KOPYA NG SALIN 🔗
WEBVTT
00:00:03.439 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.439 --> 00:00:18.719
The International Criminal Police Organization.
00:00:18.719 --> 00:00:24.800
Not usually someone you want knocking on your door, but it turns out they're pretty good company.
00:00:24.800 --> 00:00:30.160
Present in 196 countries with one shared mission.
00:00:30.160 --> 00:00:33.920
To chase the worst criminals on Earth.
00:00:33.920 --> 00:00:41.280
Cartels, traffickers, ransomware gangs, the kinds you don't want finding your IP address.
00:00:41.280 --> 00:00:46.799
INTERPOL is probably the closest we'll get to our knight in shining armor.
00:00:46.799 --> 00:00:54.000
And although today's guest didn't bring his armor, he is known in some circles as the Viking.
00:00:54.000 --> 00:01:04.400
Yeah, you were 140 something episodes ago.
00:01:04.400 --> 00:01:04.959
Yeah.
00:01:04.959 --> 00:01:05.920
You look the same.
00:01:06.159 --> 00:01:07.920
Yeah, the beard goes on and off, though.
00:01:07.920 --> 00:01:11.439
I guess you caught me two times when I actually have the beard, but yeah.
00:01:11.439 --> 00:01:13.040
How is France?
00:01:13.439 --> 00:01:14.560
Oh, France is beautiful.
00:01:14.799 --> 00:01:15.519
Where are you at again?
00:01:15.519 --> 00:01:16.480
Lyon?
00:01:16.879 --> 00:01:18.159
Yes, in Lyon.
00:01:18.159 --> 00:01:24.959
And it's uh hour and a half to the Mediterranean Sea, two hours to Geneva, two hours to Paris.
00:01:24.959 --> 00:01:26.719
It's right in the middle of everything.
00:01:26.719 --> 00:01:27.599
Beautiful.
00:01:27.920 --> 00:01:31.519
I'm waiting for an invite to come see you, but maybe I'll get one at the end of the podcast.
00:01:32.079 --> 00:01:33.040
Let's see.
00:01:33.439 --> 00:01:38.719
So uh last time we spoke in the podcast, you were the SVP and CISO of Storebrand.
00:01:38.719 --> 00:01:43.840
Then you moved to Telenor and were SVP and CISO there.
00:01:43.840 --> 00:01:48.719
Then you were partner and chairman of the advisory board with our friends over at Tagora.
00:01:48.719 --> 00:01:50.319
What are you doing now?
00:01:50.640 --> 00:01:57.599
Well, I'm the global chief information security officer for INTERPOL, the international criminal police organization.
00:01:58.000 --> 00:01:58.480
Awesome.
00:01:58.480 --> 00:01:59.439
What a career.
00:01:59.439 --> 00:02:01.760
So what are you guys up to there?
00:02:01.760 --> 00:02:03.359
Guys and girls, I should say.
00:02:03.680 --> 00:02:21.280
So what we do basically is that we connect and empower law enforcement agencies in 196 countries and uh provide sort of a hub for information sharing and collaboration between law enforcement globally.
00:02:22.000 --> 00:02:22.400
Cool.
00:02:22.400 --> 00:02:26.960
Terrorism, organized crime, financial crime, and what's the last one?
00:02:27.840 --> 00:02:28.719
Cybercrime.
00:02:29.039 --> 00:02:29.599
There you go.
00:02:29.599 --> 00:02:30.000
Yeah.
00:02:30.000 --> 00:02:32.240
So that's what I want to talk to you about today.
00:02:32.240 --> 00:02:36.560
First thing I want to ask you now that you how long you've been there?
00:02:37.759 --> 00:02:39.199
I'm on my eighth month now.
00:02:39.840 --> 00:02:40.159
Yeah.
00:02:40.159 --> 00:02:40.479
Yeah.
00:02:40.479 --> 00:02:47.520
So how has your insight and opinion about cybercrime changed?
00:02:48.000 --> 00:02:51.280
Well, it's more of an evolution than a revolution, I would say.
00:02:51.280 --> 00:03:00.719
As a cybersecurity professional, you deal a lot with cyber criminals or you try to prevent your organization from falling dictum of cybercriminals.
00:03:00.719 --> 00:03:10.159
But one thing that I've realized from spending time in different industries, it's that the adversary changes.
00:03:10.159 --> 00:03:16.800
When you spoke with me last time on this podcast, I was in a store brand, which is uh financial services.
00:03:16.800 --> 00:03:27.199
And the adversaries or the cyber criminals that would typically target the organization or our customers were opportunistic criminals looking for a quick win.
00:03:27.199 --> 00:03:29.360
Then I was in telecoms as well.
