Developments and Trends in Cyber Security

Hi, this is Charles Michael Davis. Toyotathon is on so stop by your local Toyota dealer for incredible year end deals on the cars, trucks and SUVs known for their legendary reliability like the stylish and efficient Camry. The Ready for anything RAV4 or check out a rough and rugged Tacoma or Tundra. All with great financing and lease options available to qualified customers. Visit buyatoyota.com to find out more Toyota. Let's go places.

Hello everyone and welcome to the Loopcast. I'm Chelsey Damon and today we are going to be talking about trends and developments in information security. I'm very happy to have Matt devoust on the show and Matt is the CEO and co founder of OODA llc. He's also a technologist and entrepreneur and he looks at international security and specializing in counterterrorism, critical infrastructure protection, intelligence, risk management and cybersecurity issues. Thank you so much for coming on the Loopcast, Matt.

It's my pleasure. It's great to be back.

Yes, yes. We had you on a number of years ago and we kind of wanted to do a where are we now and how did we get here type show considering your last time that you were on the Loopcast which was I think all the way back in the 2013 or so. So for our listeners you can check back way through the archives of the Loop cast if you want to to listen to that show and maybe subsequently listen to this one. So yeah, let's talk about where we are today. We're in 2020 now and what is taking place in regards to cyber conflict and cyber warfare that you are seeing.

Yeah, I think what's interesting is we saw you know that 2013 timeframe we were kind of mid cycle with regards to cyber conflict reaching kind of full steam capacity. I think 2009 was really kind of the banner year where we saw some of the state sponsored activities against corporations. We saw this change in pace where some of these large corporations that had been targeted by state actors had been, you know, previously quiet about it and then it became in vogue to disclose those attacks. So we get a lot more visibility and we've seen the you know, nation states kind of move fully into that domain at this point. They're using it for economic advantage, for psychological and information operations. They're using it to pre stage assets for future conflict. So we really have kind of now transitioned into the era of 2020 being one that is going to be fully enabled from a cyber perspective and the types of attacks that we see is.

There A way, considering all of this, that we should look at 2020 and everything that happened before it as an evolution of cyber warfare and conflicts. The strategies, what, or is this a continuation of what we've seen in the past, but just with different techniques?

I think it is an amplification of what we've seen in the past. You can go back 20 years and some of the doctrine around how the Russians would engage in information warfare of the Chinese has stayed the same. But what we've seen now is kind of the amplification of those techniques, the bravado in the types of attacks that they're willing to engage in. And then if there's been any transition, I think it's been less away from kind of cyber as a tool of kind of conventional conflict. I mean, for many years, even going back to the first work I did in 1992, we were worried about cyber as targeting critical infrastructure. It was about the power grids going down and telecommunication going down. And those risks obviously still exist. But what we've seen is now also this transition into the influence side of the equation. We've seen now where some of these adversaries are willing to target, trust in and get us to distrust our institutions. And that was a transition that I don't think anyone really fully anticipated. It was well defined in the doctrine, but we didn't expect it to kind of realize itself or manifest itself in the way that we saw, you know, from that 2013 period forward.

This concept of trust and making us potentially doubt certain information or even agree or follow it. Is that increasingly becoming something that we're seeing more on the social and political life of say, social media and different messaging platforms? Or is this in happening in a different mechanism online?

Yeah, it's a combination. I think it started with social media because that was the low hanging fruit by way of the investment that you could make and the influence that you could have. And really it's about this creating. When we say trust as a target, if we think about trusted institutions, like if we just drill down on elections in democratic societies as a trusted institution, we want to believe that those elections are fair. We want to believe that every vote counts. We want to believe that there is some resiliency in that voting infrastructure to ensure that that system remains trusted. And what you have is this ability on multiple ways to look and say, okay, how can we diminish trust in that institution of elections? 1 Can we call into question the security of that infrastructure? Can we highlight those areas where the trust breaks down naturally, you know, where you have those minor incidents of impropriety, you know, associated with the voting infrastructure and amplify that to make it a larger problem than it appears. Can we get it where we distrust each other, where you're distrusting your neighbor, or you're, you know, being incited to have very strong opinions around a particular issue that may be a real issue that's being amplified, or it may be an issue that's completely being fabricated so that social media became kind of an easy target from that perspective, of being able to incite that political discord to drive people to the edges. Typically in a democratic society you have consensus in the middle and what you saw was very concerted campaigns to kind of drive both sides, both political parties to the fringes and to the edges and to kind of amplify that. And then you had it coupled with some of these, the probing and, you know, the, I don't want to call them attacks. But it was more kind of the exploration of the voting infrastructure, in particular the electronic voting infrastructure and the voter rolls and things of that sort, not with the intent to change votes. I think the minute that a foreign adversary hacks into a voting system and changes the votes, they've crossed a line with regards to the response that other the nation is going to respond with. What's interesting though is that if you show that those systems are vulnerable, if you show that they could be hacked, even if you're not changing the results, you're making people distrust the system. What happens? We have very closely contested elections and what they're trying to do is make it where the losing party doesn't trust that the, the situation was fair for them, that maybe that there was some sort of cheating or hacking or something that took place. And the minute that we start distrusting that institution of elections, it's bad. From a democratic society perspective altogether, since.

