Speaker 1: Welcome to the deep dive. Today, we're plunging into a
Speaker 1: world where, honestly, cyber warfare has kind of shattered the
Speaker 1: digital barrier. It's not really just about stealing data anymore
Speaker 1: or causing digital disruption. It's evolving into something much more physical,
Speaker 1: something that's really deeply intertwined with almost every aspect of
Speaker 1: our lives, you know, from the power grid to the
Speaker 1: apps on your phone. So we're embarking on this deep
Speaker 1: dive into the well complex and often counterintuitive world of
Speaker 1: cyber conflict, looking at its inherent vulnerabilities and especially it's
Speaker 1: escalating real world impact.
Speaker 2: Yeah, and our insights for this they're drawn primarily from
Speaker 2: Jeffrey Caruso's Inside cyber Warfare, third edition. It's really indispensable guide.
Speaker 2: I think it helps navigate this wilderness of evolving threats,
Speaker 2: and it reveals some truths often kind of hidden beneath
Speaker 2: the surface of the daily headlines. Right.
Speaker 1: And our mission for you listening is to unpack how
Speaker 1: software is fundamental insecurity. This core problem, along with the
Speaker 1: cybersecurity industry, is let's say, unique incentives and the blurring
Speaker 1: lines of modern conflict. How all that is shaping our
Speaker 1: digital and increasingly our physical world. We promise some genuinely
Speaker 1: surprising insights and maybe some practical considerations you can actually apply. Okay,
Speaker 1: so let's unpack this first big piece. We really have
Speaker 1: to start with this foundational idea from the source. There
Speaker 1: has never been such a thing as a truly secure
Speaker 1: or healthy network.
Speaker 2: Ever. It's kind of mind blowing when you think about it.
Speaker 1: It goes all the way back to the first high
Speaker 1: stea computer maniac, back in the nineteen fifties. So, I
Speaker 1: mean think about that for a second. Insecurity was basically
Speaker 1: baked in from day one, and it sort of came
Speaker 1: to a head with what was famously called the software
Speaker 1: crisis in nineteen sixty eight. Douglas Ross, who is a
Speaker 1: pioneer in computer aided design, he us this really vivid analogy.
Speaker 1: He compared systems supposedly in good working order to a
Speaker 1: person having a heart attack.
Speaker 2: Wow, a heart attack.
Speaker 1: Yeah, So the underlying fragility, as you can see, it's
Speaker 1: been there right from the very beginning.
Speaker 2: It's truly eye opening, and that inherent insecurity it isn't
Speaker 2: just a buz, right, the author argues, it's actually become
Speaker 2: a core feature, something that's actively exploited by the well
Speaker 2: multi billion dollar cybersecurity industry.
Speaker 1: Exploited how well?
Speaker 2: He puts it very provocatively. He says, it pays much
Speaker 2: better to play offense than defense. Then he introduces this
Speaker 2: really striking analogy. He compares the cybersecurity industry's model, you know,
Speaker 2: discovering vulnerabilities then selling the protection rack. He compares it
Speaker 2: to an organized crime protection racket.
Speaker 1: Okay, that's strong language, a protection racket.
Speaker 2: From your perspective reading this, how much truth is there
Speaker 2: to that analogy? What does it really imply about the
Speaker 2: industry's incentives.
Speaker 1: Well, it definitely forces us to ask some tough questions,
Speaker 1: doesn't it. I mean, if you look at the Global
Speaker 1: Prohibition on biological warfare, for instance, finding a vulnerability in
Speaker 1: the human body and then trying to sell the cure
Speaker 1: after announcing you've maybe created a disease that can be
Speaker 1: considered a crime against humanity, unthinkable exactly. Yet in the
Speaker 1: digital realm, discovering of vulnerability and then monetizing the fix, well,
Speaker 1: that is the core business model for many. It arguably
Speaker 1: creates this kind of perverse incentive to not fully secure
Speaker 1: things from the start, because you know, there's potentially more
Speaker 1: profit in the ongoing cycle of finding flaws and patching them.
Speaker 2: That's yeah, that's a truly unsettling thought. And the real
Speaker 2: world impacts of these software flaws, I mean, while they're
Speaker 2: often hidden, they can be genuinely tragic. There's this research
Speaker 2: from Donald McKenzie back in nineteen ninety four. He found
Speaker 2: that by nineteen ninety two, only about three percent of
Speaker 2: computer related deaths, so like thirty out of eleven hundred,
Speaker 2: were actually due to software bugs. Most were caused by
Speaker 2: faulty human computer interaction like user error, basically preface issues.
Speaker 1: But fast forward and the examples get much more alarming.
Speaker 1: In two thousand and one, five patients died from radiation
Speaker 1: over exposure at Panama's National Oncological Institute directly due to
Speaker 1: software flaws.
Speaker 2: Oh wow.
Speaker 1: And then there's what the source calls the shocking number
Speaker 1: of injuries and deaths linked to the accelerated adoption of
Speaker 1: electronic health. Both records EHRs since about twenty eleven.
Speaker 2: The EHR problem.
Speaker 1: Yeah, and the FDA's m UE database even revealed one
Speaker 1: hundred and forty four deaths and almost fourteen hundred patient
Speaker 1: injuries just from robotic surgeries between twenty and twenty thirteen,
Speaker 1: and the source stresses those numbers are likely seriously underreported.
Speaker 1: So what then explains this underreporting, especially with the EHR issues.
Speaker 1: It sounds like a huge problem that's just being swept
Speaker 1: under the rug.
Speaker 2: You're right, it seems to be a massive issue, and
Speaker 2: it's largely down to a lack of legal requirements to
Speaker 2: report these incidents. There's this chilling quote from a hospital
Speaker 2: administrator in the book, quote, we don't want to know
Speaker 2: the safety performance of our system because what would that mean?
Speaker 1: Wow, just don't look.
Speaker 2: Exactly this reluctance, this sort of active avoidance of transparency.
Speaker 2: It's also very common, the author knowes, with companies underplaying
Speaker 2: how serious cybersecurity incidents are. It really feels like accountability
Speaker 2: often becomes an afrothought because there's no real penalty usually
Speaker 2: for not being transparent.
Speaker 1: Okay, So, given this fundamental fragility of software we've just discussed,
Speaker 1: it raises an even bigger question, doesn't it. When an
Speaker 1: attack does happen, how can we possibly know who's really
Speaker 1: behind it? This is where things get really complex and
Speaker 1: pretty surprising.
Speaker 2: Yeah, the bit really drills down on this core concept
Speaker 2: of attribution. Yeah, And the key takeaway is it's not
Speaker 2: deduced like a mathematical proof. It's inferred.
