WEBVTT
00:00:15.679 --> 00:00:18.079
All right, welcome back to the Nexus podcast.
00:00:18.239 --> 00:00:19.920
Jake Braun is my guest.
00:00:20.160 --> 00:00:27.600
Jake is uh a co-founder of DEF CON Franklin and former White House acting principal, deputy national cyber director.
00:00:27.839 --> 00:00:32.479
If you are unfamiliar, DEF CON Franklin is a volunteer-driven security program.
00:00:32.560 --> 00:00:41.520
It connects security researchers and hackers associated with DEF CON with uh US-based water and wastewater utilities, as well as K-12 schools.
00:00:41.679 --> 00:00:42.159
Very interesting.
00:00:42.320 --> 00:00:54.079
So this summer at DEF CON, uh, DEF CON Franklin and the National Rural Water Association announced the Water Watch Center, which provides uh support to utilities in the event of a breach.
00:00:54.240 --> 00:01:00.159
So Jake is going to take us through both programs, and uh obviously this is a very timely conversation.
00:01:00.399 --> 00:01:04.000
I've been looking forward to this, so I really appreciate Jake coming on.
00:01:04.159 --> 00:01:07.920
Uh, before we start, just my usual reminder to subscribe to the podcast.
00:01:08.000 --> 00:01:15.840
It's really the best way to keep up with new episodes and check out uh all 141 that uh maybe you've missed so far.
00:01:15.920 --> 00:01:17.359
So if you're new to the show.
00:01:17.439 --> 00:01:18.400
So thanks for listening.
00:01:18.480 --> 00:01:23.200
And uh, we are on all the platforms and easy to find, so please subscribe to us.
00:01:23.280 --> 00:01:25.439
So let's get started with today's episode.
00:01:25.599 --> 00:01:26.319
Hi, Jake.
00:01:26.400 --> 00:01:27.200
How are you?
00:01:27.519 --> 00:01:28.319
Good, how are you?
00:01:28.400 --> 00:01:29.200
Thanks for having me.
00:01:29.519 --> 00:01:29.760
Thank you.
00:01:29.840 --> 00:01:30.719
Yeah, you're welcome.
00:01:30.879 --> 00:01:32.560
I appreciate you giving me the time.
00:01:32.799 --> 00:01:36.959
Um, tell everybody a little bit about yourself and of course DEF CON Franklin.
00:01:37.040 --> 00:01:38.159
How'd you get involved there?
00:01:38.640 --> 00:01:39.040
Sure.
00:01:39.200 --> 00:01:41.120
Uh so I'm Jake Braun.
00:01:41.439 --> 00:01:54.239
As you suggested, uh right now I um the executive director of the Cyber Policy Initiative at the University of Chicago and uh also CEO of a small uh consulting firm in Washington called Cambridge Global Advisors.
00:01:54.400 --> 00:02:11.840
Uh previous to that, I was the um acting principal deputy national cyber director in the White House, which is a very long way of saying that I was the essentially the COO of uh the new cyber office they set up uh in the White House back in in uh 2019.
00:02:12.240 --> 00:02:25.039
Um and uh in that capacity, uh, you know, we did a lot of work on uh water security, um uh issues with cyber workforce and and so on and so forth.
00:02:25.199 --> 00:02:45.360
And so when I left, uh was talking to my good friend Jeff Moss about uh some work we had done years ago uh when he and I and a couple friends of ours, Matt Blaze and Hari Hirsty and Maggie McAlpine, uh started the the voting machine hacking village or the voting village as we call it, uh DEF CON.
00:02:46.000 --> 00:02:53.840
And uh when we when we started that, uh, you know, we there was a lot of great things that came out of it.
00:02:53.919 --> 00:03:06.800
Um, but two of them were we started doing uh reports annually uh from the voting village on kind of what uh hacks we found and and and how they were relevant from a policy perspective.
00:03:07.039 --> 00:03:09.919
And uh and we started putting that in an annual report.
00:03:10.000 --> 00:03:17.280
And we also uh encouraged folks from the DEF CON community to volunteer to support local election offices and stuff.
00:03:17.520 --> 00:03:22.080
And so as Jeff and I were talking when I was leaving the White House, we were like, gee, why don't we extend that to all of DEF CON?
00:03:22.400 --> 00:03:39.759
And so now we do an annual report for DEF CON uh via this project you mentioned called Franklin, um which Jeff and I co-uh co-run that identifies the best and brightest uh um discoveries or announcements or uh innovations at DEF CON.
00:03:40.000 --> 00:03:44.479
And then we do some policy analysis on why that matters um from a policy perspective.
00:03:44.560 --> 00:03:49.199
And so we put that out in our Hackers Almanac that we put out two of now.
00:03:49.280 --> 00:03:54.560
Uh and uh um we'll we'll have another one we're working on right now for Blast DEF CON.
00:03:54.800 --> 00:04:16.399
And then also we've asked uh uh the DEF CON community to s to step up and help these really under-resourced water uh utilities um to uh um you know help up their game in cyber because right now they they're uh kind of uh at the top of every bad guy's target list, yeah, particularly the ones that support military assets, data centers, or hospitals.
00:04:16.639 --> 00:04:23.759
Um so it's a little bit about my background and a little bit of a kind of an overview of what Franklin is uh is all about.
00:04:24.560 --> 00:04:32.160
So from your experience, how would you characterize kind of the current state of affairs in terms of cybersecurity at water utilities?
00:04:32.240 --> 00:04:45.519
Like you mentioned, there's so many small community systems, and you probably got you know very strapped IT people trying to not only keep the water clean but try to do some security or they outsource it.
00:04:45.680 --> 00:04:49.519
Um, you know, what's the current state of affairs from your perspective?
00:04:50.000 --> 00:04:50.560
Sure.
00:04:51.279 --> 00:05:00.160
So I I really think that water right now is where energy was about 10, 15 years ago.
00:05:00.399 --> 00:05:10.720
So I remember uh when I was in the Obama administration, I was White House liaison to Homeland Security, and I was talking to a friend of mine who was in the White House at uh the Council on Environmental Quality.
00:05:10.800 --> 00:05:15.279
And they were at the time really thinking through how they were gonna put together the smart grid.
00:05:15.439 --> 00:05:29.680
And as we remember, you know, the smart grid was okay, now we're gonna be able to, you know, um understand how and where to send power so we're not wasting all this power and and so on, is gonna be this great thing for the environment and for rate payers and everybody else.
00:05:29.920 --> 00:05:36.480
Um and so I remember uh saying to him, this is probably in 2009, I was like, hey, has cyber ever come up?
00:05:36.639 --> 00:05:38.800
Cybersecurity ever come up in these conversations?
00:05:38.959 --> 00:05:41.519
Uh and he was like, not once.
00:05:41.680 --> 00:05:44.079
No one has ever mentioned cybersecurity once.
00:05:44.240 --> 00:05:46.319
And that was 2009 in the energy space.
00:05:46.399 --> 00:05:58.079
Now, of course, energy is probably the furthest along next to maybe the financial industry or the defense industrial base, um, folks like that, in terms of uh the security of the industry.
00:05:58.160 --> 00:06:01.199
They've really upped their game tremendously since then.
00:06:01.519 --> 00:06:05.519
Um water uh is is kind of in the same place they were.
00:06:05.600 --> 00:06:12.240
You know, nobody's really talking about cybersecurity and water, um, even you know, four or five years ago.
00:06:12.319 --> 00:06:23.199
It's it's only really, you know, Vol Typhoon and and a few other things that have gotten uh broad swaths of policymakers and others to really even talking about what cybersecurity and water means.
00:06:23.360 --> 00:06:32.959
Um and so folks are really now um starting to pay attention and and starting to realize that they can't really rely on the herd theory anymore.
00:06:33.120 --> 00:06:38.800
You know, it can't just be I have to be uh a little bit faster or frankly luckier than than the other guy.
00:06:38.879 --> 00:06:41.439
Um the bad guys, the bad guys are after me.
00:06:41.519 --> 00:06:47.040
Uh and I think you know, Iran to your uh what you were alluding to earlier is has played a big role in that.
00:06:47.199 --> 00:06:49.839
Um, but really we're we're kind of starting at zero.
00:06:50.000 --> 00:06:55.680
Um and it's not because folks are dumb that work in this space, this just wasn't in their job jar until very recently.
00:06:55.920 --> 00:06:56.240
Sure.
00:06:56.480 --> 00:07:08.480
And so, you know, we're we're still at a point where we're you know having talking to folks about changing default passwords and and uh you know turning on multi-factor authentication and so on.
00:07:08.639 --> 00:07:19.360
Um, but but I think the biggest need in the industry right now, by far and away, now that we've had um DEF CON researchers in these utilities for you know over two years now, is asset inventory.
00:07:19.519 --> 00:07:22.079
Um the you know, this is you know, control number one.
00:07:22.160 --> 00:07:31.199
If if we had the folks at the Center for N Security on the call right now that maintain the 20 critical cybersecurity controls, they'd tell you asset inventory is the most important thing.
00:07:31.360 --> 00:07:35.279
Well, turns out in the water space, that is absolutely true.
00:07:35.439 --> 00:08:09.360
Um, and I think maybe even more so uh for folks in the water space, uh just getting a sense of of what in their environment is connected to the is connected to their network uh is is really a non-trivial task and and and and kind of the basis for them understanding how they can secure their their utility and not just secure it by the way, but also in the event of a catastrophic effect um attack, understanding how to take it offline and run it manually, which in theory everybody knows how to do.
00:08:09.519 --> 00:08:25.839
Um, but what we've realized after uh you know the uh alleged Iranian attacks, um it in practice it's unclear if folks know exactly how they would go about running these plants.
00:08:26.319 --> 00:08:34.240
As you suggested, that's not necessarily uh uh from uh a negligence point of view or not wanting to do something about it.
00:08:34.320 --> 00:08:38.320
It's resources, it's maybe even experience with cybersecurity, right?
00:08:38.480 --> 00:08:40.080
There's just oh god.
00:08:40.240 --> 00:08:41.279
Oh absolutely.
00:08:41.440 --> 00:08:53.600
I mean, I remember talking to somebody the other day uh at one of the water conferences, which we now go to all the time, where a bunch of you know hackers and cyber people walking around these water conferences, which is kind of funny, by the way.
