Hey, Adam curry, John C. Dvorak.
It's Sunday, July 28 2013. Time for you get more nation media
assassination episode 534.
This is no agenda.
And we are coming to you live almost kind of not really on
tape because it is the week that we're off, but we're bringing
you fresh content from somewhere in Europe. I'm Adam curry,
and from Northern Silicon Valley where I am on digital tape. I'm
John C. Dvorak scale.
That's right, everybody. It is Sunday. And I'm your half host,
Adam,
and I'm your half host, John.
And today is a second of our two shows that we're doing this
summer. So we can take a little bit of time off, though it turns
out, it's actually it's more work. It's more work than it's
worth. We should work to do it this way. Yeah. So we have two
interviews coming up for you. The one that we'll start off
with is an interview I did during the just before the
release of Daniel Suarez, his book Kill Decision. It's all
about drones. And we also touch briefly on his previous work,
which is demon and freedom TM, and I hope you enjoy it. And
after that we have John's interview with some intelligence
guy. What was it again, John?
John Dixon was a security expert, and also former Air
Force Intelligence. And so he has some thoughts about the NSA
and some of the stuff that goes down. interesting interview, to
say the least. Good good chat with him. All right,
we kick it off first with my interview. Originally done just
before the release of the Book. Kill Decision and with it's
Daniel Suarez. I think probably the most feared man in the
military industrial complex, we'll be talking to him. Here's
his book. His latest is killed decision. Daniel Suarez joins us
from California. Damn right. I can play down. Yeah, absolutely.
Thanks for having me. Well, no. And thank you very much for not
only sending me this book, but for writing it. I gotta tell
you, I'm an aviator. I've been flying airplanes and
helicopters. I've taken a great interest, of course, and
unmanned aerial vehicles. And once again, very much like your
previous books that I've read demon and freedom TM, you've
nailed it. You nailed all the technical aspects. But also, to
me, almost not science fiction. It's like, this sounds like it's
pretty much when did you write the book? When was it completed?
I was completed, oh, I don't know, six, seven months ago,
something like that. So fairly recently. And it probably took
me about, I don't know, 1312 months to write. Most of that,
of course, is research. But really, I do this just over the
horizon type thing. So you know, when you say really not science
fiction, definitely. So I've combined things that if they
don't already exist, they will very soon.
So let's so let's talk about the story. First of all, a female
protagonist, which was a departure at least from from
demon freedom. It really breaks down the possibility, though, in
perhaps the likelihood of unmanned aerial vehicles, ie
drones making decisions on their own, and the implications of
that and what could happen. Now, it's always difficult with a
book like this, which has some cool twists and turns and some
some things that pop up that I thought were very unexpected,
and then some wildly outrageous things when it comes to big
tankers and all kinds of nutty stuff going on oil tankers or
troop carriers. I can't even tell you. I don't I'm afraid of
spoiling parts, you wouldn't want to be known. So maybe you
can synopsize this. For us.
Yeah, I've already figured out my kind of, you know, snooping
through the minefield story to not reveal anything, any
spoilers, but it is essentially about a situation where the
United States has itself come under attack, targeted attack by
autonomous drones, origin unknown. And it really examines
a situation where drones have proliferated to the extent they
are all over the world. And it becomes very difficult to
determine who is attacking you. And so a very superior military
power, suddenly, you get into this power imbalance where
there's this nonstop sort of low intensity warfare going on. And
I do think this is headed towards us. Because again, if
you can't figure out who's attacking you, it doesn't matter
how powerful you are. And that's really the situation the story
examines, and it's one that I think is coming very soon,
because, you know, you look at because of the global economy,
high tech manufacturing occurs all over the world now. And
those designs because of cyber espionage and cyber war, a lot
of CAD designs and other top secret designs are also
disappearing off Western networks to the far corners of
the world. So the combination of those things that very cheap,
sort of Ubik Wood is processing power and manufacturing of high
tech all around the world combined with designs that
support that type of thing is going to really create a very,
very fractured high tech military ecosystem. And that's
that's what the story examines is that high concept of the
United States is under attack by drones. And we don't know who's
sending them.
And what's what I really like, as kind of a sub story is the
entire and I'm I watch C span all the time. And I think you
can't write that shit. It's so funny sometimes. But you know,
we've had a lot of department, Homeland Security, Department of
Defense, a lot of budget conversations in the past six
months. And in the book itself, the you know, a lot of this is
about the funding, and you know, what is going to instigate
funding for more drones, and indeed, these autonomous drones?
Now, I know a little bit about your background know, you're
basically at heart as a software engineer developer. Some would
call that consultant for you've done a lot for Fortune 1000
companies, but also for defense, I believe. So when you put
something like that in there, is that based on your own
experience? Is it just what you think it might be? Or how it'll
work? Or are you just dreaming it up?
Yeah, a little, little of all of those things. You know, just to
be clear, you know, I worked in it in designing Big Data Systems
for companies. So companies that had, let's say, wanted to do pre
production planning of vast networks of factories and things
like that. So really complex stuff did some defense work as
well. Especially y2k remediation, things like that.
The big scam? Yeah, well, you know, it's funny, you take a
look at a lot of the stuff I had, I had friends and relatives
who were like hoarding cigarettes, because they were
convinced that was going to be the new currency, I'm going to
be a problem. I'm going to be at a party. I don't know why you
guys should do it. But anyway, I digress. But basically, I
definitely don't take anything top secrets, there was one of
the things that people ask me is like, how do you do research for
this. And, again, because this technology, you look at what is
being able to be done with everything from DIY Drones, to
just consumer tech that you can buy, what I typically do with my
stories is I'll combine those things. And then I'll sort of
divine what I think is just around the corner, based on what
I would do, given these possibilities with a better
budget, and also rumors of prototypes that are out there.
So that's basically how I how I assemble, you know, what the
tech is going to be the disruptive tech in one of my
tech thrillers. And as far as the government and private
industry and the intersection of international corporate
malfeasance and otherwise, those things, I think there's a great
record for that already. So as a tech writer, you stir those all
into a pot, you can pretty much come up with a really, first of
all, thrilling lots of action and other things like that. So
that's generally how I construct these stories.
He says something very important. This is indeed a
thriller. I mean, these books that you write are thrillers.
And it's kind of funny how, when, when I first read demon,
and its successor, Freedom TM, you know, the Google Glasses had
not been announced yet. They're probably already in development.
But that was also only a couple of years separation. And now
here it is. And, you know, I, when I was reading, Kill
Decision, the the technical aspects were so good. I mean,
even in the first may be page 30, there's mention of Gorgon
stare, which I don't think anyone knows about. I mean,
that's why
I put it there, it's important to me that people know that
these things are, are really accelerating, and that they are
occurring, really, it's not even like their secret, it's just
that they don't get really very much media attention. It's one
of the driving reasons I write these is, these are fast moving,
sort of nuanced, complex things that are happening that are
changing society with this technology evolving, and I want
people to understand it. So I tried to write these thrillers,
and I write them as thrillers, so that you're really
entertained and intrigued as you go along. But you're also
learning basically what all this tech is and how it might change
society. That's really one of my goals. So top priorities make it
entertaining and exciting. But then, of course, what interests
me is, is the payload that comes along with it.
So do you worry about this stuff? Do you? Do you worry
about the possible future of autonomous drones to such an
extent that you say, Okay, I have to write this book. It's
important that people understand this unpackaging it in a
thriller in, you know, soft science fiction, but I really
need to get the This is why my introduction is setting you up
perhaps the most feared men in the military industrial complex,
you know, it could also be that you're that you're a promoter of
but you could easily be a shill for them. I don't know. I doubt
it. But, but but there's you're really sending Your message and
to me it arrived loud and clear.
Well, I'm glad of that. And I will say this most feared men in
the industrial, military industrial complex I, I tend to
think not I, I my encounter with military people has been that
there's a split. It's a lot of people in the military who have
similar concerns to society at large. And they sort of get it.