00:03:29.360 --> 00:03:33.840
And um as a telco, you don't hold a lot of money.
00:03:33.840 --> 00:03:40.960
So the opportunistic criminals that are looking for a quick uh return, they will not be targeting us there.
00:03:40.960 --> 00:03:50.879
But what a telco does hold is information about where people are, who they are speaking to, and what they are speaking about.
00:03:50.879 --> 00:03:56.800
And this is information that is very, very interesting for nation states, for example.
00:03:56.800 --> 00:04:03.759
Very advanced, very persistent, and very, very different than the ones we faced in financial services.
00:04:03.759 --> 00:04:12.319
And now that I need law enforcement, it changes again because as I said, we're an international organization.
00:04:12.319 --> 00:04:15.919
Every country on the world, so to say, is a member.
00:04:15.919 --> 00:04:25.519
So for nation states to uh attack us is sort of maybe not in their best interest, because they're they're a partner.
00:04:25.519 --> 00:04:33.920
And the opportunistic criminals well, there is no goal to be found here, so they should focus their energy elsewhere.
00:04:33.920 --> 00:04:44.319
But the ones that we are after, so to say, or our our function, our role is global organized crime.
00:04:44.319 --> 00:04:56.160
And it's the worst type of criminals, the organized, the big cartels, these kind of actors, and they would typically be adversaries where we would be concerned.
00:04:56.160 --> 00:05:02.879
They would try to neutralize us, they would try to hamper our operations because that would be in their best interest.
00:05:02.879 --> 00:05:08.319
That is sort of the thing that we are facing as a target, as an organization and as a target.
00:05:08.319
Load full transcript
--> 00:05:15.680
But we typically separate cybercrime and what we call cyber-enabled crime.
00:05:15.680 --> 00:05:38.560
And with the digitalization of the world and of society, we see that traditional kinetic crimes like uh human trafficking or drug smuggling, weapons, environmental crime, they are being amplified by the use of uh cyber technology and AI and cloud and whatnot.
00:05:38.560 --> 00:05:56.240
So we need to work on both tackling the traditional criminal cartels that are now being cyber enabled, but also the cybercrime operations uh that would be in the cyber domain specifically, like uh a digital bank heist or uh something similar to that.
00:05:56.240 --> 00:06:08.160
So um actually this month, March, marks my 25th anniversary in cybersecurity, and I will say it's more of an evolution than a revolution.
00:06:08.160 --> 00:06:17.680
And now being in law enforcement, I am uh dealing with some of the criminal gangs or helping law enforcement in other regions deal with organized crimes.
00:06:17.680 --> 00:06:26.959
But I have been dealing with that organized crime or the cyber criminals as a CISO and as a cybersecurity professional for many, many years already.
00:06:27.600 --> 00:06:29.519
25 years and no gray hair.
00:06:29.519 --> 00:06:30.720
Ah, there
00:06:30.720 --> 00:06:33.439
my beard is starting to
00:06:33.439 --> 00:06:34.000
looking great.
00:06:34.000 --> 00:06:39.279
So I mean you said a bunch of cool stuff there, like cartels and organized crime.
00:06:39.279 --> 00:06:46.079
How big is that connection between cyber and scary crime that we see on movies?
00:06:46.560 --> 00:06:47.680
Yeah, it's quite big.
00:06:47.680 --> 00:06:50.319
Everything is more or less cyber enabled.
00:06:50.319 --> 00:06:55.279
Encrypted channels of communication, surveillance, video, audio.
00:06:55.279 --> 00:06:59.920
Digital tools are used a lot by the heavy criminal actors as as well.
00:06:59.920 --> 00:07:12.480
And if you go if you want to go into the um what we call the uh cybercrime supply chain, for example, we see that there are several layers now in uh within a successful cybercrime.
00:07:12.480 --> 00:07:21.759
First, you will have the people that actually discovers a weakness in the system, what we would call a zero-day uh vulnerability.
00:07:21.759 --> 00:07:28.720
And then there will be people, maybe they are the same, that can create a code to exploit this vulnerability.
00:07:28.720 --> 00:07:31.839
And for now, no crime has happened, right?
00:07:31.839 --> 00:07:41.920
Nobody has done anything criminal, they've discovered a vulnerability, and they've tinkered with a tool that may be able to exploit a vulnerability, but you haven't committed a crime.
00:07:41.920 --> 00:08:01.040
And then this uh information is being sold on the dark web or or through others' channels, and uh, there are other people that then will implement uh the exploitation, uh distribute the code, maybe get personal identifiable information, credit card information, passwords, accounts.
00:08:01.040 --> 00:08:05.920
There is the crime, but again, the crime maybe is not that big.
00:08:05.920 --> 00:08:09.759
And then this information again gets sold to someone else.
