Speaker 1: On this episode of the NEWTS World. It's not often
Speaker 1: I get the opportunity to speak with someone who used
Speaker 1: to be a professional hacker for the CIA. My guest
Speaker 1: is doctor Eric Cole. He is a renowned cyber security expert, entrepreneur,
Speaker 1: and best selling author with over thirty years of experience
Speaker 1: in the industry. He is known for his work in
Speaker 1: advancing cybersecurity and his dedication to making the digital world
Speaker 1: a safer place. He has advised some of the world's
Speaker 1: top companies on reducing their digital threats and improving their
Speaker 1: cyber health. He's the author of the book cyber Crisis,
Speaker 1: Protecting Your Business from real threats in the Virtual World. Eric,
Speaker 1: welcome and thank you for joining me on NEWTS World.
Speaker 2: My pleasure and thank you for having me.
Speaker 1: I'm very curious. Symber of last year, Chinese hackers breached
Speaker 1: a third party vendor for the US Treasury Department to
Speaker 1: gain access to over three thousand unclassified files. How could
Speaker 1: this have happened and what should the US government learn
Speaker 1: from this?
Speaker 2: The reality is this is happening all the time.
Speaker 3: Most security vendors, most companies, most organizations have been compromised
Speaker 3: or penetrated by the Chinese, the Russians, or the Iranians,
Speaker 3: and we just didn't detect it. We didn't realize it,
Speaker 3: and we didn't know that it's happening.
Speaker 2: So this is a much.
Speaker 3: Bigger problem that has been brewing for a long time,
Speaker 3: and unfortunately there's not been a lot of awareness around
Speaker 3: just how bad the issue is. And governments and other
Speaker 3: organizations have to realize that the probability of third party
Speaker 3: vendors or third party sources having a vulnerability or a
Speaker 3: compromise is very high, and we need to redesign our systems,
Speaker 3: We need to redesign how we're configured to protect against it.
Speaker 3: And most importantly, we need federal laws on cybersecurity. There's
Speaker 3: a lot of state laws, California is leading the pack
Speaker 3: where there's a lot of privacy laws, but the United
Speaker 3: States is one of the few countries that don't have
Speaker 3: federal laws on cybersecurity and federal laws on data privacy.
Speaker 1: Then why is that? Why are we behind?
Speaker 3: I believe the big issue is we always thought and
Speaker 3: a lot of people still do, that cybersecurity gets in
Speaker 3: the way of freedom of speech, that cybersecurity gets in
Speaker 3: the way of exchange of information, and that cybersecurity is
Speaker 3: not fit for a democracy. Like most people when they
Speaker 3: think of cybersecurity, you think of North Korea, where they
Speaker 3: don't have internet access. Citizens in North Korea, they can't
Speaker 3: access the internet, they don't have email, they can't access information.
Speaker 3: Even in Russia, most people don't realize a lot of
Speaker 3: the websites that we take for granted, a lot of
Speaker 3: the social media sites are not accessible in Russia and
Speaker 3: they're not available. So people have always felt that cybersecurity
Speaker 3: is more of limiting and reducing access to information.
Speaker 2: But that's just not correct.
Speaker 3: Cybersecurity is about how do we protect and control our
Speaker 3: information so only people that need access to it has
Speaker 3: access to it. And I think that's why we've fallen behind,
Speaker 3: because we just haven't realized that cybersecurity is actually a
Speaker 3: compliment to democracy, it's not adverse to it.
Speaker 1: Does anybody the you know of have an effective cybersecurity
Speaker 1: bill proposal?
Speaker 3: None that I'm aware of. I continually try to push it.
Speaker 3: The problem is, as you're probably very familiar, everything is
Speaker 3: so political, everything is so either side has to disagree
Speaker 3: with each other that anything we we're trying to push
Speaker 3: through on cybersecurity is reading a version from.
Speaker 2: The other side.
Speaker 3: And the reality is we need to recognize cybersecurity as
Speaker 3: a non bipartisan issue. It's really something that impacts both sides.
Speaker 3: It impacts democrats and impacts Republicans and impacts America as
Speaker 3: a whole. And one of the things I'm trying to
Speaker 3: do is really, how can we break down those barriers
Speaker 3: and get both sides to agree that, Okay, we can
Speaker 3: fight about some things, but cybersecurity, we need to get
Speaker 3: her act together. Because when the founding fathers wrote the
Speaker 3: Constitution and the bill Wrights, they had no clue that
Speaker 3: we were going to be carrying cell phones with us.