00:08:53.679 --> 00:09:03.360
Um, as a side note, if you're uh if you're on a Zoom call with them or whatever, and uh you have a hacker on one screen and a water guy on the other screen, I swear to God, it's like they're cousins.
00:09:03.519 --> 00:09:13.679
Like they're they're you know, they'll usually have the like the long beard, um, you know, and kind of the frumpy clothes, uh, and uh and whatever.
00:09:13.840 --> 00:09:24.720
It's just like the water guys, a little bit more of like a Duck Dynasty flavor, and the hacker guys usually got some maybe piercings and like other maybe color going on uh you know with the hair.
00:09:24.799 --> 00:09:31.840
But it's like the same dude with a slightly different, you know, uh um uh take on take on that look.
00:09:31.919 --> 00:09:33.840
But anyway, they need some sunlight.
00:09:34.159 --> 00:09:35.440
Yeah, right, right.
00:09:35.679 --> 00:09:47.840
Um so uh no, we were talking to somebody the other day, uh, one of these water conferences, and you know, he was asking us about whatever, and you know, it turns out he's down the road from some military asset.
00:09:48.000 --> 00:09:50.960
He doesn't know exactly what they do, but knows the military runs it.
00:09:51.120 --> 00:09:56.559
Um, because nearly all military assets are ran on civilian um water, by the way.
00:09:56.960 --> 00:10:00.000
Uh and he's like, Well, what should I do?
00:10:00.080 --> 00:10:00.480
Blah blah blah.
00:10:00.639 --> 00:10:03.759
And so we were talking to him about some of the basics like I was just describing.
00:10:04.000 --> 00:10:11.919
And he was like, Yeah, I mean, I just God, I just don't have a lot of time, you know, because I run the Fourth of July parade as well for the town and blah, blah, blah.
00:10:12.480 --> 00:10:16.639
Literally, this guy runs the Fourth of July Parade and runs the water utility.
00:10:16.879 --> 00:10:24.639
And and again, no one ever told him, you know, that cybersecurity was part of his job until, you know, that conference was, I think, the first time he heard it.
00:10:24.879 --> 00:10:25.039
Sure.
00:10:25.200 --> 00:10:26.240
So it's not like he's dumb.
00:10:26.320 --> 00:10:30.000
It's just, you know, he's got a lot going on, has no resources.
00:10:30.240 --> 00:10:36.720
Um, you know, if if if they want to raise rates in these towns, um, that'll be the last time any of those people hold office.
00:10:36.879 --> 00:10:41.600
Um, who vote for them to raise rates, so it's completely unpalatable to do it.
00:10:41.919 --> 00:10:49.919
Um, and uh uh, you know, we're that's you know, that that's that's the that's the situation in most of the country.
00:10:50.240 --> 00:10:54.000
So with Franklin, it's it's largely a volunteer effort.
00:10:54.240 --> 00:10:57.600
Um how's that initiative gone so far?
00:10:57.759 --> 00:11:01.360
Uh are you finding folks want to step up?
00:11:01.519 --> 00:11:06.320
And you know, what are what is some of the kind of the output that's coming out of those interactions?
00:11:07.039 --> 00:11:10.000
Oh God, I uh yes, people want to step up.
00:11:10.080 --> 00:11:22.799
I mean, you know, after we announced it a couple years ago, uh, we had so many signups in the first 10 days, we had to shut down the intake form because I didn't have enough staff to process all the people signing up.
00:11:23.039 --> 00:11:25.679
Um, and truly it's it's been invaluable.
00:11:25.759 --> 00:11:34.399
I I think that uh if you if you um won't, you know, when we move on to talk about the Water Watch Center, which I think you mentioned uh you want to talk about at some point.
00:11:34.720 --> 00:11:35.039
Yes.
00:11:35.360 --> 00:12:10.720
Um had we not um had Franklin in place and had all these uh um folks who've who've raised their hand to volunteer, I wouldn't have been able to put folks, uh put you know, some of these really amazing technologists um in a handful of utilities for uh about two years uh to really study what is going on in these utilities, what is you know the the um you know the kind of baseline um you know uh uh status of the security and networks and so on and so forth.
00:12:10.879 --> 00:12:17.440
You know, but for that, um we would have made all, you know, we we wouldn't have been able to come up with what we've done.
00:12:17.600 --> 00:12:28.000
And in fact, um it's not just the folks we were able to embed in in several utilities, but also we had folks who were doing research on you know different options and so on.
00:12:28.159 --> 00:12:40.000
So, for example, one of the options that uh was proposed early on was providing a bunch of free uh products and stuff from some of the huge cyber companies.
00:12:40.240 --> 00:12:44.240
And we found out early on that's probably not gonna work for most of these little guys.
00:12:44.399 --> 00:12:49.120
Um, because, and by the way, like 95% of the utilities are are these little guys.
00:12:49.279 --> 00:12:49.440
Right.
00:12:49.600 --> 00:12:53.679
Uh, because they, you know, a lot of that free stuff is kind of free like a puppy.
00:12:53.759 --> 00:13:00.399
You know, it's it's uh yeah, here buy my I'll I'll I'll give you 20 free licenses, but you gotta buy my$150,000 box.
00:13:00.480 --> 00:13:10.399
Or I'm gonna give this screen that's gonna blink when something bad happens, but you have to find some guy, you have to pay$200,000 a year uh to to watch the screen and know what to do when it blinks, you know.
00:13:10.559 --> 00:13:10.799
Sure.
00:13:11.039 --> 00:13:18.399
Um, you know, when by the way, the highest salary and the water utility is$50,000 a year, you know, um in many of these places.
00:13:18.720 --> 00:13:19.039
Makes sense.
00:13:19.679 --> 00:13:20.799
Uh yeah, exactly.
00:13:20.960 --> 00:13:25.679
So so we had a lot of folks doing research like that on kind of what solutions and stuff made sense.
00:13:25.840 --> 00:13:35.919
And so uh uh because of all the the research, the this you know, security in terms of up in the game of a lot of these utilities, um, et cetera, et cetera.
00:13:36.000 --> 00:13:38.960
Um, but for that, we wouldn't have been able to launch the watch center.
00:13:39.120 --> 00:13:48.320
And now um that DEF CON community and the Franklin volunteers are still critical to what we're doing uh with the So let's talk about the Watch Center.
00:13:48.480 --> 00:13:50.159
Just kind of how does it work?
00:13:50.320 --> 00:13:57.120
So this is basically an initiative to provide support in the event of an attack and if in the event of a compromise.
00:13:57.360 --> 00:13:59.360
Um take it from there.
00:13:59.440 --> 00:14:00.320
What what happens?
00:14:00.480 --> 00:14:01.440
How do people get involved?
00:14:01.679 --> 00:14:09.200
Well, I I I would actually say that's a little bit more prophylactic than than than just uh IR type uh situation.
00:14:09.759 --> 00:14:15.840
So uh essentially, so think about it as if it's like the human nervous system, right?
00:14:16.080 --> 00:14:20.159
So um if you think about the the human nervous system, so you've got the brain, right?
00:14:20.240 --> 00:14:22.639
And the brain takes in all this data and and makes decisions.
00:14:22.720 --> 00:14:29.600
And so that would be like the National Rural Water Association, which is this uh trade association in the water industry.
00:14:29.679 --> 00:14:32.000
They support about 90% of the utilities in the country.
00:14:32.159 --> 00:14:40.399
They've been funded by the federal government since 1976 to provide technical assistance, albeit not cyber, but up until now, um, to water utilities.
00:14:40.559 --> 00:14:42.799
And so they're kind of like the hub, like the brain.
00:14:42.960 --> 00:14:49.919
So uh anonymized data from water utilities will go up to the National Rural Water Association.
00:14:50.080 --> 00:14:55.120
It'll be able to understand trends, problems, solutions that it can push down nationally, blah, blah.
00:14:55.360 --> 00:15:03.039
Okay, but as we all know, um you don't want your brain making some like really fast decisions.
00:15:03.120 --> 00:15:07.759
So if your hand touches a stove, your brain doesn't, you don't want your brain deciding to pull your hand away.
00:15:07.919 --> 00:15:12.080
You have nerve nerve clusters around your body that would pull your hand away, right?
00:15:12.320 --> 00:15:15.679
Um and uh that can operate in in in a millisecond.
00:15:15.840 --> 00:15:22.879
And so uh that um so separate or one layer down from the brain, we have uh MSSPs.
00:15:22.960 --> 00:15:24.240
So we have seven right now.
00:15:24.320 --> 00:15:30.480
We're gonna expand to ten, one for each region of of uh uh federal region of the country.
00:15:30.639 --> 00:15:35.279
The federal government split up into ten regions, so we'll have one MSSP per region.
00:15:35.919 --> 00:15:38.799
Um we're not exactly that rigid, but basically.
00:15:39.360 --> 00:15:45.279
So those MSSPs are connected directly to water utilities.
00:15:45.679 --> 00:15:52.480
Uh and those uh so they're they're now providing uh, and this is where the prophylactic side of this comes in.
00:15:52.639 --> 00:16:05.279
They're providing you know security uh um advice, resources, etc., helping folks with things like asset inventory, making sure they're turning on their multi-factor authentication, software analysis, all this type of stuff.
00:16:05.600 --> 00:16:14.080
Um they are uh the conduit from the utilities to report up this anonymized data to the brain, but they also can act independent of the brain.
00:16:14.320 --> 00:16:26.639
And crucially, we've made them can the utility or the MSSPs connected to each other so that they can also act in concert if need be without the brain, if there's a if there's a massive attack quickly or something like that.
00:16:26.960 --> 00:16:32.480
Um and then uh down your kind of nerve endings are back to our Franklin volunteers.
00:16:32.559 --> 00:16:37.919
So we still have volunteers who uh we deploy out to utilities when needed.
00:16:38.080 --> 00:16:40.000
They can help with IR, for example.
00:16:40.159 --> 00:16:43.519
They can also help because we have so many volunteers.
00:16:43.679 --> 00:16:56.559
If we've got a utility that's really far away from an MSSP, we can set up a volunteer to kind of drive out there and help get them hooked up or help walk through um somebody through kind of you know ins and outs of some of the basics and so on.
