Conversation with Andrew Boyd — State of Play: Cyber Warfare and Security

24:52They've also used their cyber tools for intelligence collection, but also attempting to disrupt critical infrastructure. But they, as we've learned since they invaded Ukraine, those tools aren't what we thought they would be. And there are quite a few limitations. The Iranians, they use their cyber tools in a very different end. And again, this is in a position of advocacy. It's a position of strategic analysis, very effectively in the realm of coercive diplomacy. They took down Albanian computer systems to demonstrate their dissatisfaction with the Albanians hosting the Mujedin al-Alk, an Iranian opposition group, and demonstrated that you can use your cyber tools to achieve diplomatic ends.

25:33And finally, the North Koreans, they use their cyber tools to make up for the sanctions. They don't have any money because they're sanctioned on almost every front you could imagine. So they use their cyber tools to steal cryptocurrency and then attempt to convert it into fiat currency to fund their weapons programs and whatnot. You know, so that's the state for the nation state actors. I think one of the biggest non-nation state problem we have is ransomware and criminal activity. And back to my point on AIML, previously ransomware actors would send poorly worded emails to people and ask you to click on an attachment.

26:14and then that would infect your computer and they'd either steal intellectual property or try to, you know, coerce, you know, ransom your data or whatnot. But now with AI ML tools, ChatGPT, they can actually have ChatGPT write those, you know, in idiomatically correct English and use ChatGPT or other AI ML tools to build exploits, even if they don't have any hacker skills. So I think 2024 is going to be the year of criminal activity in cyberspace. more so, frankly, than the nation state actors. And that's kind of where I see 2024 going from a cyber threat perspective. I just can't imagine how good it's going to be.

26:52And even worse than the con is, what happens when you can no longer trust anything? I think that's what we're going to see in 2024. But the great thing is, as technology advances in offensive capacity for criminal entities or nation states, so does the defensive capacity. And I do think we're going to have plenty of companies, and they're already coming above the waterline, attempting to come up with defensive software and or security services for small businesses, large enterprises to defend against this. I also think what's important, there's one thing if the private sector is focused on it, the tools have to be commercially viable, obviously, but the policy community is actively engaging on this.

27:39And there was an executive order and a strategy put out on cyber security and what we do with our U.S. government cyber tools back in the spring of 2023. And then late 2023, an AI executive order went out, which I think it's an extremely technical document for a document coming from the White House. But what it demonstrates is a recognition of not only the promise of this sort of technology, but the threat it could pose, you know, not only to the security of your business or the security of other businesses, but also just the entire way we manage our society up to and including disinformation and as it relates to democracy and all the elections around the world in 2024.

28:23So capacity and competence rank, if you will, the various nation states in terms of who does it the best or defends against it the best and how far ahead or behind are they, the other key players? In the context of AIML or just cybersecurity writ large? Yes. So, I mean, I think the United States is head and shoulders above everyone else in our innovative capacity, our ability to capitalize on academia and all the work that they're doing, despite, you know, the press indicating otherwise. I think where the PRC has an advantage is just the volume of humans that can throw against this problem set.

29:06The cyber, from just purely the government perspective in China, I mean, hundreds of thousands of folks are applied to their cyber, their offensive cyber problems. Similarly, they have, you know, hundreds of thousands of folks working on the defensive side as well. What also the advantage they have is they control the internet. The governments in China, Russia, Iran, North Korea, they make reference to the great Chinese firewall. It's sort of a mirage in a lot of ways, but they do control access to internet protocol space in those countries. We do not. So that is a massive vulnerability. But if I had to pick one of the two, having the innovative capacity of the United States of America versus having a vulnerable technology sector due to us living in an open society, I think I'd take the forum.

