Who gets to hack the hackers?

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this CISO-focused episode of Risky Business Features with Brad Arkin. A few weeks ago, President Trump signed a memorandum calling for the establishment of a program for private US companies to conduct cyber operations or cyber effects against foreign transnational criminal organizations. We know that under this arrangement, any cyber operation will need to be approved by both the Department of Justice and Department of Homeland Security, but there's also a lot that we don't yet know about this program and how it might be operationalized. So Brad's joining me for this conversation because he's held CISO-like roles at Cisco, Adobe and Salesforce, and more importantly, he has had first-hand experience in working with the government and law enforcement following a cyber attack on a private company.

0:56James Wilson: So we explore many things and many unanswered questions in this episode, like who is this memo a call to action for? Is it for small companies, large companies? What could go wrong? How will liability be managed? And most importantly, will the government actually be able to move at the pace that is needed for this to be truly effective against cyber bad actors? So I'll drop you here into the conversation as Brad frames where this memo sits in the scale of, as we say at Risky Biz, releasing the hounds. Enjoy. This is the US government dialing up the release the hounds gauge, you know, maybe from like two to three.

1:38So, you know, we're nowhere near 11, like, but they're just clicking it one notch up to see if it'll work, to see if it'll like broaden in any way the types of consequences we can bring to bear against the bad guys. And I think it'll be fun to dig into like, what is it and what is it not uh but the real motivation when i read this is it feels like an incremental step that has the potential to bring more consequences to bear which if that does work out then raising costs has a potential to potentially drive down bad outcomes for victims that's like the goal here that's what i'm hoping for and when you say it brings the release the

2:14James Wilson: hounds gauge from two to three but not yet to 11 is that to say that we still won't see hounds released or we'll see perhaps more docile hounds released like what what what does two to three actually look like yeah so so i think there's a lot of like fan fiction uh you know speculation out there of like what could be possible if only you know the lawyers would get out of the way and let the let the good guys you know do what they know how to do and so we're nowhere near full throttle like just you know throw it all against the bad guys but basically the u.s law enforcement particularly the FBI, has been on this 20, 30 year journey of trying to bring more effective means against the bad guys in ways that can help victims or help avoid people from becoming victims of these bad guy cyber actors.

3:03And we can talk in a lot of detail about some anecdotes here, but um this event where the fbi was in the middle of the hive ransomware crew and they were tracking who the victims were sharing decryption keys with the victims helping them drive the cost down of what otherwise would be a very bad day for these victim organizations that to me is like one little taste of if we could do a lot more of stuff like that and so the idea that you could zero out yes bad guy infrastructure. So they can't carry out their attacks. You could sow, you know, dissension in the ranks amongst the different layers of the bad guy, you know, value chain and the ecosystem of how they interact with each other.

3:48And then the idea that if somebody does get successfully attacked, you might be able to help them recover faster, or you might be able to delete the data that was stolen from the bad guy infrastructure before it's able to be copied and carried downstream to wherever they're going to do with it. And so taking those types of steps, which have happened and there are precedents for it, it's happened in the past, but making it happen more frequently, more often, more different types of bad guys. These are the things that come to mind when I read the information about where I think they're going with this.

4:18James Wilson: And, you know, just the framing there around victim companies and victims in general, let's just get a sense of who is this memorandum actually for? Like who, Who is the call to action here? Because I don't, my sense is it's not just victim companies or victims that can then sort of retroactively say, well, I would like to apply to get my retribution. It's also for the proactive aspect as well, right? I'm not in the middle of all the, you know, smoke filled back room of people negotiating like what turned into the thing that got published. So maybe it's really meant for the big six prime defense contractors.