Speaker 3: They had no clue that we've been having tracking devices
Speaker 3: on us twenty four to seven and we need new
Speaker 3: laws that are keeping up with the digital frontier.
Speaker 1: I couldn't help but smile, dad, is we have ready
Speaker 1: to celebrate our two hundred and fiftieth birthday that if
Speaker 1: you were to drop George Washington or Jefferson or Franklin
Speaker 1: under the current situation, all of them would have found them. Yeah.
Speaker 2: I think they would be amazed.
Speaker 1: It'll be remarkable. One of the examples I've been thinking
Speaker 1: about a lot elon Musk and Doge sent an email
Speaker 1: to federal workers saying, please reply to this email with
Speaker 1: approximately five bullets of what you accomplished this week and
Speaker 1: carbon copy your manager. Now, if people responded to that,
Speaker 1: are there any cybersecurity risks in responding to an email
Speaker 1: like that?
Speaker 3: There's huge cybersecurity risks because you essentially have somebody who
Speaker 3: is not employed by that government agency and they're asking
Speaker 3: for information about what you're doing on a daily basis.
Speaker 3: If I answered that accurately, I would be giving away
Speaker 3: a lot of critical information. If I had to go
Speaker 3: in and say, well, I'm working on this project, I'm
Speaker 3: working in this area, I'm working.
Speaker 2: On this research.
Speaker 3: That's a lot of valuable information that if that got
Speaker 3: on the wrong hands. And my question is what email
Speaker 3: address is Elon Musk using to get replies?
Speaker 2: Where are those emails being stored?
Speaker 3: Because at least from as far as I can tell,
Speaker 3: Elon is not using government servers. I know that he's
Speaker 3: installed some of his own servers at Treasury and other areas.
Speaker 2: So now, if these.
Speaker 3: Emails from government employees that potentially are containing sensitive or
Speaker 3: even classified information are stored on public servers, what happens
Speaker 3: if foreign adversaries get access to it. And I don't
Speaker 3: know if you saw this week, but the Doze website
Speaker 3: got hacked.
Speaker 2: They don't even have proper security.
Speaker 3: So here he's setting up their website for Doze for
Speaker 3: government efficiency. They got hacked, and they're expecting government employees
Speaker 3: to give all this sensitive information to these servers that
Speaker 3: clearly have vulnerabilities.
Speaker 1: What I'm thinking that this is one of those ideas which,
Speaker 1: when you hit the implementation phase, is a thousand times
Speaker 1: more complicated than the idea. Yeah, and I think that
Speaker 1: they really don't fully understand that.
Speaker 3: And this is one when I can resonate because at
Speaker 3: the end of the day, Elon is a geek. He's
Speaker 3: not a businessman, he's not a cyber guy. He's a geek,
Speaker 3: and he's all about solving problems and he wants to
Speaker 3: solve the problem as quick and as fast as possible
Speaker 3: and get access to information. The issue is cybersecurity is
Speaker 3: always an afterthought. And back to your original question of
Speaker 3: why is the United States behind it's because cybersecurity is
Speaker 3: always an afterthought. We're not thinking of cybersecurity. Elon didn't
Speaker 3: sit down and say, okay, how can we do this
Speaker 3: in a secure manner. What are the cybersecurity protocols that
Speaker 3: we need in place to do this correctly? He basically
Speaker 3: just said, I need the data. We'll figure out cyber later.
Speaker 3: But the problem is with digital information. Once your data
Speaker 3: is leaked out, once your data exists on servers, you
Speaker 3: can't get it back. It will exist forever. I know
Speaker 3: before the podcast, I was talking with your producer how
Speaker 3: she took her daughter to a hospital and it got
Speaker 3: hacked and her daughter's personal information was exposed. And the
Speaker 3: reality is now that person has to live the next
Speaker 3: fifty sixty seventy years of their life in a world
Speaker 3: where their personal information has been compromised because once somebody
Speaker 3: has your social Security number, you can't get it back.
Speaker 1: So to make clear how big a threat this says,
Speaker 1: you talk about a cyber war, you say, quote, our
Speaker 1: nation is currently a war, whether we realize it or not.
Speaker 1: We're in the middle of World War three. The reason
Speaker 1: why many people don't recognize it is because it's a
Speaker 1: different type of world war. In this war, every single
Speaker 1: country is involved in. Every single country is both being
Speaker 1: attacked and attacking other countries. Walk us through all that.
Speaker 1: I agree with you, but I think it'll be very
Speaker 1: helpful for people to hear what this cyber war is like.
Speaker 2: So most of us think of wars.