00:08:09.759 --> 00:08:26.240
And that someone else could be a criminal cartel, for example, where they will use the PII to get huge loans, to to um build accounts, to create uh more expensive fraud cases, uh, etc.
00:08:26.240 --> 00:08:27.360
It can build up.
00:08:27.360 --> 00:08:37.759
And then you have another one where where the money is actually then coming in, and the same cartels will uh recruit money mules to get the money laundered.
00:08:37.759 --> 00:09:02.480
We see there are several jobber advertisements of how you can work from home to earn a little bit extra money, and behind would be uh organized crime and cartels that are pulling all the strings, and they include all these elements in the criminal supply chain that per themselves does not run a huge risk because the crime is that they are committing is small or non-existent.
00:09:02.480 --> 00:09:07.759
But the people pulling the threads, they're the ones that would really be the big fish.
00:09:07.759 --> 00:09:15.759
But they're hard to catch because these different parts of the criminal supply chain are um so separated.
00:09:15.759 --> 00:09:22.480
So stitching it all together and actually catching the big fish, that is a big piece of of the job.
00:09:22.480 --> 00:09:27.919
Um it's hard to see from the surface, but there are definitely some big actors uh in the back there.
00:09:28.559 --> 00:09:33.039
We've used the word cartel, but this kind of reminds me of like mafia movies.
00:09:34.080 --> 00:09:37.519
Yeah, that uh that's another expression you can use, most certainly.
00:09:37.519 --> 00:09:46.879
And um we very often publish uh results from operations that we have had together with law enforcement in different regions.
00:09:46.879 --> 00:09:52.080
And uh we recently did a few stunts in Africa.
00:09:52.080 --> 00:09:59.440
Again, this is not endemic to a certain uh continent, but uh this time we did uh we did a few uh operations in Africa.
00:09:59.440 --> 00:10:12.799
And what we would uh be able to do is to arrest criminals in the hundreds across several countries connected to the same type of criminal activity, but they were doing different parts.
00:10:12.799 --> 00:10:20.000
So mafia cartels for sure this thing is a lot more organized than uh than what meets the eye.
00:10:21.039 --> 00:10:30.799
When I thought of the police, I thought it would be a yeah, the Norwegian police, the Danish police, or usually the Dutch police always comes to mind when it comes to this, but it's actually Interpol.
00:10:30.799 --> 00:10:32.960
How does that collaboration work?
00:10:33.279 --> 00:10:45.200
Yeah, that's interesting because as an international organization, we enjoy certain immunities, certain privileges, but we do not have jurisdiction
in these different areas.
00:10:45.200 --> 00:10:53.679
So there will always be the local law enforcement in the places where we operate that will have the jurisdiction and they will typically have the lead.
00:10:53.679 --> 00:11:00.879
Interpol will be support, and Interpol will be coordination, and sometimes Interpol will lend expertise.
00:11:00.879 --> 00:11:08.240
But it will always be the uh local law enforcement in the specific state of operation that will have the lead.
00:11:08.240 --> 00:11:22.559
And that will always be the case on global operations, where we work with some countries in South America, some countries in Eastern Europe, some countries in Southeast Asia, but they are connected, they work together, the organized crime.
00:11:22.559 --> 00:11:27.360
But it will be the local law enforcement in the different regions that will have lead in that region.
00:11:27.360 --> 00:11:35.679
And in the bull will be sort of coordinating, assisting, providing expertise, information in the back as part of the team.
00:11:37.200 --> 00:11:49.440
So back to my mafia reference, you guys usually are the uh the guys with that whiteboard and putting the pictures of the criminals on the wall and connecting the dots and and then the local the locals are kicking down doors.
00:11:49.440 --> 00:11:56.879
And I guess the larger countries, they probably have I want to say the word attache that work together with you and coordinate.
00:11:57.360 --> 00:11:58.000
Yeah, definitely.
00:11:58.000 --> 00:12:00.480
And there are also regional bodies as well.
00:12:00.480 --> 00:12:02.960
EUROPOL, that is probably well known for you.
00:12:02.960 --> 00:12:09.840
I I used to be on the advisory board uh to EUROPOL when I was in um in telco.
00:12:09.840 --> 00:12:11.840
So they have different advisory groups.
00:12:11.840 --> 00:12:16.559
They have uh financial services, internet security companies where mnemonic actually sits.
00:12:16.559 --> 00:12:21.679
And they also have uh communication providers where where I sat as a representative of Telenor.
00:12:21.679 --> 00:12:26.559
So in EUROPOL, uh, they have different jurisdictions in Europe.
00:12:26.559 --> 00:12:32.320
Then you have ASEANAPOL in the Asia region, AFRIPOL is in Africa.