4:56And that's really it. And so it's the Raytheons, Lockheed Martins of the world and nobody else. Maybe. Maybe it's meant to encompass a broader set of the usual suspects when it comes to the bad guy hunter ecosystem. So this would be Palo Alto Networks, Unit 42, Mandiant, Google, different parts of Google, Microsoft Digital Crimes, Digital Crimes Unit. So there's a bunch of broader cyber defender ecosystem players who definitely have skills to bring to bear. But is this thing written for them or not? And so the one thing which I'm very confident it is not meant to is that, you know, if you run some middle America, you know, supply chain logistics company, and you're at risk in the next two years of becoming a victim of a ransomware attack, the idea that you would somehow invest in getting ready for this and sign up for the program, like, no way, no way at all.

5:55So, you know, this is very much limited to specialist cyber, you know, offensive cyber operator skill sets and people that are tracking the bad guys and have the potential to, you know, bring information and effects against that ecosystem. And so the regular plain vanilla corporate America CISO, I think they might have their vendors would potentially get involved. So they've got an incident response, you know, retainer with CrowdStrike. And so maybe CrowdStrike would sign up for this. And so CrowdStrike might be able to do a better job for them now that this program exists. And so I don't know if that's the case or if it's really just meant for the Lockheed Martins of the world.

6:30And so that to me, I'm really curious to see what happens here.

6:33James Wilson: Yeah. And I guess there's no reason to think it might not be a combination of both, right? If it is just for the big six, there's always the subcontractors and perhaps it's not limited to either or. But you mentioned that the FBI has been on a long March journey of getting better and better at interacting with, I guess, these corporate entities to help people out when these ransomware attacks do happen. You've had some firsthand experience of working with them on this. And I think your phrasing was that there's two clocks and a lot of historical frustration. So why don't you talk us through some anecdotes of what, up until now, has it actually been like to engage with law enforcement, FBI, et cetera, when there is an actual cyber attack being conducted?

7:16Yeah. Yeah. And if we go back 15, 20 years, this is before the main end APT1 report. This is a very long time ago. And most of the interactions with US federal law enforcement was a literal, complete one-way conversation. So you could go talk to them. They would listen. You didn't know what might happen afterwards, but nothing would ever come back to you. And this was as frustrating for the people who work for the FBI as it was for the people trying to talk to the FBI because they're smart guys. They want to make an impact. They want to solve problems. And they were so tied in knots with their own policies and rules that it was almost impossible for them to turn around and do anything of value for the victims.

8:02And I'm talking 20 years ago. And so, you know, if something happened, you would call them. You might have an interaction. They take lots of notes. You know, maybe lots of things would go on behind closed doors. But But as a victim, you were on your own and you would just have to solve your own problems and figure things out for yourself. And I remember very clearly conversations like that, where basically you'd have the conversation, nothing would happen. You know, we'd be lawyered up. They'd have lots of people on their side of the table and nothing would get done afterwards. And then we started to see cracks start to happen in what was like a thawing of this.

8:36And so I remember very clearly there had been an incident, an investigation. we had reached the end of everything we could possibly learn from all the forensics and the evidence that we had run through. We had hired all the right people to help us run through this. And then three years later, one of the FBI agents that we've been working with showed up and slid a piece of paper across the table that had a 36 character hex string on it. And, you know, through some like, you know, darting glances and kind of, you know, motioning with your hands in the right direction, we got the hint that we should try this as a decryption key against an encrypted archive that we'd recovered from a staging server from within the incident boundary, but we hadn't been able to decrypt.

9:18And so we didn't know what was inside it. And so with this key, we could then decrypt it and it educated us a lot more about what had happened in great detail during the incident and answered a bunch of questions we didn't know the answer to up until then.

9:30James Wilson: But three years later, did it matter? Yeah. I mean, it was intellectually very interesting, but the price had been paid you know, and the cleanup had been paid for. And so, but it was progress. Um, so that, that was like exciting. Um, and then I remember a couple of years later, uh, we got a unsolicited inbound from our friendly, uh, FBI agent who we had a connection to. And this person said, Hey, I want to send something to you. And we're like, great. We want to receive it. And so what they sent us was a bad guy key log of the bad guy carrying out an attack against the server owned by the company I worked for.