Speaker 3: We think of World War one, World War two, tanks, planes, boats, missiles,
Speaker 3: and guns.
Speaker 2: But we're in a digital war because we live in
Speaker 2: a digital world.
Speaker 3: And now it's not bullets, it's not weapons, it's packets,
Speaker 3: it's information, it's data, it's leakage. And the reality is,
Speaker 3: as we're starting to see with some of these breaches
Speaker 3: that come out. We saw Colonial Pipeline. I live on
Speaker 3: the East Coast in Virginia, and when Colonial Pipeline, a
Speaker 3: large oil supplier on the East coast, got hacked, our
Speaker 3: gas stations were closed for four days. People were actually walking,
Speaker 3: they were panicking, saying, are we actually going to be
Speaker 3: able to get gas because of a cyber attack. Then
Speaker 3: we have Solar Winds, where you talked about earlier, where
Speaker 3: broke into a vendor that compromised government systems, And these
Speaker 3: attacks continue to happen and occur, but the reality is
Speaker 3: they started five to ten years ago. The Chinese, the Russians,
Speaker 3: they're in our systems, we're in their systems, and it's
Speaker 3: sort of like the nuclear Cold War where Russia could
Speaker 3: destroy the United States and we could destroy Russia. So
Speaker 3: neither side would actually launch a nuclear weapon. But we're
Speaker 3: in Russian's critical infrastructure, they're in our critical infrastructure, and
Speaker 3: neither side is going to do anything because it would
Speaker 3: do mutual mass destruction. But what's happening when our information
Speaker 3: starts leaking out? What happens when our data is being compromised?
Speaker 3: And the reality is because we're at war. When you're
Speaker 3: at war, you have a different mentality. I've been over
Speaker 3: in the Ukraine, I was over in Iraq during the
Speaker 3: Iraq War. When you're in a war, people are thinking differently,
Speaker 3: they're acting differently. They're more scared, they're more paranoid, they're
Speaker 3: more careful about what they're doing. The problem we have
Speaker 3: in the United States is everybody on the Internet thinks
Speaker 3: we're in peace time conditions. So they're sharing information, they're
Speaker 3: giving their data, they're accessing whatever they want, they're posting pictures,
Speaker 3: they're putting everything out there. But the reality is, if
Speaker 3: they knew were at war, we need wartime thinking. People
Speaker 3: need to be more paranoid, a little more scared, than
Speaker 3: a little more protective of the data. They need to
Speaker 3: be careful of who they're giving their information to. We
Speaker 3: need to start implementing security because here's the great news.
Speaker 3: Your banks, your e commerce all have security built in,
Speaker 3: but it's turned off by default. It's not all turned
Speaker 3: on because they don't think citizens are ready for it.
Speaker 3: So we need to start going in to our apps,
Speaker 3: going into our devices and start turning on security as
Speaker 3: turning on notifications, turning on two factor authentication. So the
Speaker 3: security is there, but we just have to start implementing it.
Speaker 3: And the war that we're facing today is not a
Speaker 3: visible war where there's huge explosions or banks are being
Speaker 3: taken down. It's a war of data leakage. Imagine we
Speaker 3: have a big bucket. Instead of somebody going in emptying
Speaker 3: the bucket, they're just putting little holes in the bucket.
Speaker 3: They're slowly leaking our data and leaking our information, and
Speaker 3: by the time the bucket's empty, most people don't even notice.
Speaker 3: A reality that I see all the time is most
Speaker 3: people's bank accounts or credit cards are compromised. But here's
Speaker 3: the reality. The attacker is stealing a dollar a month. Now,
Speaker 3: imagine if somebody is taking a dollar from your bank
Speaker 3: account each month or a dollar from your credit card,
Speaker 3: you probably wouldn't know. Most people don't look at their
Speaker 3: credit cards that closely. Most people don't look at their
Speaker 3: bank accounts close enough that if a dollar was missing,
Speaker 3: they would not recognize that error. But if you steal
Speaker 3: a dollar from every person every single month, that starts
Speaker 3: turning into a billion dollar industry, which is what we
Speaker 3: have right now. Cybercrime is over fifty billion dollars. It's
Speaker 3: costing America on a regular basis.
Speaker 1: That's wild, and that's so much bigger than people think
Speaker 1: it is. Exactly if people want to protect themselves somewhat
Speaker 1: from their own devices, what should they do and how
Speaker 1: do they do it?
Speaker 3: So the first thing they need to do is realize
Speaker 3: that when you buy a new iPhone or you buy
Speaker 3: a new Android device, they are very secure.
