Speaker 1: These are like SAPs that like thirty people in the
Speaker 1: entire world are revoluntary all.
Speaker 2: Special acts, you know, all the work that we did.
Speaker 2: We're special access programs. So not just only you're in
Speaker 2: a skiff, not just your top secret. But they are
Speaker 2: so limited. I mean we sometimes like if anybody's done
Speaker 2: the research on what an ODA is or an a
Speaker 2: team in the special forces world, you're talking twelve sometimes
Speaker 2: you know, twelve person teams that subdivide into six person teams.
Speaker 2: I was on programs where sometimes it was six people.
Speaker 3: Mm hmm.
Speaker 4: If you sleepot at night, you know just how disruptive
Speaker 4: it can be, whether you're having trouble falling asleep, you're
Speaker 4: waking up sweating in the middle of the night, or
Speaker 4: all the above. That's where ghost Sped could help. As
Speaker 4: the makers are the coolest beds in the world. Ghostbed
Speaker 4: is your go to for cooling mattresses, cooling pillows, and
Speaker 4: even cooling betting. From their sendatuor ghost Ice fabric to
Speaker 4: patent technology that adjusts with your body temperature, Every ghost
Speaker 4: Sped mattress is designed with cooling in mind. So whether
Speaker 4: you want a plush your mattress that cushions your shoulders
Speaker 4: and hips, or a firmer option with except support. Your
Speaker 4: ghostbed will keep you cool and comfortable all night long.
Speaker 4: When you purchase a ghost Bed mattress, your comfort is guaranteed.
Speaker 4: You can try out your mattress for a one hundred
Speaker 4: and one night's risk free and make sure it's the
Speaker 4: right fit for you. Plus, they offer free shipping and
Speaker 4: most items ship within twenty four hours. If you're not
Speaker 4: sure which ghost Bed is for you, check out their
Speaker 4: mattress quiz. You'll answer a few questions and get your
Speaker 4: personalized recommendation, or reach out to their friendly team of
Speaker 4: sleep experts for all the help you need. Even better,
Speaker 4: Teamhouse listeners can get fifty percent off site wide for
Speaker 4: a limited time. Just visit ghostbed dot com slash house
Speaker 4: and use code house at checkout. Again, that's ghostbed dot
Speaker 4: com slash house with code House at checkout to say
Speaker 4: a whopping fifty percent off site wide. And if you're
Speaker 4: not in the market for a mattress, check out their pillows.
Speaker 4: They're betting they have all kinds of great stuff there.
Speaker 4: So thanks to ghost Bed and check them out.
Speaker 5: Special Operation Cobert Asdi and.
Speaker 4: The Team House with your hopes Jack Murphy and David Park.
Speaker 1: Hi everyone, Welcome to episode three and twenty nine of
Speaker 1: The Team House. I'm Jack Murphy here with David Park
Speaker 1: and our guest on tonight's show is Kyle Hanslovan. Kyle
Speaker 1: served in the military with the National Security Agency and
Speaker 1: now he works in the cybersecurity realm with Huntress. We're
Speaker 1: really excited to have him on the show. As I
Speaker 1: was telling him beforehand, You're somebody who's been on our
Speaker 1: list for like four or five years, so we're really
Speaker 1: happy to finally have you here.
Speaker 3: Absolutely stoked to be here.
Speaker 2: It's one of those funny things, right of how long
Speaker 2: sometimes it just takes for good things to go down.
Speaker 1: It's totally my fault, you know, just sitting on it
Speaker 1: not not doing anything about it.
Speaker 6: But so, Kyle, let's start off at the beginning.
Speaker 1: I think tell us a little bit about how you
Speaker 1: grew up and what took you towards military service initially.
Speaker 2: Got you well, I'll try not to like cut onions
Speaker 2: or anything, but definitely grew up on the poor side
Speaker 2: of life, right, so think of like single mom. I
Speaker 2: never hungry, poor, but like we always lived with whoever
Speaker 2: mom was dating at the moment, you know, that type
Speaker 2: of situation, and you know, so I got to go
Speaker 2: bounce between Oregon, which was kind of great for outdoors life,
Speaker 2: and I eventually moved to Florida, so.
Speaker 3: It was good.
Speaker 2: But come seventeen, it was enlistment time. I kind of
Speaker 2: skipped college. I did really well in high school, but
Speaker 2: it was a little bit of like a you know,
Speaker 2: computer thug, I guess at that time, and it was
Speaker 2: one of those things that never had a brush in
Speaker 2: with the law, but it was pretty clear that if
Speaker 2: I stayed at.
Speaker 3: Home, I was probably going to get in trouble.
Speaker 1: So yeah, joined up because you had an early interest
Speaker 1: in computers from the get go, and we're doing some
Speaker 1: things that were a little shady.
Speaker 2: I was a super nerd, right, So it wasn't cool
Speaker 2: back then like now, like my kid's kind of like Marvel,
Speaker 2: Like my dad's a hacker.
Speaker 3: That was not cool in the late nineties.
Speaker 2: But yeah, a lot of aol, a lot of I
Speaker 2: mean when you're poor, like I hacked myself to free
Speaker 2: internet probably most of my childhood, all the way through
Speaker 2: probably like the very early two thousands. So yeah, a
Speaker 2: lot of unscru unscrupulous, but maybe not quite you know,
Speaker 2: jail time worthy offenses.
Speaker 4: Yeah, so late you said late nineties or late nineties
Speaker 4: is around that time, like what was.
Speaker 3: Your probably ninety seven all the way to probably two
Speaker 3: thousand and three.
Speaker 4: What was your first computer or what was the first
Speaker 4: computer you had access to, whether it was a public
Speaker 4: computer or whatever.
Speaker 2: Yeah, a lot of public computer. I remember I built
Speaker 2: like a broke down commodore once. That kind of got
Speaker 2: me in, taught me a lot of the basics. So
Speaker 2: I'm in this like weird generation for the geeks out
Speaker 2: there from like I can go as old school as
Speaker 2: like seventies style tech, very analog, all that old school programming, yeah,
Speaker 2: all the way to the most modern like technical stuff.
Speaker 2: So I'm kind of like this tweener, right, late millennial
Speaker 2: aged kind of just like this.
Speaker 3: Bourbon right yeah, like and bourbon.
Speaker 5: Yeah, yeah that is you know that is.
Speaker 4: Because it's it's it's post like common R sixty four
Speaker 4: BB the bbs right all the like that.
Speaker 5: It's yeah.
Speaker 2: Yeah, I had probably the bulletin board days, but immediately
Speaker 2: went to I R C and then it became AOL
Speaker 2: and a lot of those like it's just really lucky,
Speaker 2: you know, it's because I was so poor.
Speaker 3: I got to do the old stuff because that's all
Speaker 3: I could afford.
Speaker 5: Yeah, and then.
Speaker 2: Obviously the world kind of changed when like dial up,
Speaker 2: cable modems and then everything became available.
Speaker 5: So yeah, it was a good time.
Speaker 4: And was there like there was an online community.
Speaker 5: I'm sure that.
Speaker 4: Did you know other people in person that were like you?
Speaker 2: Not so much in person, right, everybody like back in
Speaker 2: those days, I r C kind is like a modern
Speaker 2: day chat group, right, a slack a discord server. Yeah,
Speaker 2: and so I spent most of my time back there
Speaker 2: like reverse engineering software, you know, getting around like the
Speaker 2: activation codes, getting around, you know, kind of piracy type things.
Speaker 5: Yeah.
Speaker 3: Also allegen.
Speaker 2: I mean, I think what's nice is when I joined
Speaker 2: the military the polygraph, they said you got to answer
Speaker 2: all the questions, but only go to your eighteenth birthday.
Speaker 2: And I was seventeen, So it made the polygraph really easy.
Speaker 5: That's funny.
Speaker 1: SOH time to enlist before he get into too much trouble.
Speaker 6: What branch did you join? MS?
Speaker 5: Where did you go?
Speaker 2: Yeah? So even though I was Navy junior ROTC and
Speaker 2: I had a ride to Annapolis, there was no way
Speaker 2: I was going to make it like I graduated really
Speaker 2: early out of high school and you had to be
Speaker 2: you roughly, you know, seventeen and a half or so
Speaker 2: by the time my birthday fell for me to be
Speaker 2: able to start the year.
Speaker 3: And so I changed and I went.
Speaker 2: I got an uncle that was in the Marines, and
Speaker 2: he said, look, Kyle, you're too damn soft for any
Speaker 2: other service.
Speaker 3: You need to go there.
Speaker 6: And I did.
Speaker 3: I scored good on the ASBAB, so I got guaranteed.
Speaker 2: At the time, I think they it was communication systems.
Speaker 2: I COX one was my first AFSC in the you know,
Speaker 2: in the Air Force.
Speaker 4: So in the late nineties, uh was communications systems? Was
Speaker 4: that still just was it just radio tech? Was it
Speaker 4: like setting up communication packages and stuff like that?
Speaker 3: So I had both. I had both the analog side
Speaker 3: of the house.
Speaker 2: So I actually got to do like combat com and
Speaker 2: do some more of the like proper encrypted radio, a
Speaker 2: lot of point to point systems. But I also got
Speaker 2: to do it. And so there was job was like
Speaker 2: regular base comm. So think about maintaining the email servers.
Speaker 2: I had to do a BlackBerry server, Like I don't
Speaker 2: even know those things, you know, I'm sure they don't exist.
Speaker 3: Anymore. But it was a good time.
Speaker 2: And like I said, my first duty station was all
Speaker 2: regular just comms.
Speaker 5: Yeah.
Speaker 4: No, that's fascinating because you know where cyber is a
Speaker 4: career field now. Back then, you know, it was like
Speaker 4: it the military needed it, but didn't.
Speaker 5: Really have that. Yeah.
Speaker 2: When you said cyber back in like the early two thousands,
Speaker 2: that meant like something dirty.
Speaker 3: Or doing in that chain right room. It dely didn't
Speaker 3: mean what it means that.
Speaker 4: Yeah, I mean for me, it's still me is the
Speaker 4: dirty stuff and chatman is it?
Speaker 3: Yeah? Yeah, old have his diehard right yeah.
Speaker 4: Yeah, yeah yeah cyber yeah yeah exactly.
Speaker 1: So how is how is the Air Force treating you
Speaker 1: at that point? I mean sounds like you're probably enjoying it.
Speaker 2: Yeah, you could imagine, like being seventeen, I did real
Speaker 2: well in like basics, since I had already done like
Speaker 2: years of ROTC or junior ROTC, and so that part
Speaker 2: was kind of a breeze. And what was really lucky
Speaker 2: is that this was right at the cusp that you know,
Speaker 2: people were already doing offensive cyber operations. They weren't calling
Speaker 2: it that. It was called a lot of like you know,
Speaker 2: info security. There was information operations, but really nobody knew
Speaker 2: what that meant. And it kind of gave me the
Speaker 2: benefit of because my rank was enlisted and I had
Speaker 2: a lot of technical potential. It kind of had a
Speaker 2: lot of parallels where nobody really held you down because
Speaker 2: of your rank. It was your ability to execute kind
Speaker 2: of was like where they would cap you.
Speaker 3: So for me, that first duty station was in A.
Speaker 3: I actually did in A two.
Speaker 2: Tours in England and that was just great because it
Speaker 2: opened up my whole life from moving from just basic
Speaker 2: security and that's what I started getting to work with
Speaker 2: GHQ and NSA.
Speaker 3: So it was like really good timing.
Speaker 4: And and you know, for like NSA was like singing
Speaker 4: like that was their and they start, but but that
Speaker 4: was their bread. You know, everybody's sitting there wearing their cans.
Speaker 4: Was the NSA sort of on the cutting edge of
Speaker 4: what was going on in you know, in this kind
Speaker 4: of cyber space or were they trying to catch up
Speaker 4: with kids reading twenty six hundred every month?
Speaker 2: Yeah, So General Hayden at the time, running you know,
Speaker 2: as the UH director of NSA was definitely on the
Speaker 2: cutting edge of realizing that like these basic things that
Speaker 2: we were already you know, listening in on just about anything, right,
Speaker 2: is it a cable, is it you know, overhead anything
Speaker 2: along those lines. We really started realizing there was this
Speaker 2: whole new domain that if we couldn't master it quick,
Speaker 2: somebody else was, especially like nation state adversaries. So early
Speaker 2: two thousands, all of a sudden blossomed even though nobody
Speaker 2: knew what these names were, right, they were trying to
Speaker 2: figure out, like, how do we stand up organizations that
Speaker 2: aren't really because at that time my MOS was a
Speaker 2: three series, right, it wasn't a one, it wasn't an
Speaker 2: operator AFSC, and it kind of mimics you know, MOSS
Speaker 2: and other ratings where we were looked at as support
Speaker 2: and so you can imagine there was a lot of
Speaker 2: folks on the outside that actually had substantially better skills.
Speaker 2: On the inside, however, there was pockets always from the beginning,
Speaker 2: like Navy postgraduate school, they have always had amazing offensive
Speaker 2: cybersecurity talent, and they kind of had both like that
Speaker 2: twenty six hundred early hacking vibe. Yeah, but definitely with
Speaker 2: the government, you know, espionage flair.
Speaker 3: So it's pretty cool.
Speaker 4: It's fascinating, was how did these commands overall command as
Speaker 4: because hacker at the time was a bad word, right,
Speaker 4: and so.
Speaker 2: I wouldn't call myself a hacker, but people kind of
Speaker 2: like shame. There was no concept of ethical hacker.
Speaker 3: It's just like, oh, you know.
Speaker 2: Immediately it's like, you know, some skinny dude in his
Speaker 2: basement and with a hacker hoodie. Right, that's what it invokes.
Speaker 2: It doesn't invoke military at all.
Speaker 4: Right, Right, So like, how would you know this is
Speaker 4: a new technology, this new space that you know, a
Speaker 4: bunch of old fuddies don't understand.
Speaker 5: You know, we're going to drop bombs or we're gonna.
Speaker 4: You know, you know, send tanks and and how are
Speaker 4: you guys selling this?
Speaker 5: There is a new domain that needs to.
Speaker 2: Yeah, you could you could imagine the human world has
Speaker 2: been vibrants since humans were humans, right, just try to
Speaker 2: be able to gather and all of a sudden this
Speaker 2: world that de risks. Wait, you could gather intelligence from
Speaker 2: somebody completely remote. And remember we've always been doing you know,
Speaker 2: whether it's radio, just good old bash and RF. So
Speaker 2: there was a lot of these parallel analogies that from
Speaker 2: my interpretation, is a very young airman. I don't think
Speaker 2: I appreciated how many of those parallels that some of
Speaker 2: these real early you know early sorry, late nineties, early
Speaker 2: two thousand's officers that at that time the military, right,
Speaker 2: if you think about the Air Force, they were run
Speaker 2: by pilots.
Speaker 3: The Navy admirals.
Speaker 2: Were commanding you know, a fleet, right, and of course
Speaker 2: you know instead of regular legs, there are stuff like that.
Speaker 2: In the army, you actually had folks that might have
Speaker 2: been tank commanders also now thrust into this brand new domain.
Speaker 2: And I just totally missed how far ahead some of
Speaker 2: these people were. But I'm on to bet that, like
Speaker 2: finances came into it, do a really expensive human operation
Speaker 2: doing all this crazy stuff, or put some geeks in
Speaker 2: the basement with some shady software and get it a
Speaker 2: lot cheaper at low risk. That had to be part
Speaker 2: of it. I don't know for certain, but it had
Speaker 2: to play it into it.
Speaker 4: Yeah, yeah that co read mountain and co or like
Speaker 4: mountain dew and pizza or yeah, to get the job done.
Speaker 2: Or sure definitely was that I was the skinny nerd
Speaker 2: that give me pizza get that code.
Speaker 5: Yeah that's funny.
Speaker 1: So it sounds like you started off your military career
Speaker 1: more unlike the IT side, but then you got exposed
Speaker 1: to some of these other career fields. What was that
Speaker 1: sort of like as you you know, progressed in your
Speaker 1: Air Force career.
Speaker 3: Yeah, my first pivot was not straight into cyber writing
Speaker 3: software for espionage.
Speaker 2: It was actually a mission security. So think about gathering
Speaker 2: like signals that would you know, leak from those big
Speaker 2: old monitors, right, they would ride over top of cables.
Speaker 2: That type of stuff was a real big threat, right,
Speaker 2: especially when we had, for instance, like embassies in other countries.
Speaker 2: So I got exposed to that. I got to do
Speaker 2: a lot of that work and a lot of stuff
Speaker 2: that was overhead related too, right, think of like satellite things.
Speaker 3: But it wasn't really for me.
Speaker 2: The real cyber side of my career didn't really take
Speaker 2: off till probably two thousand and eight, two thousand and nine,
Speaker 2: I happened.
Speaker 3: To be deployed when you know that it's now very.
Speaker 2: Much publicly talked about the Buckshot Yankee incident, and I
Speaker 2: happened to be in theater. I was attached to third Group,
Speaker 2: being just support. You know, I'm the furthest thing from
Speaker 2: an operator, But it was just kind of a wild
Speaker 2: time where all of a sudden, these whole worlds collide
Speaker 2: of very physical everybody's in the AOAR and the area
Speaker 2: responsibility and now all of a sudden cybers being used
Speaker 2: to gather intelligence on like some of our highest, you know,
Speaker 2: sensitive assets.
Speaker 1: Was a wild shot Yankee for the squares out there
Speaker 1: like myself.
Speaker 2: Yeah, so if you go read Wikipedia, well we'll use
Speaker 2: that as our official source.
Speaker 3: The inside scoop.
Speaker 2: Buckshot Yankee is acclaimed Nation State actor developed some software
Speaker 2: that rumor had it got into not only systems in
Speaker 2: the military that were unclassified, but even to classified networks
Speaker 2: as somebody was there on ground and one of the
Speaker 2: only offensive cyber guys on ground.
Speaker 3: It was just kind of a.
Speaker 2: Really cool moment, a luck purely by luck to during
Speaker 2: the first days of this to get to be able
Speaker 2: to do the forensics, and it kind of was some
Speaker 2: of the first truly tying what other adversaries could do
Speaker 2: to our war fighting capability and the importance of cybers.
Speaker 1: So was was this who in the whole USB controversy,
Speaker 1: Like when they started taking away our USB's was that timeframe?
Speaker 2: So you're nailing it there, You're absolutely nailing the USB
Speaker 2: drives themselves were definitely one of these things of like
Speaker 2: where did they come from? The software they called it
Speaker 2: Agent BTZ is the malware name for any of the
Speaker 2: super nerds. But it's just a piece of software that
Speaker 2: when you put a USB or put a CD in
Speaker 2: a drive, it would auto run, right, it would literally
Speaker 2: automatically start running and next thing, you know, bad stuff.
Speaker 3: And so that was a kind of wild time for
Speaker 3: the US military.
Speaker 4: Yeah yeah, and you know, I you know, not too
Speaker 4: like whoever the Nation State Actor was, but when you
Speaker 4: consider like all the SSC that was going on in
Speaker 4: people throwing you know, taking CD ROMs or US off
Speaker 4: targets and you know, throwing them in like we were
Speaker 4: exposing ourselves for that stuff all the time. Uh, just
Speaker 4: from our everyday activities.
Speaker 3: Yeah, I mean it was it was It was life right.
Speaker 2: There is a process by the way, like when you
Speaker 2: go from these low systems to high just like anything,
Speaker 2: you know, it's just like a clearing barrel.
Speaker 3: You got to be able to, you know, clear your gun.
Speaker 2: You got to be able to follow these processes to
Speaker 2: make sure you don't accidentally, you know, bring something nasty.
Speaker 2: But this is the first time that for instance, people
Speaker 2: didn't think that maybe the clearing barrel wasn't enough so
Speaker 2: to be able to find something that you're just doing
Speaker 2: your job and think about when you gather intelligence, like
Speaker 2: my deployments in Afghanistan were all you know, a team
Speaker 2: related oda work gathering human intelligence. Human intelligence doesn't start classified,
Speaker 2: it starts unclassified, right, right, and then you bring it
Speaker 2: up to the systems appropriately right. And this threat actor
Speaker 2: just really seemed to understand how that system worked and
Speaker 2: how they could exploit it.
