Srsly Risky Biz: Russia's digital detox boomerang

0:04Amberleigh Jack: Hey everyone and welcome along to Seriously Risky Biz. This is our podcast all about cybersecurity policy and intelligence. My name is Amberleigh Jack and very shortly I'll bring in Tom Uren, our policy and intelligence editor, and we'll have a bit of a chat about Tom's newsletter, Seriously Risky Business, that he has written up this week. And if you are not yet subscribed to that, you can find it, read it, subscribe. It lands in your inbox every Thursday. Just head along to our website, risky.biz. Before we get into today's show, though, I'd like to thank our sponsor, which is open source cloud security platform, Prowler.

0:37Amberleigh Jack: And you can find them at prowler.com. Tom, it has been far too long since you and I got together. It's so good to see you.

0:44Tom Uren: Good to have you back, Amberley.

0:46Amberleigh Jack: Now, Tom, I want to jump straight into your first piece. And you have taken, I love the title, actually, Russia's Digital Detox Boomerang. You've taken a look at the Ukrainian strikes on the data centers of Russian technology company Yandex that's been happening lately. And you've taken a really interesting look here, Tom, at how Russia's digital sovereignty and kind of digital isolation, I guess, really puts them on the back foot here. But I guess to start, how did this whole tip-for-tat data center back and forth begin?

1:21Tom Uren: Yeah, so around about mid-September of this year, the Russian military started to launch more concerted strikes, I guess, against Ukrainian data centres and telecommunications infrastructure. So there have been a number of Ukrainian data centres that were hit from about mid-September. those had previously not been struck and the Russian Ministry of Defence it claims that the ones it's striking are particularly related to Ukraine's war effort make what you will of that justification but in response the Ukraine military has gone after Russian data centres and they've struck since I think about a week, eight days ago, three of Yandex's largest data centres around Moscow.

2:21Amberleigh Jack: And they've only got six in total, right?

2:23Tom Uren: Yeah, that's right. So it's had a very significant impact. And I think in the last day or so, they also struck another data centre for a Russian state bank that was, I believe it's under construction. There's not a whole lot of news about that but anyway it's still this back and forth is still going on russia is still striking data centers but what struck me is that there's kind of an asymmetric impact so it just like it seems like russia is blowing up things whereas ukraine is blowing up russia's internet in a sense So Yandex in Russia is huge. In the piece I describe it as Russia's Google and AWS and Uber.

3:07Tom Uren: So it runs a taxi hailing app. It runs a food delivery app. It does search in Russia. It also has cloud services that other companies host their infrastructure on. And that's not a coincidence that it's so central. it's deliberate Russian policy. So it seems like over the last 20 years they've deliberately decided that we want something like what China's got. This is my interpretation. So that means they've deliberately kicked out Russian services, they've promoted their own domestic champions, they've made it difficult to leave the data localisation laws, means it's very difficult for Russian companies to host data overseas.

4:01Tom Uren: And so you've got these domestic champions that are inherently in Russia, like they don't have data centers elsewhere. So that's in contrast to Ukraine. So Ukraine, at the very beginning of the war, they shifted a huge amount of their critical infrastructure into cloud services hosted in Europe. So American AWS, Microsoft. And so I think the figure I heard for Amazon was something like 16 petabytes of data is hosted on Amazon. And so those services, you can blow up things in Ukraine, but those services continue. Even when Russia has been striking Keevstar, which is the largest mobile provider, there are still alternatives like Starlink and Keefstar actually has Starlink direct to cell or direct to device it's called so you can text in Ukraine over Starlink if you're using the Keefstar network so that's like not as good but it's an alternative yeah yeah yeah now there's a

5:12Amberleigh Jack: couple of things I wanted to ask you about the impact here with these Yandex strikes The first one is the bots. There's been a lot of talk online about the bots and how they appear to have disappeared. And you've kind of looked into it and seen if you can prove or disprove that. And it doesn't seem that that was actually the case.

5:29Tom Uren: Yeah, yeah. Two points there. First of all, that seems to me like in my reading of the news is the biggest news item related to that is the bots have disappeared.

5:37Amberleigh Jack: Yeah.

5:38Tom Uren: And the point later I'll make is that that's not the biggest impact. So first of all, President Zelensky, Ukraine's president, he actually mentioned that at the Warsaw Security Summit. And he said, social media is a much nicer place because all the bots have disappeared. We know who's running the bots. And there's online around that time, there was a lot of anecdotal reports of people going, oh, the bots have disappeared. It's wonderful. And so the theory, obviously, is that Yandex was hosting these bots. When data center goes away, bots go away. And like that's an appealing narrative for many people.