2013, what would you say has drastically changed or even has slightly been altered in the sense of information operations, especially waged by adversary states?

I think we've seen these kind of differing trends based on the international norms and kind of the conversations that we have. I talked about like let's for example, just look at nation state sponsored intellectual property theft. I mean, when we Talked back in 2013, maybe I mentioned it, maybe I didn't. I don't have total recall, but I used to talk about this innovation parody where the Chinese government would be more accepting of norms around intellectual property controls and intellectual property protection and not hacking into companies and stealing our secrets based on the fact that they would reach this point where they stole enough that you could focus the resources they have internally on innovating on what they've stolen, as opposed to stealing the incremental change in those technologies. There were exceptions obviously, where you have high areas of innovation, alternative energy, biomedical, things of that sort. Some of the advanced technologies, but on par, they wouldn't be as interested. You couple that with nation states like the US being more willing to kind of name and shame some of these state sponsored adversaries engaging in these attacks, putting out international arrest warrants for people that are, you know, formally affiliated with the military and intelligence apparatus. And it created an environment where you have this kind of normalization of some of the activity. You have the number of targets that are being pursued by some of these foreign attackers diminished just based on those criteria alone. You look at some of the other attackers that have kind of amplified that activity even more. So we talked about the information operations, the psychological operations. You see that happening over social media. I think there's gonna be some interesting trends as we go into this 2020 election cycle with regards to how those influence campaigns change. Obviously we have a global crisis that we're dealing with right now. So I think you'll see that tied in to some of the information operations and some of those psychological operations in that space. So it really has been this diversity where we've seen an amplification on the information operations side and a little bit of normalization on the intellectual property side. And then the last piece, and it's likely that we talked about this back in 2013 as well, is the targeting of critical infrastructure. That is something that has been persistent and continues to happen. And it is not because the adversary has the intent to take down that infrastructure. Right now. I think what we're seeing is that they are trying to develop a future capability. If we focus just in on the information operations side of the equation. I think what we've seen again is that increase in the op tempo and then the utilization of these platforms. Right? From an influence perspective, that was the tactic that worked post 2013, going into the 2000 in 16 election, you know, a little bit in the 2018 election. What's fascinating for me that we can chat about as well is kind of how does that change going into 2020 and beyond. But what we have is that from an information operations perspective, there's a couple of domains of interest, right? The first was the intellectual property theft, the things that we were seeing out of nation states like China. And if you talked with me in 2013, you know, I don't have total recall, but I would have been mentioning things like innovation parity and some of these classical deterrents that were going to come into play that would help pare back that activity. And what we saw was exactly that. They reached a point where if you have a bunch of really smart computer scientists inside your country and you've stolen all of this great innovative technology, there now becomes an option where I can just focus those resources internally on innovating the technology that I've stolen, or I can focus them on stealing the incremental changes in those technologies. And that's what I meant when I talked about innovation parity. So from an IP theft perspective, what we saw was this reaching of innovation parity. And there are exceptions in biomedical and alternative energy and some of the advanced technology spaces, but for the most part you had some innovation parity where now they're able to focus internally, you see this huge investment in venture capital funds and in new technologies and in innovative technologies like 5G, et cetera, kind of accelerating developments that have already been made, coupled with a US Government willingness to issue arrest warrants for members of the military and intelligence apparatus in places like China for that activity. So what that led to was it led to this kind of stepping back from an intellectual property perspective in the influence operations space, really, I think the greatest impact was the importance that social media platforms like Twitter and Facebook and others are playing in our lives. Facebook is one of the greatest intelligence collection and manipulation platforms ever built by mankind. You have billions and billions of users. You have an advertising infrastructure, you have ways in which you can influence people to give up their information. You reach this point where you become known by the technology better than you know yourself. And we saw that kind of manifest itself with regards to being able to influence individuals and kind of collective societal action through some of these campaigns on social media. And again, I also feel like that had a kind of a short window. It worked for a period and now we're aware of it and it's not going to work. And then the last category that I would address would be on the critical infrastructure side. That has always been in play from an information operations perspective. But it's not as if the adversary wants to target that infrastructure with the current intent to take it down. For example, they don't penetrate the power grid with the hopes of taking the power grid down. Right now what they're trying to do is pre position a capability that they can use in the future. So if I can envision a future where it might be useful for whatever reason. Maybe there's some sort of regional security conflict or economic security conflict where it would be advantageous for me to be able to impact US Critical infrastructure, take power, telecommunications, et cetera down. I need to be engaging in the staging of those activities now and I don't ever need to pull the trigger. I don't ever need to take the critical infrastructure down. But there is a certain value to pre positioning yourself to be able to engage in that attack in the future. And we continue to see those attacks and again on a much more amplified basis today than we did in 2013.