10:10And it was six weeks old and it was not redacted in any way. It had all the stuff in there and it allowed us to much more rapidly understand a situation. And when you think about going from three years to six weeks and the fact that it was an official transfer of information, they sent it to us, they reached out proactively. We weren't, banging out the door, begging them to tell us what they knew. And we wouldn't have known a bunch of stuff that became clear once we got access to this. And so that to me shows you the trend line of how things were getting better over time. And the people within the FBI were really trying to figure out how they could be much more effective at bringing what they knew and the resources to bear in a way that could help us.

10:59And because they're straddling as an intelligence service as well, how do they protect sources and methods? And where did this thing exactly come from? And all of that is something that in the old days used to prevent them from sharing anything at all that was useful. And that really changed a bunch. And then I think 2021 is when the government stood up something called jcdc and so this is a uh forum uh dare i call it what's what's a fusion center uh you know very very east coast government oh the the private private public partnership that's exactly right and so by bringing together a lot of different entities from within government and private sector and everyone can talk to each other then the idea is that you would bring information to bear much much more quickly and that you would then start to get to the point where it's not three years later, it's not six weeks later.

11:55Now it's like, you know, half an hour, three hours later. And then you're able to really take action with this information and do something with it. Now, the problem is anytime you get a bunch of different parts of the U.S. government working together, it's just this gravitational situation that you always have things drifting towards high side classification that then makes it really hard to get the information back down to low side where you can put it to work. And so private sector might be able to put people forward to work within this environment. But if they're stuck in a SCIF, and SCIF is a secure compartmentalized information facility.

12:35So if they're stuck in the SCIF, they may see a lot of stuff that's really useful. They can't take it with them. They can't put it to work when they get back to the office because they'd be potentially at risk of violating classification requirements and things like that. And so that's always like the challenge when you get the government apparatus working on these types of things. And they're not numb to this. They understand very clearly like what the challenges are. And so they work real hard to try to confront that. And I think the FBI work with this Hive response with the ransomware crew is an example of something that if we could do that, not just once, and we're still talking about it three years later, but do that, you know, a lot, you know, for the big crime events.

13:15And, you know, those, I think, are the types of scenarios they're reaching for when they were writing up this new proposal.

13:23James Wilson: Right. And so this new proposal, if I understand it, essentially is, it's not directly enabling an outcome, it's setting the path forward to, you know, allow for this to be developed and turned into law, etc. But ultimately, this is going to result in a few more tools in the toolkit available to us. And it's probably important before we dive into what those might look like to think about what's this actually layering on top of, right? Today, we hear about indictments against, you know, this criminal actor groups. I'm not sure how, you know, useful that really is when there's not extraditions, or we hear about, you know, other legal forms of disruption that are done.

14:04James Wilson: But give us a sense of It's like, what are the levers that are in place today to be able to disrupt a transcontinental cybercrime gang? And so that we understand then what this is layering on top of and how it, I guess, increases the leverage or introduces an entirely new capability alongside those levers. Yeah. And so, you know, if we remember that at the end of the day, you know, the FBI is a law enforcement agency. And so most of the people within DOJ and within FBI, their sort of measuring stick is indictments and convictions. And so if you get a victim coming to you, the kind of questions you're going to ask about is like, how big is the impact of this event?

14:48Is it worth the resources for us to pursue the investigation? Are the criminal actors that we suspect might be involved in a jurisdiction where we might be able to bring them to justice? And so doing indictments for people that are in other countries and they're never going to get on a plane and go to Thailand or come to the U.S. to give them, you know, give us a chance to arrest them. Although that has happened. It has happened, right? But if you've got some guy doing crimes based in Siberia, a Russian citizen, is this really the best use of investigative resources to pursue an indictment against him when it's vanishing with small odds that you're going to ever be able to get him inside a courtroom?