I you know, if I have a theme, it's this, that I'm against
unaccountable concentrations of power, and I don't care whether
it's corporate, military, religious, the Girl Scouts, I
don't care who it is. And this is one of those brewing
unaccountable concentrations of power that I see the idea of
autonomous weapons. I mean, it used to be that if you wanted to
have a war, you had to get buy in from other human beings to do
it. You could still have Secret Wars, but it took a hell of a
lot of work. And in the case of you know, Iran Contra and stuff,
things get out because people either get caught or they talk
or, but if you get into a situation where you don't need
people to conduct war, and this is this is this could have a
corrosive effect on the foundation of democracy is
really how I look at it. The idea of being able to automate
war and again, insect intelligence, drones really are
a done deal. They're working on rat intelligence, drones. Now.
The idea of swarming all of these things. They're so
limited. Speaking of intelligence, here comes my cat.
A swarm of cats. Oh, no, it's
very a swarm of cats. My God. Run for your life. Hey, Lucy,
what's up? So anyway? Hey, what are you doing? I'm talking. So
if she's on camera, I know better than to try to stop
it wouldn't it wouldn't be the first time a cat has appeared on
the show. Trust me this let's face
it. 40% of the video online is Kenya's cats exactly the
internet was built, the cat
is sitting there thinking, Hey, that's my gig. What do you do
and get out of the way human? But in the book, you just
mentioned that there is I trying to think was that it? Was it a
call back to Roman times. But there is a whole passage about
how once you can remove the humans from the equation, then
you've really got a great war machine. What What was that
piece? Again, I can't I can't remember off the top of my head.
It was basically the idea of harkening back to the Middle
Ages that
were the knights and the sword. Yeah. Would you mind telling us
that? Because that was a beautiful
piece? Absolutely. And it's interesting, you bring that up,
because that was really a pivotal aspect of the book for
me, so good for you? Well,
I have to admit, I read it, you know, one of those horrible
things, I do hear
that I would do the same. It helps to illuminate your reading
of it. But basically, it is that if we take a look at the
structure, the distribution of political power in a society
where I'm gonna sound really wonky,
no, no, no, I love this. You're right, you're right on my on my
vibe, man. Totally.
It is this that if we go back to the Middle Ages, and look at the
social structure, and how power was very much concentrated at
the top, there was no middle class, and you had all this vast
underclass of people who were just subsisting. And then you
take a look at how conflict was resolved. In that society, what
you see is that the mounted armored knight was almost
invulnerable to pretty much any number of peasants, who had a
different a much, you know, almost no meat in their diet and
a different muscular musculature. But they also
knights had armor, and this armor was so expensive that it
would cost the equivalent of what a house does. Now, you had
war horses, you had constant training. So it cost a great
deal of money to keep a mountain night available to fight for
you. And so you had this structure where very few knights
could exist, but where they were, they basically had
absolute power. And that went straight up through the, you
know, the medieval social hierarchy, the way you barons
and dukes and then kings. And so it's a very, very narrow period
of the pyramid at the top. And this changes when gunpowder
comes into effect, when you no longer have to have somebody
trained for 678 years and have a privileged background, and
upbringing as a page and all that stuff. In order to resolve
conflicts. You just need to give a guy a gun, maybe a few hours a
day or two of training. And suddenly, anybody who has this
too, could kill a mounted knight in armor. And that shifts
everything suddenly, over time successive decades. It's how
many people you bring to the battlefield determines who wins,
not who you bring. And so suddenly, leaders need buy in
from people at large. They need people to cooperate like I need
all you guys out here with a gun aiming at those guys with a gun.
And if I don't do
it, they'll do it. We need you to be all that you can be. Yeah,
well, yeah.
In an early form. I think it was on a tapestry in those days.
Yeah, you can be but no, it was basically this that if you look
at the size of battles from the battle of creasey and Odyssey in
court on to the Battle of the Somme and World War One, you can
see battles Waterloo, they had they progressively got larger
and larger and larger and more people and logistics started to
become a big issue and nationalism rises at around this
time. And it's interesting that the concept of real nations as
opposed to individual kingdoms and regions starts to come into
play. And then Parliament's and representative democracy,
basically, because leaders could not ignore their people anymore,
they ignored the mass of people, they would get killed. So they
had to cede some power. And so in some ways, it is technology
and its weapon technology that made that possible. So what
we're doing now what we're seeing is a shift and towards
centralization of power, because to some extent, I don't want to
say a special forces warrior, because you know, it's not just
them. But the idea of a an elite warrior, who has access to a
data network to air support all of these things, and autonomous
drones can pretty much defeat any number of people opposing
them in a regular manner. So again, we've gone back to almost
almost this mounted night where if you have access to all of
those resources, numbers don't matter. And in many ways, it's
re centralizing authority and power. And if we think that the
way human beings resolve conflicts, shape society, and I
do that, that's what makes that kind of a big concern to me. And
it's something that I don't think a lot of people are
thinking or talking about. It's in particular, why I wrote this
book on autonomous drones, a lot of people think, well, it's
about drones, like the Reaper and the Predator. No, it isn't.
Those are obsolete platforms right now. They're not even
making the predator anymore. And the idea of remotely controlling
a drone, to me, that's really a limited use thing. I know, that
sounds funny, but we're using them against largely tribal
cultures, if you try to use a remotely piloted drone against a
more sophisticated adversary, they'll jam your radio signal,
they'll cut it off, we saw what happened with the archy 170
Sentinel over Iran. And they essentially disconnected us from
our drone and hijacked it. And that's the problem with having a
drone that is remotely controlled. And that's why
there's a lot of pressure to push that decision making onto
the drone itself. And so this is really what I'm dramatizing in
this book, these that very accelerated push to make the
machines make more decisions.
So you knew, of course, I'm not the only smart guy who has
figured this out, particularly looking at the history. And so
it does seem that this is indeed this has got to be a big push
them not just perhaps for drones, although drones make a
lot of sense. It's quite easy to operate. But for all types of
autonomous warfare robots,
yeah. And cyber war as well. So bots, that will go off and do
software bots, that will go on
the Cyberware. Cyber War thing. I'm continuously amazed when I
hear the generals talk about this. And was it the guy who was
Major General in Afghanistan 2010, he had all a whole bunch
of cyber warfare going on. But when you hear how uninformed
they speak about the technology, they really these guys, they
must have the guys at the bottom knowing what they're doing. But
the generals know, they really don't understand what the hell
they're talking about. They really don't,
quite a few of them don't. But there are those that do. Take my
word for it, there are some that get it and whether they they
admit that in media or not. There are some that do.
intelligence agencies especially do, it's matter of fact, I did
an interview with Michael Hayden for an article that I eventually
wound up not finishing, but it was a number where it was it was
at a conference. But in that article, or in that interview,
he was essentially saying that when nations around the world
were solicited by a magazine or a newspaper on who they were
most afraid of on the internet, the United States was listed as
number one, because we have a really robust cyber war and
cyber espionage campaign, as has recently come to light, and as
we've recently admitted, so you know, a lot of people in the
United States, especially think of China, and of course, we're
the geopolitical contest has definitely begun there. But the
United States is very active in this area. So what's your
what's your feeling about All right, John, you're pacifist,
or? I mean, where do you stand?
I would definitely say I'm not a pacifist. I'm a realist. I
understand that when it comes to nations, geopolitics, and the
great game that happens, and that power is always sought by
those who have a will to power. And the best way to avoid real
trouble is to try to distribute power among a reasonable number
of people. And I think our founding fathers have this
principle, the idea of checks and balances. And it's really
that's what I look at. I don't think in the main, we're ever
going to make things perfect, or even close to it. But that's the
best you can do. I think if you have branches of government and
individuals who share power, that's best. It's when we start
to see this lockstep collusion or secrecy that allows conflicts
to occur in secrecy without anybody having a have any
knowledge of it or even the right to know? That's when I
think things get dangerous? So am I a pacifist? No, if if we
were attacked, I want us to strike back. But I'm not
convinced that's what we're doing. Now. I am also somewhat
concerned that what we're doing now is self defeating. I mean, I
touch upon this a bit in the book and through the biologists
character, the idea that cooperating organisms succeed
better than those that are constantly in Darwinian
conflict. This has a lot to do with Alfred Russell's concepts
about evolution, and natural selection that many, many
organisms don't just kill each other. They cooperate in a
symbiotic way with each other, and they thrive for that, right.