Speaker 4: So I'm curious because you know, you you are you're
Speaker 4: an offensive guy.
Speaker 5: Now you're not offensive guy.
Speaker 3: I would be offensive, yeah, but also offensive.
Speaker 4: Right yeah? Yeah, but but you were you know, so
Speaker 4: you're in this cyber space before you even joined the military.
Speaker 5: You joined the military, you.
Speaker 4: Get into the sort of the IT track, do you know,
Speaker 4: uh like, are you aware that sort of there is
Speaker 4: or isn't a cyber capability? You know how to get there?
Speaker 4: And how are you spending your evenings? Are you like
Speaker 4: sweating bullets every morning when you go into work?
Speaker 5: One boy, I hope nobody heard about this.
Speaker 2: So it was already in the IT world, like everyday
Speaker 2: tech was already changing, right right, we were moving from
Speaker 2: these old novel systems into early Windows and T and
Speaker 2: Windows two thousand systems. So I was already used to
Speaker 2: that grind of like every day something was different, huh.
Speaker 2: But at this time it and cyber what we call
Speaker 2: it now were largely blended.
Speaker 3: Like most folks wouldn't have called a cyber.
Speaker 2: It was this maturing and if you got lucky that
Speaker 2: you were stationed at a place that only did offense.
Speaker 2: But my job at a time was just as much
Speaker 2: defense as it was often it.
Speaker 3: Was really odd.
Speaker 2: And then of course we got a lot better when
Speaker 2: some of this started increasing and Nation States right started
Speaker 2: really going after us. We had to get much better
Speaker 2: and mature because we could see that if not, we
Speaker 2: were going to be left in the dust.
Speaker 4: Right right, No, it'sentially because like the military is running
Speaker 4: like most mom and pop businesses right now, right, we
Speaker 4: need an it guy to make sure our computers were secure.
Speaker 5: Yeah.
Speaker 2: Yeah, So at the sum of the work, I was
Speaker 2: literally the it guy unlocking accounts and stuff in the
Speaker 2: early like two thousand and three, two thousand and five days.
Speaker 3: By two thousand and seven, two thousand and eight.
Speaker 2: I was usually only doing the upper end. But that's
Speaker 2: how quick it happened only in about three years. I
Speaker 2: would say my whole life changed.
Speaker 4: Were they were they sort of were they splitting that off?
Speaker 4: Were they making the commands? Were they making that distinction?
Speaker 4: Did they see that the security was not it?
Speaker 2: The career fields hadn't updated yet, but you could get
Speaker 2: to certain places that were like and I know it's
Speaker 2: acron and souit nobody likes that military stuff, but JTFG
Speaker 2: and O, right, the Joint Task Force for doing this
Speaker 2: started like huddling together some of these offensive minded and
Speaker 2: the way I would actually describe it, in a lot
Speaker 2: of ways, it was purely you know, for those that
Speaker 2: follow us, it was title fifty Intelligence and Espionage Gathering Activity.
Speaker 3: It wasn't title ten War Powers types.
Speaker 7: Right.
Speaker 2: This is still very very early, let alone the modern
Speaker 2: world where it's our offense and support of defense.
Speaker 3: So you can imagine this timeframe.
Speaker 2: Us doctor in all on the unclassified side of the
Speaker 2: house is all about just trying to figure out, like
Speaker 2: how do I enable espionage.
Speaker 1: So I want to take a minute today to tell
Speaker 1: you guys about the perfect gene. I've been wearing them
Speaker 1: for a few weeks now and really enjoy them, and
Speaker 1: I just want to share it with our audience. You know,
Speaker 1: sometimes genes have this problem where you know, you guys
Speaker 1: all have seen these skinny jeans that they like crush
Speaker 1: your balls and you know it's just not comfortable.
Speaker 6: To wear or the other way around. The jeans are
Speaker 6: like too baggy.
Speaker 1: You know, you have the sort of like diaper in
Speaker 1: your ass area looks like. So there are these problems
Speaker 1: that you know, different fits of different types of genes
Speaker 1: have and the perfect gene strives to fix that both
Speaker 1: the fit but also the mobility, the maneuverability. It has
Speaker 1: a stretchy fabric, like they say it's like yoga ready,
Speaker 1: but you know I would say it's athletics ready. You know,
Speaker 1: moving furniture, doing things around the house. You're not going
Speaker 1: to have that like super tight, like constricted fit that
Speaker 1: you feel like you're.
Speaker 6: Not gonna be able to move around in.
Speaker 1: And there are over four hundred thousand people out there
Speaker 1: wearing these jeans at this point, so not all of
Speaker 1: them can be wrong. I hope you guys will go
Speaker 1: and check them out. So a few scenarios where you
Speaker 1: can wear these jeans and where they really come together.
Speaker 1: Everything from you know, doing yard work, or doing things
Speaker 1: around your house, if you have to move furniture around
Speaker 1: or you have to do handiwork. They're perfectly comfortable, but
Speaker 1: you can wear them, you know, getting your man spread
Speaker 1: on on the subway if that's your thing. So, the
Speaker 1: Perfect Gene is great for all kinds of different environments,
Speaker 1: whether it's doing handiwork around the house or on the
Speaker 1: job or athletics. And we really hope you guys will
Speaker 1: go and check them out. For a limited time, our
Speaker 1: listeners get fifteen percent off their first order plus free
Speaker 1: shipping at the Perfect Gene dot nyc. Or google the
Speaker 1: Perfect Gene and use the code House fifteen for fifteen
Speaker 1: percent off. That's fifteen percent off for new customers at
Speaker 1: the Perfect Gene dot nyc with promo code House fifteen.
Speaker 1: After you purchase, they'll ask you where you heard about them.
Speaker 1: Please support our show and tell them we sent you.
Speaker 1: So fuck your takis and get the Perfect Gene.
Speaker 5: Well that messages anything that ain't good.
Speaker 1: You said you did some deployments overseas supporting soft I'd
Speaker 1: be interested to hear a bit more about about that,
Speaker 1: and like how this like it security field kind of
Speaker 1: interfaces with that.
Speaker 2: Yep, So for any of the other fans of silent
Speaker 2: professionals out there. They don't just exist in espionage or
Speaker 2: you know, they exist in special forces, right, human intelligence.
Speaker 2: And it turned out these A teams were all about
Speaker 2: how do I gather intelligence right the old school ways,
Speaker 2: local building relationships, things like that, ha, humanitarian assistance.
Speaker 3: But they need a geek like me to keep some.
Speaker 2: Of the systems up, whether it's classified systems, being able
Speaker 2: to be able to keep the data you can imagine
Speaker 2: for how do you covertly record, how do we make
Speaker 2: sure things aren't bugged. All of that stuff is normal
Speaker 2: parts of just any sort of espionage doctrine all the
Speaker 2: way back to the fifties. It's not unique, but there
Speaker 2: is definitely shortage. And so folks like me who are
Speaker 2: cyber warfare operators completely different than special forces operators, got
Speaker 2: attached on the same teams, and I was like super
Speaker 2: grateful to get that.
Speaker 4: Did you basically have to teach them how to utilize you?
Speaker 3: I think in a way and a lot of it.
Speaker 2: Like when I first got there, the team was actually
Speaker 2: pretty clear like reminding me, hey, you know, hey, turd,
Speaker 2: keep the systems up, make sure the morale drive is running,
Speaker 2: but right, right, very similarly, you know, very similar though
Speaker 2: you could imagine like their careers is often defined by
Speaker 2: their capabilities, which was identical to mine. And so in
Speaker 2: a lot of ways, I got lucky that my team
Speaker 2: treated me pretty darnfair. I won't say that there wasn't azing.
Speaker 2: Like we had an incident that involved diverting a drone
Speaker 2: one day, and I'll be darned if they did not.
Speaker 2: Only like, after this incident goes down, I get in,
Speaker 2: they tell me to pack my stuff. They have me
Speaker 2: fill out a you know, incident report. I'm thinking I'm
Speaker 2: going to jail. I'm like crying, you know, filling this out.
Speaker 2: I get to the last page and it says, remember
Speaker 2: you're not a Special Forces operator, You're an Air Force
Speaker 2: tech geek.
Speaker 3: Sign here puss.
Speaker 6: So these guys let me have it.
Speaker 2: Even though you know, I got to help them with
Speaker 2: a lot of great stuff. I was definitely, though still
Speaker 2: support So that type of relationship was actually pretty cool.
Speaker 2: And for me, who'd always been very athletic, not the
Speaker 2: same style of athleticism, it was a really like kind
Speaker 2: of humbling experience to get to spend a couple of
Speaker 2: appointments with these guys.
Speaker 4: So in addition to like telling people what you can do, like,
Speaker 4: did you have to tell people what you couldn't do
Speaker 4: based on like misconception, like like enhance a picture, enhance
Speaker 4: enhance to Kyle, Yeah, exactly.
Speaker 2: Yeah, So you can imagine all the TV shows and
Speaker 2: movies ruined it for you know, folks that, for instance,
Speaker 2: are like, look, you know I blow things up. I'm
Speaker 2: a demo guy, or you know, I'm the combat medic.
Speaker 2: Just the same way that people don't understand how transfusions
Speaker 2: do and don't work.
Speaker 3: They didn't understand some of the time ethnical stuff.
Speaker 2: So like Wi Fi hacking, I could do that that
Speaker 2: would impress them.
Speaker 3: Other things. It's just like, yeah, I took this.
Speaker 2: This camera was on a flip phone or some Nokia
Speaker 2: on a Roshan network somewhere enhanced this, and I'm like, guys,
Speaker 2: there's it's not you know, it's not minority port where
Speaker 2: there's not enhanced and hands and hands. So you can
Speaker 2: imagine there's definitely some disappointment. I disappointed at times, guys.
Speaker 4: Yeah, I mean you can do stuff, there's like literal
Speaker 4: magic to them, and then they ask you for something
Speaker 4: to them that's basic, hey, and pictures like there's nothing
Speaker 4: like nothing.
Speaker 2: Yeah, I like, I literally remember some surveillance stuff that
Speaker 2: we did that I soldered some kit that was very
Speaker 2: simple pinhole camera to like an existing like cable that
Speaker 2: was hidden away, very very far away, and they thought
Speaker 2: that was magic. And then I'm letting them down on
Speaker 2: stuff that they felt it was so basic.
Speaker 3: Right, It's just a weird dichotomy.
Speaker 2: Yeah.
Speaker 5: Yeah, So.
Speaker 4: Did you do I mean, were you with them or
Speaker 4: did you do multiple trips with.
Speaker 2: SF Yeah, yeah, multiple oda's But they were like they
Speaker 2: would go and do like twelve thirteen month rotations and
Speaker 2: I'd be in and out in like five you know,
Speaker 2: by the time I could actually deploy, go back home
Speaker 2: and come back in the same team could still be
Speaker 2: in place. So it was, uh, it's kind of sad
Speaker 2: actually if you think about it.
Speaker 4: Yeah, And how do you see, like during this time
Speaker 4: where you're doing these deployments, how do you see technology
Speaker 4: changing and how the military is or isn't embracing technology.
Speaker 2: So the teams were becoming more technical, like the eighteen
Speaker 2: echoes right, who had comms roles. Our team actually also
Speaker 2: doubled as a team sniper, right, so he was very
Speaker 2: different than he could have like encrypted comms, and so
Speaker 2: you could imagine as I could take on some of
Speaker 2: those responsibilities. It allowed them to take their own specializations
Speaker 2: and focus on it. So I actually think in many
Speaker 2: ways it was you know, I even like today my
Speaker 2: current job, the best thing I can do is focus
Speaker 2: on the skills only I can do. And so this
Speaker 2: blending started happening in the late like you know late ots,
Speaker 2: think of like two thousand and eight to twenty twelve.
Speaker 2: All of a sudden you had these geeks that were
Speaker 2: taking away some of the I would call it mundane,
Speaker 2: monotonous and allowing like real operators to do stuff that
Speaker 2: only they're trained on, right, And so that was I
Speaker 2: think kind of a true like people use that word
Speaker 2: force multiplier lightly, this was an actual case where they're like, whoa,
Speaker 2: I have somebody now that can do this, can run this,
Speaker 2: is fit enough to do this, and then it enables
Speaker 2: you know, an extra body because these again these teams
Speaker 2: are very small. So anyways, it was a cool difference
Speaker 2: because that from my first time, like even just on
Speaker 2: small deployments, think about like catark weight stuff. We were
Speaker 2: modernizing it systems, but they weren't impactful, not like this
Speaker 2: right right.
Speaker 4: Yeah, you're watching people's IP addresses and their MAC addresses
Speaker 4: and they're going to pourn shutting them down.
Speaker 6: It's really really cool.
Speaker 1: Yeah, but you got to see like the blending of
Speaker 1: these capabilities pretty early on.
Speaker 5: Yeah.
Speaker 2: Yeah, and again right place, right time. And if you
Speaker 2: fast forward even just a couple of years later, by
Speaker 2: twenty eleven, I had left active duty and I started
Speaker 2: National Guard time. So the typical one week in a month,
Speaker 2: two weeks a year, and that led me at Fort
Speaker 2: Meade and that time, no joke. Within two years you
Speaker 2: had going from these type of incidents to things that
Speaker 2: were like you know, people publicly claimed, you know, the
Speaker 2: US and Israel were related to like stucksnet. That's such
Speaker 2: a big difference where you're going from four years earlier
Speaker 2: scared of like bad USBs to now all said in
Speaker 2: the world supposedly some nation state actor made some centerfugion
Speaker 2: spend extra fast to prevent enrichment of uranium.
Speaker 3: Like that is a crazy difference in four years.
Speaker 4: Yeah, were there things during this sort of blossoming. Were
Speaker 4: there things that like you just wanted to jump on
Speaker 4: somebody's desk and tell the like, tell the military you're
Speaker 4: missing this like, or the government and general that you're
Speaker 4: not paying enough attention to this particular thing.
Speaker 2: So twenty twelve was the first time I actually thought,
Speaker 2: because we have so many flyers running some of these
Speaker 2: you know what a lot of people we call them wings, right,
Speaker 2: Air force nonsense. But when you have some of these
Speaker 2: flyers making policy decisions, I would say sixty seventy eighty
Speaker 2: percent of them just couldn't get the force multiplier. But
Speaker 2: there was a rare twenty thirty percent that kind of
Speaker 2: at this time had laid the groundwork to create you
Speaker 2: could imagine the beginnings of US Cyber Command, some of
Speaker 2: even the separation because at this time, like NSA is
Speaker 2: doing what they can do to help. But NSA's mission
Speaker 2: is foreign adversaries abroad for espionage, And so you could
Speaker 2: imagine in the US we're watching all the other nation
Speaker 2: state actors.
Speaker 3: They're changing their techniques, they're using.
Speaker 2: Schools for espionage, they're using commercial entities. So in many ways,
Speaker 2: like we were both ahead and learning at the same
Speaker 2: time everybody else was. So it was again I can't
Speaker 2: tell you like how lucky I am at right place,
Speaker 2: right time for all of this stuff to change.
Speaker 5: So you joined the Guard, which exposes you.
Speaker 4: To me, what's your first impression when you like, when
Speaker 4: you're there.
Speaker 3: So I wasn't a Guard guy. I had deployed with.
Speaker 5: Okay, sorry about that, Okay, oh no, no.
Speaker 2: Yeah, you were right, But I wasn't at this time
Speaker 2: think about it. I wasn't really a National Guard guy.
Speaker 2: I was in the National Guard, but I didn't know
Speaker 2: what that meant. I thought at this time Guard were
Speaker 2: kind of like, you know, hey, you'd have like sixty
Speaker 2: five year old tech sergeants. Right e six is for us, right,
Speaker 2: And I thought, oh man, this isn't the tip of
Speaker 2: the spear.
Speaker 3: But it turned out the National.
Speaker 2: Guard and a little bit of the reserves, but really
Speaker 2: on the National Guard side of the house, realized there
Speaker 2: was going to be They're not talking about the word hemorrhage.
Speaker 3: They called it stem ridge.
Speaker 2: All the science, technology, engineering, and math folks doing cryptography,
Speaker 2: advanced for instance, offensive cyber operations, even defense, they were
Speaker 2: racing to go to support. You know, remember Google got
Speaker 2: mass hacked in two thousand and nine. So even the
Speaker 2: industry is now dropping major dollars. I'm talking like four
Speaker 2: hundred five hundred thousand dollars salaries a year, and this
Speaker 2: talent was bleeding. But it turned out the National Guard
Speaker 2: realized this was going to happen, and our whole goal was,
Speaker 2: let me retain the best talent in the world, So
Speaker 2: even if we can't have them full time, how do
Speaker 2: we have that reserve capacity? And it was brilliant. I
Speaker 2: didn't even know that this was going down, and it
Speaker 2: didn't become apparent to me for probably two or three
Speaker 2: years later that some good flyers realized this was going
Speaker 2: to happen. I guess there's some parallels with flyers. This happened,
Speaker 2: you know, at the draw down of like Vietnam, and
Speaker 2: we didn't necessarily have for a while the flying talent
Speaker 2: to be able to do other air superiority. And it
Speaker 2: turns out those same type of flyers realized this was
Speaker 2: going to happen in cyber and again I just happened
Speaker 2: to be part of the right unit. It was trying
Speaker 2: to be able to not only like retain talent, but
Speaker 2: in case there was ever like a surge capacity we
Speaker 2: could step up and support. So you could imagine for me,
Speaker 2: my perception of the National Guard went from old kind
Speaker 2: of unfit, you know, you know airman to all of
Speaker 2: a sudden like whoa. It turned out the National Guard
Speaker 2: actually had in many cases better talent in than active
Speaker 2: duty head.
Speaker 4: Were they were they Was there any process at that
Speaker 4: time in formalizing training and devog partnership with like Sands
Speaker 4: or any you know, any of the big organizations.
Speaker 5: Were they sending you to black hat?
Speaker 4: Like how were they you know, working on your professional
Speaker 4: skills and things like that, or how were they supporting that?
Speaker 2: So you could imagine when this hemorrhaging or stemaging started happening,
Speaker 2: everybody started realizing we're going to start losing to commercial
Speaker 2: They weren't so worried about overseas. They weren't worrying about
Speaker 2: national threats, although there was some of that. You know,
Speaker 2: if you think about human there's always a worry somebody's
Speaker 2: going to go start, you know, merc in area type
Speaker 2: s right, that wasn't really a concern at this time,
Speaker 2: but you could imagine they're sitting there going, if we
Speaker 2: can't retain, how do we build this cadre? And it
Speaker 2: turns out there's a couple epicenters right in the DC area.
Speaker 2: You look like the National Guard had a handful of
Speaker 2: units that were trying to retain but they also were
Speaker 2: smart enough to realize if we don't set up some
Speaker 2: sort of commercial training, we are.
Speaker 3: Not going to be able to backfill. It was a
Speaker 3: pipeline problem.
Speaker 5: Yeah. I mean still to.
Speaker 2: This day twenty five, I have to build more talent
Speaker 2: than I can hire because they're still that rare. So yeah,
Speaker 2: companies like Sands and even other like research institutes, think
Speaker 2: about the National Labs had to step up and help
Speaker 2: grow people.
Speaker 7: Yeah, and then what what was the relationship with the
Speaker 7: government side of this, whether it's military or in it
Speaker 7: say whomever, and you know, the kids or the people
Speaker 7: who or anti the man or whatever, but still doing
Speaker 7: this stuff, you know, and like you.
Speaker 4: Know, I think def Con is a funny example, you
Speaker 4: know where guys are always like trying to point you know,
Speaker 4: pick the fed and you know stuff like that.
Speaker 5: Ben right, Yeah, yeah, So like what.
Speaker 4: Was that real relationship like and how has that developed
Speaker 4: over time?
Speaker 2: So for a guy like me who I've been going
Speaker 2: to deaf Con since I on early two thousands every
Speaker 2: year showing up or black hat I had done presentations,
Speaker 2: there was always this irony that those you know, you
Speaker 2: know that current statement that the my gen Z kids
Speaker 2: will say if you know, you know, all of us
Speaker 2: that were sometimes involved in some of these hacking events
Speaker 2: by kind of like late oughts, you know, two thousand
Speaker 2: and five, thousand and seven, twenty ten. A lot of
Speaker 2: people realize spot the FED was ironic because a lot
Speaker 2: of people organizing had now become in support of some
Speaker 2: of the federal sides. So there was always this irony
Speaker 2: of you know, catch the actual active agent. And I'll
Speaker 2: be honest, lot of people wanted to pick up FBI.