15:29The other thing is you may have a pretty good sense of who's responsible. But then the question is, can you prove it in a court of law? And so you may be like, ah, like we were pretty confident. We know what this is, but we can't prove it. We don't have the right forensics trail in order to bring this to get a indict, um, go from an indictment to a conviction. Yeah. And so historically with other types of crimes, they may say, we're going to apply our resources in different directions because that's a more fruitful way to get the outcomes that we're judged by. And that's, they're doing their job.

16:00They're reacting to incentives and structures and it just makes sense. And so I think one of the first indictments that was a really big deal was I think in January 2014. And so a number of uniform PLA officers were indicted for espionage attacks against US targets. And none of those people are ever going to get arrested or leave China and put themselves at risk. But it was a big geopolitical moment when they put that out there. And so they were up celebrating and, you know, the DOJ and the FBI folks that were involved in that said, this is a really big deal. And it was an enormous amount of work for them to get that across the line.

16:40But at the same time, as a defender, you know, who might have been targeted by those types of bad actions, it didn't change anything at all for me. And so, and there's one other thing is that even if somebody is in a jurisdiction where you might have a chance of arresting them and even extraditing them to the U.S., like in the U.K., Um, a lot of times if these folks, the, the people that you suspect the suspected committing, these crimes are minors, then the potential for what kind of, um, like sentence and outcome they get might be so low that you say, this is not worth our prosecutor or prosecutorial efforts.

17:16Um, and so, so I think this is now changing, um, in, in particularly like with the, like shiny hunters, um, scatter spider guys that are being in the process of being extradited from the UK to the US, you know, they're looking at potentially serious, um, you know, charges that might lead to real jail time. And that's, that's like a new development. Cause in the old days, a lot of these guys would get non-custodial sentences. It's like slap on the wrist type thing and, and say, please promise you won't do this again until you turn 18, you know, kind of thing. Um, and so, so I think that's, that's definitely shaping a lot of the history here.

17:52And so I think what we're trying to do now, it's the word that jumped out at me when I read the memorandum is the effects. And so are they going after the scam compounds in Cambodia? Or, you know, like what's the real target for this thing? And so I don't know if it's that or it's the ransomware crews, but I'm picturing things like zeroing out servers, stealing encryption keys. Right. You know, distorting infrastructure. I don't know if they'll be so clever as to sow dissension you know between the different actors like that would be really cool but that feels a little more advanced to me than like what I think is realistically going to happen.

18:29James Wilson: And so I'm just trying to understand when when these new powers might be allowed to be invoked right because what you talked about there was two maybe three blockers that get in the way right maybe there's not enough evidence to even even assemble an an indictment or even know who to target in an indictment, yet there is real bad actions being done. And at least you know the source of where it's coming from and potentially you could attack that. Or maybe you can do an indictment, but it is really only performative because that operator is known to be overseas, non-extradition, et cetera. But again, you know where they're working from.

19:04James Wilson: And so there's an aspect where you could do something. And then lastly, you might have everything available to you. You might have enough to make the indictment. You might actually have them in an extradition treaty country, but maybe they're a minor or there's some other circumstantial thing that means that a prosecution is unlikely to be particularly effective. But are we imagining that the cyber effects under this arrangement could be done even when there is not enough to assemble an indictment, even when there's not enough of an evidence to put it through to a criminal trial or even against a minor?

19:38James Wilson: I'm trying to work out, is this still going to be following those same sort of blockers and, I guess, stage gates? Or is this going to be something that's on the side of that and says, well, okay, we don't know who to indict, but we know where their servers are. So RMRF them. That is legitimate course of action. I think it's all speculation because the memorandum doesn't give us those insights. And I don't have the government affairs team to go to the right bar in DC and give me the answers of what's really happening. but what what i'm hoping is that the this is now a new set of tools that didn't exist or were very selectively applied in the past and now they'll be cheaper and easier to apply going forward and when presented with a situation the government is going to have different remedies available and so the idea that in a certain scenario they say hey like indictment let's go to the rest of this bad guy and we'll bring them to justice and they'll see the inside of a courtroom that's the right path to go down.