Except for humans.
Well, you know, we do cooperate. We do we kill each other, too.
We do. But again, it's not all or nothing. It's not a binary
equation. Right? Yeah, I've laid I'll tell you, we've gotten
really good at that. And, and I do think there is a more
mainstream movement to try to get more sustainable, to make
things more local and comprehensible. And so I'm an
optimist. I'm definitely not a pacifist, I'm not a hawk, I'm
kind of right about in the middle. Like, I understand that
people are this way that we're kind of like shaved apes in a
way for trying to shake off this, you know, we're only
recently have the capability technologically to really do
serious harm to the entire planet. And we're trying to get
our heads wrapped around that. And so I think if more people
have their hand on the tiller, we're less likely to go
definitively in a bad direction. We'll kind of ambulator around
for a while. But hopefully, we'll work it out.
So the real futures view in the book, which you can, at this
point, probably call science fiction. But yeah, for how long?
Yes, right, is the fact that when you have autonomy, coming
into the picture, particularly with the drones is no longer
which country is the biggest badass, but which company is the
biggest badass because you're individual, or individual, all
you need is money. And once you have the money, then you can
basically you could create a war when it and no one would know
who the hell you are. And you could have anything go the way
you want it to go. And that I think, to me, that was the
message like, oh, wow, we've been just looking at, and we
have a president who apparently, you know, loves to use drones
loves to view the tapes. You know, now we have countries all
over the world. And on local level, we have in the United
States, of course, police forces, and you know, all of
this will be opened up in 2015. But that's nothing. That's
nothing compared to you know, someone who has a big pile of
cash with an agenda, they can just get in the game whenever
they want.
And especially if they either have no history of respect for
human rights, or they just definitively do not care.
Because at that point is completely optional. If people
were upset about what you're doing, and you don't care,
again, it it really, in some ways empowers authoritarianism.
And that's, that's what concern me. So again, I'm optimistic in
the sense that I sort of look at what I do, in terms of writing
thrillers as looking out for iceberg, because I like
technology. I mean, it's perfect. I love it, I made my
whole career on it. It's just that, you know, you want to keep
an eye ahead and say, oh, let's turn a little to the right,
let's turn a little to the left. That doesn't mean abandon all,
you know, technology means just try to think ahead. We've done
this in the past, we invented technologies that caused us
problems. And we have tried to deal with them nuclear,
biological, chemical weapons. They were going to be world
killers. Pardon me. They were going to wipe out the human
race, but we created international treaties. And as
imperfect as they are, we're still here. I mean, these are
weapons that by all rights, really should have wiped us out
if we were, you know, crazy, right? So I think in the main,
we're sort of like a bell curve. Most people just don't want to
get through their day raise their kids, right. And that's
what's going to save us is the fact that most of us have our
hands go down at least semi straight, right. And as long as
we can start to build things and get through our day, we'll be
fine. It's when you allow just a few people to completely upset
everything. And that's why you want to try to avoid these
concentrations of power and lethal autonomy, as it's called
the idea of robots making killing decisions. That is
definitely one of the centralizing things that I don't
think a democracy should ever allow. I don't think we should
ever allow machines to make a decision to kill people. Now.
Now, let me parse that I don't mean, we would never send a
machine specifically like a targeted munition to do
something that's different than sending machine into this area
to terrorize it. In order to try to maintain order and decide who
lives and who dies. That's a very different thing. And you
will see that I think in authoritarian nations, sooner
than later or in conflict zones or narco trafficking zones,
basically where people are grasping for power and have some
money, you're going to see them first.
Well, I think, personally, I believe that there's going to be
an even bigger call for really ace pilots because we're going
to have to be be up there defending because, you know, at
a certain point, I think a human is still for a long time going
to be better than some machine that has performance limitations
perhaps,
or mental limitation in getting into brass tacks though, because
this is great, because now I'm talking to a pilot, somebody
who, and so not to be just devil's advocate, but the thing
that concerns me there is what do you as a pilot do against a
swarm? Where the individual members of that swarm don't give
a damn whether they survive or not?
Right? Well, so of course, we already had this kind of, if you
look at the Japanese zeros we had, and suicide bombers, you
know, in general, that, of course, is a problem. But I
mean, in my head, I'm seeing, you know, Independence Day, I'm
seeing Star Wars I'm seeing there's just all this crap
coming at you. And you just got to spray and pray as many
evasive maneuvers as possible. But just from a cost
perspective, there's going to be maneuverability issues. That
just won't.
Yeah, they're not going to be able to pull 20 G's.
No, well, no, I don't think so. No, I not the pilots are great
at that. But it's so let's just hope it doesn't get to that. Put
me in the machine. I'm available.
Word shot. I will say this, though, the thing that I think
we need to be doing is developing a legal framework
extend the kind of moral framework and a moral ethical
framework. Absolutely. Right. And I always say that it's
because what would inspire leaders, international leaders
to do this is they are liable to be the prime targets of these.
By the way, we've got a drone with your name on it right
there. DEVOTEE, I want to get back to the book for a second,
because besides the topic, etc. Your characters are beautifully
developed. I think that's the first time you've had a female
protagonist. Great job.
I had a Phillips in demon. She was one of many protagonist.
Right. You know, I took some lumps from people who thought I
was misogynist, which confused me because I'm really not. Yeah,
no, I thought well, okay.
She had the relationship where there were their dad, if I can
remember correctly,
like a talented until I mean, she was the most brilliant
person there was, of course, yeah. But I did like the idea of
having someone who had more of a, you know, well, let's put it
this way less of the he-man attitude. And I really wanted
that to soften the edge of the story
yet throughout the whole thing. She's sexy. I mean, I'm just
feeling for being really, really sexy, good. And you even put a
sexing in for me, which is my favorite part of any book like,
Yeah, finally, we
get some really wow, write these things.
But you're writing really is outstanding. And I've always
been a big fan of writers and other professions, lawyers.
We've had several on the show, we're trying to be excellent
writers of fiction. When so you, you, of course, know how to
write code, which a lot of people think is just some kind
of thing. You go to school, you learn it, and it's like, Oh, and
here's how it works. No, you can write code just as poorly as a
crappy book. You can write yourself into corners, you can
do all that. And you can approach the problem from many,
many directions. None of them necessarily right or wrong. So
when you were when you started writing, did, did you approach
it from a software perspective? Were there any analogies in
that? Or? I mean, I just love to know your process.
So So then we're going back to demon, which is a book I wrote
between 2002 and 2004. I actually wrote that book as a
result of some software I've written. Hmm. So yes, the answer
is very
much elaborate on the software. Yeah, sure. I'm
getting peek out now. I'll establish my geek cred. I wrote
a software. So you know, at the time, you know, was after the
y2k remediation thing in the.com, boom, we had started
easing up. Now, I never really got involved in that I was
always a data guy. So. But nonetheless, my business slowed
down a little at the time. And I started thinking, you know, I
want to take a little time and do something that would be
interesting to me. I wanted to create some software, some
custom software, and I was a gamer for a while, you know,
everything from video games, d&d, and stuff like that. And I
always wanted to automate this weather system that I'd created
for my game. So this is an a role playing game weather
system. But of course, I wouldn't just do a simple
weather system, I have to do one that has an orbital mechanics
model module in it, not all this stuff. So you could say, Hey,
you tell me what the size of your world is what its orbital
eccentricity is its access tilt. And I'll tell you when the sun
or sun's rising set wherever you are, every day of the year
where, you know, I just went to town it was like the most. If
you go out on the web, you could see people talking about I think
it's been bit torn to two. It's called WeatherMaster. Right? So
I write this program, and I I get further or elaborate with I
put a patent polymorphic encryption wrapper around it so
that you can try it for 30 days. And at that point, it re
encrypts itself. So you can buy it online. This is like, you
know, again, around the year 2000, something like that. And
what happened was I got pulled into a project. And a couple
months later, I come back. And it turns out this thing is
selling in like 38 countries around the world, people are
trying it and buying it. And there's like this money there in
this account that I had set up. And I had it set up to pay for
the website for some advertising. So it was sort of
like this automated thing. And I started thinking, wow, I got hit
by a bus, this thing would just keep going. And then I started
thinking, Well, what else can you do if you're dead? In modern
society? It turns out, you can do like 70% of the stuff you
normally do, for us
is exactly the the core nucleus of the book. That's fantastic.