00:16:56.720 --> 00:17:00.320
And so they're kind of like the nerve endings that that go out and kind of do things.
00:17:00.559 --> 00:17:15.759
Um speaking of the nerve endings, we do still have um in our scenario here uh a uh a big kind of challenge that is yet to be addressed that we're working on with DARPA.
00:17:16.240 --> 00:17:21.200
And so that is uh a massive workforce challenge.
00:17:21.519 --> 00:17:40.559
And so, you know, our volunteers are awesome, they are salt of the earth, these are some of the most brilliant hackers you'd ever meet in your life, and they're you know great Americans and good citizens and and and want to help their country and and their community, however, uh there will never be enough of them to cover 150,000 water utilities in the country, right?
00:17:40.960 --> 00:17:47.680
Um and certain certainly not, you know, at the you know uh standard rates we would need we need that coverage to happen.
00:17:47.839 --> 00:17:48.160
Yeah.
00:17:48.400 --> 00:17:58.720
And so uh, but the thing is at the same time, at any given moment, we've got about a 500,000-person shortage in cyber professionals to open cyber jobs across the country.
00:17:59.039 --> 00:18:17.599
So the idea we're gonna magically come up with 150,000 new cyber people to work in all these utilities, which by the way, often have as their you know, upper band income or salary$50,000,$60,000 a year, which almost nobody in cyber uh would agree to work for.
00:18:17.759 --> 00:18:20.720
Right uh, we've got a big challenge.
00:18:20.960 --> 00:18:31.759
And so we're working with DARPA to do some research uh where they're putting together some uh uh working with some of our utilities to create a digital twin.
00:18:31.920 --> 00:18:40.720
So a uh a digital twin of the environment of the utility, and then they drop a red team agent, a blue team agent into the twin, so not in the real environment, but into a twin.
00:18:40.880 --> 00:18:46.000
They fight each other a gazillion times until we can figure out how we help the blue the blue team win.
00:18:46.480 --> 00:18:49.359
Uh this is to research and assess.
00:18:49.440 --> 00:18:52.400
Um we don't know if this is gonna be the right solution, we're testing it.
00:18:52.799 --> 00:19:05.200
Um but could it be the right solution to dump a bunch of these blue team agents in these water utilities down the road that we just know are just never gonna have the resources to hire a cyber professional?
00:19:06.640 --> 00:19:09.599
And uh so again, we're not sure that's the right answer.
00:19:09.680 --> 00:19:10.240
This is a test.
00:19:10.319 --> 00:19:30.480
It's it's it is research, and DARPA is doing fundamental research, which is which is kind of where we are at this point, but it is um another key component of what we're doing uh to kind of try and think a few steps down the road where it's like, okay, great, we've got our nervous system in place, we've got our NRWA being the brain, we've got our MSSPs as the nerve clusters, we're doing all this great stuff.
00:19:30.640 --> 00:19:35.599
But oh, gee, a year from now when we're trying to really scale, it's like there's no humans to do it.
00:19:35.680 --> 00:19:42.160
Well, yeah, hopefully this might be an option that that can enable us to really scale um as this as we prove out the model.
00:19:42.559 --> 00:19:45.279
That's the DARPA Castle program you're referring to, right?
00:19:45.599 --> 00:19:46.960
Yes, that's the DARPA Castle program.
00:19:47.359 --> 00:19:48.880
That's a really fascinating initiative.
00:19:49.039 --> 00:19:49.279
Yeah.
00:19:49.519 --> 00:19:50.400
It really it really is.
00:19:50.559 --> 00:19:56.799
Every time I talk to those guys, I'm it's one of those things, you know, where you do these different projects and you're like, oh man, I wish I could just spend all my time on this.
00:19:56.880 --> 00:20:05.039
That's one of those, like every conference call I get off, I'm like, I wish I could just do this, but you know, there's people with much more boring things that actually pay for this and they have to do.
00:20:06.079 --> 00:20:11.519
Um just to go back to the Water Watch uh center for a second, uh, what's the outreach like there?
00:20:11.680 --> 00:20:21.200
Are you working through the uh N N RWA exclusively or knocking on doors, so to speak, and uh if there's an incident or a need?
00:20:22.240 --> 00:20:24.079
Yeah, it's really all of the above.
00:20:24.160 --> 00:20:55.039
I will say one of the one of the really, you know, having having been in the in the election security space when this first all kind of popped, you know, back in 2016 after the election and the Russian interference and everything, um, you know, one of the one of the big issues in the election industry was that everybody was like, oh, there's no real threat here, you know, the the voting machines aren't aren't connected to the internet, which is just like what they mean is they're not persistently connected to the internet.
00:20:55.279 --> 00:21:02.400
I mean, I don't even want to go down this rabbit hole, it's so frustrating, but like, you know, all this stuff's secure, you couldn't really hack it at scale, you can't do blah, blah, blah.
00:21:02.559 --> 00:21:03.200
You know.
00:21:03.440 --> 00:21:12.559
Um, and it was just this kind of denial of the problem and this kind of visceral reaction against anybody who wanted to criticize, you know, call their baby ugly, and so on.
00:21:12.640 --> 00:21:16.880
Um, when in fact it was really the cyber community coming in and saying, hey, guess what?
00:21:16.960 --> 00:21:19.359
You guys are next on the list of the bad guys you're going after.
00:21:19.519 --> 00:21:23.200
You know, here's how we can try and, you know, up your game in cyber.
00:21:23.519 --> 00:21:25.920
It's been really the polar opposite in water.
00:21:26.079 --> 00:21:37.599
Um, you know, we we certainly there's folks who are like, hey, I could run this thing manually if I had to, but none of them are saying, I would prefer to run it manually, so leave me alone and don't talk to me about cybersecurity, you know?
00:21:37.759 --> 00:21:42.319
And none of them are saying, like, oh, this thing is totally secure and you could never hack my water utility.
00:21:42.480 --> 00:21:45.200
They're like, please tell me the things to do, you know.
00:21:45.359 --> 00:21:59.680
Um, and so I I think that we have really seen a um uh a far different and frankly more mature and responsible reaction by the water industry um to this than we did by uh from the election industry.
00:22:00.160 --> 00:22:04.240
Uh when all the when when when they went through pretty much exactly the same thing 10 years ago.
00:22:04.480 --> 00:22:04.799
Right.
00:22:05.680 --> 00:22:21.200
So given your past government experience, I I have to ask, are there is are there policy things, are there regulatory um initiatives that the government could push forward that would help here?
00:22:21.279 --> 00:22:22.880
What's what's missing from the government?
00:22:22.960 --> 00:22:26.799
Or are they doing stuff behind the scenes that we're not necessarily aware of?
00:22:27.200 --> 00:22:27.440
Sure.
00:22:27.599 --> 00:22:31.599
Well, I mean they're they're funding the Castle program, you know, obviously, because that's a DARPA program.
00:22:31.680 --> 00:22:34.960
So um, and and that's really good, and they should keep doing that.
00:22:35.200 --> 00:22:48.079
Um uh, you know, the other thing is the WWC is funded um exclusively from philanthropic dollars right now, and that's not sustainable for the future, you know.
00:22:48.240 --> 00:23:01.039
Uh we don't ask uh, you know, if the Iranians are uh uh invading the country, we don't ask, you know, the Ford Foundation to fund the Kalamazoo County Water Utility to come out and fight the Iranian Red Guard off.
00:23:01.200 --> 00:23:03.119
You know, uh that's the federal government's job.
00:23:03.200 --> 00:23:09.200
The federal government does national security and they should they need to fund the security of uh our water utilities.
00:23:09.359 --> 00:23:14.079
Uh so that's one key policy uh uh decision that needs to be made.
00:23:14.160 --> 00:23:20.559
Is the government, the federal government needs to stand up and say, you know, this this is our job because it because it's a national security threat.
00:23:20.720 --> 00:23:22.480
Um that's number one.
00:23:22.640 --> 00:23:47.119
Uh number two is uh I while I I don't think that uh more regulations are are necessary, uh I do think that there needs to be uh kind of more concerted effort to really by the federal government to really prioritize which utilities are the most critical.
00:23:47.279 --> 00:23:47.920
So, i.e.
00:23:48.079 --> 00:24:13.920
those that support military assets, because they're at the top of all the bad guys' targets list, those that support hospitals, um, because for obvious reasons, and also this may seem counterintuitive, but those that support data centers, not because we need to subsidize security for the big AI companies, but because those communities who's uh who have a water utility that now supports a data center, unbeknownst to them, are on the top of everybody bad, every bad guy's target list.
00:24:14.160 --> 00:24:23.359
And so um, you know, we should be uh we can't let those communities suffer just because somebody put a data center in their backyard.
00:24:23.440 --> 00:24:23.680
Yeah.
00:24:23.920 --> 00:24:47.599
And uh, you know, so I would recommend prioritizing those three categories first and then really going out and uh, you know, showing up with the local National Guard general, um, and the adjutant general, as they say, um, in a particular state, you know, somebody from CISA probably, um, somebody from the governor's office, maybe the mayor, uh showing up at the utility and saying, Hey, guess what?
00:24:47.839 --> 00:24:48.880
We're not kidding.
00:24:49.039 --> 00:24:52.240
Um, we'll and you know, you we really need to up your game in cyber.
00:24:52.319 --> 00:24:53.920
And oh, by the way, we're gonna pay for it.
00:24:54.160 --> 00:25:09.119
Um, they would have, you know, they would largely be welcomed with open arms by most of these utilities, and it would enable us to really get after the the um you know highest impact uh uh utilities uh quickly.
00:25:09.279 --> 00:25:10.880
And and that's it, it's a workable list.
00:25:10.960 --> 00:25:14.079
I mean, you're talking about a few thousand, not a hundred thousand.
00:25:14.240 --> 00:25:30.880
You know, that's that's a that's a a number that you could have a few hundred people, uh, or maybe even a few dozen people in the federal government um organize around, you know, knocking on all their doors over the course of six to twelve months and and getting those utilities up to speed.
00:25:31.039 --> 00:25:35.599
Um that you don't need a law for that, you don't need legislation, you don't need anything else.