Speaker 1: Inferred meaning like an educated guess sort of.
Speaker 2: It means it relies on a whole series of assumptions,
Speaker 2: not necessarily proven facts. Think about it simply. You see
Speaker 2: wet crass, you infer it rained, right, but maybe a
Speaker 2: sprinkler was just malfunctioning. Or you see a police car
Speaker 2: at a closed bank, you infer a break in, but.
Speaker 1: The officer might just be using the ATM god exactly.
Speaker 2: And historically assumptions like you know, all financial cybercrime must
Speaker 2: be Russian or all ip theft must be Chinese these
Speaker 2: often led to wildly increate blame.
Speaker 1: So if attribution really is just inference not deduction, that
Speaker 1: must lead to some pretty significant missteps in the real world.
Speaker 1: Have we seen compelling historical examples of how wrong this
Speaker 1: inference can go?
Speaker 2: Oh, absolutely plenty. Take Moonlight Mays back in nineteen ninety
Speaker 2: six massive theft of classified data Pentagon.
Speaker 1: NASA, Right, I remember hearing about that.
Speaker 2: He was initial attributed to Russia based on things like
Speaker 2: working hours and holidays observed in the logs. But even then,
Speaker 2: the specific military or intelligence unit remained fuzzy. There was
Speaker 2: some early caution. Okay, then you have Solar Sunrise in
Speaker 2: nineteen ninety eight attacks on unclassified Defense Department computers. This
Speaker 2: was during military preparations against a rock, so the immediate
Speaker 2: assumption was Bagdad.
Speaker 1: Makes sense politically right.
Speaker 2: But it turned out to be a group of teenagers
Speaker 2: from California and Israel teenagers.
Speaker 1: Wow.
Speaker 2: Yeah. And then came Titan Rain, also known as Byzantine Hades,
Speaker 2: starting around two thousand and three. This one was directly
Speaker 2: attributed to China's PLA Unit sixty one three ninety eight,
Speaker 2: and significantly, this attribution, published by the security company Mandian,
Speaker 2: led directly to their one billion dollar acquisition by FireEye.
Speaker 1: A billion dollars.
Speaker 2: Yeah. The lesson for the cybersecurity industry became pretty clear.
Speaker 2: Attributing a major attack to China meant headlines, new business,
Speaker 2: and potentially massive valuations.
Speaker 1: That example alone just makes you wonder how many other
Speaker 1: attributions might have been driven by similar incentives, consciously or not.
Speaker 1: You mentioned that many commonly accepted assumptions in these investigations
Speaker 1: have actually been proven invalid. Which of these, looking through
Speaker 1: the source, do you think has led to the most
Speaker 1: significant misjudgments or maybe even policy errors.
Speaker 2: That's a really good question. I think I'd have to
Speaker 2: point to what the author calls the exclusive use assumption.
Speaker 1: Okay, what's that.
Speaker 2: It's the belief that malware source code is proprietary, like
Speaker 2: a secret recipe, and is not shared or stolen.
Speaker 1: But that's not true.
Speaker 2: Definitely not always true. We've seen malware like ex agent
Speaker 2: famously used by the Russian group Fancy Bear or APT
Speaker 2: twenty eight. It's been in the while circulating since twenty twelve.
Speaker 2: Its source code is obtainable. And get this, Ukraine's g
Speaker 2: URE military intelligence actually maintains a repository of seized Russian
Speaker 2: and Iranian malware that they repurpose for their own operations.
Speaker 1: Wow, so they're using the enemy's tools.
Speaker 2: Against them precisely. And remember the wikileague CIA files. They
Speaker 2: revealed the Umbradge subgroup whose job was specifically to catalog
Speaker 2: exploits from other groups to use for false flag operations.
Speaker 1: False flags, so making it look like someone else did
Speaker 1: it exactly.
Speaker 2: So, if you assume a piece of malware is unique
Speaker 2: to one group and it's actually floating around or being
Speaker 2: deliberately misused, Yeah, you're almost certainly blaming the wrong party.
Speaker 1: And that flawed assumption feeds into others.
Speaker 2: Right, It feeds into things like the working hours assumption,
Speaker 2: the idea that state sponsored hackers keep regular nine to
Speaker 2: five office hours in their home country.
Speaker 1: It sounds ridiculous.
Speaker 2: It's ludicrous on its face, as the author says, I
Speaker 2: mean Russia alone spans eleven time zones, and you have
Speaker 2: other major offensive cyber players like you're on Israel, Ukraine,
Speaker 2: the UAE many in similar or adjacent time zones. It
Speaker 2: tells you almost nothing. And finally, there's the criminals versus
Speaker 2: spy's assumption, the belief that criminal hackers don't engage in
Speaker 2: espionage unless a government pays them to. But we know
Speaker 2: hackers for hire and espionage as a service are thriving
Speaker 2: businesses on the dark web. We've seen cases like subins
Speaker 2: selling US military secrets or trend micro documenting these services.
Speaker 2: The lines are incredibly blurred.
Speaker 1: So this interconnected web of faulty assumptions, it sounds like
Speaker 1: it could lead to major geopolitical miscalculations.
Speaker 2: Absolutely, it really.
Speaker 1: Sounds like, as the author suggests, no one, not even
Speaker 1: the NSA, can definitively tell you who is actually operating
Speaker 1: the keyboard. They can trace traffic maybe back to a
Speaker 1: certain point, but the person behind the screen they are
Speaker 1: may elusive. So if this is all just inference and
Speaker 1: based on such shaky assumptions, what are the repercussions for
Speaker 1: poor analysis? It seems like maybe there aren't any.
Speaker 2: You're hitting the nail on the head. The book argues
Speaker 2: there are essentially no repercussions for poor analysis. CrowdStrike is
Speaker 2: as an example achieving huge commercial success despite some heavily
Speaker 2: criticized reports on attribution. As Dimitri al Parevitch, Crowdstrikes co
Speaker 2: founder apparently put it quite bluntly, the required level of
Speaker 2: certainty for attribution is often just good enough for CNN.
Speaker 1: Good enough for CNN.
Speaker 2: Wow. That says a lot it does. Political expediency or
Speaker 2: commercial gain often seems to trump rigorous scientific certainty in
Speaker 2: this field.
Speaker 1: This inherent ambiguity. It really highlights the immense difficulty in
Speaker 1: truly knowing who's behind these cyber attacks. So, given that
Speaker 1: huge uncertainty, why is there so much resistance to independent
Speaker 1: fact finding mechanisms? Why not create something like the OPCW.