You can see. So it came from software in a very literal way.
I was like, wow. And that was really the core of the book, as
you said that you have a designer of a massively parallel
online game, who creates a program, like keeps an eye out
for the appearance of his own obituary online, at which point
all sorts of things start taking to start to execute and start to
tear the fabric of society apart. So yeah, that's where
that came from. And in terms of the plotting and design of a
thriller, I guess, I do follow a software model only because I
try Well, I guess, if you write code long enough, in a, in a
corporate environment, at least a one where you have really good
quality teams, there's some pressure to make lean,
maintainable code. And to some extent, I like to think that
carries over into my writing. I try not to have lots of
extraneous details, I try to have what I need there, and to
propel the story forward. And what I'm told is that my stories
do propel people forward. So I feel I might have succeeded at
that. We'll see. But I do follow some of the skills that I picked
up in, in writing clean code, I think, help help in that regard.
And certainly, in terms of structure structure is very
important to me in a story in terms of pacing, different
threads. So yeah, I guess my stories are multi threaded,
multi threaded. So yeah, I would say yes. what's your
what's your IDE for writing your books?
That's right. Yeah, what I emacs is this plugin? No, it's
I that would have been, you would have blown me away if that
were true.
No, I don't.
I'll tell you though, if you wrote one, if you wrote a plugin
for Emacs, it would sell like crazy.
It would be so ridiculous, because it's like it's this like
front end to Notepad, essentially. But it highlights
your colors of your character. Of course, of course, you go
like everybody, I don't even get me started. I got you thinking,
didn't I wasted six months of my time? Thank
you just a word guy, or how did you do
actually have an English Literature degree? I don't have
a computer science degree. So I got involved in computers in the
early 90s 9091, something like that back in the day, when you
could do things in a corporation, because people
didn't take data and the Internet especially seriously at
all. And so if you started connecting sites and moving data
around in the unofficial way, but you got things done, you
just got more authority and more access and more promotions. And
I look at things now. I mean, sure, I later got
certifications, and all sorts of things. But I laugh now because
I wonder since people going for it jobs, their their resumes are
scanned, automatically looking for keywords and certifications.
I mean, I've really great experience building huge
systems. But I wonder if I would have been able to easily get my
start today. Because again, on paper when I was starting out, I
was an English literature guy who had a real passion for tech.
And I always used to mess around with paradox databases and stuff
like that coding. And I don't know that it's easy to just
dabble around. And some of the most interesting people that
I've met in tech in Silicon Valley, very successful people
don't have a straight
computer science background, but bass players.
Yeah, yeah. Only musicians, bass player, mathematical models.
Yep. And that type of mathematical mind really serves
you in good stead in software design.
So is this is this really your your main vocation writing? Is
that what you're doing? You're still consulting stuff on the
side? Or that mean? Is there enough money in books today?
Still, can you still make it? You know, I'm
very fortunate. I had to to book deals with Dutton that were very
good. And, you know, demon. I think at this point, it's been
translated into 18 languages. Because a film deal with
Paramount stuff like so I've been I've been doing pretty well
so far. I
put the brakes on film deal with Paramount back it up. What are
we talking?
Sure. Yeah. Actually, what's funny is Hey, backup the demon
again. I couldn't get demon published, or self published,
right? So initially Yeah. And of course it again I made it a big
technology product project because you know, I couldn't
just self publish it and hand it over to somebody I'm like no,
I'm going to typeset it and I'm going to adjust the kerning
Yes, kerning lovely. Yeah,
I did the cover in Photoshop, all that stuff. And being a
logistics software guy, I didn't want any middle men between me.
So of course, I went right to the source lighting source,
which is a company that other publishing companies use anyway,
long story short, I, I basically made it a technology project and
then got the book out there on Amazon, as probably 2006. And
then people and I started reaching out to people, tech
bloggers and tech journalists who had read for many years, and
I could demonstrate a knowledge of what they've done. And I just
said, I want to send you this book, you can throw it away or
use it to level a coffee table, whatever you want to do, but
just wanted to say thanks. And actually, by doing that light
touch, I got a probably 30% of the people writing back and say,
hey, yeah, I read it, I really liked it. And they passed it on
to others, and eventually got into Microsoft, and Google and
all these other companies, it started to take off. So the
funny part of that is, I got a film deal before I even got a
publishing contract, a really old call from Walter parks.
First World Walter parks co wrote war games, like a seminal
film, for me, one of the reasons I really was interested in tech.
So it's funny when you get a phone call from somebody like
that, because the first thing you say is bullshit. Clear,
having to get me out exactly. And then finally, it was made
aware to me that he was actually the guy. And we started
negotiating a film deal. And it was at that point that I think I
got into Wired Magazine. And then Good lord, everybody
started coming out of the woodwork, started selling 1000s
and 1000s, I was already selling 1000s of copies, but I started
selling many more. And that's how I got the mainstream
publishing contract was done. So I got a two book deal there. I
wrote demon and freedom TM. And now I've got a second two book
deal Kill Decision as the first one that I've got one more book
I'm writing on working on that. So I'm interested in tech,
though I am interested in getting back involved. I have
not consulted in a number of years, probably three or four
years now, or four years. And I'm interested in games to
write. So can you can you tell us what you're waiting? The next
book will be about? You know what it is?
I rule that I don't discuss projects I'm working on? I don't
know. It's almost superstition? No, that's cool. That's totally
cool. It keeps this this energy. Like if you start talking about
a book.
Too much anticipation. So but on the Paramount do I mean, has
there been any form of green lights flashing anywhere? I
mean, it's been a while now, is this moving forward? Is Angelina
Jolie going to be in it?
I don't know. And this is this is what I discovered. Now,
having gone through this whole Hollywood experience is that
once once it goes into Hollywood's large intestine, you
just sort of have to wait big box.
Right.
Right. And I'm told that there's really only a couple of authors
like on Earth who have any significant input. What is the
probably Dan Brown, and god I can't believe Harry Potter Harry
Potter. You Yeah, yeah. I think I've listed all of them right
there. That's to probably have significant input. But I'm what
goes on in Hollywood. But to know, I don't have any news, I
don't know.
Well, it would obviously be great be great for you. But
personally, being a real lover of books. I don't. I have
everything in my mind's eye and and you do a great job with your
writing and really painting a picture, which is really, really
awesome. And, and I really appreciate all the time you've
taken with us today. I know this, for me has been highly
anticipated. Because I really, really like your writing. And I
hope this just does dynamite for you. And and you know, it's not
just a great book, but it could save the world. So you know, get
some consideration here for killed that. Yeah. For Kill
Decision. Daniel, thank you again for all your time. I
really appreciate it.
Oh, this is a lot of fun. Adam, thank you.
Daniel Suarez, their interview that I did with him a couple
months ago before the release of his book, Kill Decision. And
nice guy. Nice guy.
Yeah, that's a good interview too.
Thank you. You don't handle high energy.
Your energy was higher back in the day. Yeah. Well, I was.
I was probably high and you're all jacked
up. That this is long after you stop smoking. Yeah, no.
And besides that, smoking doesn't make you high it
actually makes you low. So so we're recording this we're kind
of on We are of course, pre recording this to to make this
nice little interview show, as I'm still in Europe. And we have
one more interview coming up. And and then after that, we'll
be back again live on Thursday. We do want to remind everybody
that we We still need your support. We need executive
producers, Associate Executive producers, you'll get full
credit in the show notes for this episode. But also, we'll
thank you on the Thursday live show on August 1,
right is to go to dvorak.org/n. A and help us out there also
Devorah child of arc.com/n a no agenda show.com And no agenda
nation.com. There's a Donate button on both those sites. Now
I've got in my interview is with John Dixon, who is the former
Air Force Intelligence guy runs the denim group out of San
Antonio, Texas, they do security software, actually, they help
people developing software, put security in the software. But
he's also got a lot of opinions was one of the you know, a lot
of times you interview these guys who are CEOs and the like,
and are in this Dixon is one of the principles of the company.
