Latest / Success Story with Scott Clary / Dr. Eric Cole - Former McAfee CTO | No One Is Safe Anymore

Transcript

Dr. Eric Cole - Former McAfee CTO | No One Is Safe Anymore · Success Story with Scott Clary

0:00
The number one thing that probably gets me the most fresh rate and most upset is people are still using passwords.
0:05
If you're using a password today, your system is already compromised 95%.
0:10
Because most people don't realize this, what if the biggest threats to our world weren't missiles or armies,
0:15
but invisible lines of code?
0:17
Today's guest has spent decades operating in the shadows of cyberspace,
0:21
protecting governments, corporations, and critical infrastructure from attacks.
0:25
Most of us will never see.
0:26
Most people think cyber attacks are going after government and big companies.
0:30
That was true five years ago.
0:31
The current attack factor we saw over the last 18 months is, that's too hard.
0:35
Trying to break into the government is difficult.
0:37
Breaking into individuals, simple and easy.
0:40
If companies actually fire employees and replace them with AI,
0:44
we're on a path where 30, 40 years, humans could be obsolete.
0:48
These advised intelligence agencies expose the psychology of hackers
0:52
and reveal how fragile our digital systems really are.
0:54
If I go in and create a deep fake against the president,
0:58
it's currently on our laws.
0:59
It's not illegal.
1:00
How can we live in a country where somebody can create fake media
1:04
and there's no penalty?
1:06
The more decisions you make, the bad decisions almost become irrelevant.
1:09
If you're afraid of making decisions and you're slow,
1:12
you're going to lose out to the competition every day.
1:24
So Eric, you are one of the most dangerous people in America.
1:28
You can hack a nuclear reactor in 37 minutes.
1:30
You've advised presidents and billionaires.
1:32
You've built a company, two billions.
1:34
You've had multiple exits in the high seven figures.
1:39
But your personal biggest fear isn't for an adversaries.
1:43
It's not cyber criminals.
1:45
It's people like me and a lot of my listeners
1:48
who are walking around completely defenseless in this digital war zone
1:52
that they don't even know exist.
1:54
And you've said before that we're all targets,
1:58
but most of us are easier to hack than a 1990s Windows computer.
2:03
So when you look at one thing that people do every single day
2:09
that frustrates you that really just makes you want to scream,
2:12
what is that thing that people are doing?
2:15
The number one thing that probably gets me the most frustrated,
2:18
most upset is people are still using passwords.
2:22
I mean, passwords, I say are so outdated.
2:25
If you're using passwords, you minus, we'll go back to the 80s,
2:29
put on bell bottom pads and listen to the BGs.
2:32
I mean, nothing gets the BGs, I love my music,
2:34
but it is so archaic and so easy to crack.
2:38
If you're using a password today,
2:40
the probability that your system is already compromised
2:44
is close to 95%.
2:47
Because most people don't realize
2:48
today's attacks are stealthy.
2:51
They want to get into your account, monitor it,
2:54
and most people think, oh, they want to wipe out my entire bank account.
2:58
No, what they want to do is steal eight to $10 a month from you
3:03
and do that for years upon years and just think about it.
3:06
If you went to a restaurant and you bought a meal
3:09
and you put the tip on there, if somebody added five additional dollars to that,
3:14
you probably wouldn't notice.
3:16
Most people don't check the exact amounts at the end of the day.
3:19
If there was an additional $7 charge on your credit card,
3:23
most people don't notice that because today,
3:26
with all of our online apps, we're always doing small purchases,
3:29
and that's what the attacker is doing.
3:31
They're compromising your password,
3:33
and it's so easy.
3:35
You have to go to MFA, multi-factor,
3:37
or what we call two-factor authentication.
3:39
And yes, what I always get back is,
3:41
but Eric, that's annoying, right?
3:43
Every time I go to log in,
3:45
I got to go to my phone and type in the code,
3:47
and it's so annoying.
3:48
My response back is, you know what's annoying?
3:51
Having your entire bank account slowly drained over the last next 10 years,
3:56
having your identity stolen,
3:57
having your child targeted or bullied or not accepted the college,
4:02
because somebody posts fake videos under their account.
4:05
That's really annoying.
4:06
That's very annoying.
4:07
I always say, pick your annoyance.
4:09
You either have a small annoyance or a big annoyance,
4:11
but as you said, most people think cyber attacks
4:15
are going after government and big companies.
4:17
That was true five years ago.
4:19
The current attack factor we saw over the last 18 months is,
4:23
that's too hard.
4:24
Trying to break into the government is difficult.
4:26
Trying to break into commercial is difficult.
4:29
Breaking into individuals, simple and easy.
4:32
I know that you are the author of the Wall Street Journal number one
4:36
bestseller, Cyber Crisis.
4:38
Now, this book speaks about protecting businesses for sure,
4:42
but one of the main cyber crisis that you see is the average person just
4:48
getting slowly drained over the next 10 years, 15 years.
4:52
And this is sort of like the current model for cyber crime.
4:55
And this is how it, this is how it becomes profitable.
4:57
I'm assuming this turns into a whole criminal enterprise,
5:01
because if I'm just doing the math very quickly,
5:03
if there's how many people in the US, whatever,
5:06
what is it, 330, 340 million, something like that.
5:09
And I can only imagine what percentage of those people do not have two FA.
5:14
I mean, I don't think the two FA is across the board, common.
5:18
I mean, I have two FA on everything.
5:20
Awesome.
5:21
Everything.
5:21
You may be so happy about it.
5:22
You may be so happy.
5:23
I'm so enraught.
5:24
And I don't even like two FA on my cell phone,
5:27
because I'm so stressed about somebody doing like a SIM swap or stealing mine.
5:31
So I have two FA on an authenticator on my actual device.
5:34
There's maybe even better ways we can talk about how to protect yourself.
5:37
But I come from tech.
5:39
I'm neurotic about my security.
5:41
And I don't want any of my stuff hacked.
5:44
I don't want any because I, especially when you put yourself out there,
5:48
at least in my head, I feel like I'm a target,
5:52
because I feel like people are always trying to get into my social accounts
5:56
and trying to get into my email.
5:57
Yeah, you're even a bigger target because of your audience here.
6:00
Bigger target.
6:00
Exactly.
6:01
Because of what you're doing.
6:02
Listen, I'm not as incredibly rich,
6:05
but I see some of these crypto guys,
6:07
because I've had some of them on my show.
6:08
And I've had the CEO of Ledger, the wallet.
6:12
I've had him on my show.
6:13
I've had one of the co-founders of Ethereum.
6:15
I know there's like nine of them,
6:16
but I had one of them on.
6:18
But they all tell me these horror stories of like,
6:24
multi-multimillion dollar hacks and whatnot.
6:27
And I think that that stressed me out so much,
6:30
that that's what made me want to do two FA on everything.
6:32
Because I don't want my identity stolen.
6:33
I don't want my money stolen.
6:34
But I don't think the average person is that stressed about it.
6:38
I don't think, especially if they're taking 10 bucks from my mom or my grandma,
6:43
like they're not going to notice it, but then do the math, right?
6:45
So 10 bucks a month times 10 million, 20 million, 30 million, 50 million people.
6:50
I don't know what the numbers are,
6:51
but that adds up to like a lot of money over a period of time.
6:55
So this is the cyber crisis that we're all dealing with right now.
6:58
Exactly.
6:59
And just to give you some perspective,
7:00
last year in 2024,
7:04
the amount of damage cybercrime caused to Americans was 20 billion.
7:10
Now to show you how bad it is,
7:13
we're only halfway through 2025.
7:16
And the numbers are ready estimated to be 31 billion.
7:20
And here's the scary part about those numbers.
7:22
That's what's reported.
7:24
So imagine how much is not reported on there that could cause damage.
7:30
And you're right.
7:30
The cyber crisis was written for businesses,
7:33
but the important thing is for listeners is three years earlier,
7:37
I wrote a book online danger,
7:39
which was really meant for audiences.
7:41
We talk about not clicking on links,
7:43
multi-factor, all those things.
7:45
And what I found is businesses are coming to me going, Eric.
7:49
It's great that you wrote a book for individuals,
7:51
but we need something that's more executive focus
7:54
because executives typically are not going to read
7:56
those self-help books.
7:57
So that's cyber crisis was sort of a revamp of online danger
8:02
for businesses and executives to sort of wake them up
8:05
and realize there are targets.
8:06
Just look at how many ransomware attacks are against businesses.
8:11
And the average business is typically
8:14
have to pay anywhere between 500 to 5 million in a ransom payment.
8:19
And I go back to the company going,
8:21
if you would have spent 200K,
8:24
you could have avoided that $5 million payment.
8:26
And the other mystery that people are realizing is
8:29
insurance companies are waking up and going bankrupt
8:34
because they're paying these ridiculous ransoms
8:36
and they can't afford it.
8:38
So two or three years ago, companies like I have insurance.
8:42
If I get hacked, I pay the ransom.
8:44
The insurance company covers it.
8:46
We're good.
8:47
In the last two years, insurance companies like wait a second.
8:50
We can't afford to be paying out $80, $90 million a year
8:54
because 10 or 12 of our clients have ransomed.
8:57
So now they're getting so much more particular.
8:59
And we're seeing a lot of ransom payments
9:01
where the insurance company is coming in going,
9:03
nope, you fail to meet the policy.
9:05
And therefore because your systems weren't up to date,
9:08
we're not paying.
9:09
It's the example I give with life insurance.
9:12
Most people go in on their life insurance policy
9:15
and they check the box, I don't smoke.
9:16
Yeah.
9:17
Well, you realize if God forbid something happens
9:20
and you pass away and they go in and subpoena your credit cards
9:24
and see that you go to a cigar bar even four times a year,
9:28
they're going to go in and say you smoke
9:29
when they're getting the policy.
9:31
And we're seeing that same thing with corporate policies
9:34
where they're going in and saying every system must be patched.
9:38
Every system must be up to date.
9:40
And then the insurance company goes in after a major breach
9:43
and says, well, you have three servers that were in patch.
9:46
Now, they have nothing to do with the breach.
9:48
They want an isolated network.
9:50
But because you failed to adhere to the contract,
9:52
they're not paying.
9:53
And now the company has to eat that $5 million.
9:56
Listen, I have an issue with security
9:59
with insurance companies.
10:00
Yes, I know.
10:01
That's how we hold it.
10:02
We could obviously spend the whole show on that.
10:04
But if an insurance company is that particular
10:07
about enforcing a policy, which I know they are,
10:11
I feel like it's very easy for an insurance company
10:13
to screw a business over.
10:15
Because, and the insurance company,
10:16
they'll never call it screwing a business over.
10:18
But for the average small business owner,
10:21
say, sub 10 million, OK, maybe they have somebody
10:26
who is responsible for IT, maybe not.
10:28
Maybe they have, maybe they have, it's outsourced.
10:31
It's very hard to keep track of absolutely
10:33
every single thing that is required in an insurance policy.
10:38
So, I mean, I don't know what the solution
10:40
for that is outside of just being very diligent.
10:42
But I guess the real solution is business cybersecurity
10:47
is really just educating humans on best practices.
10:51
Because, you know, an executive that gets compromised
10:55
or responds to a phishing email
10:57
or clicks a link in a text for whatever reason,
11:00
even though they shouldn't be clicking it,
11:02
or they do something that, you know,
11:05
it doesn't, they should pay a little bit more attention,
11:08
but it's not, it doesn't seem like it's a big deal
11:10
when they get that email.
11:11
It doesn't seem like it's a big problem
11:12
when they ask for this person's phone number
11:14
or this person's contact information.
11:16
It does, it kind of seems normal,
11:18
and then they're not trained, and they just do it,
11:21
and then that leads to the breach,
11:22
and then you have to deal with insurance.
11:24
So it's much easier, I think, to educate your team
11:27
and your staff on best practices,
11:29
and really that all cybersecurity issues
11:32
are really just human issues.
11:34
Bingo, at the end of the day.
11:35
They're hacking individuals, not really the servers,
11:39
and my general advice, once again,
11:42
this is what I do, and I'm not actually giving advice
11:45
when I would come after me,
11:46
but I don't actually have cyber insurance,
11:49
even though I'm a cybersecurity company,
11:51
but I have a ENO and Arizona emissions umbrella policy,
11:56
which if something really bad happens,
11:58
because I don't want to lose the business.
11:59
If something really bad happens, it's covered.
12:03
If I make an error or mistake,
12:04
but I don't have anything specific
12:06
because for me, an ENO policy is about 5,000 a year,
12:12
that's for a $10 million cover, which is good.
12:14
But if I tried getting cyber insurance very particular,
12:18
it would be about 45,000.
12:20
So to me, you get the general coverage
12:24
to protect losing the entire business,
12:26
but you focus in on then implementing,
12:28
and like I said, the other biggest thing,
12:30
and I know it's far into a lot of folks,
12:33
but passwords are the one problem.
12:35
The next one is embedded links.
12:37
So at our company, any email that comes in,
12:42
all the embedded links are turned off.
12:44
We do straight tax messages
12:46
because the number one vector of attack, as you said,
12:48
is you get social engineered, right?
12:50
You get the message, you, the Florida one.
12:52
There's a toll that you need to pay, right?
12:55
And the idea is that the toll is,
12:57
oh, it's $9.75.
12:59
So people are like, oh, not a big deal,
13:01
but they want to get your credit card
13:02
and personal data so they can do more damage.
13:05
What if you turn those links off?
13:07
What if now when you get an email from Amazon
13:09
or your bank, the link cannot be clicked?
13:12
So now what you have to do is say, okay,
13:14
Amazon sending me a message, I need to go into the app.
13:18
Apps are really secure, links are not.
13:20
So I go into my app and I check and see,
13:22
oh, is there a problem with my order?
13:24
Well, if I get a message from the bank,
13:26
then a link can't be clicked.
13:28
It's turned off.
13:29
You can automatically do this in your email client.
13:30
Super simple, a Gmail or anything like that.
13:32
Gmail or anything else.
13:33
You just turn off embedded links for everybody
13:35
and then you go in and say, okay,
13:37
let me open up the app for my bank and check it.
13:40
You go in and do that,
13:41
when you turn off embedded links across your company.
13:44
Once again, huge vector of compromise
13:46
completely removed and taken away.
13:48
So this is, I'm assuming what most people fall victim to.
13:53
And when they click that,
13:55
when they get a text saying that they owe a $9 toll
13:58
or they get an email from what looks like to be a very,
14:03
it looks like Amazon or it looks like Google.
14:06
And they click that link.
14:09
Are they already compromised?
14:10
What happens next?
14:12
So it's what I sort of call the double whammy.
14:15
So the first thing they do is as soon as you click on that link,
14:19
it does what we call a drive-by download.
14:21
It's drop in malware on your device.
14:25
Then, so even if you then go in
14:28
and you get to the login screen
14:29
where like ask you to enter in your name
14:31
and a credit card and all that,
14:33
even if you say, oh no, no, this is bad,
14:35
you're already compromised.
14:36
Then what they try to do is get you to enter in credit card,
14:40
bank info or other data.
14:42
So then they can steal your credit card
14:45
and then do charges.
14:46
So it's sort of a double
14:47
when they want to monitor your device and also do that.
14:50
And a perfect example of this,
14:53
and it's a shame it got buried,
14:55
but a few weeks ago, on a Friday evening,
14:58
we had the largest password breach
15:01
in the history of the internet.
15:03
It was close to 40 billion passwords.
15:07
But here's the thing that makes it so interesting.