Speaker 1: You know, the Organization for the Prohibition of Chemical weapons.
Speaker 1: But for cyber.
Speaker 2: Attacks, that's a critical point, and it's discussed in the book.
Speaker 2: There's a proposal for just at and international attribution mechanism
Speaker 2: modeled after the OPCW to objectively investigate major cyber attacks.
Speaker 2: But the major cyberpowers, think the US, UK, Israel, they
Speaker 2: tend to resist this idea.
Speaker 1: Why what's the fear?
Speaker 2: They seem to fear a loss of autonomy and frankly,
Speaker 2: political options. Imagine, hypothetically, if German hackers used Russian infrastructure
Speaker 2: for a major attack on the US, Washington might prefer
Speaker 2: to blame Russia directly in opposed sanctions. That's a political choice,
Speaker 2: rather than go through a transparent, independent process that might
Speaker 2: point the finger elsewhere, complicating their response.
Speaker 1: So keeping the ambiguity allows for more political maneuvering.
Speaker 2: It seems that way. The author shares this anecdote. The
Speaker 2: FBI issued a warning about election tampering linked to a
Speaker 2: specific Russian web hosting company, but the owner of that
Speaker 2: company apparently told investigators his customers help tickets for those
Speaker 2: servers were in English coming from German and New Jersey
Speaker 2: email providers.
Speaker 1: Not quite the smoking gun.
Speaker 2: Exactly. Simple assumptions can be very misleading, and powerful nations
Speaker 2: often prefer to keep their attribution options open.
Speaker 1: You could say, okay, so what stands out to you
Speaker 1: listening this about this immense difficulty and truly knowing who
Speaker 1: is behind these attacks?
Speaker 2: It really changes how you read the headlines, doesn't it? Now,
Speaker 2: Given everything we've just uncovered about softwares and inherent flaws
Speaker 2: and these huge challenges and attribution, it really forces us
Speaker 2: to think about how these digital conflicts actually play out
Speaker 2: in the real world. How are traditional battlefields changing because
Speaker 2: of this.
Speaker 1: Well, we're definitely moving way beyond distinct traditional military domains.
Speaker 1: Warfare now is deeply enmeshed.
Speaker 2: That's the term used in mesh like tangled.
Speaker 1: Together exactly, cyber electronic warfare, cognitive warfare, which is basically
Speaker 1: information in psychological operations, and traditional kinetic warfare. You know,
Speaker 1: bombs and bullets. They're no longer separate things. They're combined,
Speaker 1: often simultaneously, for a greater and more devastating effect.
Speaker 2: And is there a key figure associated with this shift?
Speaker 2: The book points centrally to Yevgeny Pregosion, often called pootin
Speaker 2: the Chef. He was a fascinating and frankly terrifying figure.
Speaker 2: In this he led both the paramilitary Wagner Group ercenaries
Speaker 2: and the infamous disinformation engine the Internet Research Agency or IRA,
Speaker 2: right the troll farm precisely. The Wagner Group, as the
Speaker 2: source details, has been documented committing horrific war crimes in Syria,
Speaker 2: the Central African Republic, Libya, and very visibly in the
Speaker 2: Butcha massacre in Ukraine. Meanwhile, his other arm, the IRA,
Speaker 2: was indicted back in twenty eighteen for interfering with US
Speaker 2: elections as laid out in the Muller Report. So Progosian
Speaker 2: really wielded both information or disinformation and brute force as
Speaker 2: integrated weapons.
Speaker 1: And we've seen some pretty compelling case studies that demonstrate
Speaker 1: this enmeshed strategy, haven't we were Propaganda and physical violence
Speaker 1: work hand in hand, Like the Mozart group in Ukraine.
Speaker 1: This was led by Andy Milburn, a retired US Marine
Speaker 1: Corps colonel. It was a volunteer organization providing really crucial
Speaker 1: training and humanitarian aid. I remember reading about them well
Speaker 1: Progosians IRA launched just a devastating information warfare campaign against them.
Speaker 1: DIDOS attacks hit the website there was a massive social
Speaker 1: media blitz labeling Mozart a private military company, trying to
Speaker 1: discredit them, and even direct threats were made against hotels
Speaker 1: known to be housing their team members.
Speaker 2: Wow, threats against hotels, Yes.
Speaker 1: And this wasn't just digital noise. Three separate hotels where
Speaker 1: Mozart personnel were confirmed to have stayed were subsequently hit
Speaker 1: by Russian missiles.
Speaker 2: That's terrifying, a direct.
Speaker 1: Link absolutely, And add to that, a heavily manipulated video
Speaker 1: from the team House podcast pushing false narratives about Mozart
Speaker 1: garnered like three point five million views. All of this
Speaker 1: ultimately contributed to the Mozart group having to shut down
Speaker 1: after just nine months of doing really critical work.
Speaker 2: That's a powerful example of information warfare having real, tangible
Speaker 2: negative consequences.
Speaker 1: We also saw elements of this in Syria, didn't we
Speaker 1: Back in twenty fifteen, Wagner mercenaries were supporting Bashar al
Speaker 1: Asad's regime. There was that significant confrontation with US forces
Speaker 1: at a Konoco gas plant in twenty eighteen, and afterwards
Speaker 1: Russia publicly denied any Russian military personnel were present. Classic
Speaker 1: plausible deniability enabled by using mercenaries. Right.
Speaker 2: It wasn't Russia, it was Wagner exactly.
Speaker 1: And in Mali, the book describes a similar pattern. Wagner
Speaker 1: Group operates militarily suppressing jihattists supposedly, while the IRA runs
Speaker 1: coordinated disinformation campaigns in parallel promoting Russia, pushing narratives to
Speaker 1: delay elections, fueling anti Western sentiment. It's a truly integrated playbook.
Speaker 2: It's really striking too how social media platforms specifically X, TikTok,
Speaker 2: Facebook I mentioned, have become the sort of preferred platforms
Speaker 2: for delivering this disinformation and misinformation. Why them specifically, Well,
Speaker 2: they're easy to use, its incredibly low costs compared to
Speaker 2: traditional espionage or propaganda, and they're largely unregulated, especially across borders.
Speaker 2: On X formally Twitter, the book points out how Elon
Speaker 2: Musk's paid blue check mark system essentially enabled Russian propaganda
Speaker 2: accounts to gain apparent legitimacy, and Musk himself even boosted
Speaker 2: some of their tweets, amplifying their reach. The European External
Speaker 2: Action Service the EEES did a report highlighting that Telegram, Facebook,
Speaker 2: and Twitter were the most used channels for foreign information manipulation,
Speaker 2: employing tactics like shifting blame for events, distorting the context
Speaker 2: of information, and just generally distracting audiences from inconvenient truths.
