Srsly Risky Biz: Trump's private hacker memo is the right idea

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this week's Seriously Risky Biz. This is our cybersecurity policy and intelligence podcast and it is based on the excellent newsletter that my colleague Tom Uren writes. You can find Tom's newsletter, Seriously Risky Business, over at our website, risky.biz, where you can read the newsletter and subscribe to it so that it lands in your inbox every week. Tom will be along shortly to chat with me about his newsletter. But first, big thanks to the sponsor for this week, which is Socket. Socket makes the Socket firewall, which is an indispensable defense against the many, many and varied supply chain attacks that we're seeing in package ecosystems.

0:43James Wilson: But back to Tom's newsletter. Two topics this week. First, Tom's thoughts on Trump's cyber, private cyber hacker memo that could unleash the capability for commercial entities to do hacking and cyber effects on behalf of the US government. And Tom's take here is, look, it's the right idea, but there's some buts, of course, that we'll delve into. And the second topic is that we talk about Ukraine's latest hacking campaign being a big propaganda win, but it's not quite what they've billed it as. And we're talking about there, of course, the drone attacks that are taking out these Wildberry's warehouses and then being combined with some cyber attacks that also took out their customer service and payment infrastructure as well.

1:31James Wilson: But back to Trump's private hacker memo being the right idea, I'm going to drop you here into the conversation where Tom essentially talks us through his summary here, which is, you know, it's well intended and it's solving a real problem. It's very Trumpian in some degree, some regards, but also it's quite surprisingly measured in others. And Tom's going to talk us through that. But first, he's going to talk us through what exactly this memo really enables, why there's controversy around it, and maybe how to think about that controversy in perspective. Enjoy.

2:06Tom Uren: The background is that the US and Five Eyes nations, they've traditionally said that cyber operations are something that the state does. And when I say cyber operations, I'm talking about hacking for espionage or for disruption. Those are something that the state does. Private companies should not be in that game and when it comes to state conflict, competition, international espionage, that's a state game. And so private companies, they can help the state, they can be contracted to be involved in developing capabilities or training, but they're not in the game of independently going out and hacking things.

2:50Tom Uren: So the reality is that other countries have taken a different approach where they've to some degree, greater or lesser extent, outsourced state hacking for the state to private parties, like notably China. And so the Trump memo, and it's just like a letter he's written to people, It just says, yeah, we're undoing all that. We're going to allow private companies to hack for a relatively narrow purpose, which is to tackle, they call it cyber-enabled transnational crime organisations. So when I think of that, I think of that like scam compounds, cyber-enabled fraudsters, I guess even ransomware gangs.

3:41Tom Uren: The people that are from a traditional law enforcement perspective, they're kind of out of the reach of domestic police. and so this is a problem that countries have struggled to deal with because we've got police forces that you know hundreds of years old they're really built and have learned how to tackle in-person real world crime and it is very difficult when it is in a computer and it's coming from outside your country and so the successes there have been very limited and so we've got this problem that has become bigger and bigger. The traditional mechanisms aren't that effective. We've been searching for new mechanisms.

4:24Tom Uren: One of those is disruption operations. And the Western governments have done increasingly more of those, but the capacity of those is limited.

4:35James Wilson: Right. And so before we get into, I guess, the real nature of the problem and why this could be a solution and also some of the, to your point, there's a kind of an interesting sort of measured tone to this response. I just want to start at like what you've just outlined there is there is a real problem. It's a problem that has been solved in this manner by other governments. So why so much controversy around this even at just a high level before we delve into the specifics and where there might be actually some sort of reasoned controversy around elements of this?

5:08Tom Uren: I'd like to be honest I think it's controversial because change is bad and that really the people in the policy space what happens is you end up in a position because smart people who've come before you have made decisions that were sensible at the time like everyone throughout the entirety of history is trying to do the right thing and what happens is that eventually you realize that those policy positions don't make sense now or never made sense. And I guess the original conception of cyber, the projection of power through cyber was that it could be very, very powerful. Like originally there was talk of cyber Pearl Harbor, for example.

5:52Tom Uren: And it turns out that in fact, when it comes to projecting power, it's actually very difficult to project power through cyber. It is hard to have really significant effects. You have to either screw up tremendously badly or try very, very hard. And so there's just less to worry about than we ever thought. And that only really becomes clear in the long arc of history where people try cyber operations and the impact is limited.