15:10
Every other password breach prior to that
15:12
was a company getting breached.
15:14
If you remember the Marriott breach,
15:16
that's where they went in
15:18
and took all the passwords from Marriott.
15:20
But in this case, they didn't compromise Microsoft
15:24
or Amazon or Facebook.
15:26
What they did is they compromised
15:29
over 30 million devices
15:31
with exactly what you're talking about.
15:33
And they stole the passwords from individual devices.
15:36
So this is sort of the first breach
15:39
that says what I was saying is true
15:40
where they're compromising individual devices.
15:43
Now me mean, if 30 million devices
15:46
all had their passwords stolen,
15:48
that means most devices are already compromised
15:51
and already have malware on it.
15:53
And unfortunately, the story got buried
15:55
because what happened within 24 hours
15:58
was the attack on Iran.
16:01
And of course, for some reason,
16:03
that gets more news coverage.
16:05
Now let's just be honest,
16:08
attacking another country
16:10
with bombs and all that stuff
16:12
doesn't impact you and me on a regular basis.
16:16
But having our devices compromised with passwords
16:20
does yet the media just is more focused
16:23
on the global than on the individual.
16:25
So two things you need to do there is one.
16:29
And I know a little bit of an inconvenience,
16:31
but once a year,
16:33
I actually re-image my smartphone
16:36
because this way, if there's malware on it,
16:39
it's not gonna be their most phones
16:41
are compromised for years.
16:43
And people have no clue.
16:45
So if you just do a re-imaging,
16:46
that's gonna help and that's super simple.
16:48
And then the second thing is,
16:50
delete apps you haven't used in 30 days.
16:54
I don't know if you're like you,
16:55
but most of my friends,
16:56
you look at their phone and it's like,
16:58
boom, of course.
17:00
It's like hundreds and I ask them,
17:02
I'm like, when was the last time you used this app?
17:04
I have no idea.
17:05
Well, here's the thing, if an app's on your phone,
17:08
even if you're not using it,
17:09
it can still have malware,
17:11
it can still infect your system.
17:12
The app can be compromised.
17:13
The app can be compromised,
17:15
but here's the good news.
17:16
If the app is compromised and not the device,
17:19
if you delete the app, the malware goes away.
17:23
It's tied to the app, not the phone.
17:25
So one of the things that I always do is any apps
17:28
you haven't used in 30 days, delete,
17:31
and I'll give you a challenge.
17:33
It sounds crazy, but I'm doing it.
17:35
Run your life on less than 10 apps.
17:38
On my phone, I only have 10 apps.
17:41
I love it.
17:42
And now the probability,
17:43
because I check my phone and I run advanced
17:46
malware and stuff on the malware analysis tools,
17:49
and it's not compromised, because here's the reality.
17:52
Your mainstream apps, like your Uber,
17:56
your Amazon and all those,
17:59
I mean, they are so tight, they have so much security,
18:02
they're so locked down,
18:03
those are not going to have malware in them.
18:06
But it's all those free apps that you get from who knows where,
18:10
and a great example is one of the number one downloaded apps
18:14
over the last 10 years is this flashlight app,
18:18
where you can actually go in and make it like a flashlight
18:20
or a strobe light or neon lights,
18:22
which people really love for concerts
18:25
and parties and stuff, it's super cool.
18:27
If you actually go in and look at it,
18:29
it's actually made in China.
18:32
And we've shown that there is some backdoor monitoring
18:36
in that, but people download apps,
18:38
they don't look at where it's from,
18:39
they don't look at any of those features,
18:41
and here's the reality.
18:43
You could live your life without that.
18:44
You don't really need a strobe flashlight app.
18:47
We're talking about an iPhone,
18:49
which is pretty secure in terms of like,
18:52
it's pretty safe in terms of cybersecurity,
18:55
compared to like a lot of like Windows devices and whatnot.
18:57
Like iPhone is pretty secure and say,
18:59
like on my Mac, I'm sure I have Chrome extensions right now
19:03
that have malware built into them.
19:06
And on top of that, all of my credit cards
19:08
and all of my information is like saved in my browser as well.
19:12
So I mean, you're just, yeah, I'm saying it,
19:14
and I'm like, shit, like I think that I'm pretty smart
19:18
about technology and I'm still doing dumb stuff.
19:21
So I can only imagine what the average person
19:24
who didn't spend their life in tech downloads,
19:27
uses, doesn't pay attention to.
19:29
Now, and you nailed it.
19:31
When you get a brand new iPhone,
19:33
and I take it out of the box and I turn it on,
19:37
I'm careful with saying this,
19:40
but it's very close to unhackable.
19:42
I mean, it is really, I mean, Apple does an amazing job.
19:45
I mean, they really lock it down,
19:47
but I compare it to buying one of the safest vehicles,
19:50
which is Volvo.
19:51
I think Volvo was still considering one of the safest vehicles.
19:53
When you get that brand new Volvo, it is a safe car.
19:56
It is very, very safe and secure.
19:58
But if I go in and do something stupid,
20:01
where I go in and have substances I shouldn't have
20:04
and I drive it 100 miles an hour and I run a red light,
20:08
you can still get injured.
20:09
You can still get damaged.
20:10
It's the driver that makes the vehicle unsafe,
20:14
not the vehicle.
20:15
And the same thing with an iPhone is,
20:17
if you just take that iPhone and you install five or six apps
20:21
from trusted sources, you're doing great.
20:23
But it's when you start putting all the free, free, free,
20:26
and you've probably heard this, free is not free,
20:29
you're the product.
20:30
So when you go in and say, I'm doing free,
20:33
it's tracking and here's a fun thing.
20:35
Go into your iPhone, go under settings,
20:39
go under location tracking and look at all the apps
20:44
on your phone that are currently tracking your location.
20:46
I will guarantee that you're probably going to start
20:49
saying four letter words like, what?
20:51
Because most people have no clue.
20:53
I do this at events and I'll just randomly grab
20:56
somebody's iPhone and I'll look at their location
20:59
and there's 30 apps and they're sitting
21:01
going, I had no clue this and this.
21:04
But we are being spied on and tracked
21:06
because of all these free apps.
21:07
So is the worst possible outcome with all this malware,
21:12
the drive by malware, the accidentally putting your credit
21:15
card number in or using an app that's free
21:17
or downloading a Chrome extension
21:19
or all these sort of like bad practices that people do?
21:25
Is the worst outcome somebody taking 10, 20 bucks out
21:29
of your bank account every month or is there real threats
21:32
about, for example, someone going through your emails
21:35
and publishing your life online, going into your,
21:39
I don't even know, your bank account
21:40
and draining your 10, 20, 50,000 dollars,
21:42
like how real are those significant threats versus?
21:46
And I'm not saying that 20 bucks a month is good,
21:50
but I think that when people think about cyber security,
21:53
they're always stressed about, okay,
21:54
what happens if somebody takes 100 grand out of my bank account?
21:57
Or somebody posts all these naked photos of me online
22:01
and then my life's over.
22:03
What is real, what's a real threat and what's not?
22:06
So they're all real, what it comes down to,
22:09
what I call sort of the funnel.
22:11
So if you started, or maybe a pyramid's better,
22:13
so you start at the bottom and the number of people
22:17
that have five or 10 dollars being stolen,
22:20
tracking location, doing basic things like that
22:23
is very high, very high percent.
22:26
But what happens is over time,
22:29
if they're stealing 10 dollars from you
22:31
and you don't know it's for a year or two,
22:32
at some point it will escalate.
22:34
And now that becomes a smaller number,
22:36
but it can still happen where you can have
22:38
your bank account wiped out.
22:40
We see corporate espionage all the time
22:42
where they'll break into the email of a COO or CEO
22:46
and they use that to do competitive analysis,
22:49
the steel trade secrets.
22:50
I think I told you I do expert witness work.
22:53
It used to be one case every few years.
22:57
This year I actually have four cases
22:59
in which that happened where a competitor broke into the email
23:04
and stole trade secrets.
23:06
And then when they went in and investigated,
23:08
because the good news is if you're looking,
23:11
they can't cover up their tracks very well
23:13
so you can tell it happened,
23:14
but they find out after the factor in one case
23:17
I'm working, this company has been noticing
23:20
that every time they go to release a new product
23:23
and they have pricing and they have this campaign,
23:26
one of their competitors releases almost the similar campaign,
23:31
I mean, similar advertising, similar messages
23:33
a month before them and captures the market share before them
23:37
and then they lose significant money.
23:39
And after four or five times they said,
23:41
it's not a coincidence and they brought us in
23:44
and we went through the logs and the intrusive detection
23:46
everything and we're like, yep, sure enough,
23:48
they've been breaking in and monitoring that
23:50
and they just had no clue that could happen.
23:53
The other thing that is less likely but it's still happening
23:57
and to me it's probably the most horrific thing
24:00
is your children being abducted and targeted
24:05
and it's terrifying.
24:06
Do you know the United States?
24:08
I mean, we're one of the biggest countries superpowers.
24:11
We have the highest rate of child targeting
24:15
and being abducted than any other country in the world
24:19
because we're so reliant on tech
24:22
and the way they do this is and this is why it's apparent.
24:25
I'll go on my soapbox for a second.
24:27
As a parent, you need to watch your kids devices,
24:30
lock them down, follow them on social media
24:32
because what these attackers do is they go in
24:35
and they'll find pictures or now with AI,
24:38
they'll do deepfake, they'll generate an 18 year old
24:41
that doesn't exist and they'll start targeting your child
24:44
following them on Snapchat or TikTok or others.
24:48
If fake person and they build a relationship with them,
24:50
oh, hey, how you doing, and they do this for a year or two
24:53
and then they go, hey, my parents and I are coming to Virginia
25:00
on a trip, we've been following each other
25:03
for two years, we're really good friends.
25:04
I feel like I know you, hey, do you wanna meet up
25:07
for coffee or do you wanna meet up
25:09
and just say hi and meet each other in person
25:12
and not all but a high probability of kids
25:14
like sure, it's trustworthy.
25:16
If they drive, they don't always tell their parents
25:19
and then they go and get targeted and get abducted
25:22
and then the unfortunate part is once it happens
25:26
because they're so good, it's very hard
25:30
to get the child back afterwards
25:32
but if you can prevent it and monitor and tell your kids,
25:35
hey, don't ever meet up with somebody,
25:37
track carefully who you're monitoring
25:39
and parents get more involved,
25:40
we can actually stop that from happening.
25:42
Now yes, it's not everyone but it's a big enough percent
25:46
that we're not at the top of the pyramid
25:48
that this is happening all the time
25:50
and it's about monthly where I'll actually get a call
25:53
from a parent where that type of activity happened
25:56
and they're like, what can we do?
25:58
And I'm like, unfortunately it's an area
26:00
where prevention is ideal but once it happens
26:03
it's very hard after the fact.
26:04
So you were talking from $10 to some very serious things
26:09
for you and your family.
26:10
So we were first and I've listened to a couple
26:13
of your interviews and you started in the CIA in 1990.
26:16
Yes, yes, okay, so when you started in the CIA
26:20
there was no internet, there was no worldwide web
26:23
the way that we understand it today.
26:26
Google was what, 96, 97?
26:29
Google was 97, Amazon was 98.
26:32
Smartphones, Apple, the smartphone didn't come out
26:36
until 2007.
26:37
So yeah, you're really, like I was there before.
26:40
You were there before all of it.
26:41
So you saw the internet sort of come into fruition.
26:47
You saw smartphones, you saw this technology being built
26:50
and we were leading the way and we're creating,
26:53
you know, this incredible infrastructure
26:55
before the rest of the world.
26:57
But then you're saying that we got lazy
27:00
and that we didn't do a good job of understanding
27:02
what we were really creating and sort of giving to our population
27:06
and we're not giving them a rule book on how to use it.
27:08
And this is what the, and I'm surprised that,
27:12
I mean, I'm surprised that the people that led the way,
27:15
I don't know, I'll say it in terms of technology and innovation,
27:19
why don't we lead the way with security and protection
27:23
and not just building first but building best?
27:27
It's one of those, it's the unfortunate reality.
27:30
Functionality always leads and security follows.
27:36
Great example is if you look at automobiles.
27:39
Automobiles came out in the 50s and 60s.
27:42
Seat belts weren't actually a thing until the 70s.
27:47
And I remember growing up,
27:49
I don't know if you follow Ralph Nader,
27:51
but he was sort of unsafe at any speed.
27:53
He was the one that really pushed that
27:55
and it's crazy because I was born 1970
27:59
and I remember when I was six and seven years old
28:02
that people were so infuriated against seat belts.
28:06
People were cutting seat belts out of their car.
28:09
I mean, people were not wearing seat belts
28:10
because they were like, this is crazy,
28:12
but they didn't realize it saves lives.
28:14
Now today seat belts are normal, airbags are normal,
28:17
but it wasn't when they first came out and unfortunately,
28:20
that's how a lot of people think functionality leads.
28:23
And I remember in 92, when the web came out,
28:27
I was one of the biggest critics of it
28:30
and I got a lot of negative criticism.
28:32
I mean, I got death threats and stuff
28:34
because I was like, listen,
28:36
we can't release this without the security embedded.
28:39
Now, eventually down the line,
28:42
your SSL, secure socket layer, transport layer security,
28:45
all those came out, but I'm like,
28:47
we should delay releasing the web
28:50
until those features are there
28:52
because most of the early websites were trivial.
28:56
Like before 2000, I mean, you could deface or break,
29:00
I mean, it was like the example I give is,
29:03
it was like people where they have their doors unlocked
29:07
and their windows open and you know they go to work
29:12
from dying to five in the office.
29:13
So I mean, it would be trivial
29:15
if you wanted to walk around the neighborhood.
29:17
Nobody had alarms, nobody had that.
29:19
I mean, that's to do whatever you want.
29:20
That's how it was with the web and unfortunately,
29:22
because we got so much money and so much value and benefit.
29:26
Today, there's still a lot of people
29:28
that essentially have their doors unlocked
29:30
and their windows open on the internet
29:32
because they just don't realize how bad it is.
29:35
So you've given some really good tips.
29:36
The average person's listening to this is now stressed out
29:39
and they're wondering how to go through life now
29:41
with all these people trying to abduct their kids,
29:44
God forbid, steal their money,
29:45
all these other horrific things.
29:47
What are some other things that they can do?
29:49
Like how do you navigate life
29:50
without being paranoid all the time?
29:52
So I always joke, not to my level,
29:56
but a little dose of paranoia.
29:57
It's not a bad thing, right?
29:59
It's good to have that and remember, in the real world,
30:03
we tell our kids, don't take candy from strangers,
30:07
don't go in car with strangers, look both ways.
30:09
I mean, there's a little paranoia.
30:11
And my favorite example, nothing against these companies
30:13
because I use them.
30:14
But when I was growing up,
30:16
my parents would always say, and they teach you in school,
30:19
don't get in a car with a stranger.
30:21
Don't get in a car with a stranger.
30:22
Don't talk with a stranger.
30:24
Today, we not only get in a car with a stranger,
30:27
but we pay them.
30:29
Coming over to your interview,
30:30
I got in a car with a stranger.
30:32
I have no idea who this person was.
30:34
They could have been targeting me or abducting me.
30:37
We have no idea, but our standard has gotten crazy
30:40
where we went from not getting a car with strangers
30:43
to now putting 10-year-olds in cars with convenience.
30:46
As a convenience.
30:47
And we're so obsessed with convenience
30:51
in real life with Uber or Lyft or whatever,
30:55
or in cyber life with the latest app
30:58
that lets us strobe our philosophy.