Speaker 2: There's a very big difference between NSA, who is very
Speaker 2: much a mission that is going after non US citizens,
Speaker 2: right right, FBI that's looking at US citizens. And I
Speaker 2: won't lie it wasn't even it's not a lie to
Speaker 2: say there wasn't a schism between some folks who are like,
Speaker 2: fuck you stay out of my you know, US citizens.
Speaker 2: And so even sometimes some of the you know, IC
Speaker 2: guys or maybe spot in the more field agent type
Speaker 2: guys of like, you know, get out of my, uh
Speaker 2: my corner.
Speaker 3: Yeah, you know everybody was FEDS.
Speaker 4: Yeah yeah, right, yeah, take your five elevens in your
Speaker 4: polo shirt and get out here.
Speaker 5: Yeah, there, I go.
Speaker 4: Yeah, but but that is true because the IC is
Speaker 4: the IC and the FBI is the man.
Speaker 2: Like, you know, people don't realize that, but you're you're
Speaker 2: hitting a culture thing that there will be more books
Speaker 2: on this, Like I think, uh, I can't remember that politician.
Speaker 2: He was out of maybe Texas, but people found out
Speaker 2: he was an early hacker. I'm spacing on his name,
Speaker 2: and uh, it blew some people's minds that some of
Speaker 2: these people that didn't seem like they could be from
Speaker 2: the hacker culture were actually the same guys on bulletin
Speaker 2: boards and you know, you know, IRC and stuff like that,
Speaker 2: but had now held like actual governor or sorry that's
Speaker 2: not correct congressman positions. So it was a weird time
Speaker 2: at the you know, kind of twenty ten period where
Speaker 2: you're the man but not the man.
Speaker 4: Right right, But we're also looking at a time from
Speaker 4: the time you started when you were a kid up
Speaker 4: until this time.
Speaker 5: You know, there wasn't hack the box. There wasn't there were.
Speaker 4: I'm pretty sure that people who were good at offensive
Speaker 4: stuff at the offense side of the house at some
Speaker 4: time may have you know, pushed up against the the
Speaker 4: legal system.
Speaker 3: There was definitely gray.
Speaker 2: And what's weird is a lot of people don't realize
Speaker 2: the polygraph is not necessarily to find out who's breaking
Speaker 2: the laws, to figure out who has integrity. And so
Speaker 2: I remember people that I knew flat out had like
Speaker 2: done not crazy hard drugs, but admitted they had done
Speaker 2: drugs and made it through polygraphs just or some shady
Speaker 2: level of Like Now, even looking back, there's nothing that
Speaker 2: I think that as long as I was honest on
Speaker 2: my polygraph, if it actually asked me about those questions,
Speaker 2: I don't think anything would have precluded me from service.
Speaker 2: It wasn't They're not looking for somebody that have you
Speaker 2: broken a law or do you, you know, dip into
Speaker 2: the gray. They're making sure that when they ask you,
Speaker 2: they know you're going to be honest. And integrity's worth
Speaker 2: a hell of a lot more than occasional bad judgment.
Speaker 2: So I think the actual US government had to changed
Speaker 2: their mind a little bit. And for me, I mean,
Speaker 2: I've been tiptoeing this line my whole career. You cannot
Speaker 2: you know, you have to obey laws period, right, you know,
Speaker 2: the intelligence communities, you obey laws if you're you know,
Speaker 2: a Ford deployed, you know, a soldier, airman, marine, you know, sailor.
Speaker 2: You obey the laws, but there's always this level of
Speaker 2: gray that I noticed that the offense of CyberWorld. You know,
Speaker 2: even to this day, some people will say, ah, I
Speaker 2: use my offense in supportive defense, and somewhere there's a
Speaker 2: little lit level of understanding.
Speaker 3: Just don't go too far.
Speaker 4: Right right, but in order, like I said before, all
Speaker 4: these you know, cool little sites that you could go
Speaker 4: on and learn this stuff.
Speaker 5: You know, when you're thirteen or fourteen.
Speaker 4: And there are there aren't sites like hack the box
Speaker 4: or whatever you know, or pent testing sites or whatever, like,
Speaker 4: how do you learn how to hack into a network?
Speaker 8: You know?
Speaker 2: For me, it was these capture the Flag of competitions.
Speaker 2: You know, they weren't physical capture the flag like the
Speaker 2: sports game. They were the hack into other systems. And
Speaker 2: it turned out there was a lot of these. They
Speaker 2: were actually hacked the box and a lot of these
Speaker 2: modern training systems started from kind of war games type events.
Speaker 2: And I don't even think people new like the year that,
Speaker 2: you know, for those that don't know what I'm talking.
Speaker 3: About, these capture the flags, think of.
Speaker 2: Possibly fifteen to twenty eight person teams of stinky pasty
Speaker 2: nerds creating exploits and hacking each other to steal data.
Speaker 2: That's their stealing the flag. They then submit the flag,
Speaker 2: bring it back to base, and they get a point.
Speaker 2: That's kind of how this worked, and these competitions were
Speaker 2: kind of the breeding grounds that at one time I
Speaker 2: remember playing Capture the Flag at Defcon where all the
Speaker 2: nerds get together in Vegas every year. That I remember
Speaker 2: looking and going Nation State Nation State US school that
Speaker 2: probably supports offensive cyber operations, defense contractor. We were a
Speaker 2: team that were just as guilty. A lot of us
Speaker 2: were five Eyes right us and some of our closest allies,
Speaker 2: and it was wild. This was almost like, you know,
Speaker 2: you can't train publicly, so the next best thing you
Speaker 2: could do is make a game out of it, And
Speaker 2: kind of what happened for I would say even still
Speaker 2: to this date, there's Capture the Flag runs every year
Speaker 2: a deaf gun.
Speaker 4: So there was Capture the Flag events like as young
Speaker 4: for you as young as like seventeen.
Speaker 5: I thought that was a more recent type of thing.
Speaker 2: So back then they were called crack mes or rehearse mees,
Speaker 2: so people would make fake software to teach reverse engineering.
Speaker 2: So they would make like a fake software that had
Speaker 2: like a fake digital rights or like key code that
Speaker 2: you had to pay for, and so they would actually
Speaker 2: teach you. And that's what I grew up on with
Speaker 2: interesting learning how to reverse engineer so I could get
Speaker 2: free software back to my broke days.
Speaker 3: But that's how it started.
Speaker 2: People then started training by creating fake software and fake
Speaker 2: activations and giving these tutorials too. This is what they
Speaker 2: were called, right, and you would actually use these tutorials
Speaker 2: to reverse engineer, and that.
Speaker 3: Turned into a whole game.
Speaker 5: So you're right.
Speaker 2: It didn't just go straight from the IRC channels into
Speaker 2: this full on war games. There was these kind of
Speaker 2: minor trainings that kept getting bigger, yeah, and bigger, all
Speaker 2: the way to hundreds person events.
Speaker 5: Right.
Speaker 1: Yeah, so let's jump into you know, you're in the
Speaker 1: National Guard. And now it sounded like at a certain
Speaker 1: point you make the jump over to the three letter
Speaker 1: side of the house or actually have a foot in both.
Speaker 1: I explained to us a little bit about like how
Speaker 1: that comes about and how that works.
Speaker 2: Yeah, so a lot of my life, you can tell,
Speaker 2: is still kind of recovering from you know, it's hard
Speaker 2: growing up broke right, and so you turn to you know,
Speaker 2: you make decisions based on money and what you know
Speaker 2: gives fun. And I realized, as you know, an e six,
Speaker 2: I was not going to have the stability for my
Speaker 2: family at this time. I have two kids, you know,
Speaker 2: I had my first one at eighteen years old, so
Speaker 2: you can imagine like a little bit of my psyche
Speaker 2: of trying to learn while graising kids, while being a kid,
Speaker 2: and I needed that. So I'm now six seven, eight
Speaker 2: years into the military, and I decide I'm going to
Speaker 2: become a contractor, and so I'm using my skills full
Speaker 2: time at NSA as a contractor for most of my time.
Speaker 2: That just means I can do most of the stuff
Speaker 2: that a government civilian can do, but there is some
Speaker 2: rules that they wouldn't let me do. And at this
Speaker 2: time my job turned into creating. They called it computer
Speaker 2: network operations. It's creating these things called implants that gather software.
Speaker 2: If you were on the receiving end of an implant,
Speaker 2: you'd call it malware. So that was my job at
Speaker 2: night or sorry, during the day. I'm creating malware professionally
Speaker 2: to support intelligence gathering. And one week in a month,
Speaker 2: two weeks a year. I'm using those cyber capabilities to
Speaker 2: actually gather intelligence or to support offensive cyber operations.
Speaker 1: That's pretty interesting. So I mean literally dual had it
Speaker 1: in a sense.
Speaker 2: I remember some meetings where again you're limited as a contractor,
Speaker 2: you're getting paid better, so you kind of like it.
Speaker 2: But with me having both feet in this world, there
Speaker 2: were times where I would actually have to remove myself
Speaker 2: because it wasn't appropriate being a contractor. And there were
Speaker 2: some times I'd have to literally flip my badge to
Speaker 2: have the right badge color up in and say, I
Speaker 2: want to tell you this on behalf of me in
Speaker 2: this role. I'm no longer a contractor, Kyle, but this
Speaker 2: is how we're going to use this for not espionage
Speaker 2: but attack computer network attack. And that was a real
Speaker 2: different role that I could actually use my National Guard
Speaker 2: time to often now benefit people who were only able
Speaker 2: to do espionage. So if I won't bore the audience
Speaker 2: with like all the laws, there's a big difference between
Speaker 2: Title fifty espionage in Title ten, which allows you to
Speaker 2: truly do attack.
Speaker 3: Deny degrade.
Speaker 6: Yeah, destroyed.
Speaker 3: I didn't use the face.
Speaker 2: It was destroyed disrupt but that type of actual effects
Speaker 2: and I will tell you being able to have both badges,
Speaker 2: it was a again I used this word earlier, force multipliers,
Speaker 2: seeking these opportunities to use my experience and again right place,
Speaker 2: right time.
Speaker 3: Super thankful.
Speaker 1: Well you spoke a little bit earlier about like these
Speaker 1: blended teams and blending these capabilities, and I mean you
Speaker 1: continue doing that. I mean I think that is that
Speaker 1: something that this line of work is sort of institutionalized
Speaker 1: or is it still sort of like a stovepipe there.
Speaker 3: I think it's getting better.
Speaker 2: This is the stuff that like if you hear people
Speaker 2: in the deployments in the AOAR saying we're going to
Speaker 2: use total forces, that means usually they're secure in the
Speaker 2: sky right with air power, they're maybe jamming the signals
Speaker 2: with electronic warfare. They've got human intelligence on the ground,
Speaker 2: they've got infantry pushing up, you know, doing the hard work,
Speaker 2: and then all the support that goes into it when
Speaker 2: you use total force. We've known that using all domain
Speaker 2: warfare is very powerful if you can coordinate it. At
Speaker 2: this time, people are trying to figure out not only
Speaker 2: how to add cyber to that story, they're trying to
Speaker 2: figure out, Oh my gosh, even within cyber there's all
Speaker 2: these different domains, right, it's an inch deep.
Speaker 3: And a mile wide of skill sets.
Speaker 2: So i'll tell you by this time, probably twenty thirteen,
Speaker 2: twenty fifteen, they're just starting to figure out what are
Speaker 2: all the blended skill sets.
Speaker 3: And they're learning this by accident.
Speaker 5: Right.
Speaker 2: The civilian world, by the way, starts calling this purple teaming.
Speaker 2: What they mean is blue teaming was always defense. Red
Speaker 2: teaming was always aggression assessing, and they start realizing you
Speaker 2: can use your red team offense to improve your blue
Speaker 2: team defense, and vice versa. You can use your offense
Speaker 2: to deliver effects so you never have to defend. So
Speaker 2: this world all of a sudden is completely learning. The
Speaker 2: whole thing is changing, and it's kind of like what
Speaker 2: we're seeing right now in Ukraine, where warfare is completely
Speaker 2: changed to drones autonomous systems.
Speaker 3: This same effect was going down.
Speaker 6: Just out of curiosity.
Speaker 1: If you can answer in a roundabout way, even how
Speaker 1: many different tools do you think you used on a
Speaker 1: daily basis when you went into work.
Speaker 2: I don't want to be cliche, but it was definitely
Speaker 2: maybe sometime in a day, it might be a half
Speaker 2: dozen to a dozen, but in a month it could
Speaker 2: be a It was really the old school, you know,
Speaker 2: folks that were lucky enough like me to grow up
Speaker 2: and learn remember those early computer programming languages like Assembly,
Speaker 2: and then blend them with modern programming languages like you know, Python,
Speaker 2: and then stuff in between like C and C plus plus.
Speaker 2: There wasn't many of us who could do this, so
Speaker 2: you could imagine this was a time where they were
Speaker 2: really trying to do everything they could, whether it was
Speaker 2: retaining people on the active duty side or National guard side,
Speaker 2: because once you lose this to the tech world, getting
Speaker 2: them back into these spaces was pretty hard. So I'm
Speaker 2: not going to sugarcoat it. It was a cluster for
Speaker 2: a really long time, and it's definitely maturing now. It's
Speaker 2: maturing to the level that some of these teams not
Speaker 2: only understand what manpower needs to look like, they can
Speaker 2: forecast it, they can grow it, and they know. But again,
Speaker 2: this is still mid twenty fifteen, twenty thirteen, and this
Speaker 2: stuff isn't figured out yet.
Speaker 5: Can you can you tell us a little bit?
Speaker 4: And I don't want to get into anything too sensitive,
Speaker 4: so I'll say, like, if we think of you know,
Speaker 4: you mentioned espionage and attack, and if we think of
Speaker 4: espionage as intelligence collection, right, that we're collecting information and
Speaker 4: you know a lot of times there's probably I imagine
Speaker 4: the attack and espionage often show similar entry points.
Speaker 5: Right.
Speaker 2: Yeah, so there's a fancy word, unclassified word, but it's
Speaker 2: talking about the preparation of an environment.
Speaker 5: Right.
Speaker 2: Think about the difference between when you deliver an effect.
Speaker 2: Let's make up one in this room. Maybe the light
Speaker 2: that's above my hair, right, give me this fancy hair light.
Speaker 2: The difference of me being able to turn that on
Speaker 2: and off is often like flipping a switch.
Speaker 5: Right.
Speaker 2: However, this is the time that all of a sudden
Speaker 2: we start realizing our legal frameworks. It's all about following laws, period.
Speaker 2: I know there's a lot of disinformation, there's a lot
Speaker 2: of bs, especially postnodin, but the most law abiding organizations
Speaker 2: I've ever worked at, military NSA plenty of examples of
Speaker 2: where it didn't happen.
Speaker 3: But it's kind of crazy.
Speaker 2: And where I'm going with this is you started learning
Speaker 2: our laws might not have let us prepare to get
Speaker 2: in just in case you have to flip that switch.
Speaker 2: So I'm telling you, when you start getting into this
Speaker 2: time period twenty fifteen twenty seventeen, we're realizing things have
Speaker 2: to change quick because our adversaries are not hung up
Speaker 2: on riwas And if you think about people that aren't
Speaker 2: nation state, let's start talking about the emergence of cybercrime.
Speaker 2: They give no shits what the laws are. They are
Speaker 2: just moving faster than anybody to innovate. So we actually
Speaker 2: got caught up in a world in the US for
Speaker 2: a little while that the real heroes were actually the
Speaker 2: policy wonks, the lawyers, the legal folks actually realizing that
Speaker 2: if we're going to obey the laws, we need to
Speaker 2: make sure the laws not only protect US citizens' rights,
Speaker 2: we have to be able to handle all the murky situations.
Speaker 2: What if a US citizen goes abroad and you accidentally
Speaker 2: do something and collect how do you like all this stuff?
Speaker 3: Because no offense.
Speaker 2: Like my mom is my best, you know, supporter, She's
Speaker 2: also the first tinfoil hatter who's like, are.
Speaker 3: You listening to my calls?
Speaker 2: And I'm like, Mom, I give no cares what I'm
Speaker 2: talking about in your calls. But that crap can happen
Speaker 2: by accidents. So you can imagine lawyers had to allow
Speaker 2: us to get in place gather intelligence, so you don't
Speaker 2: have this nine to eleven event where you had the
Speaker 2: info but couldn't action it. And so this time period again,
Speaker 2: we as the US are still trying to make sure
Speaker 2: we follow laws, but we can't get cut flat footed.
Speaker 5: Right.
Speaker 2: We are a nation state power that stays in power
Speaker 2: by projecting power, right, and if we hamstring ourselves by
Speaker 2: being perfect, you can sometimes let perfect be the enemy
Speaker 2: of good, and good enough sometimes gets you know, get
Speaker 2: shitped done.
Speaker 1: There was that example just a couple of years ago.
Speaker 1: If you remember Tucker Carlson making a big stink about
Speaker 1: how somebody illegally leaked to him that he had been
Speaker 1: caught up in an intercept. It turns out yes, he
Speaker 1: was contacting the Russian government and talking to them. So
Speaker 1: if you do that, no shit you're gonna get your
Speaker 1: accounts are going to get intercepted.
Speaker 3: And what's wild.
Speaker 2: And this is some of the stuff that I think
Speaker 2: many government agencies realized that we were caught flat footed
Speaker 2: during the snowed and era because there was a lot
Speaker 2: of things that people just zip their lips, right, No
Speaker 2: such agency type world where we weren't going to talk
Speaker 2: about this stuff right. And what it did is when
Speaker 2: you have the absence of a narrative, people will be
Speaker 2: more than happy to fill it in for you. And
Speaker 2: so this is the stuff that, to be honest, the
Speaker 2: Armed Services, I would generally say, gets it done right.
Speaker 2: We don't overclassify. We have a mission. And that's because
Speaker 2: I think we realize and we cherish loss of life.
Speaker 2: But when you work in this world where it's all
Speaker 2: secrets and it takes it away from loss of life,
Speaker 2: you sometimes let some of this perfection get in the way.
Speaker 2: And I'll tell you, like nobody wants to collect, but
Speaker 2: I'll be darne. You'll find cases of people abusing. Just
Speaker 2: like think about any employee. You probably hired somebody that
Speaker 2: seemed legit when you hired them. They turn out to
Speaker 2: be a turd d. This stuff happens.
Speaker 1: Hey, guys, it's your pal Jack. I just want to
Speaker 1: take a moment to tell you about the sponsor for
Speaker 1: this show, which.
Speaker 6: Is Stop Box.
Speaker 1: Stop Box makes this very cool box to secure your
Speaker 1: items in where your valuables or weapons could be a firearm, knife,
Speaker 1: things that you want to keep away from kids. Opens
Speaker 1: up like so and the way it locks is very
Speaker 1: interesting and you can change the combination by the way,
Speaker 1: so you have these actuators on the side, and in
Speaker 1: this case for demonstration purposes, the code is to hold
Speaker 1: down the index finger and pointer finger and then come
Speaker 1: over and there's a thumb if that and it opens up,
Speaker 1: so that's the code. And this thing is proudly made
Speaker 1: in the us of A, so they keep the quality
Speaker 1: very high. It's also TSA so you can throw this
Speaker 1: in a bag and travel with it.
Speaker 6: And stopbox also offers a.
Speaker 1: Range of other innovative products, including their vehicle safe chamberlock
Speaker 1: and other essential gear designed to keep you prepared and
Speaker 1: protected wherever you are. For a limited time only, our
Speaker 1: listeners are getting a crazy deal. Not only do you
Speaker 1: get ten percent off your entire order when you use
Speaker 1: the code House at STOPBOXUSA dot com, but they are
Speaker 1: also giving you a buy one, get one free for
Speaker 1: their Stopbox Pro. That's ten percent off and a free
Speaker 1: Stopbox Pro when you use the code House at STOPBOXUSA
Speaker 1: dot com. Discover a better way to balance security and
Speaker 1: readiness with Stopbox. I think you've touched on something that's
Speaker 1: like really interesting. I think especially around like the Snowden period,
Speaker 1: because there really was not a public interface between an,
Speaker 1: say and the public. I'm sure they had a public
Speaker 1: affairs office, no offense.
