Kamala Harris’s Bratty Coconut Memescape + What Does $1,000 a Month Do? + The Empire CrowdStrikes Back

24:36Elizabeth Rhodes, welcome to Hard Fork. Thanks so much for having me. So before we get into the findings from this study, I want to start by talking about what your goals were with this project. So what was the research team hoping to find? When we started this back in 2016, it's been a while, there wasn't much going on in the space in the U.S. There were not a lot of other pilots. The most recent studies have been back in the negative income tax studies of, you know, the 60s and 70s. So we really wanted to approach this as an exploratory foundational study to ask the broad, open-ended question, you know, what happens when you give people unconditional cash?

25:16And understanding the role of the cash in participants' lives. And universal basic income, as I understand it, is not a new idea. It's actually been around for quite a long time. Various politicians have advocated for it over the years. But this is sort of, from my understanding, like the most rigorous study of what actually happens when you try to put something like UBI into practice. So technically, this is not a UBI because if it were, there would be no income requirement, no age requirement. Every single person within a community would get it. And obviously, that's really difficult to test.

25:49We considered trying to find a town with a thousand people, but it's not representative of the country as a whole. And also, what happens if you found shale under that town or during the course of the study? So we aren't actually able to test a basic income, we're testing more of unconditional cash. Yeah. So I just want to talk about methodology for a second because I read the studies and it's just incredibly complex undertaking to study this many people in a kind of randomized control way. So walk us through sort of like how many people were involved in the study, how you found them, how much money they got, the study design.

26:29Walk us through that a little bit. That was one of the most exciting parts for me. We have 3 ,000 participants. They were recruited from Illinois and Texas. We wanted to have a group of people that came from different geographies. So that's one thing that a lot of other studies that are place-based don't have. And so we have rural counties, urban, suburban, medium urban, large urban. And we sent mailers to randomly selected addresses. We had targeted Facebook ads. There's an app that a lot of SNAP recipients use to manage their benefits. We put ads there. So we didn't want to have a massive call for applications.

27:08We really wanted a randomly selected group. Was it hard to come up with that ad? Because just imagine, you know, you're browsing Facebook and it said, hey, you want$1 ,000 a month for no strings attached? If I saw that, I might think somebody's trying to pull something on me. Actually, so our control group gets$50 a month. So everyone was participating in the program. And so we talked about it being$50 or more a month. So there was no ad saying$1 ,000 a month. So of the 3 ,000 people in the study, 1 ,000 actually got the highest payment, the$1 ,000 a month payments. for the length of the study.

27:43And then there was a group of another 2 ,000 people who just got$50 monthly payments. Why did you design it that way? We were asking a lot of participants. We collected an enormous amount of data, which is really exciting to work with. But also, you know, we sent monthly surveys. We had an app. And so having a control group that didn't receive anything wasn't something that we were willing to go with. And how did they actually get the money? Is this like a debit card or how'd you give it to them? We actually custom built a payments processing system where they, now there's a lot more technology out here for this, but at the time we weren't finding a lot of off-the-shelf options.

28:21So we linked existing bank accounts and that's how the partners distributed the cash transfers. There were a number of people that were unbanked, so we helped them open up an online bank account or if they weren't able to do that, we had a prepaid debit card. Yeah. Yeah. What was the, like, I don't know if you interface with these people directly, but I'm so curious what the reactions were from these participants when, like, you get the, I don't know if it was an email or a phone call saying, hey, you're about to get another$1 ,000 a month. Oh, I got to make a couple hundred of those phone calls.

28:52And it was really illuminating. I think I should have walked away from those calls having a better sense of what we were going to see, because every person I talked to had, like, a very unique need in that moment. Someone had finished beauty school, but couldn't afford the cosmetology license, so couldn't get a job. Someone had a$300 speeding ticket. Someone was just diagnosed with cancer. Like there were, you know, hundreds of different specific needs that people had. And in that moment, like cash was the only thing that could be used. It couldn't take care of all of them by any means, but could be used towards addressing those.

29:26And then immediately you see that, that it's going to go in so many different directions. And am I right that the median amount of money that people made who were getting these$1 ,000 a month payments was about$30 ,000 a year? Yes, the average was about$30 ,000. Okay. And you mentioned data collection and sort of what happened to participants in this study after they got the money. I read the sort of methodology parts of these studies and was just amazed. You not only had an app that they had to sort of download that would track their time and allow them to sort of like say, what am I doing? How am I spending my time on every day?