6:23James Wilson: Yeah. I mean, having had my share of jobs in large enterprises, I know that it is a very true element of the human condition that the only thing we hate more than change is the current state that we're in. But I'm going to push back on you a little bit here and say, in the example I gave there, which is, you know, it's a real problem, but we do have examples of other governments doing their subcontracting of work for cyber effects. That has not been without some problems in and of itself. I'm thinking of things like, you know, these Chinese contractors, they get discovered, it leaks tradecraft, it exposes what they've been doing, and perhaps some of the incentive structures that are not quite great.

7:01James Wilson: So wouldn't that be a case for saying, well, there is a good reason to be, you know, a bit, you know, up in arms about this right now?

7:09Tom Uren: I think it depends what you're after, right? So in terms of state espionage, I think the Chinese contractor model has been tremendously effective because it's stolen a whole heap of intellectual property, like vast amounts. the benefits have outweighed the risks. The downside has been that it's gradually eroded. One of the downsides has been that it's gradually eroded faith in Chinese motivations, I guess. But I think lots of other things that China as a government has done that as well. So it's not just the cyber element. I think the coming back to this memo, it is carving out a particular problem and it's not saying we want hackers to hack for government espionage for military and government purposes.

7:57Tom Uren: It's saying we've got this particular problem, we can't solve it in government and like to be honest this won't solve it either. I think it is a step to address a problem, make it less bad. You're not eliminating all cybercrime with this but there's people in the private sector who could help. Given the amount of money that it's costing Americans, I think it makes sense to say, okay, so we'll spend some money to bolster state capacity with the private sector. From a where do you spend your money point of view, I think that kind of makes sense.

8:32James Wilson: And so you've talked there about the problem, and at a high level, the problem is quite understandable. There are these trans, what are these, cyber-enabled transcontinental

8:45Tom Uren: Transnational Crime Organisations. There we go.

8:48James Wilson: I knew you'd have it. So we know they are a problem. That much is blindingly obvious. But I guess I would love to delve a little bit more into a five-wise exercise here. Okay, but why are they a problem? Why does it require a solution like this? Why might this be a good solution? Why might it not be?

9:06Tom Uren: Yeah, okay. So I think they're a problem because they're out of reach traditional law enforcement practices.

9:13James Wilson: You mean those indictments against the foreigners that we can't extradite doesn't work?

9:18Tom Uren: It works for some countries, but it doesn't work for all countries. And so we have hotspots, places where they can operate with impunity for at least a time. I think, you know, 20, 30 years, maybe that changes. But right now we've got places where they're basically out of reach. disruption, state-backed disruption has been successful in that it achieves something. It doesn't solve the problem, but it diminishes it. Why isn't it good enough? There's just not enough capacity. So the organisations that have been doing that, Cyber Command, NSA, FBI, they have other jobs. So you have a choice. You can say, well, we'll give them even more budget and we'll say you also get this other remit or you can forego other missions and pick up these missions.

10:18Tom Uren: And I think that's just unpalatable for the national security community because they've got other things to do that are also very, very important. You know, the default solution is to do nothing. Default solution, air quotes. The innovative solution is to say, well, it's costing us a lot of money. We would be better off if we spent some money to try and address that. Right.

10:43James Wilson: So we're sort of in a situation here where the problem is very obvious. It is costing massive amounts of money for certainly for the American citizens. They get caught up in these scams and other things that these operators are doing. The solution seems relatively known at a high level in terms of we know what we would do if we could do it, if only we had the time to do it. So let's find someone else that has the time and resources to do it. Now, but getting back to your framing here, that this is controversial, that addresses a real problem and is surprisingly measured. Let's talk about how this is both seemingly simultaneously in line with the way Trump likes to operate, but also not quite.

11:24James Wilson: There's some differences here. Yeah.

11:26Tom Uren: So the way I would describe the Trump administration and President Trump is that they like the unfettered display of American power. and so there's two parts there there's American power and the memo talks about the ingenuity of the American private sector I'm not sure like I think they'll come up with some innovative approaches I think it's just getting more people doing this work that will be important and so that's very much in line with we're getting clever American people to do things and we're not worrying about the consequences so much or we're not being restrained by the consequences and some of the critics who push back talk about worries about escalation risk, the idea that you'll hack something that'll annoy the other party, they'll fire back and you eventually end up in a real shooting war and now that may have made sense at one point when you thought that cyber operations were very, very powerful.