30:01This is an elegant segue. You have real domain expertise around the Middle East. I would just love to get your sense of the state of play or what you see is happening in the Middle East and what the media is getting wrong and the role that cybersecurity or AI is playing in the conflict. You know, so October 7th, I mean, I think we'll look back historically, you know, a decade from now as being one of the most critical historical moments in the history of the Middle East and obviously specifically Israel. As far as the Middle East itself goes, I mean, I think up until October 6th, the Arab world was in a trajectory slowly but surely of recognizing the state of Israel.

30:45I mean, the Saudis were on the cusp of doing that. The Emiratis, you know, were very close to to to basically normalizing, you know, fully relationships with with with Israel. And I think in part, that is why Hamas made the decision that they did when they did, because they were going to get left behind. And arguably, over the past decade, they've already been left behind. Most of the Arab states have walked away from the Palestinian issue, and Hamas didn't like that, and put it, you know, on the forefront of everyone's mind. I think, you know, there are going to be governments in the Middle East, principally the Netanyahu government, who do not survive this.

31:25I think there's going to be a reset in politics. And I hope for the sake of peace in the future that it's a government that looks at not only defending Israeli territory, but the rights of the Palestinian people. Destroy Hamas, okay, but the rights of the Palestinian people have to be addressed. Otherwise, you know, it'll be, again, an epoch of intifada and nonstop conflict. The idea that the Saudi-Israeli rapprochement is put on ice in perpetuity, I don't think that's true. I think by the end of 2024, beginning of 2025, those discussions will reopen as long as Israel is not in an all-out war in Gaza still.

32:10It seems as if the kingdom has been oddly quiet. And it strikes me that the two largest economies just have a lot of mutual interest in tying up together. And what I have seen, I've been struck by how quiet some of the Arab nation states have been around this. And that strikes me as that they're planning to hopefully let this cool down and then re-engage. Do you think that's a fair thesis? I do. I don't have any concrete knowledge. Since I retired at the end of September, I'm not really in that dialogue anymore. But my assessment is that that will be back on the table. There's some certain hubs of fantastic technological innovation around the globe.

32:59One of them is in Israel. Some outstanding computer scientists, cybersecurity folks, and the Saudis recognize that and they want to partner with the Israelis because of that. Now, Saudi Arabia is not perfect. I mean, they are the Mohammed bin Salman has has made a lot of progress, has opened up the kingdom to us to a great degree. But there are certain human rights issues that I do think, you know, are worth considering. You know, we can go back to a few years ago on Jamal Khashoggi and what that all meant and the murder of Jamal Khashoggi. So, I mean, it's not as if the kingdom is going to become a progressive, you know, Jeffersonian democracy.

33:43I mean, it's just not going to happen. Is it going to be a productive economic partner for Israel, for the United States, for the rest of the Arab world? Absolutely. Absolutely. I think, you know, what has been forgotten in the press to a certain extent is the Saudis have initiated a rapprochement, not a full one, but at least a dialogue with the Iranians. I think that may be one of the most important things to at least nip in the bud the potential for conflict between Saudi Arabia and Iran and a cross Persian Gulf conflict, because that, you know, would actually precipitate a larger conflict that just would be disruptive to the entire region, if not the world.

34:26It's interesting you say that because when I think of kind of rail politic, wouldn't the U.S. or certain factions of the U.S. government favor, quite frankly, somebody turning Iran's focus away from anti-Western activity? I mean, didn't we lose a buffer in a natural enemy when we kind of took out of Iraq and that is we turned Iran into a superpower? Aren't there some factions of the intelligence apparatus in Congress that would like to see tension between the kingdom and Iran? I can say, you know, again, this is as a private citizen, but based on my experience, I don't think anyone in the U.S.

35:02intelligence community would be wanting that sort of conflict to be perpetuated. I mean, the U.S. intelligence community serves the policymaker and the legislative branch in other ways. if that is the policy of the United States, which it isn't, that may be the case. The invasion of Iraq in 2003 sort of flipped the boat on a whole lot of things. I mean, I couldn't say this until the end of September of 2023. But the fact of the matter is, I wasn't a fan of the invasion of Iraq. It caused an enormous amount of chaos that is going to continue for a generation, at least. And to your earlier point, yeah, the government in Iraq under Saddam Hussein was a buffer for the Iranians.