6:22Tom Uren: And I saw many people, including Laura Looma, like going, oh, this is great. All these bots were supporting the Democrats. This will be great for the midterms. But all the objective numerical researchers who actually track bots and disinformation, none of them could find any solid evidence that actual rates had declined. And it also makes sense to me that if you were running bots like social media bots out of that data center, you would have some way to shift them quite quickly. Like it's not a hugely intensive thing to speak on social media.

7:12Amberleigh Jack: It's quite funny because you sort of said, you know, reading this, and I was the same, reading this, the bots seem to be the kind of big news of this. But if you are a Russian citizen, you're not going to be caring about the bots. You're going to be caring about the fact that you can't get your money. Tell me a bit more about the actual impact in day-to-day Russia here.

7:33Tom Uren: Yeah, yeah. So like I said, Yandex runs a whole lot of different services. Probably the one I've seen the most angst about, understandably, is Yandex Pay. So that's a payment service. People, I found reports online of people who could not get access to their money, could not pay for things. like that's a terrible place to be and for some reason which seems unwise but people will do this had all their money wrapped up in yandex pay so the chief financial fintech officer of yandex actually had to come out and say look your money's safe the money wasn't in the data center we're trying to restore things i don't know when it'll come back but your money's safe that I think indicates how dire it is if you have to go and say that.

8:27Amberleigh Jack: Yeah. Well, it's such a massive thing. Like I'm just thinking now I, you know, today is our weekly takeaway night and we have nothing out of the freezer. If I suddenly couldn't access money, like, you know.

8:39Tom Uren: Yeah, exactly.

8:40Amberleigh Jack: I mean, I'm thinking about my dinner, but there will be bigger problems if you can't access your money, but it's huge.

8:47Tom Uren: Yeah. So I think it's those kind of reports you find on media that is focused on Russia, whereas like, you know, the English language media was mostly, oh, have the bots gone or not? And it feels like they're kind of just missing the entire point. I mean, I found videos of many, many angry people who were like, I cannot get my money. This is really bad. And so that is, I think, the most sensational angst-causing impact of these attacks. But because those services, there were so many of them and they were so central to how you would conduct your life nowadays. It is having major impacts on Russians.

9:34Tom Uren: Now, because Russia has for the last, I don't know, 20 years or so, it's been gradually tightening the screws on domestic control, censorship and surveillance. And one element of that has been to make sure that data can't leave the country in addition to this promotion of domestic champions. And so you're in a situation where the Russian internet technology giants only have Russian data centres. There's no alternative. So unlike Ukraine, which can shift the services overseas, where they're effectively out of reach of Russian conventional attacks, those data centres, they can't move them. They're relatively large.

10:27Tom Uren: So in the first place, it would be just, I think, perhaps difficult to find space to host them elsewhere. But of course, with sanctions, there's no country in Europe that would host Russian data for a start. And the Russian government actually has laws in place to prevent it in the first place. So it seems like their internet services are at risk in a way that the Ukrainian internet services aren't.

10:49Amberleigh Jack: You mentioned in your newsletter, you sort of said, you know, Yandex is moving some of these servers to other domestic providers. which basically leaves them in the same situation really, doesn't it? So is it, I mean, could Ukraine realistically bomb Russia offline here?

11:09Tom Uren: So there is a quote that I came across by this researcher at the Bremen University Center for East European Studies, Nikolai Mitrokin. So he said that 95 % of Russian data centers are within range of Ukrainian drones. I don't know if that's right, but you look at a map of where Russian data centres are and it seems like the ones that have been struck near Moscow, most of them are in a similar distance from Ukraine. So that sort of just eyeballing it, it looks legit. And to me it's whether, first of all, the Ukrainians want to do that and whether they have enough drones and what the priority targets are.

11:55Tom Uren: But it seems to me that this is a real problem. Like they've shifted to other different data centres, but it's like that's not removing the risk. That's just mitigating the one problem you currently have. And like you say, more strikes to come, I expect.

12:16Amberleigh Jack: I want to move on, Tom, to your second piece in the story. um anthropic has released a report and seems to be having a little bit of a whinge i guess about how easy it is to remove the safeguards of chinese open weight models and and you've taken a look at this tom and you've read between the uh less than subtle lines here and the short of it as you've written here is claw good chinese open weight models bad but yeah give me the longer of it slightly longer version. What was this report? What was the story here?

12:54Tom Uren: Yeah, so the report examines ZAI. That's a Chinese AI company's latest model, GLM 5.3. I think it's their latest. So many come out all the time. The US Center for AI Security, Casey they looked at this model and said this is the best open weight model when it comes to cyber capabilities and it's the most capable from that perspective and Anthropic looked at it and looked at how easy it was to overcome its safeguards and unsurprisingly it's relatively easy. So there's a technique called obliteration that we've mentioned on this podcast before, where you can fiddle with the weights of a model. And because these are open weights models, those weights are available.