30:59
We're so obsessed with convenience
31:00
that we forget about safety and security.
31:02
Because we're like, oh, that can't happen to you.
31:03
That happens to other people.
31:04
That's not gonna happen to me.
31:05
Right?
31:06
There's stories about people that have gotten to Uber's
31:08
and are abducted and killed.
31:10
But millions of people get into Uber's every single day.
31:12
Now, here's where I'm sort of a practical security guy.
31:15
Is, I'm not gonna sit there and say, don't use Uber.
31:18
I use Uber, but here's two things you can do.
31:22
You can go into Uber and you can check the settings
31:25
to only get Uber's that have five star ratings
31:30
and have been on Uber for two years.
31:32
Because here's the reality.
31:33
The ones that are getting abducted
31:36
are ones that are brand new.
31:38
It sees Uber drivers that do it a month,
31:40
they're targeting somebody,
31:41
they're trying to hijack or take over.
31:43
So you just go in, it takes 10 seconds to go into Uber
31:47
and just up the settings.
31:48
And then the other thing that very few people do
31:51
that's so important, check the license plate.
31:54
Like, I watch an airport and I see so many,
31:57
I'm a observer and awareness.
31:59
I see so many people, the car pulls up
32:02
and they're like, oh, it's supposed to be a great Tesla.
32:04
And they just get in and they never check with me.
32:07
I always walk around to the back and check the license plate.
32:11
And then I check the picture of the drive,
32:13
you always do some verification.
32:15
So it's one of those where it's not avoiding it.
32:19
It's just adding in a little healthiness.
32:21
The other thing, and I don't promote it,
32:24
I probably should get stock in the company.
32:27
But one of the things is I basically live my life
32:31
on an iPad.
32:33
Now here's the reason.
32:34
An iPad is a simpler operating system.
32:37
Most of the malware that you see that does the drive by downloads
32:42
are impacting Windows or MacBooks
32:47
because those are much more complex operating systems
32:50
and it's much easier to exploit.
32:52
Very few of those exploits will actually run on an iPad.
32:55
So now, even if I've slapped you for some reason,
33:00
and I go in and click on it like I'm not supposed to,
33:03
the malware will drop, but it won't run
33:05
because an iPad is simpler.
33:06
So it's a little bit of an inconvenience
33:09
because it doesn't have the full functionality.
33:11
But for the last year, I don't use Windows anymore
33:14
or MacBooks because I even make mistakes.
33:17
I'm tired and I would get infected.
33:19
Like the one that I would always get hit on is mistyping.
33:23
So an example of it is about a year and a half ago,
33:28
it was like 10 o'clock at night, I'm a morning person.
33:31
So I'm usually in bed by night,
33:32
but I'm working with the client
33:33
and they're like, Eric, we need to have a meeting
33:36
the next morning.
33:37
So I go in to my home computer
33:41
because I didn't have all the apps
33:42
and I go to type in go to meeting.
33:45
But I go in and I mistype and I would go T meeting.
33:50
I left out an O because I'm tired and typing little quick.
33:53
Attackers register all the similar domain names.
33:56
So that went to a malicious site, infected my computer
34:00
and then I had to spend the next 24 hours.
34:03
Don't do this.
34:04
But if you go to goo, like GOO, GLE, it's malware.
34:10
If you go into sort of GOO, GLE, it's malware.
34:14
They register all these similar domains.
34:17
How can a domain registrar not just do a scan
34:21
of all the domains and then start like sending a list
34:24
to the FBI just to like shut them down themselves?
34:28
Is it a money thing?
34:29
So here's the problem.
34:31
We know who they are.
34:33
Yeah, it sounds like we know who they are.
34:35
Here's the problem.
34:36
They're in Russia.
34:38
They're in Iran.
34:39
They're in North Korea and there's China.
34:41
Now, there's something interesting about those four countries.
34:45
One, it's not illegal to hack outside the country.
34:49
So if you're in Russia and you're hacking outside the country,
34:51
not illegal.
34:52
Second, they don't have extradition treaties with the US.
34:56
So we know who they are.
34:58
We can go in and here's the crazy thing.
35:00
We go in and block them.
35:02
So we find out and we block them.
35:04
But then what do they do?
35:05
They pop up again.
35:06
So they'll go in and they'll do Google with three O's.
35:09
We block them.
35:10
They'll do great outside the US.
35:12
And they just keep doing it.
35:12
This is why we were talking before the show.
35:16
You asked what I'm working on.
35:17
What are my big projects?
35:19
And this is probably a 10 year plan.
35:21
I believe in having 10 and 15 year targets
35:24
is to have global laws on cybersecurity.
35:27
Because we have to remember in the real world
35:29
there's physical boundaries.
35:31
When I go to Russia or Canada,
35:34
I have to go through custom control.
35:36
I have to go through passport.
35:37
They check and verify and then I have to follow those rules.
35:39
If I'm in Russia and I break the law, I go to jail.
35:44
But the reality is if I'm in the US
35:47
and I go to Russia over the internet where there's no boundaries,
35:51
there's no jail, there's no law, there's nothing there.
35:53
So we have to recognize we live most of our lives in cyberspace
35:57
and there's no countries, we're one world.
35:59
And then when you're surfing the web,
36:02
do you realize you could be going to data centers
36:04
in the Philippines and you have no clue?
36:08
So to me, unless we have global laws on cyber
36:12
where countries cooperate, participate
36:14
and there's arrests and extradition,
36:16
this problem's not going away any time soon.
36:19
Having global laws on cyber would be great.
36:22
But that's assuming that Russia and China
36:24
are going to adopt those laws.
36:26
I think you could get like NATO to adopt
36:28
global laws on cyber.
36:30
I don't think that would be a stretch.
36:32
But Russia and China, that's going to be a stretch.
36:35
North Korea, they're just never going to do it ever.
36:37
I mean, unless I'll tell you right now,
36:41
if we went in and I'm trying to push this with the White House,
36:45
but but cyber secondary, no guarantees.
36:49
But I'm pretty sure if we want to rush a right now,
36:52
sorry, if we went to China right now and said, listen,
36:56
will zero out your tariffs?
36:59
If you agree to a global law on cyber,
37:03
I'm pretty sure that's a good negotiating stick.
37:05
So if we just went to them with no monetary value
37:10
or benefits of the country,
37:11
but these tariffs that we're talking about now,
37:14
I mean, huge impact to China.
37:17
And if we negotiated lower tariffs for signing a cyber internet,
37:21
I'm pretty sure they would listen.
37:24
It's interesting, because I've had a few people on here
37:28
that also, one of the co-founders of CrowdStrike, Dimitri.
37:34
Oh yeah, I'm good friends with George and Dimitri.
37:36
They're my buddy, you're so good guys.
37:38
And he writes a lot about China and he speaks about China.
37:40
Oh yeah, he's really big at China.
37:42
Very big on China.
37:43
And basically his thesis is anything that isolates China
37:49
is actually not good, because the best way
37:52
to sort of quote unquote deal with China
37:54
is to work with them more
37:56
and get them more ingrained into the US, basically,
38:00
as opposed to isolate.
38:02
That was his thesis, at least.
38:03
I don't know if I'm not a geopolitical expert by any means,
38:07
but it's sort of dovetailing off your point
38:12
where you're saying if we can negotiate tariffs
38:15
and sort of like come to some sort of agreement,
38:18
then we can get them to play ball with cyber security,
38:20
which could be an interesting point.
38:21
And it's really just finding ways
38:23
to get a little bit closer to them
38:26
so that we can get them to do what we want them to do
38:30
as opposed to saying these are tariffs,
38:32
which really isolate them to a degree,
38:34
which in his argument is not a smart way to deal with China
38:38
because then they're kind of like removed from the US
38:40
or left to their own devices.
38:42
They find ways to do business and to exist without us,
38:46
even more so than they already do.
38:48
And that could be more dangerous than keep your enemies closer.
38:51
I don't know, that's the right thing,
38:53
but that's the way that that's an interesting perspective.
38:56
But I don't think it's the worst perspective
38:58
because if they have no cyber laws,
39:01
I'm sure that you have some sort of idea of,
39:05
okay, tariffs are good for maybe some sort of financial benefit
39:09
to the US, but what does it cost us
39:12
if we don't figure out the cyber problem
39:15
with China and Russia and all these other countries?
39:18
Do you have an idea of what the actual monetary impact
39:22
of Chinese hackers, Russian hackers?
39:26
Because you can make the argument
39:28
that if a Chinese hacker and a Russian hacker,
39:30
and I didn't realize this,
39:32
it's not illegal for a Chinese or a Russian hacker
39:34
to hack the US so they're not breaking laws.
39:37
They're not breaking laws.
39:39
What is the dollar value associated with that activity
39:42
compared to what the tariffs are, quote unquote, gaining us, right?
39:47
I mean, it would probably be pretty close.
39:49
The problem is we don't track it that closely,
39:53
but we still know, I mean, we're talking hundreds of millions
39:57
of damage from China on corporate, I mean, there,
40:00
you don't remember the country is sort of have basis.
40:02
So China is known that they don't really do direct monetary,
40:06
they do intellectual property theft,
40:08
that they want to steal our tech
40:10
so they can produce a quicker and better.
40:12
Russia is all about monetary driven.
40:13
So they're all the monetary driven ones,
40:15
and then your Iran and North Korea are more disruptive.
40:19
They're the one sort of denial of service
40:21
and those types of things,
40:22
but now I, I'm very aligned with sort of Demetrius
40:25
and we've had this conversation,
40:27
and I was one of the ones that was sort of
40:30
in the minority of banning TikTok.
40:33
Like I, I thought this whole thing of banning TikTok,
40:37
not allowing people to do TikTok,
40:38
is about one of the stupidest things on the planet
40:40
because you know how many Americans make their livelihood
40:46
and living and run businesses on TikTok.
40:49
So you are impacting Americans so bad by doing that.
40:53
I mean, it was estimated that just that 24 hours,
40:56
if you remember, where it was down,
40:59
that that cost people at least $10 million
41:02
because they couldn't run their businesses,
41:04
or couldn't do anything.
41:05
My whole thing was don't isolate China and say you're evil,
41:10
and we're gonna ban you because it hurts America.
41:12
What I said was negotiate, go with China, listen.
41:16
If you wanna keep running TikTok, okay,
41:19
but you have to adhere to these privacy laws.
41:21
You have to go in and start putting your servers in the US,
41:26
not in China, and they would have been open to all that,
41:30
but instead we take this harsh, you know,
41:32
I mean, enemy thing where we wanna fight with everybody
41:35
and just ban them, I'm like, that's the silliest thing.
41:38
Let TikTok operate, but make them adhere to our rules
41:41
and privacy so it can actually be a net positive,
41:44
not a net negative.
41:45
There was the argument around TikTok saying
41:48
that it's trying to influence like a younger generation
41:51
with suggesting certain content.
41:53
I understand why that's concerning.
41:54
So is Mark Zuckerberg?
41:55
I mean, Mark Zuckerberg.
41:57
I mean, Mark's a brilliant guy,
41:59
but do we trust Mark?
42:01
Well, do we trust China?
42:02
I mean, no, Instagram is very toxic for like, you know,
42:06
the young person's mental health is not great at all,
42:10
but I was gonna make the argument that, listen,
42:14
if China, you know, I was stressed out about having TikTok
42:17
and it's a Chinese app, and from what you're talking about,
42:21
if it's not illegal to, as a Chinese national
42:25
to hack the US, they don't need TikTok.
42:28
They're not, they're not using TikTok.
42:30
It's gonna hurt us more than it hurt staff everyday.
42:32
Get rid of TikTok tomorrow,
42:34
and just as many people's phones
42:35
are gonna be compromised with malware.
42:37
Bingo, you, can you run for political office?
42:40
Cause we, we need people like you with, in Congress and stuff,
42:44
cause, cause this comments say, nothing against them,
42:47
but a lot of the folks in Congress and others
42:51
are in their 60s.
42:54
It's alarmists.
42:54
They, they're very stupid.
42:55
They just don't understand the tech,
42:57
and it's like, guys, we gotta wake up
42:59
and one other, just alarming statistic
43:01
that people don't realize is we are the only country
43:06
that doesn't have unified federal laws
43:10
on data privacy and cybersecurity.
43:14
Most of our laws right now are California
43:19
is the most aggressive with New York secondary,
43:22
and because most companies have, have people
43:27
or customers from California,
43:29
they have to follow the California laws.
43:31
This is CCPA, right?
43:32
Exactly, but California is really driving it.
43:35
The federal government doesn't have it.
43:37
I mean, Europe, GDPR.
43:38
GDPR, yeah, I mean, you're educated.
43:40
You know this stuff.
43:41
We don't, why don't we adapt GDPR?
43:43
Why don't we have federal laws?
43:44
We don't have federal laws to protect our citizens,
43:47
which is insane.
43:48
Canada, we have Kanspan.
43:49
Exactly.
43:50
Every other country has federal laws
43:53
on data privacy.
43:54
I don't know why that, you know, it's so funny
43:56
because coming from like an entrepreneur, business,
44:00
background, it was always frustrating these laws
44:03
because it meant that I couldn't solicit people.
44:05
I couldn't send them cold emails, right?
44:07
So I'm like, oh, I can't send a cold email
44:09
to somebody in Canada unless you have
44:10
a previous business relationship
44:12
because, you know, then it could be marked as spam,
44:14
and there's like significant fines.
44:16
Same with Europe, same with California,
44:19
but it was so wild to me as a Canadian,
44:22
I could send spam emails to almost anybody
44:25
in the US, nonstop, and as long as I give them the option
44:29
to unsubscribe, and as long as I'm not lying to them,
44:32
it's all good.
44:33
And that was like, that was wild to me.
44:34
That was so wild.
44:35
And I think that, you know, it's gotten so bad
44:39
that, and it's not just spam emails.
44:42
Like when I'm trying to, you know, sell a product,
44:45
okay, maybe being a little bit selfish,
44:47
I'd like to send a cold email to somebody,
44:49
but on the receiving end of it,
44:51
like I can't use my phone anymore.
44:53
It's just on do not disturb nonstop
44:54
because my number has been farmed out so many times.
44:56
I can't use it.
44:57
I can't use my phone to receive an incoming call.
45:00
I have to, like I have to leave it on do not disturb.
45:03
At the end of the day, I'll look through all my voice mails
45:05
and my calls, maybe two voice mails,
45:06
and people that I actually care about,
45:07
maybe 40 calls from spam and this and spam that.
45:11
And I know there's apps that kind of fix it,
45:13
but it's not perfect.
45:14
And even my email, I probably get 100 spam emails a day now.
45:22
And it's almost to the point where I'm like,
45:23
should I just start a new email and then give that email
45:26
at the people going forward?
45:27
Like it's ridiculous how much spam.
45:29
And now text has started too.
45:31
I get spam texts all the time as well.
45:33
So I mean, yes, some regulation would be good.
45:37
And I'm talking from like a business perspective,
45:39
I think some regulation would be good.
45:41
Forget the personal privacy, data security perspective,
45:44
which is a whole other level of why regulation should be good.
45:47
I didn't realize that we didn't have anything at all.
45:50
I was aware that it's easy to reach out to somebody
45:52
without having a prior business connection.
45:55
I didn't realize that there's no safeguards
45:57
for data and privacy.
45:59
Because I guess they all kind of fall
46:00
under the same thing.
46:01
Exactly.
46:02
Yeah.