30:03but you actually took their blood. Is that correct? You know, there's this really strong correlation between income and health across time, across countries. And so we did collect blood samples to look at markers of health like A1C, cholesterol, C-B-A-2 protein. To figure out if the sort of guaranteed payments had had an effect on their overall health. Yes. Got it. Wow. All right. Well, so why don't we get into the findings from the work that you did? There is a lot in there, and people can go on your website and read more. But I want to start by talking about mental health. One of the interesting findings in here is that participants experienced reductions in their stress and mental distress in the first year as they start to receive these payments, but that these benefits basically go away in subsequent years.

30:52So why do you think that is, and was that a surprise? I think perhaps a bit of a surprise. I think one thing to acknowledge sort of up front before we go into overall, is that these are sort of the average effects across all participants. Our next phase is to dig in and try to see like four different groups of participants, did they experience differently? But I think I have a couple of theories. I don't know if any of them actually hold, but the first transfers were distributed during 2020, which was a very unique year, both in terms of all the things that were going on, but also existing benefits.

31:24So there were a lot of pandemic era aids that expired by the end of 2021. And so it could potentially be some of that. They were losing some benefits. It could be an adjustment to a new normal. I'm not entirely sure. I was surprised. And just to get the timing right, during what years did people get this$1 ,000 a month? November 2020 to October 2023. Got it. Got it. A lot of people who are skeptical of universal basic income or of these sort of guaranteed cash transfers, will often say that this is a bad idea because, you know, people are not going to use this extra money, you know, productively.

32:03They're going to spend it on, you know, drugs or lottery tickets, like stuff that is not going to make them happier and wealthier in the long run. What did your study find about how people were spending this money? Largely, they were spending it on basic needs. The three biggest categories were food, transportation and housing. Another larger expense was on support, financial support to others. But I think it also varied a lot based on starting income. I think that's another sort of high level takeaway is the cash means something very different at different income levels. And what effect did it have on the amount that people worked?

32:42Because that's another big sticking point among skeptics of universal basic income is, you know, you give people money, they're just going to sort of like, they're going to work less, they're going to spend their free time, you know, playing video games or whatever, it's not actually going to make anyone's life better. What did you find when it came to how much people worked after they got this money? Overall, we saw some modest decreases. At any point in time, recipients of$1 ,000 were about two percentage points less likely to be employed. They worked about 1.3 hours less a week, which adds up to about eight days a year.

33:17But there was quite a bit of variation across the sample. For example, single parents decreased their labor by more than non-single parents, and those under 30 also worked a little bit less. We didn't see any effects on those over 30. We do see suggestive effects of under 30 pursuing more education. So, you know, it's a complex story. There was also some curiosity about whether receiving these cash transfers would make people more likely to start a business. I was personally curious about this because I never would have started my business unless I had a lot of savings in the bank. What did you all find when it came to entrepreneurship?

33:58We found a significant increase in interest in entrepreneurship and ideas for businesses. We saw very strong effects across everyone on those levels. That didn't necessarily translate into everyone. We didn't see a significant effect overall on starting businesses. though by the third year among underrepresented groups, especially women and Black participants, we did see increases in starting business by the third year. So you see how that adds up. But I think one of the things that from talking with participants came clear to me is, I think, tied to that entrepreneurship interest is the need for more flexible work options, especially for people who are single parents and they don't have, you know, daycare is really expensive.

34:43It works also nine to five. People don't work nine to five often. A lot of jobs are available that are overnight shifts. And so that flexibility is, I think, having the time to kind of think about a business. There was definitely a big increase in interest and ideas. Yeah. What were some of the things that you expected to see out of this, maybe when you, at the outset of the project that you didn't find in the results? That's a good question. And it's one that I have a hard time answering. I think, because I've been living and breathing this for the past, you know, eight years. I knew always that it was going to be a complex and nuanced story, but probably some of the stress reductions I didn't expect to fade out quite as quickly as they did.

35:29I think there's unreasonable expectations from a lot of us about what an extra$1 ,000 a month can do at different income levels. And so, you know, it allows people to pay their bills and rent, But it's not going to necessarily transform your lives. I mean, I remember I reported on the Andrew Yang campaign and spent time with him talking about his idea of a freedom dividend. That was his sort of rebranding of universal basic income. And his big central idea of his campaign was that if you give people$1 ,000 a month with no strings attached, it will kind of heal all of society's problems, right?

36:04We will no longer have poverty. We will, you know, we will all be able to afford basic necessities, but also it'll sort of bring us all together because we'll all be getting these checks and it'll sort of bond us. And I'm, you know, making his argument seem a little more rosy than it was. But basically there was this idea, especially among some people who supported the Yang candidacy, that this would sort of heal all ills. And it seems like what your study found is that it doesn't. Absolutely. I think there's a couple of responses to that. You do see a bit of a disparity when you look at the sort of the high level overall statistics and you talk to participants.