Speaker 4: But it was the House of Glass, right, I mean, yeah,
Speaker 4: you know, you know evil.
Speaker 1: So when that scandal broke, it was a little bit different,
Speaker 1: I think than the military, because people can see their soldiers,
Speaker 1: they can hear their soldiers, they can get to know
Speaker 1: them a little bit, and it kind of takes away
Speaker 1: the mystery of it, whereas with the NSA, we can
Speaker 1: if it's a black box, we can project all sorts
Speaker 1: of maorious things upon what you're actually doing.
Speaker 2: Yeah, no offense when somebody doesn't tell me how something works.
Speaker 3: I have survived by being.
Speaker 2: Very pessimistic, right, right, as humans evolved, right, bad stuff
Speaker 2: outside of the cave. And if you make something seem
Speaker 2: shady in the dark, I'm not going to assume positivity
Speaker 2: happens in the dark. Right, That's literally how we evolved
Speaker 2: as a species.
Speaker 3: So I can't wait.
Speaker 2: If you do the math right, you've got some of
Speaker 2: the snowed in era type stuff twenty ten to twenty fifteen.
Speaker 2: Usually US has a lot of like declassification things that
Speaker 2: happen in twenty five years. For some of this I
Speaker 2: cannot wait to fast forward to you know, our equivalent
Speaker 2: of twenty four, when some of these stories start to
Speaker 2: become declassified. Maybe governments and officials declassify these things early
Speaker 2: and tell the real story of how some of this
Speaker 2: stuff happened. Because I will say, remember that word stemorage
Speaker 2: I used if we thought it was bad in this
Speaker 2: kind of twenty ten. When you don't give somebody a voice,
Speaker 2: and you don't defend somebody who's working hard every day,
Speaker 2: I'll just go take Google's five hundred thousand dollars a year, thanks,
Speaker 2: because my civilian pay at ninety six thousand dollars a
Speaker 2: year ain't cutting it.
Speaker 5: Right, right.
Speaker 4: Yeah, And you know, both the CIA and the NSAY
Speaker 4: have this problem of not you know, they don't they'll
Speaker 4: never talk about their victories. They'll never talk about the victories,
Speaker 4: will never you know, air out like things that they've accomplished.
Speaker 4: But when they when somebody does go rogue or somebody
Speaker 4: does something bad or fails, you hear about that.
Speaker 5: So it's easy to see these shady.
Speaker 4: Evil organizations that are secretly, you know, pulling strings all
Speaker 4: over the world.
Speaker 5: World.
Speaker 2: Yeah, and I'll tell you it's what's weird. Is you
Speaker 2: work at a spy agency for about thirteen years, and
Speaker 2: now I appreciate my privacy and transparency more than I've
Speaker 2: ever appreciated. Yeah, but there's also this like again this
Speaker 2: level of like the black and white is always easy.
Speaker 2: It's the gray where things get dicey, right, It's that
Speaker 2: I think about like AI and autonomous cars these days.
Speaker 3: Do I go and you know, make the decision?
Speaker 5: Right?
Speaker 2: Do I take a right and run over three or
Speaker 2: four people? Or do I take a left and run
Speaker 2: over one person? How do you make that decision in
Speaker 2: value life? And it could be you know, one child
Speaker 2: or three ninety year old people. All this logic and
Speaker 2: the reason I'm given this example is national security is
Speaker 2: not one in the black and white. It's one on
Speaker 2: interpreting the gray and trying your best during a crappy
Speaker 2: situation to make the best decision and not regret it
Speaker 2: for the rest of your short life, you know.
Speaker 1: So back to the notion of like lifting the veil
Speaker 1: or wearing the fog a little bit. I'd love to
Speaker 1: ask you, since you were there for a hot minute.
Speaker 1: I think a lot of people, including myself, don't really understand,
Speaker 1: like what is the culture of the NSA.
Speaker 6: What is it like to actually work there?
Speaker 1: Who are your colleagues, the type of people that you're
Speaker 1: working around.
Speaker 2: So, I mean, this is the fun stuff about these
Speaker 2: big agencies, right, And we haven't even talked people forget
Speaker 2: that the US has like I don't know, what is it,
Speaker 2: sixteen eighteen different.
Speaker 5: Intelligence agencies, right, yeah, even.
Speaker 2: Treasury has like some type you know, a work. But
Speaker 2: the part that I'm getting at is that the big
Speaker 2: ones you get the whole spectrum.
Speaker 7: Right.
Speaker 2: You get some people that are top level operators, and
Speaker 2: you get some people at NSA who are janitors.
Speaker 5: Right.
Speaker 3: They they'll go.
Speaker 2: Out and tout and you know, stolen valor and everything
Speaker 2: else about how cool they were at NSA. But it's
Speaker 2: like you weren't in the thick of it, and so
Speaker 2: you can imagine you get all shapes, just like in life,
Speaker 2: just at like any type of you know, career. But
Speaker 2: the one thing that seemed to drive everybody together was
Speaker 2: understanding that like, if you mess up the things that
Speaker 2: we appreciate, right, true, freedom, true, just being good to people,
Speaker 2: Screw politics and how you lean, Like I don't care
Speaker 2: which way you lean. People love the smell of a
Speaker 2: neighbor's good smelling barbecue.
Speaker 8: Right.
Speaker 2: We also hate paying taxes. I hate getting a red
Speaker 2: light ticket. We all share way more that like unites
Speaker 2: us than divides us. And I would actually describe that
Speaker 2: was the era that I got to grow up in
Speaker 2: the intelligence community. Didn't matter whether it's political, it was just,
Speaker 2: oh my gosh, democracy is fragile. People forget the US.
Speaker 2: It's only a couple hundred years old, like we are
Speaker 2: a footnote. Like I remember the first place that I
Speaker 2: lived in England in my duty station. The house that
Speaker 2: I lived in was one hundred years older than the US.
Speaker 2: That's a perplexing thing. And I think people forget like
Speaker 2: if you don't just unite behind the like you know,
Speaker 2: I'm not talking with DEI stuff, but like belonging, just
Speaker 2: carrying around a mission that this thing that we love,
Speaker 2: which is freedom, could go away, like it'll disappear.
Speaker 3: And so I liked it.
Speaker 2: I really was felt good. And all the different things
Speaker 2: that outside of work divided people at work, it was
Speaker 2: just like mission, mission, mission, get shit done.
Speaker 1: I've heard well, first off, I've heard stories about D
Speaker 1: and D games down in the cafeteria.
Speaker 2: Ooh, so you you've done some digging here, and then
Speaker 2: the question is what cafeteria.
Speaker 3: Right, I don't know that.
Speaker 6: I don't know.
Speaker 2: OPS two has a different cafeteria than R and E.
Speaker 2: So this is for anybody who's been in the buildings,
Speaker 2: knows that there's a different level of geek.
Speaker 3: Right, are you the neck beard geek?
Speaker 2: Right it does math or are you more of like
Speaker 2: the modern cyber like there's different levels of you know,
Speaker 2: geek versus nerds. So, but you are right, it's a
Speaker 2: pretty broad spectrum from your type A personalities. I used
Speaker 2: to be a lot quieter. It turns out you can't
Speaker 2: be a very good CEO if you can't storytell. I
Speaker 2: had to learn that skill. And so what I'm talking
Speaker 2: about is all walks of life, all race, all nationality, spicy,
Speaker 2: too very timid. And it turns out some of the
Speaker 2: people that you expect, like some of the biggest badasses
Speaker 2: I ever worked with I can think of. I only
Speaker 2: had probably two or three women coworkers, but I think
Speaker 2: they had like something to prove, like they really had
Speaker 2: their whole career to prove.
Speaker 3: So some of the most competent people.
Speaker 2: I work with were actually like hardcore math and computer
Speaker 2: science women and that was sometimes intimidating. You don't have
Speaker 2: that in the physical like you know, if you think
Speaker 2: of like operator life, you guys are going to be
Speaker 2: able to drag somebody heavier most of the time, ninety
Speaker 2: percent of the time just because of like physicality.
Speaker 3: It's a little intimidating when you have someone.
Speaker 2: Five 't two crush your soul, right because they're just
Speaker 2: that much better, because this is about mental mind power
Speaker 2: and not the physicality that like testosterone and stuff separates.
Speaker 2: So I'll tell you it was a cool place to
Speaker 2: even be humbled real freaking quick, because I have a
Speaker 2: cool resume. I will tell you I still only for
Speaker 2: you know, fit in probably the top eighty percent, there's
Speaker 2: about another twenty percent who could wreck me. They probably
Speaker 2: can't communicate the same way I can, right, but from
Speaker 2: skill to skill they'll wreck me, right, And you.
Speaker 4: Know, and that's I think that is one of the
Speaker 4: interesting things about you know, like in Range of Battalion,
Speaker 4: they should say there are smart rangers and there are
Speaker 4: strong rangers, right, So you know this idea, and it's
Speaker 4: interesting that in in this cyber world and this you
Speaker 4: know that like you say, there's there's this percent that
Speaker 4: they they're their ability to interact with other humans, Like
Speaker 4: it's like it's best if they have like a translator
Speaker 4: a lot of times probably right, somebody who gets what
Speaker 4: they're saying and you know gets this.
Speaker 3: Being a true nerd.
Speaker 2: We used to call it a middleware, that a middle
Speaker 2: layer that like, okay, people that need to understand what
Speaker 2: they're talking in a translation layer between you know, geek dashk, right,
Speaker 2: do you sometimes need that?
Speaker 4: But you know, the idea that there is this place
Speaker 4: in our government security structure for these very brilliant people
Speaker 4: who again may not you know, be great at dealing
Speaker 4: with people, but they're really good at their job.
Speaker 2: And they care, which is funny, Like it's so weird
Speaker 2: when you hear about like I'm not a big polarizing
Speaker 2: fan of anything, and the reason for it is there's
Speaker 2: always something bigger, there's a bigger mission, right. I think
Speaker 2: that's a dope place though, when you're like, whoa this
Speaker 2: person that I probably on the outside would never go
Speaker 2: like drink beers with or whatever, is literally in the
Speaker 2: same trenches with me, fighting the same war. It's a
Speaker 2: again coming from military that had deployment skills, coming into
Speaker 2: the intelligence community where it comes in all shapes and forms.
Speaker 2: It was like both I said earlier, humbling, but also
Speaker 2: kind of like it definitely helped me be a better
Speaker 2: dad to understand like kids come in all shapes and
Speaker 2: forms as well, and it made me maybe a little
Speaker 2: bit more appreciative of like, you better watch out because somebody,
Speaker 2: for instance, that might not you know, be able to
Speaker 2: take me in a game of beer pong or be
Speaker 2: able to run sprints with me, might just run me
Speaker 2: under the ground because their brain is like a ten
Speaker 2: pound brain.
Speaker 6: Yeah, yeah, they'll.
Speaker 5: Turn your lights off night.
Speaker 1: I've met a few of those, those five hundred pound brains.
Speaker 1: And yeah, it's interesting you put it like that, because
Speaker 1: I thank god that there are these people out there
Speaker 1: who are so much smarter than I am, but they're
Speaker 1: also super patriotic, like they're on our side.
Speaker 5: Yeah, thank god for that.
Speaker 4: Yeah, what what is you know? Could you mentioned this
Speaker 4: this idea of this this evolution into the this attack mentality,
Speaker 4: And I'm sure that there are people who were like, well,
Speaker 4: if we have the espionage, if we have the placement,
Speaker 4: why are we gonna why are we going to attack
Speaker 4: and let them know we have the placement?
Speaker 5: But but then there are other people probably like hey.
Speaker 1: Like yeah, an espionage, there's that whole thing of like
Speaker 1: then they'll know that we know that, they know that
Speaker 1: we knowed.
Speaker 4: Right lately, what are the pros and cons of attack?
Speaker 2: Yeah, David, one of the best cases I remember, and
Speaker 2: this was again humbling, and it was more human actually
Speaker 2: than cyber. But it's the same mentality. I remember us
Speaker 2: having intel that was ID related, you know, roadside bomb
Speaker 2: type scenario and exposing the road side bomb that could
Speaker 2: save not necessarily us, but maybe like it could be
Speaker 2: second third party ally definitely civilians and if you gave
Speaker 2: that up, could prevent us from you know, at the time,
Speaker 2: it has always been lod and related. That math is
Speaker 2: like it's like I don't know, Like today I don't
Speaker 2: have I've.
Speaker 3: Been really lucky not have any form of PTSD.
Speaker 2: But the closest thing that I had was that type
Speaker 2: of scenario where you're literally measuring trade offs.
Speaker 3: In whose life is more valuable.
Speaker 2: And I'll tell you it also like when you create
Speaker 2: attack tools that you were talking about this new world.
Speaker 2: I remember the first person the first time somebody said, Okay,
Speaker 2: I appreciate you doing your work with the espionage.
Speaker 3: You don't have to create an uninstaller.
Speaker 2: And I thought, I have to uninstall my malware, right,
Speaker 2: and they said, no, don't worry, it's going to be
Speaker 2: kinetic uninstalled. That's a moment that humbled the shit out
Speaker 2: of me because you're starting to realize that, oh, because
Speaker 2: of me doing my job, just like anywhere else, bombs on,
Speaker 2: bad guys get dropped. It's kind of similar to like,
Speaker 2: you know the folks in Las Vegas that are flying
Speaker 2: drones right that still get PTSD even though they're thousands
Speaker 2: of miles away from any sort of battlefield in combat.
Speaker 2: And I didn't have anything like that, but I remember
Speaker 2: those moments that I thought, oh, I didn't gather the
Speaker 2: intelligence and people blew up that day.
Speaker 3: Like that's also like a really, that's.
Speaker 1: That's the analyst PTSD that those folks get, right.
Speaker 6: Why didn't I see that?
Speaker 5: Well?
Speaker 4: And it's like it's like when you have you know,
Speaker 4: when you have a low level uh you know, you
Speaker 4: you have this, You've identified this low level AQ guy
Speaker 4: and you're like, all right, if we roll him up,
Speaker 4: we lose access to anything he has. But if we
Speaker 4: leave him out there, he might kill innocent people.
Speaker 5: And it's that dilemma is that.
Speaker 2: And I don't think I mean, I really don't think
Speaker 2: enough actually gets talked about that because I think in
Speaker 2: the movies, right, you watch any born identity type, you
Speaker 2: just think that it's go, go go, But like people
Speaker 2: don't realize there's a lot of like calculator risk, and
Speaker 2: even worse than the calculator risks. Sometimes you just have
Speaker 2: to make a decision very quick and hope that when
Speaker 2: you're not in the black or in the white, those
Speaker 2: are easy decisions. You'll later have to hope you got
Speaker 2: it right in this like semi dark shade of gray.
Speaker 2: I just I again, I think that some of the
Speaker 2: better side of stories that will come out, Like you know,
Speaker 2: growing up, I idolize the black Hawk.
Speaker 3: Down stories and the things that were very physical.
Speaker 2: I was a big fan of like Platoon, right, the
Speaker 2: you know, the military stories that were all, you know,
Speaker 2: all testosterone. And I think the stories that probably need
Speaker 2: to come out, especially as we're starting to realize like
Speaker 2: mental health directly has a relation to like people's peak performance. Right,
Speaker 2: I don't think people normalize these things well enough. I
Speaker 2: don't think that we normalize like how much goes down
Speaker 2: like you called it the analyst trauma, right, But even
Speaker 2: just things in business, right, people forget there's like real
Speaker 2: good humans behind these things that then go home and
Speaker 2: have to like smile to their family because it's no
Speaker 2: such agency and like how is work?
Speaker 5: I was good?
Speaker 1: Yeah, yeah, yeah, speaking of that, you know, I know
Speaker 1: you had mentioned to us before the show. I think
Speaker 1: that you put some things through public review and so
Speaker 1: on to make sure they're.
Speaker 3: Yeah, good to go.
Speaker 1: Are there any like war stories from NSA that you're
Speaker 1: allowed to tell?
Speaker 2: I will tell you some of the best NSA stories
Speaker 2: that you know. The thing about NSA, right is there's
Speaker 2: a lot that can make it through pre publication. It's
Speaker 2: usually how was it collected?
Speaker 3: Who is it collected by? What the overall measurable effect?
Speaker 2: And it turns out some of the moments, like I'll
Speaker 2: tell you, like NSA stories, we were so compartmented. People
Speaker 2: don't realize how compartmented truly tailored operations are. I would
Speaker 2: like my co founders, all three of us worked NSA together.
Speaker 2: I remember we were all on different access pro none
Speaker 2: of us knew what we did, and I remember a
Speaker 2: moment I still to this day don't know if it's classified, unclassified,
Speaker 2: just completely happenstance. But all three of my co founders
Speaker 2: and I are sitting at a bar or busing and
Speaker 2: we look and it has like a country that has
Speaker 2: a nationwide internet outage, and all three of us look
Speaker 2: at each other trying to see if anybody will give
Speaker 2: a drive that no wordy breaks anything. And to this
Speaker 2: day I still don't know, did like some cable come
Speaker 2: and plugged, did they have a power outage or was
Speaker 2: this an accidental like intelligence gathering operation that took down
Speaker 2: like a core router.
Speaker 3: I still don't know to these days.
Speaker 2: Yeah, So I think those are the best stories of
Speaker 2: like not what you did. But people don't realize to
Speaker 2: truly protect secrets, you need to keep small amounts of
Speaker 2: people knowing them. And the downfall of that is I
Speaker 2: my best friends in life, I still don't know to
Speaker 2: this day they could have been directly responsible or just
Speaker 2: as clueless as I, And I think those are probably
Speaker 2: the best stories that maybe when forty fifty years gets
Speaker 2: done and people start declassifying, we'll go back and read
Speaker 2: these things.
Speaker 3: But I think that's actually.
Speaker 2: The camaraderie that I love, is the sometimes.
Speaker 1: Not knowing what are these are like SAPs that like
Speaker 1: thirty people in the entire world are revolt.
Speaker 3: All specials, you know, all the work that we did.
Speaker 2: We're special access programs, so not just only you're in
Speaker 2: a skiff, not just your top secret.
Speaker 3: But they are so limited.
Speaker 2: I mean we sometimes like if anybody's done the research
Speaker 2: on what an ODA is or an a team in
Speaker 2: the special forces world, you're talking twelve sometimes you know,
Speaker 2: twelve person teams that subdivide into six person teams. I
Speaker 2: was on programs where sometimes it was six people.
Speaker 3: That's intense when you.
Speaker 2: Like, you know, I even think to this day of
Speaker 2: like how do these stories will they ever get told?
Speaker 3: Like what if people pass? Right?
Speaker 2: Yeah, all stories need to be told, But I think
Speaker 2: nowadays there's a lot of maybe even overclassification that I
Speaker 2: learned a lot from what we used to do with
Speaker 2: like espionage in Vietnam and even during like a desert storm,
Speaker 2: desert shield, And I don't know if those stories will
Speaker 2: be told fast forward in twenty five years, because sometimes
Speaker 2: they're so limited and so targeted that people just might
Speaker 2: not be.
Speaker 3: Around to tell them.
Speaker 1: Do you think that leads to another type of stress?
Speaker 1: We talked about it a little bit. But I've kind
Speaker 1: of noticed on the military side of things, when you
Speaker 1: have these SAPs, like you mentioned, only six people on
Speaker 1: the program, there's only six people in the entire world
Speaker 1: that can do that very important job. One of them
Speaker 1: gets sick, one of them goes to you know, his
Speaker 1: wife is having a baby.
Speaker 6: Then you're even more shorthanded.
Speaker 1: I mean, does that lead to a different type of
Speaker 1: like stress, like and burnout?
Speaker 6: Really is what I'm getting at.
Speaker 2: Yeah, I think these type of things, like you're just
Speaker 2: asking people to do unnatural things. Right, if you you know,
Speaker 2: think about a sports team, right, any we just have
Speaker 2: the Super Bowl in the US, not long ago, right
Speaker 2: for NFL football, American football, there's always two or three
Speaker 2: strings of you know, quarterbacks, reivers.
Speaker 3: When you don't have that, not only do you.
Speaker 2: Have to have like that depth to be able to
Speaker 2: still get the mission done.
