Speaker 1: Welcome to Copy Time, a podcast series on Markets and
Speaker 1: Economies from D BS Group Research. I'm Timur, big chief economist,
Speaker 1: welcoming you to our 142nd episode. We've had experts from
Speaker 1: many walks of life on copy time, but a former
Speaker 1: military officer, I'm quite sure if that's a first today.
Speaker 1: I'm looking forward to having a chat with gov Ky,
Speaker 1: head of Advisory and Emerging Business at Ensign Infosec Security.
Speaker 1: His advisory firm helps organizations boards and leadership navigate cybersecurity
Speaker 1: risks in their digital transformation.
Speaker 1: Previously, Brigadier General Kirti was the Deputy chief executive of
Speaker 1: the cybersecurity Agency of Singapore and the Deputy Commissioner for cybersecurity.
Speaker 1: He was formerly a pilot in the Republic of Singapore
Speaker 1: Air Force and rose to become the Commander of the
Speaker 1: Air Defense and Operations Command K. Kirti. Welcome to Kobe Time.
Speaker 2: Thank you so much for having me looking forward to
Speaker 2: the conversation.
Speaker 1: It's
Speaker 1: great to, great to have you. I've been looking forward
Speaker 1: to this chat gov, I'm going to try to get
Speaker 1: our conversation going with the intersection of geopolitics and cyber security.
Speaker 1: I remember a couple of years ago when Russia's invasion
Speaker 1: of Ukraine began, there were all these fears, particularly in
Speaker 1: Europe
Speaker 1: grids will shut down and hacking will take place and
Speaker 1: then with all the stuff that's going on in the
Speaker 1: Middle East, we've seen Israel, you know, do cyber attacks
Speaker 1: on Iran's nuclear facility. Iran has tried to match, I
Speaker 1: think they have failed to match the Israelis, but they've tried.
Speaker 1: So there are all sorts of things going on. So
Speaker 1: tell us a little bit about that area where geopolitics
Speaker 1: collides with cybersecurity.
Speaker 2: Sure. So that's a fascinating question. It's a great place
Speaker 2: to start because there's so much happening there.
Speaker 2: And it's probably the place where most people read about
Speaker 2: it in the news. That's the stuff that grabs the headlines.
Speaker 2: But let me step back a little bit just to
Speaker 2: help people understand why it's become such an intersection. Fundamentally,
Speaker 2: the internet is insecure. It was not built securely. It
Speaker 2: was built by a bunch of tech nerds and universities
Speaker 2: to help them share information. So it's never built to
Speaker 2: be that robust to withstand that kind of attacks, the
Speaker 2: stuff that we built on top of it, all the
Speaker 2: software or the content
Speaker 2: also not built with security in mind. There's this whole
Speaker 2: movement now to make things secure by design because surprise
Speaker 2: they were not secure by design.
Speaker 2: The second thing about the internet that we need to
Speaker 2: understand is that there is an asymmetry, Attackers have the advantage.
Speaker 2: It is the only place where you can get robbed
Speaker 2: from 1000 miles away. And in the physical world, you
Speaker 2: have your wallet, you have your phone in your pockets.
Speaker 2: As long as you keep your hands nearby, you can
Speaker 2: avoid being pickpocketed because somebody has to come up close
Speaker 2: to you. There's a physical proximity to a real world robbery.
Speaker 2: But in the digital world, firstly, it's built insecurely. And secondly,
Speaker 2: there's this geographical depth that people can have, the Attackers
Speaker 2: can rob anything anywhere
Speaker 2: you put those two together and you have a toxic
Speaker 2: and potent combination for Attackers running wild. So that's the
Speaker 2: starting point.
Speaker 2: There are three types of Attackers that we talk about
Speaker 2: when we talk about geopolitics and generally cyber attacks. The
Speaker 2: first are the ones that are state sponsored. There are
Speaker 2: some bad guys out there who it's their day job.
Speaker 2: They are funded by either the government or the military
Speaker 2: of that country to specifically go after digital targets. And
Speaker 2: that's that, that day job. Their mission, they work 9
Speaker 2: to 5 hours and that's what they do.
Speaker 2: There's another group which are ideologically motivated.
Speaker 2: They can be sometimes state affiliated. They believe in the
Speaker 2: vision of their country. You mentioned Russia, Ukraine. That was
Speaker 2: a very good example. I'll talk about that later on
Speaker 2: and they want to push a certain message out. Sometimes
Speaker 2: it's cause based, sometimes it's country based, sometimes it's supporting
Speaker 2: their country in war.
Speaker 2: The third group are the straightforward ones, criminals. They just
Speaker 2: want the money. But in geopolitical contest, sometimes they want
Speaker 2: money to sponsor activities that their cause is doing or
Speaker 2: sometimes they want the money to loot while there's a ramp,
Speaker 2: while there's chaos going on.
Speaker 2: So those are the Attackers. Now we come to the
Speaker 2: geopolitics itself and the stuff that we're reading about. The
Speaker 2: most exciting event in the last couple of weeks was
Speaker 2: the US election.
Speaker 2: Elections are a great time for Attackers to go to
Speaker 2: work for a number of reasons. Those who are state
Speaker 2: sponsored Attackers,
Speaker 2: they want to influence the outcome. Some countries want their
Speaker 2: preferred candidate to win. Some countries want just so instability
Speaker 2: and discord within a country to make them less effective
Speaker 2: as a competitor. And there are all sorts of narratives
Speaker 2: that go on at play in an election anyways,
Speaker 2: a lot of the attacks that you usually read about
Speaker 2: are information attacks, fake news about this candidate, fake news
Speaker 2: about that party, fake news about this incident. That's the
Speaker 2: information space,
Speaker 2: but there's a lot of attacks that happened on not
Speaker 2: just election infrastructure but technical infrastructure in the run up
Speaker 2: to an election to cause people to lose a little
Speaker 2: bit of faith in the prevailing party or system.
Speaker 2: One of the most compelling hacks that we saw in
Speaker 2: recent years was the Democratic National Congress hack where a
Speaker 2: whole bunch of emails were leaked out. Was there anything
Speaker 2: terribly damaging in the emails? Not really, but it cast
Speaker 2: shadow over the particular candidate that was hacked and in
Speaker 2: the end, that can be lost because of the hack,
Speaker 2: maybe not but became enough of a trending conversation. Obviously,
Speaker 2: since then, all of the candidates have learned how to
Speaker 2: protect themselves and to protect themselves a bit better in
Speaker 2: an election.
Speaker 2: But geopolitics and cyber interface most sharply when it comes
Speaker 2: to elections.
Speaker 1: Can I ask you one
Speaker 1: question, elections, electronic voting
Speaker 1: machines?
Speaker 2: That's a great question. So look, there is this conference
Speaker 2: in the US called De Corner Love it. It's a
Speaker 2: conference where
Speaker 2: many industries have conferences. This is an industry conference among
Speaker 2: the bad guys. So they come together and they're not
Speaker 2: really bad people. They just people who are interested in
Speaker 2: how things work and how to break things. So they
Speaker 2: get together, we call them white hats. Some of them
Speaker 2: are gray hats, some of them are black hats, which
Speaker 2: means they operate in the not so legal realm of work.
Speaker 2: But one of the things that they do is they
Speaker 2: look at election voting machines, electronic voting machines and they
Speaker 2: try to see if they can break it.
Speaker 2: Surprise, surprise, all of the voting machines can be broken,
Speaker 2: they can all be interfered with. And the challenge is
Speaker 2: that actually building an an election system at scale in
Speaker 2: a large country which is completely immune to disruption or
Speaker 2: interference is incredibly expensive and difficult
Speaker 2: as a result. Most countries still use paper ballot,
Speaker 2: much harder to interfere with that. But even then, even
Speaker 2: if you're voting on paper at some point, you have
Speaker 2: to count the number of slips and send that electronically
Speaker 2: to somebody else. Those systems are also part of the
Speaker 2: whole machinery that people try to interrupt. And even if
Speaker 2: you can change the result, just disrupting the sending of
Speaker 2: data from one state back to central
Speaker 2: has significant implications. There's timelines they need to meet if
Speaker 2: your system goes down and you can't meet that count
Speaker 2: before the clock ends.