36:43There was this sort of intangible sense of agency that by having this cash and being able to prioritize their specific needs that people talked about and it came up a lot in the conversation that that ability created possibilities for people. Not everyone, obviously, because poverty limits choice. It limits agency. And people were like, well, I paid my rent that I was five months behind on. Like, I didn't have a lot of choices. And so we do see that it has different effects based on individuals' circumstances. Yeah. A lot of the folks that I follow online and have talked to about UBI and sort of related ideas over the years were really disappointed by the results of this study.

37:28The effects that the proponents of universal basic income were hoping to see, you know, people's job quality going way up, their health becoming way better after getting these payments, just didn't materialize or didn't materialize to the degree that they had hoped. But I'm just curious what you make of the kind of UBI community's reaction to this study, that they're excited that it was done, they appreciate how rigorous it was, but the findings kind of bummed them out. To me, one of the important goals of the study from the beginning is not only to look at the potential and the benefits of cash, but also the limitations.

38:03Because this doesn't, we didn't find negative, you know, it wasn't like people went out and, you know, right. It's going to ruin their lives to get these cash transfers, but it also doesn't seem to have helped many of them in the ways that some economists were hoping it would. Yes, and I do think, you know, we do see in our qualitative sample people for whom this did achieve some of those things. We had a participant who was able to take a job that paid, she was making$18 an hour, and she had this other opportunity that was$14 an hour, but it seemingly had opportunities for growth. she couldn't have afforded to take it without the money.

38:41Then by the end of the study, she had received two promotions, had a full-time job with benefits. You know, someone else was able to participate in a year-long job training program. So there are examples. And so I think our question is how to dig in to see, like, what are those conditions that create those possibilities? And where are the limitations? Like, we know that we had a sample that was struggling with a lot of chronic health problems. And$1 ,000 a month can't buy good health. So that's kind of what I wanted to dig into. You know, I mean, this was like 20 years ago, but my first job in journalism paid$28 ,500 a year.

39:15And over the next, you know, five or 10 years, I eventually got paid another$12 ,000, right? So I basically got the amount of money that you gave those people. And there was absolutely a change in my quality of life. But I think of it mostly as like a little bit of peace of mind of like, you know, my car breaks down or I have a medical emergency, like I'm not going to be out on my back in the first month. And that was like great. But if you'd asked me like how different is your life than it was three years ago when you were making$28 ,000 a year, I would have said, well, it's like basically the same.

39:45So I'm so curious what we think would have happened if you'd like doubled the payments or tripled them. And do you expect that you wouldn't actually see incremental changes here, but maybe you would just see wildly different results? Yeah, that's a great question. I'm not sure exactly what would happen if you doubled or tripled. I think providing some of the systems, the support systems, that whether it's robust health care or other things would help people meet those needs and then have more opportunities to use the cash. One of the things that we do see is people actually experience more unexpected expenses, partially because they are buying cars that maybe break down.

40:26Or there's an increase. People are more likely to be paying for housing as opposed to staying with other people. And so, you know, they are taking on more expenses as well. Some people have said, mo' money, mo' problems. Yeah. I was going to say that, but I didn't, you know. That was Milton Friedman, right? I believe that was. Yes, yes. I mean, one thing that I've heard from people in the tech industry who are sort of looking at universal basic income or something like direct cash payments as a way to sort of cope with what they believe will be widespread job. loss after AGI arrives, say, is that there's sort of this idea that people will still need meaning in their lives.

41:13People, you know, who get, you know, who get laid off because their job was replaced by AI, they're not just going to be sort of satisfied with, you know, getting a little bit of extra money to pay the bills, but there's actually something sort of important about work on a sort of spiritual and existential level that we are sort of not creatures who are designed to sit around all day playing video games and making art and talking about philosophy. What did you find in the study about how people's sort of attitudes toward work did or didn't shift after they got these payments? I think it depends a lot on what type of job you're working in, in terms of how much meaning it provides.

41:52There are people that we talked to who were working incredibly difficult jobs, working 60 hours a week that were physically hard on them. And the chance to work one less job or cut back those hours meant a lot and actually gave them more meaning because they were able to spend time with their kids. One of the things that I found interesting was the growing interest in entrepreneurship and having ideas for businesses. We saw a lot of increase in planning for the future. And in a lot of ways, I feel like it gave people some space to sit back and think about what would they do if they had more opportunities.