00:12:32.320 --> 00:12:38.480
So there are we work with those, they have different mandates and different jurisdictions, and then we have ours.
00:12:38.480 --> 00:12:43.519
So it's a lot of layers and and different functions, uh, for sure.
00:12:43.919 --> 00:12:44.399
Yeah.
00:12:44.399 --> 00:12:44.960
Wow.
00:12:44.960 --> 00:12:49.519
How many investigations do you like conduct a year if you have even a number on that when it comes to cyber?
00:12:50.000 --> 00:12:56.720
Yeah, no, that would be a question better better put to our um head of the cybersecurity directorate.
00:12:56.720 --> 00:13:11.200
So we are not a very big organization and we work predominantly on assisting law enforcement agencies and empowering them,
but we also need to uh to run our own operation, right?
00:13:11.200 --> 00:13:14.559
We are a hundred percent independent.
00:13:14.559 --> 00:13:24.720
We uh are forced in our uh constitution to be completely political, religious, racial, independent from everything.
00:13:24.720 --> 00:13:45.519
Uh, meaning that the data that we are custodians of on behalf of our member countries, we cannot put them in Amazon Cloud or Alibaba Cloud or because either way, if you put it in one national company's cloud, another nation will probably have objections.
00:13:45.519 --> 00:13:47.519
So we have to host it ourselves.
00:13:47.519 --> 00:13:55.120
So this is very interesting because when I started working in this domain, everybody had uh IT in the basement.
00:13:55.120 --> 00:14:00.480
Uh then we went to outsourcing, then we went to offshoring, then we went to cloud.
00:14:00.480 --> 00:14:08.159
And now 25 years later, I'm actually back in a company where we have everything on-prem in our own data centers that we run and operate ourselves.
00:14:08.159 --> 00:14:13.039
And that is my role in Interpol as the uh chief information security officer.
00:14:13.039 --> 00:14:25.840
I need to make sure that all the risks towards the integrity, availability, and confidentiality of the information that we hold on behalf of the 200 member countries are under control or within the risk appetite.
00:14:25.840 --> 00:14:41.759
So uh, me and my team, we will typically work on securing Interpol, the data, and the communication channels, while we have other directorates that work on investigation support, uh training of law enforcement, et cetera.
00:14:41.759 --> 00:14:50.879
So I do not have the number for how many investigations we are involved in uh on that part, but um there are many.
00:14:50.879 --> 00:14:53.600
That's uh that's uh what I can tell you.
00:14:54.000 --> 00:14:55.919
You were a pen tester before though, right?
00:14:55.919 --> 00:14:57.840
So going back to the on-prem days.
00:14:58.240 --> 00:15:00.080
No, I no, I I was never a pen tester.
00:15:00.080 --> 00:15:03.519
I I I started my career as a security analyst.
00:15:03.519 --> 00:15:14.639
It was it was later uh we had a fight with mnemonic at the time on who was the first to provide a 24-7 SOC in Norway.
00:15:14.639 --> 00:15:25.519
And uh yeah, I would still say it was us, but uh but um so I was reading the matrix and trying to find um every bad thing and every incident and investigate it.
00:15:25.519 --> 00:15:26.879
So that's where I started.
00:15:27.200 --> 00:15:28.000
The good old days.
00:15:28.000 --> 00:15:34.159
I was just thinking how lucky you are to be a CISO in a company that actually understands cybersecurity.
00:15:34.159 --> 00:15:40.879
Like there's no other organization in the world that understands cybersecurity than Interpol, I would almost say.
00:15:41.200 --> 00:15:44.000
Yeah, well, that there isn't, there isn't.
00:15:44.000 --> 00:15:49.120
Um like you mentioned, we we deal with a lot of crime, types of crime.
00:15:49.120 --> 00:15:54.320
Environmental crime, for example, deforestation, uh illegal mining in South America, etc.
00:15:54.320 --> 00:15:56.799
Uh cybercrime is one domain.
00:15:56.799 --> 00:16:08.000
But um, yeah, most of uh most of the people that are seconded or working for Interpol on behalf of the country where they're from, they would be police officers.
00:16:08.000 --> 00:16:20.080
So I would argue that if you if you want to find like um the top cyber uh security expert environment to work in, it would be a company like like yours.
00:16:20.080 --> 00:16:21.519
Well, thank you, Bjørn.
00:16:21.919 --> 00:16:25.440
I wasn't thinking like that, but uh that make that does also make sense.
00:16:25.440 --> 00:16:34.000
So from your vantage point, uh ransomware groups, these scam centers, do you have a team that's tracking all them?
00:16:34.320 --> 00:16:46.399
Uh we are tracking them, but we are also working with uh public-private partnerships uh on expert companies uh whose job is solely to be tracking them.