And they tend to be dull, or they just self promote or just
go really, really I believe me, I did enough of these over the
years. And people would always say, Oh, he's so what does the
guy do? I see the CTO that CTOs are usually pretty interesting.
Now he's the CEO. I, you know, so it's the the guy, you know,
especially if it's a public company, they can't say
anything. They can't do anything. He did a very dope,
this guy's interesting. I had a good time chatting with him. And
let's, let's play it.
All right. But first, I
need to program everybody's brain vorak.org/and A.
I'm chatting with John Dixon of the denim group. And I want to
get right into it. First of all, welcome to no agenda. What do
you think of the all these revelations about the NSA that
have been coming to light to let's start right there?
Well, I wonder how long this is going to play out? First of all,
that I think the phrase or cliche that comes to mind as the
hits just keep on coming. And, you know, some of the
observations that I've had are kind of the reality that the we
assume that at least for the hosted email providers that they
were probably sharing our information with at least
advertisers. And maybe in the back of our heads that we
thought that they were sharing with law enforcement, I think
it's the confirmation of them and the the Swift, specific
nature that has been probably gotten a lot of people's
attention. And so that's, that's, that's the particulars
that have probably kept this as a front page story for some
time.
Yeah, one of the reasons I wanted to talk to you is because
since you're in a community, of people who do this sort of work,
security work at the computer, there has to be gossip that goes
around. And so I'm sure that everyone has talked to each
other, or either within the company, you've probably talked
and you probably have some context outside of the company
that are interesting. What kind of gossip is going around about
about this whole thing? What is it? What do people think is
behind it? Why it even happened? Is there a, is there any
intrigue you might imagine?
Well, I think in one way, I'm reacting like other Americans.
And another way, I have a little bit more background. And inside
being a security professional, I'm also used to be an
intelligence officer and delta in this world, but I can say
most of my experience predates the electronic stuff. It's more
in the old, but these signals intelligence. So we've got
friends and colleagues that are in the security industry, and
also that work still in those in those arenas. And I'd say
there's a couple of observations. And one is, if you
remember what happened after September 11, with the September
11. Commission, there was, you know, a lot of hand wringing and
a lot of why we missed this and stovepipes of information. So
there was a you know, certainly a direct and indirect, I think,
consensus that there should, you know, we don't want to miss
another event. We don't want to have that happen another
September 11 of it, but and then how that was interpreted by the
different agencies is what we're starting to see right now, what
does that mean? Does that mean that we want to give up all of
our information that we want to have our travel restricted, some
of those things played out in public, some of them played out
in private? And like, what what I'm hearing is that, you know,
maybe six or seven weeks ago, is on the heels of the Boston
incident that, you know, there's a lot of like, how do we miss
this? How do we, you know, why did that happen? And then now,
the pendulum has swung the entire way. The other ways, how
can we possibly have permitted this so I think that's an
interesting one. The other thing that is fascinating, and I think
you pointed out a couple of things about the tech industry,
is how long that the telephone companies the delay As the bell
companies, the ATT and Verizon have been very comfortable and
very have a long history of working with governments and law
enforcement, because of wiretaps or for the monitoring side, and
that the different reactions of companies that are more
technology or Silicon Valley based, some pushing back others
not. I think that in the gap between their public
pronouncements of privacy and privacy guarantees, and you
know, what's happening in practice? I think those are
those are that puts them in an uncomfortable position now that
that's out in the public domain. And the final thing is, I think
you've alluded to it at least one piece is this
competitiveness, nature, okay, think of it this way. It's one
thing if it's the NSA that's looking at our hosted email, or
you know, the intelligence agencies that are in the US, you
know, you can make the argument that I've got nothing to worry
about, and I'll do anything wrong, and who cares. But a lot
of that hosts of emails from people that are not non US
citizens, obviously, if you were a UK company that did Hosted
Exchange for Microsoft, not just Microsoft products, but hosted
email. And if you look at the small and medium sized business
world, most of that email starting to migrate from data
centers and companies to the cloud, right. So that's the part
that I think that, you know, if you look at our hosted Exchange,
not just email, but like, posted exchange, a lot of companies
have that. And it's like, Okay, what's my application? What are
my expectations of privacy? If you think about the NSA thing, I
think if it were if we were British citizens, and and the
roles were reversed, or you know, your US citizen, you find
out the German intelligence agencies looking at all of our
email, you would view that differently? I think. And maybe,
maybe not. But I think there's, this is just a fascinating thing
that's playing out in a very public way. And the other thing
is, is that, you know, the this could be on one end is
illuminating as interesting as putting, asking us to ask
questions of ourselves, and what are our expectations? But on the
other end? I mean, he did give some information to the Russians
and Chinese that are definitely absolutely not going to help us.
I mean, there's no way that's a good
thing. What specifically do you see that does that?
You know, well, first of all, I, I'm not in the team that's doing
the damage assessment project at Fort Meade, but my suspicion is
what they call sources and methods of, of the surveillance
unit. So you have two things. First of all, one is the
surveillance side. But he also is put out information about the
attack side of the cyber cybersecurity and the sort of
the electronic cyber attack side. We've been very public
with the Chinese about their efforts in this particular space
and my experiences and within the security community, is that
as a very, very tangible threat. It is it is when you hear the
term nation state threat, you can substitute Chinese, they are
actively surveilling and attacking not government
entities, but also commercial entities. It's, you know, so
that happens all the time. What this does, is it you know, the
the charge that the US is doing it to kind of makes it weakens
our claims, or at least our protestations that we're, you
know, that's happening to us, and we're not doing it. So
that's, that's an interesting thing, too, is that that
revelation has come up, we do not know is is citizens what the
impact has been. Our will be, but my suspicion is, is is
handed us over to gun governments that are less than
friendly to us. So that's, that can't be that can't be dismissed
either.
Well, I've always felt that we have issues with the Chinese and
so far as being I wouldn't want to use the term hypocrites. But
I know the Chinese are not happy about the fact that we call them
out for their, you know, prison camps and all the rest of it.
Well, we are the country that has the most prisoners, per
capita and in total. And the same thing with this. And I saw
it seemed like we're kind of like asking for trouble. If we
are always accusing them of stuff that we are also doing. It
seems to me that doesn't bode well for the relationship, which
really is a economic one that needs to be it's really
shouldn't be too adversarial since they make almost similar
products right now. And, yeah, we've done a little bit about
that.
Yeah, we're so tied together that it's a very interesting
dance between us and them right now. But I think part of their
the attractiveness of doing the cyber stuff is they can do
things without it coming up to the surface level and it being
attributed back to them and vice versa. So, so you know, on one
level, we're friends, and we're conducting commerce, and we're
doing things that other, you know, below the surface are
knocking the heck out of each other in the cyber domain. So I
think there's some plausible deniability there that allows
them to do that. And again, this this revelation is, is making
it, you know, more of an even playing field,
what do we better be better off spending our time securing these
systems a little better than than we've done? With
the classic argument? Absolutely. I mean, I got I, as
a security guy, see, the, you know, products and, and
capabilities that get put up, you know, thrust out there on
the web, or mobile apps. And many times, they're, you know,
security is considered, but most of the time not. And I'll give
you two great examples of things that scare me. Number one is the
smart grid, where this is headlong rush for all the
electrical providers to essentially make their legacy
electrical distribution connected to the TCP IP or the
internet. And that's, that's one thing. And number two is these
health information exchanges and insurance exchanges, where you
have all of this private, private healthcare data that's
out there on us. And those are two industries that have
healthcare and the electrical that have been less rigorous in
their security compared to like the financial industry. So
you've got these, you know, oh, we need to put data, you know,
on the web for this, we need to do that. I would still say that,
always, always features and functionality will outstrip
security. And so yes, that there's going to have to be some
substantial bloody noses before that changes.