00:25:35.759 --> 00:25:41.200
You just need the government to make a policy decision to intentionally do that targeting and do that outreach.
00:25:41.279 --> 00:25:41.519
Right.
00:25:41.680 --> 00:25:47.519
And then, you know, the and then implement the basics that the you know the federal government can do in its sleep.
00:25:49.039 --> 00:26:01.119
And just to go back to the WWC for a second, in terms of like uh sharing information on threats as they're happening, is there kind of like a real-time mechanism?
00:26:01.359 --> 00:26:06.079
Um, is it going through the N RWA or something else?
00:26:06.240 --> 00:26:10.799
I mean, how how are how are you guys sharing threat telemetry, etc.?
00:26:11.680 --> 00:26:13.039
Yeah, exactly.
00:26:13.279 --> 00:26:20.000
So um we've we've kind of built the back end uh for this and and actually have data um moving up to it now.
00:26:20.240 --> 00:26:24.319
Uh it is, yes, housed at the National Rural Water Association.
00:26:24.400 --> 00:26:31.920
Uh and and it's housed there for a for a pretty specific reason, kind of back to your point about policy um opportunities.
00:26:32.160 --> 00:26:32.480
Yeah.
00:26:32.960 --> 00:27:01.680
That since the National Rural Water Association is already funded by the federal government to provide technical assistance to water utilities, uh, we believe that by building this capability at NRWA, that will make uh create an easy button for the federal government to just say, okay, great, they already have this capability, fine, we'll just kind of increase the line item in the federal budget that already goes to them annually, and they can just do this uh moving forward.
00:27:01.920 --> 00:27:06.079
But um, yes, that is the the capability is built at NRWA.
00:27:06.160 --> 00:27:08.960
It is uh there is data flowing there now.
00:27:09.119 --> 00:27:18.240
Um, we're just hoping to really uh um be able to scale it dramatically in in the coming months and years and and hoping the federal government is gonna step in and do its part for that.
00:27:19.759 --> 00:27:28.559
Uh any early wins or success metrics you can tell me about the WWC so far since it was announced in August?
00:27:29.119 --> 00:27:29.519
Sure.
00:27:29.680 --> 00:27:30.720
Uh couple things.
00:27:30.880 --> 00:27:40.079
Well, oh, by the way, first of all, I um um I I hope that you uh and your listeners um uh notice our play on acronyms here.
00:27:40.160 --> 00:27:46.720
Uh so the WWC, so it's like you know, water closet, so WC, but this is the WWC.
00:27:46.799 --> 00:27:53.599
So but then also it's a triple play on acronyms because it's like WWE, but this is WWC.
00:27:53.680 --> 00:27:56.960
So like we're we got a lot going on with this acronym, very intentionally.
00:27:57.039 --> 00:27:57.759
Um, thank you.
00:27:57.839 --> 00:27:59.279
So I had a feeling.
00:27:59.519 --> 00:28:02.000
Uh but anyway, we love our acronyms.
00:28:02.160 --> 00:28:18.240
Um uh yeah, so uh we've actually been uh contacted by some folks who were uh several entities that were affected by the recent attack uh that you referenced and have been supporting them.
00:28:18.400 --> 00:28:27.839
Um we're happy that you know the words getting out that that we're an entity that folks can trust to reach out to that you know we're not making any money off this.
00:28:27.920 --> 00:28:30.240
This is, like I said, philanthropically funded.
00:28:30.400 --> 00:28:43.839
Um, but at the same time, we're bringing in, you know, the best in the business, um, you know, from the water perspective, you know, the NRWA, and and also these MSSPs from the uh cyber perspective, and not to mention DARPA and so on.
00:28:44.000 --> 00:28:53.200
So um that's been a big success for us that we've that we've been uh asked to help with some of the remediation and so on, uh following that.
00:28:53.440 --> 00:29:24.880
And then separately, um, you know, because uh for the first two years it was so hard to gain adoption um uh that we really thought that our our big challenge after announcing the WWE C was gonna be uh you know just getting folks to take the free help because there's a lot of these utilities who just don't didn't know about the threat or or you know, again, you know, are thinking about viewing it in terms of herd theory instead of you know they're gonna find them eventually.
00:29:25.039 --> 00:29:32.720
Um but since we announced it, we've just got an overwhelming number of utilities that are raising their hand and and and asking to be a part of it.
00:29:32.880 --> 00:29:47.759
Uh and we're uh really excited about the fact that our our problem right now is processing um all the incoming utilities, um, not uh getting folks to pay attention and take the help.
00:29:47.920 --> 00:29:53.039
Um and so that's that's been a great um uh surprise to us, honestly.
00:29:53.119 --> 00:30:09.599
Um but it's also again, as I as I said, you know, compared to the election industry 10 years ago, it it really is just such a night and day scenario where folks understand the threat um and and realize that it can affect them and they want help.
00:30:09.680 --> 00:30:12.079
Um and they're raising their hand, which is great.
00:30:12.480 --> 00:30:14.400
All right, so uh a last question.
00:30:14.640 --> 00:30:23.599
I definitely wanted to bring up the summer's attacks on the the different water communities, and I think close to a dozen states, if I recall correctly.
00:30:24.000 --> 00:30:35.119
When you hear about incidents like this, what what do you make of them from it we didn't really see an uh a super negative impact, certainly on public safety.
00:30:35.440 --> 00:30:49.200
Do you see these kinds of attacks, these kinds of incidents, as more of a demonstration of capabilities or an attempt to sow some chaos rather than actual kind of sabotage of a water utility in in this case?
00:30:49.839 --> 00:30:53.279
Yeah, I think there's a couple it it I think there's a couple different things.
00:30:53.519 --> 00:31:00.799
So in the case of Vol Typhoon, which I know isn't what you just referenced, but just to kind of go back to the example, and I'll come back to uh the other thing.
00:31:00.960 --> 00:31:25.920
Um in the case of Vol Typhoon, what seems to be, and this is all in the press, I'm obviously not saying anything that is classified, but um what seems to be the case is that the Chinese are very deliberately putting malware on water utilities that support military assets that that would have to work immediately if there was a crisis with China.
00:31:26.079 --> 00:31:29.359
So presumably in a you know, a Chinese invading Taiwan or something like that.
00:31:29.839 --> 00:31:38.480
Um in that case, the the malware seems to be there for the very specific purpose of being able to shut off the water.
00:31:38.799 --> 00:31:42.480
It's not really a threat or they want to show us that they can do it.
00:31:42.799 --> 00:31:43.839
Like we know they can do it.
00:31:44.000 --> 00:31:52.079
That's not, I mean, they're one of the best countries in the world at this stuff, and and it's not that hard to plant malware in a in a water utility.
00:31:52.160 --> 00:32:02.960
So um in that case, the the object seems to be actual destruction of the uh of the IT in the event they need it, you know, in the event there is a conflict.
00:32:03.599 --> 00:32:12.799
In the case of what presumably was Iran, I know it hasn't been confirmed, but you know, the media reports and so on seem to uh you know uh imply that it was Iran.
00:32:13.279 --> 00:32:25.599
Um what that seemed to be, based on the timing and so on, was uh exactly what you said a a demonstration of capability and willingness to use it.
00:32:26.240 --> 00:32:40.960
Um and that is likely because it was a it was happened right around a key time in negotiations between the administration, uh the American administration, the Trump administration, and uh the Iranians uh over the war.
00:32:41.440 --> 00:32:49.519
And it seemed to be a shot across the bow of the Iranians saying, you know, you guys might think you have all the cards, but you know, we have a few up our sleeves too.
00:32:49.759 --> 00:32:58.400
Uh, you know, I think a lot of people criticize Trump for denying that it ex it happened, but um, you know, look, I I don't agree with Trump on everything by any stretch of the imagination.
00:32:58.640 --> 00:33:10.720
But I think in in that particular situation, um, you know, again, the the president's in the middle of an information war himself, and he doesn't uh want to cede any ground to the Iranians, uh, particularly in the middle of a negotiation.
00:33:10.880 --> 00:33:17.200
So I I understand at least the thinking behind why they they wouldn't come from it, uh and and so on.
00:33:17.359 --> 00:33:30.559
But uh it's that seemed to be a demonstration of capability and again willingness to use that capability uh that that I don't think we've we've seen from that really that I don't think we've seen before.
00:33:30.960 --> 00:33:44.960
Um and by the way, there's some I think from the Iranian's perspective, uh I think there in their mind there's some real kind of poetic justice going on because of course what they attack is a PLC.
00:33:45.359 --> 00:33:56.640
And as we all know, uh what was attacked in the um Stuxnet uh or what's you know colloquially referred to as the Stuxnet attacks uh against their nuclear program was what?
00:33:57.440 --> 00:33:58.000
A PLC.
00:33:59.279 --> 00:34:11.679
And so you know these these uh these spooks, they they they love this type of stuff, and and I I I would be surprised if they picked that particular device just because it it uh you know functionally made sense.
00:34:11.760 --> 00:34:18.239
I I think they do they do do these things to you know send signals to each other and so forth.
00:34:18.480 --> 00:34:19.119
Yeah, definitely.
00:34:19.440 --> 00:34:20.000
Which is kind of cool.
00:34:20.079 --> 00:34:22.559
It's like the stuff you see in spy movies, but actually real, you know.
00:34:22.800 --> 00:34:24.559
Yeah, it's definitely part of the playbook.
00:34:24.800 --> 00:34:25.440
Yeah.
00:34:25.760 --> 00:34:26.559
All right, Jake.
00:34:26.639 --> 00:34:27.760
That's a good place to leave it.
00:34:27.840 --> 00:34:30.079
Um I want to thank you for coming on the show.
00:34:30.159 --> 00:34:31.039
I really appreciate it.
00:34:31.119 --> 00:34:32.239
I thought it was a great conversation.
00:34:32.320 --> 00:34:34.159
I think people are gonna get a lot out of it.
00:34:34.559 --> 00:34:35.360
Yeah, absolutely.
00:34:35.519 --> 00:34:36.159
Thanks for having me.
00:34:36.239 --> 00:34:36.400
Really?
00:34:37.360 --> 00:34:38.400
All right, have a good day.
00:34:38.480 --> 00:34:38.800
Thanks.