46:03
And to me, I mean, there's a balance.
46:04
Yes.
46:05
Like one of the, I mean, I constantly am sending emails
46:09
to Congress and they probably think I'm spam.
46:11
So they might delete it.
46:13
I'm right, laws for them.
46:14
And here's one of the simple laws is if you're sending
46:18
a message, text or email that is soliciting information
46:24
with links like credit card or false information or false data,
46:27
that's illegal.
46:29
But if I'm going in and informing you
46:31
about a product or solution that might be of interest to you,
46:36
I think that should be OK.
46:37
But I don't have to be a limit too.
46:38
Yeah, there has to be a limit of how many you do.
46:41
But I think there could be a balance where you don't have
46:42
to say because to me, there's a difference
46:45
between a cold email and spam.
46:48
I agree with that completely.
46:49
And unfortunately, we're trying to bundle them together,
46:52
which I think would hurt businesses,
46:53
because I don't know about you, not all of them.
46:55
But there's times where I receive a cold email.
46:59
And I'm like, cool.
47:00
I didn't know that existed.
47:02
And you do it.
47:03
So I think there has to be this balance here
47:05
where we're trying to do these extremes of all or nothing.
47:07
But I think middle of the, I mean, balance
47:09
is one of my favorite words.
47:10
Middle of the road is where we need to get to with security.
47:13
Quick question.
47:14
What's your go to when you got 10 minutes before a meeting
47:17
or a workout?
47:18
For me, it just used to be whatever I could grab,
47:20
which usually meant skipping meals entirely
47:22
or just grabbing something that left me crashing
47:25
an hour later, because it was just full of garbage.
47:27
That's why I'm partnering with Hule.
47:28
This black edition ready to drink is a complete meal.
47:31
So it has 35 grams of protein, six grams of fiber,
47:35
35 essential vitamins and minerals.
47:37
It is no sugar added, gluten free, under five bucks.
47:41
I always keep a few of these in my fridge.
47:43
And honestly, it's solved the whole back-to-back meetings.
47:46
Go, go, go, non-stop, no time to eat problem, super well.
47:50
And this one's new for me.
47:51
It's Hule's daily greens.
47:52
I had the blueberry this morning.
47:53
Honestly, first impression, it was way better than I expected.
47:56
It's developed by registered nutritionists and dieticians.
47:59
There are 42 vitamins, minerals and superfoods,
48:01
only 25 calories, four grams of fiber,
48:04
and just one gram of sugar.
48:05
I throw one back first thing,
48:07
before my morning calls, every single morning.
48:09
Look, if you're running a business,
48:10
time is the most valuable asset.
48:12
Hule makes healthy eating simple,
48:14
and they also just launch the target source nationwide
48:16
so you can get it everywhere.
48:17
Try both products today with 15% off your purchase
48:20
for new customers with my exclusive code,
48:23
scottatwhule.com slash scott.
48:26
Try both products today with 15% off your purchase
48:28
for new customers with my exclusive code, scott.
48:31
S-C-O-T-T at huule.com slash scott.
48:35
Use my code, fill out the post checkout survey
48:38
to help support the show.
48:39
That is huule.com slash scott.
48:41
They really make healthy living tastes amazing.
48:43
Even if you're on the go, healthy eating,
48:45
healthy lifestyle, doesn't have to taste bad,
48:47
it doesn't have to suck.
48:48
Netsuite is a success story partner.
48:50
Now, every business is asking the same question.
48:52
How do we make AI work for us?
48:54
The possibilities are truly endless
48:56
and guessing is just a little bit too risky,
48:58
but sitting on the sidelines is also not an option
49:01
because one thing is almost certain,
49:03
your competitors are already making their move.
49:04
So you can't wait anymore.
49:06
And with Netsuite by Oracle, you can put AI to work today
49:09
in the right way.
49:10
Netsuite is the number one AI cloud ERP.
49:13
You're trusted by over 43,000 businesses.
49:15
It brings your financials, inventory, commerce,
49:18
HR and CRM into one single source of truth.
49:21
That connected data makes your AI smarter.
49:24
So it doesn't guess it knows.
49:25
And whether your company earns millions
49:27
or even hundreds of millions,
49:28
Netsuite helps you stay ahead of the pack.
49:30
If I needed a tool like this, I'd use Netsuite.
49:33
Now, right now, get the free business guide
49:35
demystifying AI at netsuite.com slash scott.clary.
49:39
The guide is free to you at netsuite.com slash scott.clary.
49:42
That's netsuite.com slash scott.clary.
49:45
Talk to me about your time in the CIA.
49:46
I think that's so fascinating.
49:48
Obviously, a lot has changed since then.
49:50
But I think that the CIA is just this ominous.
49:54
Nobody really understands what you can do,
49:57
what you can't do.
49:58
I know that you have interesting stories about like,
50:02
you are an incredible hacker.
50:05
So I mentioned something at the beginning
50:08
about hacking a nuclear reactor.
50:11
Why is somebody in the CIA hacking a nuclear reactor?
50:15
And what was it, 37 seconds?
50:17
So when I always joke,
50:19
it's because I believe, you know,
50:21
people need a little bit of humbleness.
50:23
I go in and I say, I am not an extraordinary hacker.
50:28
It's just most people have extraordinary bad security.
50:32
So it's like one of those back to my example.
50:34
If everyone's leaving their doors open
50:37
and their windows unlocked,
50:39
I'm not a great criminal.
50:40
It's just easy to exploit and break into.
50:44
But to answer your question,
50:45
I'm always glad you go there.
50:47
Because when I go in and say,
50:49
I'm a professional hacker
50:50
or I was a professional hacker for the CIA,
50:52
it wasn't for malicious.
50:55
It was to protect and secure on infrastructure.
50:58
So a lot of people don't realize
51:00
the 90s were in the midst of a cold war.
51:03
And we're concerned about nuclear attack
51:07
from Russia and other countries.
51:08
Well, most people don't realize a nuclear reactor
51:13
can be turned in to a nuclear bomb.
51:16
You've gone in and we've saw some meltdowns
51:19
like Fireball, I mean, that was as devastating
51:22
as if a bomb went off.
51:23
I mean, in terms of the wipeout and stuff,
51:26
so we were really concerned
51:27
and I could talk about it now.
51:28
I couldn't talk about it back then.
51:30
In the 90s of somebody hacking in
51:34
to our reactors and basically detonating it
51:37
and causing, and here's the problem.
51:39
None of our satellites, none of our Air Force
51:42
or anything would have caught that.
51:44
So my specialty is nuclear reactors.
51:47
I worked with the NRC, the Nuclear Regulatory Commission.
51:50
Most people don't even know they exist,
51:52
but they regulate non-weapon nuclear reactors
51:56
in the United States.
51:57
And I helped to write the security policy
51:59
to help protect and secure them.
52:00
So my whole goal at the CIA was,
52:04
hey, one of our big, we call them soft targets
52:07
because they're typically focused on functionality.
52:10
Nuclear reactors are all about uptime availability.
52:13
So believe it or not in the 90s,
52:15
they were running on old systems that weren't patched,
52:20
that were connected to the internet
52:21
from monitoring and tracking.
52:23
And we didn't realize how just easy and simple
52:26
it would be for somebody to break in.
52:27
So I went in and figured out how to break in,
52:30
find vulnerabilities, and then wrote regulation
52:34
that said, this is what you need to do
52:35
to protect and secure those reactors.
52:38
So it was all done from an offense guiding defense.
52:41
The only way to be good at defense
52:43
is to think and know how the offense works.
52:45
Because most people don't realize
52:47
there's no way to prove a system is secure.
52:50
I can't go in and run an algorithm that says,
52:52
okay, this is secure.
52:55
The only way you can do it is by getting smart people
52:57
trying to break in and find vulnerabilities and weaknesses.
53:01
So it was sort of that whole philosophy is,
53:04
like you said, the CIA's so misunderstood.
53:06
Our job at the CIA is, first of all,
53:10
we can't do any operations on US soil.
53:13
And too, our job is not sort of breaking and causing harm.
53:18
It's gathering, supporting to secure America.
53:20
So we sort of have, I mean, Tom Clancy, I love him,
53:23
but yeah, I mean, he sort of gives us this bad picture.
53:25
It's really a very good solid organization.
53:29
It's just misunderstood.
53:30
So you, my job there was it,
53:32
well, because it's very secretive.
53:33
Exactly.
53:34
It was in there to go in, attack,
53:35
nuclear reactors and other countries.
53:37
It was really to understand weaknesses in our system
53:40
so we could better protect and secure them.
53:42
I kind of had a slightly like a first row seat
53:45
to a similar style organization
53:49
because my dad worked for Ceasis.
53:50
Okay, yeah.
53:51
And I mean, yes, some parts of his job were exciting,
53:54
but the majority of it was actually very, very boring.
53:56
Yeah, it was very, very boring,
53:59
but it was a lot of, it was a lot of threat detection.
54:01
It was a lot of figuring out like,
54:02
what are the attack vectors enemies could use
54:04
and then stress testing those attack vectors,
54:06
you people, systems, infrastructure and otherwise.
54:11
With fast forward to today, 2025,
54:15
are these types of attacks, are these still concerns?
54:19
Like, is there ever a chance that,
54:22
because obviously that's never happened
54:23
where an enemy is hacked into a nuclear power facility,
54:27
but these kinds of sort of strange attack vectors
54:30
are these still a focus
54:31
or are there other types of attack vectors
54:33
that people like the, you know,
54:35
the North Korea is of the world who go after.
54:38
So it's one of those where we forget the past
54:42
and we get sloppy.
54:44
So the way you protect nuclear reactors,
54:47
critical infrastructure is what we call air gaps.
54:50
We're basically the critical systems
54:53
that running the nuclear reactor
54:55
are not connected to the internet.
54:57
So if you break in the servers on the internet,
54:59
there's no way that you can go in
55:02
and be able to get in.
55:03
But then what happened over the last five years
55:07
is for functionality.
55:08
Oh, we want to be able to monitor
55:09
and build everything else.
55:11
They started going in and connecting to the internet
55:14
and great example of that is the colonial pipeline.
55:19
If you remember two years ago,
55:20
now what's interesting is it only impacted the East Coast.
55:24
So like, I talked to people in Texas in California
55:28
and they're like, what was that?
55:30
That like it didn't really impact them.
55:31
I will tell you, in Virginia,
55:34
we had four days where every gas station was closed.
55:39
We actually ran out of gas
55:40
because of the colonial pipeline hack.
55:43
And I mean, it was there.
55:45
We're like, no kidding.
55:47
We're going and buying bicycles,
55:48
like we were getting concerned of how long
55:51
and when it first happened that Monday,
55:54
we went and gasped up all our cars,
55:57
15 minute wait at the gas station.
55:59
Like there were lines like back in the 80s
56:02
and then we were really cautious with driving.
56:04
But by Thursday, we're like,
56:06
this could get really ugly, really quick.
56:08
And that whole attack was caused
56:10
because they used to have air gap
56:12
and they connected those systems
56:14
to the internet for monitoring.
56:15
And then they went in and eventually broke into it.
56:19
And then the other interesting thing is,
56:20
which is the unfortunate reality,
56:22
is it's cheaper, quicker and faster
56:25
when these companies do get breached
56:27
to pay the ransom that it is to try to fix it.
56:30
So with colonial pipeline,
56:32
if they didn't pay the ransom,
56:35
it would have taken about three weeks
56:37
and they would have lost about $90 million in revenue.
56:42
But if they paid the ransom five mill,
56:44
they were up and running in a week.
56:46
So it's the unfortunate one where it's cheaper and better
56:49
and I got a lot of press on that
56:52
because the attack occurred on Saturday.
56:56
And Sunday, they're coming out colonial
56:58
and everyone's like, we're not paying the ransom,
57:00
we're not negotiating, we shouldn't negotiate.
57:03
I went on every news station and said,
57:05
they'll pay the ransom because they have to.
57:07
There's no way they can incur
57:10
the devastating impact of not paying it.
57:12
So I got a lot of criticism, it's funny.
57:15
Then Monday, Tuesday was sort of black bulls
57:17
from the media because I was like,
57:19
oh, you're raising, you know me blah, blah, blah.
57:21
And then you're mongering.
57:22
And then Thursday, when they paid the ransom,
57:25
every new station won an interview me
57:27
because I predicted it correctly.
57:28
And that's the unfortunate reality is,
57:30
our security is so behind that it's actually better
57:33
to reward the attacker than it is the self
57:36
of the curators.
57:36
It encourages it.
57:37
It encourages it because now they're going to keep doing it.
57:40
Where else are you concerned about cyber attacks
57:44
from not financially motivated?
57:48
Because financially motivated, sure,
57:50
somebody wants to make five million bucks,
57:52
they can go after any business in the world
57:53
that they just have to do a cost-benefit analysis.
57:57
Is it going to cost the business more than $5 million
57:59
to be at a business for a week?
58:02
And if they go after that, business will pay up,
58:04
easy calculation for the hacker.
58:06
But in terms of like national security,
58:09
so shutting down the power grid,
58:12
I don't know what other national security,
58:13
potentially attack vectors, there are, I'm sure there's a lot.
58:17
But what are some of the things
58:18
that you're most concerned about?
58:20
What are some of the things that, I don't know,
58:22
China, Russia, Iran, North Korea,
58:24
other bad actors around the world actually
58:26
want to hit us with the you've seen at least?
58:29
So one of the big ones is deep fakes with AI.
58:32
Yeah, that's sort of new, but that's going to be huge.
58:35
I mean, I don't watch a ton of movies,
58:38
but I like watching ones that are cyber-related
58:41
is I just saw it on the airplane G20.
58:46
And essentially, I mean, it's an interesting movie,
58:48
but the whole thing is they basically
58:50
got the 20 world leaders, including the US president,
58:54
kidnapped them, and they had them read 30 words,
58:59
and then they started creating deep fakes
59:01
of these presidents out there.
59:02
And it was like crashing world markets,
59:04
it was crashing impact, because imagine if a video came out
59:09
from FBI director to a senator,
59:13
to even the president of the United States,
59:15
that basically said, yes, we have this major thing,
59:17
and it's a total deep fake,
59:19
but people don't realize it, and they would respond
59:21
and react to it.
59:22
So this whole disinformation,
59:24
where you can basically create almost identical videos
59:28
and voice of key individuals, I mean, that terrifies me,
59:32
because people trust a video on the internet.
59:35
People trust false information.
59:37
So yeah, those deep fakes are really,
59:39
really terrifying to me of the economic impact
59:42
that could have.
59:43
How do you protect against that, though?
59:44
That's not even a hacking thing.
59:46
That's not a cyber security thing.
59:48
That's not putting an air gap
59:49
so that key infrastructure isn't connected to the internet.
59:52
That is finding a way to educate the world
59:56
that what you see online is not true.
1:00:00
I don't know how to protect against something like that.
1:00:02
That's incredibly horrifying.
1:00:03
So the way you protect against it is once again,
1:00:07
a federal law.
1:00:08
You can, there's algorithms that you can run pretty quickly
1:00:12
to see something's a deep fake.
1:00:14
What if there was a law that said
1:00:17
every social media platform had to go in
1:00:21
and run the deep fake algorithm against any video
1:00:26
that's being posted?
1:00:27
That wouldn't be hard.
1:00:28
I mean, you're talking the computing power
1:00:30
is not that intense, but you need to go in
1:00:33
and start putting out there.
1:00:34
Here's the other crazy thing.
1:00:36
I mean, this bog goes my mind.