00:16:46.399 --> 00:16:50.639
We will provide investigation support, training to law enforcement.
00:16:50.639 --> 00:17:09.599
Um we have criminal records, we have stolen vehicles, we have stolen passports, we have uh drugs, we have uh all this information, uh all these databases on behalf of all the countries, and we can cross-reference and we can find people, we can find stolen goods, we can track the individuals, etc.
00:17:09.599 --> 00:17:26.880
But uh when it comes to expertise on different criminal groups, different tracked actors, etc., we will also definitely work with private and state uh partnerships uh that may have even more of expertise in all the different areas.
00:17:26.880 --> 00:17:35.039
So you can see us as a bit of a hub or a coordination, like a dispatch where all the information flows through.
00:17:37.039 --> 00:17:41.519
There must be some drama since you're a member with you know every country in the world.
00:17:41.519 --> 00:17:51.440
You've heard before, we both heard before that like you know, ransomware groups get away with stuff because they're in Russia, or certain criminals get away with it because they're in this country.
00:17:51.440 --> 00:17:53.279
How is dealing with that?
00:17:53.279 --> 00:17:54.240
If you can comment.
00:17:54.640 --> 00:17:56.079
Yeah, it's it's an interesting question.
00:17:56.079 --> 00:18:04.960
And uh yeah, it requires a bit of finesse to answer because as I mentioned before, we're apolitical and we are uh our mission is very clear.
00:18:04.960 --> 00:18:08.480
We work on organized crime together with all the member countries.
00:18:08.480 --> 00:18:16.480
But one thing I can tell you is that no government enjoys criminal activity being done in their country.
00:18:16.480 --> 00:18:35.759
So so we see that when we are going after the organized criminal cartels, the mafias, there is a lot of
collaboration between the law enforcement agencies because everybody is interested in stopping it because it erodes the economy, it provides insecurity, uncertainty.
00:18:35.759 --> 00:18:38.319
So that usually isn't a problem.
00:18:38.319 --> 00:18:48.480
I'm also being asked uh from time to time, yeah, but what about Russia is using uh cyber attacks against Ukraine or the US is using cyber attacks against Iran?
00:18:48.480 --> 00:18:56.480
And I said, well, that is not a cybercrime, that is war between two states, and that is none of my business.
00:18:56.480 --> 00:19:00.640
So I don't, well, to say I don't care it's wrong because I do care.
00:19:00.640 --> 00:19:08.400
I would like there to be no wars, but in my job and for our organization, that is this is not what we're dealing with.
00:19:08.400 --> 00:19:26.079
And if two countries are in conflict and the conflict is not in the just in the Land Sea air, but also in the cyber domain, that is not something that we will investigate or involve ourselves in at all, because that's a matter of the state, and it's it's a war between countries and not not organized crime.
00:19:26.559 --> 00:19:32.319
It's gonna be interesting now moving forward because those lines are kind of blending, wouldn't you say?
00:19:33.359 --> 00:19:41.359
In certain regimes, certain states, cyber capacities, cyber warfare is a big part of the arsenal that they uh operate in.
00:19:41.359 --> 00:19:45.279
We see hybrid warfare is becoming more and more common.
00:19:45.279 --> 00:20:00.960
But again, it's it's important to make the distinction between what is espionage activities or uh things that would be managed by different agencies and different uh investigative bodies.
00:20:00.960 --> 00:20:05.359
But you are right, it's a very difficult terrain to operate in.
00:20:05.359 --> 00:20:21.039
There is a certain amount of uh fog of war or or blurred lines or grey areas, but uh I think it's important that we we um as an Interpol employee have a focus on on our mission and our duty and what it is that we do.
00:20:21.039 --> 00:20:31.680
So even if I as a private person could uh disagree uh with how a certain country is acting towards another one.
00:20:31.680 --> 00:20:46.559
If I uh let that feeling or that opinion come in the way of what we are actually doing, then I will uh sacrifice a quick gain for a much bigger one.
00:20:46.559 --> 00:21:08.079
So uh so it's important that uh we need to act professionally and we need to focus on what is our mandate and we need to be neutral because uh what we are trying to stop is uh child abuse, it's human trafficking, is international terrorism, is drug smuggling, is all these uh uh global plagues.
00:21:08.079 --> 00:21:19.920
And uh for us to be able to effectively do that, we have to be independent and we have to leave our personal opinions or political opinions at the door when we come to work.
00:21:19.920 --> 00:21:32.160
So it's uh it requires a high standard from the people working there, and it integrity, I would say, is maybe the most important assets uh that you can have uh working for an organization like Interpol.
00:21:32.640 --> 00:21:33.279
That's a good answer.