Speaker 2: They are very locked down and protected.
Speaker 3: The problem is when we start installing all of these
Speaker 3: different apps. Free is not free, and basically a free
Speaker 3: app is tracking your location. So first, if you have
Speaker 3: the choice between a free app or a paid version,
Speaker 3: use the paid version. If it's something that you need
Speaker 3: to run your life or it's critical for your life,
Speaker 3: you need to use a paid version because the paid
Speaker 3: versions are a lot more secure than the free versions. Next,
Speaker 3: any app that you haven't used in forty five days,
Speaker 3: the lead the lead off your app, And I'm going
Speaker 3: to give you the challenge. I run my life on
Speaker 3: ten apps. If I go and download a new app,
Speaker 3: I only do it if I delete an old one.
Speaker 3: So instead of having fifty and seventy apps on your
Speaker 3: device that you're not using, do you realize an app
Speaker 3: that you install on your device but you're not using,
Speaker 3: actually is spying on you. It's tracking your location, it's
Speaker 3: accessing your camera, it's accessing your information. So delete any
Speaker 3: apps that are not needed or required. Second, for any
Speaker 3: application you're using, you need to use what we call
Speaker 3: two factor authentication. This is where when you log in,
Speaker 3: you put in your password and then your text a
Speaker 3: one time code to your cell phone, and then you
Speaker 3: have to enter in that one time code. And I
Speaker 3: know people's initial response is, Eric, that's annoying if every
Speaker 3: time I need to log in, I have to enter
Speaker 3: a code that takes a couple of extra seconds. And
Speaker 3: my response is, you know what's really annoying your bank
Speaker 3: account getting hacked. You know what's really annoying your identity
Speaker 3: being stolen. So do you want a short term annoyance
Speaker 3: with two factor or a long term annoyance of being vulnerable? Next,
Speaker 3: turn on account notification. Every time I use my credit card,
Speaker 3: every time I withdraw money from my bank, I get
Speaker 3: a text notification where it says, Eric, is this you
Speaker 3: Did you actually do this transaction?
Speaker 2: Did you actually withdraw money from the account?
Speaker 3: And the reality is I get text messages at least
Speaker 3: one to two times a quarter that are unauthorized transactions.
Speaker 3: So if I didn't have that turned on, those transactions
Speaker 3: would have occurred, and I would have been exploited and
Speaker 3: I would have been compromised. So once again, small short
Speaker 3: term annoyance, but long term benefits. So turn on account
Speaker 3: activity notification on all your systems. And then the last
Speaker 3: piece I always give is, under no circumstances should you
Speaker 3: ever click on a link. Don't ever click on a link,
Speaker 3: don't ever click on attachment. This just happened to one
Speaker 3: of my friends where they're traveling in Florida. They got
Speaker 3: a text notification that said, you ran one of the
Speaker 3: fast tolls in Florida and you need to pay the
Speaker 3: fine or you're going to have huge issue. Using problems
Speaker 3: click on this link, and because they were in Florida,
Speaker 3: they thought it was legit. They clicked on the link
Speaker 3: and it was a scam. So don't ever click on
Speaker 3: a link, don't ever open an attachment. But Eric, what
Speaker 3: if my bank sends me a notification that says there's
Speaker 3: a problem and there's a link, Go to the app,
Speaker 3: Go to the app, log in using a valid app
Speaker 3: to access your bank account, But never click on a
Speaker 3: link and never open an attachment.
Speaker 1: Well, I'm really curious, Eric, should you have a banking
Speaker 1: app on your phone? Yes?
Speaker 3: I know that's counter because a lot of security people
Speaker 3: are like, no, don't have anything. The reality is our
Speaker 3: phone is a trusted advisor. It's something that we have
Speaker 3: with us and we access And here's the reality. Apps
Speaker 3: are much more secure than websites. Apps are much.
Speaker 2: More secure than clicking links.
Speaker 3: So if you're going to use your bank, if you're
Speaker 3: going to do online banking, if you're going to e commerce,
Speaker 3: it's much better to use the apps. The apps have
Speaker 3: a lot more security and a lot more protection than websites.
Speaker 3: So the best advice I can give you is minimize
Speaker 3: your use of websites. Maximize your use of trusted apps,
Speaker 3: and that's going to also make you a lot more secure.
