WEBVTT - Automatic Cybersecurity 0:00:00.160 --> 0:00:07.280 Brought to you by Toyota. Let's go places. Welcome to 0:00:07.440 --> 0:00:15.400 Forward Thinking. Hey there, and welcome to Forward Thinking, the 0:00:15.600 --> 0:00:18.720 podcast that looks at the future and says, if you 0:00:18.720 --> 0:00:21.160 should get it an email with the subject stinky cheese 0:00:21.239 --> 0:00:24.040 better of protecting your chances under no circumstances should you 0:00:24.120 --> 0:00:28.720 open it. I'm Jonathan Strickland and I'm Joe McCormick, and 0:00:28.760 --> 0:00:31.120 I'm not gonna ask about that. Let's move on to 0:00:31.240 --> 0:00:35.400 the topic today, which is cybersecurity. Yeah, we wanted to 0:00:35.440 --> 0:00:40.280 talk about a recent story about the idea of automating cybersecurity. 0:00:40.360 --> 0:00:43.560 But before we even get into that, let's talk about why. 0:00:43.880 --> 0:00:45.680 You know, I'm just gonna set the groundwork of what 0:00:45.760 --> 0:00:48.240 cybersecurity is all about and why it's such a huge 0:00:49.040 --> 0:00:53.519 challenge in today's world. So, really, when you think about it, 0:00:53.600 --> 0:00:56.800 cybersecurity experts and hackers have always played kind of a 0:00:56.840 --> 0:01:02.120 tick talk game. Really, the hackers, you could argue, Yeah, exactly, 0:01:02.160 --> 0:01:06.840 it's it's it's it's very much a reactionary kind of relationship. 0:01:07.200 --> 0:01:10.600 So it starts whenever a developer releases some software into 0:01:10.640 --> 0:01:15.039 the world. Operating system upgrades would be a major example. 0:01:15.160 --> 0:01:19.000 So let's say that you know, Microsoft releases a Windows 0:01:19.200 --> 0:01:22.040 update or Google and Android update, that kind of thing. 0:01:22.560 --> 0:01:25.440 Hackers then start to look at the operating system and 0:01:25.480 --> 0:01:28.600 start to explore it, probe it for vulnerabilities, things that 0:01:28.640 --> 0:01:33.039 could be exploited. Um. And the reason for that is 0:01:33.080 --> 0:01:35.680 the way a computer works, the way it executes code. 0:01:36.480 --> 0:01:39.560 If you're able to exploit vulnerabilities, you can get access 0:01:39.600 --> 0:01:43.080 sometimes to very important elements of a computer, like to 0:01:43.120 --> 0:01:47.000 the point where you could potentially take it over. Sure, 0:01:47.040 --> 0:01:48.960 you can either bend it to your will, use it 0:01:49.000 --> 0:01:52.919 to do some some upward processing, or or get data 0:01:53.080 --> 0:01:55.680 from that person's computer to to use in some kind 0:01:55.720 --> 0:01:59.000 of criminal way. Oh yeah, absolutely. Uh. It may be 0:01:59.200 --> 0:02:04.320 something as simple as simple in quotes as stealing files. 0:02:04.360 --> 0:02:08.440 It may be something more complicated, like installing a key 0:02:08.480 --> 0:02:11.800 logger that's going to copy everything someone types in so 0:02:11.880 --> 0:02:14.160 you start to get all their their info, like their 0:02:14.720 --> 0:02:16.760 logins and passwords, that kind of stuff. It may even 0:02:16.800 --> 0:02:19.640 be a backdoor access where you can you can control 0:02:19.680 --> 0:02:23.440 that processing power for specific nefarious purposes without the person 0:02:23.520 --> 0:02:25.720 necessarily knowing what's up except for the fact that their 0:02:25.760 --> 0:02:28.240 computer seems to be really kind of sludgy and slow, 0:02:28.600 --> 0:02:31.000 or it could just be fair mischief. Yeah, it could 0:02:31.000 --> 0:02:35.400 just be that, you know, yeah, as they say. So. Meanwhile, 0:02:35.480 --> 0:02:40.120 you've got the cybersecurity professionals who are looking for vulnerabilities too, 0:02:40.120 --> 0:02:42.360 but they're not looking to exploit them. They're looking to 0:02:42.440 --> 0:02:47.480 patch them to to address those vulnerabilities and and tweak 0:02:47.520 --> 0:02:50.360 them so that they're no longer and opening for hackers 0:02:50.360 --> 0:02:55.160 to exploit. They also try to nullify malware that hackers 0:02:55.160 --> 0:02:58.200 are developing. So uh, they're trying to make sure that 0:02:58.240 --> 0:03:01.040 the various worms and virus is and other types of 0:03:01.200 --> 0:03:05.680 malicious software that hackers unleash upon the world are nullified 0:03:05.760 --> 0:03:09.360 in some way. It's super tricky to do because you 0:03:09.360 --> 0:03:11.840 remember those old days of the huge downloads of the 0:03:11.840 --> 0:03:16.400 Norton anti virus updates. Yeah, yeah, well yeah, I remember 0:03:16.520 --> 0:03:18.600 the days of like when you're shutting down your computer 0:03:18.680 --> 0:03:22.280 and says, hang on, I need to download about, you know, 0:03:22.360 --> 0:03:25.880 half the gig's worth of data before you can leave, 0:03:26.040 --> 0:03:28.600 and then you think, well, as we'll go get another 0:03:28.639 --> 0:03:32.160 cup of coffee because I'm gonna be here for a while. Uh. 0:03:32.240 --> 0:03:36.080 At any rate, this this is very much the relationship. Right. 0:03:36.080 --> 0:03:40.240 You've got the release of software hackers trying to exploit it. 0:03:40.480 --> 0:03:44.880 Cybersecurity professionals trying to address the vulnerabilities and nullify the malware. 0:03:45.320 --> 0:03:49.720 Hackers go back to trying to find other vulnerabilities to exploit. Also, 0:03:49.840 --> 0:03:53.840 this is not necessarily all just happening back to back, 0:03:53.920 --> 0:03:56.280 because there's a lot of overlap. I mean, just because 0:03:56.800 --> 0:04:02.320 cybersecurity professional identifies and even patches vulnerable opening and software 0:04:02.360 --> 0:04:06.280 that doesn't magically propagated out to everybody who's ever downloaded 0:04:06.320 --> 0:04:11.920 that software. Now, so this is your your responsibility message here. 0:04:12.960 --> 0:04:15.920 Update your browser. Update your browser, update your operating system, 0:04:16.000 --> 0:04:19.480 update your security settings. Make sure that you keep those 0:04:19.520 --> 0:04:23.720 as close to up to date as possible, because while 0:04:23.800 --> 0:04:25.920 it can be irritating to take up time to do 0:04:25.960 --> 0:04:29.360 that sort of thing, it often addresses these vulnerabilities and 0:04:29.400 --> 0:04:32.960 makes you less liable to experience issues created by evil, 0:04:33.080 --> 0:04:36.880 nasty hackers out there. This also means that cybersecurity folks 0:04:36.880 --> 0:04:42.240 are typically a step behind hackers right because often they 0:04:42.279 --> 0:04:45.760 while they're trying to identify the own vulnerabilities, they may 0:04:45.800 --> 0:04:47.640 not be looking in the same place as that hackers 0:04:47.640 --> 0:04:50.599 start looking at, and they have to respond to the 0:04:50.640 --> 0:04:54.440 malware that hackers are creating. So you get this TikTok, 0:04:54.760 --> 0:04:59.320 where the reactionary response to the cybersecurity is to counter 0:04:59.440 --> 0:05:02.360 the move that the hackers have made, but it doesn't 0:05:02.360 --> 0:05:05.320 magically counter the next move the hackers make. You have 0:05:05.400 --> 0:05:08.680 to do it over and over and over again. So 0:05:08.720 --> 0:05:12.200 wouldn't it be cool if we could get an actionary 0:05:12.320 --> 0:05:16.240 system rather than a reactionary or one that is reactionary 0:05:16.520 --> 0:05:19.919 all on its own and doesn't require a human interaction 0:05:20.000 --> 0:05:24.920 at all? Because where the bottle nick really well, especially 0:05:24.920 --> 0:05:26.719 now and I'll get into more of the reason of 0:05:26.760 --> 0:05:30.200 why now it's particularly a problem in a little bit later, 0:05:30.279 --> 0:05:33.080 But as you say, it can be actionary to Lauren, 0:05:33.200 --> 0:05:37.320 you could have software that is actively looking at vulnerabilities 0:05:37.360 --> 0:05:40.320 before any human has even laid eyes apart for the 0:05:40.360 --> 0:05:44.240 developer on the code, and then in that case you 0:05:44.600 --> 0:05:47.120 close off the system before a hacker is even able 0:05:47.160 --> 0:05:50.920 to exploit it. But in other cases where there may 0:05:50.960 --> 0:05:55.159 already be a vulnerability known to hackers, uh, the systems 0:05:55.200 --> 0:05:57.279 could be patching that vulnerability as well as trying to 0:05:57.320 --> 0:06:01.040 counteract any malware that hackers have created. If you were 0:06:01.040 --> 0:06:03.200 able to do this and take humans out of that picture, 0:06:03.600 --> 0:06:06.279 it would be amazing because it would be way faster 0:06:06.360 --> 0:06:10.520 and more efficient than than than a human. But it's 0:06:10.560 --> 0:06:14.320 a tall order. It's really not an easy thing to 0:06:14.400 --> 0:06:19.760 ask for. Who would ask for such a thing? Sort 0:06:19.760 --> 0:06:23.640 of a you're right they did, DARPA asked that thing. 0:06:24.200 --> 0:06:27.960 Wait wait, First of all, though, let's remind everybody who 0:06:28.080 --> 0:06:30.440 is DARPA. It's the R and D division within the 0:06:30.480 --> 0:06:33.159 Department of Defense, with the awkwardest name ever being the 0:06:33.240 --> 0:06:38.440 Defense Advanced Research Projects Agency used to be. Or yeah, 0:06:38.440 --> 0:06:41.120 it used to be ARPA. I like. I like that 0:06:41.320 --> 0:06:43.039 the way you deliver that it made me think of 0:06:43.040 --> 0:06:45.400 like defense against the Dark arts, which in a way 0:06:45.560 --> 0:06:47.800 is kind of what we're talking about today. Yeah. I 0:06:48.560 --> 0:06:51.120 actually I'd never heard it put this way before. This 0:06:51.200 --> 0:06:54.160 might be have always been part of its charter, but 0:06:54.160 --> 0:06:57.559 but I didn't come across this description until some stuff 0:06:57.600 --> 0:07:00.640 we were reading for this episode today. But they described 0:07:00.680 --> 0:07:05.560 it as preventing strategic surprise. I watched a video about that, 0:07:05.640 --> 0:07:09.360 and my favorite quote was, surprises are hard to predict. 