Aspen Cyber Summit 2020: How 2020 Changed the Internet

Hi, everybody. Thanks for joining the fifth Annual Aspen Cyber Summit. I'm Vivian Schiller, the director of Aspen Digital, and I am pleased to introduce our next panel. As a reminder, the full summit agenda and bios of all our speakers are available@aspencybersummit.org and if you plan to tweet, and we encourage you to please use the hashtag ASPencyberg. I want to thank FireEye, intel, and Proofpoint for making this week's summit possible and helping us convene this important set of conversations and to understand such a complicated year. We also want to acknowledge Blue Vector, sickpa, NA and the American Gas association for their additional support. Up next, we have a conversation with Nick Thompson, the editor in chief of Wired and Cloudflare, Cloudflare COO and co founder Michelle Zatlin, who was also a member of Aspen Cybersecurity Group. Over to you, Nick.

All right, thank you, Vivian. Thank you for the kind introduction. Thank you for hosting this awesome event. I am blown away by all the other folks doing all the other panels, and this should be great. So, as noted, I am with Michelle Zatlin, the co founder and COO of Cloudflare. We used to describe Cloudflare as the most important company you've not heard of, but now, actually, after the last two years, everybody has heard of it, so Michelle is all over it. Good afternoon, Michelle. How are you?

I'm great. Hi. Well, I'm in California, so it's still the morning for me. I've just finished my coffee. But good morning to those on the east coast and good morning to those on the west coast, and good evening if you're in Europe. But yeah, thanks so much for having me. I'm really grateful to be here and I will admit that I kind of wish we were in Aspen right now. That sounds pretty nice. As much as I like where I live, I miss traveling just a little bit.

I know traveling to Aspen was actually of all the things that the trips that the pandemic cut short, Aspen is kind of the one that I miss the most. All right, well, let's get cracking. So this pandemic happened. You at Cloudflare are in the rare position where you get to actually watch the entire Internet. So you've seen this crazy transformation as the world that used to happen IRL has now moved online. Tell me the weirdest, most surprising thing you're have learned about how humans have used the Internet since March 2020.

That we have all become better, better digital citizens. You know, even, you know, everybody gone online we really have, I mean what happened in March is very quickly, you know, the pandemic kind of raised its, its level of severity so quickly. Basically overnight and within a two week period, the amount of traffic online doubled around the world. This was not unique to the United States or Canada or uk. It was literally globally. So almost every country around the world saw a two like a doubling of an increase of online traffic overnight. And so I say that because it's pretty remarkable for two reasons. First, that all of a sudden all these people who, who were doing things in real life went online to start to do it. And I really think that there were a lot of parents out there who said I would never do online lessons for my kids. And next thing you know they're doing online music lessons. And now it's really normal. It's actually almost even better not to go to the musicians, you know, the music teacher's house. I can do it online or school online. But it's not just parents, it's older parents. Zoom calls. It's, it's younger kids getting online. I mean I look at my kids and it's kind of sad, but their digital skills like surpass. My 7 year old can use the iPad very scaringly too much so also online. But the second thing that's been really interesting because I bring this up is and we're an infrastructure provider, so it's kind of my role to bring it up is it's amazing that the Internet held together as well as it did. I mean, do you think about it overnight a doubling of traffic, which was no one was expecting that. And by no one, I mean none of the cloud providers that really make this run behind the scenes were expecting that. And so it's pretty amazing it held together as well as it did. So I think those are two maybe in retrospect not so obvious, but interesting kind of points that we've seen of just traffic way up around the world. And since then it's ebb and flowed as restrictions have been lifted. But, but Internet traffic is way up and people are doing a lot more online. They're communicating, they're commercing, they're doing a lot more online than they were doing a lot more business online. They're working in different ways online, they're being product different ways using different tools than they were just in February of this year.