00:00:15.679 --> 00:00:18.079
All right, welcome back to the Nexus podcast.
00:00:18.239 --> 00:00:19.920
Jake Braun is my guest.
00:00:20.160 --> 00:00:27.600
Jake is uh a co-founder of DEF CON Franklin and former White House acting principal, deputy national cyber director.
00:00:27.839 --> 00:00:32.479
If you are unfamiliar, DEF CON Franklin is a volunteer-driven security program.
00:00:32.560 --> 00:00:41.520
It connects security researchers and hackers associated with DEF CON with uh US-based water and wastewater utilities, as well as K-12 schools.
00:00:41.679 --> 00:00:42.159
Very interesting.
00:00:42.320 --> 00:00:54.079
So this summer at DEF CON, uh, DEF CON Franklin and the National Rural Water Association announced the Water Watch Center, which provides uh support to utilities in the event of a breach.
00:00:54.240 --> 00:01:00.159
So Jake is going to take us through both programs, and uh obviously this is a very timely conversation.
00:01:00.399 --> 00:01:04.000
I've been looking forward to this, so I really appreciate Jake coming on.
00:01:04.159 --> 00:01:07.920
Uh, before we start, just my usual reminder to subscribe to the podcast.
00:01:08.000 --> 00:01:15.840
It's really the best way to keep up with new episodes and check out uh all 141 that uh maybe you've missed so far.
00:01:15.920 --> 00:01:17.359
So if you're new to the show.
00:01:17.439 --> 00:01:18.400
So thanks for listening.
00:01:18.480 --> 00:01:23.200
And uh, we are on all the platforms and easy to find, so please subscribe to us.
00:01:23.280 --> 00:01:25.439
So let's get started with today's episode.
00:01:25.599 --> 00:01:26.319
Hi, Jake.
00:01:26.400 --> 00:01:27.200
How are you?
00:01:27.519 --> 00:01:28.319
Good, how are you?
00:01:28.400 --> 00:01:29.200
Thanks for having me.
00:01:29.519 --> 00:01:29.760
Thank you.
00:01:29.840 --> 00:01:30.719
Yeah, you're welcome.
00:01:30.879 --> 00:01:32.560
I appreciate you giving me the time.
00:01:32.799 --> 00:01:36.959
Um, tell everybody a little bit about yourself and of course DEF CON Franklin.
00:01:37.040 --> 00:01:38.159
How'd you get involved there?
00:01:38.640 --> 00:01:39.040
Sure.
00:01:39.200 --> 00:01:41.120
Uh so I'm Jake Braun.
00:01:41.439 --> 00:01:54.239
As you suggested, uh right now I um the executive director of the Cyber Policy Initiative at the University of Chicago and uh also CEO of a small uh consulting firm in Washington called Cambridge Global Advisors.
00:01:54.400 --> 00:02:11.840
Uh previous to that, I was the um acting principal deputy national cyber director in the White House, which is a very long way of saying that I was the essentially the COO of uh the new cyber office they set up uh in the White House back in in uh 2019.
00:02:12.240 --> 00:02:25.039
Um and uh in that capacity, uh, you know, we did a lot of work on uh water security, um uh issues with cyber workforce and and so on and so forth.
00:02:25.199 --> 00:02:45.360
And so when I left, uh was talking to my good friend Jeff Moss about uh some work we had done years ago uh when he and I and a couple friends of ours, Matt Blaze and Hari Hirsty and Maggie McAlpine, uh started the the voting machine hacking village or the voting village as we call it, uh DEF CON.
00:02:46.000 --> 00:02:53.840
And uh when we when we started that, uh, you know, we there was a lot of great things that came out of it.
00:02:53.919 --> 00:03:06.800
Um, but two of them were we started doing uh reports annually uh from the voting village on kind of what uh hacks we found and and and how they were relevant from a policy perspective.
00:03:07.039 --> 00:03:09.919
And uh and we started putting that in an annual report.
00:03:10.000 --> 00:03:17.280
And we also uh encouraged folks from the DEF CON community to volunteer to support local election offices and stuff.
00:03:17.520 --> 00:03:22.080
And so as Jeff and I were talking when I was leaving the White House, we were like, gee, why don't we extend that to all of DEF CON?
00:03:22.400 --> 00:03:39.759
And so now we do an annual report for DEF CON uh via this project you mentioned called Franklin, um which Jeff and I co-uh co-run that identifies the best and brightest uh um discoveries or announcements or uh innovations at DEF CON.
00:03:40.000 --> 00:03:44.479
And then we do some policy analysis on why that matters um from a policy perspective.
00:03:44.560 --> 00:03:49.199
And so we put that out in our Hackers Almanac that we put out two of now.
00:03:49.280 --> 00:03:54.560
Uh and uh um we'll we'll have another one we're working on right now for Blast DEF CON.
00:03:54.800 --> 00:04:16.399
And then also we've asked uh uh the DEF CON community to s to step up and help these really under-resourced water uh utilities um to uh um you know help up their game in cyber because right now they they're uh kind of uh at the top of every bad guy's target list, yeah, particularly the ones that support military assets, data centers, or hospitals.
00:04:16.639 --> 00:04:23.759
Um so it's a little bit about my background and a little bit of a kind of an overview of what Franklin is uh is all about.
00:04:24.560 --> 00:04:32.160
So from your experience, how would you characterize kind of the current state of affairs in terms of cybersecurity at water utilities?
00:04:32.240 --> 00:04:45.519
Like you mentioned, there's so many small community systems, and you probably got you know very strapped IT people trying to not only keep the water clean but try to do some security or they outsource it.
00:04:45.680 --> 00:04:49.519
Um, you know, what's the current state of affairs from your perspective?
00:04:50.000 --> 00:04:50.560
Sure.
00:04:51.279 --> 00:05:00.160
So I I really think that water right now is where energy was about 10, 15 years ago.
00:05:00.399 --> 00:05:10.720
So I remember uh when I was in the Obama administration, I was White House liaison to Homeland Security, and I was talking to a friend of mine who was in the White House at uh the Council on Environmental Quality.
00:05:10.800 --> 00:05:15.279
And they were at the time really thinking through how they were gonna put together the smart grid.
00:05:15.439 --> 00:05:29.680
And as we remember, you know, the smart grid was okay, now we're gonna be able to, you know, um understand how and where to send power so we're not wasting all this power and and so on, is gonna be this great thing for the environment and for rate payers and everybody else.
00:05:29.920 --> 00:05:36.480
Um and so I remember uh saying to him, this is probably in 2009, I was like, hey, has cyber ever come up?
00:05:36.639 --> 00:05:38.800
Cybersecurity ever come up in these conversations?
00:05:38.959 --> 00:05:41.519
Uh and he was like, not once.
00:05:41.680 --> 00:05:44.079
No one has ever mentioned cybersecurity once.
00:05:44.240 --> 00:05:46.319
And that was 2009 in the energy space.
00:05:46.399 --> 00:05:58.079
Now, of course, energy is probably the furthest along next to maybe the financial industry or the defense industrial base, um, folks like that, in terms of uh the security of the industry.
00:05:58.160 --> 00:06:01.199
They've really upped their game tremendously since then.
00:06:01.519 --> 00:06:05.519
Um water uh is is kind of in the same place they were.
00:06:05.600 --> 00:06:12.240
You know, nobody's really talking about cybersecurity and water, um, even you know, four or five years ago.
00:06:12.319 --> 00:06:23.199
It's it's only really, you know, Vol Typhoon and and a few other things that have gotten uh broad swaths of policymakers and others to really even talking about what cybersecurity and water means.
00:06:23.360 --> 00:06:32.959
Um and so folks are really now um starting to pay attention and and starting to realize that they can't really rely on the herd theory anymore.
00:06:33.120 --> 00:06:38.800
You know, it can't just be I have to be uh a little bit faster or frankly luckier than than the other guy.
00:06:38.879 --> 00:06:41.439
Um the bad guys, the bad guys are after me.
00:06:41.519 --> 00:06:47.040
Uh and I think you know, Iran to your uh what you were alluding to earlier is has played a big role in that.
00:06:47.199 --> 00:06:49.839
Um, but really we're we're kind of starting at zero.
00:06:50.000 --> 00:06:55.680
Um and it's not because folks are dumb that work in this space, this just wasn't in their job jar until very recently.
00:06:55.920 --> 00:06:56.240
Sure.
00:06:56.480 --> 00:07:08.480
And so, you know, we're we're still at a point where we're you know having talking to folks about changing default passwords and and uh you know turning on multi-factor authentication and so on.
00:07:08.639 --> 00:07:19.360
Um, but but I think the biggest need in the industry right now, by far and away, now that we've had um DEF CON researchers in these utilities for you know over two years now, is asset inventory.
00:07:19.519 --> 00:07:22.079
Um the you know, this is you know, control number one.
00:07:22.160 --> 00:07:31.199
If if we had the folks at the Center for N Security on the call right now that maintain the 20 critical cybersecurity controls, they'd tell you asset inventory is the most important thing.
00:07:31.360 --> 00:07:35.279
Well, turns out in the water space, that is absolutely true.
00:07:35.439 --> 00:08:09.360
Um, and I think maybe even more so uh for folks in the water space, uh just getting a sense of of what in their environment is connected to the is connected to their network uh is is really a non-trivial task and and and and kind of the basis for them understanding how they can secure their their utility and not just secure it by the way, but also in the event of a catastrophic effect um attack, understanding how to take it offline and run it manually, which in theory everybody knows how to do.
00:08:09.519 --> 00:08:25.839
Um, but what we've realized after uh you know the uh alleged Iranian attacks, um it in practice it's unclear if folks know exactly how they would go about running these plants.
00:08:26.319 --> 00:08:34.240
As you suggested, that's not necessarily uh uh from uh a negligence point of view or not wanting to do something about it.
00:08:34.320 --> 00:08:38.320
It's resources, it's maybe even experience with cybersecurity, right?
00:08:38.480 --> 00:08:40.080
There's just oh god.
00:08:40.240 --> 00:08:41.279
Oh absolutely.
00:08:41.440 --> 00:08:53.600
I mean, I remember talking to somebody the other day uh at one of the water conferences, which we now go to all the time, where a bunch of you know hackers and cyber people walking around these water conferences, which is kind of funny, by the way.