Speaker 2: What does that mean? Is it an invalid election? Do
Speaker 2: you need to do it again? Is there doubt over
Speaker 2: the quality of the results? Just showing that kind of
Speaker 2: doubt is enough. So electronic voting machines, people have been
Speaker 2: studying them for a while but the cost of implementing
Speaker 2: them at scale, I mean for a small country like Singapore,
Speaker 2: maybe you can get away with it. But for a
Speaker 2: much larger country which is geographically spread out, it's expensive.
Speaker 1: We've had some really large elections this year. Indonesia, India,
Speaker 1: United States. So literally billions of people have voted this year.
Speaker 1: So shall we take some comfort in that this year
Speaker 1: was not characterized by hiking related risks on elections?
Speaker 2: I
Speaker 1: think.
Speaker 2: So we can take some comfort from it, but I
Speaker 2: will
Speaker 2: color it slightly differently.
Speaker 2: There were enough other reasons for cyber Attackers to go
Speaker 2: on war without having the elections as the primary target
Speaker 2: this year. As you mentioned at the start was there's
Speaker 2: conflict between Russia and Ukraine. Still the Middle East conflict
Speaker 2: has really expanded. The East West tensions have also grown
Speaker 2: quite significantly, particularly China and the West. In terms of
Speaker 2: tech application, there are layers and layers than the South
Speaker 2: China Sea in Taiwan. There's layers and layers of confrontations
Speaker 2: happening around the world.
Speaker 2: There's enough reasons for people to be involved in cyberattacks
Speaker 2: already without having to target specifically elections. So that's the
Speaker 2: not so good news of it
Speaker 1: when we talk about ju political actors who are adversaries.
Speaker 1: But are you telling me that sometimes they are also
Speaker 1: going after a very mundane private sector stuff which we
Speaker 1: might think that actually are targets of playing. They are
Speaker 1: bad guys. But actually those 9 to 5 guys who
Speaker 1: are getting paid to work for a country or a
Speaker 1: cause are also doing what we think are just like
Speaker 1: going after companies ransomware or companies. Yeah.
Speaker 2: Yeah. So there's a really difficult line to draw between
Speaker 2: pure espionage state actors and then the cyber criminal gangs.
Speaker 2: I'll give you one specific example. So North Korea, there's
Speaker 2: a group called Lazarus, the Lazarus group which is strongly
Speaker 2: affiliated to them. They go after the financial sector targets
Speaker 2: in ransomware. Usually if your browser slows down, they are
Speaker 2: the culprits, they're crypto mining on your, on your systems
Speaker 2: and they've done some really fascinating hacks including I think
Speaker 2: a couple of years ago the Bangladesh Bank Heist, which
Speaker 2: in and of itself should at some point be made
Speaker 2: into a Hollywood movie. They are already podcasts and there's
Speaker 2: a show about it which you should watch, but
Speaker 2: they are both financially motivated and state motivated in the
Speaker 2: sense that North Korea has a number of restrictions on
Speaker 2: what they can do to earn money.
Speaker 2: Cybercrime is a great way to augment that. And there
Speaker 2: are some uh kind of uh studies floating around that
Speaker 2: suggest that close to a third of North Korea's income
Speaker 2: comes out of the Lazarus group.
Speaker 2: It is. If you imagine what a third of your
Speaker 2: GDP A contribute to that would be looking like that's
Speaker 2: huge for a country. So that is the kind of
Speaker 2: scale that they operate in now. Are they purely commercial?
Speaker 2: Are they purely state sponsored? Nobody really knows, how much
Speaker 2: do they get to keep themselves? We're also unclear. But
Speaker 2: we do know that if you have access to high
Speaker 2: speed internet in North Korea,
Speaker 2: somebody gave you that access, you didn't just walk into
Speaker 2: a store and buy a modem and like log in,
Speaker 2: somebody gave you that access, somebody is allowing you to
Speaker 2: have that kind of connectivity. If you're logging in through
Speaker 2: VPN servers that connect through places, we think our embassies
Speaker 2: in overseas countries, somebody is allowing you to route that traffic.
Speaker 1: OK. I want to stay with your politics. But before that,
Speaker 1: on that very specific question, North Koreans who have massive
Speaker 1: sanctions and restrictions on receiving payments are still getting ransomware done.
Speaker 1: So they are settling in Cryptocurrency.
Speaker 2: There are. Yes. So they are settling in Cryptocurrency. And
Speaker 2: in fact, if you look at the whole ecosystem of ransomware,
Speaker 2: which is another fascinating topic, might as well get into it.
Speaker 2: It's a fun area. Ransomware has evolved from being a
Speaker 2: very niche, bespoke technical attack to being an ecosystem. It's
Speaker 2: an entire economy out there. In fact,
Speaker 2: there are estimates that if you add together the entire
Speaker 2: cyber criminal ecosystem in the world, it is the third
Speaker 2: largest economy,
Speaker 2: it is the third largest economy in the world. That's
Speaker 2: how much money is being floating around. Now. Obviously, it's
Speaker 2: hard to estimate what it actually is because a lot
Speaker 2: of it is in Cryptocurrency and Cryptocurrency today could be
Speaker 2: the
Speaker 2: could be 95,000, it could be 80,000, it could be
Speaker 2: 10,000 depending on what happens. So it's really hard to
Speaker 2: estimate the value, but it is huge. Cryptocurrency provides a
Speaker 2: great way for people to obfuscate their intentions and their transactions.
Speaker 2: Even though a lot of the legitimate cryptocurrencies, we talk
Speaker 2: about Bitcoins advertise themselves as having the ledger that give
Speaker 2: clarity and transparency of transactions.
Speaker 2: There are alternative cryptocurrencies like Monro for example, and if
Speaker 2: you go to, please don't. But if you ever visit
Speaker 2: the Monro website, the logo is actually a policeman with
Speaker 2: a cross through it. That's their logo you can only
Speaker 2: imagine the kind of services that they offer and that
Speaker 2: is their logo.
Speaker 2: So they are deliberately trying to hide things. There are
Speaker 2: systems in place in that ecosystem of ransomware that allow
Speaker 2: you to money launder, they call them laundromats you put
Speaker 2: in Bitcoin, it mashes it up with 3040 different other currencies,
Speaker 2: sends it out to different accounts, sends it back, send
Speaker 2: it out, sends it back and eventually when it reaches
Speaker 2: the final destination,
Speaker 2: it's untreatable.
Speaker 2: And so that's why law enforcement has this huge challenge
Speaker 2: figuring out how did the money get out and how
Speaker 2: did money who's receiving it at the other end?
Speaker 2: Um Cryptocurrency unfortunately means that these transactions can happen anywhere
Speaker 2: and everywhere. And the fiat banking system doesn't have the
Speaker 2: KC visibility into what happened. Um And again, there is
Speaker 2: a difference between the more legitimate cryptocurrencies that are out
Speaker 2: there and the ones that are illegitimate, but they all
Speaker 2: have the same function getting money from one place to
Speaker 2: the other. One of the more interesting functions that you
Speaker 2: see on the ransomware ecosystem is customer service.
Speaker 2: You probably have no idea how to get my narrow.
Speaker 2: But if you get ransom, you can call somebody. And
Speaker 2: in any language you choose, they will walk you step
Speaker 2: by step how to set up a wallet, how to
Speaker 2: get the Cryptocurrency and how to transfer to their preferred
Speaker 2: account and their customer service. No offense is better than
Speaker 2: most banks because 24 7, they have a huge financial
Speaker 2: incentive to get you to pay them their $3 million.