Well, I have one strong objection to what you said. Okay, good online music classes versus in home. As a father of someone who has a son who practices the trombone right next to the home Office. There's been some complexities in that particular dynamic. As much as I love having him there playing the bone. But it might start up again soon. As you all will hear. Let me ask you why the Internet held together. So one hypothesis is there was this massive increase in traffic, but it was easier to handle than you might have thought because we're all at home. So it's just through WI fi, so it's through these thick pipes, right? You know, all these zooms are going on in my house, but it's all through a big fat wifi connection. We're not going tower to tower and there's not a handoff in the car. Is that part of the explanation or why else has the Internet not collapsed?

I mean I, you know, I, again, the true heroes of this pandemic as we look back are going to be the medical responders. I mean what they've had to endure. I mean I think we're all very grateful for their service, but I mean maybe the faithful sidekick were a lot of the cloud based companies that held together. I mean I just, I, whether you're as a person connecting through my wifi or cell tower is one thing, but there's somebody behind the scenes who has to make that connection happen, right? And doubling the traffic overnight is a big deal for all those companies who have to hold it together, including ours. And so all of the large global cloud providers, I mean that's Amazon, like aws, that's Google Cloud, it's Microsoft Azure, it's IBM, it's Alicloud out of China, saw huge surges in traffic. And the fact that it kind of happened without a blip was quite, I think, remarkable. Network providers like Cloudflare, Traffic way up were holding together, but behind the scenes, although it worked, that took a lot of people and technology to make sure that, that, that the Internet kept running. And so there was a lot of network engineers, a lot of network administrators that were sweating the details for all of us to make it seamless for the end digital citizen like yourself. And so I really, the network administrators who are making these cloud providers run globally kind of deserve some gold stars for holding the Internet together during that huge spike in traffic.

Props to all the network engineers except for the ones at the Delhi telephone company who cut me off right before I was about to give a talk to a thousand people in about May. But we'll let them, let them be. Tell me about something that some service or some system that has moved into the cloud much more quickly than you would have thought. Like so, for example, one thing that I've been interested in is how much of financial exchanges have moved into the cloud. They've always been a mix of on prem and cloud, but it seems like they're all going to be entirely cloud fairly soon, which is pretty different. What is something else where the move into the cloud has been interesting or surprising?