00:21:33.279 --> 00:21:34.880
Should be a politician, beyond.
00:21:34.880 --> 00:21:46.160
I just also thought like cyber is probably the domain that is the most blurred of lines, like those other topics that you just discussed, those those are more easy.
00:21:46.160 --> 00:21:48.960
Like everybody's against child exploitation and drugs.
00:21:48.960 --> 00:21:54.000
And then you have cyber, which is probably the one that you have to tread the lightest on.
00:21:54.400 --> 00:21:59.680
Uh well, again, we're you're back to like political questions with influence.
00:21:59.680 --> 00:22:06.160
Operations before elections or things like this, political process manipulation, etc.
00:22:06.160 --> 00:22:18.559
But again, we're back to this would not be Interpol, it would be local agencies in the different countries where these operations are taking place that deals with specifically these kind of things.
00:22:18.559 --> 00:22:23.920
And I mean, even if you look to Norway, you have uh Kripos, they have their mandate.
00:22:23.920 --> 00:22:26.559
Then you have uh NSM, they have a different one.
00:22:26.559 --> 00:22:36.240
And uh while they may share information from time to time, they do not step on each other's toes or work on the same uh domains, right?
00:22:36.240 --> 00:22:37.680
Right.
00:22:38.160 --> 00:22:44.880
Uh at one point in the last 10 years that I've been in cyber, they said now the cybercrime industry is larger than the drug industry.
00:22:44.880 --> 00:22:51.920
How do you like you know, when you have drugs, cybercrime, and I guess scam center scam centers are a part of cybercrime.
00:22:51.920 --> 00:22:55.440
What is like the biggest since you sit in a house that has all those?
00:22:56.000 --> 00:23:03.599
Yeah, no, I I've heard that line being said for many years that cybercrime is now bigger than than drugs.
00:23:03.599 --> 00:23:06.160
Uh it is not.
00:23:06.880 --> 00:23:07.200
Okay.
00:23:07.440 --> 00:23:08.880
That's that that that's what I would say.
00:23:08.880 --> 00:23:12.880
But I guess it it depends a little bit on how you will count.
00:23:12.880 --> 00:23:18.799
Because if it's statistics, you can always twist it to to sort of reflect what you want it to reflect.
00:23:18.799 --> 00:23:27.680
But if you travel to parts of the world outside of the Western ones, cybercrime isn't really that big.
00:23:27.680 --> 00:23:33.279
The the traditional kinetic crimes will be much more apparent than the cybercrime.
00:23:33.279 --> 00:23:44.000
Yes, you have these big uh visible, like the the central bank of Bangladesh was rubbed of millions, and uh and you have these big ransomware groups.
00:23:44.000 --> 00:23:49.119
But but again, it it uh Norwegian Hydro, for example, they were ransomed.
00:23:49.119 -->
00:23:54.400
There wasn't much money changing hands there, but they went at a great loss, they lost a lot of money.
00:23:54.400 --> 00:24:08.559
The same with the uh shipping company Mersk, several hundred thousand of dollars, but it wasn't so much money changing hands, it wasn't people getting paid, it was just people losing money because they they were a victim of a cyber attack.
00:24:08.559 --> 00:24:16.480
So so cybercrime, stealing money, if we're talking about money, not bigger than drugs.
00:24:16.480 --> 00:24:26.079
Yeah, and like with telco, the crime that we we saw, advanced persistent threat, people after information, who is speaking with whom and where are they going?
00:24:26.079 --> 00:24:28.559
This is also not money, right?
00:24:28.559 --> 00:24:32.240
But uh drugs, 100% money.
00:24:32.480 --> 00:24:33.039
Yep.
00:24:33.279 --> 00:24:34.400
100% money.
00:24:34.400 --> 00:24:36.559
So also what what is cybercrime?
00:24:36.559 --> 00:24:37.519
Where do you draw the line?
00:24:37.519 --> 00:24:42.960
If if if I use the cyber domain to do my crime, is that a cybercrime or is it a cyber enabled crime?
00:24:43.039 --> 00:24:45.839
And so Yeah, I know that's a good point.
00:24:45.839 --> 00:24:50.720
There's a lot more money lost from cybercrime than there actually is money changing hands.
00:24:50.880 --> 00:24:51.440
Yeah.
00:24:51.440 --> 00:24:52.240
Yeah.
00:24:52.240 --> 00:24:53.119
Interesting.
00:24:53.119 --> 00:24:55.279
That's at least how I see it now.
00:24:55.519 --> 00:24:57.119
Uh hack back.
00:24:57.119 --> 00:25:00.960
What are your thoughts around that?
00:25:01.279 --> 00:25:07.519
If someone robs your house, will you want to put this person in jail or do you want to go and rob his house?
