In this live CGTN World Insight panel recorded on May 19, 2017, host Tian Wei convenes a discussion with security analyst Robert Siciliano (Hotspot Shield), cyber‑policy expert Dr. Ernest McDuffie (Global McDuffie Group), and Professor Shen Yi (Fudan University) about the global WannaCry ransomware outbreak. The conversation begins with an overview of WannaCry’s rapid spread—affecting over 30,000 machines in 150 countries, crippling hospitals, railways, and other critical infrastructure—while noting that ransom payments totaled less than $70,000. The panel then moves to attribution, with Microsoft’s Brad Smith blaming the U.S. government for leaking NSA tools, and Russian President Vladimir Putin criticizing U.S. intelligence. The core of the debate centers on responsibility: Siciliano argues that end‑users must keep devices patched and use security tools; McDuffie stresses user education and training; Shen Yi frames WannaCry as a cyber‑weapon, insisting that states bear primary responsibility and that an international regime akin to nuclear non‑proliferation is needed. Technical mitigation advice is offered—automatic Windows updates, antivirus, firewalls, VPNs, and avoiding social‑engineering attacks. The discussion also touches on broader policy issues, such as the difficulty of controlling zero‑day exploits, the need for global governance of cyber weapons, and the potential of AI‑driven defenses. The panel concludes with concise recommendations: keep operating systems updated, employ security software, use encrypted VPNs, and pursue continuous security awareness training.
Chapters
Welcome back to still watching World Insight with Tian Wei coming to you live on CGTN. We live in the IT era when it's easy to save files on computers and get data through the internet. But on the other side of the coin is that once your computer is attacked, you risk losing important data and never getting it back. Over the past few days, The nightmare became a reality across the world. A ransomware called WannaCry hacked computers worldwide and forced users to pay ransoms for their files. While the infection rates have slowed down, discussions are going beyond the malware itself.
Pay ransom within a week or you'll never get your files back. The malware called WannaCrypt— did make many around the world wanna cry. As of Monday, it reached 150 countries and infected more than 30,000 machines. Computers running the UK hospital network, Germany's national railway, and scores of other companies and government agencies around the world were paralyzed. Despite appearing to be criminal activity intended to raise money, it appears that less than $70,000 has been paid— in ransoms, and we are not aware if payments have led to any data recovery. However, Microsoft's president Brad Smith pinned blame on the U.S. government for not disclosing more software vulnerabilities, saying the ransomware were drawn from hack tools stolen from the NSA. He hopes the governments of the world would treat this as a wake-up call and abide by the same rules that concern weapons in the physical world with cyberspace as well. Russia's President Vladimir Putin criticized the U.S. intelligence agencies for losing control over their own own creation. We are fully aware that the genies, in particular those created by secret services, may harm their own authors and creators should they be let out of the bottle, and this issue needs to be urgently addressed on a political level to elaborate ways to curtail it. The information about the vulnerability that is being exploited by the ransomware has actually been public for some time. Microsoft has released a patch a little while ago, but the attack's unusually large scale proves that patch isn't enough. There's extensive information online about how exactly the exploit performs and what exactly it impacts, but when you talk about how to, you know, prepare for a threat like this and how to patch against it with a large organization, it's a little bit more complicated than do we patch or do we not patch. So far, it's still unknown who is behind the cyber attack, but rather than finding the hackers, the more important issue for the world seems to be how to better prepare against this danger.
Well, what can we do against them? In Washington, D.C., we invited Dr. Ernest McDuffie, the founder of the Global McDuffie Group, and also in Boston, we have Robert Siciliano, a security analyst with Hotspot Shield. Also on the phone in Shanghai with us briefly, he will be joining us, Shen Yi, who is the associate professor and director of the Research Center for the Global Cyberspace Governance with Fudan University. Gentlemen, I want to welcome you to our program. First of all, very important question: who should be responsible for this? Mr. Siciliano?
So ultimately, the responsibility lies on the user. That's just the way it goes. The security of your device requires you as an individual or as a small to medium business or large enterprise to make sure that your devices are properly secured and patched.
Really? Is the responsible— responsibility lies with the user, or is the burden lies with the user? That's a very different question, isn't it? Dr. McDuffie.
So, yeah, I don't know if responsibility is the right word, but certainly the, uh, the evildoers, the person who launched the attack, is ultimately responsible. But I absolutely agree, the user is the one who could have had his machine already patched with available information that was out there and not been affected at all. I, I think it really goes to the importance of, uh, the broader need for education and training for the masses. Uh, everyone who intersects or interacts with the internet needs to be aware of the threats that are out there and understand what they can do to mitigate them.
But even they're aware of the threats out there, Mr. Siciliano. What else can they do? They have to use computers. They have to use certain software because the software already dominating the market.
Yeah, Microsoft's operating system, of course, is the single most ubiquitous. It has 80-plus percentage share of the marketplace, opposed to Mac's And going forward, you know, consumers need to recognize that security awareness needs to be part of their lexicon, that keeping your devices properly updated, your antivirus, anti-spyware, anti-phishing, and firewall, making sure that your operating system has the latest, greatest security patches should be fundamental to computing. It's not an option to, you know, pull the covers over your head and, you know, ignorance being bliss. Does not work today. If you're going to use your PCs for banking online, for e-commerce, for conducting, you know, any type of small, medium, or large business, users, the end user, the enterprise, they need to make sure that those devices are properly secured because in today's day and age, technology, PCs, the internet is a central part of our critical infrastructure.