Speaker 1: We're really kind of a free for all where it's
Speaker 1: not like the Cold War where there was one side
Speaker 1: and the other side. It's more like between governments and
Speaker 1: private criminal groups, et cetera. It can be coming from
Speaker 1: anywhere at any time, and so you can't just focus
Speaker 1: on North Korea or focus on Russia. You almost have
Speaker 1: to focus on how you defend yourself against all the
Speaker 1: attacks in every single version.
Speaker 2: That's very because here's the reality. There are no.
Speaker 3: National and international borders on the Internet. When you're on
Speaker 3: the Internet, I can access different countries, different areas, different locations,
Speaker 3: and there's no boundaries.
Speaker 2: There's nothing.
Speaker 3: Somebody in Russia can access servers and individuals in America
Speaker 3: without going through customs, without presenting a passport, without going
Speaker 3: through immigration. So the problem is, as I mentioned, the
Speaker 3: laws were written for physical boundaries. If somebody is physically
Speaker 3: in the United States, they have to abide by our laws.
Speaker 3: If they're physically in Russia, they abide by Russian laws. Well,
Speaker 3: on the Internet, you don't know where you're at. I
Speaker 3: track very closely and I will tell you when I'm
Speaker 3: surfing the Web and doing daily activity just like you
Speaker 3: and anyone else. I'm frequently accessing servers in the Philippines
Speaker 3: because there's a lot of data centers there. In Singapore,
Speaker 3: the Middle East has a lot of data centers, Dubai,
Speaker 3: South America, and people don't realize that even when they're
Speaker 3: going to e commerce sites or banks or other areas
Speaker 3: and giving away their information, those servers are often not
Speaker 3: in the United States, which means your data and your
Speaker 3: information is not in the United States, which means even
Speaker 3: if we had privacy laws, they might not apply to
Speaker 3: your data information if it's outside of our country. So
Speaker 3: people just don't really understand the complexities that the Internet
Speaker 3: is really one world.
Speaker 2: There's no boundaries.
Speaker 3: Servers can exist, data can exist anywhere, and until we
Speaker 3: get international laws where we all cooperate and say, okay,
Speaker 3: we're all going to work together, it's going to be
Speaker 3: real difficult. Because this just happened this morning is I'm
Speaker 3: working on an investigation and we found a hacking group
Speaker 3: in Russia. We know who they are, we know where
Speaker 3: they're located, we have their physical address. They're a company,
Speaker 3: an incorporated company in Russia. But here's the problem. They're
Speaker 3: not breaking any laws in Russia, and there's no extradition
Speaker 3: treaty with Russia, so we know who's hurting us, who's
Speaker 3: hurting Americans, who's stealing our information. But because there's no
Speaker 3: international laws, there's really little we can do to stop them, which,
Speaker 3: as you said, every individual has to realize they're a
Speaker 3: target and we need to start putting measures in place
Speaker 3: and protect us because unfortunately, until there's global laws, the
Speaker 3: laws aren't going to be able to protect us or
Speaker 3: keep us safe.
Speaker 1: Can we reverse it and use our cyber capabilities to
Speaker 1: go back in and attack the people who are doing.
Speaker 3: This, We absolutely can. That's another area that we've seen
Speaker 3: the recent presidents actually do a really good job on
Speaker 3: Trump in his first term he was actually the first
Speaker 3: president that actually allowed Department of Defense to launch scienceber
Speaker 3: attacks without executive approval.
Speaker 2: Prior to Trump passing.
Speaker 3: That executive order on his first term, if the Department
Speaker 3: of Defense wanted to launch a cyber attack and offensive operation,
Speaker 3: they needed presidential approval. Now, China doesn't require that, Russia
Speaker 3: doesn't require that.
Speaker 2: I ran in Iraq doesn't require.
Speaker 3: That, so we were really hamstrung in that capability. So yes,
Speaker 3: we have to start getting more aggressive. But the other
Speaker 3: thing we need to do is got a lot more
Speaker 3: partnership between government and commercial organizations. In China, the Chinese
Speaker 3: government spies and steals information from US companies for the
Speaker 3: benefit of Chinese companies. In the United States, we don't
Speaker 3: have that capability in the United States, the Department of Defense.
Speaker 3: They can't steal corporate information and give it to US
Speaker 3: companies because once again.
Speaker 2: That violates our laws.
Speaker 3: But if other countries, their governments are working on behalf
Speaker 3: of local companies to help and support them, we need
Speaker 3: to do the same thing. We need to have a
Speaker 3: much closer partnership where we can launch offensive operations and
Speaker 3: then the government can share that information with US companies
Speaker 3: to help make them more competitive.