13:52Tom Uren: You can do whatever you like to them. And they're just numbers. And that process removes safeguards. Now, the key thing that Anthropic found is that removing the safeguards well first of all it works very well but it also doesn't nobble the model so it performs almost as well as the original model and so slightly less on some tests equal performance on other tests so you can get models that will do whatever you want so that is a very effective technique it actually is so they say it took them 2 ,200 gpu hours of computation to do this which they say cost four thousand four and a half thousand us dollars so that's not nothing but it's also very very achievable maybe not for an individual but from for a firm well it has been

14:45Amberleigh Jack: achieved hasn't it there were some releases of the uh alliterator model yeah yeah yeah so within

14:50Tom Uren: days so people will do this so to me the message was open weight models are getting good and they will not have safeguards effectively in practice it will be easy to get safeguards removed i mean there were also some other techniques that worked very well with which you didn't need to do that process and that was just by saying i want you to work as a red teamer most of the time that worked and another technique was to sort of gaslight the model and say basically sort of pre-fill its its history I guess and convince it that it had already decided to help you for whatever reason and so you know once it thinks it's helping you it'll continue to help you.

15:34Amberleigh Jack: It always makes me laugh that you know going going as far back as how many you know 30 40 years ago so much of of this industry, well, on the attacking side, I guess, was social engineering. And now it's literally social engineering robots.

15:52Tom Uren: That's right. What is it?

15:55Amberleigh Jack: It's super engineering nowadays, I guess, artificial engineering.

15:59Tom Uren: Anyway, so there's all these techniques that work very well. To me, the message is everyone will have access to pretty advanced cyber capabilities, good people and malicious actors. Cyber defenders, cyber attackers, everyone's going to have access. Part, reading between the lines. So Anthropics CEO Dario Amadei wrote a month or so ago now an essay saying, calling pacing the frontier about, and one of his messages was, we need some sort of international regulation about safeguards. That is totally unrealistic. So at a recent summit, President Trump and Xi Jinping agreed to basically have a hotline of some sort.

16:48So that's, I think, a fine idea.

16:51Tom Uren: Why not? It seems highly likely that at some point some model will go and hack some Chinese government website. It'd be nice to be able to just say, oh, hey, sorry, we'll wrap these blokes on the knuckle because they did the wrong thing. Not a government thing. Don't get a huff about it. That seems like a good plan, right? But that's as far as I can sell, as far as it'll go anytime soon.

17:12Amberleigh Jack: So what's the most practical option here then?

17:15Tom Uren: Yeah, yeah. So I think that given that, there will be no international regulation. The next best thing, I think, is just to loosen safeguards on frontier models and make them more widely available. So my reasoning there is that there are many motivated malicious actors that will try and get unrestricted capabilities. but there's actually many more good intentioned people who would like to use these capabilities for defensive purposes and right now they're locked out by safeguards that are too restrictive. I think it's time to put the tools in the hands of as many well-intentioned people as we can and that means loosening the safeguards.

17:56Tom Uren: So I don't think that's what Anthropic was aiming at with this report but that's what I think should happen.

18:02Amberleigh Jack: Yeah, for sure. And it's, I mean, since I started working here, I've been looking into, you know, a bit of hacking history. And it's always been chaos, right? There's always been moments of chaos where there's, you're going to have malicious actors and you're going to have defenders trying to hunt them down. And now we're just kind of at the point where we've got robots and let's get more robots in more people's hands. And the robots can kind of fight each other out in the cage. Is that kind of where we're at?

18:36Tom Uren: Yes, I think that's it. Like the tools are out there. They will continue to be out there. There's no putting them away. And I think it's practically impossible to segregate, you know, are you a good person? Let me give you this tool. Are you a bad person? I don't think that works well enough. I think it's too restrictive I think this is a global problem and it doesn't make sense to restrict it to just the number of people that you can vouch for yourself like there's many countries that have many many well-intentioned people who would like to use these tools beyond just America and Australia wherever it's just time to let go

19:26Amberleigh Jack: what's the worst that can happen?

19:28Tom Uren: I mean, something bad will happen, but I don't think it'll be, it's not, you know, the end of the world.

19:34Amberleigh Jack: Yeah. Something bad always happens though, right?

19:36Tom Uren: And it motivates people to fix things. To do better. I think that's the key thing. We're not going to go from zero to total destruction in one incident. And I think it would actually be helpful to have smaller incidents while the models, you know, assuming continual improvement, while the models are less good. Yeah. have those small incidents to motivate people to do better.

20:01Amberleigh Jack: Makes sense. All right, Tom, we're going to leave it there, but it is always a pleasure to sit down with you and pick your brain. Thank you so much, Tom, and we'll see you next week.

20:11Tom Uren: Thanks, Amberley.

20:28you