20:36But in another scenario, like you just described, they might say, hey, like there's potential for us to head off a lot more crime that's about to happen and we can intervene right now. And that'll be a positive impact on outcomes. And it may screw up the ability to prosecute in the future, but let's be honest, it's not going to go anywhere anyway, given where the, you know, the criminal operators are. And so that to me is a great new remedy to have available to apply when it makes the most sense. And, you know, I think they're going to have people from DOJ and DHS that are going to be weighing in on when they're going to go down this path versus other directions.

21:14And so I'm hoping that they're going to, you know, another word you get in DC a lot is equities. So, you know, how do they, you know, balance the equities at play here? And so, you know, if you've got someone from DOJ saying like, we're about to ship the indictment, we're about to arrest them don't screw that up right now we've been investigating this for like 18 months then i think they're going to hold off but in those other scenarios that's when i think

21:37James Wilson: they'll go down this path that's what i'm hoping okay so this is probably interesting segue here because we've talked a little bit about sort of the potential future here of what it might look like if it's a roaring success which um you know the the smile on your face that it gives me the impression that you really hope that it is a roaring success here or at least it does something interesting in terms of change that are dynamic temporarily or long term. But for you, what needs to be true? I guess I'm asking you to sort of steel man the best case for this. What needs to be true for this to actually be successful, both immediately and perhaps durably?

22:11Yeah. So with this structure, the government is going to retain target approval and operational control. And they've got the DHS, DOJ, like all these people in the room. Will they be able to make decisions fast enough that we can actually take advantage of these new capabilities. And so if the private sector operator shows up and says, we've got them right where we want them, we're ready to pull the trigger, we know exactly what to do, and then it takes the government six weeks to decide is this safe or not, then the moment will be gone. And so can they keep up with the operational tempo of what the new capabilities will provide?

22:47So that'll be like a big test here. Is this program going to recruit the kind of specialists that are going to be able to expand capabilities. And I think the hope here is that, um, you know, if you, if you join the FBI, you've got a certain career path in front of you. And if you're a cyber guy, that may not be the best place for you to practice your cyber skills for your whole career. And so, but that person in private sector maybe is going to have more fun. And so the idea that there's going to be a broader set of cyber specialists that have these offensive capabilities, that's going to be the thing to test against?

23:22You know, are they actually bringing more operators into this program in a way that's going to expand capabilities? You know, there's a bunch of other things around the size of the firms involved, like what type of campaigns or interventions are going to be fruitful. And does that become a repeatable motion or will the bad guys adapt very quickly and share notes with each other? And we'll have a couple of big wins and then it kind of fizzles and goes back to status quo yeah yeah so so these are the things that i'm going to want to want to watch for to see you know what ends up actually happening for real well the talent was an interesting piece right

23:56James Wilson: because um i could see an upside and a downside to this in terms of upside would be there's you know there's probably a lot of folks in cyber that have had a bit of a rocky past and for whatever reason you know they were they were a bad guy turned good now i would imagine they are completely prohibited from any sort of you're working at a federal agency or government agency because of those past convictions or their criminal past or even just things in their background that would make them a risky hire but they could certainly find a home in the in the private sector and be perhaps leveraged to the full extent through a program like that so that that's potentially the upside but the downside is we could see a concentration of the really top end of talent to the very large agencies that are or the very large commercial entities that are given the blessing to do this which would starve the rest of the industry from those top tier of people are these real concerns?

24:46James Wilson: Because you would know this better than me. Yeah, well, the joke, you know, is if you draw a Venn diagram of everybody with awesome computer skills, and everyone who's never tried marijuana, what's the intersection look like? And so I have no idea how they're going to, you know, do these folks who work for the private sector operators, do they have to get drug tests, they have security clearances, I don't know, you know, so you could imagine it being basically like like a security clearance arbitrage opportunity where people who couldn't get cleared and couldn't get a government job, but they can get, you know, employment within one of these shops and then they can do good work for the government and this new vehicle, maybe, you know, but that's like way beyond what we see in the actual public text right now.

25:33Yeah, yeah.