12:27Tom Uren: It's possible you could cause vast amounts of chaos and people would immediately fire back with something else. But in practice, we've never seen that happen. So we've had some very, very large cyber incidents. I mentioned NotPetra and WannaCry, which were worms that went around encrypting things basically in an unrestrained way. And the government's responsible eventually got strongly worded letters. and so that's you know that's the extent of escalation risk we've seen so far so I think it's unrealistic to say now if you've got some controls that that will that'll be fine as long as you've got some controls so in in the memo the controls are we're going to vet companies to make sure that they're competent they have an appropriate level of competence this is the part where it's concerning because what does appropriate mean in this context uh they have

13:27James Wilson: appropriate security um yeah who knows who knows what that criteria will be and if it's set by the current administration it could have a very interesting relative level of competence applied

13:38Tom Uren: to it yeah and and the other part is that any company that wants to participate in this program has to put up a bond of a million dollars i look i had a question about that is it was dr evil

13:49James Wilson: involved in coming up with that number because that seems ridiculously small.

13:54Tom Uren: Well, it's either ridiculously large if you're a small company or ridiculously small if you're a large company.

14:01James Wilson: Yes, either way, it seems utterly not fit for purpose.

14:05Tom Uren: Yeah, so that's strange but it seems very Trumpian to me. It's like we'll have something to hold over people so that they don't do the wrong thing.

14:13James Wilson: That part's Trumpian but the fact that it doesn't have an extra zero and a billion behind it is decidedly not.

14:19Tom Uren: Well, I think there are small companies where that is a significant amount of money. And I don't think cyber operations necessarily require hundreds of people, right? It doesn't need to be a huge company. I think hacking is not that hard for a small group of competent people who have been doing other jobs, essentially the same job in other contexts.

14:41James Wilson: But this raises interesting questions about the tasking and who this is actually meant for. and sort of clarify for me who you think this is actually, this memo is actually targeting and enabling because I would have thought it's for the big six large defence contractors but if you've got to stump up a bond of one million, that says the opposite, that it's actually for the smaller operators to join up to this directly.

15:05Tom Uren: So that's one thing the memo leaves totally unclear. So somewhere else I saw the FBI, an FBI official saying This is really formalising what happens already with big companies and doing disruption operations. And that kind of makes sense if those companies want to get involved. And so usually the big companies have international, they're multinationals. And so they've got political sensitivities to be aware of all over the world. So do you want to get involved and be associated with the Trump memo? so closely. I'm not so sure. I think that is a decision for big companies. For small companies, and the memo specifically says we want small companies to be involved as well.

15:53Tom Uren: It's, well, what is the motivation? I'm assuming that if there's a million dollar bond, there will be some financial remuneration. You're not going to go, yes, let's just lock up a million dollars so that we can perform public good works. Tackling cyber criminals, that will make us feel so good while our million dollars is sitting in the US government coffers. Well in the ballroom. Yeah that's and so the memo doesn't talk about why people would do this it's like you're allowed to do it but who's paying for it what are we what are we achieving.

16:29James Wilson: But then you've painted an interesting picture there just in terms of there is a significant negative factor for a large multinational to get involved in this because of association to Trump and the memo and all the rest So, you know, you can sort of imagine that one million is not much for a ragtag bunch of hackers to stump up and join this. Like, do we end up not with the most elite private cyber force, but instead a bunch of dirty, rotten scoundrels in the cyberspace?

16:57Tom Uren: I think it'll be like lawyers where you hire companies that are basically cutouts for what you want to achieve. So I guess that's the realistic approach. but I don't see why big companies would pay other companies to do hacking. Like, you know, why pay for something that we're achieving already just more slowly, right?

17:21James Wilson: Yeah, it just doesn't line up.

17:22Tom Uren: That's a cost centre. There may be a few companies that go, okay, it's worth paying something for the purported security benefits, but if you can't really even talk about it because how can you both associate yourself with it and also maintain a distance from it. I think it's sort of problematic. It was unclear, very unclear to me why companies would do this unless they're getting paid, but there's no mechanism described about how to get paid.

17:49James Wilson: Yeah, okay. So that's one end of the equation we've talked about. We don't know who it's for and the potential implications of the incentives and who that might drive to sign up for this. But let's look at it from the other perspective here in terms of who's going to be driving the targeting of this and the reporting. Because as you said, the line here was they can be identified, they as in these bad actors that we're going to target, they can be identified by either private sector entities, makes sense, or by any federal, state, local, tribal and territorial agency. My goodness, that's broad.

18:25James Wilson: What's your thoughts there? Well, that seemed to me to be everyone, right? Yes. I'm not sure who that excludes.