Actually on that point. So right now, as we're recording, we're in the middle of March and we're in a global pandemic. Pandemic, excuse me, have you noticed any trends, considering the current events taking place with this idea of having access in one way or another to critical infrastructure? Because potentially we are not just in the sense of people's health and the world's health, but in the sense of as a nation we are in a weaker state in some ways.

Yeah, absolutely. I think we're going to find, you know, even if we're not getting the indicators now, we're going to find that this was a time of very high op tempo for some of those penetrations. Because you have a highly distracted society right now. Our guards are down a little bit. You have something that is of interest to just about everyone in society by way of being able to use that for spear phishing campaigns and increasing the effectiveness of kind of the individual targeting or developing those inroads. And then you couple that with what we've seen is just an unprecedented movement of folks to a remote working environment. I mean, I talked with folks last week where if you look at, I think Facebook moved 45,000 employees to all remote working within the course of a week. And then they did that with 30,000 contractors. There's another large telecommunications company that I spoke to that went from 1% of their 20,000 person workforce working remotely to 100% working remotely. That creates seams that are currently being exploited by attackers. I guarantee you that. I'm sure that some of these organizations are seeing those types of attacks, but it creates different ways of doing business. It means that some of the triggers and signatures and anomaly detection, behavioral analytics platforms that we've built are all disrupted because we've disrupted the workforce and where they're working from and the types of devices. So. So I'm absolutely certain that we're being targeted with a very High level of cyber threat activity. It's just not necessarily being noticed at this point in time.

When we consider cyber threat activity, is there more of a majority or less of a majority of cyber threats coming from more individual or small groups versus large state sponsors? Is there a certain way we can define which threat is more prominent than the other?

Yeah, I mean, the nation states obviously are at the high end of the spectrum, but the issue is that we have a lot of convergence. You have a lot of kind of hybrid entities where they engage in criminal behavior by day because it's a great way to pay the bills, and then maybe by night they're being influenced by a nation state targeting, or they are allowed to engage in their criminal activity without prosecution as long as when they encounter information or get access to resources that might benefit the state apparatus that they provide those. Right. So there's this, this kind of huge blending. We tend to focus folks down when we look at it from a threat perspective on the goal and kind of the intent. I usually can tell the sophistication of an adversary and what type of adversary it is by just looking at the behavior that they engage in. Because the behavior that I engage in is different. If I'm trying to steal money because I'm some sort of cyber criminal vice trying to steal PII that might have value in the black market vice trying to steal intellectual property, that requires a high level of sophistication to interpret, decode, and take advantage of, or even just gain access to critical infrastructure. So at the end of the day, a lot of the adversaries kind of blend together and you see them operating in multiple domains. But typically we know kind of who the ultimate sponsor or ultimate intent of the attacker is by looking at their behavior and the decisions that they make once they've successfully targeted an enterprise.