0:07:10.000 --> 0:07:12.280 I know exactly what you're talking about. I watched that 0:07:12.320 --> 0:07:18.840 same video. I'm like, you don't say. I think you 0:07:18.880 --> 0:07:22.160 said surprises can be hard to predict, Yes, which I 0:07:22.200 --> 0:07:26.280 thought was amazing. It reminds me of the Giant the 0:07:26.320 --> 0:07:29.320 Giant Souvenir shop at Las Vegas, where one of the 0:07:29.400 --> 0:07:35.080 signs says, if it's in stock, we have it, and like, yeah, 0:07:35.200 --> 0:07:38.080 I guess that's I mean, I would have argued that 0:07:38.080 --> 0:07:40.760 that was pretty much obvious, but I'm glad that you 0:07:40.840 --> 0:07:44.920 put it out there. So, uh, yeah, DARPA is it's 0:07:44.960 --> 0:07:49.440 got a long history obviously with technology. I mean, the Internet, 0:07:49.640 --> 0:07:53.560 you could argue, is really a product of work that 0:07:53.640 --> 0:07:55.840 was done when DARPA was called ARPA. There was a 0:07:55.880 --> 0:07:59.240 predecessor to the Internet called ARPA net and during the 0:07:59.280 --> 0:08:01.720 development of our and that many of the protocols that 0:08:01.920 --> 0:08:06.560 underlie the way the Internet works were developed. So very 0:08:06.640 --> 0:08:10.680 much a part of the world of software and hardware. 0:08:10.720 --> 0:08:13.360 Not just hey, can we develop a new thing that 0:08:13.440 --> 0:08:17.000 flies faster and uh and it's harder to detect than 0:08:17.040 --> 0:08:21.720 anything else we've ever created, but things that have benefits 0:08:21.960 --> 0:08:27.720 far beyond just a basic military application. Now, to be fair, DARPA, 0:08:27.800 --> 0:08:31.120 being part of the Department of Defense, is primarily concerned 0:08:31.400 --> 0:08:36.559 with matters of protecting national security and and uh making 0:08:36.600 --> 0:08:41.240 certain that the United States technological capability remains at the 0:08:41.360 --> 0:08:44.320 very front of the entire world as much as possible. 0:08:45.040 --> 0:08:46.520 You know, you've got to keep that in mind. But 0:08:46.760 --> 0:08:52.559 beyond that, the developments of various DARPA initiatives have uh 0:08:52.880 --> 0:08:58.800 much greater consequence than improving our defensive capabilities. Oh sure, well, 0:08:58.840 --> 0:09:01.240 and and started started to say in way that just 0:09:01.440 --> 0:09:04.200 like NASA, getting people into space has a lot of 0:09:04.280 --> 0:09:07.720 further reaching implications in terms of technology and design. And 0:09:07.720 --> 0:09:10.679 we've in fact talked about a few of the darpest 0:09:10.679 --> 0:09:12.839 projects here on the show before. Right, So first we 0:09:12.880 --> 0:09:17.160 should mention DARPA really is more of an administrative organization. Right. 0:09:17.200 --> 0:09:19.600 It's not so much that you go to DARPA and 0:09:19.679 --> 0:09:22.320 you enter into a world of shiny labs with lots 0:09:22.360 --> 0:09:26.720 of beakers and and beeping computers and stuff and and 0:09:26.720 --> 0:09:31.240 and technicians and scientists running everywhere with like crazy alien 0:09:31.320 --> 0:09:34.720 looking devices. That's not really what DARPA is. What DARBA 0:09:34.920 --> 0:09:40.040 really is is the organization that provides funding to other 0:09:40.200 --> 0:09:44.120 research organizations. They what what DARPA does is identify a need. 0:09:44.720 --> 0:09:49.080 They say, we need for this type of technology to exist. 0:09:50.320 --> 0:09:52.640 Who out there thinks they can do it? And then 0:09:52.920 --> 0:09:55.280 we've got some money for you, exactly, And then you've 0:09:55.320 --> 0:09:59.440 got different organizations that respond and they'll say I think 0:09:59.440 --> 0:10:02.679 we can do it, and then DARPA reviews the various proposals, 0:10:03.000 --> 0:10:07.959 decides which organizations are the most likely to succeed based 0:10:08.000 --> 0:10:10.920 upon those proposals, and funds them in order to try 0:10:10.960 --> 0:10:16.000 and develop that technology. Uh. And sometimes what DARPA does 0:10:16.240 --> 0:10:18.800 is they do this in the form of a competition. 0:10:18.880 --> 0:10:21.640 It's not just hey, hey, we need this one type 0:10:21.640 --> 0:10:24.800 of technology. Who thinks they can do it? It's hey, 0:10:24.840 --> 0:10:27.600 we've got this idea for a crazy thing we want 0:10:27.640 --> 0:10:30.680 people to be able to do with with technology. We're 0:10:30.720 --> 0:10:35.000 gonna pit you against other groups that also want to 0:10:35.040 --> 0:10:37.640 do this thing, and whoever wins gets a big old 0:10:37.840 --> 0:10:41.760 fat prize, which may or may not be equal to 0:10:41.760 --> 0:10:44.319 the amount of money that these organizations have to pour 0:10:44.440 --> 0:10:46.880 into their research and development to create the technology in 0:10:46.920 --> 0:10:49.160 the first place. But they still own that technology and 0:10:49.240 --> 0:10:53.280 can use it to make the money. Absolutely so, we 0:10:53.400 --> 0:10:57.880 have talked about them multiple times. Uh. The first time 0:10:57.920 --> 0:10:59.880 that I was able to find using the handy dan 0:11:00.200 --> 0:11:05.360 control f feature on our RSS feed was from November eighth, 0:11:05.400 --> 0:11:09.040 two thousand thirteen, when we published robot you Can Drive 0:11:09.120 --> 0:11:12.480 My Car? How many times have we made that joke. 0:11:12.520 --> 0:11:15.959 I'm almost convinced. I'm pretty convinced I made that that title. 0:11:16.280 --> 0:11:19.880 I could be wrong. I could be wrong, but yeah. 0:11:20.440 --> 0:11:23.720 So it was one of our earliest episodes about autonomous vehicles, 0:11:24.320 --> 0:11:27.040 and in that episode we talked about how DARPA played 0:11:27.040 --> 0:11:30.480 a key role in getting the development of driverless cars 0:11:31.160 --> 0:11:36.400 rolling because they have wheels. Uh. But yeah, the the 0:11:36.400 --> 0:11:41.200 original Grand Challenge that DARPA issued was about autonomous vehicles. 0:11:42.000 --> 0:11:44.720 On May eighth, two thousand fifteen, we published an episode 0:11:44.720 --> 0:11:48.200 titled What's Up with DARPA, which really was more of 0:11:48.240 --> 0:11:51.760 an episode to explain what DARPA really is all about 0:11:52.240 --> 0:11:54.839 and some of the projects that DARPA was overseeing at 0:11:54.840 --> 0:11:58.560 that time, um and mostly leading up to the Grand 0:11:58.640 --> 0:12:01.600 Robotics Challenge, which of course we already kind of covered 0:12:01.640 --> 0:12:04.559 in the previous episode, and then we had on June seventeen, 0:12:04.640 --> 0:12:08.480 two fifteen, So not long after that one, we released 0:12:08.480 --> 0:12:11.960 our episode about the DARPA Robotics Challenge. They are not 0:12:12.080 --> 0:12:14.360 the not the Grand Challenge, which was autonomous cars, but 0:12:14.480 --> 0:12:19.240 rather the challenge of building a humanoid robot, or at 0:12:19.280 --> 0:12:23.520 least a robot capable of following over a lot. They 0:12:23.840 --> 0:12:26.559 people excelled at that part of the challenge, which really 0:12:26.600 --> 0:12:28.600 wasn't part of the challenge. You didn't want your robot 0:12:28.640 --> 0:12:30.679 to fall over, but to be able to do a 0:12:31.040 --> 0:12:36.560 series of of steps, a series of tasks that would 0:12:36.600 --> 0:12:41.079 potentially be part of a rescue operation or an emergency 0:12:41.120 --> 0:12:44.200 response operation in the wake of a disaster, similar to 0:12:44.320 --> 0:12:49.840 the uh the Fukushima plant when the tsunami hit. So like, 0:12:49.880 --> 0:12:52.120 one of the tasks was walked to a door and 0:12:52.240 --> 0:12:54.760 open it. Man, that was that was a tough one. Yeah, 0:12:54.760 --> 0:12:56.600 it turned out to be a lot hard. Like robots 0:12:56.600 --> 0:12:59.480 were not being able to grab the weren't able to 0:12:59.480 --> 0:13:01.600 perceive where the doorknob was accurately, and so they kept 0:13:01.600 --> 0:13:04.040 trying to grab at places the doorknob definitely was not. 0:13:05.040 --> 0:13:08.360 Stepping through the doorway was bad, Yeah, which is a 0:13:08.440 --> 0:13:11.240 very difficult thing to mechanize. That. They had to pick 0:13:11.320 --> 0:13:14.000 up a drill and like use it. Yep, they had 0:13:14.040 --> 0:13:16.719 to climb us as stairs, which also turned out to 0:13:16.760 --> 0:13:18.640 be super tricky. Yeah, there are a lot of things 0:13:18.679 --> 0:13:23.120 that we humans typically find fairly easy. I mean, even 0:13:23.160 --> 0:13:26.040 if we couldn't do all of the different tasks, we 0:13:26.160 --> 0:13:28.640 might find at least, some of the tasks pretty natural 0:13:28.920 --> 0:13:31.920 for us to complete, but for robots that's not the case. 0:13:32.040 --> 0:13:35.000 There is no natural for a robot. Uh. And it 0:13:35.040 --> 0:13:37.520 turned out that a lot of those what we thought 0:13:37.520 --> 0:13:40.280 of as simple tasks were really complicated. So those are 0:13:40.280 --> 0:13:45.120 the episodes where we specifically focused on DARPA. But today 0:13:45.120 --> 0:13:49.640 we want to talk about the more recent Cyber Grand