35:48And the Iranians subsequently obviously moved into Baghdad and for years really controlled the situation because we reduced our presence there. But to your point of actually actively encouraging conflict between the Saudis and the Iranians, I think it's the opposite. I think anything we can do to mitigate or prevent or delay a Shia-Purian conflict with the Sunni Arabs, I think, is in the interest of everyone. We'll be right back.

36:25Support for the show comes from Smartsheet. Okay, be honest. How many times today did a DM or email send you on some wild goose chase when you should have been focusing on being productive? No matter how many times you were distracted today, you don't have to be embarrassed. It's okay, we all do it. But just because we all do it doesn't mean we have to all do it. Smartsheet knows how easy it is to get distracted. They know how easily opening a new window to start a work task can turn into a series of rabbit holes, work-related and otherwise. And that's exactly why Smartsheet designed a seamless all-in-one platform that allows you to flow between tasks.

37:04Smartsheet customers know that Smartsheet is a distraction-free zone. Smartsheet. Work with flow. Learn more at smartsheet.com slash vox.

37:34Black Friday. That's why Mercury offers banking that does more, all in one place, so that doing just about anything with your money feels effortless. Visit Mercury.com to learn more. Mercury is a financial technology company, not a bank. Banking services provided through Choice Financial Group, Column N.A., and Evolve Bank and Trust members FDIC.

37:57As a founder, you're moving fast towards product market fit. Your next round, or your first big enterprise deal. But with AI accelerating how quickly startups build and ship, security expectations are also coming in faster, and those expectations are higher than ever. Getting security and compliance right can unlock growth, or stall it if you wait too long. Vanta is a trust management platform that helps businesses automate security and compliance across more than 35 frameworks like SOC 2, ISO 27001, HIPAA, and more. With deep integrations and automated workflows built for fast-moving teams, Vanta gets you audit-ready fast and keeps you secure with continuous monitoring as your models, infrastructure, and customers evolve.

38:42That's why fast-growing startups like Langchain, Ryder, and Cursor have all trusted Vanta to build a scalable compliance foundation from the start. Go to Vanta.com slash Vox to save$1 ,000 today through the Vanta for Startups program and join over 10 ,000 ambitious companies already scaling with Vanta. That's V-A-N-T-A dot com slash Vox to save$1 ,000 for a limited time.

39:13So we're doing a bit of a world tour here. We talked about the chaos in the Middle East. I would imagine one of the biggest losers from the conflict in the Middle East right now is Zelensky in Ukraine, because it just feels like we've taken our eye off the ball or people just don't seem to care as much. How would you describe the state of play in the Russia-Ukraine war? And what do you see playing out, given you no longer have access to confidential information, but just as someone who's very good at observing this type of situation and just telling it down to a few points? What are your thoughts on Russia-Ukraine?

39:44So the risk of it going off the front page, and it has since October 7th, you're correct. And I honestly think the trajectory will continue as we have our 2024 election cycle. I mean, the main risk of that is that there's not enough momentum on the Hill to continue to fund the president's programs and the aid programs, the military support programs to Ukraine. I really think that's the only real issue. There is certain advantage for the Ukrainians not being on the front page every day and that they can, you know, not quietly in Ukraine because everybody in Ukraine knows what's going on there, but they can continue their quiet offensive against the Russians and, you know, attempt to succeed.

40:29I don't think, you know, there's a lot of press on the offensive, the Ukrainian counteroffensive stalling. That is a real thing. That seemed to coincide with the October 7th incidents. I don't think that's a permanent condition. I think the Ukrainians are innovative. They have applied technology that hasn't really been used, particularly in drone space. I mean, I think ultimately, if we can continue to write the checks as a U.S. government to support the Ukrainians, they're ultimately going to prevail. I think they have to prevail. I think the whole structure of NATO, the whole structure of how we secure Europe will be upended if they don't succeed.