00:25:07.519 --> 00:25:08.400
Yeah.
00:25:08.799 --> 00:25:09.440
I see your point.
00:25:09.759 --> 00:25:10.799
I think it's better to put him in jail.
00:25:11.039 --> 00:25:15.920
The older I get, the more I realize and respect why there's a constitution, there's rules.
00:25:15.920 --> 00:25:25.200
You have to abide by these rules because if you don't, somebody in power one day is going to change the rules or amend the rules in their paper, and then look where we end up.
00:25:25.519 --> 00:25:28.400
Yeah, we see a little bit of that happening these days, don't we?
00:25:28.720 --> 00:25:29.440
Yeah, we do.
00:25:29.440 --> 00:25:33.039
Not that we're gonna talk about that right now, but off the podcast, maybe.
00:25:33.039 --> 00:25:34.240
Yeah.
00:25:34.240 --> 00:25:35.599
Attribution.
00:25:35.599 --> 00:25:41.440
How has attribution sort of matured in your mind since stepping into your role?
00:25:41.440 --> 00:25:42.240
Yeah.
00:25:42.559 --> 00:25:57.119
That is a thing that is still a bit of a problem because when we're talking about hybrid warfare, it's very easy to say you shot a rocket at us because we saw the rocket and it came from you.
00:25:57.119 --> 00:26:01.200
It's very hard to deny that when you when you physically have the rocket coming.
00:26:01.200 --> 00:26:17.359
But when there is a cyber attack and you're good at hiding your track, so you use multiple jump points and and whatnot, and the effect that you cannot with 100% certainty say that it was you, it gives you that plausible deniability that everybody likes to have.
00:26:17.359 --> 00:26:28.000
And as you said uh before, that it's still difficult to, you can't really like touch the cybercrime or or or see it uh many times.
00:26:28.000 --> 00:26:30.319
It makes it hard to make the attribution.
00:26:30.319 --> 00:26:40.640
But it's at the same time, I would say that when a national agency comes out with a name that is usually very well funded.
00:26:40.640 --> 00:26:50.400
It's it's usually not, but but it's getting the like hard physical, visible evidence we seldom see and it's seldom given.
00:26:50.400 --> 00:27:04.559
But um but when we work with with cybercrime and and and criminal gangs, we find them because they um it is typically easy to follow the money, for example, because they would at some point want to collect on the money.
00:27:04.559 --> 00:27:21.599
So even if it's difficult to see where the attack is coming from, or like I mentioned, the cybercrime uh supply chain where all the different actors, but if you follow the money, then at one point you will in most uh most cases be able to uh to find out who's pulling the strings.
00:27:21.920 --> 00:27:29.680
You must have really fun like work parties where you have people talking about your you know, your financial follow-the-money guys that you probably have.
00:27:29.680 --> 00:27:32.960
That must be so interesting to uh listen to what's going on.
00:27:32.960 --> 00:27:34.400
Um AI.
00:27:34.400 --> 00:27:36.000
Yeah.
00:27:36.000 --> 00:27:38.160
Uh being used by criminals today.
00:27:38.160 --> 00:27:43.359
What is your what have you found interesting around the use of AI these days?
00:27:43.759 --> 00:27:50.079
Yeah, the biggest problem that we've seen with AI being introduced is around fraud.
00:27:50.079 --> 00:27:59.359
The AI will make sure that you're being approached in a way that's familiar to you with the information that's uh uniquely tailored to you.
00:27:59.359 --> 00:28:02.720
These days an email can come to you in perfect Norwegian.
00:28:02.720 --> 00:28:09.440
And also we see other channels, not just emails, but uh voice video calls, even.
00:28:09.440 --> 00:28:13.839
We also see the release of um AI pen testers, for example.
00:28:13.839 --> 00:28:18.400
Yeah uh not just a vulnerability scanner, but an AI pen tester.
00:28:18.400 --> 00:28:38.559
And uh I think that is just the tip of the iceberg because this it will not be difficult to improve this AI pen tester into connecting it with business context or or uh fraud scenarios or whatever, so you can have like a fully automated weapon.
00:28:38.559 --> 00:28:47.759
Um so I think up until now it's been the the fraud and and going for for
private people and users that's be the been the big problem.
00:28:47.759 --> 00:28:56.319
But uh but going forward, uh I don't know if uh Skynet is around the corner, but it um I'm starting to become a believer.
00:28:56.319 --> 00:28:58.240
So uh yeah.
00:28:58.640 --> 00:29:02.240
There's this guy, his name is Stök, um Swedish pen tester.
00:29:02.240 --> 00:29:04.960
Yeah, uh really interesting guy, fun to follow.
00:29:04.960 --> 00:29:10.000
And he said, Yeah, I remember when I told you guys that AI wasn't gonna take your pen testing job.