42:33Because there are a lot of people, I think, now that are just surviving and maybe work is not providing that sense of meaning and they don't have those choices. Yeah. I mean, can I just say, Kevin, that question, which a lot of people really are asking, just feels like the most American Puritan question I can possibly imagine. You know, it's like, if you're not working like eight to 10 hours a day, your life could not possibly have any meaning. And if we were to give people$1 ,000 a month, then all of a sudden, like, we will lose our being. Anyway, it's just like, it's the most American idea that you can have.

43:12And I would posit that, you know, maybe people could work one hour fewer a day and, you know, the country would be okay. Wow. Spoken like a European. I'm going on strike after this episode, by the way. So one of the backers of this project is Sam Altman, the CEO of OpenAI. He's been talking about universal basic income for years as a sort of antidote to widespread AI-related job loss. It seems like recently he might be cooling on the idea of UBI. He recently said in an interview that he now wonders if a better approach would be something like what he called universal basic compute, basically giving everyone sort of a slice of the computing power to, you know, to run their own versions of GPT-7 or whatever.

43:58What do you make of that? And do you think attitudes in the tech industry toward UBI are shifting at all beyond him? I mean, I can't speak for Sam. I have heard him talk about basic income being one piece of a larger policy framework, which I think is very true. And what we see from this study is that people need more than just money sometimes or what amount of money people need. Like there's a lot of people that aren't able to participate in the economy now or share in the benefits of the economy. And they're not don't feel like they have a voice now. And so I think for me, it is a question that we should be asking ourselves now about all the challenges that individuals and families are facing and the inequalities.

44:40They're only going to get worse. They've gotten worse over time. And so thinking about how do we create a more inclusive economy now, and I think it probably involves more than just money. I think Sam is thinking about those things, although I can't speak for him. Have the findings shifted your own thinking about UBI? Do you still think it's kind of a promising idea? How did the research change the way you thought about it? People have asked a lot of questions. It's like, does this work or does cash work? And my sort of immediate response is, does food work, right? Like, everyone does need cash.

45:19I think a question that I have is, what does it look like for it to work? And what are the goals that it should achieve? And one of the things that we learn the most is that cash is an imprecise tool. If you're trying to move health, for instance, for everyone, there's probably a better way to do that. Some of the average treatment effects being null can be masking like very strong improvements or improvements, small improvements across a number of different dimensions for different people. And so measuring that and sort of what are those metrics, what is the goal of this policy, I think is a critical question.

45:56Like this was not supposed to be a referendum on UBI or a specific policy. It was what happens when you give people cash and understanding, like we have very granular data on the lives of participants over three years. Also, I'm going to guess that none of the participants like wrote a note to you at the end saying, you know, I really regret taking this money over the past few years. And if anything, I wish it had been less. Well, as someone who thinks that AI will change the labor market in many ways over the next decade or so, and will change a lot of people's jobs and will eliminate some people's jobs, I'm really glad that these kinds of studies are happening.

46:32I'm really grateful for the research that you and your team have done, even if it didn't, you know, make the proponents of universal basic income universally happy. I just think we need a lot more people looking into what does a society look like when AI can do 20, 30, 40 percent of all jobs and how do we sort of help the people who may fall through the cracks? So I just think this is incredibly valuable and important work. I think it's really important to be proactive. And, you know, we learn a lot from these studies about what works, what doesn't, under what conditions. And I think that is really important work that needs to continue.

47:08You know, it's just occurring to me that you're a researcher whose last name is Rhodes. You must get so many Rhodes Scholar jokes. No, not usually. Oh, wow. Okay. Well, I'm excited to tell people we have a Rhodes Scholar on the show this week. I'm honored. Yeah. Yeah. Well, thanks for coming by. It's really good to talk to you. Thanks so much. Thanks. When we come back, CrowdStrike pushes an update to its Falcon software, and then everything goes Falcon Haywire.

47:49Well, Kevin, this past week saw us all getting a harsh lesson in the dangers of using a Windows computer. I assume you're talking about the global tech meltdown that happened last Friday. I am. On Friday, July 19th, a faulty update to cybersecurity software from a company named CrowdStrike took down millions of computers, causing a global calamity. This bug knocked Sky News offline in the United Kingdom. It took out 911 call centers for a while, and it grounded commercial airline flights. And on that last point, our team, which had been visiting us last week here in San Francisco, their flights were delayed and canceled due to this bug.

48:29And that makes this personal, Kevin. Well, it's personal for me because I was also supposed to fly out on Friday. I don't care about that as much. I feel bad for our team. But what happened to you? Well, I was scheduled to fly to Cleveland to see my family. And the morning of the flight, I got a notification that my flight was three hours delayed. and it actually did end up taking off. But it was very bizarre. I went to the airport in San Francisco and all of the screens were down, like that show you the arriving and departing flights. And at the gate, like the screens that show you, you know, boarding group one is now ready to board were just completely either black or they had sort of gotten the blue screen of death.