Since we spoke to you in 2013, we've seen a larger increase in things like breaches and leaks. So weaponization through states or even associated actors or criminal groups. So many different levels involved in this. But as we see things become more digitalized in our personal lives, say like personal data and information, Everything from our banking is online, our health information is online to one extent or another. Do you think we'll see more of this happening? And also, what are the ways that people can actually hopefully protect their personal information?

Yeah, at this point, you know, the protection of personal information is pretty difficult. I always like to use myself as a case study. If you just look over the past several years, I got the notification around my SF86 the very intrusive form that I fill out to maintain a security clearance, it has all of my personal data, everywhere I've lived, all of my family members, everybody's Social Security numbers. I was notified of my healthcare provider being breached. So then you now have indicators of medical records and other things. And then I was notified of a credit union breach. Right. All of my financial data. So it's really hard to get that kind of back under control once it's been breached to that, you know, to that level. In fact, I joked with some colleagues that, you know, I use the Wickr encrypted messaging system to share barbecue pork shoulder recipes, but I'll happily email my Social Security number to somebody just because my Social Security number is out there. It's in all these different criminal databases. What I would love to see from that perspective of how we protect our personal information is that we start taking advantage of some of these new technologies, like a blockchain where you have permissive use, or where the user gets back in control of maybe not their core data, like their social, Social Security number and things of that sort, but those data points that we know are very, very valuable and provide us unique insight into who they are. That kind of the browser history, the things that they like, things of that sort. I would love to see a little bit more decentralized control where the user has privacy from the get go, and then based on the economics, they have the ability to release some of that information to preferred vendors or associated with different incentives. So I think, you know, eventually maybe the market moves that way, but it's very difficult right now from an individual privacy perspective. With regards to the leaks, I think we're going to see more and more of that. Right, because you have a multitude of different threat actors that are engaging in those penetrations and those leaks. You have the individuals that, you know, might be classified as whistleblowers by some, as traders, by others that are trying to shine a spotlight on a certain type of activity that are providing information en masse. And because we've digitized a lot of things in this world, you're able to provide information and breach data that, you know, is kind of beyond comprehension and the volume. And you have individuals who are looking to just discredit organizations by penetrating the organization and bringing that data into the public domain. We've seen that occurring and continuing to occur. And then you have the nation states, right, that play into this concept of targeting trust that we talked about. If you look at some of the DNC related breaches in 2016. It was embarrassing, but it was meant to sow distrust amongst folks in the Democratic Party around the fairness of that, around the process. Right. Of determining who the presidential candidate was going to be. So you have nation states engaging in some of that targeting, the releasing of that information, or in the very least allowing for criminals to engage in that targeting and then exploiting the information once it's been discovered.

On the topic of trust, which I know you also mentioned earlier in the show, what happens to the idea of trust, especially in the political system, when, as we're seeing on social media, there tends to be essentially at times a low or even no trust level in the social media environment when it comes to information about politics and elections. And I guess even for now, the idea of information and disinformation when it comes to COVID 19, which we're dealing with as well. So what happens to this idea of trust and how can we actually trust what we're seeing? Because some things look very verified in the sense as certain articles and certain information seem like they're coming from credible sources, but yet we still find out that potentially they are not. Or even the credible sources are just sowing misinformation.

Yeah, it's. It's really crazy to observe. You know, I have a very diverse by design, professional and personal network and I tend to be high on the connectivity spectrums. I connect with a lot of people on LinkedIn and on Facebook and Twitter and elsewhere. And I am amazed that, you know, the willingness that we have to share unvetted information that confirms a particular bias or perspective that we have. I see every week really smart people, PhDs, successful entrepreneurs, share information that I know is false, that has been disproven or can be disproven by just visiting snopes.com or one of the fact checking sites because it informs a narrative. So I think the real key here is going to be in the individuals being able to step away from sharing content that really, you know, reinforces a particular narrative. The content players, you know, playing a stronger role in trying to highlight sources of information. We see that now, you know, for example, just what you mentioned, the COVID 19, if you make a posting about COVID 19 or you post a YouTube video, all of those platforms right now are recognizing that and providing links to reliable information for folks at the top of your post. Right. So we'll see some automation and we'll see the platforms coming into play, but it really is, I think, a much different, deeper issue. My colleague Bob Gorely at OODA likes to talk about this targeting of our cognitive infrastructure and our ability to, to withstand some of these influences or to better understand ourselves and why and how we're sharing information. But we see that as kind of a real vulnerability to these concepts of trust moving forward is that as individuals, a lot of people seem to lack the tools of being able to do critical analysis of a source or to question the viability of it. They just are kind of in de facto sharing mode. I also, you know, you see this manifest itself by people sharing content and endorsing by nature content that they haven't read. I see that all the time because I run a site, OODA loop.com that has a paywall component to it and I see people sharing content from the site that is behind the paywall, knowing that they're not a member and that they haven't read it. So while I appreciate the support of somebody trying to distribute our content, it is kind of interesting to me this dynamic of, oh, I can read a headline and it's going to be something that I am going to share and try and influence people's decision making around a particular topic by sharing that content. So it's a really big issue. It's probably one of the bigger ones that we need to grasp, but is not going to be solved through platform enforcement only. It's going to require some training and some education and some awareness with regards to how we're, how we're being manipulated on these platforms and how best we can participate as citizens, the same way that we participate in voting, that we can participate in some of these initiatives to control the flow of false information.