00:29:10.000 --> 00:29:11.119
I was wrong.
00:29:11.119 --> 00:29:12.400
Yeah, there you go.
00:29:12.400 --> 00:29:13.759
So uh yeah.
00:29:14.079 --> 00:29:19.359
Yeah, it is a bit alarming, but then again, we have we have AI on the on the positive side as well.
00:29:19.359 --> 00:29:30.319
You you mentioned uh briefly that uh the detective that puts up all the different um vehicles and people's uh uh faces and then connect them with the rope.
00:29:30.319 --> 00:29:34.640
We have tools now to to do this uh digitally and using AI.
00:29:34.640 --> 00:29:37.359
And it's uh it's pretty cool, yeah.
00:29:38.640 --> 00:29:51.839
Uh this is out of place in the conversation, but you know, as CISO of Interpol, is there anything besides the fact that you're securing your on-premise environment, which is uh something that most people have to do anymore?
00:29:51.839 --> 00:29:58.400
Is there anything unique about being the CISO of Interpol being who Interpol is?
00:29:59.519 --> 00:30:01.839
Yes, uh definitely.
00:30:01.839 --> 00:30:25.119
Uh in a world that is becoming so polarized and so filled with conflicts, I would say it's uh very unique to be in this position where everybody are still friends, we still work together, uh, we still have a common enemy that would be uh the organized crime and terrorism.
00:30:25.119 --> 00:30:27.359
And you get to uh to learn a lot.
00:30:27.359 --> 00:30:39.839
That's that's the maybe the biggest thing for me because I meet so many people in so many uh parts of the world that I would never have the opportunity to do if I was working for a company that I've done most of my career.
00:30:39.839 --> 00:30:43.440
So I would say I it is a privilege to uh to be here.
00:30:43.440 --> 00:30:47.440
And we we're four Norwegians in Interpol.
00:30:47.440 --> 00:30:54.480
So it's um quite unique to be an international organization doing uh doing what I do.
00:30:55.599 --> 00:30:57.680
Uh you have an awesome job, Bjørn.
00:30:57.680 --> 00:31:00.319
It's so cool to be talked to the CISO of INTERPOL.
00:31:00.319 --> 00:31:06.319
But is there any do you have any closing thoughts or anything that you're gonna be using your time on moving forward?
00:31:06.319 --> 00:31:09.279
Anything you want to share to listeners?
00:31:10.000 --> 00:31:12.960
I would say that it's still the basics that matter.
00:31:12.960 --> 00:31:24.079
And for people like you and me in our daily lives, it's very small habits and very small things that would determine whether you're a target or or not.
00:31:24.079 --> 00:31:35.680
So I I would encourage everyone to try and become what I would say uh is a hard target to make it a little bit more difficult to hit you than the person next to you.
00:31:35.680 --> 00:31:44.480
Because most of the uh criminals that will target you as a private person, they will be looking for the easiest way.
00:31:44.480 --> 00:31:51.039
And if you just a centimeter more difficult than the person beside you, they will go for the person beside you.
00:31:51.039 --> 00:31:54.079
So don't be too afraid of everything.
00:31:54.079 --> 00:31:59.680
Just make sure that you are making yourself a bit harder target than your neighbor, and you will do fine.
00:31:59.680 --> 00:32:02.079
That's uh that's what I would say.
00:32:02.480 --> 00:32:09.039
Do you think that will change in our new reality where yeah, I don't know, the scale is so different.
00:32:09.039 --> 00:32:12.319
Is that actually still the same from from now on?
00:32:12.640 --> 00:32:17.279
No, yeah, that will be the same because humans will be humans.
00:32:17.279 --> 00:32:22.000
And no matter what happens with the world, it will be humans that make or break security.
00:32:22.000 --> 00:32:31.039
It was like this before the industrial revolution, it was like this before the IT revolution, it will still be like like that.
00:32:31.920 --> 00:32:32.160
Mr.
00:32:32.319 --> 00:32:36.960
Watne, thank you so much for joining us here today and keep up the great work at INTERPOL.
00:32:36.960 --> 00:32:37.359
Take care.
00:32:37.599 --> 00:32:38.319
Thank you, Robby.
00:32:38.319 --> 00:32:38.960
Have a good day.
00:32:39.119 --> 00:32:39.839
Thank you.
00:32:40.880 --> 00:32:42.720
Well, that's all for today, folks.
00:32:42.720 --> 00:32:45.519
Thank you for tuning in to the mnemonic security podcast.
00:32:45.519 --> 00:32:54.960
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us the mail to podcastnemnemonic.no.
00:32:54.960 --> 00:32:58.400
Thank you for listening, and we'll see you next time.