Speaker 2: And these are not small sums of money we're talking
Speaker 2: about
Speaker 1: just on that issue of
Speaker 1: you, you share with us some estimates of how large
Speaker 1: this cybercrime economy is. How do we differentiate between things
Speaker 1: that we hear about? Gets reported to say Interpol or
Speaker 1: Singapore's security services and stuff that people just don't report
Speaker 1: because they're embarrassed or they feel that it will make
Speaker 1: their company look weak if they were to report that.
Speaker 2: That's a, that's a real challenge. So, within the law
Speaker 2: enforcement system, we're quite aware that what we see in
Speaker 2: terms of reporting is the tip of the iceberg. And
Speaker 2: the vast majority of people who suffer some form of
Speaker 2: cyber attack either don't see a need to report it
Speaker 2: or like you said, have challenges in reporting it. Maybe
Speaker 2: I'll give two quick anecdotes. One is fascinating.
Speaker 2: There was an attack on a financial institution in the
Speaker 2: US and the cyber Attackers came in, they attacked the
Speaker 2: company and the company tried to keep it quiet. This
Speaker 2: was a listed company. The cyber Attackers then filed an
Speaker 2: sec report complaining that the victim did not file a
Speaker 2: material breach notification in time with the sec.
Speaker 2: The Attackers filed an S ECs EC reports are not
Speaker 2: easy to file. So these guys went through the trouble
Speaker 2: of filing that to basically punish this person punish the
Speaker 2: company like, hey, you're not paying me ransom and you're
Speaker 2: not revealing to the regulators. I got you.
Speaker 2: So that's the level of kind of complexity that we
Speaker 2: live in. Now, these guys are really sophisticated.
Speaker 2: The whole ecosystem has just evolved to a point where
Speaker 2: there's a, so there's the open internet that we talk
Speaker 2: about your things that you can find with the Google search.
Speaker 2: There's the deep web, your whatsapp chats and signal chats
Speaker 2: and stuff that they're on the internet, but they're hard
Speaker 2: to search. And then there's the dark web
Speaker 2: when we talk about estimates on the financial transactions that
Speaker 2: are happening out there, that's what people monitor. That's where
Speaker 2: we get maybe not a source of truth, but a
Speaker 2: second perspective on how much money is slushing around in
Speaker 2: this ecosystem because that's where you see people making the transaction.
Speaker 2: Like I will sell this data for this amount of money.
Speaker 2: I will pay you for that amount of service. I'll
Speaker 2: get this for you. So those transactions are where we
Speaker 2: see the liquidity happening. So
Speaker 1: even beyond the realm of the reporting to the former
Speaker 1: law is absolutely fascinating.
Speaker 1: Um I want to stay on the geopolitical side. Um
Speaker 1: There's a lot of talk about countries, critical infrastructure, electricity
Speaker 1: healthcare database or the way you know, systems run for
Speaker 1: hospitals and airports and so on. Um
Speaker 1: Looking at sort of the data on how many times
Speaker 1: these things are getting compromised. How worried or how relieved
Speaker 1: are you? I mean, are we on top of these things?
Speaker 2: Ok. Um So I am relieved. I live in Singapore
Speaker 2: and I'll say that because so a couple of years ago,
Speaker 2: we pushed this thing called the cyber Security Act. When
Speaker 2: we first pushed it out, it was seen globally as
Speaker 2: a little bit extreme.
Speaker 2: Um forcing private sector companies to meet some sort of
Speaker 2: technical standard by law with the threat of jail. Wow,
Speaker 2: that's an unusual requirement. And when we first push it out,
Speaker 2: there was a lot of pushback from the companies as well.
Speaker 2: I mean, people said, look, it's a, it's a free market.
Speaker 2: If you don't like my hospital, my power service get
Speaker 2: somebody else. Like why are you forcing me to comply
Speaker 2: to these standards?
Speaker 2: But you have to remember that tech is probably the
Speaker 2: only industry that's been immune from regulatory standards for a
Speaker 2: very long time. If you drive a car, you have
Speaker 2: to meet all of these requirements, you fly a plane,
Speaker 2: there are all these requirements, even if you buy a toaster,
Speaker 2: there are requirements about what the toaster safety looks like.
Speaker 2: Tech for some reason has gotten by without it. So
Speaker 2: when we pushed it out, it was quite controversial today,
Speaker 2: more and more countries have some form of technical standard
Speaker 2: requirements in terms of the cyber security of critical infrastructure,
Speaker 2: we've had a head start. So like I said, in Singapore,
Speaker 2: I'm relatively comfortable that most of our critical systems are
Speaker 2: well defended and if they're not well defended enough, they're
Speaker 2: better defended than at least the other targets that might
Speaker 2: be out there. So, I guess the game here is
Speaker 2: just to be to run faster than your neighbor rather
Speaker 2: than the lion. The Attackers are also after money. If
Speaker 2: they can find an easier target, they'll go for that
Speaker 2: globally. Everybody is ratcheting up. So companies, the big companies
Speaker 2: are starting to ask their vendors like are you cyber secure?
Speaker 2: Are you going to introduce risks for me? Uh Countries
Speaker 2: are starting to ask their critical systems, you know, are,
Speaker 2: are my power grids secure? Are my banking systems secure?
Speaker 2: Is my country going to be held hostage or taken
Speaker 2: to its knees by criminal actors? Those are the right
Speaker 2: questions to ask
Speaker 2: but the implementation of regulation to ensure that is incredibly
Speaker 2: difficult and takes a lot of political. Will I go
Speaker 2: back to the Singapore Cyber Security Act? And to some extent,
Speaker 2: it takes almost a criminal negligence point of view. You
Speaker 2: built a hospital and you didn't make it secure. That's
Speaker 2: criminally negligent. People trusted you to build a hospital that
Speaker 2: they can feel confident in. And if you told us
Speaker 2: that you secured it and you didn't, that should actually
Speaker 2: be a jailable offense. So it is extreme, but it
Speaker 2: motivates behavior like more than fines do, at least from
Speaker 2: what we've seen
Speaker 1: when I walk on T road, I walk by the
Speaker 1: international headquarters of Interpol and I think their cybersecurity wing
Speaker 1: is here. Are they and other multilateral organizations trying to
Speaker 1: come up with a set of codes that are universally implement?
Speaker 2: Absolutely. So I spent the last five years prior to
Speaker 2: joining Ensign in the government. And one of the things
Speaker 2: that we did was engage a lot with Interpol and
Speaker 2: also engage a lot with the United Nations.
Speaker 2: To some extent, cyber security is in this odd space
Speaker 2: where it is a problem at state level, but a
Speaker 2: solution at the company level. And I'll explain that. So internationally,
Speaker 2: we need some sort of rules of the road. What
Speaker 2: are the norms and the expectations of countries in the
Speaker 2: way that they use the internet. It took us quite
Speaker 2: a bit of time, but the United Nations has come
Speaker 2: out with what we call the norms of responsible behavior
Speaker 2: and there are 11 norms. They basically state the usual
Speaker 2: expectations of what you can and cannot do on the
Speaker 2: internet and what states should and should not do.
Speaker 2: The good news is that the UN has agreed to them.
Speaker 2: There are some norms of what responsible behavior looks like.
Speaker 2: The bad news is that as with all international agreements,
Speaker 2: some countries are
Speaker 2: more willing to abide by them and some countries blatantly
Speaker 2: flagrantly ignore them.
Speaker 2: We portioned it
Speaker 2: the portion of the countries that have agreed to the
Speaker 2: norms and are trying to implement it. That's, that's the
Speaker 2: ray of hope. That's the part where as more countries
Speaker 2: get on board, as more countries try to understand how
Speaker 2: to secure their critical infrastructure and agree not to attack
Speaker 2: critical infrastructure, we will start to see the seeds of
Speaker 2: a slightly more responsible secure internet coming up.