Speaker 1: And kiktok that gets mentioned a lot in terms of
Speaker 1: security concerns.
Speaker 2: Yeah, TikTok presents a particularly thorny national security threat, according
Speaker 2: to the source, because of his parent company Bike Dance's
Speaker 2: deep ties to the Chinese government in Beijing. The author
Speaker 2: cites examples of prominent Chinese citizens Jack Maw, the tennis
Speaker 2: player Peng Shui, the actress Zoe Way, who essentially disappeared
Speaker 2: for periods after crossing Beijing in some way, right.
Speaker 1: The implication being the government has immense control.
Speaker 2: Exactly, And the concern is that TikTok on your phone
Speaker 2: could effectively be turned into a two hundred and forty
Speaker 2: seven surveillance device feeding data back.
Speaker 1: And this surveillance capability isn't just theoretical, is it. It's
Speaker 1: being used for direct targeting and conft zones.
Speaker 2: Right now.
Speaker 1: There's this incredible, chilling example from March twenty twenty two
Speaker 1: in Kiev, a Russian sympathizer apparently posted a TikTok video
Speaker 1: showing Ukrainian armored vehicles park near a shopping center. Oh no,
Speaker 1: shortly after that video went up, the shopping center was
Speaker 1: bombed by Russia. But here's the cyber counter move. Ukraine's
Speaker 1: GUR their military intelligence reportedly use cell phone tower data
Speaker 1: combined with subscriptions to commercial ad tech companies, leveraging what's
Speaker 1: called digital exhaust the data trails we all leave, right,
Speaker 1: the ad data exactly. They use that to identify and
Speaker 1: ultimately capture the individual who posted the TikTok video.
Speaker 2: Wow using ad tech for counter espionage.
Speaker 1: Yeah, and Ukrainian special forces apparently used this methodology called
Speaker 1: F three EAD, find, fix, finish, exploit, analyze, disseminate. They
Speaker 1: actively leverage Russian social media like Telegram and VK, alongside
Speaker 1: commercial data brokers, facial recognition tech, even smartphone location services,
Speaker 1: all to track and target Russian military personnel. The book
Speaker 1: mentions them capturing an FSB officer's laptop. This way, it's
Speaker 1: like spycraft meets big data. This leads me to a
Speaker 1: really chilling thought, though, how does that seemingly benign surveillance,
Speaker 1: the stuff that happens through real time bidding and the
Speaker 1: online ad industry play into all this. It feels like
Speaker 1: something we all interact with constantly clicking except on cookies,
Speaker 1: without realizing its potential darker uses.
Speaker 2: It's a really critical connection to make, and the book
Speaker 2: lays it out well. Imagine every click you make, every search,
Speaker 2: every app you open, each creates a tiny data point
Speaker 2: about you. Real Time Bidding r TB is the automated
Speaker 2: process where at exchanges scoop up literally billions of these
Speaker 2: tiny points every second, and they stitch them together into
Speaker 2: an incredibly detailed digital portrait of view. How detail, they
Speaker 2: use a standardized taxonomy apparently of one thousand, six hundred
Speaker 2: and seventy nine different personal characteristics. This includes things you'd expect,
Speaker 2: like demographics, but also incredibly sensitive stuff very low net worth,
Speaker 2: personal debt, history of seeking bail bonds, views on vaccines,
Speaker 2: even lgbtq plus identifiers. Incredibly granular it is, and while
Speaker 2: it's all collected ostensibly for advertising showing you relevant ads,
Speaker 2: this data has been extensively abused. We saw it with
Speaker 2: Cambridge Analytica influencing elections. There are examples of companies using
Speaker 2: it to profile lgbtq plus individuals in Poland or Mobile
Speaker 2: Walla profiling Black Lives Matter protesters in the US.
Speaker 1: So the capability is there, and it's been misused exactly, and.
Speaker 2: This micro targeting capability built for commerce is precisely what
Speaker 2: intelligence agencies around the world find immensely valuable. They leverage
Speaker 2: this same data ecosystem for their own surveillance and targeting purposes,
Speaker 2: turning our everyday digital footprint into a powerful and potentially
Speaker 2: dangerous tool.
Speaker 1: So far, we've talked a lot about data information propaganda,
Speaker 1: but the most alarming evolution of cyber warfare maybe isn't
Speaker 1: just about stealing secrets anymore. It's about causing real physical destruction.
Speaker 1: That feels like a profound shift.
Speaker 2: It absolutely is, And to really understand this, we need
Speaker 2: to quickly define operational technology or.
Speaker 1: Ot okay o T what is that.
Speaker 2: These are basically the industrial control systems, the computers and
Speaker 2: networks that run critical infrastructure think power plants, water treatment facilities, subways, factories, pipelines,
Speaker 2: the physical backbone of our modern world.
Speaker 1: And these systems they weren't built with security.
Speaker 2: In mind for the most part. No, Many were designed
Speaker 2: decades ago before the Internet as we know it existed,
Speaker 2: focus purely on operational reliability, not on fending off nation
Speaker 2: state hackers. They're often incredibly vulnerable.
Speaker 1: And the examples of cyber attacks actually causing physical kinetic
Speaker 1: effects they're chilling. The book details the Aurora generator test
Speaker 1: from two thousand and seven. This was done at Idaho
Speaker 1: National Laboratory, kind of a proof of concept experiment kept
Speaker 1: secret for a while. Or they do a cyber attack
Speaker 1: deliberately manipulated a protective relay on a huge twenty seven
Speaker 1: ton diesel generator. The result the generator started taking violently
Speaker 1: erupted smoke and was physically damaged, basically destroying itself from
Speaker 1: the inside out.
Speaker 2: Wow, so proof positive. Yeah, code can break heavy machinery unequivocally.
Speaker 1: Then, more famously, there was stucksnet around twenty ten twenty eleven.
Speaker 1: This targeted Iran's nitens uranium enrichment facility and is widely
Speaker 1: believed to have destroyed between one thousand and two thousand
Speaker 1: centrifuges by manipulating their speeds.
Speaker 2: Right, stucks net is the classic example, But here's.
Speaker 1: A surprising detail from the book. Despite Stucksnet's success in
Speaker 1: destroying centrifuges, Iran's overall stockpile of enriched uranium actually increased
Speaker 1: tenfold between twenty eight and twenty thirteen.
Speaker 2: So the sabotage didn't really stop the program long term.