41:08And this idea that we're going to encourage the Ukrainians to come to the negotiating table with the Russians is frankly an absurd proposition unless the Ukrainians decide on their own to do so. And I apologize for skipping around here, but I'll put forward another thesis on another important relationship. The West is struggling with inflation. uh china is struggling with low growth we have ip capital they have unbelievable manufacturing might aren't there just a ton of incentives for a thought in u.s china relations i think there are and i think in your 2024 predictions you may have addressed that that the uh the biggest i think you i forget exactly how you said it but i think you said the biggest tax cut we could have the United States was a thawing of the relationships between China and the United States.

41:58I agree, but there are very particular things that the Chinese do. Again, back to my point on intellectual property theft, pre-positioning of cyber tools, what Microsoft has called Volt Typhoon, essentially the pre-positioning of tools and telecommunications networks in Guam and elsewhere. I mean, those are all very serious issues that we have to address. But there is some middle ground where we aren't necessarily allies with the PRC, but we're not promoting an adversarial relationship. And I agree with you. There's too much at stake economically. There's too much at stake from a well-being of our respective societies.

42:39And the Chinese economy is in decline, as you've noted, and I think it's probably in their interest as well. Make the case for serving in the agency or more generally public service. You're pitching, a bunch of my students have gone to work for the government and specifically the agency. Make the pitch when you're recruiting talented young people to come to work for the agency or our security apparatus. So I had a wonderful retirement ceremony at the end of September. Bill Burns, the director, was the keynote speaker. It was an extraordinary event. And then I was allowed to say my two cents. And what I thanked the agency for, and by extension, the State Department and the Air Force, you know, the time I spent in the Air Force, was giving me an extraordinary opportunity over the course of three plus decades to live multiple lifetimes, really.

43:33A day in Baghdad was like worth two weeks back here in Washington. I mean, the things that I would experience, the things that I would see, just, you know, only an infinitesimally small group of Americans get to get to experience those. Are they dangerous? Have I lost friends of mine in situations like that? Yes. But that doesn't negate from the impact that it had on my life. So that was the key messages that I wanted people in the audience to have when I retired was was just be thankful for being given the opportunity to experience such extraordinary things. What I would say to people like who are in grad school now, and it's a little different where I teach because, you know, folks at Hopkins at the School of Advanced International Studies, they all kind of want to go into government.

44:21But in other programs, maybe even an MBA program like yours at NYU, I'd say, yeah, you can go to be an investment banker right now after you graduate, or you can make the decision to do some adventurous things around the globe, contribute to your government. If for whatever reason, your family situation wouldn't allow you to travel all over the world like I did. There's plenty of ways to serve the United States government, serve the American people in capacities in Washington and elsewhere where you bring your talents to really complicated problem sets. And at the end of it, you know, no matter how long you serve for me, you know, over three decades, but, you know, two, three, four or five years, you leave very satisfied that you had an impact on people.

45:09You weren't getting paid enough, but you can always make money. So what I would say is, you know, don't don't burn your youth, your 20s and your 30s making money. You can make money later. Do something where you really, you know, exercise muscles that you wouldn't exercise otherwise and give back to your country and be in a position of federal service, however you define that. Andrew Boyd is a distinguished expert in intelligence, cyber operations and geopolitics. He most recently served as the director of the CIA Center for Cyber Intelligence, where he oversaw operations against foreign cyber threats.

45:44Upon retirement from the CIA, Andy held the rank of Senior Intelligence Service 5, the most senior rank for career CIA professionals. In addition, Andy has earned a number of recognitions, including the Intelligence Medal of Merit and the Presidential Rank Award. He joins us from his home in Arlington. Andy, when I speak to you, I not only feel better about America, I feel safer. Thank you so much for your service. Thank you, Scott, for your time, and I've really enjoyed our conversation.