Challenge, 0:13:49.679 --> 0:13:53.680 which comes into the concept we're talking about here about 0:13:53.760 --> 0:13:59.640 creating an automated system capable of recognizing vulnerabilities and patching 0:13:59.679 --> 0:14:02.920 them in real time. That's the basic idea, right, Like 0:14:03.000 --> 0:14:07.480 DARPA's like, hey, this is what we want, uh, you team, 0:14:07.679 --> 0:14:11.400 you know, start forming teams out there to do competitions, 0:14:12.040 --> 0:14:15.680 and we'll have a big challenge and whoever wins gets 0:14:15.679 --> 0:14:20.240 a prised. That's the basic idea, um. But it's interesting 0:14:20.280 --> 0:14:26.800 because it's using an approach that humans have been following 0:14:26.800 --> 0:14:29.960 for a while. It's it's not not like they've invented 0:14:30.000 --> 0:14:33.360 a game that the robots have to compete in. The 0:14:33.400 --> 0:14:38.480 game already existed and in fact has a a bit 0:14:38.520 --> 0:14:43.360 about an interesting name. It's it's a capture the flag game. Yeah, 0:14:43.640 --> 0:14:48.000 which is funny because it doesn't actually resemble Capture the Flag. Yeah, 0:14:48.440 --> 0:14:51.600 so what what is the capture? They have these tournaments, right, 0:14:52.000 --> 0:14:54.560 so capture the Flag tournament might be a thing. A 0:14:54.560 --> 0:14:56.960 bunch of hackers show up too, and it's a model 0:14:57.040 --> 0:15:00.880 for testing people's skills at cybersecurity challenge. Just so a 0:15:00.960 --> 0:15:04.280 CTF tournament you might see something like this, a bunch 0:15:04.360 --> 0:15:08.160 of cybersecurity pros all show up and get a piece 0:15:08.200 --> 0:15:11.720 of target software and then they go to work trying 0:15:11.720 --> 0:15:14.360 to be the first to discover security flaws in the 0:15:14.400 --> 0:15:18.480 software and then release a secure patch to fix the problems. 0:15:18.480 --> 0:15:20.080 So they've got to sort of they have to like 0:15:20.160 --> 0:15:24.560 reverse engineer the software, figure out what its vulnerabilities are, 0:15:24.920 --> 0:15:29.600 address those vulnerabilities, and get them fixed. Uh. And so 0:15:30.360 --> 0:15:34.400 that sounds like a good test of your steel as 0:15:34.400 --> 0:15:39.280 a cybersecurity professional. But what if you removed the human 0:15:39.320 --> 0:15:43.120 hackers from the competition, right, Like, so in this case, 0:15:43.320 --> 0:15:48.400 the people competing aren't competing directly in searching that software, 0:15:48.480 --> 0:15:52.440 finding the vulnerabilities, and patching them, but rather developing software 0:15:52.520 --> 0:15:56.480 that can do that on their behalf automatically. Yeah, so 0:15:56.520 --> 0:15:59.360 that they aren't the ones guiding the software. Very much 0:15:59.400 --> 0:16:02.280 like in the rival less car scenario. You were not 0:16:02.360 --> 0:16:07.040 allowed to have any kind of remote control of the vehicle, right, 0:16:07.160 --> 0:16:09.720 The vehicle had to be able to do everything on 0:16:09.760 --> 0:16:13.240 its own, and if it failed, it failed. Same sort 0:16:13.280 --> 0:16:15.320 of thing with this kind of software. The idea being 0:16:15.320 --> 0:16:19.280 that you don't get to guide the software. It has 0:16:19.320 --> 0:16:23.400 to be able to analyze that that target software and 0:16:23.480 --> 0:16:27.120 identify the vulnerabilities and patch them all on its own. 0:16:27.440 --> 0:16:31.840 So why even bother doing this? Well, it's because computers 0:16:32.280 --> 0:16:37.400 are everywhere now, They're pervasive, they're integrated into our daily experience, 0:16:37.440 --> 0:16:42.160 and they're on all scales. Right, the stakes have never 0:16:42.200 --> 0:16:45.480 been higher as far as cybersecurity goes, and they're only 0:16:45.520 --> 0:16:50.360 getting higher exactly right. So it used to be higher, 0:16:50.720 --> 0:16:53.040 or it used to be you know, the early days 0:16:53.040 --> 0:16:55.240 of viruses, you know, way back in the day where 0:16:55.760 --> 0:16:58.240 things weren't even necessarily networked yet and people were spreading 0:16:58.280 --> 0:17:01.440 viruses via physical discs and oh yeah, uh, you know, 0:17:01.520 --> 0:17:03.520 the worst that was going to happen is you might 0:17:04.000 --> 0:17:07.400 cause a lot of damage to your computer. Yeah, and 0:17:07.480 --> 0:17:10.000 that's not good. I mean that could have you know, 0:17:10.119 --> 0:17:14.520 potentially disastrous consequences for somebody's personal I don't know, personal 0:17:14.600 --> 0:17:21.520 projects or whatever. But you wouldn't have um extremely dangerous, widespread, 0:17:21.880 --> 0:17:26.680 society wide consequence. It's not not a catastrophic event. It's 0:17:26.720 --> 0:17:29.040 something we're not going to kill anybody. Right. On an 0:17:29.080 --> 0:17:34.640 individual basis, it could range from inconvenient to financially difficult, 0:17:34.720 --> 0:17:36.920 depending like let's say you know, my dad, for example, 0:17:37.440 --> 0:17:40.119 is an author, and if he had had a computer 0:17:40.200 --> 0:17:44.000 virus affect our old computer upon which he was writing 0:17:44.200 --> 0:17:48.160 his novels, that would have had a very profound impact 0:17:48.200 --> 0:17:50.439 on his ability to do his work as an author. 0:17:50.920 --> 0:17:54.200 But it's not like that would suddenly also affect all 0:17:54.240 --> 0:17:57.399 the other computers in the world. It's happening on a 0:17:57.520 --> 0:18:00.639 very individual machine. Right. But then, okay, so once you 0:18:00.760 --> 0:18:03.920 start networking computers all over the place, suddenly you can 0:18:04.000 --> 0:18:10.480 spread viruses uh and malware and vulnerability knowledge much more easily, 0:18:10.640 --> 0:18:15.080 and you can exploit sensitive information and you can uh, 0:18:15.240 --> 0:18:17.560 you can you can have much more far reaching consequences. 0:18:17.600 --> 0:18:22.080 You can cause economic disaster. Um. Now, imagine expanding this 0:18:22.160 --> 0:18:25.480 to the next level beyond just network devices. Our devices 0:18:25.480 --> 0:18:29.080 are no longer just information devices. There, uh, you know, 0:18:29.200 --> 0:18:33.919 standard infrastructure devices, devices that control the world around us, 0:18:34.520 --> 0:18:37.600 power plants in our own HVAC systems and all all 0:18:37.600 --> 0:18:41.160 sorts of things. Yeah, so we elevators everything, right, Yeah, 0:18:41.240 --> 0:18:44.240 we started with things like your desktop computer. But then 0:18:44.280 --> 0:18:46.640 we're also like, okay, well we also have laptop computers. 0:18:46.920 --> 0:18:49.080 And now we've also got uh cell phones. Oh and 0:18:49.160 --> 0:18:53.720 smartphones came a little bit later, tablets to other computer systems. 0:18:54.359 --> 0:18:59.360 In uh, traffic lights to not just within an entire 0:18:59.400 --> 0:19:02.160 system of try lights, but within an individual traffic lights 0:19:02.240 --> 0:19:08.720 or appliances or televisions or sensors. I mean we as 0:19:08.760 --> 0:19:12.159 we approach the Internet of things, we have more and 0:19:12.240 --> 0:19:16.200 which you could argue that era is already upon us. 0:19:16.240 --> 0:19:19.080 We are in the Internet of things era. Now we 0:19:19.119 --> 0:19:23.119 have more and more devices that are partially or fully 0:19:23.160 --> 0:19:27.280 dependent upon computerized systems, which may and in fact you 0:19:27.320 --> 0:19:30.400 might as well say, do have vulnerabilities in them. They 0:19:30.400 --> 0:19:33.840 may not all be identified, but there's almost certainly a 0:19:33.880 --> 0:19:37.879 vulnerability in every system that human beings have produced, because 0:19:38.800 --> 0:19:43.560 we can't necessarily predict the vulnerabilities while we're making them, 0:19:43.640 --> 0:19:45.840 Like they really shouldn't have released that smart of and 0:19:46.000 --> 0:19:48.720 has the vulnerability where somebody can get it to throw 0:19:48.760 --> 0:19:51.760 you inside and turn on self cleaning mode. HANSL. And 0:19:51.800 --> 0:19:54.200 Gretel five thousand. I told them not to do it, 0:19:54.560 --> 0:19:57.200 but you know, they just might not have been able 0:19:57.240 --> 0:20:00.800 to predict that that vulnerability was there. Yes, when you're 0:20:00.800 --> 0:20:03.520 in the middle of developing, it can be difficult to 0:20:03.520 --> 0:20:07.240 see that, right because your number one goal is to 0:20:07.359 --> 0:20:10.720 get the thing you want to happen to happen. Yeah, 0:20:10.800 --> 0:20:13.480 you want, you want the whatever it is, whatever the 0:20:13.480 --> 0:20:16.760 the end goal is of the code you are writing. 0:20:17.440 --> 0:20:20.199 You want to achieve that goal. So let's say that 0:20:20.240 --> 0:20:23.160 you're just writing a program. It's a really simple program. 0:20:23.160 --> 0:20:25.760 It's like, let's say it's a word processing program. So 0:20:25.800 --> 0:20:27.960 you're just trying to create a word processing program, and 0:20:27.960 --> 0:20:30.960 you wanted to have all the basic elements of word 0:20:31.000 --> 0:20:34.440 processing involved in it. You're concerned with writing code that 0:20:34.520 --> 0:20:38.480 creates a working word processor. You may not notice that 0:20:39.040 --> 0:20:42.240 in the way that you develop this code, you have 0:20:42.320 --> 0:20:47.520 created a vulnerability that would allow a hacker to access uh, 0:20:47.640 --> 0:20:51.840 let's say some administrative level commands on an operating system 0:20:52.040 --> 0:20:54.919 through the code you've made. Because that wasn't what you 0:20:54.920 --> 0:20:57.440 were thinking about when you were building your word processor. 