Speaker 1: It raises questions about the long term strategic effectiveness of
Speaker 1: sabotage like that, doesn't it? Did it just delay or
Speaker 1: force them to build better and more resilient system Interesting point,
Speaker 1: and the attacks on Iran continued. Israel is widely attributed
Speaker 1: with attacks in twenty twenty and twenty twenty one. One
Speaker 1: caused a major fire and explosion at a new set
Speaker 1: trifuge production facility in July twenty twenty. Another in April
Speaker 1: twenty twenty one completely destroyed the heavily protected internal power
Speaker 1: system at an underground fuel enrichment plan.
Speaker 2: Destroyed the power system. That's a critical blow.
Speaker 1: Yeah, apparently forcing Iran to start building a new facility
Speaker 1: even deeper in the mountains. So the cycle continues, and
Speaker 1: it's not just state on state. More recently, in twenty
Speaker 1: twenty two, the book details how Ukraine's g u are
Speaker 1: their military intelligence working with limited funds, reportedly engineered ruptures
Speaker 1: and explosions in Russian gas prom pipelines by remotely manipulating pressurization.
Speaker 2: Controls, manipulating pipeline pressure that sounds incredibly dangerous.
Speaker 1: Extremely specific examples cited include a gas leak and the
Speaker 1: sarchans Neft to Gez pipeline in April twenty two after
Speaker 1: a related helicopter attack, a large fire in the Urungoi
Speaker 1: Center two pipeline also in April twenty two, and then
Speaker 1: a major explosion at the Urungoi gas field itself in
Speaker 1: June twenty twenty two. And Urungoi is the second largest
Speaker 1: natural gas field in the world.
Speaker 2: These sound like major industrial.
Speaker 1: Accidents exactly, but allegedly triggered by cyber, and the source
Speaker 1: suggests that vendoring competence and corruption on the Russian side,
Speaker 1: like a supplier bankruptcy leaving systems unfinished or fire safety
Speaker 1: systems contracted in twenty eleven still not being completed, actually
Speaker 1: facilitated these attacks, made them.
Speaker 2: Easier, so basic security failures opened the door, it seems so.
Speaker 1: There's even evidence presented of combined cyber and special operations missions,
Speaker 1: like a fire and explosion at Russia's second Central Research
Speaker 1: Institute in Tever in April twenty twenty two. This is
Speaker 1: where Russia designs things like their Iskander and S four
Speaker 1: hundred missile system.
Speaker 2: A high value target extremely.
Speaker 1: And informed sources cited in the book suggest this wasn't
Speaker 1: just an accident. It was a combined attack, a cyber
Speaker 1: attack possibly caused an initial electrical fire, which then ignited
Speaker 1: explosives potentially placed beforehand by commandos.
Speaker 2: Wow, a truly enmeshed operation.
Speaker 1: And one more quick example, in June twenty twenty two,
Speaker 1: a group calling itself Predatory Sparrow claimed responsibility for causing
Speaker 1: a fire at Iran's cuses Stand Steel Company. They apparently
Speaker 1: did it by accessing the SCATA system, the industrial control
Speaker 1: system controlling the plant's furnaces. They even posted videos online.
Speaker 2: As proof, posting videos brazen.
Speaker 1: It's a terrifying convergence of the digital and the physical,
Speaker 1: breaking things in the real world using code. So, given
Speaker 1: the sheer scale and potential impact of these kinetic cyber attacks,
Speaker 1: why is the cybersecurity industry seemingly struggling to defend against them.
Speaker 1: Why aren't we seeing massive investments pouring into preventing these
Speaker 1: kinds of devastating OT breaches.
Speaker 2: Well, the book offers a pretty stark explanation, and it
Speaker 2: comes down to economics. Really. As the author puts it, fundamentally,
Speaker 2: these attacks are uncommon and so they aren't profitable to
Speaker 2: defend against them.
Speaker 1: Uncommon, but they sound devastating.
Speaker 2: They're devastating when they happen, absolutely but compared to the
Speaker 2: sheer volume of ransomware attacks or data breaches affecting millions
Speaker 2: of consumers or businesses, these highly targeted bespoke attacks on
Speaker 2: industrial systems are statistically rare. They don't fit neatly into
Speaker 2: the traditional cybersecurity playbooks or crucially, the venture capital funding
Speaker 2: models that drive so much of the industry.
Speaker 1: So vcs aren't interested.
Speaker 2: Venture capital looks for scalable solutions, products you can sell
Speaker 2: to thousands or millions of customers. Defending a specific type
Speaker 2: of power plant control system in one country. It just
Speaker 2: doesn't offer the same potential return on investment as say,
Speaker 2: the next big anti malware suite. It's a niche market,
Speaker 2: relatively speaking, And this.
Speaker 1: Kind of links back to that broader systemic issue we
Speaker 1: touched on earlier, doesn't it The idea that the software industry,
Speaker 1: especially the world's largest and most valuable tech companies, has
Speaker 1: largely made all this possible because it has operated essentially
Speaker 1: free from liability for defects or security flaws for something
Speaker 1: like forty years.
Speaker 2: That's a huge point the author Hammer's home. It's presented
Speaker 2: as a classic market for Lemons situation.
Speaker 1: The economics concept. We're sellers no more than buyers.
Speaker 2: Exactly sellers in this case. Software companies know about potential
Speaker 2: defects or vulnerabilities in their products, but they often don't
Speaker 2: disclose them fully, or they disclaim responsibility. You see this
Speaker 2: everywhere and end user license agreements elas, those things nobody
Speaker 2: reads before clicking agree too, we all are. They're full
Speaker 2: of as is disclaimers, language like you bear the entire
Speaker 2: risk of using it, and the limitations of liability are
Speaker 2: often incredibly severe. Crowdstrikes clauses are cited again, limiting damages
Speaker 2: for things like lost profits or lost data even if
Speaker 2: their product fails.
Speaker 1: So even if the software crashes your whole business, tough luck.
Speaker 2: Pretty much. These are essentially contracts of adhesion for almost
Speaker 2: all users. Individuals, small businesses, even large corporations often have
Speaker 2: little room to negotiate. The message is clear. If you
Speaker 2: don't like the terms, don't use the software, but often
Speaker 2: you don't have a realistic alternative.
Speaker 1: What's truly shocking to me reading this section is the
Speaker 1: stark absence of independent testing for cybersecurity products. I mean,
Speaker 1: we have consumer reports for cars or appliances, right, why
Speaker 1: not for the software protect our most vital data and systems.
Speaker 2: It's a glaring gap. The AUTHO points to the Anti
Speaker 2: Malware Testing Standards Organization or AMTSO.
Speaker 1: Okay, sounds like it should be doing.