Speaker 2: But unfortunately, it just takes one bad egg. And if
Speaker 2: they disrespect all of this, if they ignore all of
Speaker 2: it becomes a challenge, Interpol has a huge part to
Speaker 2: play as well because in addition to the states agreeing,
Speaker 2: the police have to enforce the challenge. Now is that
Speaker 2: like I said, it's a state problem and a corporate
Speaker 2: problem
Speaker 2: states on the outcome. So if your water supply is hacked,
Speaker 2: states deal with the problem,
Speaker 2: but water supply is often provided by private companies. Banking
Speaker 2: is private companies. The cloud is private companies. Everything about
Speaker 2: the internet is owned by a private company, the government
Speaker 2: owns nothing of the internet. Even the Telco that provides
Speaker 2: data is a private company.
Speaker 2: So the challenge here is that how do you get
Speaker 2: the private companies to internalize this externality? It is a
Speaker 2: classic economic problem. The cost is significant security is a cost.
Speaker 2: The implications and the outcome of a negative incident is
Speaker 2: some on the company but significantly on the externality of
Speaker 2: the public. How do you internalize this cost? Singapore chose
Speaker 2: regulations to do it. Other countries are trying to find
Speaker 2: other incentives to do it. But no matter what happens,
Speaker 2: the private sector needs to be part of that wider solution.
Speaker 2: And today, not quite
Speaker 1: is it really just a matter of managing the risk?
Speaker 1: Because it doesn't seem to me, you are giving me
Speaker 1: the sense of comfort to think that we can win
Speaker 1: this battle.
Speaker 2: I know. So I'm, I hope I'm not giving you
Speaker 2: the confidence because I don't have that confidence. I, I'm
Speaker 2: a little bit of what we call an octo pass.
Speaker 2: A realist. I hope for the best plan for the worst,
Speaker 2: but I expect reality to come and kick me in
Speaker 2: the stomach. It's, it's a rough world out there. And again,
Speaker 2: cyber security is pretty much the only industry in the
Speaker 2: world which has this dynamic of bad guys. I mean,
Speaker 2: you as a bank, have other competitors. Me as a
Speaker 2: cyber security company, I have other competitors but these competitors
Speaker 2: operate within rules.
Speaker 2: Cyber security and tech is the only space where you
Speaker 2: have an aggressor that doesn't operate within rules and is
Speaker 2: deliberately trying to break you down. We invest in fire
Speaker 2: alarms and buildings but you don't have ar is running
Speaker 2: around trying to set fire to every building to test
Speaker 2: whether your fire alarms work or not. But it cyber security.
Speaker 2: You do and on a daily basis, I'm willing to
Speaker 2: bet that a bank like yours at the scale that
Speaker 2: you operate thousands, hundreds of thousands of probing attacks every
Speaker 2: single day. If not every single minute, the biggest banks
Speaker 2: in the world experience a million attacks an hour,
Speaker 2: a million attacks an hour. So if that scale of
Speaker 2: attacks are happening,
Speaker 2: you just need one to leak through. So I am
Speaker 2: not optimistic that we will solve the problem, but in
Speaker 2: a sense, it's similar to disease control and I'm glad
Speaker 2: that they chose the term viruses for the cyber for
Speaker 2: technical work as well because it is like that
Speaker 2: COVID is now endemic. Will it ever go away? No.
Speaker 2: Will it kill a few people? Unfortunately? Yes. But we
Speaker 2: have ways and strategies to manage the risk of its
Speaker 2: becoming a pandemic. Again, we have ways and risks of
Speaker 2: managing the overall population and its immunity and its ability
Speaker 2: to be resilient. So I guess part of the thinking
Speaker 2: is rather than thinking about how to defeat this whole problem,
Speaker 2: how do we become resilient? How do we as a society,
Speaker 2: as a company, as a, as an organization
Speaker 2: build up resilience? So that even if it does come,
Speaker 2: we've got enough immunity. Yes, you took out database A
Speaker 2: but it was all encrypted and I've got database B
Speaker 2: so I'm still working fine. There's a little bit of impact.
Speaker 2: We're down for 1520 minutes.
Speaker 2: Sometimes we had to go back to manual processes like
Speaker 2: the incident at the airport with crowd strike. Unfortunate, but
Speaker 2: the airport went to manual processes and people even mocked
Speaker 2: that they were writing boarding passes. But that's actually a
Speaker 2: great answer. Look, if you have no it systems have
Speaker 2: a drawer full of boarding passes you can take out
Speaker 2: and write and every single organization needs to think about.
Speaker 2: How do you deal with the implications of the impact
Speaker 2: of a cyber incident in a way that
Speaker 2: degrades gracefully that the customer still has some level of service,
Speaker 2: even if it's not the quality and the black level
Speaker 2: that they're normally used to experiencing.
Speaker 1: So backups redundancies.
Speaker 2: Absolutely.
Speaker 1: This is
Speaker 1: a paper.
Speaker 2: Yeah, I know whatever works for your organization at the
Speaker 2: scale that you operated. So if you're a really sophisticated
Speaker 2: organization having a completely what we call a second chain,
Speaker 2: a completely backup system that fails over immediately and data
Speaker 2: centers have this all the time, they're supposed to be
Speaker 2: able to fail over instantly. But if you're a small shop,
Speaker 2: maybe just have a print out at the end of
Speaker 2: the day, print out all of your customer records. And
Speaker 2: if really your systems get wiped out, you have a
Speaker 2: whole bunch of print outs in a drawer somewhere, you
Speaker 2: can take it back and reconstruct the systems. Is it tough?
Speaker 2: Is it painful? Yes, but it builds resilience. And so
Speaker 2: we've gone away from, and even though I'm a cyber
Speaker 2: security company and we provide advice, our solution is never
Speaker 2: to invest infinitely in protection.
Speaker 2: It's great money for me, but it's not a wise
Speaker 2: strategy for companies. You need to think about investing in
Speaker 2: resilience and that's a balance between protection and bouncing back.
Speaker 2: And if you don't bounce back, that's a business closure event.
Speaker 1: This is Danny K and I think President Turner's trampoline analogy. Yes, absolutely.
Speaker 2: Absolutely. You will fall and you will hit. And we've
Speaker 2: seen when companies get a cyber attack of a ransomware
Speaker 2: or data breach, stock prices get impacted customer trust gets impacted.
Speaker 2: But we've also seen companies bounce back after that. And
Speaker 2: quite often, what we see is that in about 40
Speaker 2: plus days, stock prices return to normal.
Speaker 2: And if the incident is particularly well handled stock prices
Speaker 2: even improve because the company now takes the security much
Speaker 2: more seriously. They are proactive in managing customers expectations and
Speaker 2: trust and they build up better systems and governance around
Speaker 2: their technologies to be more resilient. And so after that,
Speaker 2: the customers and investors like
Speaker 2: they will not get hit by the same thing. Again,
Speaker 2: it's actually a good strategy.
Speaker 1: Right?
Speaker 1: At the beginning of the conversation, we are talking about
Speaker 1: multiple actors and you said that there are state level actors,
Speaker 1: but then you alluded to this non stake idealistic. I
Speaker 1: don't know this crypto anarchists out there who do also,
Speaker 1: you know damage at the geopolitical level. So give us
Speaker 1: some examples and how do we sort of contextualize this entity?
Speaker 2: There
Speaker 2: are all sorts of fascinating examples. So I'll give one
Speaker 2: that's ideological and not
Speaker 2: not state affiliated. So there's this group that operates in Indonesia,
Speaker 2: we think it's a group, it might be an individual
Speaker 2: called Burka.
Speaker 2: And despite the European sounding name, it's actually we think
Speaker 2: it's an Indonesian person, he attacks Indonesian government systems, he
Speaker 2: or she or they attack Indonesian government systems purely to
Speaker 2: send the message that Indonesia needs to invest more in
Speaker 2: cyber security.