Well, it's easier said than done. You call on them to be able to safeguard the software that they produce, but they apparently just have some problem at this moment. So what can we do? Are we at a critical time, Dr. McDuffie, that we could do nothing about the danger that we are facing right now because it has become so professional, so sophisticated about one field that the other ones who are not necessarily in that field or not necessarily the expertise about that would not be able to do anything.
No, I, I don't see this as a particularly, uh, any kind of inflection point. I mean, these issues, the technology, the, uh, the malware, the ransomware has been around for, uh, quite a while now. This idea of awareness of the, of the, of the public and what they can actually do about it is is the critical piece. I completely agree with my colleague on the— on the— let's just talk about—
okay, we have to recognize both of you are from the industries. One is representing the association of many of the software makers, and the other, of course, has been, you know, doing security software yourself. So obviously you're representing the industry, but the question is, what can they do in order to protect themselves? Let's talk about this WannaCry, for example. Microsoft have been updating its software for years. How much do you expect one consumer to be able to follow all the latest of Microsoft in their computer? And is it fair for consumers to do that? And would the makers of software purposefully put certain kinds of problems over there Therefore, they have to have the consumers to update their products next time. These are all very eligible questions, I guess.
So the issue with the software makers and—
Mr. McDuffie first and then go to Mr. Siciliano. Mr. McDuffie first.
Yeah, the question about consumers keeping up with all the updates. Microsoft has made it very, very easy to do that. The updates are pushed out automatically and you can set your computer to automatically accept them. If those settings are done correctly on your system, the user doesn't even have to be concerned. It happens automatically. The idea that there are errors in the software is a part of human nature. Software is created by human beings and there's always going to be errors in the software. So this idea of patches always coming up is something that we're going to be living with until we find a way to create software that's perfect all the time.
Well, Dr. McDuffie, even though I'm not necessarily a computer scientist myself, but I do understand even though you update some of the versions, it does not necessarily mean you're going to be safe after all. And meanwhile, once certain product into the market for some years Those updates already disappeared. That I know. So, Mr. Siciliano, are you two just trying to brush away all the responsibilities with the software makers and trying to say, "Okay, consumers, it's your job. Once we sold to you, it's done"?
So, I understand and appreciate, uh, your pro-consumer champion perspective. At least that's what it sounds like.
Okay.
Now, nobody wants to come from the perspective of blaming the victim, and that's certainly not what my colleague and I are doing here today. The reality of it is, is that Microsoft produced a flawed operating system that had a vulnerability that the NSA, a US government agency, essentially discovered and exploited. And that exploit was leaked to the public, or at least via, uh, some internal flaws that the NSA has on their own.
Alright.
So they have their own security issues that they need to deal with where they released that vulnerability to the wild. All that being said, there is no such thing as 100% security in anything that we do as a species. There's no such thing as 100% security. So yes, the security companies, the software developers, Microsoft and others They have a responsibility to make sure that what they deploy is in fact secure. But this is an ongoing evolutionary process. The software itself, the hardware, continues to evolve. The hard drives become bigger and faster. The operating system itself is much more complicated than it was back in Windows 3.1—
Yeah.
—or Windows 98 or 95 and so on. And so it is— there is always going to be errors and vulnerabilities. I know.
I know, Mr. Siciliano, I know you would say that. I know you would say that because you're going to say, well, you know, anything cannot be 100% safe. So why do we focus on this so much? Why don't we look at the other cases where in which we're safe? But the thing is, it is influencing computers worldwide, 150 countries. Everybody's being asked to pay pay to those hackers. So at this point, we still do not know what to do, and this is going to spread even further. Even though the speed goes down, it is still going further. We don't know when it's going to stop, do we, Dr. McDuffie?
Well, I, I would say that the, the fact that, um, so little money has actually been received back to the bad guys, I eventually the bad guys are going to realize that this is not really a money-making venture. And eventually I think there is a good probability that they will be identified and apprehended, apprehended. And so that is going to happen as well. This idea that there is nothing we can do is not completely true. Besides the activities that the end user can take, law enforcement, local law enforcement around the globe has the ability to help mitigate these illegal criminal hacking activities. Now, this is not state-to-state spy stuff. This is criminal activities that all countries recognize as something that's not good for their own administration, for their own people. So a lot of law enforcement are collaborating to attack this problem. Well, it is.
They are collaborating, but we are seeing, Dr. McDuffie and Mr. Siciliano, a very interesting phenomenon that when there were no problems, whether it is the science, the computer science, or it is the, you know, security issue, or the public, they're saying to one another, don't mess with my field. We don't want you to know too much. But when there are problems, We begin to say, "It is your problem. You have to fix it. This is what you need to do." So we are seeing the balls being kicked into each other's court, but eventually the thing has to be resolved. This problem has to have a solution. Where does the solution right now come from, Mr. Siciliano? We wait for the good heart of those hackers? Is that what you're saying?