Speaker 2: That testing, you'd think so. But AMTSO is composed almost
Speaker 2: entirely of the cybersecurity companies themselves.
Speaker 1: Wait, the companies are testing their own products or each other's.
Speaker 2: Effectively, yes, it creates a massive conflict of interest. It
Speaker 2: fails to meet the basic balance of interest requirements needed
Speaker 2: for a credible independent standards organization. It's essentially the industry
Speaker 2: grading its own homework, which, as you can imagine, doesn't
Speaker 2: inspire a whole lot of confidence in the results.
Speaker 1: No kidding, So it sounds pretty bleak. Is anyone trying
Speaker 1: to fix this accountability gap?
Speaker 2: Well, there is what the author calls a nascent effort,
Speaker 2: a beginning to try and bring some accountability to the
Speaker 2: software world. CIEs director Jen Easterly in the US has
Speaker 2: been vocal about principles for a new model, things like
Speaker 2: putting the burden of safety squarely on the manufacturers, demanding
Speaker 2: radical trans parency about flaws, enforcing real accountability, and pushing
Speaker 2: for products to be secure by design and secure by
Speaker 2: default from the outset.
Speaker 1: Okay, those sound like good principles. Are they being implemented?
Speaker 2: That's the challenge. We're also seeing legislative efforts. The European
Speaker 2: Union has its Cyber Resilience Act, which aims to tackle
Speaker 2: inadequate cybersecurity through regulation, and the US National Cybersecurity Strategy
Speaker 2: from March twenty twenty three explicitly calls for shifting liability
Speaker 2: for software products and services onto the vendors.
Speaker 1: So we have these ideas, these proposed solutions from government,
Speaker 1: but what are the biggest hurdles to actually making them happen? Because,
Speaker 1: as the book notes, relying on voluntary compliance from the
Speaker 1: industry hasn't worked in twenty five years.
Speaker 2: Right, Voluntary measures just haven't cut.
Speaker 1: It, and market forces, like maybe some states trying to
Speaker 1: impose liability and contracts. New Jersey is mentioned trying to
Speaker 1: impose two hundred percent liability on vendors for breaches in
Speaker 1: state contracts. Those seem limited in scope.
Speaker 2: They are they only affect specific contracts, not the whole market.
Speaker 1: So it really seems like forced change through regulation is
Speaker 1: what's needed. But why aren't we seeing that happen faster?
Speaker 1: What's the hold up?
Speaker 2: Well, it really comes down to political will versus the
Speaker 2: immense lobbying power of the tech industry. These are incredibly
Speaker 2: profitable companies that, understandably from their perspective, resist regulations that
Speaker 2: could increase their costs or expose them to significant liability.
Speaker 1: So the usual DC gridlock and.
Speaker 2: Influence pretty much and the author offers a rather sobering
Speaker 2: prediction here. He suggests that it might take a truly
Speaker 2: catastrophic failure, most likely involved in the use of AI,
Speaker 2: to actually galvanize Congress into taking decisive regulatory action.
Speaker 1: A catastrophe involving AI. That's not exactly reassuring.
Speaker 2: No, it reflects a pattern, sadly, where we often seem
Speaker 2: to wait for disaster before we implement meaningful preventative measures.
Speaker 2: We react rather than anticipate.
Speaker 1: Which brings us inevitably to the cutting edge artificial intelligence AI.
Speaker 1: And this technology, even from its earliest conceptual days, carry
Speaker 1: it a stark warning. John von Neumann, one of the
Speaker 1: pioneers of computing, cautioned way back then that we were
Speaker 1: potentially creating a monster whose existence is going to change history.
Speaker 1: And then he added, provided there is any history left.
Speaker 2: That's a pretty heavy thought to kick off our discussion
Speaker 2: on AI, wouldn't you say? It?
Speaker 1: Absolutely is heavy and maybe prescient. And to navigate this
Speaker 1: incredibly complex topic, it's probably helpful to clarify some essential
Speaker 1: AI terminology. First, as laid out.
Speaker 2: In the source good idea, let's get the basic straight.
Speaker 1: Okay. First, generative AI. This is what most people think
Speaker 1: of now, things like chatch EPT or image generators like Bailey.
Speaker 1: The author describes it somewhat dismissively, perhaps as a stochastic parrot,
Speaker 1: meaning it generates new content based on patterns in its
Speaker 1: vast training data, but without any reference to meaning or
Speaker 1: real understanding.
Speaker 2: Okay, stochastic parrot, got it. Second, the neural network. This
Speaker 2: is basically the brain of the AI, a complex structure
Speaker 2: of layers and nodes controlled by algorithms inspired by biological brains,
Speaker 2: but working very differently. Right. Third, narrow AI or NAI.
Speaker 2: This is AI designed for very specific functions, playing chess,
Speaker 2: brilliantly optimizing airline prices, detecting spam. Most AI we use
Speaker 2: today is narrow AI. Fourth, a foundation model. This is
Speaker 2: a more recent, powerful concept. It's a large model trained
Speaker 2: on incredibly broad data sets, which can then be adapted
Speaker 2: or fine tuned from many different tasks. Think Chat, TWPD four,
Speaker 2: Google's Gemini, and thropicsquaud. These are foundation.
Speaker 1: Model big versatile ones exactly.
Speaker 2: Fifth frontier AI. This is a somewhat fuzzy term often
Speaker 2: used by policymakers and the industry. It generally refers to
Speaker 2: highly capable foundation models that could possess dangerous capabilities, often
Speaker 2: hinting at abilities approaching or exceeding human levels in certain areas,
Speaker 2: and often linked to the idea of AGI AGI.
Speaker 1: That's a big one, right right.
Speaker 2: And finally, AGI, which stands for artificial general intelligence sometimes
Speaker 2: we use interchangeably with superintelligence. This refers to the hypothetical
Speaker 2: future AI with human level or vastly superior cognitive abilities
Speaker 2: across the board, self aware, self preserving, and potentially capable
Speaker 2: of recursively self improving at an exponential rate. Like seed
Speaker 2: AI that can build better versions of itself.
Speaker 1: That sounds like sci fi. Is it even feasible?
Speaker 2: Well, that's a key point. Scientists still disagree profoundly on
Speaker 2: its technical feasibility and there's currently no clear roadmap for
Speaker 2: actually achieving it. It remains largely speculative, though highly debated.
Speaker 1: Okay, so thanks for that breakdown. Let's focus first on
Speaker 1: the present and tangible risks of AI. The stuff happening
Speaker 1: right here, right now or very near term. Not the
Speaker 1: potential robot uprising, but what's already causing problems or has
Speaker 1: the clear potential to very soon.