0:20:57.480 --> 0:21:00.879 You weren't trying to you weren't even thinking that that 0:21:00.920 --> 0:21:02.600 was a possibility. You were just trying to make a 0:21:02.720 --> 0:21:05.560 working word processor. Yeah. Yeah, And and and for all of 0:21:05.600 --> 0:21:08.720 these all of these computers, people are writing so much 0:21:08.760 --> 0:21:13.719 code every day, trillion lines of code a year. That 0:21:13.800 --> 0:21:15.840 was in the early two thousands, so we're talking about 0:21:15.880 --> 0:21:18.160 way more. And and you think about you think about 0:21:18.200 --> 0:21:21.040 the number of platforms that have increased since the early 0:21:21.080 --> 0:21:24.560 two thousand's. That's before the smartphone was really a thing. 0:21:25.240 --> 0:21:27.199 You know, think about two thousand seven. That's when the 0:21:27.240 --> 0:21:30.320 iPhone gets introduced. That's when the smartphone, at least in 0:21:30.320 --> 0:21:34.240 the United States, really becomes a consumer product. Before that time, 0:21:34.280 --> 0:21:37.000 it was something that you might see some executives having 0:21:37.040 --> 0:21:40.280 as part of the way they interact with their businesses, 0:21:40.320 --> 0:21:42.639 But the average consumer in the United States didn't have 0:21:42.640 --> 0:21:45.720 a smartphone until after two thousand seven. At that point, 0:21:45.920 --> 0:21:50.000 you've got so many different devices now that people are 0:21:50.000 --> 0:21:53.439 developing code for, and some of them aren't even you know, 0:21:53.680 --> 0:21:56.560 your traditional computers or smartphones or tablets. They might be 0:21:56.840 --> 0:22:01.400 hardware that the consumer is never interacting in a way 0:22:01.440 --> 0:22:04.359 where they're even all where their software involved. Sure, like 0:22:04.560 --> 0:22:08.920 every single Intel chip that's sold has has stuff hard 0:22:08.920 --> 0:22:11.640 coded into it, and that's it's not just Intel every 0:22:11.720 --> 0:22:15.720 every chip, sure yasically many chips and your basic firmware. Right, 0:22:15.720 --> 0:22:20.120 the idea that you've got programming that is physically codified 0:22:20.160 --> 0:22:23.520 into a system, it's not. It's not like some ephemeral 0:22:23.720 --> 0:22:27.040 software that exists for a moment and then it's gone. 0:22:27.080 --> 0:22:30.320 It's it's actually part of the device itself. So we've 0:22:30.320 --> 0:22:34.040 got all this code, huge amounts. Now, imagine it's your 0:22:34.119 --> 0:22:37.280 job to go through code and find vulnerabilities, and you're thinking, 0:22:37.359 --> 0:22:41.320 there's more code generated every day than I could possibly 0:22:41.359 --> 0:22:43.480 get through in a week. It's kind of like the 0:22:43.600 --> 0:22:46.080 issue with YouTube where you talk about how many hours 0:22:46.359 --> 0:22:50.800 per minute get uploaded to YouTube. There's no way to 0:22:50.920 --> 0:22:54.800 watch all the content because it's physically impossible. Yeah, you 0:22:55.119 --> 0:22:58.320 could say, well, how could we monitor all that content 0:22:58.440 --> 0:23:02.400 to make sure people aren't uploading copyrighted movies and stuff 0:23:02.440 --> 0:23:05.000 like that? But you know what you could do. You 0:23:05.000 --> 0:23:08.600 could design a program to look through all of that 0:23:08.640 --> 0:23:11.920 stuff and compared against the database of copywritten material, it's 0:23:11.920 --> 0:23:15.159 alood easier than hiring Bob to try to watch an 0:23:15.160 --> 0:23:18.600 impossible number of YouTube videos every day. Yeah, so, yeah, 0:23:18.600 --> 0:23:21.120 you've got and if you've seen you've seen people trying 0:23:21.119 --> 0:23:23.440 to get around this, I bet right on YouTube where 0:23:23.480 --> 0:23:27.840 they like they upload copyrighted material, but it's like obscured 0:23:27.960 --> 0:23:30.600 and flipped and zooming in and out in weird ways 0:23:30.640 --> 0:23:34.080 to try to prevent auto detection. Right, have you seen this? Yeah? 0:23:34.200 --> 0:23:37.960 Or people you know, people just have like a a 0:23:38.160 --> 0:23:42.080 section of whatever the view would be. Yeah, those are 0:23:42.119 --> 0:23:45.359 the worst, right where you're like, oh, it's the lower 0:23:45.400 --> 0:23:47.879 two thirds of a television screen so that this doesn't 0:23:47.880 --> 0:23:51.480 get picked up. An awful, awful sound quality. What a 0:23:51.520 --> 0:23:54.359 wonderful experience I'm having right now. I'm going to go 0:23:54.400 --> 0:23:56.840 buy the movie. Man. Really we think about it, it's 0:23:56.840 --> 0:23:59.240 more of a great tool to convince people to purchase 0:24:00.040 --> 0:24:03.400 this stuff legitimately in order to have a decent experience. 0:24:03.400 --> 0:24:06.000 But at any rate, Uh. One of the things that 0:24:06.240 --> 0:24:09.600 was interesting when I was researching this was the you know, 0:24:09.640 --> 0:24:11.800 you got those trillion lines of code, what does that 0:24:11.840 --> 0:24:15.439 mean in terms of vulnerabilities? And the estimate I was 0:24:15.480 --> 0:24:19.399 hearing was about they were talking about a billion vulnerabilities 0:24:20.200 --> 0:24:23.600 existing out there, a billion. So you've got trillion lines 0:24:23.640 --> 0:24:27.800 of code and a billion vulnerabilities. Finding a billion vulnerabilities 0:24:27.800 --> 0:24:29.879 within a trillion lines of code. That is such a 0:24:29.880 --> 0:24:32.040 monumental test. Most experts are saying like, yeah, I can't 0:24:32.040 --> 0:24:34.160 even wrap my head around hold on, am I doing 0:24:34.200 --> 0:24:36.720 the math right? That that that would be one vulnerability for 0:24:36.760 --> 0:24:41.800 every thousand lines of code? Yeah. Yeah. So then you 0:24:41.840 --> 0:24:43.800 sit there and you think about it, like if you 0:24:43.880 --> 0:24:47.600 let's say that you've got a job requests saying, yeah, 0:24:47.680 --> 0:24:50.919 so turns out there's a billion vulnerabilities out there. I'm 0:24:50.920 --> 0:24:52.439 gonna need you to clear those up before the end 0:24:52.480 --> 0:24:55.120 of the year. She was just like, I'm going into 0:24:55.160 --> 0:24:58.880 a new line of work and you can't do it. Yes, 0:24:58.960 --> 0:25:02.800 I'm leaving this up and also possibly my sanity goodbye. Um. 0:25:03.000 --> 0:25:07.320 And these these vulnerabilities do shake out into actual issues. 0:25:07.600 --> 0:25:11.240 I read a report where a security firm called Jamalto 0:25:11.359 --> 0:25:16.520 said that approximately a billion records personal records were compromised 0:25:16.760 --> 0:25:22.040 worldwide alone, so one in like one in seven points something. Yeah, 0:25:22.520 --> 0:25:24.679 so you've got well, I mean assuming that that that 0:25:24.720 --> 0:25:28.239 a human person only creates one record per year, and 0:25:28.280 --> 0:25:30.040 I think it's more than that. But but yeah, but 0:25:30.080 --> 0:25:31.720 at any rate, like like like a billion is a 0:25:31.800 --> 0:25:34.480 nice round number, Like it's large, it's not small, it's 0:25:34.520 --> 0:25:38.399 it's impossible for me to even you know, have a 0:25:38.480 --> 0:25:41.200 concept of how much that is. And when you think, 0:25:41.680 --> 0:25:44.960 like we said about how they this this code is 0:25:45.000 --> 0:25:49.080 integrated not just in software but in hardware across all 0:25:49.200 --> 0:25:53.800 sorts of different devices and infrastructures, you realize this is 0:25:53.960 --> 0:25:59.160 legitimately a problem. It is. It is really a threat, right, 0:25:59.240 --> 0:26:01.480 It's not it's not just it's not just something like 0:26:01.480 --> 0:26:04.000 oh that's inconvenient. It's not like, oh man, my cellphone's 0:26:04.040 --> 0:26:06.679 gonna get hacked. It's like, oh man, are a hydro 0:26:06.760 --> 0:26:09.800 power plant is going to get hacked? The US Director 0:26:09.840 --> 0:26:14.600 of National Intelligence one James Clapper in listed cyber attacks 0:26:14.680 --> 0:26:19.840 as the most serious global threat, above terrorism, above weapons 0:26:19.840 --> 0:26:26.400 of mass destruction, above sid ducks. I don't know, yeah, Godzilla, yeah, 0:26:26.560 --> 0:26:29.760 more so than that not saying something so yeah, you've 0:26:29.760 --> 0:26:32.680 got you've got the perfect situation for disaster here, right, 0:26:32.680 --> 0:26:37.720 You've got a target rich environment, and cybersecurity experts might 0:26:37.800 --> 0:26:41.080 know to to really seek out the stuff that's going 0:26:41.119 --> 0:26:44.119 to have wide propagation first, because obviously, if you're a hacker, 0:26:44.160 --> 0:26:46.160 you want to try and hit as many targets as 0:26:46.160 --> 0:26:49.520 you possibly can. So from a cybersecurity point of view, 0:26:49.560 --> 0:26:51.959 you'd say, let's make sure we cover the stuff that's 0:26:52.000 --> 0:26:56.159 going to get the widest circulation first and then worry 0:26:56.200 --> 0:26:58.920 about the smaller programs kind of like you know, think 0:26:58.960 --> 0:27:00.879 of it like concentric raicles. We want to get on 0:27:00.960 --> 0:27:03.760 that middle of that target first, so like operating system 0:27:03.840 --> 0:27:07.800 updates or major product upgrades, that kind of stuff, stuff 0:27:07.840 --> 0:27:10.320 that lots and lots and lots of people are going 0:27:10.359 --> 0:27:13.760 to get. But that also means the hackers can say, well, 0:27:14.359 --> 0:27:16.639 