49:09And this really was, you know, so of course if a Windows computer can't boot, it will show you what is known colloquially as the blue screen of death. And this is the moment when we found out how many computers around the world were running on Windows because all across social media, we saw these, frankly, beautiful photos of these like everyday environments where there were these giant screens that were just showing the blue screen of death out of nowhere. And it truly seemed like an experimental art project that like Grimes would have done. It was pandemonium at the airport because not only were a lot of flights delayed and canceled, but the actual like the computers in the restaurants and like the Hudson News kiosks, many of them were down.

49:45So, like, I tried to get some snacks for my flight, and literally all of the self-checkout things were down. There was one register open, and, like, they were doing the tabulations by hand on paper. Oh, no! It was cash-only. Like, we had reverted to the 19th century. Well, look, I mean, this seems like a very dangerous situation if we're going to have to be doing calculations by hand in this weird future that we're living in. So we need to get to the bottom of this, Kevin. Yes. So, you know, by now, some of you may have heard some details about how this happened. But today, we want to offer you the clearest explanation we can give you of how just one 40-kilobyte file can crash the global IT infrastructure and to discuss what we can do to prevent it from happening again.

50:29Because we're very solutions-oriented on this podcast. It's true. So to talk about this, we're bringing on friend of the show, Kate Conger. Kate is a tech reporter at The New York Times and has been covering this CrowdStrike debacle for the past week. So let's bring her in. Let's bring her in.

50:46Kate Cogger, welcome back to Hard Fork. Thank you so much for having me. So what were you doing when you learned about the crowd strike situation? I was waking up. Because it actually started sort of very early in the day Pacific time, right? Right. Yeah. Well, I was in New York last week. But yeah, it happened overnight, basically. So we're still waking up to it. And did it seem like a really big deal at first? Or did that sort of dawn on all of us more gradually? I think it seems like a really big deal right away but I'm waking up in when it's already been happening for several hours so I think I had enough context to be like oh this is quite bad actually I I had this experience of seeing all the photos on social media of the blue screens of death like like including in a lot of places where like they shouldn't have been there you know it should have been showing you an advertisement or like you know airport departures or whatever instead it was these blue screens everywhere did those also strike you as very beautiful I do really like them.

51:42Yes. Well, and the little frowny face that some of them had, the frown emoji, I was delighted by. But we should say, like, lest we be accused of making jokes about a global tech outage that did actually have— No, you're joking, but it did. I would never. Hospitals, schools, airlines all experienced outages as a result of this. So, Kate, from your reporting on this, who sort of felt the brunt of this outage and how? I mean, I think you just kind of ran through the list. I mean, 911 centers, airports, hospitals, and then, of course, everyone that's relying on those services, right? You know, I think we saw a lot of people talking about having surgeries or procedures they were supposed to get canceled.

52:24Obviously, tons and tons of flights got canceled. So, you know, very quickly went to critical businesses and then to all the customers that are relying on them. So let's go a little bit deeper here. And Kate, I have to ask you a question that I hope to never ask on this podcast. And it goes like this. What is CrowdStrike? Okay. So CrowdStrike is a huge cybersecurity company. And I think everyone outside of the security industry woke up on Friday and was like, what is this company? And I think everyone within the industry knows them to have this almost mythic status of being the guys that are called in to fix it when you have no idea how to fix it.

53:03Yes. So they have a pristine reputation in the cybersecurity industry. They were called in for the 2014. hack on Sony Pictures and when they're trying to figure out, you know, how North Korea had gotten all their files and dumped them. Again, the Democratic National Committee calls them in in 2016 to investigate the email hack and leak where we saw Hillary Clinton's emails exposed. And so they are kind of known in the industry as the people that can come in, track very sophisticated nation state actors and remediate those kinds of really intense hacks. So in a lot of ways that up until this happened, these were the last people who you would expect to be behind a global IT outage.

53:43Yes. They were the people you would call to fix it. I did not actually realize until this happened that they also make their own software that goes on millions of computers around the world and that that's part of the reason that this happened. Because you only knew them from those things you just mentioned. I only knew that they were sort of the fix-it guys that you would call when something calamitous happened to your computer network. All right. So all of this happened when CrowdStrike was updating its Falcon software. What do you know about Falcon and what were they trying to update here? Okay.