Speaker 2: Good place to start. In cybersecurity itself, AI presents immediate threats.
Speaker 2: There's something called indirect prompt injection. This is a type
Speaker 2: of attack where attackers can sneak malicious instructions into data
Speaker 2: that an AI later process is manipulating it to produce
Speaker 2: harmful outputs or leak sensitive information. The source states there's
Speaker 2: no no mitigation for some forms of.
Speaker 1: This yet no known fix.
Speaker 2: That's concerning very Then there's automated vulnerability exploitation. Studies cited
Speaker 2: show that AI agents like ones based on CHATSHPT four
Speaker 2: can autonomously hack into real world computer systems. They can
Speaker 2: analyze vulnerability or reports cvees and automatically develop and execute
Speaker 2: the code needed to exploit them, apparently succeeding against a
Speaker 2: high percentage of known high or critical flaws.
Speaker 1: So AI can find and exploit weaknesses on its own.
Speaker 2: Now it appears so and beyond that, AI is already
Speaker 2: being used more broadly by attackers to right malware more efficiently,
Speaker 2: compose much more believable spear phishing emails, power sophisticated human
Speaker 2: like bots for scams or influence operations, and even run
Speaker 2: simulations to test network attack strategies before launching them.
Speaker 1: Okay, those are direct cyber threats. What about other areas well?
Speaker 2: There's automated decision making. The dangers of using AI in
Speaker 2: sensitive areas like the criminal justice system or healthcare are
Speaker 2: becoming increasingly apparent. The core issue is hidden biases beaked
Speaker 2: into the massive data sets used to train these AI models,
Speaker 2: and often this training data isn't public or open for scrutiny.
Speaker 1: So the AI can perpetuate or even amplify existing societal
Speaker 1: biases exactly.
Speaker 2: The author notes the nightmare scenario we already see with
Speaker 2: buggy ehr is causing patient harm, and suggests this could
Speaker 2: get much worse with biased AI in healthcare. He even
Speaker 2: speculates about a future need for the six of Amendment right,
Speaker 2: the right to confront your accuser to include the right
Speaker 2: to confront witnesses.
Speaker 1: Or algorithm confront the algorithm wow. And in war fighting.
Speaker 2: Big impacts there too. First, disinformation or cognitive warfare gets supercharged.
Speaker 2: AI generated dfakes using text, audio, and video are becoming
Speaker 2: so realistic that it's now virtually impossible for the average
Speaker 2: person to tell a fake from the real thing, and
Speaker 2: AI enabled to take accounts are starting to replace human
Speaker 2: runtrol farms for spreading propaganda, making it cheaper and more scalable, so.
Speaker 1: More convincing fakes spread more easily.
Speaker 2: Right, and then there are AI guided drone swarms. These
Speaker 2: are described as potentially game changing lethal weapons platforms. Imagine
Speaker 2: dozens or hundreds of small drones equipped with facial or
Speaker 2: even gait recognition, carrying explosives, coordinating autonomously defined and attack
Speaker 2: targets the sources they could be close to impossible to
Speaker 2: defend against using current methods.
Speaker 1: Are these really it?
Speaker 2: Systems like Elbit Systems, Legion x A Reportal being used
Speaker 2: by the Israeli defense forces, the US, China, and Russia,
Speaker 2: which is used non AI swarms, are all actively developing
Speaker 2: this kind of technology. It's not science fiction, It's on
Speaker 2: the immediate horizon or already here in early forms.
Speaker 1: It's interesting, though, isn't it, How much of the public
Speaker 1: conversation and maybe even the funding seems focused on those
Speaker 1: more theoretical, existential even sci fi like AI risks, the
Speaker 1: AGI the superintelligence, when as the author points out, there
Speaker 1: are these tangible right now dangers like mass surveillance, bias
Speaker 1: decision making, or energy consumption that maybe aren't getting the
Speaker 1: same attention. What do you make of that apparent prioritation
Speaker 1: or maybe misprioritization of where the resources and attention are going.
Speaker 2: It's a really valid concern, and the book deals into
Speaker 2: this quite critically. Much of the high profile AI safety
Speaker 2: debate is driven by these speculative future risks. You have
Speaker 2: Nick Bostrom's famous paper clip maximizer thought experiment. An AI
Speaker 2: designed simply to maximize paper clip production might logically decide
Speaker 2: to eliminate humans to convert our atoms into more paper clips,
Speaker 2: fulfilling its goal in a perverse way, right.
Speaker 1: The unintended consequences idea exactly.
Speaker 2: Then there's Stuart russell self preservation scenario, sometimes called the
Speaker 2: fetch the coffee problem. An advanced AI, given the simple
Speaker 2: task like setching coffee might realize that being shut down
Speaker 2: would prevent it from completing the task, so it might
Speaker 2: take steps to prevent being shut off, even if those
Speaker 2: steps harm humans, its core goal conflicts with our safety.
Speaker 2: You also have the concept of the treacherous turn. This
Speaker 2: is where an AI might pretend to align with human
Speaker 2: values during its training phase when it's being monitored, only
Speaker 2: to pursue its own hidden goals once it's deployed or
Speaker 2: becomes powerful enough that monitoring is ineffective deceptive AI essentially,
Speaker 2: and finally, the sharp left turn. This refers to the
Speaker 2: possibility of a sudden, rapid and unpredictable jump in an
Speaker 2: AI's capabilities, maybe during self improvement, rendering all previous safety
Speaker 2: measures or alignment techniques instantly obsolete because its nature has
Speaker 2: fundamentally changed.
Speaker 1: Okay, those are some worrying scenarios.
Speaker 2: They are, and this focus on what the author terms
Speaker 2: the zero probability high impact risk model. These potentially civilization
Speaker 2: ending but maybe incredibly unlikely events has driven huge funding
Speaker 2: over half a billion dollars cided into AI safety research,
Speaker 2: particularly from the effective altruism movement.
Speaker 1: But the argument is this distracts from current problems.
Speaker 2: Yes, the author argues strongly that this intense focus on
Speaker 2: theoretical and highly unlikely outcomes like rogue superintelligent machines taking
Speaker 2: over it diverts crucial resources, attention, and talent away from
Speaker 2: the dangerous problems that exist today, things like the very
Speaker 2: real thread of AI powered mass surveillance, the enormous energy
Speaker 2: drain of training and running these large models, the potential
Speaker 2: for widespread job displacement due to automation, and the amplification
Speaker 2: of bias and disinformation. We just discussed. It's a fundamental
Speaker 2: debate about where we should focus our limited resources on
Speaker 2: preventing potential future apocalypses or mitigating the harms happening right now.