Yeah, I have so many examples. Let me start with some obvious ones and I'll maybe move up to some non obvious because I think this is really interesting. We'll start with a small business owner yoga teacher used to do all their yoga classes in person. All of a sudden the studio closed. Yoga teachers don't have big margins, they're living almost paycheck to pay check. And so a lot of them pivoted or some really pivoted to online classes and using online video streaming. We have something called Stream, but there's other providers out there where they're doing digital online video classes and where now you're not just connecting with your community, you can build an audience globally and it's all digitally online first. So it's kind of this digital first strategy. So that's one example. A second example is a very well known consumer company. They are a consumer foods company, kind of a rising star I would say. And they supply a lot of their product to restaurants. Well, restaurants have had a hard time during this because especially in the early days we couldn't go and support them. And so they very quickly pivoted to a direct to consumer brand that was not even in their plans. And so they went from March thinking that they were selling to their supply chain to restaurants to being like, oh my goodness, restaurants are cutting all their orders, we gotta stay in business. So they pivoted to building a digital direct to consumer brand for their particular product. And they're selling directly to customers their food item, which if you think about that, it's pretty amazing that this business was able to pivot and kind of change, take something that wasn't even a strategy and create a strategy and make it happen. And what I think is pretty incredible is how quickly they could spin it up. And they did not build all the technology themselves, they had the great product, but they used services like Cloudflare and others to build the storefront and get their connection to their audience and start sell direct to consumers. So that's the second example. Third example is something like DoorDash or any of the meal delivery companies doordash about to go public. There was a great article a few months ago about this, so this, this public information where like again in March, like everybody in DoorDash was uploading restaurant menus online to help these restaurants become digital first strategies. And they wasn't the restaurant doing it. Some of them were, but it was like almost like doordashes were like, we're going to help you. And they've seen something like a 700% increase in the amount of demand. And it's one of these ideas we all have to eat. We can't go to the restaurant, but hey, can we support them? Can we help do it? And the technology through a company like DoorDash, helping make it easy to order, identify what they we can make and then getting it delivered to us is pretty impressive. So I love that story because I just think it's kind of like us all banding together to help digital make these digital first strategies come to life and not making it one by one, but doing it in mass. So I think that's really interesting. So those, those are those. And then there's, there's the large, large established organizations that you kind of think of as slow, stodgy, last to move, where we've definitely had the CIOs, the CISO say we all of a sudden my digital transformation, my digital first project that I thought was going to happen two years from now has been pulled up by two years. We're doing it now and it's in this case, this particular company, it was like an oil and gas company where they found all their employees at home. And it was one of these things. They'd spent so much time securing their corporate network and they were like, our corporate network is rock solid. And all of a sudden their employees were at home. And just by nature, our home networks aren't as solid as our corporate networks because we haven't invested as much as securing them. And not only that, they've got three unissued personal devices connecting to their work things too. And so a lot of these large industrial companies have said, wow, I got a front load. I have to make it easier to kind of get my next generation user centric VPN approach together because the old model is not working. And so there's just been a huge shift for things that for the last 10 years there's been a lot of hardware boxes that have held the Internet together to make it work. And what's really interesting, the next 10 years is all about these cloud services that are going to make the Internet work. And it's really just accelerated the trend. I saw Harley Finkelstein From Shopify. You know, it's just Black Friday, Cyber Monday. So Shopify was all over that. And, you know, he had a, he, he said something on his Twitter yesterday and said, 20, 2013 has arrived now in 2020. And there's some truth to that. It's like where we thought we were going to be five or ten years from now. It's happening now. And a lot of these transformations are happening faster. And this idea of like, oh, these businesses are slow to pivot, actually the best businesses have pivoted very quickly.

Well, let's talk about cybersecurity, because if you had asked me in March or April what I expected would happen, I would have predicted a boom in online education, I would have predicted a boom in healthcare, and I also would have predicted massive hacking for just the reasons you describe.

Right.

I'm outside of the Conde Nast building. Not only am I outside of the Conde Nast building, but my kids are using my phone and clicking on every Russian link they see. Right. And so how have we not had a massive hacking catastrophe yet? Is that A, because things happen that I wouldn't have predicted, that I've kept it safe, or B, because it's going to happen tomorrow and the bad guys have just been laying the traps and waiting to crack the distributed network that we've all created.

So I think that there's a couple pieces to your question that I think it's important to spend some time on. And I'll answer your what you asked at the very end, but I think there's a couple prefaces especially because there was a ransomware panel right before us, which we didn't get to hear all of it. So there are an increase in attacks online now that's great. That you haven't seen and you have been the target of it, so be thankful. But like, there are a lot of businesses who have been the target of it. And so we did, you know, Forrester did a study, we worked with them to do a study. And since the pandemic, you know, we surveyed 300 companies around the world, global. 58% of them had dealt with a data breach since the pandemic started. 58%. That's a lot. That's a high percentage. Now, I don't think they're high profile like some of the ones that Equifax or the target breaches like those have a bit. But I actually think that if you're a business owner, whether you're a medium sized business owner or small business owner, a large corporation, there are A lot of teams who are on pins and needles because there are some really bad things going on. The panel before was ransomware. There's been a huge uptake in these network ransomware initiatives where there's an organization called Fancy Bear, they go buy some other names as well. They took down the New Zealand Stock exchange in May. I mean serious. And it's not just. There are many American businesses, gold businesses, who are being targeted by this ransomware event. And what's is kind of, I mean the bad news and then I'll tell you the good news is a lot of CISOs like CIOs, CISO CTOs, receive these ransomwares and they don't know what to do until they pay it quietly because they don't want it to be the mat, they don't want to be on the COVID to Wired, they just don't want to be in the COVID and Wired as the example child. And so they pay it quietly to make them go away. And that's because these old hardware boxes that have held things together for the last 10 years aren't working in the new world of a cloud based service that's much more infinitely scalable stops these sorts of things. And so again, we've seen a lot of prospects pay or come under be like my God, what do I do? And again, the good news is a service like Cloudflare and others can help now make that problem much easier. So that's good. And I know you said at the beginning everyone knows us, but the truth is most of the world has no idea we exist. So we have to continue to raise our profile. There are way better solutions today than there were five years ago to build these new things. So I guess the first part of your question is that there are some businesses that I've definitely seen an increase and it's not just some segment. It's been small businesses, medium sized, large corporations. And I do think there are a lot of people who are sweating the details behind the scenes and that's a very violating experience. And so again at Cloudflare we really have been very busy this year making sure that we can help our customers or potential customers solve these problems because we want them to be ahead of it and protected, not behind. And we're lucky to say that our technology works, is very effective at stopping that. So I think there's that. So I guess that that's the answer to your question where, you know, again, I think there are better solutions today that help bridge this than there were five years ago. But you have to know about them, you have to be using them. And if you're using antiquated technologies, then there's lots of gaps and you are, you are being subject to it. And I think that you and your kids have just been lucky so far.

