, thank you for being part of Open Chicago. We're really proud of you. We would love to continue to work with you.

So thank you.

Thank you, everyone, for joining this Sunday morning.

Thank you so much.

Have a good one.

Take care, everyone.

Bye.

Bye, everybody.