Joseph Menn: Observations From Two Decades Of Tech Journalism

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hi, I'm Matt Devoe and this is the Oodacast. And today joined by a special guest, Joseph Men, who is the author of the book Cult of the Dead Cow and also a journalist. So, Joseph, welcome to the oodacast and I would love for you to provide a little background for our watchers as to kind of who you are and how your career progressed.

Sure. So I guess to start out with, I'm one of the survivors, one of the longest serving mainstream journalists covering cybersecurity. Started covering it in 99, but well before that I started out the old fashioned way in journalism. I was a police reporter in a small town in North Carolina and then I covered city hall and civil courts and business and worked at Bloomberg back when nobody heard of Bloomberg and then moved out west and joined the Los Angeles Times in 99 in San Francisco. And I've been based in San Francisco covering technology one form or another since then. But from the beginning I sort of gravitated towards cybersecurity. I thought it was one of the most interesting bits. And so that's, that's what's consumed most of my time, somewhere between most and all of my time for the last, I don't know, 15 years or so. Great.

And currently at the Washington Post after having joined from Reuters for how many years were you there?

I was at Reuters for 10 years. I was at the, let's see, LA Times two for 10, Financial Times for three, Reuters for 10, doing more investigative deeper dives into cyber y things. And then joined the Post earlier this year. And I guess I should say I've done three books, solo books. There's the definitive take on Napster, the inside story of what happened there. And then I did one called Fatal System error about 12 years ago, which was about the sort of the alliance of governments, particularly Russian government, government agencies and organized cybercrime. And then I did. That was kind of a very, very bleak book that was like, it was aimed at like mainstream saying, like we got a real, real problem in cyber security and part of that problem is geopolitics. And, but there's plenty of other things wrong too. And then lots of other books have come along since then saying like, we're also screwed in this way or the other way. And I didn't want to do another hey, we're also screwed this way book. So I, I wanted to look for something that was more useful, positive, like, you know, here's some things that might work, might make things a little bit better. And that's why I landed on the the go to the dead cabin.

Excellent. So what attracted you to covering cyber security issues back in 1999? What was the kind of the angle that was the hook for you that you thought there was something compelling there?

Well, it was really interesting. So, first of all, I've always liked things that are sort of interdisciplinary. I think they're the more interesting things. So while I was a business reporter, I tended to do sort of investigative business stuff. And I would look to court records and, you know, really look in the backgrounds of people to see if there was, you know, something that was more important for society. And then just, you know, whether this guy's going to make you any money or not in the stock market. And, you know, from the beginning, I gravitated to cyber for a few reasons. One of them was that nobody had the right incentive to tell you what was actually going on and not in public. So Microsoft and friends and Dell and Compaq didn't want you to worry, you're pretty head about something going wrong with your computer. They wanted you to buy your computer and put grandma on the Internet. And it's terrific. And the antivirus companies wanted you to be concerned enough that you should spend, you know, 20 bucks a year, 40 bucks a year on their stuff, but not so concerned that you realize that that's not actually going to protect you from anybody serious. So the only people with incentives to say how screwed up things actually were, and I should say, like, the FBI isn't fond of calling press conferences to announce they can't catch anybody. So really, the only ones with incentives to tell the truth were the hackers that were finding all these holes and could demonstrate what they were doing. On the other hand, they didn't have the credibility of like a giant, you know, blue chip corporation that was saying it was no big deal. So it was just an interesting puzzle to me. Like, you know, if there's no incentive, if things are bad and there no one has an incentive to tell you that, then it's on me. You know, it's. It's. It's my job to sort of shine the light on stuff and make sense of it when it's complicated. So I like the interdisciplinary part. I like the fact that it was kind of unproved ground at that point, that nobody was going out and saying, like, this is a serious thing. This one's kind of exaggerated. Don't worry about it. So I like Those things. And it was, and it was fun. I mean, I, you know, I've always liked the personalities who've been involved in this stuff.

Yeah, excellent. Yeah. It takes a unique approach, I think also to cover. Given the personalities, given the complexities of the topic. Was there something that you clued into early that kind of helped you decipher or translate? Or was it just good journalism and it came natural to you? Was there, do you have any sort of technical background at all or did, were you self taught kind of as you went along the way?

No, I was an English major. I'm not a coder. You know, I, I wrote a few programs in high school and college and that's it. But, you know, another thing that, that incented me, I suppose, is that I, I just saw that it was going to get bigger and bigger once I realized how messed up it was. I just anticipated that it was going to become a bigger deal as more things got, you know, know, computerized. And then, you know, and then sure enough, the nation states like sort of showed up, started showing up in a visible Way in 0304. And, and so I was like, you know, this, it's already bad and now like nation states are realizing they can take advantage of it. I mean, obviously the US and others had been quietly for a while, but it was becoming much more sort of open season. And so, you know, I just, I just thought that was, that was super interesting in terms of the people. I don't know, I mean, I guess there's, there are some similarities. I mean, serious journalism can be, can be akin to hacking in some ways. You know, you're not, you're trying to figure out what's going on, what ground truth is without, you know, following what the authorities tell you. You know, sometimes the authorities are telling you the right thing and sometimes they're not and sort of outside the box. Thinking, I think, is important for both, you know, for both good journalism and good hacking.