Well, I know my doctor had to recently upgrade his disinfect
his whole office of doctors, they upgraded their system,
because the government requires now that they have electronic
health records. And so they've had to retrofit everything and
and from what and then they have a website that the patients can
go to and fool around on. And it's, it's so mediocre, because
I've gone to the website. I mean, it's so low end crap, to
be honest about it, that I can't imagine the security being any
good at all.
Yeah, I you might be on to something that, you know. But
depending on the size of the clinic and the doctor's
background, they you know, they have, there's something called
HIPAA. And there's another one, the healthcare regulation called
high tech that's coming out or has come out, excuse me, and
they're supposed to prescribe ways of doing things. But there
is still that is issue number five, or six or seven. In the in
the planning consideration. There's still high profile cases
where hospitals systems, insurers are losing customer
data. And if you see something that looks clunky or kludgy like
that it probably doesn't have a sophisticated security back end,
either. So your your, your intuition probably serves you
well, although I can't confirm that.
Yeah, well, I'm sure. It's a model I've always used, which is
the Gestalt model with which is if everything looks like crap,
and cheap and doesn't look like a professional did it, you have
to assume that the whole product set way from front to front, the
bottom, top to bottom?
I would not doubt that.
So what? So when you see do you actually look at Chinese attacks
in the Dental Group go out and help companies when they say, I
think these guys have been looking at our stuff, or
something like that company, for example,
we spend most of our time in the upfront part where we help
companies with the security, their software, our building
software systems that are resilient to start with, that's
fine. But from time to time we get called. And when we do, it's
usually, you know, usually this time on a Friday afternoon and
something is weird. It depends on the target. So if you're a
financial institution, that you're probably going to give be
attacked by the Eastern European hacker games, you know, because
they're looking for money. They're looking to steal money
and fraudsters, many of whom are in Bella Russia or Russia or
proper Ukraine. It's the nation state threats. Again, the Russia
is the China's the Iranians of the world, who are more likely
to go against other gets infrastructure. Those are the
ones that we get called in from time to time. Here's the
challenge. The real good ones and the nation state guys are
really good are exceptional covering their tracks. Now they
do make mistakes. But they're they're pretty darn good, pretty
sophisticated. So that usually what we do is we're able to find
out where they originate from or kind of can deduce where they
come from. At that point. If you say, Well, we think it's kind
Coming from the Ukraine, that's kind of the end of discussion
because you either have to turn it over to law enforcement,
because because most of these companies don't have, you know,
rule of law, excuse me, countries have don't have the
rule of law, or don't have the rule of law in this area, you
really have zero capacity to prosecute or to litigate. So
it's like, yeah, it started off in this country. Yep. We think
it came from there, if you get that far, but the logical
outcome is, it's a loss. And we did a project a little bit of a
response, maybe two years ago for a water system and a real
low level kind of utility. And one of their wire transfer
people had actually downloaded what's called a bot or, you
know, automated system. And it Skander harddrive found out that
she was the payment processor, she did all the wire transfers
with the utility. And they sure enough, went out, recreated a
computer, so overseas and then moved 25,000, they tried to move
50 75,000 a bunch of other money. And they didn't catch it,
the internal fraud filters of the bank that was transferred
the money said, Wait a second, this is fishy. And in what the
guys were doing is they had had a compromised shell account with
another bank in Florida. So they didn't move the money from, you
know, from San Antonio to Belorussia. They moved it from
San Antonio to to Florida. And then it was the second one that
they moved it offshore. So that's one of the things that
these guys are good at is it, you know, the covering attracts
and doing multiple hops. So we can suspect that it was a nation
state threat. Really, we're less powered. So like one of the
things that's interesting, I think one of the outcomes is,
you know, the FBI wants companies like ours to cooperate
and say, You know what, we think that this attack happened from
Russia. And like, there's nothing we can do is as a
consultant, and a company based in South Texas, there's nothing
we can do. So their their encouragement is, hey, why don't
you cooperate, at least let us know what this happens. So maybe
at the law, at the international level, we can prevent or warn
others, I see as an outcome for this particular thing. Less and
less cooperation or suspicion between
the NSA thing,
and the outcome of the NSA thing is in general. I mean, there's
there is no law that compels didn't group our General
Electric or USAA, our name any any, you know, in San Antonio
Rackspace is here, any of the big companies, there's nothing
that compels me to cooperate. However, there's an incentive
because there's a certain point, I really can't do anything.
Well, let's at least let law enforcement know that we had a
loss here. And then for insurance purposes, we might
need to report it with very few expectations to get anything
back or even resolution, that's gonna be harder to do now,
because, you know, it just is going to be harder to do, I
think people would be more reluctant. And that's one of the
weird outcomes. I don't know, if you follow the debate prior to
this, and DC, what it was all about information sharing can,
you know, can the FBI and DHS share threat information with
industry and then vice versa, because, like most of the
critical infrastructure in the US is in the private sector, not
in public sector. So we're going to see things on our end, that
in aggregate might be a trend that would be very important to
DHS. So we'll see something in San Antonio, you'll see
something on the West Coast, something up, you know, guys
like us, you're gonna see lots of little pieces or evidence
that something might be going on. It is the only way that the
DHS or others might see that from a cooperation standpoint is
if we cooperate through sharing, you know, there's groups that do
kind of industry sharing with law enforcement, that might be a
casualty of this whole process.
That would actually make sense, because I think I just wrote a
column that ran today on PC Magazine that suggests the cut
if anyone should be annoyed about this NSA problem. It
should be the Commerce Department.
Yeah, I actually caught that right before. And I agree. And I
think that's this is the second one I would add to this. So
after I read your article, I thought a couple things. First
of all, we don't know all the other things that are going to
happen, like we're starting to imagine what are the what are
the unintended outcomes of this? And I think that's one the
competitiveness issue. I mentioned. It's one thing if
Americans are being surveilled by the NSA in North America, if
you have your Hosted Exchange in the data center in North
America, and you're German company, that's a little
different angle, right. And the second thing is, is, you know,
industry cooperation and general security cooperation in general
with law enforcement, and guys like DHS on on legitimate issues
around critical infrastructure. Again, most of the critical
infrastructure, particularly energy and pipelines and
electrical distribution, are in the hands of private to the
private sector. Um, DHS can't, you know, compel most these
companies to share information on vulnerabilities? So what has
happened is that is very much a one way? Well, the argument has
been, it's a one way, information sharing, we share
with the government, they don't give anything back to us. You
know, that'll even be worse now. So I, you know, I add that as
Issue number two from the security guys perspective, and
that is, you know, an increased distrust or potential distrust
between industry and law enforcement, national agencies.
And that may happen, particularly in the Silicon
Valley companies, I think, who have a more, you know, to lose
their mortal is they have bigger brands to lose. And again, no,
just I wrote this piece, and I have to share it with you
afterwards. We're doing a, like a fun piece for the Blackhat
conference coming up in Vegas at the end this month. And I, I
came up with a top 10 things to ask General Alexander if you
bumped into him at BlackHat. So he's a keynote, he's going out
the, you know, the keynote, this hacker cop Conference, which is
very interesting. And one of the funny questions is all in jest
here, but one of the questions we came up with was, you know,
ask him, if NSA can collect data faster than Facebook can give it
away. So you have Facebook is, you know, on one end of the
spectrum doesn't have a really great reputation for privacy and
all that. But others have kind of staked out a bit stronger
claim for that. I think that this, this is a cast a doubt on
some of those claims. So the funny thing is, though, you
know, again, Americans in the US, US companies, in the US
intelligence agency, you know, people have asked me, if you're
not doing anything wrong, what do you have to worry about? It's
like, okay, you know, yeah, that's
always been an argument that's different, really annoyed me,
because it doesn't really account for the real problem
with the loss of privacy, which is blackmail. And in fact, I
would have to add one argument is that I don't think there's a
person out there that has absolutely nothing to hide,
because you're if you're a human being, there's probably
something you've got to hide, you want your medical records
out there, do you want insurance companies jacking up your rates,
because they know that you have high blood pressure? I mean,
there's a lot of things that you don't really want in the public
domain, including, you know, the, you know, your body
measurements, in fact, so, so that argument is always, it's
never sat well with me, but in fact, even if you didn't have
anything to hide, the does you think it's okay to have a
congressman, for example, that's been compromised through some
blackmailing system, and they're voting against? What is your
best interest? Is that okay with you?