So I want to try to highlight some case studies to give people context of some of the things we've been discussing right now. And maybe we could talk about ransomware because it's very interesting as originally it started more off as cybercrime activities and then shifted in the later 2016 2017ish timing to more state sponsored activities, for instance, like WannaCry. So I wonder if we could talk about that a little bit.

Yeah, absolutely. It's a great topic. Ransomware has been around for a long time. I responded to my first instance of ransomware probably almost 20 years ago. So what's interesting is why was it not more widespread? And I think that comes into a couple of different factors. One is a, we've had the release in the public domain of some of these kind of nation state level exploits that are for all practical purposes 0 days for which there were not a lot of patches available. So you had the ability for that attacker community to basically weaponize some of these very elegant exploits, to be successful with some of the ransomware attacks in environments where maybe they didn't have the technical sophistication previously. So the leaks of that information is kind of number number one if we look at it from a critical or from a criminal perspective, really, the persistence of ransomware and why it is so widespread now also couples very closely with the emergence of cryptocurrencies. If I think back to the ransomware 15 years ago, say for example, you encrypt my files and you want me to pay some sort of ransom. It was incredibly cumbersome to try and get money to that criminal individual, say that it's a personal type of ransomware. You've encrypted my photos or whatever it may be on my drive. I want to get them back. It typically looks something like this. They wanted payment through kind of a Russian version of PayPal. That Russian version of PayPal didn't have an ability for you to fund it with US Credit card because the US Banks and the credit card infrastructure recognized that this was kind of a system that perpetrated fraud. So they didn't allow for those transactions. Maybe you could get a wire transfer, you know, via Western Union or something like that. But at the end of the day, it was incredibly cumbersome for me to actually pay the ransom. So what you have is basically a lack of market. I can't figure out. There's a lot of friction associated with being able to pay the ransom. From a criminal perspective, with the emergence of Bitcoin, you remove that friction because now I can run an 800 toll free number that you can call when you're infected with my ransomware. That'll step you through the process by which you can use a bank account or a credit card to convert some currency to Bitcoin and step you through the process of how you send that bitcoin to my wallet. I can also automate the kind of the ransomware decryption process as well, right through the use of unique keys and unique wallets. So what we had now with the emergence of cryptocurrency is the infrastructure by which those financial transactions now were very low friction. So that's why you have the high volume. Now we've seen kind of two evolutions in that space and it's a move away from the automated ransomware, which still exists, but now you have attackers where they are able to establish a foothold with their ransomware but it's not a fixed amount. You know, it used to be $300 or $600. These are kind of low pain points for getting the decryption key associated with the ransomware. Now, what we're seeing, similar to what we see with kind of the business email compromise, is the attackers are studying the environment in which they've compromised with ransomware, and then they are setting a very high value kind of ransomware payment based on what they perceive to be the value of those systems. So now they've introduced a level of analysis into the equation that basically says, oh, I'm inside this state government system and it doesn't look like they have any backups or I was able to encrypt the backups as well. I'm going to charge them $1.2 million because I feel like that's the pain threshold. Oh, I'm in this corporation. It's going to be very painful for the corporation to resolve this. They are willing to spend $10 million or they know that they have a cyber insurance policy associated with this. So that's been one interesting trend now is that we have very kind of focused analytics based on the target and what they've been able to compromise with the ransomware, being able to set this variability in the pricing. And then the last factor is now you also have the emergence of, as you mentioned, the state actors where the ransomware might perpetrate some other sort of endeavor. Maybe it's diminishment of trust, maybe it's impacting the economics around a particular industry. We have all of these kind of additional types of motives and incentives that come into play that nation states can engage in. What's also interesting, and we did an article on this by a longtime infosec colleague of mine on OODA Loop, is that we are now starting to see ransomware attacks as well that look like they're not only ransomware attacks, but they're intended by traditional organized crimes and not cybercriminals to impact the business in which they are competitive with. So in the two case studies he looked at was the Travelex currency exchange, where they were down, I think at the time that he wrote the analysis for like 48 days. In those 48 days, it did not mean that people weren't going to change currency. What it meant was that they went and started changing currency at some of these non Travelex, some of these secondary market locations, of which some are controlled by organized crime. If I'm in organized crime, I run some of these currency exchanges. For the benefit of being able to launder money. The higher volume of money I'm able to push through some of these secondary currency exchanges, the more efficient they are. From a money laundering perspective, if you look at that instance, just in particular, I engage in the ransomware. I put a very high value target, the 5 million, the 10 million, whatever it may be. If they pay it, great. It's like being able to double your bet at the blackjack table. I've made money and just take the cards off the table if they don't pay it. What I've done is I've effectively shut down their operations to drive them towards business models that maybe are under my control or are more favorable for me or allow for some of these secondary incentives like money laundering. He gave another case study as well that was focused on European auto parts distribution where there was a competitor that was impacted by the same malware variant that targeted Travelex. But it was with, he believed, with the intent to disrupt their ability to engage in this supply chain of auto parts of which there were competitive kind of organized crime, not kind of black market, but kind of gray market alternatives. And what it did was it beefed up their ability to sell in that gray market. So lots and lots of different elements around ransomware in particular, and I think we're going to continue to see that emerge and adapt over time to be even more critical of a threat.