Yeah, for sure. And I know you certainly have established yourself as a journalist that's trusted by the hacker community and that has been able to take these topics and make them accessible to the, to the public writ large. So that's a great accomplishment as well. Do you remember what story it was that you first covered from a cybersecurity perspective? Or is that too long in the past?

So one of the first ones I remember was kind of an explainer on why ebay kept crashing. And it wasn't really about, I think some of it was hacker driven. There was, there was some DDoS, maybe mafia boy went after them. But, you know, it was, you know, sort of. I got deep into like the architecture of the system architecture and the servers and what was dependent on what. Um, and I couldn't translate all, all that into English, I think in a way that, that people found was compelling. But I, I thought it was really interesting and, you know, why would a company that is worth so much money not be able to stay. Stay up? Yeah, and so I, you know, I think that was one of the things that really sort of piqued my interest. I'm like, well, you know, some teenager can knock off ebay and Yahoo, I think also had outages around then. That's interesting.

Yeah, I do remember the mafia boy, Yahoo outages. I think I did a couple editorials around the time because that was also one of the first exemplars of other people's infrastructure being used in targeted denial of service attacks. So it was introducing all these interesting questions around what is your liability if you have a system on the Internet that is unpatched and has been unpatched for two years and it gets compromised and used to take ebay offline. So there certainly were a lot of questions that were emerging there, particularly from a business angle as well, with regards to what would it mean to be attached to the Internet and what was your responsibility from a due diligence perspective to keep those systems patched, at least known exploit patched, you know, that you weren't being subjected to some three year old vulnerability which was pretty common at the time actually.

Right. Well, so that, that, that was also interesting to me, like the perverse incentives and the sort of tragedy of the commons aspects, the fact that nobody felt a responsibility, you know, to not run open relays if there is all kinds of spam happening and you know, there's that problem, problems we still have today, only more at scale now where, you know, by the time, you know, big companies are incented to make the quarterly numbers and it's hard to evaluate, you know, your bank for your bulk on security spend. Uh, and by the time some glaring lapse actually catches up with the company, you're probably out if you're the CEO anyway. So, you know, the incentives are in the wrong places for a lot of cybersecurity.

Yeah, I agree. Something I actually wrote about in my thesis back in 1995, it's quoting guys like Bob Stratton talking about how there was a lack of incentives for security to be built into these products. You and I first met at Defcon I don't know how many years ago, Many years ago. But what first caught your attention, you know, with regards to the DEFCON hacker conference and when did you first attend?

So unfortunately I cannot remember. It would have been somewhere in the oos. And you know, I didn't go every year, but I think I first, you know, I, you know, I was always going to both Black Hat and defcon. Sometimes just, just Black Hat some years, depending on what I thought was most important and what I was having time to cover and whether, and whether hacking was 100 my beat or just 50 or 30 or whatever. But you know, I, while some of the technical talks were always going to go over my head, you know, I like the fact that, you know, people would try to explain it, that there was generally a supportive, you know, the, the quest for knowledge was a good thing and if you would admit when you didn't know something, you know, and, but you were taking it seriously, we're putting in some effort. People would try to help you and explain why it was important. And that was sort of like a continual challenge that I liked. I mean I like trying to figure out what the hell was going on and then figure out how important it was and then figure out how to explain it to people. So it's like three different jobs and that was more fun. And sometimes it wound up being a very big deal. Sometimes there'd be enormous problem that wasn't being talked about or wasn't being understood or that was being covered up. And you know, I, you know, I certainly gravitated towards mismal and nonfeasance. So like back doors, you know, stuff that was, you know, presented as making your system more secure when it would make it worse. You know, things like that I found especially interesting sort of the quiet deals between companies and governments, offense and defense and, and you know, the fact that some of the stuff gets classified just makes it that much more of a challenge. So one of the nice things about Blackhead and DEFCON is that there are people from all walks of life there, there are people in like doing secret government stuff and people doing, you know, defense contractor stuff and like teenagers, you know, just getting into it. And the cross pollination when it happened was really special. I don't think there's near as much of that now, but you know, it would be weird to see like a guy who's a, you know, chief security officer at a giant company, you know, hang out with somebody that just got out of jail and somebody else who's like, you know, three Rungs from the top at the nsa. I mean, but you would see that and that was really interesting.