Speaker 2: And after every attack, they will send out a message
Speaker 2: saying this system was not well encrypted. This thing was
Speaker 2: not patched.
Speaker 2: It is fascinating to observe. This person is still a
Speaker 2: bad person is still taking down systems, but the ideology
Speaker 2: behind it is to improve cyber security. That's one kind
Speaker 2: of example,
Speaker 2: I'll use Russia and Ukraine as one a separate example
Speaker 2: and probably the start of this whole HIV
Speaker 2: at the initiation of the conflict. When Russia first came in,
Speaker 2: Ukraine was obviously the underdog and Ukraine needed help. What
Speaker 2: they did was they called for assistance from all of
Speaker 2: the Ukrainians living all around the world and all of
Speaker 2: the Ukrainian supporters around the world. They actually created a
Speaker 2: telegram group. I think it was called the Ukrainian Cyber
Speaker 2: army or something along those lines. And they asked people
Speaker 2: for help. It's like, please, you know, we're under attack,
Speaker 2: help us
Speaker 2: at the start. It sounded like a great idea. Rally
Speaker 2: your friends, rally your troops, rally the people out there
Speaker 2: who could support you in this big conflict with an aggressor,
Speaker 1: both for defense and offense. Like
Speaker 2: so it got complicated
Speaker 2: during that conversation. They were like, hey, there are all
Speaker 2: these Russian systems. If you could disable any of them,
Speaker 2: it would make them less effective. And it would help
Speaker 2: us
Speaker 2: essentially what they were doing was they were motivating
Speaker 2: cyber professionals, technical professionals who worked in companies that had
Speaker 2: access to Russian systems to use that privileged access to
Speaker 2: do bad things. Once you turn white hats, ethical hackers
Speaker 2: into unethical hackers by asking them to go after targets,
Speaker 2: you would breach a very fundamental ethical boundary. And that's
Speaker 2: where things started to go a bit wrong once. And we, we,
Speaker 2: we accepted it because we thought Ukraine was the underdog
Speaker 2: and they need all the help that they could get.
Speaker 2: In fact, we even celebrated articles talking about how they
Speaker 2: were so innovative in getting people to support them. Now
Speaker 2: we realize what they've done is they've unleashed. I mean,
Speaker 2: they've opened Pandora's box, they've created a situation where legitimate
Speaker 2: technical professionals are now distrusted. If you are a Ukrainian
Speaker 2: or Russian working in a big tech company,
Speaker 2: your boss is going to look at you and be like,
Speaker 2: are you using your access to do bad things to
Speaker 2: the other guys? Are you an activist? So it's not
Speaker 2: just the traditional kind of criminal groups that are ideologically
Speaker 2: motivated that are going after things. Now it's professionals, once
Speaker 2: you open that space and you look at Now what's
Speaker 2: happening with Israel and Hamas,
Speaker 2: the spectrum of types of Attackers that come out, some
Speaker 2: are directly enabled by States. Ukraine gave a target list
Speaker 2: in a telegram chat group. Israel and Hamas are giving
Speaker 2: motivation to people to support them,
Speaker 2: what we see in particular in this region. So Southeast
Speaker 2: Asia is that there are a lot of ideologically aligned
Speaker 2: groups that are targeting companies that either for or against
Speaker 2: Israel or Hamas. And unfortunately, it's one of those situations
Speaker 2: where damned if you do, damned if you don't.
Speaker 2: If you support Israel. There are groups who support Hamas
Speaker 2: who will attack you. If you support Hamas, there are
Speaker 2: groups that support Israel, they will attack you. If you
Speaker 2: support neither, both will feel that you need to take
Speaker 2: a stand and will attack you as well. So it's
Speaker 2: really a difficult situation with companies and we are seeing
Speaker 2: groups in particular in Malaysia and Indonesia going after targets
Speaker 2: purely on an ideological basis.
Speaker 2: And it's a difficult situation. We're really far away from
Speaker 2: the conflict. It has very little to do with us
Speaker 2: on a day to day basis. But because again, the
Speaker 2: geography of the internet has collapsed,
Speaker 1: I, I was only aware of the product boycott and
Speaker 1: things like that. I wasn't aware that even in this
Speaker 1: part of the world, we have seen cyber related incidents
Speaker 1: based on the Middle East conflict.
Speaker 2: Yeah. So the most visible ones that we see are
Speaker 2: website defacements. So if you have a company website and
Speaker 2: it's poorly secure, some bad guy will take over it
Speaker 2: and put a message saying, you know, you supported either
Speaker 2: Israel or Hamas and you are therefore a bad company,
Speaker 2: you know,
Speaker 2: so those are the most visible ones, but under the surface,
Speaker 2: we see a ton of attacks and sometimes those attacks
Speaker 2: are on systems that are either built by Israeli companies
Speaker 2: or that supporters or vice versa. So there is a
Speaker 2: ton of stuff happening below the sea level that you
Speaker 2: can't really see, but it is happening
Speaker 1: China us.
Speaker 2: That's going to be a fascinating thing to watch, especially
Speaker 2: in the next four years. Um I think one of
Speaker 2: the biggest challenges that we saw was at the start
Speaker 2: of China's kind of technical rise. People didn't quite take
Speaker 2: it as seriously and to some extent, the US industrial
Speaker 2: base had hollowed out already when we had the five
Speaker 2: G debates. A while back, it was not a choice
Speaker 2: between the American five G and the Chinese five G
Speaker 2: because there was no American five G,
Speaker 2: it was all European and they had no alternative to
Speaker 2: offer
Speaker 2: the rise of China's technical innovations in the last few
Speaker 2: years has been tremendous. And I think partly fueled by
Speaker 2: the lessons that they're learning from Russia, Ukraine, what happened
Speaker 2: and I'll kind of jump around a little bit. But
Speaker 2: what happened during Russia, Ukraine was the West decided that
Speaker 2: the best strategy to contain Russia was to isolate them
Speaker 2: on a technical level. So they took them off some
Speaker 2: backing systems, they took them off some international kind of
Speaker 2: technical situations systems and tried to isolate them as much
Speaker 2: as possible.
Speaker 2: China watched and realized that having dependencies on Western technology
Speaker 2: and Western infrastructure was a risk. They already have their
Speaker 2: great firewall, but now they started building their own operating systems,
Speaker 2: their own cloud system, their whole infrastructure, the whole tech stack,
Speaker 2: they're looking at every layer and see which part of
Speaker 2: this do I have a dependency on something that if
Speaker 2: it's taken out, I crumble and they're replacing it. So
Speaker 2: instead of trying to encourage a situation where
Speaker 2: they become more interdependent, they become more independent, I'll explain
Speaker 2: what the problem with that is now. So
Speaker 2: that
Speaker 2: maybe as an analogy that I think it's an African proverb,
Speaker 2: if you live in a village with one shared, well,
Speaker 2: no matter how much my family hates your family and
Speaker 2: your family hates my family, we will never poison that well,
Speaker 2: because there is absolutely no incentive for us to do so.
Speaker 2: The minute I have my well, and you have your, well,
Speaker 2: the incentives flip and the game theory outcome is I
Speaker 2: will try my best to poison your well and you
Speaker 2: will try your best to poison my well,
Speaker 2: in an era where we had one banking system globally
Speaker 2: in an era where we had one technical infrastructure for
Speaker 2: the whole cloud, for the whole internet.
Speaker 2: I had no incentive to poison your. Well, our well,
Speaker 2: our shared well, but when you have a western technical
Speaker 2: ecosystem and an Eastern technical ecosystem and that tech by
Speaker 2: location is completely segregated, the incentives flip and we will
Speaker 2: spend all day trying to poison each other's wells. At
Speaker 2: the point where all of our companies rely on Microsoft
Speaker 2: Windows to power up our systems.