Do you think because ransomware can really hit different sectors of a country's economy, that states will become much more active in helping out companies that are hit by ransomware? Or will it still be something that potentially is more of the responsibilities placed on the company that is engaged or not engaging, but having the attack put on them?

Yeah, I think they will help by default when they can, you know, by way of. Is there something that they can do to crack the encryption that's used? I think they will definitely help by way of attribution so that some of these entities can determine, you know, whether they're hit with criminals or whether it's a nation state type activity. We see that actually causing conflict just even within our insurance ecosystem. Right. With one of the large scale ransomware attacks, victims in a lawsuit with their insurance provider over whether the cyber insurance that they obtained covers this. And their argument is no, that this was basically an act of war. This was a nation state engaging in these activities. And so your insurance is not determined to cover that. So we're seeing that play out also kind of in the legal system as well, where attribution of These attacks and kind of where they come into play on the spectrum is going to be important. What we might see in that space is the government providing some sort of relief and who knows what that looks like for some of these companies where it is considered to be a nation state activity, where it is more indicative of traditional conflict or act of war type criteria, where maybe there's some allowances that they put in there for the insurance industry based on those examples, in which case the the nation state efforts towards attribution are going to be critically important. So we know who is engaging in these attacks and why. It's also interesting to note that ransomware provides for pretty interesting way in which to diminish the potential operation of critical infrastructure. So I think that's another area where there's a tremendous amount of concern is the resiliency of our critical infrastructure from ransomware type attacks.

Of course, everyone loves to talk about the 2016 US presidential elections and Russian activity and interference, which is a really interesting case on multiple levels. But I was wondering, in your opinion, holistically, would you consider it a success in the sense of the influence in the elections? And if so, how do you define success? What does that mean in this case?

Yeah, I think it was successful based on some of those things we talked about earlier where you were able to drive the conversation kind of to the extreme ends of the political spectrum. You are able to create this alienation around some of these issues that were, you know, either real or manufactured type issues. And you were able to create an environment and, you know, less on the kind of the cyber influence and the social media platforms and more on kind of the probing of election infrastructure, but create this environment where people view it as, oh, this is potentially a rigged system. Right. You saw that within the Democratic Party. Oh, this was rigged. You know, the outcome was predetermined. And you start having that dialogue emerge around the national election cycle as well. Which is why 2020 is going to be one of those critical years. Right. We need to get through 2020 with the losing party not feeling like that it was rigged or was hacked or was influenced by a foreign adversary. That's going to be a huge challenge for everybody on the cyber defense side of the spectrum.