00:08:53.679 --> 00:09:03.360
Um, as a side note, if you're uh if you're on a Zoom call with them or whatever, and uh you have a hacker on one screen and a water guy on the other screen, I swear to God, it's like they're cousins.
00:09:03.519 --> 00:09:13.679
Like they're they're you know, they'll usually have the like the long beard, um, you know, and kind of the frumpy clothes, uh, and uh and whatever.
00:09:13.840 --> 00:09:24.720
It's just like the water guys, a little bit more of like a Duck Dynasty flavor, and the hacker guys usually got some maybe piercings and like other maybe color going on uh you know with the hair.
00:09:24.799 --> 00:09:31.840
But it's like the same dude with a slightly different, you know, uh um uh take on take on that look.
00:09:31.919 --> 00:09:33.840
But anyway, they need some sunlight.
00:09:34.159 --> 00:09:35.440
Yeah, right, right.
00:09:35.679 --> 00:09:47.840
Um so uh no, we were talking to somebody the other day, uh, one of these water conferences, and you know, he was asking us about whatever, and you know, it turns out he's down the road from some military asset.
00:09:48.000 --> 00:09:50.960
He doesn't know exactly what they do, but knows the military runs it.
00:09:51.120 --> 00:09:56.559
Um, because nearly all military assets are ran on civilian um water, by the way.
00:09:56.960 --> 00:10:00.000
Uh and he's like, Well, what should I do?
00:10:00.080 --> 00:10:00.480
Blah blah blah.
00:10:00.639 --> 00:10:03.759
And so we were talking to him about some of the basics like I was just describing.
00:10:04.000 --> 00:10:11.919
And he was like, Yeah, I mean, I just God, I just don't have a lot of time, you know, because I run the Fourth of July parade as well for the town and blah, blah, blah.
00:10:12.480 --> 00:10:16.639
Literally, this guy runs the Fourth of July Parade and runs the water utility.
00:10:16.879 --> 00:10:24.639
And and again, no one ever told him, you know, that cybersecurity was part of his job until, you know, that conference was, I think, the first time he heard it.
00:10:24.879 --> 00:10:25.039
Sure.
00:10:25.200 --> 00:10:26.240
So it's not like he's dumb.
00:10:26.320 --> 00:10:30.000
It's just, you know, he's got a lot going on, has no resources.
00:10:30.240 --> 00:10:36.720
Um, you know, if if if they want to raise rates in these towns, um, that'll be the last time any of those people hold office.
00:10:36.879 --> 00:10:41.600
Um, who vote for them to raise rates, so it's completely unpalatable to do it.
00:10:41.919 --> 00:10:49.919
Um, and uh uh, you know, we're that's you know, that that's that's the that's the situation in most of the country.
00:10:50.240 --> 00:10:54.000
So with Franklin, it's it's largely a volunteer effort.
00:10:54.240 --> 00:10:57.600
Um how's that initiative gone so far?
00:10:57.759 --> 00:11:01.360
Uh are you finding folks want to step up?
00:11:01.519 --> 00:11:06.320
And you know, what are what is some of the kind of the output that's coming out of those interactions?
00:11:07.039 --> 00:11:10.000
Oh God, I uh yes, people want to step up.
00:11:10.080 --> 00:11:22.799
I mean, you know, after we announced it a couple years ago, uh, we had so many signups in the first 10 days, we had to shut down the intake form because I didn't have enough staff to process all the people signing up.
00:11:23.039 --> 00:11:25.679
Um, and truly it's it's been invaluable.
00:11:25.759 --> 00:11:34.399
I I think that uh if you if you um won't, you know, when we move on to talk about the Water Watch Center, which I think you mentioned uh you want to talk about at some point.
00:11:34.720 --> 00:11:35.039
Yes.
00:11:35.360 --> 00:12:10.720
Um had we not um had Franklin in place and had all these uh um folks who've who've raised their hand to volunteer, I wouldn't have been able to put folks, uh put you know, some of these really amazing technologists um in a handful of utilities for uh about two years uh to really study what is going on in these utilities, what is you know the the um you know the kind of baseline um you know uh uh status of the security and networks and so on and so forth.
00:12:10.879 --> 00:12:17.440
You know, but for that, um we would have made all, you know, we we wouldn't have been able to come up with what we've done.
00:12:17.600 --> 00:12:28.000
And in fact, um it's not just the folks we were able to embed in in several utilities, but also we had folks who were doing research on you know different options and so on.
00:12:28.159 --> 00:12:40.000
So, for example, one of the options that uh was proposed early on was providing a bunch of free uh products and stuff from some of the huge cyber companies.
00:12:40.240 --> 00:12:44.240
And we found out early on that's probably not gonna work for most of these little guys.
00:12:44.399 --> 00:12:49.120
Um, because, and by the way, like 95% of the utilities are are these little guys.
00:12:49.279 --> 00:12:49.440
Right.
00:12:49.600 --> 00:12:53.679
Uh, because they, you know, a lot of that free stuff is kind of free like a puppy.
00:12:53.759 --> 00:13:00.399
You know, it's it's uh yeah, here buy my I'll I'll I'll give you 20 free licenses, but you gotta buy my$150,000 box.
00:13:00.480 --> 00:13:10.399
Or I'm gonna give this screen that's gonna blink when something bad happens, but you have to find some guy, you have to pay$200,000 a year uh to to watch the screen and know what to do when it blinks, you know.
00:13:10.559 --> 00:13:10.799
Sure.
00:13:11.039 --> 00:13:18.399
Um, you know, when by the way, the highest salary and the water utility is$50,000 a year, you know, um in many of these places.
00:13:18.720 --> 00:13:19.039
Makes sense.
00:13:19.679 --> 00:13:20.799
Uh yeah, exactly.
00:13:20.960 --> 00:13:25.679
So so we had a lot of folks doing research like that on kind of what solutions and stuff made sense.
00:13:25.840 --> 00:13:35.919
And so uh uh because of all the the research, the this you know, security in terms of up in the game of a lot of these utilities, um, et cetera, et cetera.
00:13:36.000 --> 00:13:38.960
Um, but for that, we wouldn't have been able to launch the watch center.
00:13:39.120 --> 00:13:48.320
And now um that DEF CON community and the Franklin volunteers are still critical to what we're doing uh with the So let's talk about the Watch Center.
00:13:48.480 --> 00:13:50.159
Just kind of how does it work?
00:13:50.320 --> 00:13:57.120
So this is basically an initiative to provide support in the event of an attack and if in the event of a compromise.
00:13:57.360 --> 00:13:59.360
Um take it from there.
00:13:59.440 --> 00:14:00.320
What what happens?
00:14:00.480 --> 00:14:01.440
How do people get involved?
00:14:01.679 --> 00:14:09.200
Well, I I I would actually say that's a little bit more prophylactic than than than just uh IR type uh situation.
00:14:09.759 --> 00:14:15.840
So uh essentially, so think about it as if it's like the human nervous system, right?
00:14:16.080 --> 00:14:20.159
So um if you think about the the human nervous system, so you've got the brain, right?
00:14:20.240 --> 00:14:22.639
And the brain takes in all this data and and makes decisions.
00:14:22.720 --> 00:14:29.600
And so that would be like the National Rural Water Association, which is this uh trade association in the water industry.
00:14:29.679 --> 00:14:32.000
They support about 90% of the utilities in the country.
00:14:32.159 --> 00:14:40.399
They've been funded by the federal government since 1976 to provide technical assistance, albeit not cyber, but up until now, um, to water utilities.
00:14:40.559 --> 00:14:42.799
And so they're kind of like the hub, like the brain.
00:14:42.960 --> 00:14:49.919
So uh anonymized data from water utilities will go up to the National Rural Water Association.
00:14:50.080 --> 00:14:55.120
It'll be able to understand trends, problems, solutions that it can push down nationally, blah, blah.
00:14:55.360 --> 00:15:03.039
Okay, but as we all know, um you don't want your brain making some like really fast decisions.
00:15:03.120 --> 00:15:07.759
So if your hand touches a stove, your brain doesn't, you don't want your brain deciding to pull your hand away.
00:15:07.919 --> 00:15:12.080
You have nerve nerve clusters around your body that would pull your hand away, right?
00:15:12.320 --> 00:15:15.679
Um and uh that can operate in in in a millisecond.
00:15:15.840 --> 00:15:22.879
And so uh that um so separate or one layer down from the brain, we have uh MSSPs.
00:15:22.960 --> 00:15:24.240
So we have seven right now.
00:15:24.320 --> 00:15:30.480
We're gonna expand to ten, one for each region of of uh uh federal region of the country.
00:15:30.639 --> 00:15:35.279
The federal government split up into ten regions, so we'll have one MSSP per region.
00:15:35.919 --> 00:15:38.799
Um we're not exactly that rigid, but basically.
00:15:39.360 --> 00:15:45.279
So those MSSPs are connected directly to water utilities.
00:15:45.679 --> 00:15:52.480
Uh and those uh so they're they're now providing uh, and this is where the prophylactic side of this comes in.
00:15:52.639 --> 00:16:05.279
They're providing you know security uh um advice, resources, etc., helping folks with things like asset inventory, making sure they're turning on their multi-factor authentication, software analysis, all this type of stuff.
00:16:05.600 --> 00:16:14.080
Um they are uh the conduit from the utilities to report up this anonymized data to the brain, but they also can act independent of the brain.
00:16:14.320 --> 00:16:26.639
And crucially, we've made them can the utility or the MSSPs connected to each other so that they can also act in concert if need be without the brain, if there's a if there's a massive attack quickly or something like that.
00:16:26.960 --> 00:16:32.480
Um and then uh down your kind of nerve endings are back to our Franklin volunteers.
00:16:32.559 --> 00:16:37.919
So we still have volunteers who uh we deploy out to utilities when needed.
00:16:38.080 --> 00:16:40.000
They can help with IR, for example.
00:16:40.159 --> 00:16:43.519
They can also help because we have so many volunteers.
00:16:43.679 --> 00:16:56.559
If we've got a utility that's really far away from an MSSP, we can set up a volunteer to kind of drive out there and help get them hooked up or help walk through um somebody through kind of you know ins and outs of some of the basics and so on.