Speaker 2: I'm not going to poison it. I need it as
Speaker 2: much as you do. But if I have my country's
Speaker 2: operating system and you have your country's operating system, it's
Speaker 2: going to be a much more fragile world. So this
Speaker 2: whole idea of de risking, which came about with this
Speaker 2: whole East West conversation came about at the start of
Speaker 2: this whole five G conversation while it addresses the tactical
Speaker 2: risk creates a strategic risk. The tactical risk is yes,
Speaker 2: I no longer depend on Chinese tech or Western tech,
Speaker 2: whichever side you're from.
Speaker 2: But the strategic risk is now, I am going to
Speaker 2: be constantly under a barrage of attacks from the other
Speaker 2: side that will not lead to any sort of stability.
Speaker 2: There is no stable dynamic between this situation. So it's
Speaker 2: going to be very tough.
Speaker 1: This is a fascinating insight. Why aren't people listening to you?
Speaker 1: Because this is, yeah, I I totally relate to this
Speaker 1: point and the fact that in the name of the scheme,
Speaker 1: we're actually increasing vulnerabilities
Speaker 2: because on a very tactical, very short term level, it
Speaker 2: seems to make sense, right? It seems to make sense
Speaker 2: that hey, I I have concerns with the supplier ABC.
Speaker 2: I'm just going to remove supplier ABC. And if supplier
Speaker 2: abcs are from a country that I have general geopolitical
Speaker 2: concerns with, then yes, I'll remove all of those companies
Speaker 2: but that in the longer term and unfortunately most Corporates
Speaker 2: in most countries don't plan and act in very long
Speaker 2: term interests, creates a very unstable equilibrium.
Speaker 2: I have made this point and I'm not alone. There
Speaker 2: are many others who are making similar points. But you
Speaker 2: look at like the Chips Act, you look at de risking,
Speaker 2: you look at all the conversations that are happening on Telco.
Speaker 2: It is a very similar line of logic. The other
Speaker 2: implication for all of this is in terms of great
Speaker 2: power competition. So part of the reason why the US
Speaker 2: started the Chips Act was because firstly, the risking they
Speaker 2: wanted to have onshore chip production capabilities. But secondly, they
Speaker 2: wanted to reignite the industrial base, get tech back up.
Speaker 2: But by doing so, they've also incentivized China to double
Speaker 2: down on. It's their splitting moment. It is there, it
Speaker 2: is their moment to now suddenly spark off. And previously,
Speaker 2: when they would have been in a more interdependent economic system,
Speaker 2: they like, you know, it's OK. I'll get some stuff
Speaker 2: from them, I'll sell some stuff from them there, there's
Speaker 2: an ecosystem of buying and selling and we don't have
Speaker 2: to have all of it on our own.
Speaker 2: But once you make it such an obvious strategy that
Speaker 2: you want to have your own capacity and capabilities, the
Speaker 2: other guy is going to do the same thing. And
Speaker 2: at this point in the technological evolution, China does have
Speaker 2: a little bit of a head start. They have the
Speaker 2: capabilities and the capacity to do a lot of things.
Speaker 1: Actually, I've been thinking about this issue myself, which is
Speaker 1: I think the view in the West, particularly the US
Speaker 1: has been that if you sort of stop the Chinese
Speaker 1: from accessing the latest in tech technology or rather chip technology,
Speaker 1: that there will be a widening gap. I think the
Speaker 1: lesson from the last eight years is that there is
Speaker 1: a whole range of stack on non chip specific technology
Speaker 1: from like building green transition related things to large tractors
Speaker 1: to protein folding. You don't need the two nanometers, what
Speaker 1: the Chinese have, they can get by and do very well.
Speaker 1: And even the journey from say 7 to 5. Now
Speaker 1: when I talk to chips especially, they don't say it's impossible.
Speaker 1: Four or five years ago, people told me it was
Speaker 1: impossible for the Chinese to ever come up with smaller
Speaker 1: chips on their own.
Speaker 1: But even like lithography and stuff, nobody thinks that it
Speaker 1: is only a Sm L's game. Forever. Forever is a
Speaker 1: very long time. So
Speaker 2: no I, so without getting to the technicalities of it,
Speaker 2: I also don't think it's impossible. But I will say
Speaker 2: that even if, even if it takes them a really
Speaker 2: long time, there's a lot of stuff you can do,
Speaker 2: which is more compute. I said it is more condensed, correct.
Speaker 2: And they have scale, right? They have production capacity at
Speaker 2: enormous scale which does not require them to force that
Speaker 2: miniaturization that the West is looking at and it is
Speaker 2: more efficient, it is more effective, etcetera, etcetera. But they
Speaker 2: have scale and they have data, right? Put those two together,
Speaker 2: you look at what A I is happening in China
Speaker 2: and it's tremendous, the scale and the speed that they're
Speaker 2: moving
Speaker 2: at.
Speaker 1: OK. I was waiting for you to mention the word
Speaker 1: A I, all right. So cyber security and A I,
Speaker 2: oh that I think is the game changer on both sides.
Speaker 2: Um I was just involved in conversations again at the
Speaker 2: United Nations looking at how A I is impacted cyber
Speaker 2: from the offensive and the defensive side.
Speaker 2: It is a productivity tool for the Attackers just as
Speaker 2: it is for the defenders. And we're seeing it, we're
Speaker 2: seeing
Speaker 2: amateur maybe beginner Attackers used their version of Chad GPT
Speaker 2: to build out and understand technical vulnerabilities and exploits.
Speaker 2: One of the most apparent examples that ordinary people feel
Speaker 2: is that the quality of phishing emails has gotten better.
Speaker 2: There was an era where we used to all joke
Speaker 2: about the Nigerian Princes and how badly written those emails
Speaker 2: were
Speaker 2: today, you cannot tell the difference between a human and
Speaker 2: a bot. And in fact, there was a period where
Speaker 2: we used to tell people spot the signs of fishing,
Speaker 2: look out for the spelling errors and the grammatical errors
Speaker 2: and the punctuation errors today. If there are no spelling
Speaker 2: errors and no grammatical errors, that's the, that's the phishing
Speaker 2: email because the humans still make typos. I still have
Speaker 2: punctuation errors in my emails.
Speaker 2: We are now in a situation where telling fiction from
Speaker 2: reality is incredibly difficult because of generative A I and
Speaker 2: the Attackers are using it not just for the deep
Speaker 2: fake images and the fake news and all of that,
Speaker 2: but also just to lure people into clicking a link
Speaker 2: to create websites that look incredibly realistic on the fly.
Speaker 2: And that generative A I capability is tremendously powerful in
Speaker 2: their hands.
Speaker 2: The challenges that we are going to see with A
Speaker 2: I being both a productivity tool as well as a
Speaker 2: tool for greater sophistication means that the quality and the
Speaker 2: volume of attacks are going to go up
Speaker 2: on the defender side. It is incredibly useful. And I
Speaker 2: would say that A I in my view does two
Speaker 2: things very well. It finds needles and organizes haystacks, it
Speaker 2: finds needles in the sense that it finds unusual spiky
Speaker 2: behavior
Speaker 2: on a daily basis. Go checks his email from 9
Speaker 2: to 5 suddenly on a Thursday at 3 a.m. he
Speaker 2: sends out a one gigabyte file. That's a needle, that's
Speaker 2: a spiky behavior. That's unusual. Something was wrong, either legitimate
Speaker 2: but unusual or illegitimate. And so it will flag that
Speaker 2: up and say, look, sending out an email of three
Speaker 2: gigabytes is allowed by our system. But this guy, it's
Speaker 2: unusual based on our behavioral analysis and A I is
Speaker 2: great at that.
Speaker 2: The other thing it's great at is organizing haystacks, small
Speaker 2: data points that on their own don't really mean much.