Would you say that what we saw in 2016 is potentially reproducible? I know we have this election most likely coming up later in the year in 2020 here in the States. Is it something that we might see similarities or could there be other things that pop up that we might not expect?

Yeah, that's A great question, and it's one that I've thought about quite a bit. So I think the influence operations, you'll see, but the platforms have gotten a little bit better about detecting that activity, so I'm hopeful. You know, we mentioned the COVID 19 example of. If you mentioned COVID 19, they provide resources, you know, at the top of your link, of the top of your link or your post to accurate sources of information. So I think we'll see more of that around the 2020 election. And the platforms, they've done a great job of being able to eradicate these false Personas. We had a lot of voices participating in social media around the 2016 and to a lesser extent, the 2018 elections that were false Personas. They were not real people, they were bots, or they were people pretending to be somebody else. We are now seeing those Personas being wiped off these platforms by the hundreds of millions in some cases and in other cases by the billions. Right. I think Facebook has crossed multiple times that we've eliminated over a billion of these fake accounts. So that type of tactic where you build an infrastructure to amplify a particular message is not as viable because the platforms have gotten so much better at detecting those non viable voices. Right. They remove that ability to implicate. What does that mean? That means now that you have to move towards trying to amplify in legitimate voices. So I watch very closely for what I call kind of, you know, the proxy type actors or the folks where it's like they have a. They're a legitimate person and they have a million followers on Twitter and they have a particular campaign. And I'm very interested in kind of how are they sustaining themselves, how are they running the podcast infrastructure, how are they engaging in the economics here? Because I think that there is an aspect of this where you're going to have some of these proxy folks that are run by puppet masters. So be very curious to see that level of activity that takes place. I think you'll see them also focusing on legitimate influencers. If I can't create the accounts in order to amplify my message, are there people that are legitimate influencers that I can target and manipulate their thinking at a micro level to have that macro level impact. Right. So I don't have a million fake Twitter followers that I can get to retweet this message, but if I can spend time in identifying these influencers that do have the million followers and I can convince them to retweet my content, that becomes very interesting as well. Right. So that's an area I think that we need to look at very, very close focus on just the integrity of the election infrastructure aspect and that that is really disrupted. And I think there'll be some psychological operation campaigns around COVID 19 and the impact that that has on the elections. And whether there's changes that are made to the way people vote or how they vote or their ability to vote, those messages, I think, will be amplified. But I'm very, very interested in this, what I kind of call the direct targeting of that infrastructure. Voter registration databases being breached but not changed. Electronic voting systems being breached but not changed. Like anything that would cause us to question the security and integrity of those devices. That is a tactic, I think, from 2016 that translates still very efficiently to 2020. So I would expect to see a lot more of that and moving away.

From the 2020 elections. What else do you think the future holds? I know before this talk, we talked a little bit about the current situation, the global pandemic of COVID 19 and the concept of resilience. And I know you've had some background dealing with issues of pandemics. So I was wondering if we could talk about that a little bit.