00:16:56.720 --> 00:17:00.320
And so they're kind of like the nerve endings that that go out and kind of do things.
00:17:00.559 --> 00:17:15.759
Um speaking of the nerve endings, we do still have um in our scenario here uh a uh a big kind of challenge that is yet to be addressed that we're working on with DARPA.
00:17:16.240 --> 00:17:21.200
And so that is uh a massive workforce challenge.
00:17:21.519 --> 00:17:40.559
And so, you know, our volunteers are awesome, they are salt of the earth, these are some of the most brilliant hackers you'd ever meet in your life, and they're you know great Americans and good citizens and and and want to help their country and and their community, however, uh there will never be enough of them to cover 150,000 water utilities in the country, right?
00:17:40.960 --> 00:17:47.680
Um and certain certainly not, you know, at the you know uh standard rates we would need we need that coverage to happen.
00:17:47.839 --> 00:17:48.160
Yeah.
00:17:48.400 --> 00:17:58.720
And so uh, but the thing is at the same time, at any given moment, we've got about a 500,000-person shortage in cyber professionals to open cyber jobs across the country.
00:17:59.039 --> 00:18:17.599
So the idea we're gonna magically come up with 150,000 new cyber people to work in all these utilities, which by the way, often have as their you know, upper band income or salary$50,000,$60,000 a year, which almost nobody in cyber uh would agree to work for.
00:18:17.759 --> 00:18:20.720
Right uh, we've got a big challenge.
00:18:20.960 --> 00:18:31.759
And so we're working with DARPA to do some research uh where they're putting together some uh uh working with some of our utilities to create a digital twin.
00:18:31.920 --> 00:18:40.720
So a uh a digital twin of the environment of the utility, and then they drop a red team agent, a blue team agent into the twin, so not in the real environment, but into a twin.
00:18:40.880 --> 00:18:46.000
They fight each other a gazillion times until we can figure out how we help the blue the blue team win.
00:18:46.480 --> 00:18:49.359
Uh this is to research and assess.
00:18:49.440 --> 00:18:52.400
Um we don't know if this is gonna be the right solution, we're testing it.
00:18:52.799 --> 00:19:05.200
Um but could it be the right solution to dump a bunch of these blue team agents in these water utilities down the road that we just know are just never gonna have the resources to hire a cyber professional?
00:19:06.640 --> 00:19:09.599
And uh so again, we're not sure that's the right answer.
00:19:09.680 --> 00:19:10.240
This is a test.
00:19:10.319 --> 00:19:30.480
It's it's it is research, and DARPA is doing fundamental research, which is which is kind of where we are at this point, but it is um another key component of what we're doing uh to kind of try and think a few steps down the road where it's like, okay, great, we've got our nervous system in place, we've got our NRWA being the brain, we've got our MSSPs as the nerve clusters, we're doing all this great stuff.
00:19:30.640 --> 00:19:35.599
But oh, gee, a year from now when we're trying to really scale, it's like there's no humans to do it.
00:19:35.680 --> 00:19:42.160
Well, yeah, hopefully this might be an option that that can enable us to really scale um as this as we prove out the model.
00:19:42.559 --> 00:19:45.279
That's the DARPA Castle program you're referring to, right?
00:19:45.599 --> 00:19:46.960
Yes, that's the DARPA Castle program.
00:19:47.359 --> 00:19:48.880
That's a really fascinating initiative.
00:19:49.039 --> 00:19:49.279
Yeah.
00:19:49.519 --> 00:19:50.400
It really it really is.
00:19:50.559 --> 00:19:56.799
Every time I talk to those guys, I'm it's one of those things, you know, where you do these different projects and you're like, oh man, I wish I could just spend all my time on this.
00:19:56.880 --> 00:20:05.039
That's one of those, like every conference call I get off, I'm like, I wish I could just do this, but you know, there's people with much more boring things that actually pay for this and they have to do.
00:20:06.079 --> 00:20:11.519
Um just to go back to the Water Watch uh center for a second, uh, what's the outreach like there?
00:20:11.680 --> 00:20:21.200
Are you working through the uh N N RWA exclusively or knocking on doors, so to speak, and uh if there's an incident or a need?
00:20:22.240 --> 00:20:24.079
Yeah, it's really all of the above.
00:20:24.160 --> 00:20:55.039
I will say one of the one of the really, you know, having having been in the in the election security space when this first all kind of popped, you know, back in 2016 after the election and the Russian interference and everything, um, you know, one of the one of the big issues in the election industry was that everybody was like, oh, there's no real threat here, you know, the the voting machines aren't aren't connected to the internet, which is just like what they mean is they're not persistently connected to the internet.
00:20:55.279 --> 00:21:02.400
I mean, I don't even want to go down this rabbit hole, it's so frustrating, but like, you know, all this stuff's secure, you couldn't really hack it at scale, you can't do blah, blah, blah.
00:21:02.559 --> 00:21:03.200
You know.
00:21:03.440 --> 00:21:12.559
Um, and it was just this kind of denial of the problem and this kind of visceral reaction against anybody who wanted to criticize, you know, call their baby ugly, and so on.
00:21:12.640 --> 00:21:16.880
Um, when in fact it was really the cyber community coming in and saying, hey, guess what?
00:21:16.960 --> 00:21:19.359
You guys are next on the list of the bad guys you're going after.
00:21:19.519 --> 00:21:23.200
You know, here's how we can try and, you know, up your game in cyber.
00:21:23.519 --> 00:21:25.920
It's been really the polar opposite in water.
00:21:26.079 --> 00:21:37.599
Um, you know, we we certainly there's folks who are like, hey, I could run this thing manually if I had to, but none of them are saying, I would prefer to run it manually, so leave me alone and don't talk to me about cybersecurity, you know?
00:21:37.759 --> 00:21:42.319
And none of them are saying, like, oh, this thing is totally secure and you could never hack my water utility.
00:21:42.480 --> 00:21:45.200
They're like, please tell me the things to do, you know.
00:21:45.359 --> 00:21:59.680
Um, and so I I think that we have really seen a um uh a far different and frankly more mature and responsible reaction by the water industry um to this than we did by uh from the election industry.
00:22:00.160 --> 00:22:04.240
Uh when all the when when when they went through pretty much exactly the same thing 10 years ago.
00:22:04.480 --> 00:22:04.799
Right.
00:22:05.680 --> 00:22:21.200
So given your past government experience, I I have to ask, are there is are there policy things, are there regulatory um initiatives that the government could push forward that would help here?
00:22:21.279 --> 00:22:22.880
What's what's missing from the government?
00:22:22.960 --> 00:22:26.799
Or are they doing stuff behind the scenes that we're not necessarily aware of?
00:22:27.200 --> 00:22:27.440
Sure.
00:22:27.599 --> 00:22:31.599
Well, I mean they're they're funding the Castle program, you know, obviously, because that's a DARPA program.
00:22:31.680 --> 00:22:34.960
So um, and and that's really good, and they should keep doing that.
00:22:35.200 --> 00:22:48.079
Um uh, you know, the other thing is the WWC is funded um exclusively from philanthropic dollars right now, and that's not sustainable for the future, you know.
00:22:48.240 --> 00:23:01.039
Uh we don't ask uh, you know, if the Iranians are uh uh invading the country, we don't ask, you know, the Ford Foundation to fund the Kalamazoo County Water Utility to come out and fight the Iranian Red Guard off.
00:23:01.200 --> 00:23:03.119
You know, uh that's the federal government's job.
00:23:03.200 --> 00:23:09.200
The federal government does national security and they should they need to fund the security of uh our water utilities.
00:23:09.359 --> 00:23:14.079
Uh so that's one key policy uh uh decision that needs to be made.
00:23:14.160 --> 00:23:20.559
Is the government, the federal government needs to stand up and say, you know, this this is our job because it because it's a national security threat.
00:23:20.720 --> 00:23:22.480
Um that's number one.
00:23:22.640 --> 00:23:47.119
Uh number two is uh I while I I don't think that uh more regulations are are necessary, uh I do think that there needs to be uh kind of more concerted effort to really by the federal government to really prioritize which utilities are the most critical.
00:23:47.279 --> 00:23:47.920
So, i.e.
00:23:48.079 --> 00:24:13.920
those that support military assets, because they're at the top of all the bad guys' targets list, those that support hospitals, um, because for obvious reasons, and also this may seem counterintuitive, but those that support data centers, not because we need to subsidize security for the big AI companies, but because those communities who's uh who have a water utility that now supports a data center, unbeknownst to them, are on the top of everybody bad, every bad guy's target list.
00:24:14.160 --> 00:24:23.359
And so um, you know, we should be uh we can't let those communities suffer just because somebody put a data center in their backyard.
00:24:23.440 --> 00:24:23.680
Yeah.
00:24:23.920 --> 00:24:47.599
And uh, you know, so I would recommend prioritizing those three categories first and then really going out and uh, you know, showing up with the local National Guard general, um, and the adjutant general, as they say, um, in a particular state, you know, somebody from CISA probably, um, somebody from the governor's office, maybe the mayor, uh showing up at the utility and saying, Hey, guess what?
00:24:47.839 --> 00:24:48.880
We're not kidding.
00:24:49.039 --> 00:24:52.240
Um, we'll and you know, you we really need to up your game in cyber.
00:24:52.319 --> 00:24:53.920
And oh, by the way, we're gonna pay for it.
00:24:54.160 --> 00:25:09.119
Um, they would have, you know, they would largely be welcomed with open arms by most of these utilities, and it would enable us to really get after the the um you know highest impact uh uh utilities uh quickly.
00:25:09.279 --> 00:25:10.880
And and that's it, it's a workable list.
00:25:10.960 --> 00:25:14.079
I mean, you're talking about a few thousand, not a hundred thousand.
00:25:14.240 --> 00:25:30.880
You know, that's that's a that's a a number that you could have a few hundred people, uh, or maybe even a few dozen people in the federal government um organize around, you know, knocking on all their doors over the course of six to twelve months and and getting those utilities up to speed.
00:25:31.039 --> 00:25:35.599
Um that you don't need a law for that, you don't need legislation, you don't need anything else.