46:21positive happiness just an observation around being a dad i'm having such a wonderful time i'm with my 13 year old it's just me and him his mother is in buenos aires um i want her life and then going to patagonia and my oldest who is 16 is at boarding school and so it's just me and my 13-year-old and just some observations on some of the great stuff that's fun for us. I ask him to kind of be the dad. I say, all right, can you figure out dinner for us tonight? I ask him sort of to take care of me. I say, what should we do tonight? Can you, can you, and I've given some responsibilities. I'm like, can you make sure that we now remember to take the dog store walk in the morning?

47:01I ask him to be sort of co-parent with me as opposed to kind of digressing into the traditional roles where I kind of boss him around and tell him to do stuff. And it's nice. And I think he sorts of enjoy it. And I task him with, all right, what are we going to do tomorrow night? Are we going to do this weekend? And he uses AI to go and plan like the perfect day. And we end up doing all this crazy touristy shit. But anyways, it's kind of fun. By the way, Madame Tussauds is the seventh ring of hell. Anyway, but there's some fun stuff. I took him to something called Moonwalkers, which he found, which was this kind of IMAX-like experience.

47:34A second observation, I just didn't appreciate until I was a little bit older how important it is that you spend time with each of your kids alone. I can't express how different they are when it's just you and the one kid alone. My friend David Carey, I remember it struck me, he always used to talk about he would take each kid on a trip every year, just the one kid. And I've started doing that. And that as I task them, I say, all right, where are we going? We each, you know, you have to do a trip with dad, just the two of us. I say to each of my sons and they pick something and we, it usually involves football, but it's a lot of fun.

48:13And also, you know, the difference between 13 and 16 is just so enormous. Apple, I figure what it's called, that kind of slideshow that they put in front of you with the sappy music. Jesus Christ, that shit's effective. And what I mean by effective is it makes me want to burst out crying. My 16-year-old is, you know, bumping up on six feet tall. And he's at the bottom line, it's just no longer my little boy. And it's really sad. And what it's given me, though, is an appreciation for I still have kind of a boy at home. And I'm really trying to lean into it. And it's a position of privilege because I have the economic security to spend a lot of time with my kids.

48:52But when I was younger, I kind of saw spending time with my kids as a bit of a tax. I was kind of always looking for reasons to make plans or do something else or never have them for that long. Because when they're kids, when they're really small, quite frankly, I found they were awful and just a ton of time and attention. It was mostly like, how do I keep this thing alive and make sure it doesn't get near a body of water? And as they get older and they get more fun, all I can tell you is kind of four to 14, that is the golden decade. And you really want to lean into it. My oldest is great. I still get a ton of reward hanging out with him.

49:25but he's less interested in me. He has his own thing. If you're fortunate enough to have a kid at home that really wants to be into you and really is into the relationship, oh my God, my brothers, just drink it up. Just seize that moment because that moment, that moment is fleeting. This episode was produced by Caroline Shagrin. Jennifer Sanchez is our associate producer and Drew Burrows is our technical director. Thank you for listening to the Prop G Pod from the Vox Media Podcast Network. We will catch you on Saturday for No Mercy, No Malice, as read by George Hahn, and on Monday with our weekly market show.

50:03The pumpkin spice latte is back at Starbucks. Crafted with our signature espresso and real pumpkin sauce. Then topped with whipped cream, cinnamon, and nutmeg. The PSL. Get it while it's hot or iced. Only at Starbucks. Support for this show comes from Saks Fifth Avenue. Saks Fifth Avenue makes it easy to shop for your personal style. It's fall, and it's time to invest in new arrivals you'll want to wear again and again, like a relaxed Prada blazer and Gucci loafers that are great for work or a weekend rendezvous. Saks makes shopping feel totally customized to you, whether that's in person with their in-store stylists or online at Saks.com, where they show you only what you like to shop.

50:45They'll even let you know when arrivals from your favorite designers are in, or when an item you've been eyeing is back in stock. For a personalized, easy shopping experience, head to Saks Fifth Avenue for the best fall arrivals and style inspiration.