Yeah, I think you still see it. I definitely saw some of that at DEFCON this year at number 30 with government folks and hackers who had been convicted and security professionals. I still think you see some of that intermingling. Maybe it happens a little further away from the conference at parties and get togethers and things of that sort. But that was one thing. Of course, for me that was always an appeal, but was a balancing act. Because here I was in 1995 with one foot in the hacker community and one foot in DOD and Intel community and trying to attend events like SummerCon and DEFCON and other hacker conferences while maintaining a security clearance was a bit of a challenge in those days, especially given the narrative was around hackers as criminals. And there wasn't really a lot of great understanding around the tinkering, exploratory research angle that encompassed the hacker community as well. So you written fatal system error and you know, we have a lot of stuff that happens during that time frame as well. And after that with Project Aurora, the emergence of apts, kind of the table stakes going up in the world being on fire, dozens of books per year being written about cyber security, cyber war, cyber conflict, and you decide to narrow in on an old school hacker group, the Cult of the Dead Cow. So what first piqued your interest and what was kind of your first entree into the fact that there was a story to tell here that was compelling enough to, to be written into a book?

Right. So yeah, I was looking around for a positive story first off, like what has worked and you know, really at any time in the history, in modern history of cyber security and some of the things that worked, I think, and you know, this was during the, you know, the Trump years. And it seemed like to me that an unqualified good was critical thinking. And it seemed like that we had sort of bizarrely, despite the fact that we all have universe's knowledge in our pockets, we are now more susceptible to lies and manipulation of many flavors than ever before. And I wanted to hold up something else as an example of, of critical thinking and say, you know, here's some good guys in critical thinking because to me the good hacking is inherently critical thinking because you're, you're trying to, instead of taking the system as was designed to function, you're looking to see what else you can do with it, you know, to trick it at some level. And I found, I thought that was important, you know, so there have been, what are the big things that have happened? There's been like, you know, your Snowden type disclosures. There have been, you know, coordinated, coordinated disclosure with vendors of software flaws. Instead of just, you know, full, full, you know, full disclosure stuff. There has been, you know, a variety of, of ways to come to terms with the government if you're, you know, an outside hacker type. And it just seemed like the close of the dead cow like tied a lot of these together. It's like as a narrative thread, it had been around since the 80s, it was still around when I was writing and it had been on the leading edge of a couple different. Yeah, it was most famous 20 years ago, but had been on the leading edge of a couple different waves that really didn't have much to do with each other. They had, you know, they were like one of the first, most popular bulletin, you know, networks of bulletin board text files. And then, you know, some years later, there they are center stage at Defcon chucking out CDs with back orifice to hack a Windows machine. And, and then they go on to do all these amazing establishment things. So, you know, they, they coined the term hacktivism. So there's this whole volunteer thing that happens. You know, MUDGE goes to DARPA and starts handing out like grants to like people like Charlie Miller and whatever, you know, great, you know, great smart. He establishes like the cyber fast track so that instead of like IBM or some university getting millions of dollars to come up with some next gen DARPA thingy, you know, some dude in his garage or a couple guys can get $50,000 and see if they can prototype something. It's cool. I thought that was really interesting. And then you've got, you know, at stake the same guys for, you know, the loft guys, which are also cdc, starting at stake, which is, you know, very, you know, not maybe not the first hacker boutique consultancy, but one of the first and most influential. And then a couple of those guys founding Veracode and allowing, tipping the balance towards the customer from the big software vendors and allowing them to analyze what the code is actually doing as opposed to what it's like doing in theory. So all these different things that came out of this one group, even though the sort of the membership turned over and just, you know, honestly there's some entertainment value in these characters. People like deathbedgey and what have you.

Propaganda.

Yeah, yeah. So it had all these different elements, interesting characters and you know, most of the names had, most of the real names had not gotten out I didn't think I was going to get them all, but some people I knew were going to be willing to come out of the closet. You know, I'd like to, you know, give a shout out to the statute of limitations. And you know, I just, I just thought it had hit enough things. I didn't want to write the first Snowden book. I didn't, you know, I didn't have access to the Snow documents and I didn't want to write the like the last Snowden book. And like, I didn't want to say I'm on Wicked, you know, all these other, you know, all these other, you know, on Wiki WikiLeaks, all these other big issues, you know, I'd see like this like wave of people pouring into the, the Hot Topic that's cyber related. And I didn't want to do, you know, I want, I mean, I've, my whole career I've tried to go somewhere else, you know, like, you know, zig when the other guys are zagging and find something that's new that I like. People wouldn't know except for, you know, me figuring out a way to write about and that this is more rewarding for me. And I thought, you know, first of all, it's hard to write a positive book cybersecurity because it's so terrible, but I think it's, that's more useful to people. And I was also very conscious that new people coming into the field and didn't know the history and you know, I don't want to send people, you know, they're going to be, their hair is going to be on fire from day one. I don't want to say, like you have to go back and read 20 years worth of views and have to really understand how the big decisions got made. So I was like, if I can just boil this down to like an entertaining thread that talks about some of the key decisions, you know, and how people wrestled with ethical issues. I'm giving them, I feel like I'm giving them a head start, you know, they won't, they'll know, you know, which shoulders they might want to stand on and which, which they don't.

Yeah, I think there's this. The kind of, the path to legitimacy, I think too is the interesting kind of compelling story because as you mentioned, it was a little goofball in the early years and writing text files. And then it got a little bit more serious with regards to pushing the envelope and releasing software that had the potential to do great good, but was also Used for great harm as well. And then that kind of continuing the evolution into working in the government, starting these companies that move the needle. Were there some key personalities that you felt like kind of continued the thread throughout that kind of whole history that were there in the late 80s, early 90s and were continued elements kind of to the modern day iteration of the cdc?