1:00:38
If I go in and create a deep fake against the president
1:00:43
and put it out there, it's currently on our laws.
1:00:47
It's not illegal.
1:00:49
What law are you breaking?
1:00:51
There's no law that says you can't go in
1:00:54
and create, now I'm not claiming.
1:00:57
Now, if I went in and said,
1:00:59
you know what I mean, this is the president,
1:01:00
but if I went and said, here's an interesting video.
1:01:03
Why can't I create an interesting video that simulates,
1:01:06
I mean, look at all the memes out there.
1:01:08
I mean, memes are basically a funny deep fake,
1:01:12
but they're not illegal.
1:01:13
So I mean, it's crazy.
1:01:14
How can we live in a country where somebody can create fake media
1:01:19
against key individuals and there's no penalty
1:01:22
that anyone could do?
1:01:23
Why isn't there a law on that?
1:01:24
How long do you think it's going to take
1:01:26
for a lot of you passed on that?
1:01:27
Because I mean, you mentioned before
1:01:30
the people that make these laws,
1:01:31
I've watched like the Senate hearings.
1:01:35
There's people that are just so, so, so ancient.
1:01:39
People that are just old.
1:01:40
That's a good word I love.
1:01:41
I was thinking of a nice word because old is
1:01:44
absolutely correct.
1:01:45
So ancient is better.
1:01:46
Listen, they've been on this earth for a long time
1:01:48
and they're trying to make decisions
1:01:49
and pass laws about things that do not 100% understand.
1:01:52
Like I've seen it with all the social media hearings,
1:01:55
the data privacy hearings, crypto hearings,
1:01:57
like all it's, and they're just asking the dumbest questions
1:02:01
because they don't understand what's going on
1:02:02
and you're just thinking, oh my god,
1:02:04
like these are the people that are going to be creating the laws
1:02:06
and they still haven't created proper laws.
1:02:08
Unless there's some huge, you know,
1:02:11
Cambridge Analytica level media pressure requirement
1:02:15
for somebody to change, nobody does anything.
1:02:18
Like I think that, listen,
1:02:20
there's still ambiguity about crypto
1:02:24
and how long has, how long has that been going on?
1:02:26
Like there's still ambiguity about,
1:02:28
and I mean, like yeah, it's gotten a little bit better
1:02:31
and like this administration is trying to be a little bit more
1:02:35
proactive with setting up rules and regulations
1:02:37
about crypto and what, you know, what you're allowed to do
1:02:40
and what you're not allowed to do
1:02:41
and what if it's considered a security or not
1:02:43
or whatever.
1:02:44
And then there's like the whole like XRP case
1:02:46
that was like ongoing for forever
1:02:48
and that was supposed to be like, you know,
1:02:49
defining the whole category.
1:02:51
That's slowly winding down and that's,
1:02:53
but how long, what, five, six, seven years?
1:02:55
I don't even know how long has been going on
1:02:56
for forever.
1:02:57
So the point is the new tech and laws that affect new tech
1:03:01
don't, the laws don't happen quickly.
1:03:04
I mean, it's probably, I mean, the deep fake in AI stuff.
1:03:07
I know that's what's going to be at least five years now.
1:03:10
Now imagine what's going to be like in five years.
1:03:12
Now the irony is, it should be done this year.
1:03:15
Like you go in and definitely good
1:03:19
is you probably saw, I think it was like 45, 50 days
1:03:24
the new administration came in, Melania Trump had the law
1:03:28
about, you know, I mean, if you put false images
1:03:31
or false information about younger people
1:03:34
that that has to sort of be illegal and stuff,
1:03:37
which I think was great, but why so narrow?
1:03:40
Well, why is it more expansive?
1:03:42
I mean, what we need to do is get key people.
1:03:45
Like if we can get Melania and she's awesome
1:03:47
and really big on cyber and some of these to spearhead it,
1:03:50
we could probably get them through a lot quicker,
1:03:53
but unfortunately what it comes down to,
1:03:55
it's up to you, me and every listener
1:03:58
to just sort of be local enforcers
1:04:01
where we just tell people, listen,
1:04:03
you can't trust these videos.
1:04:04
We don't trust these videos and just spread the message
1:04:07
because if we can go in and spread the message of, listen,
1:04:10
deepfake is on the rise.
1:04:11
Most videos you see out there is total BS
1:04:14
and just don't trust videos without verification
1:04:17
and validation.
1:04:18
We can start to tackle it, but it's almost like
1:04:20
we as citizens have to lead the way
1:04:23
because Congress is way too behind.
1:04:25
Yeah, I agree.
1:04:26
You think that's what a cyber war looks like?
1:04:29
You think that it's somebody in North Korea
1:04:31
getting really good at creating deepfakes?
1:04:33
Absolutely.
1:04:34
And I think it's one of those
1:04:36
where you're talking asymmetric warfare.
1:04:39
You go in and what if you start going in doing deepfakes?
1:04:43
You then start targeting and compromising devices
1:04:46
which were already there
1:04:47
and you start withdrawing money from those accounts.
1:04:50
You start going in and attacking cryptocurrency
1:04:53
and you could crash.
1:04:55
I mean, you do those three things strategically.
1:04:57
You could crash US markets.
1:04:59
I mean, it would not be hard to imagine
1:05:02
if we start doing deepfakes against stock
1:05:05
and certain stocks where we have the CEO of a large company.
1:05:10
I don't want to pick on anyone
1:05:11
because they do have good security,
1:05:12
but deepfakes you can't protect.
1:05:14
Let's say CEO of Cisco or Microsoft or Amazon
1:05:18
or even some of the new AI companies, right?
1:05:22
NVIDIA and they go in, what if the CEO of NVIDIA
1:05:26
you know, you did a deepfake and I mean,
1:05:29
you got to hand it to the CEO.
1:05:30
I mean, the black leather jacket, I mean,
1:05:32
he is looking good.
1:05:33
I mean, I love his look and stuff.
1:05:35
I mean, he's definitely got to get,
1:05:36
but what if you did a deepfake video going,
1:05:39
hey, because of all the new tariffs
1:05:41
and because of everything,
1:05:43
NVIDIA productivity is going to be down 70%
1:05:46
for the next six months.
1:05:48
I mean, that would crash the stock.
1:05:50
And by the way, today I can do a video as a consumer,
1:05:56
I can't do a video deepfake of somebody
1:05:58
that looks exactly like them, it's not perfect,
1:06:00
but I can emulate their voice immediately.
1:06:03
Today I can emulate anybody's voice
1:06:05
and it sounds with the inflection, the tonality,
1:06:08
with about 10 seconds of audio from them speaking,
1:06:11
I can just copy their voice.
1:06:13
And deepfakes, listen, I think that they're,
1:06:16
I think that I mean, I'm sure that if there's somebody
1:06:19
who had really good tech,
1:06:21
they could make a pretty good deepfake already,
1:06:23
but I don't think that the average consumer
1:06:25
can just do it yet.
1:06:26
But it's still like maybe six months away.
1:06:29
It's six months away and here's the trick
1:06:32
is to get a deepfake believable.
1:06:35
You want to have as far out as zoom out as possible.
1:06:38
So if like, for example, you tried to go in
1:06:41
and do a deepfake of me in this frame,
1:06:44
it would be a little choppy and like,
1:06:47
you could tell it's a little robotic,
1:06:49
but you go in and zoom out and put me on a stage
1:06:52
where it's a smaller Eric and it's not as clear.
1:06:56
And the voice is perfect and the voice is perfect.
1:06:58
And the video might be a little blurry,
1:07:00
but you mean, that's okay because you're on the stage.
1:07:03
I mean, that's, that I think is three to four months away.
1:07:07
I think so too.
1:07:08
And then the close up, I think he has gonna be about a year,
1:07:11
but we're, I mean, we're on the page.
1:07:13
It's not like this is impossible, like landing on Mars,
1:07:17
who we're talking very soon and it just,
1:07:19
I mean, it gets scary and that's what most people think,
1:07:23
like cyber war is, I mean, breaking into the government
1:07:27
or breaking into huge companies, it's not,
1:07:29
it's disinformation targeted and like you go in
1:07:33
and crash a few stocks with a few bag things.
1:07:35
I mean, it's just targeted attacks
1:07:38
that could just cause devastating impact.
1:07:40
What is the, I mean, if we look at sort of the Iran,
1:07:44
Russia, China, North Korea,
1:07:47
I guess these would be considered like cyber enemies
1:07:49
or like, I don't know how to describe them
1:07:51
because they're not all classified in the same bucket.
1:07:54
Obviously, I wouldn't put Russia in China,
1:07:56
the same bucket as like North Korea, for example,
1:07:58
but if you look at sort of the capabilities
1:08:01
of our cyber enemies or people
1:08:04
that we're not exactly aligned with,
1:08:05
what are some of the scarier things
1:08:06
that you've seen outside of potential defects?
1:08:08
Like, what else can they do?
1:08:09
Cause I, and also I'm curious, you probably had
1:08:13
front row seats to see how they protect
1:08:15
and how they prepare.
1:08:17
And I know that you've spoken about a few different things
1:08:19
that even Russia does where they disconnect from the internet.
1:08:22
I'm very curious about why they would do that.
1:08:25
Cause we definitely don't disconnect from the internet.
1:08:26
Well, we don't even know how we can,
1:08:27
we are the internet.
1:08:29
Yeah, so that's the craziest part.
1:08:31
I've been asking for 15 years government officials
1:08:35
and asking myself, do we have a list
1:08:39
of all the connectivity points to the internet?
1:08:41
Do we know how we're connected to the internet?
1:08:42
And the answer is no because if we didn't disconnect it
1:08:45
from the internet, the internet goes down.
1:08:47
So how do you protect yourself?
1:08:49
If you can't filter the borders,
1:08:51
imagine running our country,
1:08:53
where anybody can go in and out without border.
1:08:56
Like, if we didn't have border patrol
1:08:58
and we didn't have all those control gates,
1:09:00
I mean, this country would be overrun so quickly.
1:09:03
So we have physical border control.
1:09:05
We're controlling who can come in and out of our borders.
1:09:07
But on the internet, we have no border control.
1:09:10
We're one of the few countries.
1:09:11
Russia, as you said, has border control.
1:09:14
The reason why they go in and disconnect
1:09:16
from the internet once a year for 24 hours
1:09:20
is to basically show that if a cyber war broke out,
1:09:23
they could actually be out of it
1:09:25
and still run their country.
1:09:27
They could run their country without internet connectivity
1:09:29
because they have an internal internet to do that.
1:09:32
US can't do that, which means if we're under attack,
1:09:35
we can't stop it.
1:09:36
Most people don't realize when the conflict broke out
1:09:42
between Israel and Iran a few weeks ago.
1:09:45
And this is very, very telling of what Iran is thinking.
1:09:48
Iran disconnected from the internet.
1:09:50
Iran is currently not connected to the internet,
1:09:52
which means we can't launch a cyber attack against Iran,
1:09:56
which why do you do that?
1:09:58
That's the precursor for war.
1:10:00
If I'm consulting for a country
1:10:03
and we wanna launch a cyber war,
1:10:05
the first thing I'm gonna say is lock down the hatches,
1:10:08
disconnect from the internet.
1:10:10
And now when I say disconnect, it's one way.
1:10:13
Packets can't come in, but they can still fire out.
1:10:17
So now, from a warfare standpoint,
1:10:20
if Iran starts launching a cyber war against the US,
1:10:23
we can't do anything because we can't attack them back
1:10:26
and we can't do that, right?
1:10:28
We can't do that because the way the internet was designed,
1:10:31
we never did.
1:10:32
So to be one of my big things is, okay,
1:10:36
and I'm not criticizing administrations
1:10:39
because both of them did it,
1:10:40
but the last president, the current president,
1:10:43
they're spent trillions of dollars rebuilding our roads.
1:10:47
They're spending trillions of dollars rebuilding businesses.
1:10:52
Why aren't we spending trillion dollars
1:10:53
of building a separate internet,
1:10:55
at least for the government or commercial,
1:10:57
so we can control their ingress egress points.
1:10:59
We should not be the backbone of the internet
1:11:02
and the US should be separate.
1:11:04
It shouldn't be the same,
1:11:05
but why aren't we spending money on doing that?
1:11:07
That would be the best, if you're looking at our future,
1:11:10
that would be the best investment is building that out
1:11:14
because here's the reality.
1:11:16
We're so focused on physical warfare.
1:11:19
If you go in and build out a list
1:11:21
of the top five nuclear powers, US, Russia,
1:11:26
I will tell you, Iran and North Korea,
1:11:30
which are probably two of the biggest threats
1:11:31
to the United States are not on that list.
1:11:33
We don't allow them to have nuclear weapons
1:11:35
and that was part of the attack.
1:11:37
But you go in and you look at cyber capabilities
1:11:41
and cyber nuclear weapons, China, North Korea,
1:11:48
Iran, Russia, and then United States.
1:11:51
So they're all up there.
1:11:52
They're all up there because they realized like North Korea
1:11:57
realized they're not going to have a nuclear weapon.
1:11:59
Now they would shoot some of the rockets
1:12:01
as a diversion tactic,
1:12:02
but they was spending the last five years
1:12:05
on building out cyber hacking and cyber warfare capability.
1:12:09
A lot of people don't realize more than half
1:12:13
of the economy of North Korea is run
1:12:16
because of cyber attacks against the US.
1:12:19
That's how they're making a majority of their money.
1:12:21
And Iran, once again, has major cyber capabilities.
1:12:26
And once again, we gave them the weapon.
1:12:29
What I mean by that is, do you remember Stuxnet?
1:12:32
No, what's that?
1:12:33
Stuxnet was an attack eight years ago
1:12:36
as a joint effort with the US and some other countries.
1:12:40
We actually broke in to a nuclear reactor in Iran
1:12:44
and melted it down.
1:12:46
We basically did an attack against their nuclear reactor,
1:12:49
melted, well, here's the issue.
1:12:51
When you put malicious code on a server and you break in,
1:12:55
they have that malicious code.
1:12:57
So now they have the code for breaking into nuclear reactor
1:13:01
and the PLCs, the programmable logic controllers
1:13:04
that run the nuclear reactors in Iran,
1:13:07
same brand and model that we run in the United States.
1:13:10
So we basically have given them a cyber weapon
1:13:14
that they now can perfect enhance
1:13:16
and now they could potentially use it against them.
1:13:18
Why haven't they yet?
1:13:21
Because I believe two things, one, I believe they have,
1:13:27
they just haven't activated it.
1:13:29
The way a cyber attack is going to work is,
1:13:32
it's not like a traditional bomb you launch it it explodes.
1:13:36
The way you do a cyber attack is you break in
1:13:38
and you put the code and then you wait for a certain time
1:13:43
and you activate it.
1:13:44
So I believe they have access to our critical infrastructure,
1:13:48
critical service and devices.
1:13:50
They just haven't activated it yet
1:13:52
because they know the retaliation factor.
1:13:55
So they're just waiting for the right moment
1:13:57
because when they do that, I mean, you're talking devastated.
1:14:01
I mean, you're talking World War Three.
1:14:03
I mean, if they did that.
1:14:04
So I think they're carefully planning it
1:14:06
and exploiting it, but they're waiting to do that.
1:14:09
Another great example is most of our financial data,
1:14:14
government information and others is encrypted
1:14:17
and it's encrypted with RSA and AES
1:14:21
which today is considered unbreakable.
1:14:25
But what we're seeing is they're breaking in
1:14:27
and doing what we call harvesting.