18:32Tom Uren: It's who is left other than the government and private entities, like no one. And so they can nominate those cyber-enabled crime organisations. And then it's up to the companies who want to be involved in the program to come up with a package. Here's an entity that is of interest, a potential target, because Joe Bloggs named them. and here's what we propose to do and that'll get assessed by two people, one in Homeland Security and one in Department of Justice. There'll be a deconfliction process so it doesn't interfere with legitimate state intelligence targets. No mention of multinational or international law enforcement operations, so like Operation Endgame, which is a European operation.

19:27James Wilson: Well, even the two-person quorum there seems small.

19:32Tom Uren: Yeah, I mean, that feels like typical of the Trump administration, like small number of people just get things done. So why bog things down with process when you involve a whole lot of people? And so the targeting seems like that seems like way too broad, but there is that filtering step. and there's the incentive to not screw things up because you've got a million dollars at stake. Like I think there's enough low-hanging fruit in the criminal community that we're not going to have problems because of rogue hacking of the wrong thing.

20:12James Wilson: Well, time will tell. It'll be interesting to see how this goes. But to wrap up on this one, Tom, I mean, look, it's easy to throw stones at this. it's easy to poke holes at what we don't know and what seems a bit farcical in there but let's be our better selves what what needs to be true in your mind for this to be a roaring success

20:32Tom Uren: I think what needs to be true is well what I'd like to see I guess is that there's some actual motor driving it in the sense of what's the incentive for companies to do this I think you actually need to probably pay them. Where's that money come from? I'd also like to see reporting about how the program's actually going. So it says, the memo says there should be an annual report written by Homeland Security. It specifies a centre in Homeland Security that's going to do it. And it's going to send the report to Stephen Miller and Sean Cancross, the National Cyber director and just those two people, the only two people in all of government that get to see the report.

21:19Tom Uren: I don't think that's good enough. I think that to me, the program has a lot of promise, like there's a hole and you've figured out a way to try and address that capability gap. But what's the best way? What are the best organisations to target? How do we learn from doing it? How do we fund it? I think all these things are up for, they won't be perfect from the get-go so i think there's a lot of scope to shape it and adjust it in future i think it's hard to do that if only two people know what's going on and they're kind of essentially unaccountable because there's no process to try and get them to change their behavior again i'm

22:00James Wilson: drifting back to imagining this turning into a cyber wild west but uh time will only tell now going from identifying holes and attempting to plug them now let's shift to intentionally blowing holes in warehouses that turn into great big firewalls fireballs and then also the involvement of firewalls it's this interesting conflation of cyber and kinetic that's arisen out of the ukrainian strikes on wildberries uh your your take here is um you know interesting but way overblown. So why don't you take us through what's happened here? Why is it interesting? And what aspects do you still see as being overblown but still perhaps otherwise good?

22:42Tom Uren: Okay, so Wildberries is, I often see it referred to as the Amazon of Russia. So it is a very large logistics online store company. And since about mid-July, Ukrainian forces have been very, very successful targeting its warehouses, with drones that blow up. So some reporting says that seven of their 10 warehouses are inoperable. I've seen massive smoke and fireballs across the Russian sky from these warehouses and Ukraine's been targeting them because they provide drone components, navigation components, and they also provide military equipment that Russian soldiers are buying for themselves. And so there's a kind of direct military reason that they're a target.

23:43James Wilson: Which I think is an interesting point, because I've heard some, you know, commentary and scaremongering of, oh my goodness, you know, this is an example of how the private industries like Amazon will be attacked if, you know, there's ever an attack on the US. But it's a different model here, right? I mean, the US, or the Russian campaign here is so different in terms of the way it's funded, how these soldiers have to get their supplies, how they're kitting themselves up, that I think that's what's given rise to Wildberries being not just the Amazon of Russia, but the Amazon of Russia that does a roaring trade in the things that Russian soldiers end up having to buy for themselves to even be effective on the battlefield.

24:20James Wilson: Am I right in that assessment?

24:23Tom Uren: That's what the Ukrainians would argue. I think there's also an element of it brings the war home to ordinary Russian people as well. So I think there's dual motivations. It is extremely striking when you see oil refineries being blown up, just the amount of smoke. And I think that is very sobering if you're a Russian citizen. So I think there's, whether you call that legitimate or not, I think it's a way to the Ukrainians think they can influence the course of the war.

24:54James Wilson: Okay, so either way, I took us through a little bit of a tangent there, but bringing us back on topic, there's been these attacks on the Wildberries warehouses, but what's the cyber element that has sort of now come to light?