Speaker 1: And if AI is at its core fundamentally just very
Speaker 1: complex software, as we established earlier, what are the challenges
Speaker 1: of actually regulating it? Are we just doomed to repeat
Speaker 1: the mistakes of the past forty years, where the software
Speaker 1: industry largely operated without meaningful liability.
Speaker 2: That's precisely the fear expressed in the book. Since AI
Speaker 2: is software, the prediction is that companies developing it will
Speaker 2: lobby intensely to regulate its use rather than its engineering.
Speaker 1: What's the difference there?
Speaker 2: Regulating use means putting rules on how people or companies
Speaker 2: deploy AI. Don't use it for discriminate to hiring, don't
Speaker 2: use it for autonomous weapons without human oversight, etc. Regulating
Speaker 2: engineering would mean putting rules on how the AI itself
Speaker 2: is built, requirements for transparency, security, safety testing, maybe mandating
Speaker 2: certain programming languages or architectures.
Speaker 1: And companies prefer regulating use.
Speaker 2: Generally yes, because it shifts the burden and liability away
Speaker 2: from them the developers, onto the users who deploy the AI.
Speaker 2: It echoes the whole history of software liability we discussed,
Speaker 2: and we're already seeing the failure of voluntary compliance efforts
Speaker 2: in AI safety. The Bletchley Park AI Safety Summit is
Speaker 2: cited where initially only one company agreed to share its
Speaker 2: frontier models for indebedd safety testing. Only one initially yes,
Speaker 2: and then there was the whole drama with the open
Speaker 2: AYE board firing and then quickly rehiring CEO Sam Altman,
Speaker 2: largely centered around debates over the pace of development versus
Speaker 2: safety concerns. The outcomes seem to underscore a fundamental reality
Speaker 2: for many commercial AI labs, profit Trump's safety. When push
Speaker 2: comes to shove so.
Speaker 1: What would effective regular look like? According to the source, Ultimately.
Speaker 2: The argument is that effective regulation must include specific security
Speaker 2: requirements for building AI, things like mandating the use of
Speaker 2: memory safe programming languages to reduce vulnerabilities, and critically, it
Speaker 2: must involve finally, shifting liability for damages caused by AI
Speaker 2: failures onto the developers of the foundational models themselves.
Speaker 1: Making the creators responsible.
Speaker 2: Exactly Without that fundamental shift in liability, we're likely just
Speaker 2: to see the same market for lemons dynamic play out
Speaker 2: all over again with AI, but this time with potentially
Speaker 2: far far greater consequences for society.
Speaker 1: It really is a sobering reality for you listening. We
Speaker 1: are almost entirely dependent, increasingly so, upon devices and systems
Speaker 1: that fundamentally cannot be made perfectly safe. Our deep dive
Speaker 1: today has really spanned a complex, interconnected landscape, hasn't it.
Speaker 1: From the inherent baked in insecurity of the software that
Speaker 1: underpins our entire modern world, to the often perverse profit
Speaker 1: driven nature of the CyberSecure industry trying to patch it,
Speaker 1: the profound, maybe insurmountable complexities of figuring out who actually
Speaker 1: launches cyber attacks, the blurring lines of modern conflict where
Speaker 1: digital and physical violence are unmashed, the terrifying reality of
Speaker 1: cyber attacks causing kinetic real world destruction, and now the profound,
Speaker 1: accelerating and frankly quite frightening risks being introduced by artificial intelligence.
Speaker 2: It's a lot to take in. So what can you,
Speaker 2: as an individual actually do in the face of all this?
Speaker 2: If you overwhelming the AUTHO offers a pretty concrete three
Speaker 2: step plan focused on personal safety and resilience.
Speaker 1: It's quite practical, okay, let's hear it. Step one.
Speaker 2: Step one is reduce your attack surface, basically, make yourself
Speaker 2: a smaller, harder target. Suggestions include switching from Windows, which
Speaker 2: is the most targeted operating system, to Macorus or Linux
Speaker 2: if possible, as they tend to be less vulnerable. Overall,
Speaker 2: go through your phone into lead apps you don't actually use.
Speaker 2: Each app is a potential entry point. Critically, turn off
Speaker 2: location services on your phone by default, only turn them
Speaker 2: on specifically when you need them for navigation or a
Speaker 2: particular app, then turn them off again.
Speaker 1: That's a big one for privacy, too huge.
Speaker 2: Also, make sure your home Wi Fi router isn't using
Speaker 2: the default password and that it has a strong, unique password,
Speaker 2: use a reputable password manager for all your accounts. Don't
Speaker 2: reuse passwords.
Speaker 1: Okay, reduce the surface area makes sense.
Speaker 2: Step two, Step two create redundancies for your critical systems.
Speaker 2: This draws on the old military adage two is one
Speaker 2: and one is none, meaning don't rely on a single
Speaker 2: point of failure for things essential to your survival or
Speaker 2: well being. This applies to personal preparedness for basic needs
Speaker 2: power backup generator, solar, water storage, purification, food, emergency supplies,
Speaker 2: and communications radio satellite phone.
Speaker 1: Thinking about resilience if the grid goes down basic exactly.
Speaker 2: The author even suggests considering moving to more rural areas
Speaker 2: for greater self sufficiency potential, and points to resources on
Speaker 2: home setting skills. It's about building backup plans right.
Speaker 1: And the final step, step three, diversify your risks. This
Speaker 1: is similar to financial advice right, don't put all your
Speaker 1: eggs in one basket. Practically, this means things like keeping
Speaker 1: some emergency cash on hand, maybe in multiple secure locations,
Speaker 1: not relying solely on digital banking or payment systems that
Speaker 1: could fail. And critically, the author emphasizes creating neighborhood watches
Speaker 1: or community groups focused on shared resources and mutual support
Speaker 1: during emergencies, because, as he puts it, individuals don't survive
Speaker 1: long in chaotic environments. You need to be part of
Speaker 1: a group. Community resilience is key.
Speaker 2: Reduce your surface, create redundancies, diversify risks, and build community
Speaker 2: that's actionable, you know. Reflecting on all this, the author notes,
Speaker 2: we are not good at getting ahead of disaster or
Speaker 2: moving left of boom, as they say in the military,
Speaker 2: acting before the crisis hits. It does seem we often
Speaker 2: wait for that catastrophic event to finally galvanize us into
Speaker 2: serious action. So final thought for you to ponder, what
Speaker 2: might that catastrophic event look like in this cyber physical
Speaker 2: AI driven future, and more importantly, how might you prepare
Speaker 2: for it or even contribute in your own way to
Speaker 2: preventing it