1:14:29
We're seeing them steal encrypted data
1:14:32
from banks and encrypted data from businesses.
1:14:34
But here's the crazy part.
1:14:36
Our disclosure laws say unless
1:14:39
they can actually read the information,
1:14:42
we don't have to disclose it.
1:14:43
So if somebody steals encrypted data
1:14:46
and they don't have the keys, they don't have to tell anybody.
1:14:49
Wow.
1:14:50
And now what they're doing is they're harvesting
1:14:52
all these encrypted databases
1:14:54
because it's estimated if you look at quantum computing
1:14:58
that at least in 10 years,
1:15:01
some people say five, some say seven,
1:15:03
I'm always sort of conservative.
1:15:05
So at least 10 years, quantum computing will be so advanced
1:15:09
that it will actually be able to break RSA and AES in minutes.
1:15:14
So now what they're doing is they know
1:15:17
they're building up quantum capabilities in these countries.
1:15:20
They're stealing all our encrypted data.
1:15:22
So then in five, seven or 10 years,
1:15:24
they can decrypt it and use it against us.
1:15:26
Imagine if in five, seven years,
1:15:30
all of our financial data,
1:15:31
all of our passwords, all of our information
1:15:33
are now public for those countries.
1:15:36
I mean, to talk about cyber warfare at a whole new level.
1:15:39
So what do we do to protect against this?
1:15:42
Like this is so I asked you like,
1:15:43
what were the scariest capabilities of these countries?
1:15:46
I mean, these are some of them for sure.
1:15:48
So the next 10 years is going to be a rough 10 years.
1:15:52
But I guess the question is,
1:15:54
you mentioned like Iran's not activating
1:15:56
because it would mean World War III.
1:16:00
This is more of a geopolitical, I guess,
1:16:02
talking point and question.
1:16:03
But do you, I mean, from your time in the CIA,
1:16:07
do you believe that China, Russia, Iran
1:16:11
are actively trying to like really end the US
1:16:16
or is it just like a safety precaution
1:16:18
on the off chance that there is a conflict?
1:16:20
Like do you think that, and I know that
1:16:22
there's three very separate countries.
1:16:24
I think North Korea, I think we can argue
1:16:26
are not fans of the US.
1:16:27
But do you believe that like Iran wants to see
1:16:31
like true death to America?
1:16:34
Like do they want to see, you know,
1:16:36
like the West just collapse?
1:16:39
I don't know if I believe that China really wants to see that.
1:16:42
I don't think so.
1:16:42
I don't think Russia really wants to see that either.
1:16:45
Yeah, no, you nailed it.
1:16:47
It is safety measures.
1:16:48
Safety and it's, it's all monetarily driven
1:16:53
because here's the reality.
1:16:54
If the US went under, if our economy
1:16:58
completely collapsed, the world would China relies on us.
1:17:03
Iran, Russia, they're making so much money
1:17:06
on either business or cyber attacks from us.
1:17:09
They don't want us to.
1:17:10
So to me, it's, you said, why haven't they done it yet?
1:17:14
It's more precautionary, but it's also monetarily driven
1:17:18
because now if I go in, let's say in five or 10 years
1:17:23
and I have all the banking information from major banks,
1:17:27
what I'm going to do is I'm going to go back to that bank
1:17:30
and say, okay, you're going to pay us a million dollars
1:17:35
a month or a year as safety protection.
1:17:38
Go back to the mafia in New York City.
1:17:41
And that's what we're getting to is like the mafia
1:17:45
didn't want the stores to go under.
1:17:48
They don't want because then they would lose money.
1:17:50
They just wanted to scare them enough
1:17:52
so they would give them whatever it was.
1:17:53
$100 and pay money and they would do this for years.
1:17:57
They actually wanted the businesses,
1:17:59
like they would promote them.
1:18:00
They wanted the business to do successful
1:18:02
because the more successful the business,
1:18:05
the more money they made.
1:18:06
And that's where I think we're really heading
1:18:08
is this extortion ransomware is unfortunately
1:18:12
going to be a business model in market
1:18:15
where I think most Fortune 500 companies
1:18:18
in five to 10 years are going to have line items
1:18:21
for ransom payments.
1:18:22
So when you go in and you do your profit and loss statements,
1:18:26
you have your revenue, you have your expenses, right?
1:18:29
Your building expense, your insurance expenditure, this,
1:18:32
you're going to just have a ransomware expense
1:18:35
where maybe one or two percent of revenue
1:18:37
you're just going to have to pay for ransoms
1:18:39
because we're behind the curve
1:18:41
and we're not staying up to base.
1:18:43
Now you sort of said the next 10 years
1:18:46
could are going to be bad.
1:18:47
I would sort of just change the word could be
1:18:50
if the point is if we act now,
1:18:53
like if Congress started passing laws
1:18:55
and we started locking down our systems
1:18:57
and doing two FA and rebuilding
1:18:59
and putting more security.
1:19:00
It's your point.
1:19:01
They have this information, that's my point.
1:19:03
Say, okay, yes, I'll let you think
1:19:05
in a second, let's put those out.
1:19:07
No, jump figure.
1:19:07
They have, they have the information
1:19:10
that they've stolen from financial institutions already.
1:19:12
They can unlock that with quantum.
1:19:14
You're saying that just going forward,
1:19:16
we have to be a little bit more strict
1:19:17
so that they don't keep getting more information
1:19:19
so that at some point that information holds no value
1:19:23
and they can't use it to exploit companies and individuals.
1:19:26
So for example, it's not the easiest,
1:19:29
but it's not impossible.
1:19:31
What if the banks had a three year plan
1:19:35
to change everyone's account?
1:19:38
I understand.
1:19:39
So now by the time they decrypt it,
1:19:42
the accounts are all no longer valid.
1:19:43
Yeah, and they have no leverage.
1:19:45
And they have no leverage.
1:19:46
Or what I do and citizens can do this
1:19:50
is every three years, I actually do go into my bank
1:19:55
and I go listen, I work in cybersecurity,
1:19:56
I'm a little concerned and can I change all my bank accounts?
1:20:00
And now I don't have that many, but I go in
1:20:03
and I change all my bank accounts periodically.
1:20:06
Just change the account number?
1:20:07
Just change the account number.
1:20:08
Yeah.
1:20:09
What you do is there's typically,
1:20:12
you do a 45 day so any checks from the old account
1:20:16
will still allow and then after that,
1:20:19
they won't allow and they won't allow any EFTs
1:20:21
from the old account number.
1:20:23
And yet it takes a few hours,
1:20:25
but it's much better than somebody breaking in
1:20:28
a white thing out my entire account.
1:20:30
So there's things individuals can do
1:20:32
where we just like re-image our systems
1:20:34
or change our accounts every,
1:20:35
and just do things to reduce the exposure factor.
1:20:38
And to me, that's where individuals have to take action
1:20:43
because the big companies in government are too slow.
1:20:45
You gotta listen, you gotta protect yourself at the end of the day.
1:20:48
I mean, something as simple as it's not
1:20:50
to the extent of changing your account numbers,
1:20:52
but I love using virtual cards.
1:20:54
Like I'll spin up a virtual card for a payment
1:20:57
and when I'm done with it, I just cancel it.
1:20:58
It's so simple and it's like I have a dashboard
1:21:01
and get rid of the card, okay, two things happen.
1:21:04
First of all, if the card's compromised
1:21:06
and no one else can ever use it,
1:21:08
but also sometimes I forget what I'm paying for.
1:21:10
So then if I have like a subscription
1:21:12
that I don't wanna pay for anymore
1:21:13
and then I cancel the card,
1:21:14
then I don't have to pay for the subscription.
1:21:16
So I love the virtual card,
1:21:17
but this is like on a much easier simple,
1:21:20
just like you can do this with any bank,
1:21:21
I think now you can spend a virtual cards,
1:21:23
use it, cancel it and whatever.
1:21:25
And then take that to the next level.
1:21:27
So not only do I do virtual cards,
1:21:30
but I also have a burn phone, do you?
1:21:33
So I have a burn phone that basically has a number
1:21:38
and whenever I go to websites or cause you know,
1:21:41
some of these to get stuff like,
1:21:43
because there's a lot of free content,
1:21:45
you have to put in your phone number.
1:21:47
So I put in the phone number that burn phone
1:21:50
and then when it gets too much,
1:21:53
typically nine or 12 months, now it's gotten so crazy.
1:21:56
It's about every six months.
1:21:58
I go in and the few legitimate,
1:22:00
like there's maybe one or two legitimate people
1:22:02
that have that number.
1:22:04
I just text them and say,
1:22:05
hey, I'm changing my cell phone number.
1:22:07
Here's the new one and then I give them
1:22:09
the trusted one that I've had for 15 years.
1:22:12
And then I just go and here's the cool thing.
1:22:15
You just go in and call up the provider
1:22:18
and you just say you want a new number.
1:22:21
They do it over the phone, it takes,
1:22:22
but you don't even have to get a new phone.
1:22:24
So the idea of like a burn,
1:22:25
because on my iPhone, I have two numbers on it.
1:22:29
Or do that, yeah.
1:22:30
I have two numbers on it.
1:22:31
So I have a second one that I pay like 15 bucks a month for
1:22:35
that I, a burn number, a burn number.
1:22:37
And it's like not like,
1:22:40
you don't even have to use an app for it
1:22:42
because most phones can support two Sims now.
1:22:44
And you can do virtual Sims.
1:22:46
So it's very simple to do.
1:22:47
Yeah, so you don't even need a second phone.
1:22:49
Yeah, I'd even think about putting a second number
1:22:51
on your iPhone, that's a great idea.
1:22:52
And you can actually choose when you're texting somebody
1:22:55
to want to choose from primary number
1:22:57
or secondary number and you can just have two numbers.
1:22:59
And I think it's meant, actually,
1:23:01
for like when you're traveling abroad,
1:23:02
but it works for whatever you want it to do.
1:23:04
So yeah, very, very smart, very, very smart.
1:23:07
And I actually should do that more often
1:23:08
because I've just been using that number to sign up for things,
1:23:12
especially when I don't want them people to like,
1:23:14
no, you're real number, I mean, numbers.
1:23:16
I guess I'm kind of using it the same way.
1:23:17
You are, you already got it, yeah.
1:23:19
But it's just like little things like that.
1:23:21
And then I also, I also have like a burner email address
1:23:25
that I use when I sign up for stuff,
1:23:26
but it like links back to my main email address.
1:23:28
So I get like all my 2FA codes on it if I want to use it.
1:23:31
So anyway, but it's just about, listen,
1:23:33
it's just about being smart, protecting yourself,
1:23:36
2FA, not doing dumb stuff.
1:23:38
The last thing that I think is interesting,
1:23:41
we sort of spoke about your work with the CIA.
1:23:45
Obviously your work with like past administrations
1:23:49
also was focused on, I'm assuming,
1:23:51
just protecting from foreign actors and whatnot.
1:23:53
But you also worked with the Gates Foundation.
1:23:56
And I'm curious what billionaires
1:23:59
do differently than the average person.
1:24:01
And I'm also more curious,
1:24:03
is a billionaire cyber security infrastructure
1:24:06
more robust than the governments?
1:24:08
Or is the government's more robust than a billionaires?
1:24:11
So I'm sorry, I would definitely say a billionaires infrastructure
1:24:16
is more secure than the government.
1:24:18
And for a couple reasons, there's less individuals.
1:24:24
And just to be clear, I did a little with the foundation,
1:24:28
but it was mainly with the personal.
1:24:31
Oh, with Bill Gates.
1:24:32
So when he basically split away from Microsoft,
1:24:37
all of his security and IT was done by Microsoft staff,
1:24:40
and he wanted that to be separate and isolated.
1:24:43
So I was one of the folks that originally helped set that up.
1:24:47
And a lot of it was just the things that we talk about is,
1:24:52
so one of the simple ones, and like I said,
1:24:54
I can talk about it now, because it's there for it,
1:24:56
is for G1, we gave him nickname.
1:25:00
And so that was for G1, was G2, Melinda?
1:25:05
Potentially.
1:25:06
Oh, I always wanted to be careful, right?
1:25:09
Hypothetically, it could be okay, fine.
1:25:11
But like one of the simple things we did for him is,
1:25:15
he had three computers.
1:25:17
He had one computer.
1:25:19
He used for internal communication with his staff and financial.
1:25:23
He had a second computer, he used for web surfing and public.
1:25:27
And he had a third computer that he used for dealing with Microsoft.
1:25:30
Just simple isolation, right?
1:25:33
Simple devices and accounts.
1:25:36
And once again, I mean, we have so many devices.
1:25:39
What if, and I actually do this, I have multiple iPads.
1:25:44
Like I, the super thin, you carry,
1:25:46
I mean, it doesn't take much to carry them to like three pounds.
1:25:49
And I have one that I only deal with my finances and others,
1:25:53
one for my high-end business clients,
1:25:55
and then one for public surfing.
1:25:56
So, and once again, iPads are like 700.
1:26:00
So that's what's 21, 2,100.
1:26:04
Most people will spend $3,000 on a high-end laptop.
1:26:07
So it's like, so just simple things like just having isolation
1:26:11
of those services that are there.
1:26:14
They had two factor out of the gate.
1:26:16
So, so just two factor.
1:26:18
And then once again, just heavy filtering of even back then,
1:26:23
we didn't allow attachments.
1:26:25
We didn't allow embedded links.
1:26:26
We really limited and restricted the functionality.
1:26:30
And once again, that's about it.
1:26:32
I mean, it wasn't like we had super high-end lasers.
1:26:36
I mean, it was zap, or anything.
1:26:37
It was pretty basic, fundamental components and security
1:26:42
places. And then the other big one that we did early on,
1:26:45
and now we recommend for all folks is on any device
1:26:48
that's connected to public Wi-Fi.
1:26:50
So if you're connected to Wi-Fi, hotels, airports,
1:26:54
you have to run a VPN.
1:26:55
Always. Always.
1:26:57
It's super simple.
1:26:58
It doesn't take up a lot of resources and encrypts everything.
1:27:01
And once again, just goes a long way of locking it down.
1:27:04
And then the last thing is endpoint security in every device.
1:27:09
Most people think of it used to be called antivirus.
1:27:11
Now it's called EDR and point detection response.
1:27:14
People who would only run it on their laptops.
1:27:17
I run it on iPad, phone, everything.
1:27:20
Once again, not a guarantee,
1:27:22
but you encrypt all your traffic with a VPN,
1:27:24
and you run EDR with a high setting that if and doubt,
1:27:27
it'll block or allow it.
1:27:28
So you miss a little bit of legitimate,
1:27:30
but you don't get any malicious.
1:27:32
And I mean, those basic foundational things,
1:27:34
and you're going to be in really good shape.
1:27:36
Are there any particular VPNs that you would stay away from
1:27:39
or that you recommend?
1:27:41
I mean, I usually recommend the ones in the US,
1:27:45
like open VPN or open SSL.
1:27:48
I like the ones that are based on standards that are public,
1:27:54
because when you have a lot of smart people looking at it,
1:27:57
you're going to find it and make it a lot more secure.
1:27:59
So I'm very big into open source for VPNs,
1:28:04
because it gets a lot more visibility than a small,
1:28:07
nothing gets small private companies,
1:28:09
but a small private company releasing a VPN
1:28:12
is not going to have the same code scrutiny as an open source.
1:28:14
I really, for those, prefer open source.
1:28:17
Indeed is a success story partner.
1:28:19
After hiring, indeed is all you need.
1:28:20
Let me give you an example.