Yeah. And you know, one of the things I was trying to do is like as you said this, it's pretty unusual that you have this giant industry now that basically came from a scene, it evolved from a scene rather than an academic discipline. You know. And so one of the things that surprises people that are new to this all is that if you meet a CISO or a CSO at an important company who's around, you know, early 50s now, ch the chances. And they're good. The chances are way better than 5050 that they were breaking laws as a teenager. I just think that's really interesting. And one of the benefits to all this is that they've had to think about risk and ethics and law in ways that regular people never have to. And that's important because I think, you know, if you get a, like if you're coming in now and you went to a nice college and got a nice degree and you work for a big company doing cyber y things, you might wind up sleepwalking into doing something that is not helpful for society or even the company that you're working for. So it is important to think about where your ethical lines are and what is actually going to be helpful. And so it's good to go back to these folks in terms of the enduring personalities. So I mean, to me, I guess the changeover from there are a couple key changeovers. There's the changeover from text files to sort of public hacktivism and releasing hacking tools. And a number of them made that, you know, that journey, including the aforementioned Def Veggie and Omega. And then the others who came in with like the, this with superior technical talent that wanted to join CDC because they were the fun kids, they were the cool kids. And so that would be like Mudge and Dildog more than anybody. Dildog being Chris Roo, the co founder of Veracode. So I think that was interesting. And then like, and then what happens after when we get into the OOs and people, most people go legit. So you know, Mudge and Dildog are there in the hacktivism thing. Oxblood Ruffin was sort of like the, the godfather of activism. And what's kind of amazing to me is that the book has resonated so much with, with not just the old school I knew would be psyched to see any mention of a BBS and a modern bestseller, but with the new entrance to the field and it's actually inspired a new generation of activists. There's actually been more activism since the book than there has been at any time beforehand. So that's, that's really wild and, and pretty cool. Not that all activism is good and sometimes it's covered for something else, but the fact that people are sort of engaged in the idea and are, are doing things. We had their first ever government endorsement of activism that I've seen. I mean, yes, China kind of turned a blind eye to a lot of patriotic hacking that was, that was happening. But we had the government of Ukraine, you know, retweeting one of the major anonymous accounts and saying, you know, hey, come join our, our telegram channel. And you can have like here's some target lists in Russia, you know, all, you know, all aboard. And it's just incredible that it's, it's come, it's come that far so quickly. Yeah.

So, you know, during that time frame you talk about, you know, if you're a good CISO or security expert in your early 50s, you likely did something illegal. The environment was a little bit different, you know, because the technology was not accessible. And really a lot of the illegality was around getting access to the technology to learn. And today a lot of those technologies are available. You can build a home lab, there's capture the flag environments. Are there examples of issues today where you think that maybe there are folks that are still bridging into that world of illegality and what would those issues or kind of topics be where they would still kind of have one foot in the illegal world, you know, for some reason with regards to access to technology or personal growth or the like?

Well, I agree with you. It's no longer a necessity. You know, in the old days it was, you know, a lot of it was just long distance service. And you know, if you're going to dial up to a bulletin board that wasn't in your area code, that's going to, you know, your parents are going to get a multi hundred dollar phone bill, they're not going to be happy. So hence the brisk trade in credit card numbers and calling card numbers. I don't think that's necessary today. You know, there's certainly some exploration that happens that is best kept quiet I think, if you're doing it. But the laws have gotten Quite tough. And there's a lot of prosecutorial discretion, as you know, as to whether to charge you with something if you're in the teen exploration phase. So don't break the law, kids. And if you do, be under 18 and if you do and don't get caught, and if you do get caught, you know, make the case that, you know, you weren't doing substantial damage and maybe you'll, maybe you'll get off easy.

Or we have a case. I won't talk about it too much because it's actively underway, you know, with regards to catching young hackers and trying to reframe the illegality of it into something that was more like a bug bounty or. Yeah, I think you see some mentors of folks that have been in that environment that, or have the experience of at least understanding where they're coming from, trying to adapt the rules as to, you know, what does it mean to hack and what is malicious intent. So definitely interesting times. So when you first reached out to some of the key players at cdc, were they receptive? Were they guarded? You know, how did the book pitch go when you, you first came up with the idea and reached out to them?