Speaker 2: But if you put them together in an interesting way,
Speaker 2: you get an insight. Like over time, your computer has
Speaker 2: been performing slower and slower over time, the data that
Speaker 2: is sending up to this particular address is increasing a
Speaker 2: little bit by little bit each day. Why would that be,
Speaker 2: what's an insight we can gain from that? So it's
Speaker 2: great at organizing these kind of haystacks.
Speaker 2: You put those two needles and haystacks together and that's
Speaker 2: cyber security. It's trying to understand when there is malicious
Speaker 2: activity inside your corporate network and usually manifest in either
Speaker 2: spiky unusual behavior or a trend of unusual things. And
Speaker 2: if you can catch that early enough, you can stop
Speaker 2: it from becoming an impact. So the whole game now
Speaker 2: is for A I for defenders is to use A
Speaker 2: I in detecting malicious activity inside the networks.
Speaker 2: Attackers still cannot use A I. Once they get it,
Speaker 2: they use it to knock on the door to break in.
Speaker 2: But once they get in, they're on their own, you
Speaker 2: can't bring it with you. It's a huge payload to
Speaker 2: bring into an attack. But defenders have the entire perimeter
Speaker 2: on their own so they can put A I to work.
Speaker 2: And I think at the scale of data that most
Speaker 2: companies are operating at now, you can get a lot
Speaker 2: of fascinating insights. And more importantly, humans can't do it.
Speaker 2: The amount of data that a bank like yours would
Speaker 2: process on a daily basis internally would overwhelm your human operator.
Speaker 2: So you have to use some sort of algorithms or
Speaker 2: A I for it. The challenge we have is that
Speaker 2: A I is a little bit unpredictable by design. It
Speaker 2: is a statistical system and statistical systems inherently work on probabilities,
Speaker 2: which means that there is a 90% chance it's correct.
Speaker 2: There's a 10% chance it hallucinated and give you a
Speaker 2: completely bad answer.
Speaker 2: And that will always be the case. So we need
Speaker 2: to figure out a way to design around that. There's
Speaker 2: a whole other interesting conversation about securing A I itself,
Speaker 2: which today is a very nascent area. We don't quite
Speaker 2: understand how to secure A I because it doesn't work
Speaker 2: like traditional software, traditional software is if this, then that,
Speaker 2: which means if I program a software to say what
Speaker 2: color is the sky, the answer is blue. And if
Speaker 2: it doesn't give me the answer of blue. I'll flag
Speaker 2: up an error and I know somebody hacked my system
Speaker 2: because the answer is not blue. But if you ask
Speaker 2: A I, what color is the sky? Where? Well, it's
Speaker 2: black at night.
Speaker 2: That's true. It's red in the morning. That's true. It's
Speaker 2: gray in London also. True. So it may not ever
Speaker 2: give you blue. But is that an error, is that
Speaker 2: performing correctly?
Speaker 2: You can't build those same security rules to determine if
Speaker 2: the A I is failed because it might just be
Speaker 2: performing as expected. And so securing A I is another
Speaker 2: huge challenge that we're going to see as more companies
Speaker 2: incorporate A I into the infrastructure.
Speaker 1: Our cyber practices are largely driven by infrastructure created by
Speaker 1: very large companies from Aws to Google and then on
Speaker 1: the social media world, all the
Speaker 1: Facebook of the world. So in this new A I
Speaker 1: wave that is now just about two years old. Are
Speaker 1: we seeing large companies play as dominant a role or
Speaker 1: is it becoming a more of a decentralized world?
Speaker 2: But
Speaker 2: you have, so I'll talk about the decentralized portion. First,
Speaker 2: you have a tremendous amount of tools available in the
Speaker 2: open source area in the open source domain that already
Speaker 2: empower a vast number of people to use A I
Speaker 2: at home. You can go to this place called Hugging Face,
Speaker 2: download a model, run it on your Macbook super easy
Speaker 2: and you can do everything from generating poetry to generating
Speaker 2: photographs by yourself. Without the internet, after you've downloaded the models,
Speaker 2: that's a few gigabytes. It's not difficult to do
Speaker 2: at the same time. While it's decentralized to the extent
Speaker 2: that individuals can run their own and build their own models,
Speaker 2: it's also become a game of very high performance compute.
Speaker 2: So part of the reason why NVIDIA is kind of
Speaker 2: surged ahead is because they offer the kind of high
Speaker 2: powered computer that's optimized for A I.
Speaker 2: These cloud service providers and chip manufacturers and the providers
Speaker 2: of high performance compute will run far ahead. The type
Speaker 2: of complex work that they can do. And I'm, you know,
Speaker 2: my company is building many of these tools with them.
Speaker 2: The type of high performance A I things that you
Speaker 2: can do will be fascinating. We are already seeing the
Speaker 2: surge of activity in terms of use cases for A
Speaker 2: I and to some extent, I am far more bullish
Speaker 2: on A I than I ever was on crypto. But
Speaker 2: I do think that this whole space will continue to
Speaker 2: create a lot of productivity and a lot of interesting
Speaker 2: use cases and value for ordinary people and for companies
Speaker 1: and the large companies that we're talking about which have
Speaker 1: all those great M one and M 100 chips. Are
Speaker 1: they being cognizant of the cybersecurity aspect?
Speaker 2: We still operate in a world where the fundamental mantra
Speaker 2: for tech is move fast and break. That's right. And
Speaker 2: there is no better example of what move fast and
Speaker 2: break things looks like than what we saw in terms
Speaker 2: of the governance of open A I very few companies
Speaker 2: have the ability to fire their own board.
Speaker 2: Yeah, very few companies have the ability to fire their
Speaker 2: own board. And at the point where you can fire
Speaker 2: the governance layer for your own company because you want
Speaker 2: to move faster, you have to ask real questions about
Speaker 2: what is the actual
Speaker 2: risk management culture in that organization? How fast are they
Speaker 2: prepared to move and how slow are they prepared to
Speaker 2: take the risks? I offer an analogy with another domain
Speaker 2: of technology where we deliberately slow down cloning, we have
Speaker 2: the ability to do cloning. In the late nineties. I
Speaker 2: think we all read about Dolly. The shape and human
Speaker 2: cloning is eminently possible. Today, bioengineering is also very possible,
Speaker 2: but we as a human society decided, let's slow down.
Speaker 2: This doesn't feel like a good idea. At this point,
Speaker 2: I don't think we should do this. So we slow
Speaker 2: that entire trajectory down.
Speaker 2: That industry is heavily regulated, medical testing, medical experimentation is
Speaker 2: a heavily regulated industry. You cannot try cloning without getting
Speaker 2: into a whole bunch of problems in most countries.
Speaker 2: But tech again is an unregulated space. So A I
Speaker 2: is doing a lot of things and it's adding value,
Speaker 2: but it's not managing the risks very well. And you'll
Speaker 2: see this in every single A I solution out there.
Speaker 2: It's trying its best to prevent it from being used
Speaker 2: to generate deep fake nudes, for example.
Speaker 2: But we have an epidemic right now rampant deep fake news,
Speaker 2: South Korea. It's happening in Singapore. It's happening everywhere in
Speaker 2: the world. How do you stop that? Fake news is
Speaker 2: a general concept.
Speaker 2: It's impossible at this point to stop because everybody has
Speaker 2: access to a simple tool that can create a photograph
Speaker 2: of me doing a bad thing and me and a
Speaker 2: story being written about that bad thing, I can't stop it.
Speaker 2: And you put companies on the defensive all the time.
Speaker 2: The challenge with the big companies is that they are
Speaker 2: going to keep pushing really far and really fast. They
Speaker 2: do say all the right things. So most of the
Speaker 2: big tech companies have great frameworks around ethical A I
Speaker 2: have great frameworks about responsible and secure A I.