00:25:35.759 --> 00:25:41.200
You just need the government to make a policy decision to intentionally do that targeting and do that outreach.
00:25:41.279 --> 00:25:41.519
Right.
00:25:41.680 --> 00:25:47.519
And then, you know, the and then implement the basics that the you know the federal government can do in its sleep.
00:25:49.039 --> 00:26:01.119
And just to go back to the WWC for a second, in terms of like uh sharing information on threats as they're happening, is there kind of like a real-time mechanism?
00:26:01.359 --> 00:26:06.079
Um, is it going through the N RWA or something else?
00:26:06.240 --> 00:26:10.799
I mean, how how are how are you guys sharing threat telemetry, etc.?
00:26:11.680 --> 00:26:13.039
Yeah, exactly.
00:26:13.279 --> 00:26:20.000
So um we've we've kind of built the back end uh for this and and actually have data um moving up to it now.
00:26:20.240 --> 00:26:24.319
Uh it is, yes, housed at the National Rural Water Association.
00:26:24.400 --> 00:26:31.920
Uh and and it's housed there for a for a pretty specific reason, kind of back to your point about policy um opportunities.
00:26:32.160 --> 00:26:32.480
Yeah.
00:26:32.960 --> 00:27:01.680
That since the National Rural Water Association is already funded by the federal government to provide technical assistance to water utilities, uh, we believe that by building this capability at NRWA, that will make uh create an easy button for the federal government to just say, okay, great, they already have this capability, fine, we'll just kind of increase the line item in the federal budget that already goes to them annually, and they can just do this uh moving forward.
00:27:01.920 --> 00:27:06.079
But um, yes, that is the the capability is built at NRWA.
00:27:06.160 --> 00:27:08.960
It is uh there is data flowing there now.
00:27:09.119 --> 00:27:18.240
Um, we're just hoping to really uh um be able to scale it dramatically in in the coming months and years and and hoping the federal government is gonna step in and do its part for that.
00:27:19.759 --> 00:27:28.559
Uh any early wins or success metrics you can tell me about the WWC so far since it was announced in August?
00:27:29.119 --> 00:27:29.519
Sure.
00:27:29.680 --> 00:27:30.720
Uh couple things.
00:27:30.880 --> 00:27:40.079
Well, oh, by the way, first of all, I um um I I hope that you uh and your listeners um uh notice our play on acronyms here.
00:27:40.160 --> 00:27:46.720
Uh so the WWC, so it's like you know, water closet, so WC, but this is the WWC.
00:27:46.799 --> 00:27:53.599
So but then also it's a triple play on acronyms because it's like WWE, but this is WWC.
00:27:53.680 --> 00:27:56.960
So like we're we got a lot going on with this acronym, very intentionally.
00:27:57.039 --> 00:27:57.759
Um, thank you.
00:27:57.839 --> 00:27:59.279
So I had a feeling.
00:27:59.519 --> 00:28:02.000
Uh but anyway, we love our acronyms.
00:28:02.160 --> 00:28:18.240
Um uh yeah, so uh we've actually been uh contacted by some folks who were uh several entities that were affected by the recent attack uh that you referenced and have been supporting them.
00:28:18.400 --> 00:28:27.839
Um we're happy that you know the words getting out that that we're an entity that folks can trust to reach out to that you know we're not making any money off this.
00:28:27.920 --> 00:28:30.240
This is, like I said, philanthropically funded.
00:28:30.400 --> 00:28:43.839
Um, but at the same time, we're bringing in, you know, the best in the business, um, you know, from the water perspective, you know, the NRWA, and and also these MSSPs from the uh cyber perspective, and not to mention DARPA and so on.
00:28:44.000 --> 00:28:53.200
So um that's been a big success for us that we've that we've been uh asked to help with some of the remediation and so on, uh following that.
00:28:53.440 --> 00:29:24.880
And then separately, um, you know, because uh for the first two years it was so hard to gain adoption um uh that we really thought that our our big challenge after announcing the WWE C was gonna be uh you know just getting folks to take the free help because there's a lot of these utilities who just don't didn't know about the threat or or you know, again, you know, are thinking about viewing it in terms of herd theory instead of you know they're gonna find them eventually.
00:29:25.039 --> 00:29:32.720
Um but since we announced it, we've just got an overwhelming number of utilities that are raising their hand and and and asking to be a part of it.
00:29:32.880 --> 00:29:47.759
Uh and we're uh really excited about the fact that our our problem right now is processing um all the incoming utilities, um, not uh getting folks to pay attention and take the help.
00:29:47.920 --> 00:29:53.039
Um and so that's that's been a great um uh surprise to us, honestly.
00:29:53.119 --> 00:30:09.599
Um but it's also again, as I as I said, you know, compared to the election industry 10 years ago, it it really is just such a night and day scenario where folks understand the threat um and and realize that it can affect them and they want help.
00:30:09.680 --> 00:30:12.079
Um and they're raising their hand, which is great.
00:30:12.480 --> 00:30:14.400
All right, so uh a last question.
00:30:14.640 --> 00:30:23.599
I definitely wanted to bring up the summer's attacks on the the different water communities, and I think close to a dozen states, if I recall correctly.
00:30:24.000 --> 00:30:35.119
When you hear about incidents like this, what what do you make of them from it we didn't really see an uh a super negative impact, certainly on public safety.
00:30:35.440 --> 00:30:49.200
Do you see these kinds of attacks, these kinds of incidents, as more of a demonstration of capabilities or an attempt to sow some chaos rather than actual kind of sabotage of a water utility in in this case?
00:30:49.839 --> 00:30:53.279
Yeah, I think there's a couple it it I think there's a couple different things.
00:30:53.519 --> 00:31:00.799
So in the case of Vol Typhoon, which I know isn't what you just referenced, but just to kind of go back to the example, and I'll come back to uh the other thing.
00:31:00.960 --> 00:31:25.920
Um in the case of Vol Typhoon, what seems to be, and this is all in the press, I'm obviously not saying anything that is classified, but um what seems to be the case is that the Chinese are very deliberately putting malware on water utilities that support military assets that that would have to work immediately if there was a crisis with China.
00:31:26.079 --> 00:31:29.359
So presumably in a you know, a Chinese invading Taiwan or something like that.
00:31:29.839 --> 00:31:38.480
Um in that case, the the malware seems to be there for the very specific purpose of being able to shut off the water.
00:31:38.799 --> 00:31:42.480
It's not really a threat or they want to show us that they can do it.
00:31:42.799 --> 00:31:43.839
Like we know they can do it.
00:31:44.000 --> 00:31:52.079
That's not, I mean, they're one of the best countries in the world at this stuff, and and it's not that hard to plant malware in a in a water utility.
00:31:52.160 --> 00:32:02.960
So um in that case, the the object seems to be actual destruction of the uh of the IT in the event they need it, you know, in the event there is a conflict.
00:32:03.599 --> 00:32:12.799
In the case of what presumably was Iran, I know it hasn't been confirmed, but you know, the media reports and so on seem to uh you know uh imply that it was Iran.
00:32:13.279 --> 00:32:25.599
Um what that seemed to be, based on the timing and so on, was uh exactly what you said a a demonstration of capability and willingness to use it.
00:32:26.240 --> 00:32:40.960
Um and that is likely because it was a it was happened right around a key time in negotiations between the administration, uh the American administration, the Trump administration, and uh the Iranians uh over the war.
00:32:41.440 --> 00:32:49.519
And it seemed to be a shot across the bow of the Iranians saying, you know, you guys might think you have all the cards, but you know, we have a few up our sleeves too.
00:32:49.759 --> 00:32:58.400
Uh, you know, I think a lot of people criticize Trump for denying that it ex it happened, but um, you know, look, I I don't agree with Trump on everything by any stretch of the imagination.
00:32:58.640 --> 00:33:10.720
But I think in in that particular situation, um, you know, again, the the president's in the middle of an information war himself, and he doesn't uh want to cede any ground to the Iranians, uh, particularly in the middle of a negotiation.
00:33:10.880 --> 00:33:17.200
So I I understand at least the thinking behind why they they wouldn't come from it, uh and and so on.
00:33:17.359 --> 00:33:30.559
But uh it's that seemed to be a demonstration of capability and again willingness to use that capability uh that that I don't think we've we've seen from that really that I don't think we've seen before.
00:33:30.960 --> 00:33:44.960
Um and by the way, there's some I think from the Iranian's perspective, uh I think there in their mind there's some real kind of poetic justice going on because of course what they attack is a PLC.
00:33:45.359 --> 00:33:56.640
And as we all know, uh what was attacked in the um Stuxnet uh or what's you know colloquially referred to as the Stuxnet attacks uh against their nuclear program was what?
00:33:57.440 --> 00:33:58.000
A PLC.
00:33:59.279 --> 00:34:11.679
And so you know these these uh these spooks, they they they love this type of stuff, and and I I I would be surprised if they picked that particular device just because it it uh you know functionally made sense.
00:34:11.760 --> 00:34:18.239
I I think they do they do do these things to you know send signals to each other and so forth.
00:34:18.480 --> 00:34:19.119
Yeah, definitely.
00:34:19.440 --> 00:34:20.000
Which is kind of cool.
00:34:20.079 --> 00:34:22.559
It's like the stuff you see in spy movies, but actually real, you know.
00:34:22.800 --> 00:34:24.559
Yeah, it's definitely part of the playbook.
00:34:24.800 --> 00:34:25.440
Yeah.
00:34:25.760 --> 00:34:26.559
All right, Jake.
00:34:26.639 --> 00:34:27.760
That's a good place to leave it.
00:34:27.840 --> 00:34:30.079
Um I want to thank you for coming on the show.
00:34:30.159 --> 00:34:31.039
I really appreciate it.
00:34:31.119 --> 00:34:32.239
I thought it was a great conversation.
00:34:32.320 --> 00:34:34.159
I think people are gonna get a lot out of it.
00:34:34.559 --> 00:34:35.360
Yeah, absolutely.
00:34:35.519 --> 00:34:36.159
Thanks for having me.
00:34:36.239 --> 00:34:36.400
Really?
00:34:37.360 --> 00:34:38.400
All right, have a good day.
00:34:38.480 --> 00:34:38.800
Thanks.