Speaker 3: It's just asking a lot.
Speaker 2: I actually think some of my most unhealthy work life
Speaker 2: balance was during these times where I just now look
Speaker 2: at it. You know, my company's now five hundred people.
Speaker 2: I pride not having tiny you know, people who can't
Speaker 2: do it.
Speaker 3: I call it the bus factor.
Speaker 2: Right, how many people at my company can get hit
Speaker 2: and the mission still gets going, you know.
Speaker 3: Run over by the bus. Yeah.
Speaker 2: And I actually think in some of these places that
Speaker 2: we were so small we didn't even know we were
Speaker 2: creating stress because we're having to do the jobs of
Speaker 2: not just one, but like, oh, if this falls, I
Speaker 2: better be able to do at least sixty eighty percent
Speaker 2: of that, so the mission still gets done. So I
Speaker 2: don't think I've ever heard anybody publicly talk about that,
Speaker 2: but I bet that happens. I know I felt it
Speaker 2: over extended, is what I felt.
Speaker 4: You know, the other thing in addition to that, because
Speaker 4: you've talked about post amount of stress, and you've talked
Speaker 4: about the camaraderie, but in addition to that is that
Speaker 4: you know our friends, the cammaderie that we build, those
Speaker 4: ties that bind us. When you walk out of that sat,
Speaker 4: when you get read off, you lose something with those friends,
Speaker 4: Like you can still hang out, you can still barbecue,
Speaker 4: but you know you're not going to.
Speaker 5: There are limits. Now, there's a barrier.
Speaker 4: And when you leave, especially when you leave a service,
Speaker 4: whether it's the military, the intelligence screen or whatever, and
Speaker 4: you're out in this world where there's not that purpose
Speaker 4: and the post traumatic stress or the operator syndrome and
Speaker 4: all this stuff, and now you're also isolated and you
Speaker 4: can't even really be that close to people who are
Speaker 4: your best friends. I used to be close to them,
Speaker 4: but there's but those walls go up. Once you leave,
Speaker 4: you're gone.
Speaker 2: So my co founder Chris right, he was navy, don't
Speaker 2: judge him. We now have these moments that we talk
Speaker 2: about this. We're like, why did we end up creating Huntress?
Speaker 2: And now that we're ten years in, you know, hindsight's
Speaker 2: always twenty twenty the amount of places that we were like, look,
Speaker 2: we created a place that gave us the same mission
Speaker 2: and the same fulfillment that we had, And so people
Speaker 2: now ask, like the finance people are like, oh, you
Speaker 2: got a big company, You've done these things, but they
Speaker 2: don't realize the most of the motivations. There was some
Speaker 2: very altruistic reasons, but there were some also very selfish
Speaker 2: reasons that I just had to get back into the mission.
Speaker 3: Right. It's almost like.
Speaker 2: I bet there's some sort of like dopamine hit that
Speaker 2: comes that you're addicted to. And I remember even going
Speaker 2: like there's a couple of these like local like bars
Speaker 2: and watering holes not far from NSA that you go
Speaker 2: and you catch up with your friends and you're all
Speaker 2: read out now and there's a little bit of a look.
Speaker 2: You know, nobody's going to disclose classified, but you're kind
Speaker 2: of you look at each other and you're like, okay,
Speaker 2: I can vibe you because we can. You know, we're
Speaker 2: speaking at a level that's you know, nonverbal, right, non physical,
Speaker 2: but you know you kind of just you know, you
Speaker 2: got that gut feeling you're like, okay, I can stay connected. Yeah,
Speaker 2: when I jumped into the civilian world, I felt probably
Speaker 2: as isolated and purposeless as I did. And so and
Speaker 2: what's I'm lucky, Like I've always had some sort of
Speaker 2: sexy flare. I got early cyber special Forces. I don't
Speaker 2: know how the people, like a lot of the operators
Speaker 2: will call, you know, the regular army folks legs, right.
Speaker 2: But those folks there are the folks that didn't get
Speaker 2: that sex appeal.
Speaker 3: They didn't get the intel, they didn't get it.
Speaker 2: I actually think about them a lot of what happens
Speaker 2: when you didn't have that extra high that made all
Speaker 2: this worth it, and you just were serving a mission
Speaker 2: as best as you could.
Speaker 3: And now you definitely don't have it because you don't.
Speaker 2: Like for me, when I have my high highs and
Speaker 2: then low lows, I can always go back and think, ah,
Speaker 2: that roller coaster ride was great, right, right, But what
Speaker 2: if everything was just mediocre and then you leave the
Speaker 2: service and now you're low you don't have these moments
Speaker 2: to reflect on.
Speaker 3: So I don't know.
Speaker 2: I think we're at a really interesting place where both
Speaker 2: armed services, whether it's cyber, whether it's signals intelligence, whether
Speaker 2: it's human intelligence, and just go to fashion kicking doors
Speaker 2: in I bet there's a lot on the psychological side
Speaker 2: we're going to learn now that we're becoming very aware
Speaker 2: that these things have real effects.
Speaker 3: Twenty thirty years later.
Speaker 5: Yeah, I think you're right.
Speaker 4: I mean we're already learning just on like the SOFTE,
Speaker 4: Like we're learning so much about like blast injuries, you know,
Speaker 4: all the door breaches and you know, and you know
Speaker 4: post traumatic stress, like you know, I mean, I'm fifty five,
Speaker 4: so like I remember made for TV movies in the
Speaker 4: seventies about a Vietnam veteran having post traumatic stress and
Speaker 4: losing his mind, like having flashbacks in the office and
Speaker 4: people there are still someings out there who think that's
Speaker 4: what it is, and that you know, they don't understand.
Speaker 4: It comes in all shapes and sizes, from all different
Speaker 4: types of things.
Speaker 1: One of the things the reason why I was asking
Speaker 1: you about how many tools you accessed on a daily basis,
Speaker 1: I have a acquaintance working on a PhD dissertation about
Speaker 1: what that does to a person psychologically. He was really
Speaker 1: he was pointing out that if you're a soldier, let's
Speaker 1: say you're an infantryman, you learn how to shoot an
Speaker 1: m F four M two forty Bravo machine gun, M
Speaker 1: two four nine saw three weapon systems. Maybe if you're
Speaker 1: a sniper, you have a few more weapon systems, maybe
Speaker 1: you have to earn six something like that. But people
Speaker 1: are in the cyber warfare field. You're having to learn
Speaker 1: hundreds of different tools and move between those systems, those
Speaker 1: weapon systems, if you will, on a day to day basis,
Speaker 1: And what does that do to, particularly a young person,
Speaker 1: to their mind.
Speaker 2: And I you know, obviously, you know, it's not ever
Speaker 2: worth joking about any folks that are on any sort
Speaker 2: of a spectrum because like that stuff's real. Some of
Speaker 2: us get hit, you know, in the chest, some of
Speaker 2: us get nicked with the tism, you know, yeah, I
Speaker 2: think about Like I think part of the reason we
Speaker 2: bonded so well from Cyber to some of the operators
Speaker 2: is very specifically. We all had to learn different weapon systems.
Speaker 2: Like I remember first deployment in Afghanistan. None of us
Speaker 2: are shaving everything else. Everybody's using macarovs, AK forty seven's
Speaker 2: and pkams. You don't learn that in basic training, right,
Speaker 2: you don't learn any of that type of stuff. And
Speaker 2: so like that flexibility, and I think they called it
Speaker 2: fluidity at the time, like being able to go fluid
Speaker 2: between different weapons systems on different arms. Learning the basics
Speaker 2: only gets ratcheted up to a level like I remember
Speaker 2: the guys looking and they're like, how do you keep
Speaker 2: track of what to do?
Speaker 3: And I'm like, I don't even know.
Speaker 2: Yeah, I bet there is some real like ramifications, like
Speaker 2: if somebody asked me, quantify the number of pools you've used, Like,
Speaker 2: so I joined in two thousand and three, So what
Speaker 2: would I be at I'd be I guess I would
Speaker 2: be at twenty two years of like some of this
Speaker 2: professional experience.
Speaker 5: Yeah, I don't even know.
Speaker 3: It would be thousands.
Speaker 2: It doesn't even make sense, But I bet there's somewhere that, like,
Speaker 2: if you're not on some sort of like okay with
Speaker 2: the spectrum, and I guess we're all becoming, like with scrolling,
Speaker 2: a little short minded and used to consuming a little
Speaker 2: bit more. But somewhere in there it wears on you.
Speaker 2: So I would be stoked if you actually have those resources.
Speaker 2: I would love to see someone writing the dissertation.
Speaker 6: Also, yeah, I can.
Speaker 1: I can introduce you to that dude and maybe he
Speaker 1: can get it to you when he finishes it. Well,
Speaker 1: you mentioned jumping into the private sector before we jump
Speaker 1: into that. Any final thoughts on NSA that you want
Speaker 1: to talk about before we discuss your transition into the
Speaker 1: private sector.
Speaker 2: I am, you know, if I was to end it
Speaker 2: on there, obviously I'm long removed. I don't carry a
Speaker 2: badge there anymore. But if I was to you know,
Speaker 2: end it with you know, standing on a soapbox, it's
Speaker 2: we owe a lot to folks, just like in the arms,
Speaker 2: services that are okay with be in silent professionals don't forget,
Speaker 2: you know, the typical hero doesn't always look like Jason Bourne.
Speaker 2: It doesn't look like some folks like the three of
Speaker 2: us that can articulate.
Speaker 3: It's kind of really interesting.
Speaker 2: Of like at the future of true peak performance.
Speaker 3: Brain power these days.
Speaker 2: Can actually be the equivalent of top level athlete who
Speaker 2: can bench the most weight.
Speaker 3: So I just would challenge folks to consider that.
Speaker 2: And even though I don't fit that personality for ends,
Speaker 2: I think, I, you know, next time you sit back
Speaker 2: and think about where you want to go, maybe you
Speaker 2: don't fit in the military, don't forget the opportunities you
Speaker 2: have to support you know, national security in different ways,
Speaker 2: even if you.
Speaker 3: Don't fit the mold.
Speaker 2: At least for me, I really enjoyed every bit of it,
Speaker 2: working for all the different types because I'm not a bodybuilder.
Speaker 2: I'm also not you know, quiet, and it was cool
Speaker 2: working with both sides of it.
Speaker 6: That's awesome.
Speaker 1: So what made you decide to transition from you know,
Speaker 1: your leave behind your National Guard and your NSA careers
Speaker 1: essentially into the private sector. I think you said, what
Speaker 1: you had sixteen years in uniform.
Speaker 2: Yeah, so they start thinking about that, I'm only four
Speaker 2: years away. I think I might have had one bad
Speaker 2: year in the Guard because I was a scrub, But
Speaker 2: either way, four or five years very close to like
Speaker 2: a twenty year retirement of some sorts.
Speaker 3: Gosh, you're asking me the spicy question, brother.
Speaker 2: I was pretty pretty upset by not having representation in
Speaker 2: that STU world. I was definitely part of those that
Speaker 2: felt like I had given it all. I had my kids,
Speaker 2: the amount of birthdays I had missed, the amount of things.
Speaker 3: I had given.
Speaker 2: I finally had a moment where I said, Okay, I've
Speaker 2: given all that I can. I need to use my
Speaker 2: skills to give back to a new mission. And I
Speaker 2: think I would have stayed longer if I would have
Speaker 2: had better support, because at that time I had the money.
Speaker 3: Contractor pays, no joke.
Speaker 2: You can make some pretty decent money as a contractor sometimes,
Speaker 2: you know, two two hundred and fifty thousand dollars, stuff
Speaker 2: that you usually can only get on combat pay. That's
Speaker 2: good pay, is a geek, right, Maybe not quite the
Speaker 2: same pay as like a big you know, fortune one
Speaker 2: hundred bay, but that's pretty great government services you know
Speaker 2: pay or government service is.
Speaker 3: But I didn't.
Speaker 2: I didn't have that support. I didn't feel like the
Speaker 2: mission resonated. And to be very frank, I was looking
Speaker 2: at these operations that I was supporting and people forget
Speaker 2: when you're in the military and you're doing intelligence gathering,
Speaker 2: you might be on the same computer with not only
Speaker 2: other nation states, you might be on the same computer
Speaker 2: as a cyber criminal. And so as I pour me
Speaker 2: a little bit of drink here in preparation, I guess
Speaker 2: of this segment as I I knew that there was
Speaker 2: kind of a wave, a tsunami about to come where
Speaker 2: these people were going to go from just spy verspy.
Speaker 2: It dawned on me that we were about to see
Speaker 2: the first billion dollars cybercrime groups. And in twenty fifteen,
Speaker 2: I realized, if I don't help get ahead of this,
Speaker 2: we're going to see some of our most critical infrastructure.
Speaker 2: Like don't think about just water and hospitals and you know, electricity,
Speaker 2: think of like the backbone of world economies. Your fortune
Speaker 2: five hundred, Yeah, that's dope, right, the biggest five hundred
Speaker 2: companies of the world. But the US has thirty three
Speaker 2: million businesses and the vast majority of those are twenty
Speaker 2: five hundred employee companies all the way to the smallest.
Speaker 2: And I realized that nobody was going to be able
Speaker 2: to protect them. When cybercrime said, let's not go whale hunting, right,
Speaker 2: Let's go hunting for like squirrels, rabbits and mice right right.
Speaker 3: And so you can.
Speaker 2: Imagine I'm a little bit bothered by the NSA system.
Speaker 2: I'm getting crusty, I'm missing my kids, right, I'm realizing
Speaker 2: I'm missing life. And I decided, okay, I'm going to
Speaker 2: punch Even at sixteen years, even being this close, I
Speaker 2: had a bigger calling and it was going to be
Speaker 2: protecting not just the one percent of businesses, but the
Speaker 2: ninety nine percent that fall below the enterprise.
Speaker 3: So you can imagine.
Speaker 1: Before before we jump into that, I do want to
Speaker 1: ask you to unpack a little bit the Snowden.
Speaker 3: Issue, yeah, and share share the.
Speaker 1: And you know your claim, your issue, it sounds like,
Speaker 1: was that there was no pushback against it, and so
Speaker 1: I would love to ask you, you know, to give
Speaker 1: the insider point of view. You talked a little bit
Speaker 1: about the importance of following laws and everything, but like,
Speaker 1: what would be as a intelligent professional, what would your
Speaker 1: pushback be against the snow narrative of mass ubiquitous surveillance
Speaker 1: against the American and.
Speaker 4: And the like the argument that he was just a whistleblower.
Speaker 5: Right, yeah.
Speaker 3: Yeah, So we'll break those in two different parts.
Speaker 5: Right.
Speaker 2: The first one is people fuck up. Let's call a
Speaker 2: spade a spade. Anybody can do it. I am not
Speaker 2: a fan of having my personal data leaked by any
Speaker 2: or snooped on by anyone, just the same way at
Speaker 2: Defcon when I would happily call spot the FED against.
Speaker 3: An FBI agenty same guy.
Speaker 5: Yeah.
Speaker 2: So people don't realize sometimes these government agencies collab and
Speaker 2: when you get it wrong. From everything that I've come
Speaker 2: to read in the public news, it sounds like some
Speaker 2: pretty jacked up stuff that should have been fixed. It wasn't,
Speaker 2: by the way, NSA's first mistake. If you go back
Speaker 2: to like the Pike Church Committee type stuff. This is
Speaker 2: not the first time a government agency has done dumb stuff, right,
Speaker 2: But accidents happen, right, and to be able to call like,
Speaker 2: you know, anybody you know, paint with a broad brushstroke.
Speaker 2: I was really surprised to hear some of the people
Speaker 2: that they don't realize. The average Joe does not realize
Speaker 2: how much terrorism, how much abuse of money, and how
Speaker 2: much kind of like world projection, all of our agencies
Speaker 2: do to like keep the daily freedoms we have and
Speaker 2: then to get roasted in the news by and again
Speaker 2: I'll toe the line on this really closely.
Speaker 3: Edward Snowden was an IT administrator.
Speaker 2: Edward Snowden did the good thing that any person, for instance,
Speaker 2: could do, which is, if you find something that is
Speaker 2: truly illegal, you should file an IG complaint and get
Speaker 2: that shit to attention. And if somebody ignores you, you should
Speaker 2: do the most safe version.
Speaker 3: Of whistleblowing right, go to Congress.
Speaker 2: When twenty forty drops, we will see a narrative that
Speaker 2: is very different, and I'll leave it at that, and
Speaker 2: it's one of those that it doesn't match any narrative
Speaker 2: of a Roger Stone film or if I got that
Speaker 2: wrong right, some.
Speaker 3: Of the movies that were on this.
Speaker 2: He's an administrator that if you you know, when the
Speaker 2: actual cards spill and the proof comes out, you'll see
Speaker 2: it's not a hero, a hero in the sense that
Speaker 2: he challenged good things.
Speaker 3: I'm not going to take that away.
Speaker 2: But there's more to any story, and I can't wait
Speaker 2: for that one to become public. And that's as somebody
Speaker 2: who like, maybe from me to you, I left my
Speaker 2: whole career behind because I was so bothered by the
Speaker 2: bigger story not coming out. So I'm hoping, and remember,
Speaker 2: any president can declassify this type of stuff. I hope
Speaker 2: we see some of these come public, but I don't know,
Speaker 2: like it doesn't. Some of these stories don't become public.
Speaker 2: And so on my end, it was enough that it
Speaker 2: bothered me that me and enough people to come up
Speaker 2: with an acronym called stemmeradge left.
Speaker 5: Yeah.
Speaker 4: Yeah, and you know, I have no personal inside knowledge
Speaker 4: of that, but my like the way I see it,
Speaker 4: like we can say whistleblower, I you know.
Speaker 5: The guy had.
Speaker 4: I think the guy got like, I don't think he
Speaker 4: knew what he had. He got lucky that there happened
Speaker 4: to be something that was, you know, sort of like
Speaker 4: implicating the US government, but he was really just you.
Speaker 2: Don't you don't accidentally fly to China and then accidentally.
Speaker 5: And right exactly exactly exactly. Yeah.
Speaker 1: And I think the other thing to point out is
Speaker 1: that he didn't just take documents or below the whistle
Speaker 1: on documents about like prism that was the big the
Speaker 1: metadata issue. He took everything from what I understand, he
Speaker 1: took everything.
Speaker 2: Yeah, yeah, yeah, anyway, so you're you're we're right there,
Speaker 2: we're on that knee, respecting like my career and respecting
Speaker 2: that on to end up in handcuffs. But you know,
Speaker 2: when something's a problem, you raise the problem and cause
Speaker 2: the minimal damage as possible. Yeah, if, for instance, you
Speaker 2: are creating maximum damage as a plan to keep you
Speaker 2: out of jail, if what you were doing was ethical
Speaker 2: from the get go, Don't get me wrong, there are
Speaker 2: plenty of cases where good whistleblowers.
Speaker 3: Have been hung to dry. I know this is the gray.
Speaker 2: This isn't black, this isn't white, it's the gray. But
Speaker 2: when the details come out, I hope that these things
Speaker 2: are settled that call a spade is spade, call it
Speaker 2: for all the good, and what I believe will be
Speaker 2: interpreted is all the bad will finally come to roost
Speaker 2: and we'll see like, okay, there's you know, life is complex,
Speaker 2: and I guess you know.
Speaker 3: The biggest thing that I appreciate.
Speaker 2: It seems like that moment actually caused a lot of
Speaker 2: the intelligence communities to realize if they don't have a
Speaker 2: say in the narrative, the narrative will be formed around them,
Speaker 2: and that has consequences.
Speaker 3: Right, right, and not everything's bad is what I'm saying.
Speaker 5: And the problem with.
Speaker 4: That is is is that one it hurts recruitment to it,
Speaker 4: you know, the the public sentiment, which you know may
Speaker 4: or may not matter, but the public sentiment you know
Speaker 4: about you know, these nefarious organizations that are listening to
Speaker 4: our every phone call, Like how many people have to
Speaker 4: work at the NSA to listen to my every phone
Speaker 4: call I make?
Speaker 5: Right?
Speaker 4: Or you know the CIA also, you know, they're they're
Speaker 4: just all over the world, you know, creating coups and
Speaker 4: stuff like that. And it's it when these agencies won't
Speaker 4: stand up for themselves, it hurts them, you know, Yeah,
Speaker 4: it hurts their recruiting, It hurts their their efforts.