Or maybe I'm lying and I've actually been paying ransomware like left and right.

Let's do an audit of your bank.

Account after how that, that would be fine. I mean, I didn't mean that. Everybody knows everything about Cloudflare. Like I don't think my mom has heard of it, but I just met everybody at the Aspen Cyber Summit has heard of Cloudflare. Let's stay on cybersecurity for a minute. You recently gave an interesting interview where you said that cybersecurity is going to move to something more like a water treatment analogy. Tell me what you meant and what Cloudflare's role to play there.

You know, it's so interesting. That's like, I'm not a very controversial person. I don't think anyone who knows me would say, oh, Michelle Zalin is not very controversial. That's probably the most controversial thing I've ever seen. Like I've ever said. That really got a lot of people to set up, some people who really did not like it. And I meant it in a positive way, not the negative way. And you know, some of the feedback I got was, well, you're going to discourage people from getting into the industry. And I was like, well, no, people should get into cybersecurity. It's really important. We got a lot of work to be done. But you know, as I, when I sit back and I think, okay, where is the world going? What's changed is these cloud based network services. And again, this is very self serving. Cloudflare is one of them. We're not the only cloud based cybersecurity company, but there are many others. And I do think that the model, the architecture of what we're doing and others are doing is very well suited to help future proof businesses for the next 10 years than what's happened the last 10 years. And I'll just give you a quick history lesson for the folks listening, like a bit of context and then I'll explain a little bit more what I mean by this water treatment plant. If you go back to the original specs of the Internet, security was never built in, which is why we have all these cybersecurity companies. It was never built into the rfcs. It was kind of, you can go find them and at the bottom says security to be included at a later date. Because originally the Internet was invented to connect academic institutions. Right. And so I don't really think Tim Sir Tim really sought like could envision everything it's become connecting us and our music lessons and the, and the communication and how we learn and how we do business. Like it's really become this huge backbone to all of our lives and how many people are online and how global it is. It's, I mean it's amazing, it's amazing invention. We're like, we're so lucky to live in a world with all of it. And so what's changed is again these cloud based services technologies like machine learning and artificial intelligence, all of a sudden, if you think about cybersecurity, what happened for the last 10 years is if you were an attacker, a bad actor online, it was actually fairly easy to have more resources than any individual business because you kind of take. We had many business, millions of businesses around the world, some really investing in it, some not. And so if you're a bad actor, you kind of had to amass a certain amount of resources to overwhelm them and they could really do go a far away. What's happening in the cloud with a service like Cloudflare is again, we now have 25 million Internet properties, over 3 million businesses that are using Cloudflare. This is a lot of companies around the world, global. And all of a sudden we've been able to band all the legitimate businesses together and we have way more resources than any one bad actor. It's just very hard to have more resources when you band all of those resources together. When you have a system like Cloudflare sitting in front of whatever your workload or application is behind the scenes, whatever passes through us, it's like we're a bouncer. We just stop any known attacker and we know who the attacker is because we have 25 million data points to compare it against. And every second billions of requests are going through our network and we're just using machine learning and AI to figure out who's doing malicious things and who's not. And so it's all of a sudden cybersecurity is a data science play. And those companies with really amazing data science, which we have, really amazing cybersecurity, which we have a huge source, we have so many customers around the world can start to build the technology to stop it. And this is what I mean by water treatment plants. Like back in the day, you couldn't just easily pour water from your Tap it wasn't trustworthy. And so a lot of multi stakeholders got together and they said, okay, we want to be able to trust the water coming out of our taps. And I think that this is kind of a way that the Internet's going to go over the next year is you're going to connect to a network like Cloudflare or others. We won't just be the only ones. And we will clean the traffic in the sense of getting rid of all the known malicious things and making it speedier and faster and better. So what comes out the other end is better for everyone. If you're a business, it's like, great, I don't have to deal with all those headaches anymore. If you're an end customer like your kids, you can feel you can click on any like you want because you have a lot of confidence that it's not going to bring malware or damaging things into your home environment. And so I hope that's the future. I mean, I think we should all hope that's the future 10 years from now and where it's all more safe. All tides rise not. And that all of a sudden you don't have to be spending 10 billions of dollars, tens of millions of dollars, billions of dollars on these solutions because you're worried, like, it should just get. Everything should get safer and the product development should get safer at all these application companies where you have intrinsic security, the way the code reviews, everything needs to get safer. And all tides have to rise and we'll have a whole new set of challenges 10 years from now to deal with. That's what I hope the future is like that. It's just like, wow, we kind of go back and put in what the Internet said to be completed at a later date. It's kind of like, I think we're doing that now and it's going to come to fruition within the next 10 years.