Speaker 1: As you think through this continuous cyber war, as I
Speaker 1: understand that North Korea is almost entirely government run cyber war,
Speaker 1: but Russia has a huge amount of criminal operations. Nigeria,
Speaker 1: I think has a lot of criminal operations. So yeahther
Speaker 1: China has a mixture of government them free enterprise entrepreneurs.
Speaker 1: Is that lily to all around the world that there
Speaker 1: are different.
Speaker 3: Patterns, absolutely, and you nailed it in North Korea.
Speaker 2: There's really no corporations.
Speaker 3: The government is the country and basically runs everything, so
Speaker 3: everything is run from the govern and control by the government.
Speaker 3: In China, it's very cooperative where companies and the government
Speaker 3: work very closely together, so the government is going to
Speaker 3: do attacks on the heaf of companies and vice versa.
Speaker 3: Now when you get in to carriers like Russia and Nigeria,
Speaker 3: it's interesting the commercial criminal actually helps and supports the government.
Speaker 3: So these commercial elements are actually supporting and involved.
Speaker 2: A lot of government.
Speaker 3: Officials in Nigeria, a lot of government officials in Russia.
Speaker 3: They're actually involved and sit on the board of these
Speaker 3: cyber crime or criminal companies, so they're actually supporting, helping them,
Speaker 3: and they're helping and supporting the government in return. Imagine
Speaker 3: in the United States if we had generals and government
Speaker 3: officials actually sitting on commercial boards that are doing offensive
Speaker 3: operations to help the company but also help the country.
Speaker 2: It's a total mind shift.
Speaker 3: But the reality is until we start thinking and acting
Speaker 3: like the adversary and started doing what the adversary does,
Speaker 3: we're at a disadvantage. Because these other countries have commercialized cybercrime.
Speaker 3: They're making tons of money on it. They've legalized cybercrime,
Speaker 3: and because in the United States it's illegal, we're at
Speaker 3: a huge disadvantage in terms of offensive operations and protecting ourselves.
Speaker 1: And some of these things are really big. If I'm
Speaker 1: mumber correctly, the twenty fifteen Office of Personnel Management breach
Speaker 1: was a huge failure. Did we learn anything from it?
Speaker 2: Unfortunately, very little. And the reality that.
Speaker 3: Is brought up that we have to recognize is social
Speaker 3: security numbers are no longer private information.
Speaker 2: We have this term.
Speaker 3: I'm sure you've heard PII personally identifiable information or PHI
Speaker 3: personal healthcare information, and our social security number, our driver's
Speaker 3: license are all considered private information. And if somebody knows
Speaker 3: my social security number, my data birth and my driver's license,
Speaker 3: they can open bank accounts, they can open credit cards,
Speaker 3: they can access information, they can access data. But as
Speaker 3: you said, in that breach and in other breaches, a
Speaker 3: large percent of American social security number has been compromised.
Speaker 3: A large number of social security numbers is public information.
Speaker 3: So now we're living in a world where a personal
Speaker 3: identifiable information is actually public. Our social security number is public,
Speaker 3: our driver's license is public.
Speaker 2: Yet that's what we're.
Speaker 3: Using to authenticate, and verify. So in terms of back
Speaker 3: to the federal laws, we actually need to come up
Speaker 3: with new unique identifiers for American citizens that is actually secure,
Speaker 3: protected and not compromise. Something along the lines of biometrics.
Speaker 3: We're actually tying it to like your fingerprint or your
Speaker 3: facial idea or something that's much more difficult for somebody
Speaker 3: to steal. But the reality is what we're using as
Speaker 3: personal information is actually public and exposed and available to
Speaker 3: many people.
Speaker 1: I mean, should people despair or how do you function
Speaker 1: in the kind of wide open world you're describing?
Speaker 3: The reality is sort of two things. One is awareness
Speaker 3: is recognizing the reality. Don't be afraid of it, don't
Speaker 3: be terrified. I work in cybersecurity, and people like Eric,
Speaker 3: how are you in a good mood?
Speaker 2: How are you not depressed?
Speaker 3: Them like, Because I'm aware and I understand that, I
Speaker 3: embrace it, and then it's just doing simple things, doing
Speaker 3: cyber hygiene. But the reality is because technology came on
Speaker 3: so quick that most of us were not trained in school.
Speaker 3: When I went to school, the Worldwide Web didn't exist.
Speaker 3: There weren't cell phones, there weren't computers. They didn't teach
Speaker 3: me about cyber hygiene.
Speaker 2: But now my.
Speaker 3: Kids are going to school and they're still not teaching
Speaker 3: them about cyber hygiene.