Speaker 2: But the actual implementation lacks many of those safeguards because
Speaker 2: it's hard and because it's hard, they may not prioritize
Speaker 2: them all the time. I'm not optimistic that companies will
Speaker 2: take the cloning path for example and slow down deliberately
Speaker 2: so that they're comfortable with
Speaker 2: it.
Speaker 1: The money talks girl, you said that you're very constructive
Speaker 1: on the productivity gains from A I, not as much
Speaker 1: as you have been on crypto,
Speaker 1: but there seems to be a lot of people who
Speaker 1: are really bullish crypto these days as you and I
Speaker 1: speak it's hitting 95,000 Bitcoin. Um One of the appeals
Speaker 1: of crypto is that, you know, it's compute heavy to,
Speaker 1: you know, counterfeit and therefore there's a fixed number of
Speaker 1: bitcoins and the mining gets progressively increased, expensive because of
Speaker 1: all the cryptography element of boundary. And leading us into
Speaker 1: the question of quantum, will that entire infrastructure
Speaker 1: become sort of completely undermined if quantum computing becomes ubiquitous?
Speaker 2: So it will be uh there's a transition, there's a journey.
Speaker 2: And I I do think that there are risk. I
Speaker 2: sit in both conversations. So I'm in conversations with folks
Speaker 2: who are very optimistic on cryptography. I'm also in conversation
Speaker 2: with folks who are very optimistic on quantum.
Speaker 2: Those two conversations rarely intersect because it's it's it's a
Speaker 2: bit of oil and water.
Speaker 2: The whole Blockchain and kind of Cryptocurrency world exists on
Speaker 2: the basis of cryptographic fundamentals. And as you mentioned, the
Speaker 2: cryptographic fundamentals are robust enough such that you need a
Speaker 2: lot of compute in order to break it.
Speaker 2: But if you could break it,
Speaker 2: if you can break the cryptographic fundamentals behind Bitcoin or
Speaker 2: whatever it is,
Speaker 2: you undermine the entire value proposition that that thing offered.
Speaker 2: The argument is that quantum will come out in stages.
Speaker 2: The first stage is the ability to decrypt things
Speaker 2: and the ability to decrypt things will be destructive. It
Speaker 2: will undermine for example, Bitcoin
Speaker 2: more so than some of the other ones because the
Speaker 2: crypto referendums are rather old.
Speaker 2: The challenge with cryptocurrencies is that if you try to
Speaker 2: change the cryptographic fundamentals halfway through, it's really hard. Once
Speaker 2: you end up doing a hard fork, you actually lose
Speaker 2: the previously, you actually lose all of the previous value.
Speaker 2: And it's very difficult to transition that value into the
Speaker 2: new fork. And you've seen this with other cryptocurrencies that
Speaker 2: they have done a hard fork and have lost previous value.
Speaker 2: There are some cryptocurrencies that will come out that are newer,
Speaker 2: that will use more modern cryptographic standards, perhaps even quantum
Speaker 2: resistant post quantum cryptography, but they will be new and
Speaker 2: they won't be the $95,000 guy. So there will be
Speaker 2: this era of transition and difficulty because the first use
Speaker 2: case of quantum computing will be to decrypt.
Speaker 2: Once enough people have access to a quantum computer, then
Speaker 2: you can use it to encrypt,
Speaker 2: then you can have a Blockchain that uses quantum as
Speaker 2: the cryptographic fundamental generator. But we're very far away from
Speaker 2: that at the point where quantum cryptography becomes something that's
Speaker 2: accessible to the ordinary person. We're a decade at least away.
Speaker 2: And the reason why it's different from cloud is because
Speaker 2: quantum is a physics problem. It's not just a scaling
Speaker 2: problem cloud is a scaling problem. If you know Zimbabwe
Speaker 2: wants it. If Brunei wants it, if Singapore wants it,
Speaker 2: it's a scaling problem. And in fact, you don't even
Speaker 2: need to have your own cloud, you just need to
Speaker 2: have access to the internet
Speaker 2: quantum will be different. You will need to have a
Speaker 2: physical environment that's stable enough to actually build a quantum
Speaker 2: computer and very few countries will have access to that.
Speaker 2: And if you look at the programs around the world,
Speaker 2: most of the quantum programs are being sponsored by militaries,
Speaker 2: which indicates, I mean, I'm sure many militaries are interested
Speaker 2: in curing cancer,
Speaker 2: but there will also be other use cases that they
Speaker 2: have for it in terms of espionage. And once you
Speaker 2: start to decrypt internet protocols, decrypt transaction protocols, decrypt cryptographic fundamentals,
Speaker 2: you create that instability. That makes me wonder whether today's
Speaker 2: cryptography based tokens products tools will survive,
Speaker 1: right? So let me broaden that specific discussion in the
Speaker 1: context of geopolitics.
Speaker 1: Um who has the lead in quantum is the us
Speaker 1: way ahead of the Russians and the Chinese and the
Speaker 1: North Koreans.
Speaker 2: It
Speaker 2: is really hard to tell. Um So the Europeans, so
Speaker 2: what we know about is what the West openly declares
Speaker 2: and I think they are quite transparent in terms of
Speaker 2: what they are building and what they're doing. There are
Speaker 2: many open quantum initiatives I was talking to leads at
Speaker 2: some in Geneva and they're pushing this idea of openness
Speaker 2: because they want quantum to be something that people talk
Speaker 2: about and understand
Speaker 2: and used responsibly.
Speaker 2: But there are many other countries who invest in quantum
Speaker 2: that don't tell people what they're doing.
Speaker 2: And so I have no idea whether they are ahead
Speaker 2: or not. My assumption is that the West is currently
Speaker 2: likely to be ahead.
Speaker 2: But we have another trajectory that's come in, that's kind
Speaker 2: of
Speaker 2: made things a bit harder to assess. And I'll explain
Speaker 2: why we assume that research in quantum was a straight line.
Speaker 2: More phd students studying quantum, it will move a little
Speaker 2: bit faster. But now I've got a I
Speaker 2: that a conversation has become a productivity tool for phd
Speaker 2: S as well for the researchers, the types of work
Speaker 2: that they are asking their models to do overnight before
Speaker 2: they come back previously, took a year of phd research
Speaker 2: systems to produce. So we are now seeing a sudden
Speaker 2: change in the trajectory of research in quantum.
Speaker 2: Does that mean it move faster? Does that mean countries
Speaker 2: will suddenly be able to accelerate countries that have A
Speaker 2: I at scale in their domestic environment? Can they do
Speaker 2: more with it? I don't know. So that's the disruptive
Speaker 2: power which I'm not quite sure how the trajectory plays out.
Speaker 2: All I do know is comment everybody A I is
Speaker 2: making a difference in their research and we're seeing things
Speaker 2: move faster.
Speaker 1: This is just so cool. I was going to end
Speaker 1: our conversation with your advice for corporate leaders. I think
Speaker 1: we have talked about it already. We should really stop
Speaker 1: in that really fascinating, brave new world phase go Kirsty.
Speaker 1: Thank you so much for your insights.
Speaker 2: Thank
Speaker 2: you so much. For having me and I hope I
Speaker 2: didn't scare you too much. I am still an optimist
Speaker 2: at heart. I just plan for the worst and we
Speaker 2: figure out how to deal with reality a lot. What
Speaker 2: was the phrase octo realist, realist?
Speaker 1: You heard it for the first time here?
Speaker 1: Uh Thanks to our listeners as well. All 142 episodes
Speaker 1: of copy time are available on youtube and on all
Speaker 1: major podcast platforms including Apple Google and Spotify. Uh The
Speaker 1: podcast was produced by Ken Delbridge from spy studios, Violet
Speaker 1: Lee and Daisy Sherman provided additional assistance. Uh As for
Speaker 1: our research publications, webinars, you can find them all by
Speaker 1: Googling devious research library. Have a great day.