I won't hit as many people if I aim for 0:27:16.680 --> 0:27:22.399 these other more niche oriented software packages, but I'm also 0:27:22.520 --> 0:27:25.960 less likely to encounter resistance. I'm more likely to find 0:27:25.960 --> 0:27:29.600 a vulnerability that people haven't identified yet, and therefore will 0:27:29.640 --> 0:27:32.479 be able to hit a greater percentage of that niche 0:27:33.000 --> 0:27:35.959 than I would if I aimed for operators who's really 0:27:36.119 --> 0:27:39.480 shoring up the defenses of this organ trail clone that 0:27:39.560 --> 0:27:42.440 I downloaded right, which, by the way, is a great game, 0:27:44.200 --> 0:27:45.800 But I mean I I do want to put in 0:27:45.800 --> 0:27:48.800 here that there are certainly uh hackers for good, like 0:27:48.800 --> 0:27:52.439 white hat hackers cybersecurity type experts that we've been talking about, 0:27:52.600 --> 0:27:57.159 who are actively working every day to to plug up 0:27:57.240 --> 0:28:00.080 these kind of vulnerabilities. UM you know, not looking to 0:28:00.080 --> 0:28:02.760 cause harm or mischief, but to seek these things out 0:28:02.880 --> 0:28:06.440 and to change them. Their conventions around the world where 0:28:06.440 --> 0:28:09.880 where where hackers and other interested parties gathered to strategize 0:28:09.920 --> 0:28:13.119 and to learn and to present research and to disclose 0:28:13.240 --> 0:28:17.760 security problems that they've found. Um, you know, either providing 0:28:17.800 --> 0:28:21.000 outright or selling the information to the parties at hand 0:28:21.080 --> 0:28:24.480 that that would be able to enact changes. Um. One 0:28:24.480 --> 0:28:27.119 of those black hat is actually happening this very weekend, 0:28:27.240 --> 0:28:30.760 July August four in Las Vegas. Right. The other big 0:28:30.800 --> 0:28:32.960 one I hear about all the time is def con right, 0:28:33.520 --> 0:28:36.800 that also happens in Las Vegas. I urge you that 0:28:36.880 --> 0:28:39.280 if you ever decide to attend one of these conventions, 0:28:39.640 --> 0:28:42.640 bring a burner phone and leave your normal one at home. Yeah, 0:28:43.200 --> 0:28:48.080 I'm being totally serious, that's I I agree. These hacker 0:28:48.120 --> 0:28:50.400 thons often have a wall of shame, and if you 0:28:50.480 --> 0:28:55.000 have not secured your technology properly, they will put your 0:28:55.080 --> 0:28:57.880 name up there because they will have found how to 0:28:57.960 --> 0:29:02.240 access your stuff and say, look, uh, this is serious. 0:29:02.360 --> 0:29:04.840 You need to be aware of this. Yeah, I'm not 0:29:06.040 --> 0:29:09.880 These these quote unquote white hat white hat hackers certainly 0:29:09.920 --> 0:29:13.240 are not outside of the realm of the mischief type 0:29:13.280 --> 0:29:15.760 of concept. I mean, but it's not's mischief for good 0:29:15.840 --> 0:29:19.560 and yes, exactly to be fair, one of the issues 0:29:19.640 --> 0:29:23.000 that hackers who are doing this work run into is 0:29:23.120 --> 0:29:26.400 a lack of cooperation on the side of the companies 0:29:26.440 --> 0:29:29.440 that are producing the software. Right, and that's starting to change, 0:29:29.480 --> 0:29:31.360 I think, um, I think that a lot of companies 0:29:31.400 --> 0:29:35.040 have come into the realization that it is less expensive 0:29:35.200 --> 0:29:39.400 to hire this kind of security expert than it is 0:29:39.480 --> 0:29:43.920 to allow someone to create a vulnerability in the programming. Um. 0:29:43.960 --> 0:29:46.200 But and and and and many many companies do these 0:29:46.240 --> 0:29:49.160 days have hackers on their team looking for these kind 0:29:49.160 --> 0:29:52.320 of vulnerabilities. And there's been tons of successful projects to 0:29:52.360 --> 0:29:55.440 come out of freelancers and contractors and full time hackers, 0:29:55.920 --> 0:29:59.040 you know, work bolstering everything from from the security of 0:29:59.160 --> 0:30:03.360 hospital patients records and pacemakers and insulin pumps. Insulin pumps 0:30:03.400 --> 0:30:07.000 have computers in them. Now that's terrifying, um and wonderful. 0:30:07.160 --> 0:30:09.720 But but but to to making a t M S 0:30:09.800 --> 0:30:14.720 and net network routers more secure, to making prison and 0:30:14.840 --> 0:30:21.240 office doors unhackable important stuffs for work right, right, all 0:30:21.280 --> 0:30:24.040 of these things. Um, so you know it's not that 0:30:24.280 --> 0:30:26.600 it's not that humans are totally falling down on the job. 0:30:26.640 --> 0:30:29.320 It's just that we are only humans, right, which is 0:30:29.360 --> 0:30:32.000 why we need the machines to take over. Right, Yes, 0:30:32.080 --> 0:30:33.440 because the idea of being that you know, if you 0:30:33.440 --> 0:30:35.840 have a computer program, stop us out. Exactly. If you 0:30:35.840 --> 0:30:41.040 have a computer program that's properly orchestrated, properly designed and 0:30:41.160 --> 0:30:44.880 coded so that it can look for vulnerabilities and patch 0:30:44.960 --> 0:30:48.520 them autonomously, then it's going to be able to work 0:30:48.640 --> 0:30:52.000 much faster, more efficiently than any human could. It never 0:30:52.040 --> 0:30:57.280 gets tired, it's never going to miss vulnerability because it's 0:30:57.320 --> 0:31:00.080 been staring at this code for like six hours and 0:31:00.120 --> 0:31:02.560 it just you know, you get that blindness six hours 0:31:02.840 --> 0:31:05.880 was Yeah, well, most of my programmer friends are like, 0:31:05.920 --> 0:31:08.360 you know, fourteen hours in with like seventeen cups of 0:31:08.360 --> 0:31:13.040 coffee and sure increasing twitch and exciting eye twitch. Yeah. That. 0:31:13.280 --> 0:31:16.000 The issue there, of course, is that you're more likely 0:31:16.240 --> 0:31:19.000 to miss something, yeah, you know, but a computer program 0:31:19.040 --> 0:31:23.800 doesn't because it just keeps on trucking. No. Obviously, the 0:31:24.640 --> 0:31:27.040 dependability on the program is only as good as the 0:31:27.080 --> 0:31:30.920 developers are, right, but ideally they would catch problems before 0:31:30.960 --> 0:31:33.160 bad guys could ever identify there was a problem there 0:31:33.200 --> 0:31:35.840 in the first place, and everything gets patched, maybe even 0:31:35.920 --> 0:31:39.040 before the release of the software, so that there's never 0:31:39.160 --> 0:31:42.600 the opportunity for a hacker to take advantage and exploit 0:31:42.600 --> 0:31:47.320 of vulnerability. So this all leads up to this Cybergrand Challenge, 0:31:47.320 --> 0:31:51.840 which is happening August fourth, and that's where we get 0:31:51.880 --> 0:31:55.160 this automated Capture the Flag tournament. This is also in 0:31:55.200 --> 0:31:57.400 Las Vegas, kind of on the tail end of of 0:31:57.480 --> 0:31:59.960 black Hat. I'm not sure if it's officially I doubt 0:32:00.080 --> 0:32:03.160 it's officially affiliated, right, Yeah. I love the idea of 0:32:03.240 --> 0:32:09.320 DARPA showing up to black Hat soap UM and everyone's like, hey, buddy, 0:32:09.560 --> 0:32:14.440 hacked your system last week. Looking good. So so this 0:32:14.920 --> 0:32:18.360 is this is actually the final round of competition. It's 0:32:18.360 --> 0:32:20.480 a competition that's been going on for a while now. 0:32:20.720 --> 0:32:23.400 It's not something that is you know, they had made 0:32:23.400 --> 0:32:25.920 it just for this one day UM and in fact, 0:32:25.920 --> 0:32:28.880 in earlier rounds of competition, which began back in ten, 0:32:29.200 --> 0:32:31.720 there were more than thirty teams that registered for this 0:32:32.400 --> 0:32:36.240 UM and they could register as either an open track 0:32:36.360 --> 0:32:41.720 competitor which covered self funded teams, or a proposal track competitor. 0:32:41.960 --> 0:32:44.760 Which were teams that were invited to participate by DARPA 0:32:44.840 --> 0:32:47.560 itself and partially supported by the agency to develop the 0:32:47.600 --> 0:32:51.320 tech necessary to compete. This is not unusual. The same 0:32:51.360 --> 0:32:54.880 thing happened in their driverless car challenges, where they had 0:32:54.920 --> 0:32:58.280 teams that were specifically invited to participate versus those that 0:32:59.120 --> 0:33:02.520 volunt that that essentially stepped forward to enter the competition. 0:33:03.360 --> 0:33:06.040 So so there were more than thirty back in two 0:33:06.080 --> 0:33:09.800 thousand and fourteen, we're down to seven finalists. Now. Each 0:33:09.960 --> 0:33:15.880 finalist team received an award of seven fifty thousand dollars 0:33:15.960 --> 0:33:20.960 to prepare for the Grand Challenge after completing these preliminary rounds. 0:33:21.040 --> 0:33:24.920 So here are the seven finalists in the Cybergrand Challenge. 0:33:25.800 --> 0:33:30.400 There are some researchers from Moscow, Idaho, which I did 0:33:30.400 --> 0:33:33.960 not know was a place UH with the Center for 0:33:34.040 --> 0:33:37.800 Secure and Dependable Systems or CSDS. Now, this was a 0:33:37.840 --> 0:33:40.800 group that formed out of the with the Idaho State 0:33:40.840 --> 0:33:44.480 Board of Education called for this group to come into 0:33:44.560 --> 0:33:48.080 being UH specifically at the University of Idaho to advance 0:33:48.120 --> 0:33:53.280 computer security education and research. According to their their profile 0:33:53.400 --> 0:33:57.640 on DARPA, they represent the only system that was entirely 0:33:57.640 --> 0:34:01.720 built from scratch. Every other stom that is in the 0:34:01.920 --> 0:34:06.800 finals had existed in some previous form before these these 0:34:06.800 --> 0:34:11.320 preliminary tests began. Next, you have Deep Red, which is 0:34:11.360 --> 0:34:14.560 a team from Raytheon. They took their name by combining 0:34:14.600 --> 0:34:17.440 Deep Blue, which was IBM system that took on Grand 0:34:17.480 --> 0:34:21.600 Masters and chess, and the color of Raytheon's logo, which 0:34:21.640 --> 0:34:26.759 is red Deep read. So this is not the the 0:34:26.840 --> 0:34:32.120 Dario Argento movie. No. Now. Next you have Dissect, which 0:34:32.160 --> 0:34:34.480 is spelled d I S e k T. And they 0:34:34.640 --> 0:34:39.280 hailed from Athens, Georgia, so I went to college in Athens, Georgia. 