Yeah, absolutely. I think, you know, there's a kind of a. A graceful transition. And that is one. If we think about trust as it relates to this particular issue or just in general, we look at elections as just one thing in which there's a lot of societal trust that can be influenced. And if we start to expand and say, okay, what are other aspects of trust that exist within our society? One is obviously financial institutions, right? So getting it where we have trust in the fact that we have a viable economy and that we have reliable financial institutions. And that given that my representation of wealth is entirely contained within ones and zeros, that that representation of wealth is accurate and high integrity. So I think we'll see people trying to kind of focus or cause distrust in that system. And I think by nature of just the wild swings that we've seen in the market, it's caused a high level of distrust around the stability of the economic system and economic markets. I think that's one interesting dynamic that's there. Second dynamic is trust in the supply chain. We have reached a point, I'm speaking just from a US perspective, where I don't think I've ever seen supply chain disruption at this grand a scale. You have entities like Amazon that are completely sold out of some common goods. You have local stores that are completely sold out. That's Primarily based on panic and over consumption. But what's interesting to me is that the supply chain model around that overconsumption doesn't backfill very well. I mean, you can go on Amazon today and stuff that is not in a warehouse, they won't deliver to you until April or May in order to make room for some of these kind of high demand common goods. But you still can't order toilet paper. Right. So there's this interesting dichotomy around supply chain integrity that I think is being raised right now. I think that also relates to international supply chains. I think we're going to see a lot of discussion around the resiliency of supply chains and foreign supply chains in face of a pandemic event like this. And it could be that there are some contradicting factors there as well. You know, I mentioned last week that the regime's level of authoritarianism might be an indicator as to how resilient they are to a pandemic. Because we see where people are able to come in and enforce through technological means and through shutdowns, an ability to bounce back much quicker than kind of more democratic, open, free, less suppressed societies. So there's some counter narratives that exist there as well. And then the final one is just around trust in the government and the government's ability to provide vital services to the citizens. And I think right now we are in a period with this pandemic and it obviously is stressing all elements of the system where you have a huge level of distrust emerging. You have a huge contradiction in the narratives associated with how well the governments are handling this at the local, the state and the federal level. You have a conflict between how it's being handled at the state and the federal level. So I think we'll see that kind of this amplification of the citizens trust in the government to act in their best interest or to manage through a crisis like this. I think that'll be a huge narrative that comes out of this COVID 19 pandemic as well.

My final question, and I know this is a huge ask, so I'm just going to throw it out there, but based on this timeline that we have of our Last show in 2013 till now is March 2020, what do you think the next decade will look like? And are there any glaring issues that you are really worried about or is it a slow burn, so to speak?

Yeah, I have. In 2009, I penned something that I called Devoe's Law of exponential Change. And that is that the pace of Change basically doubles every 36 months. And I think we've seen that right through our adoption of technology, through introduction of technology and anything that's exponential over the past decade, over the next decade, I think is going to be this kind of the significant disruption through just rapid paces of change that in an almost like, you know, an Alvin Toffler esque type future shock environment, we're not prepared for what are some of those, you know, the ones that I track very closely, obviously the cybersecurity, I think we're going to see, you know, huge changes in just the threat level and kind of the criticality of that as a domain moving forward. The impact of being able to achieve, you know, a kind of more generalized AI capability, I think that's going to be incredibly disruptive. We've seen, seen very interesting things in cyber and outside of cyber with regards to being able to automate attack or have autonomous attack or autonomous defense. I think we're going to see more and more kind of turning over control over those things that are no longer manageable by humans to machines. And that's going to be incredibly disruptive. And then a third category I would say is we are definitely going to see disruption from like a biomedical perspective, right? The gene editing and the CRISPR and things of that sort. So the next decade, by way of threats, I think it stays fairly slow burn. But by way of disruption and kind of how we engage in business and what that means and the role between nation states and citizens and corporations and citizens is going to be very, very disrupted. It's not lost on me when we look at an entity like Facebook making a call to, to protect their employees and get them to work from home before there was any sort of national call, being the first to offer this kind of stimulus type check where they were sending all employees $1,000 bonus to help with unanticipated expenses, setting up an environment where they're collecting and issuing grants to local businesses to survive. Right. So if you look at the leadership that's emerging from some of these corporate entities and the role that they're able to play in society, I think you're going to start to see this, this increasing tension over where we have our affiliations. And it is something straight out of the books. No crash or something that Bruce Sterling might have written 25 or 30 years ago, but I see that dynamic every day and that's one that I'm keeping close eyes on. Does somebody start to have more affinity for a Facebook or an Amazon than they do for their country of origin or country of citizenship. That's going to be a very interesting dynamic over the next decade as well.

That is definitely true, and I guess as the years roll on, we'll see what happens. But thank you so much for coming on the Loopcast, Matt. I really appreciate it, especially after a number of years of having been on the show before. So thank you for spending your time and your day with us. And do you stay safe and healthy?

Absolutely. Thanks for having me. Again, I can't believe it was seven years. And congrats to you on producing such a long run of just compelling content. I love the podcast.

Oh, thank you. I know. I can't believe it's seven years either. I keep on telling people, oh, it's only a couple of years and then I have to look back and surprise. It's many more than that. Well, thank you. And for our listeners, once again, please stay safe and healthy. And we thank you for listening to the Loop cast during this very worrying time in our history.