Speaker 2: So to me, it's a lot of simple things.
Speaker 3: One is just recognize and know that you're a target,
Speaker 3: and understand where is your information, where is your critical data?
Speaker 3: And then understand that passwords are a thing of the past.
Speaker 3: Passwords are no longer strong. I can crack any password.
Speaker 3: You give me an account that uses a password, and
Speaker 3: I'll break into it. And we need to really embrace
Speaker 3: what we call two factor, a multi factor, and this
Speaker 3: is where you get an alert to your phone. You
Speaker 3: type in a code and start doing that. The other
Speaker 3: thing we have to realize is free apps are not free.
Speaker 3: Those free apps that you have on your cell phone,
Speaker 3: they're spying on you. I always love doing this. If
Speaker 3: we were in person, with your permission, I would ask
Speaker 3: to look at your phone and go under advanced settings
Speaker 3: and go under tracking and camera and you would probably
Speaker 3: be shocked of how many apps are tracking your location
Speaker 3: and how many apps are accessing your camera, or how
Speaker 3: many apps are accessing your microphone. And the reality is
Speaker 3: we can turn that off if we're aware. Most people
Speaker 3: just are not aware of how bad the threat is,
Speaker 3: and how open and exposed our data is.
Speaker 1: I'm sort of being sobered up just thinking about it.
Speaker 1: Let me ask you specifically about North Korea, because several
Speaker 1: people have said to me that a large part of
Speaker 1: the North Korean military operation is actually subsidized by cybercrime,
Speaker 1: and that if we were really serious about putting pressure
Speaker 1: on North Korea, we would find ways to sort of
Speaker 1: isolate them from a cyber theft standpoint. I mean, is
Speaker 1: that accurate?
Speaker 3: It is accurate, and not just for North Korea, but
Speaker 3: also Russia and Nigeria and Argentina and a lot of
Speaker 3: these countries that they're realizing that competing with the United
Speaker 3: States in traditional business is really hard. It's really difficult,
Speaker 3: and I hate to say it. You heard the phrase
Speaker 3: crime pays. It is real easy to commit cybercrime. I
Speaker 3: often joke with my friends and family that if I
Speaker 3: didn't have ethics and morals and I didn't love this country,
Speaker 3: I could be a lot richer if I moved to
Speaker 3: South America and basically was a cyber criminal.
Speaker 2: It is just unfortunately so easy and.
Speaker 3: Simple to break in to these different companies, steal information,
Speaker 3: hold them ransom, ransomware attacks where they break in, they
Speaker 3: steal the data unless you pay ransom. Most people don't
Speaker 3: realize last year, in two thousand and twenty four, ransomware
Speaker 3: attacks just in the United States against US companies was
Speaker 3: over forty two billion dollars.
Speaker 1: Good grief.
Speaker 3: Now take twenty bills million of that, give that to
Speaker 3: North Korea. Take another ten billion, give that to Russia.
Speaker 3: So yes, imagine now a country like North Korea is
Speaker 3: making twenty billion dollars a year on cybercrime, and they're
Speaker 3: increasing their capabilities because guess what, it's working. We can't
Speaker 3: stop them, and they're continuing to get more advanced in
Speaker 3: their capabilities. I always laugh is we're trying to stop
Speaker 3: North Korea from having nuclear weapons, But the reality is,
Speaker 3: without realizing it, North Korea has built cyber security nuclear weapons.
Speaker 2: That are hurting and harming US, and we don't even realize.
Speaker 1: It that the whole system you're describing. We really have
Speaker 1: to reconceptualize how we're approaching this. It's so much bigger,
Speaker 1: so much more powerful, it has so many more threats.
Speaker 1: You almost need to start from ground zero and try
Speaker 1: to imagine both what would a secure effective system be
Speaker 1: like and what would the right kind of offensive system
Speaker 1: be to make people decide it was too expensive and
Speaker 1: too painful to do things to us. I mean, it
Speaker 1: does not require a whole new way of thinking about
Speaker 1: the system's architecture.
Speaker 2: Absolutely.
Speaker 3: We talked about the last several years about infrastructure. There
Speaker 3: was the trillion dollar Infrastructure Bill to sort of rebuild
Speaker 3: the US infrastructure because it's old and it's outdata, it's antiquated.
Speaker 3: We need a trillion dollar bill on rebuilding our cyber infrastructure.
Speaker 3: Because the reality is the United States created the Internet.