So the current solution, of course, is to make sure that your devices have automatic updates. All right, this is a feature that Microsoft offers, and as long as your devices are set to automatically update, in general, you should be in pretty good shape. Beyond that, making sure that you have basic security installed, which includes antivirus, and of course having your firewall, a two-way firewall, turned on. So these tools are available to the consumer, to the business, and as long as they run automatically in the background, that generally should protect. However, the other aspect of this is to make sure that the consumer themselves, or the end user, are not socially engineered, which essentially is being tricked into clicking links that they're not supposed to, to downloading files they're not supposed to, to be engaging in behavior on the web that puts them and their devices and data at risk. Well, Dr.
McDuffie, what do you think? This is no different than—
this is no different.
Dr. McDuffie, finish your thought. Okay, so he's absolutely right.
Well, this is—
there's due diligence that the end user can, can apply, uh, and there's also the issue of, uh, zero-day threats. You know, they're, they're There's always going to be new threats out there that will be able to defeat some of these methods that are being taken. The best thing that you can do is not only follow all those best practices, but educate yourself as much as you can and those around you. It's a network and the weakest link is always the person, you know, that there's always going to be a human element that hasn't, you know, doesn't have a strong password, is clicking on all the crazy sites, and once that person is infected, it can spread to other systems. So there's a, there's a program in the United States called NICE, the National Initiative for Cybersecurity Education, that focuses on education and training for everyone so that they're aware of what's going on.
There are educational programs like that, but obviously it hasn't solved the problem as we have seen with this specific case. And on the phone right now, Mr. Shen Yi at the Center for Communication and State Governance Research in Fudan University. I guess you are coming from, I hope, a different perspective.
So I have to say first, all your discussion on this issue is completely wrong. It's not a virus, it's a cyber weapons. We're talking about it's not a virus attack. It's the proliferation of cyber weapons. So it's obvious it's the state and the government has special responsibility for it. In United States, there is a debated discussion how to control the so-called lawful access from the government side, in which including that government will explore the vulnerability and the zero-day backdoors inside these softwares. The real purpose of the announcement from the Microsoft companies, it targets U.S. government. Such kind of policies will do damage to its economic interest. But the real challenge is we lack a regime that help us to control the proliferation of such kind of cyber weapons. Globally, just like we control the proliferation of nuclear device and related technologies.
So do you have solutions? Dr. Chen, it's easy to identify the problem. The question is, where is the solution? Particularly with the current crisis, we have to put an end to it.
Current crisis already has been controlled. The companies already found a very easy technical ways to solve it. The problem is we need to now, they Immediately, the governments from both sides and all related countries should initiate negotiation how to control and avoid such kind of proliferation again. The job we need— the media, the company, the individuals— need to require the governments to start up such kind of negotiation and dialogue as possible. All right. All right. While at the same time, you need to upgrade and continue patching your software.
Every time we have a crisis, we have a long list of what we need to do, but every time when the crisis is over, everybody forget it. Take a look at the history of ransomware. The first known malicious software is AIDS malware that appeared in 1989. Ransomware evolved into 30 active kinds with different kind of things. In 2013, the first to demand Bitcoin to afford payment Last year, we also see the first ransomware to target Apple's OS X, and the Locky was delivered through Microsoft Word documents. All of these have been some of the histories of ransomware. Now, solutions. We have only 1 minute left. We talked for about 20 minutes. Do we have solutions for this specifically? 30 seconds for every one of you. Mr. Siciliano, solutions.
Of course, update your operating system, install antivirus, run a virtual private network. I use Hotspot Shield that encrypts your information on your devices on free open Wi-Fi. Engage in security awareness training.
All right, Dr. McDuffie.
Yeah, as far as solutions are concerned, there's some, there's some small level of optimism that advances in artificial intelligence, which has been talked about a number of times on this program, uh, may provide an even greater level of protection against these, uh, type of weapons. I agree with, uh, the other speaker that these are really not just viruses. They are cybersecurity weapons. The difference being between nuclear is that it's not a limited number of people that can create these weapons. A person with a high school education and enough imagination can create the same kind of tools that state actors are creating. So policy at the national level is far below what's happening technically. You have to do exactly what's been said. You have to address all the education and training issues and best practices. Dr.
Ernest McDuffie, Robert Siciliano, and Mr. Chen Yi, thank you so much for joining As I said, that's all the time we have for today. If you'd like to see more, try to find us, World Insight CGTN, into your search engine, or check out our YouTube channel. Follow us on Twitter, Facebook, and see the Weibo. From me, Tian Wei, and everyone on the World Insight with Tian Wei team, thanks for watching, and tune in again next time for insights from across China and around the world. Good night.
More from Robert
America's #1 Top Cyber Security Speaker Architect of The Strategic Human Firewall™
Robert Siciliano Cyber Security Speaker, Cybersecurity Awareness & Security Appreciation expert.
Nancy Guthrie Deleted doesn’t mean destroyed- FBI recovers 'inaccessible' surveillance video servers