25:34James Wilson: Oh, the governance around that would be a nightmare as well. How would you as a commercial entity, whether you're a private company or even a publicly traded company, how would you deal with the, keeping the shareholders and the board happy with the notion of, yeah, we're going to do cyber on behalf of the government, and we're also hiring a bunch of folks that have had a bit of a shaky past as well. That sounds intractable? Well, no, I think it's pretty easy because the customer, you're working as a contractor to the government, the government is the customer. The customer will be very clear about what the rules are for how you staff the projects and what the criteria is and things like that.

26:09And they, I mean, I could even imagine them signing off one by one, name by name of who you have involved. And, and then if you're thinking about the private sector company that's delivering on these contracts, probably they've done government work before. And, and it's a pretty standard motion of like what you do for the customer may not be the kind of thing that you can talk about broadly within the company who's delivering on it. So it's compartmentalized within the project team and not something that's shared more broadly, you know, higher up the chain as to the particulars of it. Okay. And so those things to me feel pretty manageable.

26:44James Wilson: Okay. Okay. Well, that's good. What else needs to be true for this to be a roaring success before we try to poke some holes into the what about this, what if that sort of scenarios? So I think is there a range of effects that will actually deter or change outcomes for the bad guys? So like how creative can these projects get and like, is it actually going to work and have the desired outcome? So that's one question. If the projects are getting proposed and they're working, can the government make decisions fast enough to green light these things? And then, you know, there's silly things like, is there enough money in the budget to actually fund this to the level that makes sense?

27:18And is this the right direction to go compared to all the other things the government could be doing in this area to help victims? So, you know, these are kind of the inputs into the equation that I'm imagining. And then depending where it goes, like it could lead up to a program that's just like, yeah, you know, they tried some things, you know, middling success, unclear if it's going to go any further, or you might have some real home run scenarios that are fun that you want to go deeper with. And, and then the question will be, if we can get that upfront success, how will the back out ecosystem, uh, adapt and evolve in reaction to this new player, you know, who just showed up, um, like in the landscape.

27:54And then how do you confront this as a bad guy planning your own operations?

28:00James Wilson: You mentioned the funding there, which made me think, okay, well, beyond just the who's paying who for this, but what happens, again, to use that word equities, if a commercial contractor is given the green light to do a cyber effect against a target on behalf of the government, and what's, let's say, is as part of that work, not so much that they uncover a bunch of intellectual property, but they also generate a bunch of intellectual property, new attack types, and maybe they find new zero days. Who owns that? Who can monetize that? Who can get the lasting benefit from it? Do you think there'll be restrictions around this, and how might that affect the effectiveness of a program like this as well?

28:43Yeah, I hadn't thought about that at all. My guess is it'll be covered by the terms of the contract, between the customer who's the government paying these entities to do the work. And so residual IP and in-house capabilities and things like that, would the private shop have the ability to invest in capabilities that they jealously guard? Or when shop A comes up with a clever trick, does the government get it and then they just sprinkle it across their six other contractors that they're working with right now? And even if they do that, I could imagine there's so many people that want to make a positive impact on this crime ecosystem right now.

29:23And so the idea that we're like, eh, like we're not doing this to get rich. We're doing this because we want to make a difference and help victims and help, you know, like defeat the bad guys. Like that may be enough, you know, in order to bring people to work within this program. And, you know, if we're talking about, you know, you need a certain amount of token budget, you need your, you know, labor, you need some bandwidth like it's not it's not gonna be all that expensive compared to what you know big defense contractors use the kind of bills that are used to teen up so so there may be there may be some uh like let's make the world a better place yeah happening here as well well maybe you're

30:01James Wilson: too cynical but i can see that playing into the short-term success you know the there's huge problems with these scam compounds huge problems with ransomware actors we can't address that with indictments in the current levers no doubt if this was uh if this was the new mechanism through which a uh commercial entity or even private citizens could have that impact sure there's going to be a groundswell of support i can absolutely see that happening but i i think that then sort of again to your point of getting back to the new normal or the reset i don't see that lasting for a long time right once once you're down to the most elite of the bad guys which which require an enormous amount of resources and probably some very, very secret source, highly valuable intellectual property to even go after them.