25:04Tom Uren: Without any cyber element, those attacks have been extremely successful from about mid-July. And then in the last week, the Ukrainian military intelligence has come out and said, we also did a cyber attack to amplify the impact of these drone strikes. and I have written many times that in a way it's because cyber effects are relatively weak, you have to take advantage of them or orchestrate them with conventional military operations if you really want to have battlefield impact. So for example, the Russians, when they invaded Ukraine, they took down some telecommunication networks and the idea was that that would allow the space for conventional forces to make military gains.

25:53Tom Uren: It was military communication networks. Yeah. The US, there's a couple of stories how a cyber operation took down either air defences or like the streetlights in Caracas. And that gives your conventional forces more space to operate with lower risk. And so I feel like those are really great examples of enabling conventional military operations. Whereas in this case, so I thought it was really interesting that Ukrainian military intelligence said that. Like they've obviously in, you know, they understand that concept. They're saying that they're doing that. But of course, those drone strikes were successful before the cyber operations.

26:36Tom Uren: And the cyber operations didn't enable the drone strikes. They were kind of additive in that they took down some of the ordering flows and payment processing and call centre responses. So it adds to the confusion. But I think given that the warehouse is on fire, there's...

26:55James Wilson: There are other reasons why your order will be delayed, dear purchaser.

26:59Tom Uren: Yeah, yeah, that's right. And it's much easier to recover from the cyber element, the impact of that, than it is to rebuild a warehouse.

27:07James Wilson: But to be fair, you did make the point that one of the things that makes Wildberries such a powerful target for Ukraine to display such military might against is that it not just disrupts the flow of these combat items that have been making it into the hands of Russian soldiers via Wildberries, but to your point, it brings the war home to, or the impact of the war home to the citizens. Now, is that not also achieved with these attacks? Because as you said, it disrupts ordering, it disrupts payments. That's going to bring it back home, right? Yeah, yeah.

27:39Tom Uren: I'm not saying that they're insignificant. What I'm saying is that they're not amplifying the military effect. Now, I think what they're doing is actually, in fact, the exact opposite. They're taking the conventional attack. They've successfully blown up or struck a warehouse in this region. and they're combining that with the cyber attack and they're saying, look, the cyber attack is so amazing and powerful. And so I think they're amplifying their propaganda effect. And when it comes to influencing the Russian population, like that's a legitimate thing to do. That makes sense. Like they're achieving the goal.

28:20Tom Uren: It's just not the one I really look for. So I'm not, I don't think it's, I don't think they're doing a bad thing. I think it makes sense that they said this. I just think it's, I'm trying to be clear-eyed about what is exactly going on.

28:35James Wilson: So if I sum it up here, it is, we're thrilled to see that we are getting a combination of cyber and kinetic, because that is what you've talked about and the crack has talked about many, many times. I think if I was to distill your feedback down here from Tom's cyber planning agency, your advice here is you got the horse and the cart around the wrong way. If you're going to do this, you do the cyber first, get that impact and get that raising awareness in the public eyes of what the Ukraine can do. Then you follow it up with your big display of the drones, right? Is it as simple as they just got the order wrong here?

29:12Tom Uren: Look, I don't think they've done anything wrong. I think they've just described it in, and I think, in fact, they've actually described it in probably the right way. I just think it's, they're describing it in the right way to have propaganda impact. They're not describing what has actually gone on. And so, like, you know, that's fine. I think that's, like.

29:34James Wilson: Why let the truth get in the way of a good story?

29:36Tom Uren: Well, I think the reason I'm writing about it is because I want to have a clear idea of what is actually going on as opposed to what they're telling us is going on. And so and I think there is a distinction between amplifying something for a propaganda effect and amplifying something for an actual military impact. And so that's the difference. That's the distinction I'm drawing there. And so I don't even have any, oh, this is terrible or this is bad or they don't understand. I think they understand and they're doing exactly what they want to do. It's just I'm saying, okay, I see what you're doing.

30:16Tom Uren: Well done. It's not exactly what you described, but I understand why you're saying that.

30:21James Wilson: Yeah, okay. So good job. Well-intended effect. We like what you've done here. We just wish you'd been a little bit more accurate about what you've reported on. And well, look, nevertheless, Tom, you've achieved your aim of writing about this in a way that raises the awareness of this, because I hadn't understood the subtleties of this until I read the newsletter this week. So again, I am ending a session with you feeling smarter. And so, Tom, thank you very much for dropping by and talking about both of these topics with me today. Thanks, James.

31:00Thank you.