Speaker 5: Yeah.
Speaker 2: Yeah, So again I'm I I'm one of those type
Speaker 2: of people that, like, I don't believe you should sit
Speaker 2: on a fence, you should have an opinion, but I
Speaker 2: also acknowledge, like it's not always left or right or
Speaker 2: you know that side or this side right. Some stuff
Speaker 2: is the devil in the details and you can kind
Speaker 2: of only help, you know, and hope that at the
Speaker 2: end you chose the best things. So if you can
Speaker 2: tell enough for me to upend forego retirement and say,
Speaker 2: I appreciate my service, I need to use my skills
Speaker 2: for some other reason, and thankfully like the Service Army
Speaker 2: to be able to do some pretty cool stuff. So
Speaker 2: I can't be completely salty about Edward Snowden, but I
Speaker 2: am ready for the reckoning.
Speaker 1: Yeah yeah, So talk to us about making the jump
Speaker 1: to the private sector and how that worked out for you.
Speaker 3: Can I tell the embarrassing embarrassing.
Speaker 1: Side, absolutely, because all of us have that story about
Speaker 1: leaving governmental service and going into the private sector and
Speaker 1: slamming face first into the ground at least once.
Speaker 2: So all the stuff that made me like successful, right, promotions, early,
Speaker 2: you know, awards, things along those lines. When you decide
Speaker 2: to create a business, you have to go into sales,
Speaker 2: and it turns out I did not have to do
Speaker 2: much sales in the military. You guys would be so
Speaker 2: like disappointed if you, like I've it ever leaked like
Speaker 2: some of my first cold calls and stuff like this,
Speaker 2: I sounded like a dumbass military guy.
Speaker 3: I was at least hat honest, like I think guys.
Speaker 3: The pitch usually went.
Speaker 2: Something like, Hi, my name's Kyle, and I'm a former
Speaker 2: service member and I'm exploring creating a startup, Do you
Speaker 2: have a couple of minutes to like help me, like
Speaker 2: I need help? Like I was always really honest, and
Speaker 2: I found that if I was more honest that people
Speaker 2: wouldn't hang up on.
Speaker 3: Me as much.
Speaker 2: And usually I'd find somebody that was either prior service
Speaker 2: or respect the service. It would give me a little
Speaker 2: bit of time. But Guys, you wouldn't believe, Like when
Speaker 2: I started, I started thinking like I was going to
Speaker 2: be selling to like one or two person companies. Think
Speaker 2: about how many one or two like these little tiny
Speaker 2: micro businesses.
Speaker 3: That are still important. But I didn't know how to
Speaker 3: make money.
Speaker 2: I knew, like how to personally make money and pay bills,
Speaker 2: but I didn't know how to do this at scale.
Speaker 2: And so I am so stink and lucky that like
Speaker 2: the State of Virginia did this program.
Speaker 3: They call it an accelerator. It's pretty much like an MBA.
Speaker 2: In sixteen weeks that teaches you how to build a startup.
Speaker 3: Guys, if I didn't have that.
Speaker 2: Program, one, I wouldn't be celebrating at whatever it is
Speaker 2: now two billion dollar business. But I sure as heck
Speaker 2: I wouldn't have Like I would still be living in
Speaker 2: Maryland in my three bedroom townhouse, thinking about how I
Speaker 2: could use military my military skills.
Speaker 5: It was that bad.
Speaker 3: Yeah, I'm cool. Now I can do these things.
Speaker 2: Now I can pitch confident and I can get over
Speaker 2: like the apost syndrome. But twenty fourteen, twenty fifteen, twenty sixteen,
Speaker 2: these were like my puberty years that I'm just glad
Speaker 2: that there wasn't more camera phones at that time.
Speaker 4: It was that embarrassing what you know, And I think
Speaker 4: that's very common for you know, people who are good
Speaker 4: at something and and all business is sales, right, so
Speaker 4: it's like or like I can make these The acumen
Speaker 4: is yeah I can, or I can make this table,
Speaker 4: but be like the table doesn't sell itself, and I
Speaker 4: don't know how to run the business.
Speaker 5: In addition to.
Speaker 4: Sort of that type of thing, though, how was it
Speaker 4: difficult for you to articulate too a two person business
Speaker 4: who what they know about the Internet is you know,
Speaker 4: plug it, you know, having the cable guy come out,
Speaker 4: plug it in, and you know, to try turning it
Speaker 4: on and off, and you're trying to explain to them
Speaker 4: how their business is potentially at risk of getting ransomware
Speaker 4: or speaking hyper gee right.
Speaker 2: I mean to be honest, I think all careers have this.
Speaker 2: I bet if a firefighter, right, I'm trying to choose
Speaker 2: something that's not that's technical but not too technical. Imagine
Speaker 2: a firefighter having to talk about all the physics things
Speaker 2: that you can smother a fire by spraying, for instance,
Speaker 2: and causing different vacuum Like, no one is going to
Speaker 2: understand that. Must They've seen a video that was me
Speaker 2: in the cyber world talking to people that were just
Speaker 2: like Kyle, I know you have the skills, but if
Speaker 2: you can't learn to talk to me and storytell to
Speaker 2: me on my level, I'm never gonna appreciate what you're doing.
Speaker 3: And thankfully, like the one gift.
Speaker 2: I got was I got a lot of radical candor,
Speaker 2: meaning people who I also got like what some people
Speaker 2: call ruinous empathy, meaning they cared so much about me,
Speaker 2: but weren't willing to challenge me, right, they would just
Speaker 2: not tell me that I suck. Thankfully, it was actually
Speaker 2: a lot of either people that were fan of the
Speaker 2: military or support of the military or prior service that
Speaker 2: would just tell me a spade is a spade and
Speaker 2: be like, Kyle, you suck. I don't know what you're saying,
Speaker 2: can you talk to me, like like tell me, like
Speaker 2: I'm five, what you're doing and enough stumbling by the way,
Speaker 2: like I would rather not fail.
Speaker 3: It's just faster.
Speaker 2: But it turns out if you're going to fail, do
Speaker 2: it really quick and people give you. And so again
Speaker 2: I just was blessed with failure and I had the
Speaker 2: time to, by the way, like this was real early,
Speaker 2: so I got those out of the way. So when
Speaker 2: it came time for me really needing to know this,
Speaker 2: all that military skills of being used to like in
Speaker 2: this fast failing environment, just like a hacker trying to
Speaker 2: break in. Yeah, nine and ninety nine times I fail.
Speaker 2: I don't care. It works on the thousand. That mentality
Speaker 2: helped me. Actually, my hacking skills literally help me be
Speaker 2: a better entrepreneur.
Speaker 5: That's phenomenal.
Speaker 8: The you know Udulu you know, yeah, yep, yeah, it's
Speaker 8: funny you uh so one of our sponsors, I'm going
Speaker 8: to say it because I like the company.
Speaker 5: I like their product.
Speaker 4: What Manscape used to sponsor us, and it's a great company.
Speaker 4: And even though I don't sponsor us anymore, I'd recommend
Speaker 4: everybody get one, but they'd send us copy and we
Speaker 4: see this a lot in copy right that the copy
Speaker 4: like it mentioned like how many RPMs this motor runs
Speaker 4: at the little mansket motor.
Speaker 5: And I'm reing this just like nobody nobody cares about that.
Speaker 2: Actually, that scares me when I if I'm even my junk, right,
Speaker 2: I want to know how many RPMs. I know that
Speaker 2: the guard isn't gonna right, That's what I want to.
Speaker 5: Know, right, you know.
Speaker 4: And and it's like, but it's that type of thing
Speaker 4: that somebody, some engineer who is very proud of getting that,
Speaker 4: you know, the RPM off like got to add this,
Speaker 4: and nobody said, we don't need to add that.
Speaker 2: I mean, that's that's unlocking my fear. I will tell
Speaker 2: you I would.
Speaker 3: There was this analogy my first sale, very first sales
Speaker 3: guy told me. He called it painting Seagulls.
Speaker 2: It was this idea like imagine you've got a beautiful
Speaker 2: family on a beach and they asked you to do
Speaker 2: a portrait. So David, you're you're you're just painting this
Speaker 2: portrait and you're like, man, this sky is missing something.
Speaker 2: I'm going to add some seagulls. That moment right there,
Speaker 2: you are inserting risk. You don't know, maybe that wife
Speaker 2: is terrified as seagulls attacked her when she was six.
Speaker 2: The amount of like sales objections I would immediately add
Speaker 2: by thinking I was being so transparent, right, and I
Speaker 2: wanted to have integrity, I was terrible. I could never
Speaker 2: even get, like in the OODA loop, to the point
Speaker 2: that I was deciding and acting because when I was
Speaker 2: trying to observe an orient and edge kate like, I
Speaker 2: never even got to this point. And so I ended
Speaker 2: up having to learn from my lessons really the hard
Speaker 2: way of how many I just often would add so
Speaker 2: much information that I had sold myself out of the
Speaker 2: deal that if I would have just shut up right right,
Speaker 2: don't tell me about the RPMs next to something that
Speaker 2: I care about. I just want to get the job
Speaker 2: done right.
Speaker 5: So you know you're dealing with you're dealing.
Speaker 4: With like the business side of this with with you know,
Speaker 4: civilians who have a risk. Was there any side of
Speaker 4: the NSA or the military that ever looked at you
Speaker 4: and said, what.
Speaker 5: Exactly are you doing with this business?
Speaker 4: And can you assure us that it in no way
Speaker 4: relates to anything that you were doing with us?
Speaker 2: So I had a little bit during the National Guard
Speaker 2: side where they look. We definitely had to deconflict to
Speaker 2: make sure, Like there's always this problem of like what
Speaker 2: if we as a company find us tradecraft right right right,
Speaker 2: would you burn us tradecraft? I am an elitist, very
Speaker 2: hyper competitive bastard. So my rule of thumb is, I
Speaker 2: don't care who you are if you're weak enough for
Speaker 2: me to.
Speaker 3: Catch you right back harder. Yeah, and that gets around that.
Speaker 2: But I will tell you for a little while, there
Speaker 2: was actually some of that conflict. Like I left the
Speaker 2: service I think in twenty eighteen, but I found a
Speaker 2: Huntress in twenty fifteen, and I had to navigate that
Speaker 2: for about three years.
Speaker 1: Yeah, Ken, you know, you told us a story about,
Speaker 1: you know, falling flat on your face and trying to
Speaker 1: pitch these little businesses and.
Speaker 6: And out working out so great.
Speaker 1: But could you tell us about like the success story,
Speaker 1: a little bit of the aha moment closing your first
Speaker 1: big deal and you know how that came about lessons
Speaker 1: learned from that.
Speaker 2: Yeah, I'm going to give the pitch that I used
Speaker 2: to raise one hundred and fifty million dollars and then
Speaker 2: translate how that pitch happened, and I'll do it very succinct.
Speaker 2: So what I learned from my time at NSA, we
Speaker 2: were a team that believed in using very small compartmented
Speaker 2: teams an insane amount of automation to deliver value. The
Speaker 2: value at that time at NSA was largely finding intelligence
Speaker 2: against our foreign adversaries or saving life in the counter
Speaker 2: terrorism mission. At Huntress, I went and took that same
Speaker 2: very small compartmented teams. I use so much automation to
Speaker 2: be able to bring this product to people that don't
Speaker 2: have the budgets. And the thing we obsess about at
Speaker 2: Huntress is a very small but measurable, valuable thing that
Speaker 2: prevents people from getting wrecked by hackers. That pitch took
Speaker 2: me like nine years to get right. I'm ten years
Speaker 2: into it. That's how new this pitch is. What it
Speaker 2: turned out that I ended up learning is I had
Speaker 2: to get so simple.
Speaker 3: I had to be able to speak in analogies.
Speaker 2: I had to learn that people like to hear the story,
Speaker 2: but they don't sometimes need to hear the seagull in
Speaker 2: the depths. And I iterated on that pitch so freakin' long.
Speaker 2: I think it literally took me four years before I
Speaker 2: had a version of our pitch that actually like resonated
Speaker 2: to the point that people were.
Speaker 3: Giving me cash. So you can imagine, just like.
Speaker 2: The cybersecurity mission I mentioned earlier, it's not like the movies.
Speaker 2: It's usually like months and weeks of like gruesome you know,
Speaker 2: hard work to get two minutes of like success.
Speaker 3: And then you're back at it.
Speaker 2: That prepared me for all the failures that I'll tell you,
Speaker 2: like grit matters. Also, what's that country music selling? Get
Speaker 2: to know when to hold them no wheen to fold.
Speaker 5: Them by Kenny Rogers.
Speaker 3: There you go.
Speaker 2: I was probably foolish enough that at times I probably
Speaker 2: should have folded them, but that grit actually allowed me
Speaker 2: to see it through. So I can't tell you there's
Speaker 2: anyone path for anybody, but for me, I was so
Speaker 2: obsessed by just delivering a.
Speaker 3: Small little bit of value. And we used to do this.
Speaker 2: By the way, in the intelligence world, you don't got
Speaker 2: to get bin laden get this. You know small person
Speaker 2: in AQ right, you know some sort of al qai
Speaker 2: to type personnel that allows you to go to the
Speaker 2: next level, that allows you to go to the next level,
Speaker 2: that that allows you to find family that allows you
Speaker 2: to be able to do the DNA swab, that allows
Speaker 2: you to be able to get into the phone, that
Speaker 2: allows you to find the court courier, that allows you
Speaker 2: to be able to have a team that drops bombs
Speaker 2: on bad guys or breakstores, kicks them down and eliminates terrorists.
Speaker 2: Those were all very small iterative moments, but they all
Speaker 2: built on each other. Right, I don't think people appreciate
Speaker 2: how much you can do that involves small iterative successes.
Speaker 2: Instead of it, we would have just went ten years
Speaker 2: to hatch the master plan, Ben Laden would still be
Speaker 2: alive today. Right, I don't think people are okay with
Speaker 2: that idea. And the one thing I would share with
Speaker 2: the audience that turns out like it's better to not fail.
Speaker 2: But if you're going to fail, fail in a way
Speaker 2: nobody else has done before, and do it quick.
Speaker 5: Yeah, And here's kind of a question for you.
Speaker 4: Like obviously in coding or like not coding, but like
Speaker 4: in hacking or whatever, you probably know when you fail,
Speaker 4: like when you don't get entry, but like in business,
Speaker 4: with these ideas, how how do you know when you failed?
Speaker 5: And how do you know when to keep on? Like pushing.
Speaker 3: I'm giggling, because when you pitch somebody in real life,
Speaker 3: especially like me who's used to this little like you know,
Speaker 3: even Cyber was fairly hyper masculine.
Speaker 2: People only code. It's a lot of dudes, military, a
Speaker 2: lot of dudes. I remember the first time pitching a
Speaker 2: woman CEO and she was like, I have no idea
Speaker 2: what you're talking. I could see it across her face
Speaker 2: before she was even kind enough to tell me, like,
Speaker 2: if you don't have that social awareness and I'll say
Speaker 2: other parts of it, when I started like if I
Speaker 2: missed that social c to be honest, if I was
Speaker 2: like some of my other NSA compatriots and I didn't
Speaker 2: have that, Like it's not just about IQ. Sometimes the
Speaker 2: intelligence right only goes so far and the emotional quotient.
Speaker 5: EQ picks up right.
Speaker 2: If you can't read a room, I dare you to
Speaker 2: start a company and then look back in two years
Speaker 2: and find success, it's just not gonna happen. But I
Speaker 2: was kind of blessed enough with that like middle of
Speaker 2: skills that even when I didn't have it, Like my
Speaker 2: co founder John, he is the quietest guy in the
Speaker 2: room and we'll wreck you. But he couldn't do what
Speaker 2: I do and my co founder, Chris, there's three of us.
Speaker 2: He is when some people talk about what one engineer
Speaker 2: can do, Chris is like a whole He can do
Speaker 2: what one hundred engineers can do. We offset our balances.
Speaker 2: But you remember that whole conversation we brought up earlier
Speaker 2: about like team dynamic and sometimes having the right team,
Speaker 2: and we have to be able to cover each other's
Speaker 2: gaps but also compliment each other's gas. These skills turn
Speaker 2: out like you can change worlds. You can build billion
Speaker 2: dollar companies on the same tactics that six person military
Speaker 2: units or six person intelligence units can do. So I
Speaker 2: just if you can't tell, like my military time was
Speaker 2: pivotal to team me up to make a big difference.
Speaker 4: You know, it's interesting too, because you have a team.
Speaker 4: You built a business with a team, And I think
Speaker 4: a lot of veterans go out there to build business
Speaker 4: by themselves and are very dissatisfied even if they're successful,
Speaker 4: because we're used to working in those team environments and
Speaker 4: when we're out there on our own, it's like, I
Speaker 4: I mean, I'd rather like, who's my team? You know,
Speaker 4: my employees are they my team? Like I think that that.
Speaker 5: Must have been in my mind. I think that that
Speaker 5: must have been very gratifying for the three of you.
Speaker 2: I mean, think about the use of the word team,
Speaker 2: team room right, my team, my teammates. I actually think
Speaker 2: a lot of the starts with good old fashioned psychology.
Speaker 2: I don't think we realize, like I know there's all
Speaker 2: these corny you know, there's no I in.
Speaker 3: Team corny or not.
Speaker 2: I actually think some of these things that if you
Speaker 2: get them right from the beginning, they just get your
Speaker 2: head right. Yeah, they help you think about that. Like
Speaker 2: there's like that old African prov or. I think it
Speaker 2: goes something like, if you want to go fast, go alone.
Speaker 2: If you want to go far, go together. There's nothing
Speaker 2: wrong with going alone. There's nothing wrong with starting a
Speaker 2: very small business and a lifestyle business that can still
Speaker 2: make big differences. But if you want to move mountains,
Speaker 2: you want to go far, you are not going to
Speaker 2: get there. You could be the greatest cyber warfare operator
Speaker 2: or greatest grunt or greatest pilot or whatever you do,
Speaker 2: you're going to be able to.
Speaker 3: Move what one X does.
Speaker 2: And I will tell you, like I now have the
Speaker 2: point where I think I'm in US Canada UK, Australia,
Speaker 2: New Zealand right some Ireland in there too. I've got
Speaker 2: five hundred plus teammates and we move not just paddling
Speaker 2: in the same direction, but we're in the same boat,
Speaker 2: in the same direction at the same cadence, and that.
Speaker 3: Allows us to go both fast and far.
Speaker 2: So I think the word team and team room actually
Speaker 2: has a lot more to do with success of just
Speaker 2: getting that right in the beginning, and if you get
Speaker 2: it wrong, I just would challenge, like, how far can
Speaker 2: you go?
Speaker 3: Solo?
Speaker 4: So let's I want to ask you about Huntress, uh
Speaker 4: real quick, because you know my vast time, the whole
Speaker 4: eight months that I was in cyber like, Huntress is
Speaker 4: a name like it is, it is a name that
Speaker 4: is known in the community. You know, people outside of
Speaker 4: the community may not have heard of it, you know,
Speaker 4: may or may not, but it's like it's known.
Speaker 5: What are you? What is Huntress? What? What was your
Speaker 5: original mission? Has that morphed?
Speaker 3: Yeah? Why we start with the embarrassing?
Speaker 5: Why started with a badass? Is what I want to know.
Speaker 5: Why are you guys so bad ass? Yeah?
Speaker 2: Yeah, we started with a mission that we were like
Speaker 2: all we want to do is fuck a packers. That's
Speaker 2: not a good mission statement, by the way, don't start
Speaker 2: a company on that mission statement. But it was a
Speaker 2: good north star. It told us like what we were there.
Speaker 2: It ended up becoming a mission statement that was we
Speaker 2: had to figure out who we were doing it for
Speaker 2: and how we were doing it right, that's the why.
Speaker 2: Start with why, move to how and who, and then
Speaker 2: finish with what. So at Huntress, our whole mission is
Speaker 2: to elevate mid sized businesses, small businesses, and these folks.
Speaker 3: That don't have a budget.
Speaker 2: We do that by leading with education and community, and
Speaker 2: we end up delivering this one hacker at a time.