1:28:21
If I needed to hire a new editor for this show,
1:28:23
I'd go to indeed and be super specific.
1:28:25
Not just can you edit audio, I'd say I need someone
1:28:28
who's edited a conversational podcast
1:28:30
for at least three years, gets our style
1:28:31
and knows our software.
1:28:32
Someone who's done this before.
1:28:34
And here's the thing with indeed sponsored jobs.
1:28:36
I'd get people who fit that description.
1:28:37
I'm not digging through resumes
1:28:39
when people who've edited one YouTube video,
1:28:40
I'm getting actual podcast editors who know what they're doing.
1:28:43
People who've worked on shows like ours and can prove it.
1:28:45
That's what makes a difference.
1:28:46
You get people who actually are what you're looking for.
1:28:49
According to indeed data, sponsored jobs posted directly
1:28:52
on indeed are 90% more likely to report a higher
1:28:55
than non sponsored jobs.
1:28:56
And people are finding quality hires right now.
1:28:58
In the minute that I've been speaking to you,
1:29:00
companies like yours have made 27 hires on indeed
1:29:03
according to indeed data worldwide.
1:29:05
Spend more time interviewing candidates
1:29:06
who check all the boxes, less stress, less time,
1:29:09
and more results now with indeed sponsored jobs.
1:29:12
And listeners of this show will get a $75 sponsored job
1:29:15
credit to help you get your job.
1:29:17
The premium status it deserves at indeed.com slash clary.
1:29:21
Just go to indeed.com slash clary right now
1:29:23
and support our show by saying you heard about indeed
1:29:25
on this podcast.
1:29:26
Indeed.com slash clary terms and conditions
1:29:29
apply hiring do it the right way with indeed.
1:29:32
HubSpot is a success story partner.
1:29:34
If you're into this show, you're probably someone
1:29:35
who likes to learn from people who've actually done the thing.
1:29:38
That's why I want to put create like the greats on your radar.
1:29:40
It's a great show.
1:29:41
It's hosted by Ross Simmons.
1:29:42
Part of the HubSpot podcast network.
1:29:43
Ross breaks down some of the greatest creations
1:29:46
and creators of all time.
1:29:48
What they built, how they thought the actual process behind it
1:29:51
and he's not just talking theory.
1:29:52
He's been doing this stuff for over a decade.
1:29:54
What I appreciate is that he makes it practical.
1:29:56
Like how do you actually systematize creativity?
1:29:59
So you're productive, but you're not burning out.
1:30:01
So if you like learning from history,
1:30:02
understanding how great work gets made
1:30:05
and you want something that's easy to listen to,
1:30:07
check it out, listen to create like the greats
1:30:09
wherever you get your podcasts.
1:30:10
Do you believe that you work with past administrations,
1:30:14
billionaires, CIA?
1:30:16
Do you believe that the US is going to win the war
1:30:20
on cyber the way we are right now
1:30:22
or does there have to be some radical change?
1:30:24
Not just on an administrative level,
1:30:27
but with private companies.
1:30:29
Like what else has to happen so that we can guarantee
1:30:31
that we can win this war going to the future?
1:30:33
Yeah, so the path we're on right now is not a good one, right?
1:30:38
We're behind because as we said,
1:30:40
we are too focused on functionality.
1:30:43
So to me, one of the simplest rules is
1:30:46
when I come into businesses
1:30:47
or I consult with these high end individuals,
1:30:50
their perception of cyber is you're the negative guy.
1:30:53
You're the guy that's going to say no,
1:30:54
you're the guy that's going to say don't use it.
1:30:56
I love tech, I use tech,
1:30:59
but essentially what we have to start doing
1:31:01
is when we're evaluating any new business decision,
1:31:04
any new technology, we have to step back
1:31:07
and instead of one question which is asked today,
1:31:10
what is the value and benefit?
1:31:11
So like you look at AI,
1:31:13
what is the value and benefit?
1:31:15
We can create content, we can get more visibility,
1:31:17
we can do all this stuff,
1:31:18
but what companies and organizations need to do
1:31:20
is ask a second question,
1:31:22
what is the risk and exposure?
1:31:23
And then ask yourself is the value worth the risk?
1:31:27
Because to me right now today,
1:31:29
the way we're using AI,
1:31:31
if you look at the risk of data leakage,
1:31:33
information leakage and targeting,
1:31:35
it ain't worth the risk.
1:31:36
Like to me, I use AI very limited,
1:31:40
I do have a digital twin,
1:31:42
I joke, I love it there.
1:31:43
Every morning at 430,
1:31:44
I basically argue in debate with myself
1:31:46
with the digital twin and one time was funny,
1:31:49
I get so heated that I'm at a hotel
1:31:52
and there's a knock on the door and it's security
1:31:54
because I guess the neighbor was complaining
1:31:56
because that was too loud.
1:31:57
And they're like, are you having a party?
1:31:58
I'm like, no, I'm just fighting with myself.
1:32:00
I'm just debating, sorry.
1:32:01
I think there's limited use,
1:32:03
but I don't actually use AI publicly
1:32:07
where I put any of my information
1:32:08
or business decision publicly
1:32:10
because that's then available to anyone or anyone else.
1:32:12
So I think we gotta look at the new tech,
1:32:15
AI and everything else as a tool.
1:32:18
I get so frustrated when I hear these executives
1:32:21
go in and say, AI is gonna replace your job,
1:32:24
you're gonna become obsolete.
1:32:26
I'm like, yeah, if we dehumanize ourselves, right?
1:32:30
But if we continue to be human,
1:32:32
AI can never have emotion,
1:32:35
it can never have feeling.
1:32:36
And if we let AI take people's jobs,
1:32:39
we're basically downgrading our intelligence
1:32:41
to that of AI, we're turning ourselves into computers.
1:32:44
And if we do that,
1:32:45
if companies actually fire employees
1:32:48
and replace them with AI,
1:32:51
we're on a path where 30, 40 years,
1:32:54
humans could be obsolete or extinct
1:32:56
because we don't need humans anymore.
1:32:57
That's the worry.
1:32:58
But if we-
1:32:59
Exactly, but if we go in and step back going,
1:33:01
this is insanity at every level and AI is a tool,
1:33:06
we should actually be telling people,
1:33:09
AI is gonna enhance your job and make you more valuable.
1:33:13
It's not gonna replace you.
1:33:14
We should be training people
1:33:16
and how to use AI as a tool
1:33:17
to make themselves more valuable as humans
1:33:20
and not the other way.
1:33:21
So to me, we're sort of missing the boat,
1:33:23
where we're only looking at functionality
1:33:25
and not security risk.
1:33:26
And we just need to change how we look at things
1:33:28
that all functionality needs security.
1:33:31
And whenever you're releasing new functionality,
1:33:33
security should be embedded and new tech,
1:33:36
like AI is a tool, it's not a replacement.
1:33:39
Couple of thoughts on that.
1:33:40
So first of all, fully agree.
1:33:43
I don't think that a lot of companies
1:33:44
are looking at AI, like that they're looking at AI
1:33:46
in terms of how do we just get rid of
1:33:48
as many salaries as possible so we can use AI?
1:33:52
I do believe that people should be using AI
1:33:54
to sort of 10X or output or to upskill themselves,
1:33:57
for sure, that's important.
1:33:58
And it's a mixture of both.
1:34:00
Like, yes, AI can speed things up, automate processes,
1:34:04
it can help somebody do 10X to work they were before,
1:34:06
but the person also has to be willing
1:34:08
to learn how to use it properly.
1:34:10
But they can't be overly dependent on it
1:34:12
because there was just a new study that showed the people
1:34:14
that are using AI for all of their tasks,
1:34:16
for their thinking, their searching, their writing,
1:34:18
it's showing a decline in their cognitive abilities.
1:34:21
So you still have to be as an individual,
1:34:23
somebody uses AI, but somebody who still doesn't use it
1:34:25
for everything, and you still have to learn
1:34:28
and improve yourself, you still have to read,
1:34:30
you still have to write, you have to do yourself
1:34:31
to do all the things that help you perform
1:34:34
at the best level.
1:34:35
So you can't just outsource 100% of your thinking to AI,
1:34:38
but you can use it as a tool.
1:34:39
And there's some, again, the happy medium
1:34:41
as to how you use it, they're overusing it
1:34:43
without ignoring it completely.
1:34:45
I also think that I don't think
1:34:48
that too many people love Sam Altman.
1:34:52
I don't think that too many people look at him
1:34:54
and are like, he's acting in the best interest of humanity.
1:34:59
I feel like there's a significant amount
1:35:01
of negative sentiment as to how he's built.
1:35:04
But how he's built open AI, even like from switching it
1:35:06
to a nonprofit, to a for-profit,
1:35:09
I think a lot of mixed emotions about that
1:35:11
and what incentives are actually driving the company forward.
1:35:14
Is it actually AGI?
1:35:15
Is it actually betterment of humanity?
1:35:17
Is it just making more money?
1:35:20
And I think that people have different perspectives on that.
1:35:25
But I do believe that more companies,
1:35:33
and I don't know how this is going to manifest
1:35:36
because this is not how companies operate,
1:35:39
but more companies that are responsible for bringing AI
1:35:42
into the world do have to understand the power
1:35:45
that it's going to have and build it responsibly
1:35:49
and not just give sort of lip service
1:35:52
to the ethics around AI.
1:35:54
And I think I personally feel there's a lot of lip service
1:35:58
and people saying we care about AI ethics
1:36:04
and we care about AI security and we care about,
1:36:08
we care about how it's going to impact jobs and humanity,
1:36:11
but I don't believe if I look at the actions,
1:36:13
the actions aren't aligned with what people
1:36:17
are sort of preaching about AI security.
1:36:21
Even if we look at, listen, I don't have an issue with Elon,
1:36:25
but Groc just went off the rails
1:36:27
and started becoming super anti-Semitic
1:36:30
in the past 48 hours.
1:36:32
So if you really cared about security,
1:36:35
that would have never happened
1:36:36
because there would have been some sort of safeguard in place,
1:36:38
it doesn't turn the AI that you've built
1:36:42
into this thing that starts calling itself Hitler,
1:36:45
which is in the past,
1:36:46
it was calling itself mecha Hitler
1:36:48
in like the past week, right?
1:36:49
I don't know if you saw this in the news,
1:36:50
but it was absolutely crazy.
1:36:52
So all these founders and CEOs can say
1:36:56
that they care about security and safety,
1:36:59
but it doesn't seem like they actually care about it
1:37:01
with the actions that they're taking
1:37:02
because they're moving so damn fast.
1:37:05
The reason why they're moving fast
1:37:06
is because when they move fast,
1:37:07
they can make more money
1:37:08
and they can stay ahead of everyone else.
1:37:11
So I think it has to be more of,
1:37:13
I don't know if it's government regulation,
1:37:15
I don't know, I don't think it's gonna come
1:37:17
from a business perspective or private business perspective
1:37:19
because I think that private business founders,
1:37:21
entrepreneurs, CEOs, they are motivated by profit
1:37:25
and creating shareholder value
1:37:26
and safety and security and slowing things down
1:37:31
that runs counter to creating massive shareholder value.
1:37:36
I don't know what the answer is.
1:37:38
I think it's a hybrid,
1:37:40
but to me, one of the new areas is AI hacking,
1:37:45
where you actually go in and hacking groups hack the AI model.
1:37:48
I mean, that's what happened with GROC
1:37:50
is you had a group of people
1:37:52
that basically wanted to either target Elon
1:37:56
or target GROC and they fed a ton of new information
1:38:01
and GROC learned.
1:38:02
That's how it works.
1:38:04
So it wasn't that Elon or anybody running GROC did that.
1:38:08
It was any AI tool works on the data set
1:38:12
and with a public AI tool,
1:38:14
you can influence the data set.
1:38:15
So if I go in to any AI,
1:38:18
whether it's chat TV or GROC
1:38:19
and I have a bunch of computers
1:38:22
and I feed it a ton of information aggressively,
1:38:25
I can retrain and turn it into anything I want.
1:38:28
So that was actually a hack against GROC.
1:38:32
It wasn't anything Elon or the GROC folks did.
1:38:34
No, and I didn't think it was Elon
1:38:37
and the GROC and the whatever,
1:38:39
the GROC team or the X team or whatever.
1:38:42
I was just saying that they launched it
1:38:45
and there was not enough safe guards in place.
1:38:47
There was no protect against it.
1:38:48
You need, I mean, in some of these have it,
1:38:51
but it's AI ethics built in
1:38:53
where it won't allow large amounts of messages
1:38:55
or won't allow other things.
1:38:56
Now I actually think the GROC
1:39:00
could be a good lesson learned
1:39:01
because it probably is going to get
1:39:03
either lose a lot of market share or something like this.
1:39:06
I mean, it could potentially go on.
1:39:08
I mean, it's something devastating enough.
1:39:10
I know a lot of my friends are like,
1:39:11
I'm just going to switch to the chat GPT.
1:39:14
So I mean, this could sort of be a good wake up call for it.
1:39:18
But the other thing too is like,
1:39:21
look at what we did with cloud.
1:39:22
When cloud came out,
1:39:24
one of the ways we secured it
1:39:26
is you had public out and private cloud.
1:39:28
So I could run my own service in the cloud
1:39:31
but nobody had access to first public.
1:39:33
And I think what companies need to do
1:39:35
and it's what I do is if you're going to use AI,
1:39:38
you need to have a private AI internally
1:39:41
that never goes out to the internet and then public.
1:39:43
And I think if we as individuals and companies
1:39:46
started sending up private and not using the public,
1:39:50
that's one way we can quickly secure
1:39:53
and still get the value without having the leakage.
1:39:56
But but you're right,
1:39:57
unless vendors get enough reputational hit
1:40:00
which is the grog one and there's regulation
1:40:02
and there's consumer pushback,
1:40:04
it's sort of all those things have to happen.
1:40:07
But my question is by the time it happens,
1:40:09
will it be so bad that we can't basically
1:40:12
put the genie back in the bottle?
1:40:14
I actually, you know, as you're saying this,
1:40:17
I actually now believe that maybe grog
1:40:20
was actually a blessing in disguise
1:40:22
because it was almost like a canary
1:40:25
in the coal mine situation where it showed
1:40:27
the potential implications of having AI
1:40:32
without the safeguards in place.
1:40:34
And it was bad, but it wasn't like really bad.
1:40:38
But enough to wake people up and say,
1:40:40
oh shit, this isn't great.
1:40:42
We shouldn't do this, we shouldn't do this.
1:40:45
So it's better that it happens with some stupid,
1:40:50
probably just some hackers trying to be assholes
1:40:53
versus somebody who's impacting AI
1:40:55
to actually have a significant impact
1:40:58
on a country or whatnot.
1:41:01
So yes, it wasn't good, but yeah, maybe you're right.
1:41:04
Maybe it was, you know, it's this nice little wake up call
1:41:07
that we understand the power of AI
1:41:08
and that the average, because it's all, listen,
1:41:11
I love what you said, it's not just the vendor
1:41:15
or the private company because we can't trust
1:41:17
the private company to always make the best decision
1:41:19
for the rest of the world, obviously,
1:41:20
it's just the fact incentives are different
1:41:23
for a private company.
1:41:25
The government moves slow.
1:41:26
So what moves the government quicker
1:41:29
and what makes the private company
1:41:31
act in the best interest of people
1:41:33
outside of the shareholders?
1:41:35
It's public sentiment.
1:41:37
So when something really bad happens
1:41:40
or even moderately bad,
1:41:41
the public will make both of those groups move quicker.