30:45James Wilson: Maybe that's when there is a bit of a tipping point from the initial reset and the new normal. But then if this is going to have a lasting success, I'm only half buying the notion that goodwill and wanting to make a difference would have a long-term effect. Do you agree or do you think it does actually have the ability to keep this program going? I don't know. I mean, what's the contractors are going to get out of it? Can they talk about it publicly? Does this become their Black Hat booth theme for next year? You know, the marketing budgets alone could fund a lot of goodwill, you know, if they can talk about it publicly.

31:22And so like, we just don't know a lot of the details here. And I think nobody knows, like they're just figuring it out right now. So, you know, if we can help influence anybody who's sitting down to write the rules. The more that you can let people derive benefit from participating in this, whether it's they're making money, they're solving problems, they're able to brag about the problems they're solving, they're able to help their customers more effectively. There's all sorts of ways that you could make this worth participating in. And I think more than anything else, it's can we get swift decision making so that the really sound proposals get the green light so that we can try it out and then learn from it and then pick up the operational tempo against the bad guys.

32:05I think that's the thing that's going to drive success more than anything else.

32:09James Wilson: Okay. So that's a really great statement of what needs to be true for this to work. But to poke holes in this, I mean, to the commentary we had on the main show, where we were sort of saying, look, there's a lot of hysteria around this. We shouldn't do this because what if then the state-affiliated APT goes and bombs a US target in retaliation? That seems incredibly far-fetched, but I think it is quite real to, again, putting myself back in the position of if I was pitching this as a senior leader at the commercial entity to my board and to my shareholders as to why it was a good idea for us to begin doing cyber effects on behalf of the government.

32:52James Wilson: Well, we're going to have to answer the retaliation question. How much of a risk does this pose to retaliation attacks? So I think the things you'd have to think about are, if you work on one of these teams, are you now yourself no longer able to travel to certain countries because you're worried that you're going to be swept up and extradited for prosecution somewhere else? So you can't go, I don't know, go see the Great Wall in China or something like that. And so people that have spent their lives in private sector, they may not understand all the rules involved once you start to do this kind of work.

33:26So I think for the individuals, that's like an interesting question is like once you start getting engaged in these activities, how does it change things for you as an individual? And then for the employer and for the individual, what kind of risk and blowback do we bring on ourselves by participating in this stuff? And then that might run across purposes with the desire to brag and talk publicly. about it. But at the same time, you don't want to tell, you know, these well-resourced bad guys that you blew up their money-making machine. And so, because they could do something, you know, about it in retaliation.

33:58So, um, all of this stuff to me is an example of the, like the learnings we're going to have to explore together to figure out like what, what works, what's the right way to handle it, what's the right way to do it. Um, and, and then who's brave enough to be one of the first to get involved here and you know is it a program that makes sense given where the organization is and the other things you could be doing you know i think we're getting to the point

34:23James Wilson: of sort of wrapping this up and zooming out and getting to the cso's perspective of of so what but before we do uh we talked about there the risk of retaliation from a bad actor coming after you because you did blow up their their shiny thing there's also the very real risk of as part of actually doing one of these cyber effects, even though it's blessed by the government, there's a mistake, there's an error, there's wrong data, the wrong data gets deleted, the wrong person gets impacted by this. How on earth would we, how do we think about where the liability should sit? Because that I imagine will have a huge impact on the lasting success here, especially beyond just the, regardless of the risks, we've got to make the world a better a place let's go who who's going to wear the liability here i think by definition the kind of entities they're going to be going after are groups that have no recourse and so the idea that you know the the cyber mercenaries go after the bad guys and uh they screw up in some way that you know the the would-be bad guys or the people who live next door to them i don't think they're going to be able to sue in u.s court and say hey you know you you blanked my server you bricked my machine.