Speaker 2: That's a double entendre talking about taking down one hacker
Speaker 2: at a time, but we also do that growing one
Speaker 2: ethical hacker at a time. Notice nothing in there talks
Speaker 2: about making money. Nothing in there talks about making cybersecurity tools.
Speaker 2: We just happen to build cybersecurity products. Our whole mission
Speaker 2: is to elevate people that are underrepresented in business. Because
Speaker 2: cyber criminals love direct small businesses that are underrepresented. They
Speaker 2: extorre them for twenty fifty hundred thousand dollars and that's
Speaker 2: usually enough that you can't run payroll for six weeks. Right,
Speaker 2: How many Americans can go six weeks without pay? Not
Speaker 2: very many. It's really really low, unfortunately. And the part
Speaker 2: that I'm talking about is when you get your mission
Speaker 2: right and you start with the real why, everything else
Speaker 2: falls in place, that one hacker at a time, it
Speaker 2: turns out we realize that if we lead with education,
Speaker 2: growing other hackers to be able to join our mission,
Speaker 2: and doing it with a community, not by ourselves, we
Speaker 2: could go far.
Speaker 3: And so like what I do is I sell security products.
Speaker 2: Products that allows my shady team of hackers that if
Speaker 2: anybody tries to get in, whether it's your computer, your
Speaker 2: digital identity like your Google or Microsoft account, maybe it's
Speaker 2: trying to get into your data, we're not only going
Speaker 2: to prevent them from getting in, but when they do
Speaker 2: get in, we wreck them. Right, that's the whole idea.
Speaker 2: And it's not perfect, just like health, you can get sick.
Speaker 2: But notice what I'm talking about is it started with
Speaker 2: a mission. Everything else the stuff that we do afterwards,
Speaker 2: building it, how we do it, that's the minutia. And
Speaker 2: I think that's what I like most about hanging with
Speaker 2: you guys, is you guys expose stories for the mission first,
Speaker 2: and it turns out everything else can fall in place
Speaker 2: and you can learn it. You know, after ten years,
Speaker 2: I can sound crisp because I iterated with small successes
Speaker 2: and I can eventually take down much bigger targets. So
Speaker 2: if you can't tell, I owe a lot to what
Speaker 2: I learned during my time in the service.
Speaker 5: Yeah, it's it's amazing, you know.
Speaker 4: So the cyber community is it's very interesting because you
Speaker 4: have the government.
Speaker 5: You have the government that is working on you know.
Speaker 4: These uh you know national nation uh actress you know
Speaker 4: uh threats.
Speaker 2: Yeah, nation state adversaries, stuff like that, advance threats.
Speaker 4: Yeah, yeah, and then you know, you then you have
Speaker 4: a bunch of security companies and then you have like
Speaker 4: you say, these these companies that can't they're not going
Speaker 4: to have a couple of you know, uh cybersecurity guys.
Speaker 4: They're not going to have you know, they're not they
Speaker 4: don't have these things and and a lot of the
Speaker 4: tool out there or out of reach for them. But
Speaker 4: they are also the ones who get hit often and
Speaker 4: you know, and so they get ransomwared. Then they have
Speaker 4: to hire a DFI our team, and the DFI our team, well,
Speaker 4: they hire lawyers, and the lawyers get to deal out
Speaker 4: because the lawyers are basically like, this is this is
Speaker 4: your exposure, Like, this is the risk that these people
Speaker 4: might sue.
Speaker 5: You, you know, the people, your clients or whoever.
Speaker 2: Yeah, you're in business to make money, right, you got
Speaker 2: to limit your liability.
Speaker 5: Yeah, yeah, and you know.
Speaker 4: And then with the forensics teams, these are civilian.
Speaker 5: Companies that are being paid by these you know.
Speaker 4: To find what to find really one thing, and that
Speaker 4: is what is the company's exposure, right, and maybe do
Speaker 4: some ransomware negotiations. But they're not paid the hourly to
Speaker 4: go in and find out the code or the who
Speaker 4: the actor was. And and so a lot of these
Speaker 4: DFIR teams are actually on the cutting edge of like
Speaker 4: seeing a lot of these thread actors for the very
Speaker 4: first time, but they're not setting that off anywhere because
Speaker 4: they're not getting paid the hourly to do it. So
Speaker 4: you have this really like disconnected community in a way
Speaker 4: of where because the national security it all plays like
Speaker 4: a lot of these thread actors are part or at
Speaker 4: least not necessarily sponsored by but maybe like giving permission
Speaker 4: by nation state.
Speaker 2: Actors loosely supported, loosely connected when it's favorable. You know, Hey,
Speaker 2: I don't want to do something as a nation, why
Speaker 2: don't I allow this slightly shady proxy that I get
Speaker 2: permission to do it on my behalf because my hands
Speaker 2: are clean.
Speaker 3: You're nailing it.
Speaker 4: But if one of these DFI R companies like comes
Speaker 4: across or is in chat with a brand new thread
Speaker 4: actor that nobody has seen before, they're not reporting that
Speaker 4: to anybody because that you know, they're they're being build
Speaker 4: hourly or they build hourly, and they're just going to
Speaker 4: give these attorneys in these companies what they ask for.
Speaker 4: And so it's sort of like, how does the government
Speaker 4: incentivize these smaller companies to to you.
Speaker 5: Know, to pump this information up?
Speaker 4: And then should the government or state governments pay companies
Speaker 4: like yours uh to cover everybody in order to you know,
Speaker 4: basically as part of the infrastructure of our country.
Speaker 2: We all have bias, and I'm going to show my
Speaker 2: cards first. I'm a big fan, for instance, of there
Speaker 2: is great places where the federal government should intervene. Sometimes
Speaker 2: local government that's closest to you should be able to help.
Speaker 2: I will also share that I'm a firm believer we
Speaker 2: all have an obligation to take care of each other.
Speaker 2: It's just kind of what's got us to be humans
Speaker 2: in twenty twenty five. I'm giving that upfront because I
Speaker 2: want to like caveat that. There is some places, for instance,
Speaker 2: the government's job is to facilitate and allow companies to
Speaker 2: be able to go toe to toe with cybercrime, to
Speaker 2: go toe to toe with terrorism. But we don't need companies,
Speaker 2: for instance, being vigilantis. Imagine if we just allowed like
Speaker 2: the local person to provide security at the I don't
Speaker 2: know bank.
Speaker 3: You don't want that.
Speaker 2: You need some level of professionalism, some level. Heck, the
Speaker 2: person who cuts my hair has to go through a certificate.
Speaker 2: I want the person guarding the bank to go through
Speaker 2: some bar I don't want a vigilane right.
Speaker 3: But where I'm going with this is their job is
Speaker 3: to be able to enable this.
Speaker 2: Just like the story I told earlier that when the
Speaker 2: early days of cyber kind of as it started to
Speaker 2: mature into twenty ten to twenty fifteen, the real heroes
Speaker 2: were the lawyers who allowed us to do more of
Speaker 2: this preparation of the environment right to be able to
Speaker 2: do the effects that could actually stop terrorism or stop
Speaker 2: nation states I actually think the role that we have
Speaker 2: right now in twenty twenty five in the government, and
Speaker 2: this is global.
Speaker 3: I'm not making it about the US.
Speaker 2: Some of it is about facilitating companies that are of
Speaker 2: the right qualification and the right standard. Why are we
Speaker 2: not doing more to take defense and not lead by
Speaker 2: defending waiting for them to break down our door?
Speaker 5: Right?
Speaker 2: But if they're qualified people, and I'm not saying spin
Speaker 2: up vigilantis, there's going to be people who interpret this wrong.
Speaker 4: But private qualified maybe qualified letters of mark, cyber letters
Speaker 4: of mark.
Speaker 2: I mean, I'll tell you Huntress itself, two billion dollar company,
Speaker 2: at the risk of, you know, liability when we find,
Speaker 2: for instance, a threat actor who is just for instance,
Speaker 2: a lot of times people come to us after they're
Speaker 2: already hacked, not before we try to prevent it. When
Speaker 2: somebody comes to me that they're hacked and I find
Speaker 2: that this cyber criminal has stolen their data, These I'll
Speaker 2: call them what they are, bastards accidentally leave their credentials exposed,
Speaker 2: just like how we get credential I would be a
Speaker 2: liar to say it is not. You know, I could
Speaker 2: count on more than one hand the times that, for instance,
Speaker 2: we said oh, they left their credentials exposed. We took
Speaker 2: a look at the risk. We realized it was some
Speaker 2: shady hosted server and insert shady country here, that you
Speaker 2: have quite a good idea that it's malicious. We have
Speaker 2: been more than happy to rendition that data back for somebody.
Speaker 2: We have been more than happy to dump their logs,
Speaker 2: and more than happy that when we find a mistake
Speaker 2: that they make they use software vulnerabilities to get into
Speaker 2: people's systems. We have actually found vulnerabilities in the same
Speaker 2: systems that they used to steal and encrypt and hold
Speaker 2: data for ransom, that we exploit their system and make
Speaker 2: their software no longer work. That is not always in
Speaker 2: an area that's clearly defined. I'm not talking about hacking
Speaker 2: them back. I'm talking about using our offensive skills sometimes
Speaker 2: to be able to make their software not work. And
Speaker 2: the thing that I would go back to without ever
Speaker 2: getting political, sometimes you can make a big difference by
Speaker 2: just carrying a big stick, right, And if you have
Speaker 2: a defensive company that's led with a very offensive mindset
Speaker 2: that also believes in following rule of law, who is
Speaker 2: happy to explore not just the black and the white,
Speaker 2: but the gray. I think it's government's job to facilitate that,
Speaker 2: and when lines are crossed, let's hold people accountable. We
Speaker 2: can't do illegal things. We all have to be accountable
Speaker 2: for our actions. But I do think that version is
Speaker 2: a lot easier version that we can let capitalism do
Speaker 2: its thing. Let's let businesses protect against hackers, but let's
Speaker 2: not think about healthcare. If my only job was I
Speaker 2: wait till you get stage four cancer, tell you like,
Speaker 2: let you know you're gonna die.
Speaker 3: That's too late.
Speaker 2: Well, I got to be doing everything I can to
Speaker 2: find it as early as possible, and if I can,
Speaker 2: if I can possibly stop cancer from happening, no one
Speaker 2: would say, don't do that. So why are we not
Speaker 2: making similar analogy about stopping thread actors and treating them
Speaker 2: like what they are. They're criminals and they should be stopped,
Speaker 2: and that sometimes should be law enforcement closely partnered with
Speaker 2: commercial businesses.
Speaker 4: Well, I was gonna say, like, we've all deployed to
Speaker 4: the you know, the g WAT in some way, and
Speaker 4: it's sort of like the US's cyber policy seems to
Speaker 4: me to be like we're getting attacked, so let's keep
Speaker 4: building our base defenses.
Speaker 5: Yeah, let's just keep on.
Speaker 4: Let's add more sandbags, let's add more hescoes, Let's uh,
Speaker 4: let's get to.
Speaker 2: Say, Jack, are we taking you off yet with all
Speaker 2: this nerd stuff here and hackers kind of going unrecked
Speaker 2: only mildly.
Speaker 1: But we're gonna jump to some user questions because I
Speaker 1: know some of our viewers had had some stuff for
Speaker 1: you as well that we want to make sure we
Speaker 1: get to.
Speaker 3: Let's do it.
Speaker 9: Alrighty from the count of Kohiba, did you see any
Speaker 9: differences in people who had shady backgrounds growing up for
Speaker 9: straight laced kids.
Speaker 3: A yeah.
Speaker 2: I actually would say my general rule of thumb is
Speaker 2: bad decision makers stay bad decision makers. However, if you
Speaker 2: can't understand the nuance between what is a think about fruit,
Speaker 2: I'll choose strawberries because why not I like them. Sometimes
Speaker 2: fruit molds because it's next to bad fruit. Sometimes fruit
Speaker 2: molds because it is truly the one that starts the molding.
Speaker 2: I would say, generally speaking, I've seen rare cases where
Speaker 2: people who make extremely bad decisions change making bad decisions.
Speaker 2: It's not saying people can't change, However, I think sometimes
Speaker 2: separating what's molding because they're surrounded by essentially a bad
Speaker 2: environment is very different than, for instance, a bad egg.
Speaker 2: So what I'm saying is I've seen plenty of people.
Speaker 2: I mean, look at my I started this whole thing
Speaker 2: admitting I've been some things that when I.
Speaker 3: Was poor that are pretty crappy. I kind of wish
Speaker 3: I could undo them.
Speaker 2: They were circumstantial, and I've given back a lot more
Speaker 2: than I've ever taken. And so I don't think this
Speaker 2: is a case that you can just say if you've
Speaker 2: messed up, there's no forgiveness that like that doesn't mimic life.
Speaker 2: So I appreciate that question because no, I don't think
Speaker 2: just because you've made a mistake you're wrong. But I
Speaker 2: think there are degrees in it's the spectrum, and if
Speaker 2: you cross a line, you're probably going to keep crossing
Speaker 2: a line, not because it's wrong or right, but you
Speaker 2: probably have something wrong with judgment.
Speaker 4: Do you do you think that motivation is because I
Speaker 4: feel like in you know, the cyber world, that there
Speaker 4: is a lot of this, there's a lot of crossover
Speaker 4: with the softman tell you right, like when we take
Speaker 4: an an MP, I like like we have certain traits
Speaker 4: that we share with criminals, and you know, but I think.
Speaker 5: That that.
Speaker 4: It's, you know, we have sort of the same adrenaline,
Speaker 4: the sort of same compartmentalization, the same desire for.
Speaker 5: Challenge, but we don't have we don't have.
Speaker 4: The selfishness or the desire, you know, the desire to profit.
Speaker 4: And so I think maybe a cyber there's a difference
Speaker 4: between that hurteen, fourteen, seventy year old kid who wants
Speaker 4: to hack into a system to see if he can
Speaker 4: get into the system and the kid who wants to
Speaker 4: hack in the system to see what he can take.
Speaker 2: Yeah, you mentioned the selfishness, right, One of the core
Speaker 2: values in the Air Force was serviced before self.
Speaker 3: Why are you doing it? Are you doing it?
Speaker 2: Because it's experimenting and I've had I've been selfish before.
Speaker 3: Right, it's a you know, but.
Speaker 2: When I look back in hindsight, a lot of it
Speaker 2: was and ends to a means that was in a
Speaker 2: way that was inconsequential. Did anybody get upset back in
Speaker 2: the day that I was using their unlimited minutes AOL account?
Speaker 2: They probably never even noticed yet they were giving me
Speaker 2: a chance to learn. That is so gray, But that's
Speaker 2: very different than I tried to get their credit card number. Right,
Speaker 2: and they just used their credit card and racked up
Speaker 2: all kinds of gift cards with it. Right, that's a
Speaker 2: very different version. And so the gentleman or you know,
Speaker 2: a lady or person that asked that question, like, that's
Speaker 2: a really astute question because, to be very frank, it's
Speaker 2: all a spectrum, and I think the answer is somewhere
Speaker 2: there in probably the middle to dark gray.
Speaker 3: I think that's still okay.
Speaker 10: Yeah, we got another question v due to the place,
Speaker 10: due to places like China having an internet, and as
Speaker 10: opposed to an internet, could regular Americans actually do any
Speaker 10: kind of hacking in places like China?
Speaker 2: So the thing everybody forgets, right, think about a castle wall,
Speaker 2: and even if you have the world's greatest you know, moat,
Speaker 2: and you have all the walls in the world, some
Speaker 2: people have to bring food in and out of that castle.
Speaker 2: So China does with the Great Firewall. For those that
Speaker 2: don't know, it's an actual logical layer that prevents certain
Speaker 2: traffic that only operates in China and certain traffic that
Speaker 2: for instance, allows outgoing. So it's not as easy as
Speaker 2: just walking into a place with no castle wall. But
Speaker 2: they're not on their own and as a result, sometimes
Speaker 2: you have to be able to find just like the
Speaker 2: about the old stories about the Trojan horse, right, sometimes
Speaker 2: you got to be able to get things in. And
Speaker 2: you know, if they were truly like a hermit kingdom
Speaker 2: that nothing could come in or out, they wouldn't be
Speaker 2: the nation state that they are. So where I'm sharing
Speaker 2: with this is I think that there is some value
Speaker 2: and having castle walls.
Speaker 3: But let's not be s ourselves.
Speaker 2: No castle wall is permanent because unless you're self sustaining
Speaker 2: from the inside, stuff's coming from the outside end. And
Speaker 2: as long as that's coming from the outside end, someone
Speaker 2: like me is trying to exploit it.
Speaker 4: Yeah, do you think that there's ever any future in
Speaker 4: which like a standard defense is just basically to learn
Speaker 4: how to put like create a poison pill for people's
Speaker 4: like data that you know what I mean.
Speaker 2: So I've gone back and forth between should we have
Speaker 2: data that just you know, deletes itself or you know
Speaker 2: kind of like mission impossible, this message will self.
Speaker 3: Distract, right.
Speaker 2: I've also balanced with the such opposite side of the
Speaker 2: spectrum of do we care way too much about what
Speaker 2: data gets leaked?
Speaker 3: No offense?
Speaker 2: At this time, I think I've had like ninety six
Speaker 2: times my Social Security number. I probably have like nine
Speaker 2: overlapping credit card policies right now. I get by every day.
Speaker 2: I'm a super nerd. I've got Alexus in my house.
Speaker 2: I could probably talk to my phone right now and
Speaker 2: ask it to do its thing. There is some level
Speaker 2: that I think we kind of got to dial it
Speaker 2: back and say, like, look at do you remember that
Speaker 2: movie Catch me if I can. That's that guy Frank
Speaker 2: Abagnail that fished the checks. It's twenty twenty five. Check
Speaker 2: fraud still happens. We never solved that problem. Why do
Speaker 2: we think we're going to solve this cyber crime problem?
Speaker 2: So I think some of it we just got to
Speaker 2: tone it down and realize, you get hacked in twenty
Speaker 2: twenty five. What's important is can you find it before
Speaker 2: it becomes like deathly, right before they drain your account?
Speaker 2: And when they drain your account, is there some sort
Speaker 2: of way that we can, you know, ease the burden,
Speaker 2: because that's pretty extreme to have like no money to
Speaker 2: pay for bills, you know. So my point behind a
Speaker 2: lot of that statement is I think that there is
Speaker 2: a level of I wish sometimes data would self delete.
Speaker 2: We'd be a little bit smarter, you know, minimize it.
Speaker 2: But I think we should also not a butt but
Speaker 2: an and we should also just chill out a little
Speaker 2: bit and be okay with certain things.
Speaker 3: Is gonna leak in twenty twenty five.
Speaker 4: So when I say poison pill, I don't just mean
Speaker 4: the data is self deleting, but basically installing malwell or
Speaker 4: you know, basically destroying whatever that data goes to.
Speaker 2: Ooh see, that's a good one. I don't you know
Speaker 2: what's unfortunate. I don't think that we're quite at the
Speaker 2: level that people are playing that four dimensional chess yet.
Speaker 2: Should we have things like we're getting better, Like, even
Speaker 2: though I'm not a huge crypto fan, we're getting.
Speaker 3: Wallets that are like better resilient.
Speaker 2: They try to prevent people's data from getting stolen, and
Speaker 2: they have some of these built in protection mechanisms. I
Speaker 2: I'm never a naysayer. I always think glass half full
Speaker 2: unless it's suburban, right, But I actually think we're still
Speaker 2: playing in many ways checker, not even chess, let alone
Speaker 2: four dimensional chess. So I think what you're getting to,
Speaker 2: we'll get there. Yeah, We're just not there yet, Like
Speaker 2: we still can't keep people from stealing my darn s
Speaker 2: F eighty six data.
Speaker 4: Well I've we talked about that before.
Speaker 5: Yeah, our our OPM file.
Speaker 2: Yeah yeah, so yeah, I wish That's my long way
Speaker 2: of saying, I hope we get there.
Speaker 9: Yeah, all right, m corbyin how do you feel about
Speaker 9: the fact that Chinese cybersecurity organizations are cyber organizations openly
Speaker 9: acknowledge and publicize their partnerships.
Speaker 6: Does it result in better collective action?
Speaker 3: So? I think that some of the things that's needed.