0:34:39.960 --> 0:34:41.960 They are the one team in the challenge that has 0:34:42.000 --> 0:34:45.960 managed to post scores in five other CTF events hosted 0:34:45.960 --> 0:34:49.919 by various other universities and and organizations. So they've they've 0:34:49.920 --> 0:34:55.200 got a record, yeah, of doing well in other competitions. Next, 0:34:55.280 --> 0:34:58.640 you've got four All Secure. That's all one word. They're 0:34:58.680 --> 0:35:01.640 out of Pittsburgh pencil Mania. That team started with researchers 0:35:01.680 --> 0:35:09.360 who worked with Carnegie Mellon University. You have Shellfish with Fish. Yeah, 0:35:10.280 --> 0:35:13.239 they're out of Santa Barbara, California. That group grew out 0:35:13.280 --> 0:35:16.160 of a hacking team at the University of California, Santa Barbara, 0:35:16.239 --> 0:35:20.120 and it includes, according to their profile, the youngest program 0:35:20.120 --> 0:35:23.920 analyst expert in the competition. I love like the little 0:35:23.960 --> 0:35:26.279 facts that you get under each team as you go 0:35:26.400 --> 0:35:29.920 through them. Uh. Next you have tech X, which is 0:35:29.960 --> 0:35:33.600 based out of Ithaca, New York, and Charlottesville, Virginia. Team 0:35:33.600 --> 0:35:37.920 members come from Gramma Tech Incorporated and the University of Virginia. 0:35:38.160 --> 0:35:41.480 They developed a program they call pea soup, which is 0:35:41.520 --> 0:35:45.080 an acronym that stands for preventing exploits of software of 0:35:45.200 --> 0:35:49.000 uncertain provenance. I don't know do I love or do 0:35:49.080 --> 0:35:53.000 I hate those contrived acronyms. You might want to ask 0:35:53.040 --> 0:35:55.279 where they answer that question show? You might want to 0:35:55.320 --> 0:35:57.960 ask where they deep inside yourself, where does the A 0:35:58.160 --> 0:36:04.840 and P soup come from? In that preventing exploits of what? Yeah, 0:36:05.200 --> 0:36:07.520 where's the A come from? One wonders from that, I 0:36:07.560 --> 0:36:13.000 should be peck soup or soup. Uh. Then you have 0:36:13.520 --> 0:36:18.120 I love this name to co Jitsu, which is a 0:36:18.160 --> 0:36:21.680 team that is based in uh, well, the three different places. Actually, 0:36:21.719 --> 0:36:25.719 they have researchers who are in Berkeley, California, Lausane, Switzerland, 0:36:25.840 --> 0:36:30.160 and Syracuse, New York. So it's a collaboration of scientists 0:36:30.200 --> 0:36:34.920 from Berkeley, cyber Haven, and Syracuse, and they're all competing 0:36:35.200 --> 0:36:40.080 for prizes that that collectively amount to just under four 0:36:40.160 --> 0:36:44.959 million dollars um. And so there's some there's some big 0:36:45.000 --> 0:36:48.120 money and obviously some great bragging rights if you're the 0:36:48.840 --> 0:36:52.359 group that creates the automated system that wins. I mean, 0:36:52.440 --> 0:36:56.359 that's that's some nice accolades to have. Sure. I mean 0:36:56.360 --> 0:36:58.960 also see above re being able to sell it to 0:36:59.120 --> 0:37:03.319 a company done that rent it out at any rate. Right, 0:37:03.400 --> 0:37:06.279 But they, you know they Dark was very quick to 0:37:06.320 --> 0:37:12.080 mention that this competition is really more about identifying the 0:37:12.080 --> 0:37:16.239 most effective approaches. It's not necessarily we have identified the 0:37:16.440 --> 0:37:20.480 working strategy. This, this one product here is clearly the 0:37:20.480 --> 0:37:22.960 way we're gonna go everyone else. Thank you for showing up. 0:37:23.440 --> 0:37:26.960 It's not Willy Wonka, right, you know, it's not everyone 0:37:26.960 --> 0:37:30.720 else has to go home. It's rather saying the elements 0:37:30.760 --> 0:37:33.960 that you had in your approach, these these particular ones 0:37:34.000 --> 0:37:36.920 we've identified, were really effective, but this other team had 0:37:36.960 --> 0:37:39.839 these that were very effective in a different way. How 0:37:39.880 --> 0:37:42.280 can we start to look at the things that worked 0:37:42.280 --> 0:37:45.239 best and create best practices. So they're going to create 0:37:45.280 --> 0:37:50.760 a Frankenstein cyber security robot. Well it's really too maybe 0:37:50.960 --> 0:37:54.719 who knows, but really, I mean, it's about about identifying 0:37:54.840 --> 0:37:58.600 what strategies work the best in order to move forward 0:37:58.600 --> 0:38:03.359 with the next step. Um. So you might wonder, all right, well, 0:38:03.360 --> 0:38:06.759 how is this all gonna play out based upon that? Well, 0:38:06.800 --> 0:38:10.120 you know, it hasn't happened yet. Uh. And while we're 0:38:10.120 --> 0:38:14.080 all about talking about the future and speculating, we are 0:38:14.160 --> 0:38:19.399 incapable of telling you who won yet I can't. After 0:38:19.440 --> 0:38:21.520 it happens, we can do it, but right now, not 0:38:21.640 --> 0:38:24.840 so much. Um. It may turn out that none of 0:38:24.840 --> 0:38:28.840 those programs perform better than human experts they'll be pitted against. 0:38:29.440 --> 0:38:33.520 That is a possibility that certainly wouldn't surprise me today, 0:38:32.719 --> 0:38:36.239 right Uh. And it may still be that even if 0:38:36.280 --> 0:38:40.000 that happens, we're able to at least identify the reasons 0:38:40.040 --> 0:38:43.719 why programs didn't measure up to humans or things that 0:38:44.040 --> 0:38:46.399 got close but didn't quite get there. Well, I mean, 0:38:47.160 --> 0:38:50.720 one thing that strikes me is maybe maybe they've found 0:38:50.719 --> 0:38:54.200 a way to uh to circumvent this problem. But it 0:38:54.239 --> 0:38:58.799 seems like you couldn't really combine the advantages of an 0:38:58.840 --> 0:39:02.000 automated system. For is the advantages of a human operator 0:39:02.200 --> 0:39:06.879 in a competition setting, because in a competition setting, there's 0:39:06.920 --> 0:39:10.200 a limited scope of problem solving area, if you know 0:39:10.239 --> 0:39:14.320 what I mean. So there's like a limited problem solving space, 0:39:15.000 --> 0:39:18.120 and what the automated system would seem to have at 0:39:18.160 --> 0:39:22.200 its advantage is sort of just limitless time and and 0:39:22.480 --> 0:39:27.080 speed to search the problems space for problems to identify 0:39:27.400 --> 0:39:32.600 and and like like multiprocessing multiprocessor tracks to accomplish that 0:39:32.800 --> 0:39:37.080 on multiple systems, in multiple programs at the same time. Um, 0:39:37.120 --> 0:39:39.799 but but I'm sure that you can. I mean, the 0:39:39.840 --> 0:39:42.000 hard evidence that you're going to get here is like 0:39:42.120 --> 0:39:46.720 if if a computer program can crack all the vulnerabilities 0:39:46.719 --> 0:39:49.319 and patch them in a fifth of the time that 0:39:49.360 --> 0:39:52.080 a human does it, or vice versa, then then you've 0:39:52.080 --> 0:39:54.680 got a pretty solid idea of of how fast each 0:39:54.680 --> 0:39:57.640 system is working. And and over time that kind of 0:39:57.640 --> 0:40:01.799 time difference will will be affected by how much it 0:40:01.840 --> 0:40:04.480 can get done well. And also we need to remember 0:40:05.239 --> 0:40:09.880 Darba challenges sometimes teach us a lot. Even when everyone fails, 0:40:10.840 --> 0:40:13.800 all the competitors fail, that was the case, this failure 0:40:14.000 --> 0:40:16.200 won't be nearly as funny as watching those robots trying 0:40:16.200 --> 0:40:18.920 to open that door. Yeah, right, well, I was mostly 0:40:18.920 --> 0:40:22.520 thinking of the driverless Car Challenge. That's that's funny too. Well, 0:40:22.520 --> 0:40:24.600 the Driverless Car Challenge. The first time they held that 0:40:24.640 --> 0:40:27.120 back in two thousand four, they didn't award a winner, 0:40:27.560 --> 0:40:33.000 no one. No one team was able to complete the objectives. Uh, 0:40:33.160 --> 0:40:36.680 in the time allotted. Most of them had pretty remarkable 0:40:36.719 --> 0:40:40.280 failures where the vehicle at some point got off track 0:40:40.520 --> 0:40:43.680 or failed to respond anymore, or just you know whatever 0:40:43.760 --> 0:40:45.840 for whatever reason it was, was not able to complete 0:40:45.880 --> 0:40:49.719 the course. But they decided to go ahead and hold 0:40:49.719 --> 0:40:53.040 the challenge again the following year, which gave the team's 0:40:53.120 --> 0:40:57.520 chances to go back and reevaluate their work, make changes 0:40:57.520 --> 0:41:00.560 and improvements so that they were better able to compete 0:41:00.600 --> 0:41:02.919 the following year. And that's when things started to really 0:41:03.400 --> 0:41:07.840 move forward literally in that case. And uh, when you 0:41:07.880 --> 0:41:11.080 look at it that way, you could say, well, if 0:41:11.080 --> 0:41:13.760 they had just in two thousand and