So, you know, other people have asked me, like, how did you even reach these guys? And in fact, that was like, incredibly easy because they all still talk to each other and. But they were always sort of like comparing notes behind my back. I mean, I'm not privy to their, you know, private chats. But I think one thing that helped me was that I basically told the same story to everybody. And I was transparent. I really, you know, journalists are scary. And to try and make up for that, I try to be very transparent about what I'm doing, what my goals are, what my methods are. And I sort of like report in on where I'm going or what I've found that contradicts something I've been told or whatever. And eventually most people wind up trusting me. So some of them I had known before. And so in some ways, like, thematically, the book is a sequel to Fatal System Error, which that were all screwed. But in terms of people, there's a fair amount of overlap with the Napster book because Napster came out of a group of hackers in Boston. And so some of those people were also CDC adjacent. They were going to 2600 meetings or whatever. They were very early beta testers of the Napster program. Sean Fanning was in a hacking group called Woowoo, and so were a number of members. Some of the CDC and You know, Woo woo, you know, small group, I don't know, 30, 40 people includes now not just Sean Fanning, but Doug Song, who founded Arbor Networks and then Duo and Jan Koum who one of the two founders of WhatsApp. So incredibly impressive group again with like, you know, teen criminals and you know, really smart, you know, mid career types I guess, and just amazing. But anyway, so there's some of them are, there are a couple people that are both CDC and Woowoo. One of them is Adam o'. Donnell. Now it's Stripe. And I had met him, I don't know, a few years ago. So I started with the ones I knew and you know, talk to them and they're the one time they were excited about it because of all the hacking groups, they're the ones that were running towards the camera. You know, most serious hackers running away. I'm not going to tell what I'm doing, but like they, they sort of, they were doing this media jamming and like they thought it was fun and they would, one of the things they would do is they would meet you wherever you were. So if you were like a serious journalist really who really cared about vulnerabilities and what's wrong with the software ecosystem, they could talk about that. But if you're just some clueless person that wants a sound bite for TV and you want to talk about these terrible hackers in Las Vegas that can derail trains, they'll give you that too. So on the one hand they were much more willing than average to speak. On the other hand they were, a lot of them didn't see how you could actually tie it all together in a book. And some of them were understandably worried that I'd screw up one thing or another. But it's just like, you know, I spent a lot of time with them and talking about the different elements I would need to make this work. And in fact I wasn't, I wasn't going to leave out crimes, but that wasn't the point of the book. And you know, eventually, you know, eventually won them all over I guess.

What do you think were the top contributions of the group over the history? And if you had to narrow it down with regards to everything that they did, what were some of the greatest hits?

So I think kind of like sort of the cultural rebel attitude thing, but being aimed at good, like they were actually trying to make the world better and they could and it's hard to make doing good cool. And I think, I think they managed to do that and you know, they pissed off the establishment, they pissed off big companies. But that's how you get the kids these days in their rock and roll ways. So I think, I think the hacking scene in the late 90s was trying to figure out what it was about. It was on the cusp of there being actual money to be made. Government was just, you know, was getting more interested in hiring folks and it was kind of a wild time. And they were like, kind of like the figureheads. Like, you know, they closed like DEF CON Saturday night, you know, you know, they had the big, the big events a couple years in a row. So I think they were seen as kind of models for like, how you could do something interesting and be ethical and not sell out until you're good and ready and maybe when you even do sell out, you know, to take some of your old values with you. One of the things is that I liked is that I was able to illustrate the internal disagreements about, you know, various ethical calls and how they sort of got past them and where they resolved. So it's not like I'm not trying to hold up like one absolute model of, you know, these. This is one person or five people or 10 people that did everything right. It's like, you know, here's what they were concerned about and here's where they split ways and you can choose among them or pick your own way. But think about it. That you have a responsibility to think about, you know, what you're doing. Because the future really belongs to coders and system architects. And these people have a lot of power and they don't really. A lot of them do not have, you know, one of the things I called out towards the end is that like, there really isn't much philosophical or ethical training for anybody. I mean, many, many amazing hackers never went to college at all. But even, you know, the only time you sort of get to a philosophy requirement, at least, you know, around oh and so forth, is, you know, if you get an EE degree or something like that, you'll probably have one required philosophy course. But it, like, it could be like, you know, play DOH for geeks or something like that. It's not the real world, you know, challenger disaster case study type things. There should be, you know, that that's, that's where you see how incredibly important this, this stuff is. So it would be nice if there was like a 1, 800 number for like, you know, hackers in a dilemma, you know, besides eff, you know, what is the right thing to do here? I Remember, like, when I was nearing. I was finishing up the book, Rob Graham posted something on Twitter like, you know, what are, what are some of the big ethical issues on disclosure? And it was like, there are hundreds of responses and they're really interesting ones. Like, okay, say, you know, ended encryption is banned in country X. Do you steer people to ways they can get it anyway? What if you are working for a company that wants you to put it in a back door? Do you quit quietly? Do you quit publicly and expose it? Do you know, there's a. There's so many interesting questions that are only like, sort of whispered, you know, among your trusted friends in the hacker community, you know, at defcon and in the bar and whatever. And, you know, there needs to be sort of like a place, a way to discuss this stuff more broadly because I think it's really important and people don't understand how fascinating it is.

Yeah, interesting. I think that's part of the reason why Richard theme, I don't know if you've ever attended any of his talks at defcon resonates so well with the community. It kind of calm the hacker shaman, right? He's, he's, he's providing insight into some of those dilemmas that people face through all walks. I mean, one that I remember in particular is him talking about the burden of keeping secrets, which for those that were involved in government work, you know, I think really resonated and is an entirely different class of problems similar to what you were discussing. So how did your perspective, you know, or view change based on your interactions with the cdc? Did it cause you to view the world a little bit differently or was there a shift or was it simply that you were reporting and this was historical, you know, did the cult of the dead cow change? Joseph Men?