So you just hit on one thing, and this is the David Petraeus
scenario you just threw out, which is, you know, having a
relationship with a reporter. FBI investigates that reporter
because of perceived harassment, in that, in the course of that
investigation, they find out that she's having an affair with
David Petraeus, you know, well, the problem was, it was David
Petraeus if she was having an affair with Uri, which wouldn't
happen. You know, who cares? But it's with the director of the
Central Intelligence Agency, and it's the issue of leverage. So,
you know, that instance was one where I see more of those type
of things happening with a trip across this and they find
something else. I mean, and here's the other thing I would
throw out there is that don't anticipate bureaucracies ability
to make mistakes on data, you know, think of the TSA, you
know, watch lists and travel lists issues and getting Arabic
names,
right. Or the fact that Ted Kennedy couldn't get on a plane
once.
So so that is when you, I think, this is an important point. I
think our ability to collect data has always outstripped our
ability to analyze it and put it to work. Always, always, always,
always. If you want to draw on another analogy, you look at the
US Air Force and the military's ability to collect you know,
full motion video with drones out in Afghanistan. They have
apparently years worth of video that they've never been able to
analyze. Their ability to collect it is outstrips their
ability to analyze it. I think that'll be the case here. The
interest in the other one that I like to reference is the Mumbai
attacks. By the the Lashkar e Taiba Mujahideen guys in
Pakistan. If you've ever seen that HBO video, the documentary
tearing up in Mumbai, the Indian intelligence actually had the
entire operation attack recorded they had seated prepaid cell
phones and a bunch of marketplaces in Pakistan hoping
that the the Mujahideen would get these things. And in fact
they did. What happened was they use them these prepaid and
proceeded phones as the means of communication for that attack in
Mumbai, guess what happened, the Indian intelligence didn't
figure it out until after the attack, they weren't able to put
two and two together and correlate that information until
after the attack. So the other side of this is, is your you
know, that's what the intelligence guys are worried
about. They're worried about not having access to the data or
catching them in time. It's great to find the guys after
they've done something Boston, Mumbai, September 11. It's
another thing, you know, if you're able to so that's the
other bit of the dynamic that is tough, that I struggle with as
an X intelligence guys, like, you're asking our, you know,
our, our, you know, people that are trying to do the right
thing, they might be efficient or inefficient, to find needles
and needles,
and they're making bigger, and they get the hate Oh, yeah,
they're making the haystack really, really big. And in the
question that I asked is, you know, what, what level what
percent level of protection Do you want? Do you want a, a 90%
guarantee that we'll never have a terrorist attack, or 100%.
Because 100% is a is a, a completely authoritarian state.
Right now,
it's called a risk free society, it's impossible.
And here's the other thing, this, I've said this before, if
there is another Boston attack like this next week, this whole
story goes away. And the pendulum swings back the other
way. So I mean, that's the other thing to read, I think, to
realize is that this is this, this discussion will continue to
play out and will and perceptions will change,
depending on current events. I mean, and yeah, so I am not
saying I'm not using that to justify anything. The other last
point I would make is a guy that was part of this community a
long time ago, we're getting the tip of the iceberg. And it's
very difficult to make real strong decisions based upon the
information that is getting out, and that we have the information
that is being leaked out. Many times it's not within context.
So you're kind of getting the tip of the spear, you don't
know, you know, whatever. So that's one thing that I worried
about when back when I was in the doing that kind of work, you
always would wonder if a certain key event would make it in the
news, and it never would, and, or we would make it in the news.
You know, like, that's not how it actually happened. So I mean,
the chance for distortion, both from the leaker and the
responders is, is off the charts. So I mean, that's the
other kind of tough thing throughout this discussion. But
the general fact that they are that this is happening at the
level it is is the big, big coin. And now this is a public
domain discussion that will happen in a public way. And I
think that'll be healthy. I don't think anybody I don't
know, I I'm very interested to see how this plays out as
somebody both as a security practitioner, American, and
also, you know, X former intelligence officer, I can see
why. Some of the you know, why general I understand Joel
Alexander's point. I, it's the breadth and scale that is, that
is, you know, very, very amazing.
Yeah, it's quite something. Getting back to the smart grid
situation, which is something I've always been skeptical of,
because it seems to me that your best power grid would be a local
one where you were, the guy could throw a switch by hand, or
should as opposed to something interlinked, interlinked into
the internet, which always seemed like a sketchy I mean, I
liked the idea of grids that are not subject to cascade effect,
collapse. But at the same time, I'm not liking the idea of one
giant grid. That smart because these things are always not fun.
I mean, they're, they're not foolproof.
What, what the lore for the smart grid is and business
reason these guys are doing it, I want to say, I mean utilities
in general electrical utilities is they are able to dampen
demand during peak times in August, specifically July and
August. So if you look at the way you build a electrical
network, it has to be for the capacity for peak times. And
that's happening now. If you can go in and dampen demand in
certain houses or buildings, by essentially remotely lowering
the temperature from 72. Or excuse me, raising the
temperature to 72 to like 77, you essentially save billions of
dollars of electrical infrastructure by having to
build redundant transformers and redundant lines. So that's the
allure is to basically make every one of these remote
devices in the households, every thermostat, essentially an IP
addressable device because you can do it In these the 1% or 2%
scenario on the network, you can turn down demand for air
conditioning. The challenge is, is now everything's an IP
enabled device, it has a, you know, it's a computing device.
And every every capability that you create has an ability to
tear down or to exploit that capability. You know, and that's
the thing that I worry that the headlong rush to make sure that,
you know, everything is part of the smart grid is in certain
instances is being done with no little consideration for that
security implication, the real problem with the electrical guys
to is, who would care to attack or disruptive from a attacker
standpoint, it's not going to be the Eastern European hacker
gangs, it's not going to be it might be anonymous, or the
hacktivist gangs, it would most likely be a nation state threat.
And I got to sit through an interesting session in DC back
in February, January, February timeframe, where there were a
bunch of industry folks, we're talking to Representative Mike
McCaul who's chairman of the House. Well, he's responsible
for cybersecurity things as chairman House Homeland Security
Committee, and one of the attendees was a vice president
at the electrical company there around DC, she said, when we get
brought down by a nation state threat, who is going to knock on
our door? I mean, of the 20 federal agencies and not under
who do we listen to first, NSA, DHS, FBI, NERC FERC, she just
went down this list. And the point is, is that if you're a
federal, if you're a electrical people around DC, or other
critical areas, you're planning that this might happen. And if
they do happen, it's going to be the Chinese, or it's going to be
the Iranians or be, you know, a nation state threat. And when
that happened, they are not there's a mismatch between the
sophistication the attackers, and their ability to withstand
that. And so that's, that's something that has a lot of
people concerned. Again, the private sector controls most of
that infrastructure. And it's a fairly abstract and maybe
distant threat. But when it happens, it'll be those guys.
And that'll be real tough.
Yeah. nothing to look forward to. in your dealings with some
of these agency is that you bump into quite often, I'm guessing.
Well, how do you because I've noticed, I used to work for a
government agency, and it was a regional agency. And the kind of
the rule and what kind of work the most, in terms of our
thinking was the regional agency was very, very good. And then
when you went to the state version of the same agency,
which oversaw everything else, they were kind of dumb. And
then, then when you took it one layer higher to the feds, they
were extremely there were to the point where it was they're
essentially stupid. And of course, this is reflected in a
lot of TV dramas and the rest where you have the, you know,
the idiots from the FBI, let's say to interfering with a police
investigation and some cops show. What's your experience
with the, with these agencies, and without naming any more you
could if you want, I don't care,
I would say pockets of excellence. And then pockets of
competency to I mean, like you've got it's particularly in
our area, that cybersecurity area, there is, you know, thin
talent across the board. So you'll have some pretty sharp
folks, I would say probably like the FBI, I imagine in the FBI,
San Francisco Bureau, they've got a pretty crack team. If you
go to other places, maybe that's inconsistent. And I have a
general rule of thumb. And this is not fair. But a general rule
of thumb in Texas, that if I'm doing security incidents, I'm
not going to call law enforcement guys with cowboy
hats. And that's not fair. But like, I don't, I'm assuming that
if you're a county, MT a county sheriff that you probably are
not a crack forensics guy that that is not that is probably not
fair to them, but it's probably true. So, you know, like, what,
what the impact there is we tell our clients, you know, step one,
and if you're having an incident is not to call law enforcement,
because once you get once you engage them, they treat, you
know, this is a big deal. And you have to kind of think and be
ready to manage them and interface with them. Because,
you know, they're their goals are different from your goals.