four said well 0:41:13.960 --> 0:41:16.719 this this isn't gonna work, We're walking away from this, 0:41:17.120 --> 0:41:20.400 then we wouldn't be on the cusp of the autonomous 0:41:20.400 --> 0:41:23.520 car revolution, which we appear to be right now. Right 0:41:23.680 --> 0:41:26.160 they could very we have companies right now talking about 0:41:26.200 --> 0:41:28.879 it will be a matter of years, not a lot 0:41:28.920 --> 0:41:31.919 of them, a few years, and then we'll start seeing 0:41:31.920 --> 0:41:35.680 autonomous cars in earnest start to hit the roads beyond 0:41:35.840 --> 0:41:38.480 just the limited use we're seeing, where it might be 0:41:38.520 --> 0:41:42.759 like an office park automated bus, or something that navigates 0:41:42.800 --> 0:41:47.960 through like a relatively closed system like an airport, that 0:41:48.040 --> 0:41:51.759 kind of thing like around an airport at various terminals. Um. 0:41:51.920 --> 0:41:54.960 So it may be the same with this Grand Cyber Challenge, 0:41:54.960 --> 0:41:58.200 where that first year of competition we don't see a 0:41:58.560 --> 0:42:02.200 clear winner, but that doesn't necessarily mean this is the 0:42:02.440 --> 0:42:06.319 end of the line um. Although it's also possible that 0:42:06.320 --> 0:42:08.600 one of the automated systems will just totally smoke all 0:42:08.640 --> 0:42:12.320 the other competitors, both computer and human, the most likely 0:42:12.400 --> 0:42:15.480 outcome will be that through this challenge, will learn which 0:42:15.560 --> 0:42:17.960 of these techniques are the most promising and which one 0:42:18.000 --> 0:42:21.640 seemed to be less effective, and thus people can direct 0:42:21.719 --> 0:42:25.480 their attention to to the avenues that appear to be 0:42:25.680 --> 0:42:30.560 best best chance of success, with the goal ultimately of 0:42:30.600 --> 0:42:33.279 creating these automated systems that could be rolled out on 0:42:33.960 --> 0:42:38.480 rather large scale too. You know, check for probe for 0:42:38.560 --> 0:42:44.920 vulnerabilities in software across multiple platforms in some cases before 0:42:45.200 --> 0:42:48.160 they can actually be encoded into hardware. I mean anything 0:42:48.239 --> 0:42:51.920 that's been encoded into hardware that's tough. Like you, you 0:42:51.920 --> 0:42:54.720 can do firmware updates, but that's really a software layer. 0:42:54.800 --> 0:42:57.440 It's not like you're physically changing the chip that's already 0:42:57.480 --> 0:43:00.200 been produced. You're you're just you're trying to compensate for 0:43:00.200 --> 0:43:03.640 a vulnerability that's been hard coded into a device. That's 0:43:03.640 --> 0:43:07.520 a little trickier, but um, moving forward, you could at 0:43:07.600 --> 0:43:11.799 least mitigate that somewhat and limit the number of vulnerabilities 0:43:11.800 --> 0:43:16.000 that get put into hardware. So the biggest outcome of 0:43:16.040 --> 0:43:18.560 this would be that we'd have a safer approach to 0:43:18.600 --> 0:43:21.840 this wondrous future we've talked about, this Internet of things 0:43:21.920 --> 0:43:26.560 future where reality is responding to our wishes and desires 0:43:26.600 --> 0:43:29.839 before we can even voice them, and refrigerators can eat us. 0:43:31.160 --> 0:43:33.920 I don't want to see that happen, Joe. But I 0:43:33.960 --> 0:43:36.759 also don't want to see a future in which this 0:43:36.840 --> 0:43:42.680 wondrous world I'm walking around in is also uh enabling 0:43:42.719 --> 0:43:46.600 a hacker to track my every movement, or get tons 0:43:46.640 --> 0:43:50.960 of personal information about me, or exploit me in some 0:43:51.040 --> 0:43:53.760 other way that I may or may not be aware 0:43:53.800 --> 0:43:56.680 of or you know. Yeah, it's a concept where we 0:43:56.719 --> 0:44:00.439 want to make the world better with this, not scarier. Yeah, 0:44:00.640 --> 0:44:02.520 you don't want to open the door and have a 0:44:02.520 --> 0:44:05.040 guy sitting there like. So here's the thing. I've been 0:44:05.080 --> 0:44:07.680 tracking your every movement for the last two years, and 0:44:07.800 --> 0:44:12.280 unless you pay me this exorbitant amount of money, everyone's 0:44:12.280 --> 0:44:15.040 gonna know about how often you go to Taco Bell. 0:44:15.160 --> 0:44:20.160 You're terrible, terrible puppy kicking excursions throughout the neighborhood when 0:44:20.200 --> 0:44:24.719 you think everyone's asleep or whatever it may be. Uh, 0:44:25.160 --> 0:44:27.600 the taco bell thing, while it does strike deep into 0:44:27.640 --> 0:44:30.120 my heart, I think I could. I could reconcile myself 0:44:30.160 --> 0:44:35.360 with over time, Over time and a couple of taco locos, 0:44:36.000 --> 0:44:38.439 I could probably do it. But yeah, it's oh my god, 0:44:38.480 --> 0:44:41.040 are those the ones that are in Derrito's. Yes, that's 0:44:41.040 --> 0:44:45.239 the thing, right, Yeah, a taco that's inside Derrito's. The 0:44:45.280 --> 0:44:48.800 shell itself is made out of essentially derrito chip. Yeah, 0:44:49.080 --> 0:44:51.759 and and then you've got um like melted cheese on 0:44:51.800 --> 0:44:53.719 top of it. It looks pretty insane. I have never 0:44:53.760 --> 0:44:55.839 actually tried one of these things, and I just happen 0:44:55.920 --> 0:44:59.200 to know what the name is um. But yeah, if 0:44:59.200 --> 0:45:02.120 we want this another future, we want it to be 0:45:02.239 --> 0:45:06.520 a safe one. And obviously, again, if we're talking about 0:45:06.640 --> 0:45:10.520 trillions of lines of code, expecting it to be a 0:45:10.560 --> 0:45:15.239 safe future without the use of computer assistance seems to 0:45:15.320 --> 0:45:20.879 be implausible at the at best. You know, one potentially 0:45:20.960 --> 0:45:25.640 frightening implication of this whole scenario. It's not of what 0:45:25.640 --> 0:45:28.600 what DARB is doing with this competition, necessarily, but just 0:45:28.680 --> 0:45:31.000 the fact that we're in a position to be having 0:45:31.040 --> 0:45:36.040 this kind of competition is that we could as humans 0:45:36.560 --> 0:45:40.000 lose sight of what's happening in the sort of back 0:45:40.040 --> 0:45:46.200 and forth between people who want to compromise our information 0:45:46.239 --> 0:45:50.400 security and and take over our devices and the measures 0:45:50.400 --> 0:45:53.160 that are put in place to protect them. It's kind 0:45:53.200 --> 0:45:57.120 of like that frightening scenario and automated trading, where you 0:45:57.200 --> 0:46:00.719 have computers making lightning fast buy and sell decisions on 0:46:00.760 --> 0:46:03.920 the stock market or commodities markets, and even the people 0:46:03.920 --> 0:46:07.640 who design these systems don't understand what they're doing in 0:46:07.719 --> 0:46:11.920 real time, right writer, or you know, small small glitches 0:46:12.040 --> 0:46:14.839 like like that time that like I don't know, like 0:46:14.840 --> 0:46:18.440 like something on Twitter made the stock market waiver for 0:46:18.480 --> 0:46:21.279 a moment and everyone was like like like taking their 0:46:21.280 --> 0:46:26.000 hands slowly off of the computer wheel. It is terrifying 0:46:26.000 --> 0:46:28.279 when you get to a system that's so sophisticated that 0:46:28.320 --> 0:46:31.440 even the people who design the system cannot be fully 0:46:31.680 --> 0:46:35.719 certain what caused it to make a specific decision at 0:46:35.719 --> 0:46:38.759 a specific time. Right, And so I think that there 0:46:38.960 --> 0:46:43.239 is generally we might want to be concerned about allowing 0:46:44.120 --> 0:46:47.239 a state of affairs where humans just sort of get 0:46:47.239 --> 0:46:51.040 cut out of the loop of understanding the software that 0:46:51.120 --> 0:46:54.080 governs our day to day lives. Like, so you imagine 0:46:54.120 --> 0:46:59.800 this this future scenario, hackers have massively powerful automated vulnerability 0:47:00.000 --> 0:47:04.640 aching software that tests all networked systems that can find 0:47:04.719 --> 0:47:07.319 for weak points. You know, it's essentially like living in 0:47:07.719 --> 0:47:10.839 a world where people could insert lockpick guns into ten 0:47:10.920 --> 0:47:14.919 thousand different houses front doors every eight seconds to see 0:47:14.960 --> 0:47:16.839 what could be picked. So this is kind of like 0:47:16.880 --> 0:47:21.520 the black hat version of the software we were just talking, right, 0:47:21.560 --> 0:47:25.640 But I'm getting there. So if you have that, there'd 0:47:25.640 --> 0:47:28.000 be no way for human security agents to keep up. 0:47:28.040 --> 0:47:31.160 So you need this kind of automated vulnerability seeking and 0:47:31.239 --> 0:47:35.400 containment software, right, But imagine so you've got these two 0:47:35.440 --> 0:47:39.440 systems working in tandem. Both automated sort of in a 0:47:39.680 --> 0:47:43.920 in an automated security arms race back and forth. Um, 0:47:44.080 --> 0:47:48.080 will humans lose track of what their own software does 0:47:48.320 --> 0:47:53.120 and how? I don't suspect so, because humans are still 0:47:53.120 --> 0:47:56.920 the ones creating the software with a specific purpose in mind. 0:47:56.960 --> 0:48:01.200 And what we're looking at is the matching or exploiting 0:48:01.200 --> 0:48:05.360 of vulnerabilities within that software, not fundamentally changing how that 0:48:05.440 --> 0:48:09.040 software behaves or what it is supposed to do. But Jonathan, 0:48:09.080 --> 0:48:12.040 what if what if that software decides that the real 0:48:12.160 --> 0:48:15.920 vulnerability in the system is us? It's a little different. 