It's a good question. I mean, I mean, I went in like, knowing the highlights of what they'd done, you know, the, you know, the making exploits easier because it was the only way to force Microsoft, which was a monopoly, to actually do anything. And, you know, the covering some of the historical things. So, I mean, I just got sort of a deeper appreciation of the significance of a lot of those things, of like, how coordinated disclosure came to be. It wasn't when Microsoft screamed at them, it was when at the loft at that time. It was like when one of them politely said, you know, if you'd like us to fix this before everybody, all the criminals get their hands on it, maybe you should let us know a month or two ahead of time. Oh, yeah, that's Reasonable. Okay. I think the. The dynamics, you know, Dick Clark coming up from the White House and visiting the loft and then arranging the testimony in 98 before Congress when the loft guys, including Mudge, said that they could take down the Internet in half an hour. But that was really interesting, you know.

Their hacker handles, which I always thought was, you know, just played into it as well.

Yeah. One of the parts that was awkward for me was that sometimes they made stuff up. And the big example of that is like, the Hong Kong blondes. So the Hong Kong blondes was this group that the CDC talked about at a couple of different cons, including Hope. And it was this group of Chinese dissidents that were working with democracy advocates, and the CDC was advising them on how to, you know, avoid getting caught and some other stuff. It was really exciting. It got a lot of play at the time, you know, around. Around 2000, 2001. And it was. It was made up. And, you know, as a journalist, as somebody who's like, petrified of writing anything wrong, you know, I was like, I don't know what to do about something like this. Like, hey, this is a really cool lie, or, you know, here's a, you know, a mixed bag of a lie. But, you know, as I. So I just kept reporting it and kept studying it, and, you know, it actually became true. It's like a lie that became true. And I think that's one of the most interesting stories in the book. There was. There was a guy in Tibet who was, you know, helping the. Helping the monks there who are constantly under surveillance by China and the ones that fled to India, Dharamsala. And one of those guys read about the Hong Kong bonds and said, well, this is terrific. We need to hook up with them. And so got in touch with Oxblood Ruffin and, you know, Oxblood Ruffin got him to come to Vegas and give a talk about what they were doing in Dharamsala and what sort of help they needed. And then Oxblood and a bunch of other hackers went to India to help the Tibetans. And so, you know, it may have been inspired by a bogus but feel good story, but it actually wound up doing some good. So, I mean, the layers of gray in this, I think, are really interesting. So, you know, and once again, I love the challenge of trying to digest that, synthesize it, and make it fun for people. I mean, I'm always trying to explain complicated, important stuff. And the trick is to make it entertaining while still being truthful. And I was, you Know, basically finding good guys that were colorful. There's just been too much written about, like, bad guy hackers. I don't need to celebrate them. We need good stuff. And so to find like, colorful good guys is a real, is a real win. I think that helps, that helps get it out.

Interesting. Not that I want to steal your next book idea, but were there any adjacencies or kind of topics or characters that you encountered that just weren't a fit for the book that you thought were kind of interesting or compelling stories in the grander narrative?

Well, I don't plan to write about it, but, you know, there was, there was a big, you know, I allude to it a little bit, a little bit in the book, but there's, you know, there's neon serious neo Nazi hacking types and some of whom, like, hanging out in Russia, some of whom are big in bitcoin. And you know, cryptocurrency in a lot of ways has monetized pure hacking for, for whatever reason. But it also facilitates money laundering and other sorts of sketchy things. So there is like, I don't think it's the hacker norm, but there is a community of far right, nationalist, racist hacker types who've made a lot of money in crypto and are responsible to some degree for a lot of the polarization and bad things that have happened in the US and other countries. I think that's a story that hasn't really been told compellingly. I don't really feel like doing it, so I'll leave that to somebody else.

Do you think there's a ultimate confrontation coming up between that kind of hacker group and the more collective kind of CDC do good hacker?

I think there's always, I think there's always hacker on hacker stuff that's happening. The hackers are among the very, most people, very, most likely to be hacked because they, you know, for ego reasons and because they might have tools that others want. There's, there's, there's a long list of reasons. So there is, there is that sort of stuff going on, but I don't, you know, I don't know that there have been clear winners yet. The problem is these days, most of the good guys, I mean, they're, I mean, there's kind of doxing stuff that's happening, which is interesting. You will see like, you know, both sides doxing each other. I think that's the way it comes out the most. So, you know, there are, there are activist types that will dox, you know, Nazis marching in hoods or whatever. And some of those people are hackers. And then you'll see the reverse too. So I mean, it's, it's, it's. And swatting and stuff like that. So it's, I think it's mostly, mostly low level that's visible. I think by and large the people who are trying to do the right thing are now obeying the law. And so that means they're less likely to, you know, break into machines of people like we've.