And it changes things so like you they come in and we got the
FBI there, they're trying to find out who did what to whom
and prosecute, you're trying to get your network back up and
running. Those are not the same goal. So again, widespread
talent level. You know, same thing with DOD and DHS, guys,
there's some super sharp ones that we work with and then and
then a full spectrum after that. I don't know that's a nice way
of saying it.
Yeah, well, that's good, I would think would be the
good I didn't see like at the local level, I've never I've not
experienced that with at the local level, they were
fantastic. And then they were dumber, the higher up the food
chain, they went, I've seen some pretty sharp ones well meaning
and and then but just inconsistent because this
industry has grown to the demand for the talent has grown. Where
the you know, the amount of people doing it is remained not
too much difference. Yeah, well, I think
the difference I think, insofar as the look of my thesis, which
is local smarter than the big the bigger it gets, the dumber
it gets is I think valid based on on specialty type of
agencies. So if you have a look, if you had a local cyber
terrorist threat operation, which may be actually
represented by a small company like yours, that would be ideal.
I don't think you can generalize about let's say, the health
department can't also can't, which would be a small local
health department, which would not do well with the police
either. No, I
think in cybersecurity stuff, it's the opposite. I mean, the
higher up the food chain you go, the more likely they are going
to be real technical and pretty sharp, like San Antonio Police
Department and the county sheriff probably have one or two
guys that are okay. What what I would see I would confirm with
you is there's a chasm between the private sector and the
public sector in general. I mean, most of the, of the
hardcore talent is probably working at the banks and the
commercial entities that that's, you know, some something
reflected, somewhat reflective of salaries and an ability to
keep guys like that happy. But I think if you look, there is a
gap between the private and public sector on talent, big
time. And like, like, if you think about it, if you are a
security person who who's getting attacked most of time,
many times, it's the banks, and they have some of the
interesting work to do. And so I've seen a, you know, a, for
example, the head of Bank of America's group is an ex Air
Force guy. I'm the head of the Sabre and Travelocity security
group, ex Air Force guy while these guys migrate end up there,
because it's, you know, interesting work. They're always
under attack. And oh, by the way, the compensation is pretty
pretty darn good, too.
Yeah, I would suspect so. And that's where all the money Isn't
this where they have to have the talent.
Yeah. And they're constantly under attack. So it's not like
it's a boring, you know, Hey, quit your great government job
for boring, you know, jobs in the private sector. Now, these
are pretty damn dynamic jobs.
Is there anything else? What else? Do you guys work on it the
denim group?
Well, we, again, we are focusing on the whole area of software
security. So it is the issue of helping people build the
software right the first time, and so we're always spending
time properly. So you're working at the development level?
Exactly. At the software development level, both in
mobile, and then, you know, mostly web applications. And so
so like T Mobile would give you guys a call and you help them
put together some app or what,
yeah, mostly a big companies like that not, you know, so the
big companies are looking to extend their reach out through,
you know, Android and iOS apps on the mobile side, or web
applications on the website. And so the key, what we try to do is
help them do it right, the first time to build secure and
resilient apps. So they don't get this stuff and put it out
and just get the teeth kicked in when it's published. And, and
you see all these vulnerability reports and all these things,
oh, these guys put this up. And they got, you know, that's what
we're trying to do is show them how to do it the right way, the
first time so that they don't go through that process. How
secure are these mobile phones? Is? Do you always hear about?
Oh, well, you know, they can turn them on remotely?
Wow, that's a great question. Well, it depends. None of them
are created. Equally. I would say that. The interesting thing
is that, you know, iPhone, and the in the Apple devices have a
closed system. So there's kind of a little bit of a more of a
known in that, you know, the the handset. And the operating
system is created by Apple made by Apple put out there. So
there's a little bit more regimen to that. And they have
to go through, you know, apps have to go through some process
not really rigorous, but they have to go through a process to
get on in the iTunes Store. The Android side, it's a little bit
more wide open, there's a wider spread, there's some secure
implementations in there some that are pretty wide open, and
you got every device under the sun. The bigger challenge that
we see now is again, how do you understand what the software is
doing on your device? Is it actually sending data or
location data that you're that you don't know? What does it do
in
effect, when you load almost any of the apps on these phones that
they essentially ask you to turn on everything?
That's by default, and that's bad and so it's So what's
happened right now is like, I'm not going to know, you're not
going to be able to know, hey, is this software? Does the
software do it on my phone? Is it secure? Is it creating a
risk? For me? Is it sending data that shouldn't be you don't know
that. So what's happened up to this point is people are
trusting the brands. They say, Look, that's an app from Wells
Fargo, for Bank of America or from USAA, you know, that the I
know those guys, they are trusted brand. I like those
guys, I'm assuming that they've done the right thing. And I've
checked the security this. So that's the proxy up to this
point has been the brand more than the actual software. So
there's no like rating scale, like restaurant, you know,
rating scale, there's nobody auditing these apps. And you
know, the kind of the joke about the iPhone world is that, you
know, Apple checks for hand a set of things to make sure that,
you know, number one, that you don't actually blow up the phone
network that you don't put on objectionable material, and most
importantly, you don't compete with Apple, you know, so that's
what they're checking for. They're not checking whether or
not there's backdoors. There, your SIP Tisha Slee, you know,
sending data to somewhere offshore or not do it's not
doing any of that stuff. It just simply is not.
Alright, well, I think that should wrap it up. I think
unless you think there's a question I should have asked.
No, John, I enjoyed it. And I, my thoughts on this whole NSA,
Eric Snowden thing continue to evolve. And I just think there's
more, a lot more that's gonna come out not only in the data
that he releases, but probably more importantly, the unintended
consequences. And I think your piece on the economic
competitiveness one is just one facet of that. So I mean, I'm
continue to write about that and think about it. And like I said,
I'll make sure to give you my two cents from Blackhat. When
we're out there in three weeks.
Yeah, I'd be very interested in what happened. Okay, John. Okay.
Thanks. Have a great weekend. Yeah, same to you, John. Bye.
Bye. That was John Dixon of the denim group, also a security guy
that felt like chatting about the NSA with me, and I
appreciate that. And hope you guys enjoyed that.
I enjoyed it. Yeah, I bet you did in Florence.
I would enjoy anything and
you should have come in to visit me. I can't believe that you're
in Detroit right now. Well,
since I'm on tape, digital tape, I'm really not in Detroit, but
hopefully I will be. We're gonna
be back on Thursday, August 1, I will be in back in Amsterdam.
Back in the ghetto somewhere. Three stories up. But we're
going to have a whole bunch of stuff to talk about
live show. We have like a week's worth of material you're gonna
gather throughout Europe.
Yeah, I'm gonna have a lunch. Yeah, no, I'll have
a lot of you that you've gotten to the end, you would have gone
to the party by then the party with the elites? Oh, yeah. No,
no, no,
no, the party with the ambassador of Barbados and all
that. No, no, it's gonna be cool. It's gonna
have narcolepsy and all that kind of thing.
Exciting. Make sure you you support us by going to
divorce.org/n. A, you can get in for an executive producer ship
or Associate Executive Producer ship or even an episode club
membership. We look forward to talking to you then. And until
then, coming to you from somewhere in Europe on my way to
the lowlands. I'm Adam curry,
and from Northern Silicon Valley. I'm John C. Dvorak.
I'm glad you remembered. We'll talk to you again on Thursday,
August 1 Right here on no agenda
devora.org/n A