54:14So Falcon is a piece of security software that I think we have on our computers at work, probably. And it's on, I think, 300 of the Fortune 500 companies use their software. That's a lot of Falcon companies. Yeah. So what does it do besides leave kids stranded at the airport? Okay, so the way the CrowdStrike software, the Falcon software works, it sits sort of at the kernel level of the operating system. And I'm already watching you glaze over. No! This is sort of... You have to know about the kernel. It's like a Kentucky Fried Chicken. You have to know about the kernel. One must always think of the kernel.

54:51One must always. So what is it? So this is sort of the heart of the operating system that gets the computer going, boots everything up, and then you have all the software kind of and the apps that you use running on top of that. This is like the first thing that happens when you turn on a computer is that the kernel gets involved. So before even the operating system is loaded, right? Yeah. Yeah. And so CrowdStrike has access to the kernel, which is like that's already, some would say, a risky thing to give a company access to, right, because of all the havoc and wreak. Right. But if you're thinking about – I mean, take a second and think if you've gone into hacking instead of podcasting.

55:25I've thought about that in the past. I'll admit it. Sure. Who among us? But, you know, if you're thinking about how you want to get access to a system that you're trying to spy on or infiltrate, you know, would you rather be at the software level or get into someone's email account? Or do you want to be sitting at the very base of the system so you have that broad, broad access? Yeah, so you want the kernel. Right. You want to go wherever you want to go in the system. And so that's part of the reason why CrowdStrike software sits there. It wants to monitor activity that's going on and see, you know, what kind of malicious things might be happening kind of beneath the surface.

55:59All right. So CrowdStrike has access to the kernel. What goes wrong? Okay. So they send an update out to Falcon, and the update is meant to look for a new kind of attack that they've started to see and detect. So file goes out, and there is a problem with the file. And so when it's installed on the system, the computer tries to boot, and then it fails. And then it will try to boot again and fail and boot again and fail and boot again and fail. And so then you get to the blue screen of death. I mean, presumably before they push out updates to millions of computers that use the Falcon software, CrowdStrike is doing some kind of internal testing on a smaller set of computers to just say, hey, does this break the operating system when we push out this update?

56:50So what do we know about how their internal quality control process might have failed here? Yeah, so they do a lot of testing and they just put out a blog post about how they run through that and what went wrong. And they do a mix of automated testing and, you know, hands-on personal testing. And they said that there was a problem with the testing software that they use that allowed the flaw to slip through in this update. And then they shipped it. Yeah. Now, that said, the fact that they didn't test it more before sending it out, would you say that was a huge Falcon mistake? I mean, it does seem like there should have been more testing here, obviously.

57:32Like, this is something that should have been caught. It wasn't. There's also a question of, you know, wanting to roll out an update to every single computer that's using your software at once. And it's one of those kind of classic tug of wars that you see a lot in security where you want to get the fix to people as quickly as possible. So if they are presently under attack, you can detect it and stop it. So ship the update everywhere, right? But, you know, should you happen to make a mistake in your update, perhaps ship it in like a staged fashion. So it's going to a couple people and then a couple more people and you're making sure that you don't cause a global internet.

58:11I mean, that's what we do on Heart Fork. Every episode, we ship it out to a small number of test users to see if it crashes their phones. And if it doesn't, then we send it out to the rest of them. That's not true. I have possibly a dumb question, Kate. So CrowdStrike pushes out this update to Falcon that breaks all of these computers and prevents them from loading. But they know there's a problem right away, and they know that there's a fix to this. Why couldn't they push out a second update to fix the problems in the first update? So that's what they did. A little bit less than an hour and a half after the first update.

58:41So they send the bad update. They go, oh, no, something has gone wrong. And an hour and a half later, they send a second update that will, in theory, fix the problem. But I've also seen reports that it could take weeks before all of the computers that are affected by this are fixed or, you know, back online. So what's the disparity there? Why did this problem continue late into Friday? Okay. So all of the computers that got the bad update, 8.5 million or so, were online, obviously, at the time that the update was shipped out. And like we talked about before, they are now in this cycle of crash and reboot and crash and reboot and crash and reboot.

59:24And because the Falcon software is sitting sort of at the kernel level of this operating system, a lot of these computers are not booting up far enough for the new update to come through and fix what's happening. That is something that started to happen. And I think Microsoft was even suggesting to their customers, try rebooting the computer 15, 20 times. And that update might come through and come onto the system. That sounds like trolling. You know, if someone is like, oh, did you try rebooting it 20 times? Come on. But I guess it works. One of the blue screen of death images that I saw, the text on it was like, you know, if you are comfortable doing the reboot, try it.