Yeah. Not without proper authorities. So the subtitle of the book is how the Original Hacking Supergroup Might Just Save the World. Can you explain kind of the shift towards that kind of positive outlook? And what role do you think the CDC and some of these other hackers for good play in the future of society?

Well, so first of all, I want to say that by super group, I don't mean that these are, you know, you know, the single biggest conglomeration of talents in the history of the world. There's some, you know, the CDC started out back in the day, like sort of, you know, writing snarky teen text files about the people who are actually very talented. And at that point, Legion of Doom and Masters of Destruction who were like, you know, breaking the laws over all over the place. I use super group in the sense of like the, the rock and roll groups of the 70s that had one guy from Cream and you know, one guy from whatever. So most, almost everybody in the CDC had another primary affiliation. And so the fact had somebody from LOD and somebody from Mod and they got along. It was like kind of a Switzerland in part because they were sort of, at least in the beginning, more like the liberal arts wing of the hacker underground, as opposed to the guys who were actually gathering at that group to do crime, which is what some of.

The others were doing.

And that's one of the reasons they survived. So, you know, I think the ways in which they might help save the world is that they were able to bring some of the critical thinking and efforts to do the right thing into government, into, into business and also spread the word among sort of hacktivists that it's important to preserve anonymity, fight censorship. We can help our brethren and sisters in other countries. That's a good thing, all that sort of stuff. And then there's this kind of like the Wooten family chart where the famous basketball coach who trained the people who he trained went on to train others and you wind up with the entire NBA that way. You know, at, at stake you had people like Katie Massouris, Alex Stamos. David Litchfield, you know, people who are now, you know, either incredible innovators like Katie, you know, brought the bug bounty to the Pentagon. Litchfield is, is one of the top security guys at Apple. You know, there's like, whenever there's some big ethical test inside a company, say like, you know, there's like Vietnam is yelling at Facebook and says we're going to shut you down unless you give information on, you know, decisions X and Y. There's you know, some gathering of the company minds that includes like the market lead for Vietnam inside Facebook and a security person and several lawyers probably. And you know, by and large the person that everybody's going to look to for some kind of moral leadership was either in the CDC or was trained by somebody who's in the CDC or trained by them. They're just like the ones that are most experienced wrestling with this stuff. They're not always going to win the day in the internal arguments, but they're a very important voice. And so that's how I think they sort of saved the world. Other things that are happening, I think the Ukraine stuff is super interesting. I think open source developments, Tor and the like, anti censorship tools, encryption tools. Moxie wasn't a CDC guy, but signal is a very big deal. And you know, the CDC indirectly contributed to Tor because they were, they put out a browser that was supposed to work with Tor that would protect anonymity. At that time Tor was just like FTP and stuff, you know, other protocols. And that convinced Dingle, Dyne et al, say, oh my God, we need to bundle in a browser too. Which is now how everybody uses Tor, so, or almost everybody. So they had a big impact on that sort of thing that lives on. So I mean it's, it's the, it's more the, the motivations and the commitment and the willingness to rise to new, to move as the playing field moves. So, you know, you know, testifying to Congress didn't come naturally to these folks, but they figured it was important since they figured out how to do that. And most of them weren't real business heads, but they figured that that was important. So they learned to learn to run businesses. Um, one of the things I admire about these guys who are just, you know, obvious, it should be obvious, they're super smart is that they're willing to learn new things and screw up on occasion to try and affect real change. And I think that's a kind of an enduring lesson.

Yeah, interesting. Do you think that one day extends into politics. You know, when you look at the hacker mindset being applied to all these different fields, do you think that outside of, outside of the Beto case study, you know, which was there in the early days of the text files, is there the equivalent of, you know, a mudge that runs for Senate? Or do you think that politics is a. Is the next manifestation of them trying to. To take things apart and put them back together in. In a better form?

So I think the hacking mindset can apply to almost anything, particularly where the public good is concerned. And politics is sure concerned with the public good. So there are already lots of hackers who are important in politics, some of them behind the scenes doing the online organizing thing and the battalions on Twitter and organizing this and that. But I think I tried to make the argument in the book that Beto o'. Rourke, yes. That Bet o' Rourke was applying hacker skills towards his political career and campaigns. Like, for example, there was a sit in over the refusal of Congress to consider gun control legislation, to even debate it. They did a sit in and the majority party cut the cameras, gaveled it out of session. And so the rules say that C SPAN has to turn off the cameras. So, okay, so then Beto and friends do a Facebook live from their cell phones, and there's some of that unorthodox approach outside the box thinking that is helpful for campaigns. And also, I think, you know, the public is more receptive to outsiders in general these days. I mean, Trump is an outsider, you know, so are other major candidates. So I think there is. I think there is a pretty big. There's already a hidden role, except for Beto, of hackers in, in politics. And I think there will be a more open, open role. I mean, I think I was trying to, among other things, rehabilitate the word hacker as a positive thing. Sure. And I think more and more the population is seeing. Seeing it that way. So I don't think the past will haunt folks just as much. I think in some ways, like, Beto was like just the way Jackie Robinson had to have a certain personality to be able to break the color line in baseball. You know, he had to let stuff roll off him and he had to, you know, the guy who goes first is super important. And Beto, I think, is kind of opened the floodgates for him. It was easier because, you know, he, you know, he was already published already out there that he had a dui. So it's not like this is like, oh, my God, he's confessing to a criminal thing and it's going to ruin his career. Yeah, he was a minor and it's not as bad as a dui, the stuff he was doing. So. And he, and it's not like the stuff that he was exposed for, except for the really juvenile writings, was totally in conflict with the person he is today. You know, he's, you know, liberal, libertarian, depending on the issue, you know, you know, he's, he's pushed for like, legalization of marijuana way back when, which certainly fits with the hacker mindset. So, I mean, I think he was kind of the perfect, perfect first mainstream politician to have fessed up to a hacker past. And I think there will be more.