Speaker 2: And by the way, for the remember when I started
Speaker 2: this story, I said all the people that were in
Speaker 2: decision makers were former tank drivers, pilots, sub drivers, ship
Speaker 2: you know, admirals. Turns out in twenty twenty five, some
Speaker 2: of the people in office now are people who started
Speaker 2: their careers in offensive cyber So what I'm saying this is,
Speaker 2: if we go back to the root question, we've actually
Speaker 2: got some really well informed people that are helping make
Speaker 2: better decisions that allow us to kind of be more
Speaker 2: public and with more public like I can tell you publicly,
Speaker 2: Huntress collaborates with all kinds of law enforcement, less about government,
Speaker 2: but all kinds of world law enforcement. Sometimes in countries
Speaker 2: you wouldn't expect like, you know, people forget that. Sometimes
Speaker 2: on what you read in the news, you read like, oh,
Speaker 2: we're going to trade political prisoners behind the scenes. Sometimes
Speaker 2: cyber criminals are traded. These nation state governments, for instance,
Speaker 2: that protect some of these sometimes use these players as chips,
Speaker 2: and believe it or not, law enforcement is some of
Speaker 2: the people that we've actually had the best success of collaborating.
Speaker 2: We've worked on raids that have brought back millions of
Speaker 2: dollars of stolen money from cyber crime takedowns. So that's
Speaker 2: my very long way of saying we could do better,
Speaker 2: and I will wholeheartedly argue some countries are challenging us
Speaker 2: of how well they do open collaboration, but don't underestimate
Speaker 2: how much dope stuff goes down in the shadows, like
Speaker 2: we're you know, we're not playing from a position of weakness.
Speaker 2: We use this term in the intelligence community that we
Speaker 2: call everybody else not peers. We call them near peers.
Speaker 2: It's not by accident, it's not by hubris. We do
Speaker 2: a lot of stuff really well. Don't underestimate what the
Speaker 2: US can do.
Speaker 9: I have a question, out of all the state actors,
Speaker 9: who's the best at hacking.
Speaker 2: That's such a good invest is such a loaded Do
Speaker 2: you know who I like and who I'm not going
Speaker 2: to use the word admire because like that'll be on
Speaker 2: like I go, I file for IPO and that'll be
Speaker 2: used against me. North Korea knows what they are, and
Speaker 2: they know what they are and what they are generally
Speaker 2: is very dependent on China for certain things. And they
Speaker 2: are also pretty darn broke. And this is a country
Speaker 2: that is more than happy to use their very very stringent,
Speaker 2: you know, economic sanctions that are against them that they
Speaker 2: have no problem going after your crypto wallet, going after Swift,
Speaker 2: that's the you know payment systems behind credit cards, and
Speaker 2: they have made millions maybe even there's some estimates that
Speaker 2: go into the big B word that is not playing around.
Speaker 2: Could you imagine like as a business and if you
Speaker 2: think about what some of these nation states are, their
Speaker 2: biggest businesses in their country are actually their hackers bringing
Speaker 2: in revenue wild that's pretty crazy, and we don't do
Speaker 2: that in the US. We don't do economic you know,
Speaker 2: espionage this way, some people will split hairs. I'll tell
Speaker 2: you ninety nine times out of one hundred unless there's
Speaker 2: some weird accident. We don't do that the way we
Speaker 2: play with economic espionages through like things like immigration. We'll
Speaker 2: just steal your best and brightest and make them US citizens. Right,
Speaker 2: not going to open that can, because that's a whole
Speaker 2: different other thing. But we play at a different level
Speaker 2: of four D chess, and I admire North Korea knowing
Speaker 2: how bad they are at some things and being able
Speaker 2: to make a whole lot of money with a handful
Speaker 2: of people they're not us.
Speaker 3: Well, you can't keep up with ghost but that's pretty dope.
Speaker 1: Before uh well not before, but during I mean they
Speaker 1: were also involved in the whole supernotes.
Speaker 5: Thing and oh yeah, oh yeah.
Speaker 1: I mean they were like like, uh, you know, counterfeiting
Speaker 1: physical US dollars. So this is just a criminal regime.
Speaker 1: Like like you said, they know who they are and
Speaker 1: what they do.
Speaker 2: Yeah, So I mean, is there not something to admire
Speaker 2: where they're like, Yo, it's getting harder to repre you know,
Speaker 2: to recreate and forage and create counterfeit dollars.
Speaker 3: So let's just not counterfeit as hard, and let's.
Speaker 2: Go after this new emerging digital Let's go after people
Speaker 2: behind crypto. Let's go after some of these core systems,
Speaker 2: like they know how to get paid, and I know
Speaker 2: it's so easy to like throw a Kim jong unmema
Speaker 2: out there, but like they're scrappy, they're hustling. They remind
Speaker 2: me of a startup they got startup energy.
Speaker 4: Well, you know what's wild is, you know the same
Speaker 4: scams that worked in the eighteen hundreds, like this Snake
Speaker 4: Oil says like the Nigerian prince like this with these
Speaker 4: crypto drops, you know, like they're using the somebody in competence. Yes, exactly,
Speaker 4: somebody wants something that's too good to be true and
Speaker 4: they believe that they just might be the person to
Speaker 4: get it, and they give people access to everything.
Speaker 5: You know, it's it's wild.
Speaker 2: And people forget when they're succeeding. They don't have to
Speaker 2: succeed big. It doesn't have to be billions. When you
Speaker 2: have such a disproportionate exchange rate, a fifty thousand dollars
Speaker 2: ransom could be significantly bigger for folks in economic sanctioned worlds.
Speaker 2: So I just sometimes think that we just like how
Speaker 2: we're really bad as humans, like comper in and how
Speaker 2: many like stars in the sky are great of sand
Speaker 2: on Earth, there's a different law, right, a different set
Speaker 2: of physics in North Korea or these other you know,
Speaker 2: world regimes, even Iran, who's like much smaller that they
Speaker 2: are winning and just at their scale. And I don't
Speaker 2: think we necessarily like we talk trash against them, but
Speaker 2: you got to watch out because startups sometimes disrupt big environments.
Speaker 2: And I'm not saying North Korea is going to become
Speaker 2: a nation state, but what you know, a nation state
Speaker 2: for instance that we have to worry about, like a
Speaker 2: China Russia type of scenario. But don't sleep on their
Speaker 2: ability to dis you know, deliver bigger bang for the buck.
Speaker 3: That's what I'm saying.
Speaker 4: And the simple fact is a lot of these countries
Speaker 4: will play by.
Speaker 5: Rules that we won't even consider.
Speaker 4: Like I mean, look like look at human espionage. There
Speaker 4: are countries that will still honeypot and the United States
Speaker 4: will not honeypot, you know, I mean, look.
Speaker 2: At the koshogi you know situation, right though the reporter,
Speaker 2: when's the last time the US was accused of hacking
Speaker 2: some be apart in an embassy, Like, we play on
Speaker 2: slightly different rules in the physical and digital world, right,
Speaker 2: And I think that's.
Speaker 6: My officers, We don't do those kinds of you know, uh.
Speaker 2: And there is a level of like I will say,
Speaker 2: there's a weird thing about espionage that it's a very
Speaker 2: gentleman's general person's game. But we got to understand that
Speaker 2: we have to play smarter and harder because some people
Speaker 2: just won't play by our rules. And that's not an
Speaker 2: excuse to play by the rules. Like you don't want
Speaker 2: to fall into that, right, you don't. You've got to
Speaker 2: protect some level of humanism, Like even adversaries they wake
Speaker 2: up and they probably have back pain the same way
Speaker 2: that my you know, aging you know ass is starting
Speaker 2: to feel back pain, like something generally connects us. They're
Speaker 2: still humans. So I think it's important that we can't
Speaker 2: lose that right. At the same time, let's not let
Speaker 2: them take our kindness for a weekend.
Speaker 4: So let me ask you a quick question because I
Speaker 4: I feel kind of strongly about cybercrime, and I I
Speaker 4: feel as though our.
Speaker 5: Government gets wrong.
Speaker 4: That's it's not breaking into the bodega and stealing their cash,
Speaker 4: it is that I'm all for presidential findings. I am
Speaker 4: all for the cyber terrorism. If you shut down a hospital,
Speaker 4: that now you become.
Speaker 5: A title fifty Title ten target that you're not.
Speaker 4: It's not a lot you know, an FBI case anymore,
Speaker 4: it's not law enforcement. I would like to see consequences.
Speaker 4: I would like to see these things elevated in our
Speaker 4: in our sort of warfare, or in a new domain,
Speaker 4: a new warfare domain.
Speaker 3: Yeah, so, David, I think there's nuance in what you
Speaker 3: just said.
Speaker 2: But I will tell you so what we've been hanging
Speaker 2: out bs in for what two hours or so, I
Speaker 2: will tell you, like, we protect one hundred and fifty
Speaker 2: thousand businesses worldwide, even with all of our skills, all
Speaker 2: of our prevention, et cetera. I'm sure there's probably a
Speaker 2: to a couple dozen that have been wrecked in the
Speaker 2: last two hours, even the ones we protect. It's like
Speaker 2: saying there's perfect prevention against cancer. It's not real. Sometimes
Speaker 2: it's about just finding it early. And the point that
Speaker 2: I'm getting across the whole idea is finding it before
Speaker 2: it kills you. If you look at things that way,
Speaker 2: at that scale, that even just during this two hours
Speaker 2: that we're hanging you know, just there's companies that are
Speaker 2: not going to be able to deliver food tomorrow. There's
Speaker 2: going to be companies that can't run payroll. There's going
Speaker 2: to be companies that can't schedule logistics meetings, and there's
Speaker 2: going to be people that's causing stress on real people.
Speaker 2: I don't think we equate cybercrime with real crime. And
Speaker 2: I think in some ways we even victim shame. Oh
Speaker 2: you got hacked, Right, you don't blame somebody for getting
Speaker 2: robbed at knife point in New York City, Right, you
Speaker 2: just flat out and say that's crap, Get out, go
Speaker 2: after the criminal. And I think some ways that we
Speaker 2: need more support to, like, let's treat hackers, and I
Speaker 2: don't mean all hackers not ethical, right, the people who
Speaker 2: are threat actors cyber criminals. Treat them like they are criminals,
Speaker 2: and it should come with some real consequences. And let's
Speaker 2: be willing to handle the gray areas. Maybe there's some
Speaker 2: places that we have to interpret. Maybe there's some people
Speaker 2: that aren't quite the same level. Right, just like how
Speaker 2: we're having the conversations on like recreational drugs and stuff,
Speaker 2: Let's be smart humans and understand there's gray.
Speaker 3: Yeah, but I'm telling you.
Speaker 2: When it's very clear that you're out to ruin people's lives,
Speaker 2: why are we not considering.
Speaker 3: More and I'm not going to all the way to
Speaker 3: the extreme.
Speaker 2: Of use of force. There is some level of disproportionate
Speaker 2: force that I think. I imagine if, for instance, somebody
Speaker 2: drone striked a group that was doing scam calls. That's
Speaker 2: the most extreme example I can come up with here
Speaker 2: at night. And what I'm going with is it probably
Speaker 2: doesn't take too many of these things to have real repercussions.
Speaker 2: And I would not advocate for like loss of life,
Speaker 2: but maybe when it hits a certain level that you're
Speaker 2: willing to attack a hospital, let's call it what it is.
Speaker 2: It's no longer cyber crime. It's much closer to terrorism,
Speaker 2: if not split out terrorism. And I just don't think, Yeah,
Speaker 2: there's a whole lot of this willingness to have this
Speaker 2: hard conversation.
Speaker 4: Yet Yeah, for me, it's like even talking about scam calls.
Speaker 4: I mean, do we measure how many Americans kill themselves
Speaker 4: because they've lost everything through a scam call or through ransomware? Like,
Speaker 4: so have they sort of taken that life?
Speaker 5: I don't know. I feel like you, you know, you send.
Speaker 4: A tomahawk to one or two thread actors and and
Speaker 4: you'll separate the week from the chat, you'll see who's
Speaker 4: serious about, you know, ransomware.
Speaker 3: There will still be some that don't care.
Speaker 5: You're not right, absolutely absolutely, But.
Speaker 2: And there's versions of this right like jail time. I've
Speaker 2: seen some of these that are like responsible for millions,
Speaker 2: and they still end up with four to six years
Speaker 2: when they finally get extradited. I again, I think there's
Speaker 2: difference between people who rob banks and people who shoot
Speaker 2: people while robbing banks. That's logical, that is a difference
Speaker 2: between that. But I don't think, for instance, we do
Speaker 2: enough to look at the blast radius. We don't look
Speaker 2: at the collateral damage. And I do think we will
Speaker 2: get there. I really think that now we're starting to realize.
Speaker 2: But I will also say guys to not to like
Speaker 2: maybe tone down some of the rhetoric. There's a lot
Speaker 2: of incidents actually that businesses do get hacked and they
Speaker 2: go back to business in six to eight weeks as well.
Speaker 2: So I do think that we got to make sure
Speaker 2: that like, when it's extreme, let's treat it more extreme, right,
Speaker 2: and when it's chill, let's normalize that some people get
Speaker 2: the car burglarized and let's just go back to work
Speaker 2: the next day. You know, get the window fixed by
Speaker 2: USA or whoever your car insurance. And so if you
Speaker 2: can't tell, I'm like this weird version of where I'm
Speaker 2: simultaneously saying reck.
Speaker 3: Them right and also chill, And I think that's okay.
Speaker 6: Right, we have any more question? One more question?
Speaker 9: Do you have any thoughts on cyber having kinetic effects
Speaker 9: in warfare like hacking medical devices and altering device functionality?
Speaker 2: I think if laws support it, do it. And I
Speaker 2: don't mean that laws can't take it down. But for instance,
Speaker 2: if I could take your internet connected car and I
Speaker 2: have everything against you that you are an arms dealer
Speaker 2: that's taken life, if I have the same war power,
Speaker 2: for instance, if I was there to actually take life,
Speaker 2: why does it matter if it comes from a bullet
Speaker 2: or your Mercedes swerving off the bridge. I know that's extreme,
Speaker 2: and I'm trying to make a point with it, but
Speaker 2: my point behind it is let's not go to extreme
Speaker 2: on either side, but let's keep things proportional.
Speaker 3: Does it really matter?
Speaker 2: And so I come from a world that my job
Speaker 2: has literally taken life because of this, and it wasn't
Speaker 2: against people who just did a little bit of credit
Speaker 2: card fraud. They were people who blew up ten, fifteen,
Speaker 2: twenty innocent people, some of their own citizens, some foreign Again,
Speaker 2: I think the nuance matters here, So I'm trying to
Speaker 2: give these edgy points to like make sure people have
Speaker 2: a sound bite and they can like jolt them to think.
Speaker 2: But I'm also trying to bring it down to the
Speaker 2: nuance matters. So for me, there is definitely situations that
Speaker 2: exist that we should be able to use cyber to
Speaker 2: deliver kinetic effects when the juice is worth the squeeze,
Speaker 2: or when we would have done the same thing if
Speaker 2: it was a physical situation.
Speaker 1: Right, Yeah, Kyle, tell us about where can people find you?
Speaker 1: Where can they find Huntress? What types of companies should
Speaker 1: contact you? And you try to procure your services? I
Speaker 1: mean who needs to find you?
Speaker 2: Yeah, so I gave all the embarrassing stories earlier. When
Speaker 2: I was small, we serviced businesses that were small businesses.
Speaker 2: It turns out now we're cybersecurity for all businesses and
Speaker 2: it's not just a tool where the full team that
Speaker 2: actually does all the development and the same team building
Speaker 2: the tool is the same team hunting these cyber criminals.
Speaker 2: Huntress dot com is obviously the website but it turns
Speaker 2: out some of our spiciest stuff you can find is
Speaker 2: on stuff like LinkedIn, on x right, on Facebook. We
Speaker 2: actually show on a daily basis what we're wrecking. And
Speaker 2: that goes back to that mission statement I said earlier.
Speaker 2: If you lead with not only transparency and integrity, but
Speaker 2: educate these companies that don't.
Speaker 3: Have resources, maybe like yours.
Speaker 2: With community and with education, you can kind of make
Speaker 2: a real big difference in the world.
Speaker 3: So again, the website's cool.
Speaker 2: You can learn about us on a website, but if
Speaker 2: you want to see the real kind of like deal
Speaker 2: that you've got to experience tonight, find us on LinkedIn,
Speaker 2: Find us on one of those social networks that's where
Speaker 2: we actually talk, just like we talked today.
Speaker 5: Yeah.
Speaker 6: Awesome.
Speaker 5: Yeah, it's been fantastic, really really.
Speaker 3: Thank you Kyle guys. Well again, I appreciate it.
Speaker 5: Again.
Speaker 2: We got to touch a lot of topics that some
Speaker 2: people shy away from. We got to be able to
Speaker 2: play both sides of the fence, and I just really
Speaker 2: appreciate I know it took us a handful of years
Speaker 2: for both of our schedules to work, but I don't know.
Speaker 2: Two and a half drinks in and I'm feeling like
Speaker 2: we succeeded.
Speaker 3: So cheers, guys, outstanding.
Speaker 1: We'll do it and some time, Kyle, and thank you
Speaker 1: for your time spending some for your Friday evening with us.
Speaker 3: Yeah, this was awesome, Thank you so much.
Speaker 6: Guys. Hi, I got one more question? What the where?
Speaker 6: What countries does Huntress service?
Speaker 3: So we actually service all of them?
Speaker 5: Right?
Speaker 2: There is a you know when it comes down to
Speaker 2: like we have some legal obligations like I can't service
Speaker 2: Syria today if they're sanctioned away. But when I say
Speaker 2: one hundred and fifty thousand businesses, I'm not talking about
Speaker 2: like in the Atlanta or Baltimore a DC region. There
Speaker 2: are one hundred and fifty thousand businesses that some you
Speaker 2: would know and some that just provide all the power
Speaker 2: and electricity that you don't know across the entire globe.
Speaker 3: So no joke.
Speaker 2: We are a proper global company, wrecking hackers no matter
Speaker 2: where they try to go.
Speaker 4: After what what would be your like five year dream
Speaker 4: for hundreds?
Speaker 3: Dude?
Speaker 2: So I asked this question or I get asked this
Speaker 2: question a lot too, meaning I asked my teammates, but
Speaker 2: also get asked and what's nice about it is hackers
Speaker 2: are so innovati if they have to be respected, just
Speaker 2: like for instance, adversaries, they're smart humans. And the one
Speaker 2: thing that I love is, think about launching a rocket
Speaker 2: to the moon. Physics don't change, right. If you know
Speaker 2: the physics, you know the Earth orbit, you can take
Speaker 2: a rocket, go around the moon, slingshot back, land it
Speaker 2: on a drone platform.
Speaker 3: You're done.
Speaker 2: But cybersecurity is brilliant shady humans against brilliant ethical humans.
Speaker 2: And the part that I would share is I hope
Speaker 2: more and more and more through like our conversation we
Speaker 2: shared today that the ethical side can you know, not
Speaker 2: just cat and mouse this, but disproportionately win. We're not
Speaker 2: going to win at all, but I think we're on
Speaker 2: the cusp of using our offensive skills to support defense
Speaker 2: that could finally change. Like, so, cyber criminals are making
Speaker 2: less money than the companies protecting them, and I know
Speaker 2: that sounds like so capitalistic. You want that companies like
Speaker 2: this are making money. You are just doing whatever you do,
Speaker 2: dry cleaning, delivering pain right services, shipping things, whatever, widget software.
Speaker 3: You want that to win. And for me, I would
Speaker 3: like no matter.
Speaker 2: Where threat actors go, I would love for Huntress to
Speaker 2: be one step ahead like that would be a really
Speaker 2: cool place that I could like pass away and feel
Speaker 2: good about.
Speaker 5: That's awesome.
Speaker 1: Kyle, thank you again for taking the time to do
Speaker 1: this interview, and maybe we'll come back to you again
Speaker 1: at some juncture in the future when we need your
Speaker 1: cyber expertise. And we will see all you guys next week.
Speaker 1: There's some links down the description for you'll find Kyle,
Speaker 1: you'll find Huntress.
Speaker 6: You also find our Patreon. Thank you everyone who
Speaker 1: Subscribes, and we have new merch also, so you can
Speaker 1: find that down there, and thank you everyone, and we
Speaker 1: will see you next week.