I am all in favor of that, though I'm not certain I want all the tides to rise if I'm working at a sewage treatment plant. So let me ask you a question from the audience, because it's a great one. Michael Nelson. Years ago, Cloudflare entered into a partnership with Baidu. What's changed since then? What lessons can you share about working with Chinese companies and the Chinese government?

Yeah, it's so interesting. Thanks for the question, Michael. People are connecting around the world. And what's interesting is early on we were a tiny, tiny company and the second largest source of traffic from cloud. Coming to Cloudflare customer sites was from China. So we had a lot of Chinese visitors trying to access information or do business on our early customer site and that's continued. And then we have a lot of American companies who have big customer segments within China. So it's gone both ways. And so we really believed in having one global network around the world. And we had to find a way to work with a partner in China to help make one global network because again, a cloudflare helps make the Internet faster, safer and more reliable for any size business. That is our promise. And we, we felt really strongly that China had to be included in that. Like we didn't think it could be everyone except for China. And so we worked really hard early on. And so we are quite a young company when we, when we really started to be serious about our Chinese strategy. And we partnered with Baidu and we have since partnered with a second Chinese company called JD Cloud. And what that means is if you are a cloudflare customer, if you are a large company like Garmin, they can use cloudflare as network, sitting in front of all the Garmin devices which are around the world, including in China. And they can have one uniform control plane for a performance, cybersecurity and reliability stance. And what they've seen is a four times increase in ROI and improvement in China increased by 400% because they have one global network to manage it. And so that's what we, A lot of the vision that we saw five years ago of why we thought it was so important has played out where companies, some American, some European, turns out China is a huge market for them and they want one architecture that works to provide this performance, security and reliability. If you're the CIO of this company, it's like great, you say to your CEO, it's great you want to go into China, but I got to manage it and I don't want to have to manage a totally other network. And so to have this network layer that you can kind of see this control plane and have one set of cybersecurity, one set of protection, one set of global performance protection, one set of reliability makes a huge difference. Identity and access management makes a huge, huge difference in the complexities to the teams that have to hold these things all together behind the scenes. And so I guess what's changed is we've had another partner with JD Cloud and it's become more and more important. And we've seen a lot of businesses local in China who want to connect globally. These China businesses want to get access to the markets, rest of the world. And they are saying, man, I need to get access to the European consumers and North American consumers and I want one provider to be able to help me do that. And then we've seen so many multinationals out of America, Europe, rest of Asia say I need to be able to service China and I want one provider to be able to do it. And so, I mean, that makes sense. We're all very connected. And again, it's kind of back to the Internet's connected us all in many ways that I think we did not expect even 10 years ago.