And really enabling and adapting to the use of technology. To talk about the Facebook Live, I just think back to what I thought was a brilliant, the bipartisan road trip with him and Will Hurd, where they basically broadcast on Facebook Live, you know, Republican and a Democrat driving from Texas all the way to Washington, D.C. and engaging people on Facebook, taking requests to what to play in the radio, recreating the Dukes of Hazzard slide across the front of the car and, you know, even attracting the attention of folks like Mark Zuckerberg, you know, at the time, said, hey, there's something really interesting here taking place. And that was a comfort with technology. Right. That there are very few politicians that would turn their cell phone and broadcast live for, you know, 24 hours straight or whatever the duration was that they, that they were pursuing.

It's informed his political thinking too. So he cares about broadband, expanding availability of broadband. He knows, he understands the value of the Internet as a economic thing and a freedom of expression thing and a find your own people thing. So there have been a number, there are a number of policy areas where, unsurprisingly, he is very pro the good parts of tech. So there's that too.

Excellent. So I always appreciate the time. You know, is there, is there a thematic here that I missed or something important about the book that you wanted to convey that you'd like to take an opportunity to.

I think we've hit a lot of the highlights. I mean, they're, they're, you know, it, it is a fun, short read about history and that totally impacts the present day. Not just with Beto running for governor, but, you know, issues, you know, like the various fights over end to end and surveillance that are happening today. And, you know, so hacktivism pro for a government against the government. It's a lot, all sorts of live stuff that is informed by it. And so I Just, you know, suggested. Kindly suggest that if people might want to check it out and read it, the paperback's like 10 bucks. And if you're into audio, the guy who reads it is really good. People really like him.

So yeah, I have to check out the audio version. Like to download audiobooks for my hockey road trip with my son. I think you could make the argument that the next 10 years are maybe even more important than the last 10 years as it relates to technology disruption and the role that, you know, technology will play in digital self sovereignty and privacy and security of communications, as well as the role it'll play in the economy with the emergence of cryptocurrencies. And it's a bit of a house on fire right now, but the underlying technologies are very sound and will be disruptive. And having that hacker mindset for how to take these technologies and use them for good or how to progress society, I think is going to be as important in the future, if not more important than it has been over the past years. Also would like to thank you as somebody who's part of the hacker community for writing this book because it is a great historical perspective, but it is rare that it captures the attention and it would be given the treatment that you've given it by writing this story and kind of sharing these ideas and thematics. So thank you for writing it. As somebody who's been in the community for 25 plus years, it certainly was a joy to read and it was a joy to have the hacker in a positive connotation be acknowledged in such a significant way. The last question I always like to ask, and I know a bit of a surprise, is what are you reading right now that somebody else wrote that you find compelling, that you would like to attract the attention of the audience to?

Well, I just got Miko Hipponen's new book, but I haven't cracked it yet. I have an advanced copy of Andy Greenberg's book on crypto chasing and he's written a couple of humdingers in the past, so I'm sure that's going to be good. You know, what I'm reading right now is the one on my bedside table right now is actually the dawn of Everything, which is really good. It's a new way of looking at sort of synthesizing new finds archaeologically and anthropologically of prehistory. And it sort of attacks the sort of like the two major schools of thought which are basically Hobbes and Rousseau. And one of them is, you know, man used to be savage and Then they had to get civilized and when they did, farming in cities. And that's what keeps savagery in check. And that's one school and the other school is, is the same except for like, you know, people used to be innocent but then and good and then and then they had to and then. But they still needed the structure and it's too bad, but it's necessary. And these guys are saying, well, actually that neither of those are supported by what we now know and that there are all kinds of different societies that were happening back then and that means that there's more possibilities now that it's not, you know, we're not sort of locked into, you know, this sort of, you know, top down leadership and stuff like that. So I'm enjoying that so far.

Excellent. Cool. Well, I will provide a link in the show notes and I've got Mikko's book I think has been officially released. I'll have to check my Kindle. I know I had pre ordered it so I have to see if it showed up there then. Certainly looking forward to the Greenberg book as well. Excellent. Well, thank you so much for joining us. Really appreciate it and look forward to seeing you in person sometime again in the near future.

Thanks for your support. Matt. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.