Speaker 3: If you go back to the sixties and seventies, there
Speaker 3: was Darpernet, which was the original research project with the
Speaker 3: Department of Advanced Research, Department of Defense that actually built
Speaker 3: out the Internet. Well, what happened is the infrastructure of
Speaker 3: the Internet and the United States have now become one,
Speaker 3: which means we don't have any boundaries, we don't have
Speaker 3: any protection. North Korea can disconnect from the Internet. They
Speaker 3: know where they're connected to the Internet. Russia has done
Speaker 3: this twice a year. Russia disconnects from the Internet for
Speaker 3: twenty four hours to show that they can run independently.
Speaker 3: The problem is in the United States, the Internet is
Speaker 3: the United states. We can't disconnect, we can't isolate, we
Speaker 3: can't protect. So you are spot on where we need
Speaker 3: a huge revamping, where we need to rebuild the cyber infrastructure.
Speaker 3: We need to rebuild how we're connected to the Internet,
Speaker 3: and we need to create ice related countries just like
Speaker 3: Russia and North Korea, where we could protect, secure and
Speaker 3: limit who can access and what can access or information.
Speaker 3: But until we sort of redesign our infrastructure on the
Speaker 3: Internet and have a new cyber infrastructure, this is going
Speaker 3: to continue to be a problem because we're trying to
Speaker 3: fix a broken model.
Speaker 1: Seems smoothed. What you have is something which grew up
Speaker 1: at hoc over a long period of time and gradually
Speaker 1: began to attract more and more bad actors. And now
Speaker 1: you have bad actors who have very modern technologies and
Speaker 1: very modern approaches kind of trading a system much of
Speaker 1: which is obsolete. This has really got to be one
Speaker 1: of the profound infrastructure challenges of the Trump administration to
Speaker 1: take this head on.
Speaker 3: I agree, and that's one where I love what's going
Speaker 3: on now with government efficiency and dodge and cutting spending.
Speaker 3: But my concern is are we focused on the right
Speaker 3: now problem Government efficiency is an issue.
Speaker 2: It's an issue that we need to address. We need
Speaker 2: to limit spending.
Speaker 3: Cyber security is a problem that we have to stop ignoring.
Speaker 3: So you really summarize it so well that this administration,
Speaker 3: to me, if they want to go down and sort
Speaker 3: of be remembered and have a legacy, the legacy is
Speaker 3: not going to be in government efficiency. It's not going
Speaker 3: to be in cutting spending. It's going to be Could
Speaker 3: this be the first administration that actually passes federal cyber
Speaker 3: security laws? Could this be the first administration that passes
Speaker 3: a trillion dollar cyber infrastructure bill that rebuilds our cyber infrastructure.
Speaker 2: But you're right.
Speaker 3: Until we start taking this seriously and Congress and the
Speaker 3: White House and everyone starts realizing that cybersecurity is the
Speaker 3: number one problem, we're going to continue to have these
Speaker 3: issues and continue to be vulnerable.
Speaker 1: This is exactly right. And I'm really delighted that we
Speaker 1: had this conversation because I think you put your finger
Speaker 1: on one of the great challenges of the next ten years.
Speaker 1: And I want to thank you for joining me. Your book,
Speaker 1: Cyber Crisis, Protecting Your Business from Real Threats in the
Speaker 1: Virtual World is available now on Amazon and in bookstores everywhere.
Speaker 1: We're going to feature a link to buy it on
Speaker 1: our show page, and I want to let our listeners
Speaker 1: know they can follow your recent work by visiting your
Speaker 1: website at doctor Ericcole dot orgon Thank you so much for.
Speaker 2: Being here, my pleasure, Thank you for having me.
Speaker 1: Thank you to my guest, doctor Eric Cole. You can
Speaker 1: get a link to buy his new book Cyber Crisis
Speaker 1: Protecting Your Business from Real Threats in the Virtual World
Speaker 1: on our show page at newtsworld dot com. Newtsworld is
Speaker 1: produced by Gamelish three sixty and iHeartMedia. Our executive producer
Speaker 1: is Guarnsey Sloan. Our researcher is Rachel Peterson. The artwork
Speaker 1: for the show was created by Steve Penley. Special thanks
Speaker 1: to the team at Gaglish three sixty. If you've been
Speaker 1: enjoying Newtsworld, I hope you'll go to Apple Podcast and
Speaker 1: both rate us with five stars and give us a
Speaker 1: review so others can learn what it's all about. Right now,
Speaker 1: listeners of Neutrold can sign up for my three free
Speaker 1: weekly columns at Gingrich sixty dot com slash newsletter. I'm
Speaker 1: newt Gingrich. This is neut world,