1:00:04if not, call someone you trust. It's just like, so my mom? A coach, a parent, a trusted friend. Yeah. I also saw people suggesting that this could be manually fixed by like going into the recovery mode of the computer and like deleting a certain file from a certain folder. But if you're an airline like that has, you know, a hundred thousand computers all running windows with this same thing, you're not going to be able to like go individually to each of those computers very quickly. Right. So yes, you could do, I think Windows calls it safe mode, but you could put the computer into safe mode, go in, delete this bad file from the CrowdStrike software, and then, you know, reboot as normal.

1:00:49There's a couple of problems with that. One, a lot of the computers that are crashed by this are not necessarily computers like a laptop where you have a keyboard right there that you can kind of log onto the computer, go in and delete the file. There's servers in a data center. Right. Yeah. Or like I saw, you know, I was at the gym the other day and a bunch of their screens were still blue. And it's like, you know, the big TV screens that are in the gym, there's no keyboard there. And who knows where that screen is actually running from to go track it down and remove the file. Two is that a lot of these computers exist in big enterprises, right?

1:01:24Like big companies. And a lot of these companies have very smartly locked down some of the machines that they use. So not any person in the building can go in, put the computer into safe mode and start tinkering with it. So I think that that's an issue as well, is that some of these devices are locked down so that only certain users have the permission to do those things. And so when you're in this panic moment, all your screens are blue and you have to wait for the one guy that has permission to go around and fix the computers. It's going to take a while. So this bug only affected Windows computers.

1:01:57Is that because only Windows and Microsoft work with CrowdStrike in this way? Do Mac computers not have this specific piece of software? Why was it only a problem for Windows users? This is super interesting. I love this question. Okay, and this gets into Microsoft lore. So in, I would say, I think this is like the mid-2000s or so, so like 2005 to 2010-ish, Microsoft was working with a variety of different security vendors. And then Microsoft was like, hey, what if we acquired some of these security vendors and started bringing them in-house and owning security companies? And then the EU was like, hey, wait a minute, besties, that bothers us for competition reasons.

1:02:46So you need to figure out how to make your operating system competitive for other security companies that want to compete in that space. And you're not privileging the ones that you've acquired and brought in-house. So that gets to a point where Microsoft basically decides we're going to have a more open kernel and we're going to let multiple security vendors play in this space, make software that runs in this space. Because, just to be clear, a thing that Microsoft could do would be to prevent companies like CrowdStrike from getting access to the kernel, but they get regulatory pressure, you're saying, to not do that.

1:03:22Right. So Microsoft is under regulatory pressure to allow a multitude of cybersecurity companies to have that kind of access. Apple does not have that issue. They have a completely closed kernel, no software, including CrowdStrike, which runs on Mac, has that same level of access. And I believe Apple, I want to say in 2019 was when they cut off kernel access and they created this whole other system that allows CrowdStrike software to work on macOS without getting that same kind of deep, deep access to the operating system. I see. I noticed that Microsoft, in the wake of this outage, was very quick to say, this was not us.

1:04:03We did not cause this. We are not responsible for it. This is CrowdStrike's fault, even though it happened on Windows machines. So what kind of response has Microsoft had in maybe tightening up their security ecosystem after this outage? So I think Microsoft is in a little bit of a tough spot with this because, you know, it isn't a flaw on their end. And, you know, I think we talked about this earlier, but there's this catch 22 of security, right, where you want to have the best protection you can have as quickly as possible. But, you know, if those updates aren't sufficiently tested, then you have a crash coming.

1:04:43So, yeah, I think it's I think it's a really tough position for them to kind of strike. Yeah, I mean, with security software in particular, in order to keep you safe, it just needs access to everything on your computer. So it's like, in a way, the security software itself is going to be the least secure thing on your computer because it is essentially a single point of failure. And if something goes wrong with that, well, then now all of a sudden, you're in a tough spot. And as Kate just explained to us, Microsoft said, well, hey, we could fix that. And then regulators said, no, you can't. So I agree with you.

1:05:13This is a catch-22 for them. Well, and it's kind of interesting, too, because now you have the antitrust scrutiny shifting over to CrowdStrike. And people are saying, hey, wait a minute, like, should a security company have this kind of marketplace dominance where they ship a flaw and it takes out industries around the world? You know, and again, you have that same catch-22. It's like, sure, should we all be using the exact same company for these needs? Maybe, maybe not. But if you're sitting there trying to pick out your cybersecurity software, aren't you going to go with the guys that were called in for the Sony?

1:05:46Right, right. Well, I think that takes us into the real question that I want to get at today, which is, can something like this be prevented? So what thoughts are out there right now about what we might be able to do to prevent something like this from happening again? So, I mean, I think the big thing that I keep hearing from people in the industry is to think about testing in a different way. I think a lot of software testing has shifted to a fully automated system where there's kind of like running the software real quick through these automated systems, checking a box, it's good to go. And, you know, not really heavily scrutinizing and having a person sit down and look and say like, OK, is this working?