35:34You owe me a new one. So I just don't see that happening.

35:38James Wilson: But just to push back on that, what if the attacker has somehow stolen themselves some API keys that gets them some access into AWS? They're using that as part of their C2 infrastructure. That's alongside legitimate AWS customers. I mean, that's a real scenario where you could be facing some lawsuits. Yeah, yeah. So I actually was thinking through this when I was reading the material originally. so what if the most effective way to target the bad guys is through a neutral entity like starlink or aws or something else you know so um you know if you're going after the scam compounds maybe you know hacking starlink and zeroing out their accounts uh from from the inside the control panel of the customer support agent uh within starlink maybe that would be the most efficient way to achieve the outcome you're seeking certainly where your open core agent is going to go to try to do this, right?

36:30James Wilson: That sounds exactly like what an LLM will try. That's exactly right. And so my guess is initially, they're not going to go anywhere near those types of operations, but they will reach a point where it's just such an obvious win. And there may be some reluctant, allegedly neutral entity that's just looking the other way and not trying to be helpful. And so a bulletproof hosting provider, things like that. I don't think AWS is going to be there at the start but but i imagine that will be where the tension is eventually and and so who the hell knows like this is all uh new territory so so it'll be fun that's for sure yeah yeah it's gonna be very interesting to see how this develops and uh you know but then then sort of zooming out now and the original premise for this was uh you know why should i care about it i've got a good sense now of why i should care about it if for nothing else just to with interest to watch how this goes.

37:23James Wilson: But from a CISO's perspective or senior cybersecurity leadership, what's the so what in this for them? Even if it's not like what matters on Monday morning, but what should they be watching to know when there is a material, I guess, eventuality that comes out of this that could have an impact on a CISO? Yeah, so I think like for all the CISOs out there, the first really obvious thing is if you cannot name the special agent in charge of your local FBI field office, you should figure that out. Ask someone you have dinner with once a month to put you into touch. You could just call them, cold call them and ask for an introduction, explain your role.

38:05The idea that you should have multiple different FBI agents' cell phone numbers on your cell phone and you can text and call them 24-7 and you may not get an answer back within 30 seconds, but you need a way to reach out to that population because they're going to have this increasing range of remedies that might be useful to you. And so you need to know who they are. The next thing is within the private sector, do you have a retainer for incident response and investigations? Do you work with Crosstrike or Mandant or who's the team that you go to when something goes wrong? And getting in touch with them and saying, hey, what do you know about this announcement?

38:41Is this the kind of thing that you might participate in? Have you looked into it? Or is this just meant for Lockheed Martin? Like, help me read between the lines and understand what's going on here. And so, and then talking together about if something bad were to happen to your environment, can your delegated investigation third party potentially on your behalf, share information that might become a proposed operation? Or would you have to sign off on it? Do you want to be involved and have the chance to bless one of these things before it happens if it's related to an incident that impacted your environment?

39:13So talking through how did these decisions get made, how will the information flow back and forth, if an operation is carried out related to an incident in your environment, how will that play out when your customers who are impacted initially litigate you in court? So will this stuff all be made public and will it make the lawyers on your side happier or less happy about being involved in the program? so like all of this stuff i think is worth sort of spending a little bit of time talking through um and and i don't think anybody should count on this uh saying we can cut our cyber budget in half you know i don't think it's going to make your life easier as a defender anytime soon it might in aggregate be worth doing um but you know if you're at risk of ransomware today you should do something about it you should try to improve your defenses improve your recovery capabilities.

40:08And because this thing is coming, don't feel like, oh, we can just cancel that project. I don't think we need to do that anymore. I wouldn't wait for that to save you.

40:16James Wilson: Yeah. Who knows how long this takes, what form it eventually comes to life in. And also, I guess, the longevity of it, right? What happens if there's a change of government in the US and this just gets repealed. But either way, Brett, very solid advice. And more than anything else, great to see you again. And thanks so much for dropping by to talk through this with me. yeah this is great