0:48:15.960 --> 0:48:18.000 But I like where you're going. Yeah, no, no, no, 0:48:18.160 --> 0:48:20.560 I mean, I don't mean that, but I do. I know, 0:48:21.440 --> 0:48:25.240 I know, you know, but I do mean. Like, Okay, 0:48:25.280 --> 0:48:30.000 so let's say a computer this program detective vulnerability and 0:48:30.000 --> 0:48:32.719 then patches it. But as we all know, sometimes maybe 0:48:32.719 --> 0:48:36.000 a security patch can destabilize the system in another way. 0:48:36.640 --> 0:48:39.360 You've just caused a new problem that needs to be addressed. 0:48:39.840 --> 0:48:42.400 And so what if they say, ah, you know, every 0:48:42.440 --> 0:48:45.800 time it patches something, it's not sophisticated enough that it 0:48:45.840 --> 0:48:48.640 can do that without compromising something else in the system. 0:48:48.680 --> 0:48:51.560 So we've got to we've got to let it fix 0:48:51.640 --> 0:48:54.600 the compromised part also, so it's got a patch security 0:48:54.680 --> 0:48:58.480 and it's got to fix the destabilized system, and then 0:48:58.920 --> 0:49:02.040 that caused another problem. Bloom. I I can imagine scenarios 0:49:02.040 --> 0:49:07.839 where they're cascading effects requiring us to create self modifying software, 0:49:08.520 --> 0:49:11.799 and I don't know. Self modifying software always makes me 0:49:11.840 --> 0:49:15.160 feel icky. Well, the problem is we need it now anyway. 0:49:15.320 --> 0:49:18.720 We have so many, so many lines of code that 0:49:18.960 --> 0:49:22.080 there's a need. Like if what's the other option. We 0:49:22.200 --> 0:49:27.719 don't develop the automated software we train about another billion 0:49:27.960 --> 0:49:34.160 people in cybersecurity. It's well, or we don't have an 0:49:34.200 --> 0:49:37.239 Internet of things, I guess, is an option which is 0:49:37.280 --> 0:49:43.240 not That's not happening unless there's just a catastrophic change 0:49:43.280 --> 0:49:46.520 in our technology, you know, one of those sun spots 0:49:46.600 --> 0:49:51.480 or solar right layers, barring some enormous electromagnetic pulse device 0:49:51.560 --> 0:49:54.520 that goes over an entire or large enough section of 0:49:54.520 --> 0:49:59.480 the world, or a scenario where our priorities shift to guzzoline, right, 0:50:00.239 --> 0:50:03.319 I think, I think that's I mean, we we've kind 0:50:03.320 --> 0:50:06.160 of committed, right, We're kind of committed to a pathway 0:50:06.160 --> 0:50:09.760 which requires us to do this, and so it's almost 0:50:09.760 --> 0:50:12.759 a moot question at this point of should we do 0:50:12.840 --> 0:50:15.799 this now, it's we have to do this, or we 0:50:15.840 --> 0:50:17.560 have to at least attempt to do this to see 0:50:17.560 --> 0:50:21.279 if it will work, because we've created a problem that 0:50:21.400 --> 0:50:25.680 isn't going away on its own unless we make a 0:50:26.840 --> 0:50:30.719 fundamental change in the way we are moving forward, which 0:50:30.760 --> 0:50:36.560 doesn't seem likely, uh, at least not within the foreseeable future. 0:50:36.640 --> 0:50:41.560 It would amaze me to see a real move to 0:50:41.600 --> 0:50:45.680 put the brakes on the Internet of Things. Yeah, I mean, so, 0:50:47.120 --> 0:50:49.800 I understand why you're getting where you're where you're headed. 0:50:50.120 --> 0:50:53.000 But I think, first of all, we already have those problems. 0:50:53.080 --> 0:50:56.799 Right If you detect a software vulnerability and you patch 0:50:56.840 --> 0:50:59.839 it and that destabilizes things, we already have to fix that. 0:51:00.160 --> 0:51:02.120 It's just right now we're the ones who have to 0:51:02.160 --> 0:51:05.680 do it. But yeah, no, no, I I see, I 0:51:05.760 --> 0:51:07.879 certainly see your point, Jonathan, And I think that that's 0:51:07.960 --> 0:51:11.880 that's it's absolutely ludicrous to think that we're just going 0:51:11.920 --> 0:51:16.719 to stop networking all of our increasingly valuable electronics to 0:51:16.880 --> 0:51:20.360 the Internet. Um. But but I but I definitely you know, 0:51:20.520 --> 0:51:25.120 think that caution, or at least a kind of concept 0:51:25.160 --> 0:51:28.239 of science fiction horror be be kept close to our 0:51:28.280 --> 0:51:31.680 hearts and and considered. Uh yeah, I mean, I don't 0:51:31.680 --> 0:51:34.600 really have an alternative to suggest. I understand that I 0:51:34.600 --> 0:51:38.960 think we probably need something like automated cybersecurity, but it 0:51:39.160 --> 0:51:41.920 just I don't know. I just guess thought we should 0:51:41.960 --> 0:51:44.240 be aware of this fact that, you know, there's always 0:51:44.280 --> 0:51:47.560 something a little bit strange about the idea of, in 0:51:47.560 --> 0:51:50.480 any extent, of cutting humans out of the loop of 0:51:51.400 --> 0:51:54.520 architecture of software that runs our lives. I do think 0:51:54.520 --> 0:51:58.640 also that like, and I say this with absolute respect 0:51:58.719 --> 0:52:03.759 and love for for programmers, and specifically specifically cybersecurity programmers. 0:52:03.840 --> 0:52:07.360 Um uh, I don't think we have to worry about 0:52:07.360 --> 0:52:11.600 those nice humans being not paranoid. I think I think 0:52:11.640 --> 0:52:13.400 that they've got that covered, and I think that they 0:52:13.440 --> 0:52:15.959 will take that into consideration when they're doing their work. 0:52:16.440 --> 0:52:18.680 I think it's part of part of the gig. Yeah, 0:52:18.800 --> 0:52:22.040 I agree, I think. Uh. I mean, obviously, any time 0:52:22.080 --> 0:52:27.239 you're talking about developing any sort of technology, particularly automated technology, 0:52:27.719 --> 0:52:32.960 you have to be cognizant of the consequences if stuff 0:52:33.000 --> 0:52:36.440 were to go wrong, trying to anticipate as many of 0:52:36.480 --> 0:52:39.640 those possible outcomes as you possibly can, and to plan 0:52:39.760 --> 0:52:44.279 for them and account for them so that they don't happen. Uh. 0:52:44.400 --> 0:52:46.680 For one thing, it's it's always going to be impossible 0:52:46.719 --> 0:52:51.600 to do that to perfection. Um. And at some point 0:52:51.680 --> 0:52:53.839 you just have to say, well, we just we've got 0:52:53.840 --> 0:52:57.840 to move forward and hope that we have uh accounted 0:52:57.880 --> 0:53:02.239 for all the most risky outcome us um. But yeah, 0:53:02.800 --> 0:53:06.040 it just it becomes a matter of practicality eventually, and 0:53:06.120 --> 0:53:10.799 unless we do reverse gears and back off from this 0:53:10.840 --> 0:53:13.279 approach of Internet of things, which at this point I 0:53:13.280 --> 0:53:15.480 think there's so many companies that have so much money 0:53:15.800 --> 0:53:19.600 in Internet of things that that's unrealistic. Uh, It's it's 0:53:19.640 --> 0:53:22.480 something we have to move forward with. I'm very curious 0:53:22.480 --> 0:53:24.560 to see how this turns out. I really look forward 0:53:24.600 --> 0:53:28.360 to reading up on the competition once it's finished and 0:53:28.440 --> 0:53:31.600 seeing how the various teams did and uh, you know, 0:53:31.800 --> 0:53:34.080 did any did any of the teams or did multiple 0:53:34.160 --> 0:53:39.719 teams uh significantly outperformed the human participants. I can't wait 0:53:39.760 --> 0:53:42.440 to learn more about it. So we'll probably at some 0:53:42.520 --> 0:53:46.320 point do a follow up of some sort um either 0:53:47.000 --> 0:53:49.960 forward thinking video or maybe a future podcast where we 0:53:50.000 --> 0:53:53.600 talk about these concepts and how how did the machines do? 0:53:54.400 --> 0:53:58.759 Did we did we see a market improvement in performance 0:53:58.800 --> 0:54:01.520 over humans or is that something that humans are just 0:54:01.640 --> 0:54:04.480 better at doing than machines are right now, because sometimes 0:54:04.480 --> 0:54:07.040 we run into that stuff. It seems to be fewer 0:54:07.040 --> 0:54:09.640 and far between these days, but it does still happen. 0:54:10.640 --> 0:54:13.200 For instance, we're still better at opening up a door 0:54:13.200 --> 0:54:15.759 and walking through it. All right, Well, that wraps up 0:54:15.800 --> 0:54:18.840 this episode. Yeah, that's I love, I love it is 0:54:18.880 --> 0:54:22.200 to be. It's like the classic Escape from Daleks is 0:54:22.280 --> 0:54:27.239 just run up some stairs until the Yeah, the reboot 0:54:27.560 --> 0:54:30.359 ruined all that, but back in the day, the good 0:54:30.360 --> 0:54:33.560 says stairs would protect you from the Dolleks. All right, So, 0:54:33.680 --> 0:54:36.360 if you guys have any suggestions for future episodes of 0:54:36.480 --> 0:54:39.600 forward Thinking, or you got any questions or comments anything 0:54:39.680 --> 0:54:42.400 like that, you can send us a message, otherwise we 0:54:42.440 --> 0:54:46.000 won't hear you. Our email addresses FW thinking at how 0:54:46.040 --> 0:54:49.320 Stuff Works dot com. If you search Facebook for FW thinking, 0:54:49.320 --> 0:54:50.920 our profile will pop right up. You can leave us 0:54:50.920 --> 0:54:54.239 a message there. We are FW thinking on Twitter. You 0:54:54.239 --> 0:54:57.000 can always tweet us at Twitter. We're happy to hear 0:54:57.040 --> 0:54:59.920 from you, and we will talk to you again really soon. 0:55:00.280 --> 0:55:07.920 H For more on this topic and the future of technology, 0:55:08.200 --> 0:55:21.560 visit forward thinking dot com problem brought to you by 0:55:21.600 --> 0:55:23.640 Toyota Let's Go Places,