1:06:29have we tried testing it on this old, outdated operating system that we know some of our users are still on? Have we tried it in this environment? Have we tried it in that environment? And it just seems like, you know, getting a more robust testing system would help with some of this stuff. I think there's also maybe going to be some renewed debate in the industry about, you know, the depth of access that software vendors are allowed to have on your machine. Obviously, you know, Apple comes out of this looking very prescient for making that change and kicking everybody out of their kernel when they did.

1:07:00I have been thinking a lot this year about a word that I keep hearing, which is dependencies. And we talked about a few months ago on the show, this one random database engineer at Microsoft who may have inadvertently sort of stopped a massive cyber attack because he spotted this malware in this piece of Linux software. You're talking about Andres Freund. Andres Freund. Yeah. And in the wake of that story, there were all these sort of people in the cybersecurity industry saying, our infrastructure is way too dependent. We have too many dependencies on these kind of obscure open source projects, these obscure vendors, these obscure things that, you know, they're installed on millions of computers, but that maybe aren't overseen with the level of rigor that they should be, given how important they are to our sort of global tech infrastructure.

1:07:50And that's what I'm thinking a lot in the wake of this CrowdStrike incident is just how dependent we are as a society on these things that most of us probably don't even know exist, that even people who write code for a living may not routinely interact with, but that are so important and that we have very little insight or access into. So do we need some kind of like a national online infrastructure movement, like the way that we have infrastructure bills to like invest in our roads and bridges? Like, do we need some kind of a national effort to just firm up the infrastructure that our global technology landscape depends on?

1:08:30I mean, I love that idea. I think that sounds so fun. But yeah, I mean, I think the, to go to your broader question about the architecture of the internet, I think the internet is a very fragile and beautifully built thing. And I think there's so many fun quirks and weird things about the way the internet works. Like you mentioned all these open source projects, all these, you know, protocols that are sort of written by committee and voted on by people who are just volunteering to like make sure the internet works good. You know, it's really cool and beautiful and also quite fragile. And I don't know.

1:09:08I mean, I think there's an instinct to say, yes, we should consolidate this. We should have more oversight over it. We should try to run it in a coherent and structured way. But I also think that like that's something that's really beautiful and special about the Internet is that anyone can have access and can get involved in sort of the in the plumbing of it and work on it if they want to. And, you know, maybe the thing that solidifies and kind of reinforces that infrastructure is the fact that people are becoming more technically savvy and more people are getting involved in those projects. You know, I think I think that's sort of the dream.

1:09:47I'm still kind of like in the the web should be free mindset, I think. And I kind of, you know, I don't love the idea of saying, OK, like, you know, we're going to have a I don't know, a national Internet infrastructure board that's going to run the Internet. Totally. I mean, obviously, this particular outage has largely been resolved. But are there other things that you're still waiting for? Are there other shoes to drop here? What do you think comes next in the CrowdStrike story? So I think a couple of things. One, I mean, things are mostly back to normal, but, you know, I'm still seeing blue screens here and there at the gym and the airport, et cetera.

1:10:24And so, you know, I think there's still remediation to be done there. And then, you know, I think there's still a need for public accounting of what exactly went wrong and how we got to this point. And, you know, I know CrowdStrike CEO has been asked to come and testify in Congress. So I think it'll be interesting to see what he says about the process and how they got to this point. But in the meantime, Kevin and Kate, I am pleased to tell you that some level of justice has already been delivered. This just broke on TechCrunch. CrowdStrike has offered a$10 apology gift card to say sorry for the outage.

1:11:00This sounds like a joke. It is not. They have been emailing customers to offer them a$10 Uber Eats gift card as an apology. And the accompanying email says, We send our heartfelt thanks and apologies for the inconvenience. To express our gratitude, your next cup of coffee or late night snack is on us. Is that real? This is real. I guess I will share this in the chat. A$10 Uber Eats gift card. Sorry we screwed up your entire infrastructure and made hundreds of thousands of people miss their flights. Here's$10. I think that's lovely. Yeah. So thank you to CrowdStrike for resolving this issue with a gift card, and we won't be discussing it any further.

1:11:44Kate, thanks for coming in and may the forces of the internet protect your computer from CrowdStrike. Casey, thank you so much. This was so fun. Thanks for coming by.

1:12:38Thank you. Kate Lepresti, and Jeffrey Miranda. You can email us, as always, at hardfork at nytimes.com. Keep those direct cash transfers coming. What's your Venmo again?

1:13:12Thank you.