What if the Chinese government says, hey, it's so great you have that cloudflare in front of Garmin. But, you know, we'd really like access to that data because we want to know, you know, where all of our dissidents happen to be jogging today. Right. So how do you handle that request?

I have a lot turns out running a large technology company, doing networking. I have a lot more gray hair than when I started because of questions like this. These are really serious questions. And I'll answer your question. But just zooming out, because that's a very Cloudflare specific question. But I think just zooming out, I strongly believe that if you're a technology company, the next five years is all about policy. The companies who really lean into understanding policy, partnering with policymakers and policymakers who become better technologists, those are the people who are going to invent the future because it's just, they're colliding. You see it everywhere around the world. You see all these policy changes. You see some people very happy, some people are very angry. And so there's like this huge multi shareholder approach where people are saying, this isn't working, this is working great and people are coming together and we're going to make progress. But I think the people who are really going to write the laws for the future, and this is why the Aspen Institute is so important, are the policymakers who become better technologists and technologists become better policymakers. So this is an example of a question that if you're running a tech company, you have to be able to have an answer to. And I can almost guarantee that no tech entrepreneur starts thinking they're going to have to answer that question right? Or if you're a CEO of a large company, you're like, I'm not qualified to make this answer. Let's talk, call our GC and the GC saying, well, I'm not qualified to, I don't know, China. Let's get some outside counsel. It's complicated. It just hasn't really had to come up. And so you got to be really thoughtful. There's some, you. There are some companies a bit ahead of you, but it's a small handful. And so in this question, we are a US Law abiding organization, so we follow the law. And that means with court orders, if there's been due diligence. And again, there's lots of amazing things about the Internet. There's some really ugly, gross, bad things that happen online. And with court orders and due process, we follow the law. We say, wow, okay, thank you. Court order. This does seem legitimate. We should remove it from our network. And that happens all the time and it does very well. But that's not your question. In this case, there is no court order. This is a government saying, I want this. And it's not even that. Sometimes it's the US Government, sometimes it's other governments. And you know, we have a story where we are a 40% company. We got served with a national security letter. When you're a 40 person company. This was years and years ago. We're a lot larger now. We're over 1700 people now. But it was a really scary event. And it was actually the US Government asking for a bunch of information. And so we worked with the EFF and ended up suing the US Government. We said, because the national security letter at the time had no due process, we said, there needs to be due process if you want us to comply with this. And so we ended up winning the case, which is why I can talk about it. And it became a big example. And so we've been pretty very principled on this point where we're a law abiding organization with due process, but we're not. We are not. We are not. Otherwise.

No.

And so in this case, the answer is no. And that's. We've taken a very hard stance about that and we've been very principled. We've written about a ton. We've drawn very strong lines in the sand and we think that's really important to not undermine the trust of our customers.

All right, well, right. As we reach perhaps the most complex issue in technology and policy, we are at time. I want to say thank you to Michelle and I hope that Garrett and Vivian, I hope you caught that little bit the next five years of technology robot policy, because that is going to be great for the trailer for the Aspen Cyber Summit in 2021. All right, we're leaving now. We'll be back in just a minute with more Aspen Cyber Summit. Thank you so much.