1:41:44
We have a lot more power as together
1:41:45
than we do separate, yep.
1:41:46
Very much so.
1:41:47
And maybe this is the wake up call that people needed
1:41:50
so that the public will say, hey, listen,
1:41:53
Elon, Groc, Claude, Anthropic, open AI,
1:41:57
like all these companies, okay, we love what you're building.
1:42:01
But like, let's slow down a little bit
1:42:03
or at least just focus on safeguards
1:42:05
that this can't be manipulated.
1:42:07
Because on the other end of the spectrum,
1:42:09
if you're talking about slowing things down
1:42:10
in terms of AI development, the concern is,
1:42:15
well, all these other sort of nation states
1:42:17
that are not the US are not slowing down.
1:42:19
So China and Russia and North Korea
1:42:21
are building AI as quick as possible.
1:42:24
And we don't want to let them outpace our own AI development.
1:42:28
So there is, this is balance, right?
1:42:30
You wanna have, you wanna be able to increase
1:42:33
your AI capabilities as quick as all these other countries
1:42:35
so that you can defend against them.
1:42:37
But also you don't want to build something that's,
1:42:40
it's a scary spot to be in.
1:42:42
You don't want something to go crazy
1:42:43
and go off the rails either.
1:42:44
But it's one of those where we gotta go back
1:42:47
to older software models.
1:42:48
We can build without releasing.
1:42:51
Correct.
1:42:51
I mean, if you look at Microsoft,
1:42:53
Microsoft used to take two to three years
1:42:56
to build an operating system before they released it.
1:42:58
Now what we're doing with all these AI,
1:43:01
we're building in a releasing it immediately.
1:43:03
There's no internal beta testing,
1:43:05
basically the community and the world is beta testing.
1:43:08
So I think what we need to do is,
1:43:10
I mean, these AI companies should still aggressively
1:43:12
be building, but what if we just did a slower rollout?
1:43:15
What if we actually did alpha and beta testing,
1:43:18
and we didn't release it for a year or two?
1:43:20
Now we're not behind,
1:43:22
but we're just not putting the consumers at risk.
1:43:25
Yeah, exactly.
1:43:25
And the only reason why we release as quick as we do
1:43:27
is because of money.
1:43:29
Yeah, exactly.
1:43:30
That's really it.
1:43:31
Where can people connect with you?
1:43:34
I want you to tell them what you're working on now,
1:43:36
what to look forward to in the future,
1:43:38
also like where to connect you on social.
1:43:41
I mean, your book is a cyber crisis,
1:43:44
protecting your business from real threats
1:43:45
in the virtual world.
1:43:46
I know you have other books.
1:43:47
You can probably get this book on Amazon,
1:43:49
or wherever you go.
1:43:50
Exactly.
1:43:51
Amazon book stores.
1:43:52
Yeah, so what are you excited about in the future?
1:43:53
And then also where can people connect with you online?
1:43:56
So the big things I'm really excited about
1:43:58
for the future is one, and I'll be a little careful.
1:44:02
But one is I'm actually looking at exiting one of my companies.
1:44:06
Gradually.
1:44:07
So I think you mentioned we didn't get into a lot of it,
1:44:09
but I'm a big fan of building companies
1:44:11
over three to five years, getting them to about eight to 10
1:44:14
a mile, and then doing evaluation of five to six,
1:44:18
so then selling them for 30 to 40.
1:44:20
I find doing that as opposed to trying
1:44:22
to build a $100 million company over 20 years
1:44:25
is a much better model.
1:44:26
So I'm in that cycle, and then I start up a new one behind it.
1:44:30
I'm also working on a new book.
1:44:32
So look for that at the end of the year.
1:44:34
What are you going to, what is the premise of the book?
1:44:37
Basically, what we just talked about.
1:44:39
So I mean, all those, so about sort of AI and security,
1:44:43
and basically the fact that we're at war
1:44:46
and what can individuals do to protect and secure.
1:44:49
So I definitely look for that also trying to get a federal law
1:44:54
passed on cyber security.
1:44:56
And then the longer term plan is that migrates
1:44:58
into a global law on cyber.
1:45:01
So those are sort of my big projects.
1:45:04
Then I go in and you can find me, Dr. Erichold DR, ERIC,
1:45:08
COLE, I love giving away information.
1:45:11
I love giving away data, so I do a lot of posts.
1:45:13
It's all cyber security.
1:45:15
And then I have two podcasts that are cyber focused
1:45:18
on sort of bullet proof of how to implement security
1:45:21
into your life to be better protected.
1:45:23
And then for techy people, I have life of SSO,
1:45:26
chief information security officer.
1:45:28
So really giving back, I also do my blogging,
1:45:31
Dr. DR, ERIC, COLE.org.
1:45:34
So Dr. Erichold.org, and then also my company site,
1:45:37
if I can help you in any way, is secure-anchor.com.
1:45:41
Perfect.
1:45:42
Amazing.
1:45:43
You've given a lot, I guess the last question
1:45:45
that I'd like to ask, because again,
1:45:46
you've had a very interesting life.
1:45:48
But if you could summarize sort of all the wisdom
1:45:51
and all the experience, and it could be just business,
1:45:53
life, cyber, doesn't matter how you want to sort of
1:45:57
take the angle on this, and you could just pass on
1:45:59
one really great lesson to your kids.
1:46:02
One of the things that's been the most important to you,
1:46:04
what would that lesson be and why?
1:46:06
So there are two principles that guide everything that I do.
1:46:10
And I believe they're critical to success
1:46:13
and interacting with other humans.
1:46:14
The first one is, smart people know the right answer.
1:46:19
Brilliant people ask the right question.
1:46:21
I think in so much communication, if you look over my life,
1:46:25
most of my problems, most of my arguments,
1:46:28
most of my issues and relationships in business
1:46:31
was because I thought I was the smartest person
1:46:34
and I tried to give answers and I didn't listen.
1:46:36
So I think if you listen more, and one of the things I always
1:46:39
remind myself and remind my kids of,
1:46:42
is we have two ears and one mouth.
1:46:45
Maybe the universe was trying to tell us we should listen
1:46:48
more than we hear.
1:46:49
So my rule is when I'm in communication with anyone
1:46:53
or I briefed to a board, I always ask three questions
1:46:58
before I give an answer.
1:46:59
I always want clarifying information.
1:47:01
Don't assume we know everything, ask more questions
1:47:05
and listen as opposed to giving answers.
1:47:07
And then the second, big one that's probably
1:47:10
the most keen to my success in business
1:47:12
is let data drive decisions not emotions.
1:47:17
To me, I used to make so many decisions on emotions
1:47:21
and make a lot of really bad decisions.
1:47:23
Then I got paranoid because I was making
1:47:26
so many bad decisions on emotions.
1:47:28
I would then delay on the decisions I made,
1:47:31
which would then lose out on opportunities.
1:47:33
Now what I do is when I have to make a decision,
1:47:36
I ask myself, do I have enough data to make a good,
1:47:42
not a perfect decision, but a good decision?
1:47:44
If the answer is yes, I make a decision, I don't wait.
1:47:48
Then if the answer is no, I say,
1:47:50
what do I need to do to get enough data
1:47:52
so I can be confident in that decision
1:47:54
and then I make it as quick as possible?
1:47:56
So now if you look at my life on a weekly basis,
1:48:01
I'm probably making 100 decisions.
1:48:04
Now people go but Eric, aren't you gonna make
1:48:06
a couple of bad ones?
1:48:07
Yeah, but here's the trick.
1:48:09
If I only make, because I'm afraid,
1:48:11
if I only make three decisions a week
1:48:14
and one is bad, that's one third,
1:48:17
that's a pretty big impact.
1:48:19
But if I'm making 100 decisions a week
1:48:21
and one is bad, that's one percent.
1:48:23
Who cares?
1:48:24
So I've actually learned that if you do the data driven
1:48:27
and you're trying to make decisions as quick as possible
1:48:30
on having enough data and if not getting the data,
1:48:32
the more decisions you make,
1:48:35
the bad decisions almost become irrelevant.
1:48:37
And that's how you change the world
1:48:39
and grow a big business because if you're afraid
1:48:42
of making decisions and you're slow,
1:48:44
you're gonna lose out to the competition every day.
1:48:47
It's also, I mean, this is not just how you build a good business.
1:48:49
It's how you build a good life.
1:48:50
A good life, exactly, yep.
1:48:51
You've worked with some very interesting people.
1:48:54
You've worked with McAfee.
1:48:56
You've worked with, which administration
1:48:59
it was the Obama administration, right?
1:49:00
You've worked with Gates.
1:49:03
I think it would be fun if you could pick one lesson
1:49:07
from each one of those people.
1:49:09
What was that one lesson?
1:49:10
And you could pick one from the Obama administration,
1:49:12
one from McAfee, one from Gates.
1:49:14
And what were those lessons
1:49:15
and how did they impact your life?
1:49:16
So Obama, sort of biggest lesson I learned from him
1:49:21
was you get up three hours before your first meeting
1:49:27
and you spend that on yourself.
1:49:29
You spend that on sort of South evaluation, meditation,
1:49:33
journaling, and then planning out your day
1:49:36
and saying, what are the big things
1:49:38
that I need to accomplish today?
1:49:40
That was one of the things that, once again,
1:49:43
politics aside, he was a super smart president.
1:49:46
I mean, and he accomplished a lot.
1:49:50
You know what I mean, in there,
1:49:51
and that was his rule, he goes, Eric,
1:49:53
if I had an eight o'clock meeting, I got up at five.
1:49:58
If I had a seven o'clock call with somebody overseas,
1:50:01
I would get up at four, he goes, but what I found is,
1:50:04
if you get up and you rush right to meetings,
1:50:07
you're never grounded for the day
1:50:09
and you end up rushing making bad decisions
1:50:11
and your mind is racing.
1:50:12
But if you get up three hours
1:50:14
and you basically look at your agenda,
1:50:16
you get very clear, you get grounded,
1:50:18
you solve any internal problems
1:50:19
and you get very clear on what you want to accomplish
1:50:22
in each of your meetings, your productivity goes through the roof.
1:50:25
So that was sort of the big one with him,
1:50:29
with Bill, it's, know your strengths and weaknesses
1:50:33
and most people go, oh, play to your weakness.
1:50:37
What Bill always said is, higher people
1:50:40
that play to your weakness
1:50:41
and you focus on what you're really good at.
1:50:43
Most people don't realize this.
1:50:45
Bill was never CEO of Microsoft.
1:50:50
He knew that's not a strength.
1:50:52
He knew that his strength is on problem solving innovations.
1:50:57
So he would spend his time chief research officer
1:51:01
on always looking at evaluating, questioning what was doing
1:51:05
and always optimizing and improving.
1:51:07
He played to his strength.
1:51:08
The stuff he wasn't good at, he hired other people to do.
1:51:11
He knew he wasn't good at a CEO,
1:51:13
so he hired Steve Bomber, one of the best in the business.
1:51:15
So always play to your strength and not your weaknesses.
1:51:19
And then John McAfee, I saved him for last,
1:51:22
because he's my favorite, is crazy is good.
1:51:25
That they always say there's a fine line
1:51:27
between brilliance and insanity
1:51:29
or their next door neighbors
1:51:31
and his whole philosophy that he taught me is
1:51:34
you should have both houses built.
1:51:36
You should have a brilliance house
1:51:39
and right next door you should have a crazy house
1:51:41
and you should spend 50% time in each house
1:51:44
because that's how you truly innovate
1:51:46
and the one thing with John that a lot of people don't realize,
1:51:50
he bought and sold McAfee four times.
1:51:57
He basically sold McAfee for a lot of money.
1:52:00
Then the company that bought it basically took what they wanted
1:52:04
and McAfee sort of became this little thing.
1:52:07
He bought it back for pennies on the dollar,
1:52:10
rebuilt it again, sold it for top dollar,
1:52:13
let them drain it, get it small, buy it back for pennies on the,
1:52:17
I mean that was his cycle for repeating
1:52:21
and sort of my favorite John's story really quick is
1:52:25
when I would go down to the least to meet with him
1:52:27
because you know he got it,
1:52:28
he couldn't get back at the US and stuff
1:52:30
and we would always go to dinner
1:52:32
and you'd be like Eric,
1:52:33
you pick where you want to go to dinner.
1:52:35
I would always pick sushi
1:52:37
and after about four or five times is like Eric,
1:52:40
do you eat anything other than sushi?
1:52:42
And at this point I had a really good relationship with him.
1:52:45
So I'm like, John could I be honest with you?
1:52:47
And he said yeah, I'm like, the reason why I pick sushi
1:52:50
is I know you're brilliant but you're also crazy
1:52:53
and I know if I say the wrong thing at dinner
1:52:55
you might get very aggressive and if we're at a steak house
1:52:58
and you have a knife, that might not end well for me
1:53:01
but you can't do a lot of damage with the chopstick.
1:53:03
And then it was funny, after I said that
1:53:05
there's this awkward porous
1:53:07
and I'm like, okay, so he's gonna stand with a chopstick
1:53:09
and he goes, you're very smart.
1:53:11
He goes, he goes, you're right because I might do that.
1:53:13
He goes, so you're a really smart man.
1:53:15
I'm like, so that's sort of my John's story as we wrap up.
1:53:18
You've sort of said, for the entire interview,
1:53:21
cybersecurity is really everyone's responsibility.
1:53:26
If you look at your life now,
1:53:28
what would be your responsibility?
1:53:31
What is sort of your mission on this earth
1:53:33
and what do you think your purpose will be going forward?
1:53:36
So my mission now is all about contribution.
1:53:40
It's all about giving back.
1:53:41
It's one of those where I'm sort of at a point in my life.
1:53:45
I don't need to work, right?
1:53:47
I could be fine for the rest of my life.
1:53:49
I don't believe in retirement.
1:53:51
I believe if I retired, I would hurt myself
1:53:53
or hurt others because I would just be bored out of my mind.
1:53:56
So I'm never gonna retire.
1:53:57
So now I'm at the point now where it's not about,
1:54:01
you know what I mean, the making the money anymore
1:54:04
or the legacy, it's about contribution and giving back.
1:54:07
So that's why I give so much free, I write books,
1:54:09
I give away with online danger.
1:54:13
I actually bought 3,000 copies.
1:54:17
So it cost me about 40,000 and I gave them the schools
1:54:20
and teachers and churches and stuff.
1:54:22
You know, me people that normally couldn't afford
1:54:24
that to give back.
1:54:25
So I'm all about contribution giving back.
1:54:28
I go to a lot of seminars like motivational,
1:54:32
which people like, what is a cyber guy?
1:54:33
And it's really like you did to help educate and give back.
1:54:36
So yeah, I appreciate you let me be on the podcast
1:54:39
with sharing my message with the world.
1:54:40
And then here's the craziest thing.
1:54:42
Craziest thing is for the last five years,
1:54:45
I focused 100% on contribution.
1:54:47
Like I'm like, okay, this is a terrible business idea.
1:54:51
Right, it could lose money, but it's gonna help people
1:54:53
be safer and help protect them and I do it.
1:54:56
And the more I focus on contribution,
1:54:58
the more money I make.
1:55:00
It's the craziest thing to be here.
1:55:01
People say that, but it's so true.
1:55:03
When you focus on money, it ends up being a struggle.
1:55:06
When you focus on your purpose, your mission
1:55:08
and contributing back, you end up not only being
1:55:11
happier and having more fun, but you have to make it
1:55:13
more money too.